SFC updates FATF monitored-jurisdiction lists for licensees and VASPs
SFC licensees and VASPs must add Bosnia and Herzegovina and Iraq to increased-monitoring country risk and may relax Algeria and Namibia, updating EDD triggers accordingly
Change
On 14 July 2026, the Securities and Futures Commission (SFC) circulated the FATF's 19 June 2026 jurisdiction statements to licensed corporations, SFC-licensed virtual asset service providers and associated entities: the FATF added Bosnia and Herzegovina and Iraq to its Jurisdictions under Increased Monitoring list and removed Algeria and Namibia, while reiterating unchanged calls for countermeasures against the DPRK and Iran and enhanced due diligence for Myanmar.
Why it matters
The operative change is the update to the FATF grey list: Bosnia and Herzegovina and Iraq are now subject to increased monitoring, while Algeria and Namibia have been removed. SFC-licensed corporations and VASPs must reflect these four moves in their country-risk assessments and enhanced-due-diligence triggers — raising scrutiny on relationships and transactions connected to Bosnia and Herzegovina and Iraq, and re-rating Algeria and Namibia on a risk basis. The Call-for-Action designations (DPRK and Iran countermeasures, Myanmar EDD) are reiterated without change. Several plenary outputs are context rather than immediate obligations: the Recommendation 16 cross-border payment-transparency guidance is only out for consultation until 21 August 2026, and the virtual-asset and DeFi updates are yet to be published.
Implications
- — AML/CFT and sanctions-screening teams at SFC-licensed corporations and virtual asset service providers must add Bosnia and Herzegovina and Iraq to their increased-monitoring country-risk lists and apply enhanced due diligence to business relationships and transactions connected to those jurisdictions, since the FATF now designates them for increased monitoring.
- — The same teams should re-rate Algeria and Namibia on a risk basis following their removal from the increased-monitoring list, adjusting EDD triggers rather than treating either as automatically higher-risk on FATF grounds, while retaining any risk factors identified independently.
- — Compliance teams must retain existing countermeasures against the DPRK and Iran and enhanced due diligence for Myanmar — these Call-for-Action designations are unchanged, so no relaxation is warranted, and Myanmar faces possible countermeasures if the FATF finds insufficient progress by October 2026.
Who is affected
- — AML/CFT and sanctions-screening teams at SFC-licensed corporations
- — AML/CFT compliance teams at SFC-licensed virtual asset service providers and associated entities
What to watch
- — 21 August 2026 — FATF public consultation on strengthened Recommendation 16 cross-border payment-transparency guidance closes.
- — October 2026 — FATF to consider countermeasures against Myanmar if no further progress is made.