FATF standards & lists
The Financial Action Task Force (FATF) is an inter-governmental standard-setter founded in 1989 and based in Paris. It writes the 40 Recommendations, the internationally agreed benchmark for combating money laundering, terrorist financing and proliferation financing. FATF is not a law and has no direct enforcement power over private firms; instead it drives national legislation and monitors how well countries implement it. Over 200 jurisdictions have committed to the standards through FATF and its nine FATF-Style Regional Bodies.
The 40 Recommendations cover criminalisation of money laundering, preventive measures (CDD, record-keeping, suspicious-transaction reporting), supervision, transparency of beneficial ownership, and international cooperation.
FATF assesses each country through 'mutual evaluations' — peer reviews scoring both technical compliance with the Recommendations and the effectiveness of the regime in practice.
The grey list, formally 'Jurisdictions under Increased Monitoring', names countries with strategic deficiencies that have committed to an action plan and are actively working with FATF.
The black list, formally 'High-Risk Jurisdictions subject to a Call for Action', names the most serious cases; FATF urges enhanced due diligence and, for the worst, counter-measures.
As of 2024-2025 the Call-for-Action list is Iran and North Korea (DPRK) — subject to counter-measures — plus Myanmar/Burma (enhanced due diligence).
Casinos are named as a 'designated non-financial business or profession' (DNFBP), so the CDD and reporting Recommendations (notably R.22 and R.28) apply to the gambling sector.
Lists are refreshed at FATF's plenary meetings (roughly February, June and October each year), so operators must monitor them continuously rather than treat them as fixed.
Under the Recommendations, casinos are DNFBPs that must apply customer due diligence at or above a designated threshold (USD/EUR 3,000) and report suspicious transactions. FATF's grey and black lists directly shape which customers and payment flows an iGaming operator must treat as higher-risk, feeding country-risk scoring, enhanced due diligence and, for black-listed states, transaction restrictions.
Reference, not advice. This is a teaching summary of the AML framework — not legal advice, and not an operational compliance procedure. Confirm requirements against the primary regulator and your own counsel.