Question 1

How did South Africa's exit from the FATF grey list affect my compliance obligations?

Accepted Answer

South Africa was removed from the FATF grey list (Jurisdictions Under Increased Monitoring) in October 2024, following legislative reform and demonstrated improvements to its AML/CFT supervisory framework. The exit is significant externally - correspondent banks that applied enhanced scrutiny to SA-linked transactions should gradually reduce that pressure. However, the exit does not reduce your institution's domestic FICA obligations. Customer Due Diligence, Enhanced Due Diligence, the Risk-Based Approach, and RMCP requirements remain fully in force. Your RMCP should be updated to reflect South Africa's current FATF status as a compliant jurisdiction. KYCopilot's country risk module updates FATF status in real time across all 200+ covered jurisdictions - so country risk scores always reflect the current listing position, not a static snapshot.

Question 2

Which countries are on the FATF grey list and what must I do when a client is connected to one?

Accepted Answer

The FATF grey list - formally Jurisdictions Under Increased Monitoring - identifies countries with strategic deficiencies in their AML/CFT frameworks. The list is reviewed and updated at each FATF plenary meeting, typically held in February, June, and October each year. When a client is connected to a grey-listed jurisdiction - through nationality, place of business, transaction flows, or corporate structure - FICA's risk-based approach requires you to treat this as an elevated risk factor that will typically trigger Enhanced Due Diligence. The connection and your risk rationale must be documented in your RMCP. Because the list changes regularly, institutions relying on static lists quickly fall out of date. KYCopilot's country risk module monitors FATF grey and black list status in real time across all covered jurisdictions, so changes are automatically reflected in your client risk assessments.

Question 3

How do I assess geographic risk for a client with offshore interests or cross-border transactions?

Accepted Answer

Geographic risk assessment requires evaluating the risk profile of every jurisdiction to which a client is exposed - not just their primary country of incorporation or residence. Under FICA's risk-based approach, relevant geographic connections include the client's nationality, country of residence, location of business operations, jurisdictions of transaction counterparties, and the domicile of any associated entities. Each jurisdiction should be assessed across multiple risk dimensions: AML/CFT framework maturity, FATF status, sanctions exposure, governance and rule of law quality, geopolitical stability, and sovereign risk. A client with business interests in a jurisdiction with weak AML controls but no formal sanctions designation still presents elevated geographic risk that must be reflected in their risk rating. KYCopilot's country risk module scores all six dimensions across 200+ jurisdictions and integrates this automatically into every EDD report.

Question 4

What is the difference between country risk and sanctions risk in a compliance context?

Accepted Answer

Sanctions risk and country risk are related but distinct assessments. Sanctions risk is binary - a jurisdiction is either subject to a formal sanctions programme (OFAC, UN, EU, FIC SA) or it is not, and transacting with a sanctioned jurisdiction carries clear legal consequences. Country risk is broader - it encompasses the overall AML/CFT, governance, geopolitical, and financial crime environment of a jurisdiction regardless of whether formal sanctions apply. A country can present high compliance risk through weak AML laws, high corruption, or poor rule of law without being formally sanctioned - and that elevated country risk still informs your institution's risk rating of clients connected to that jurisdiction. KYCopilot assesses both: real-time sanctions checks across 12+ lists and multi-dimensional country risk scoring across six separate risk pillars.

Real-time Country Risk Intelligence. 200+ Jurisdictions.

Colour-coded risk at a glance

Comprehensive risk across every dimension

AML/CFT Risk

Sanctions Exposure

Governance & Rule of Law

ESG & Sustainability

Sovereign Risk

Geopolitical Risk

200+ countries & territories

Built into every EDD report

Frequently asked country risk questions

Start your country risk assessment