by Aarti Thakor [1]
The Financial Action Task Force (FATF) publishes an updated list of “Jurisdictions under Increased Monitoring”, commonly called the grey list after each of its three plenary sessions a year. A jurisdiction is placed on the list when FATF identifies strategic deficiencies in its anti-money laundering and counter-terrorist financing (AML/CFT) regime and the country makes a high-level political commitment to an agreed action plan. As recommendation 8 on protecting non-profit organisations (NPOs) from terrorist financing abuse and Immediate Outcome 10, feature heavily in these action plans, this article looks at jurisdictions currently or recently under increased monitoring and the recurring NPO-related deficiencies FATF identifies, to show what countries need to keep in mind as they navigate the relevant requirements.
The Current Picture
At FATF’s February 2026 plenary, the following jurisdictions remained under increased monitoring: Algeria, Angola, Bolivia, Bulgaria, Cameroon, Côte d’Ivoire, the Democratic Republic of the Congo, Haiti, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Namibia, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK), and Yemen. Of these, a clear majority carry an explicit NPO or R.8-related action item, that is, FATF has identified the country’s approach to identifying, assessing, or supervising at-risk non-profit organisations as a specific strategic deficiency requiring remediation, rather than treating NPOs as a peripheral or already-resolved issue.
This is notable because it shows R.8/IO.10 compliance is not a formality: even after FATF’s 2023 revision of Recommendation 8 narrowed its scope to a defined, risk-assessed subset of the sector and emphasised proportionality, national authorities are still struggling to build the evidence base, such as sectoral risk assessments, targeted (not blanket) oversight, and outreach, that FATF now expects as the baseline for effective implementation. Of the countries referred to however, not all have been assessed fully under the revised R.8 or have at least had a full Mutual Evaluation under the new methodology, so this should be borne in mind.
“R.8 compliance is not a formality.”
Recurring or Thematic NPO-related Deficiencies
Four recurring patterns appear to emerge from the grey listed jurisdictions:
-
Absent or immature NPO terrorist-financing risk assessments
The single most common deficiency is the absence of a granular, evidence-based sectoral risk assessment. This is often compounded by a lack of consensus in identifying which subset of NPOs actually falls within the FATF’s functional definition and faces genuine TF risk. Cameroon’s action plan requires it to implement “a risk-based approach to NPOs without disrupting or discouraging legitimate NPO activities”; Algeria’s calls for “implementing a risk-based approach to oversight of non-profit organisations, without disrupting or discouraging legitimate activity”; and South Sudan’s plan requires it to commence “implementation of targeted risk-based supervision/monitoring of NPOs at risk of TF abuse”, a task on which FATF has noted only limited progress after all deadlines expired.
-
Disproportionate NPO sector treatment
A second, more endemic pattern is where a jurisdiction treats the entire NPO sector, or a broad swathe of it, as high risk without an adequate underlying assessment, which is precisely the misapplication the 2023 revision of R.8 was designed to correct. Venezuela is the clearest current example. FATF’s action plan for Venezuela requires it to ensure “measures to prevent the abuse of NPOs for TF are targeted, proportionate, and risk-based and do not disrupt or discourage legitimate activities within the NPO sector,” and FATF states it is “especially concerned about Venezuela’s approach to conducting oversight of the NPO sector,” calling on the government to “urgently consider whether certain sections of the November 2024 NPO law should be re-examined and potentially altered” to align with FATF’s risk-based approach and its Best Practices on R.8. Venezuela’s November 2024 law (the Law for the Control, Regularisation and Operation of NGOs and Non-Profit Organisations), which imposes annual disclosure of funding sources, activities and leadership, bars funding for a broad range of disfavoured activities, and grants the executive wide powers to monitor and penalise organisations, sanctions that human rights bodies and the UN Fact-Finding Mission on Venezuela have warned could curtail civil society activity generally. This is a rare instance of FATF publicly and specifically criticising a named piece of domestic legislation as inconsistent with the risk-based approach it requires.
FATF’s earlier mutual evaluation of Venezuela, conducted by the Caribbean Financial Action Task Force (CFATF), had already found that the country’s own assessment, that NPOs are its highest TF risk, was “not based on an in-depth sectoral assessment,” and that the resulting blanket “high-risk” categorisation of NPOs as customers for all reporting entities was not justified under the FATF Standards. Civil society commentators have described this finding as a useful precedent for calling out disproportionate regulation in future mutual evaluations of other countries.
-
Weak outreach and sector engagement
A third recurring theme is insufficient outreach and targeted monitoring. Countries setting rules for NPOs without adequately consulting or educating the sector on TF risk indicators remains problematic. In the context of monitoring, Kenya’s action plan requires it to “revise the framework for NPO regulation and oversight to ensure that mitigating measures are risk-based and do not disrupt or discourage legitimate NPO activity”; Lebanon’s requires “targeted and risk-based monitoring of high-risk NPOs, without disrupting or discouraging legitimate NPO activities,” alongside its broader deficiencies on beneficial ownership and sanctions; and Nigeria’s action plan, prior to its exit from the grey list, specifically required “risk-based and targeted outreach to NPOs at risk of terrorism financing abuse” as a distinct action item, separate from broader AML/CFT reforms.
-
Non-disruption as baseline standard
Perhaps the most striking structural trend is that in virtually every current action plan that references NPOs, FATF appends the same proportionality caveat, which is that measures must not “unduly disrupt or discourage legitimate NPO activities.” FATF’s own grey list publications now carry a standing instruction that, as jurisdictions act on the information in the list, “they should ensure that flows of funds for humanitarian assistance, legitimate NPO activity and remittances are neither disrupted nor discouraged,” with an express cross-reference to UN Security Council Resolution 2761 (2024) on humanitarian exemptions to asset-freezing measures. This repetition is deliberate: it reflects FATF’s institutional acknowledgement, following its multi-year unintended-consequences project, that misapplication of its own standards had itself become a source of harm to the sector, through de-risking, financial exclusion and suppression of legitimate civil society activity. Whilst these issues are not always causatively attributable to governments directly, the key point remains that a positive non-interventionist environment is an appropriate starting point for the NPO sector, and that remains itself a positive message.
Country Case Highlight
-
Venezuela: disproportionate regulation
Grey-listed since June 2024, Venezuela remains the leading current example of FATF directly challenging a government’s approach to NPO regulation, citing its November 2024 NGO law as potentially inconsistent with the risk-based approach. This is a useful illustration of how a comprehensive NPO statute which covers heavy disclosure duties, broad funding restrictions, wide executive discretion to sanction can fail FATF’s proportionality test if it is not grounded in a genuine sectoral risk assessment.
-
South Africa: sectoral risk assessment
South Africa, grey-listed in February 2023, addressed its IO.10-related gap by publishing a national NPO Terrorist Financing Sectoral Risk Assessment in April 2024 (the TF NPO-SRA), a multi-stakeholder exercise involving the South African Revenue Service, National Treasury, the Financial Intelligence Centre and the Department of Social Development, which identified Public Benefit Organisations as the primary FATF-defined at-risk NPO subset and flagged the issue of unregistered NPOs operating outside regulatory oversight. FATF removed South Africa from the grey list at its October 2025 plenary, welcoming its progress, though South Africa’s own regulator has emphasised that “delisting is not the finish line” and that reforms must be sustained ahead of the next round of mutual evaluations. This sequence of evidence-based sectoral risk assessment feeding into demonstrable, proportionate monitoring, is close to the model FATF’s guidance now recommends other jurisdictions follow.
“Delisting is not an endpoint: NPOs should expect continued, and potentially more sophisticated, risk-based oversight rather than relief.”
-
Nigeria: NPO Outreach
Nigeria, grey-listed in February 2023, was set a specific commitment to conduct risk-based and targeted outreach to NPOs at risk of TF abuse, and to implement risk-based monitoring for that subset without disrupting legitimate activity, as one of its action-plan items. Nigeria was removed from the grey list in October 2025 after an on-site assessment, with its financial intelligence unit noting that all identified action items, including the NPO-specific one, had been addressed, alongside broader reforms such as its beneficial ownership register. Notably, Nigeria’s Money Laundering (Prohibition) Act amendments during this period also delisted NPOs from the list of obliged reporting entities (designated non-financial businesses and professions), consistent with the 2023 R.8 revision’s clarification that NPOs should not automatically be treated as reporting entities subject to full customer due diligence obligations.[2] Again, this is a helpful indication of baseline expectations favouring freedom from unnecessary scrutiny of NPOs.
-
Algeria, Cameroon, Kenya, Lebanon and South Sudan: risk based actions
Several jurisdictions currently on the list have explicit, unresolved NPO-related items as at February 2026. Algeria’s action plan, though FATF has made an initial determination that the country has substantially completed it pending an on-site verification visit, includes implementing risk-based NPO oversight without disruption to legitimate activity. Cameroon, on the list since 2023 with all deadlines now expired, still needs to implement a risk-based approach to NPOs without disrupting legitimate activity, alongside unresolved targeted financial sanctions gaps. Kenya must revise its NPO regulatory framework to ensure proportionality as part of a broader seven-point remaining agenda. Lebanon, which is working within a challenging domestic context, must undertake targeted, risk-based monitoring of high-risk NPOs specifically, rather than the sector as a whole. South Sudan, on the list since 2021 with FATF noting only limited progress, has not yet commenced targeted risk-based oversight of NPOs at all.
The 2025 Procedural Safeguard
A recent institutional development gives these trends added significance. In 2025, FATF introduced a new procedure allowing FATF or FSRB (FATF-style regional body) members, the International Monetary Fund, or the World Bank to formally raise concerns where a country’s misapplication of the NPO standards is unduly disrupting or discouraging legitimate NPO activity. Under the procedure, once two or more qualifying parties report such concerns, FATF’s Evaluations and Compliance Group must assess whether there is sufficient evidence to proceed with further action, in coordination with the affected country. FATF has framed this as ensuring there are “no gaps” in its ability to address unintended consequences, building on the existing mutual evaluation process rather than replacing it. FATF also continues to invite direct input from NPOs and civil society organisations ahead of scheduled mutual evaluations and on-site visits, provided at least two months before the indicated on-site date.
Practical Consequences of Recent Case Studies
In light of the above, the following observations emerge:
- Organisations should be mapped against the FATF functional definition, not the local statutory label. R.8 only applies to organisations that fall within FATF’s functional NPO definition : entities that primarily raise or disburse funds for charitable, religious, cultural, educational, social, fraternal or similar “good works” purposes. If a national law imposes NPO-style obligations on a broader class of entities than this definition captures, that in itself may be evidence of the kind of over-application FATF’s 2023 revision and 2025 procedure are designed to correct, and a fact worth documenting for advocacy or engagement purposes.
- Is there a published NPO sectoral risk assessment? Where a jurisdiction has, like South Africa, completed a national or sub-national assessment, that document defines which NPO categories are treated as higher risk and why, and should shape the risk-based compliance governance, financial controls and due diligence requirements. Where no such assessment exists, or where regulation appears to apply uniformly regardless of risk, that gap is itself relevant when engaging with regulators or banks that are over-applying AML/CFT requirements.
- The danger of blanket “high risk” labelling by financial institutions using FATF’s own language. Where a bank declines services, delays onboarding, or imposes disproportionate due diligence purely because an entity is an NPO, it is worth pointing the institution to FATF’s own position that R.8 does not require countries to designate NPOs as obliged reporting entities or to apply blanket customer due diligence, and that only a small subset of NPOs face genuine TF risk. Citing the specific language FATF used to criticise Venezuela’s blanket approach, that a “high-risk” categorisation of the whole sector is not justified absent an in-depth sectoral assessment, can be a useful reference point in derisking disputes.
- FATF actively compiles input from NPOs and civil society ahead of mutual evaluations to help assessment teams understand the real-world impact of a country’s R.8/IO.10 implementation. Umbrella bodies and coalitions (for example, national NPO associations or regional civil society networks) are often best placed to coordinate sector-wide submissions; FATF’s lists in its mutual evaluation calendar upcoming on-site dates in a relevant jurisdiction and the two-month submission window.
- If a jurisdiction has recently exited the grey list, expect continued scrutiny, not relief. Regulators in South Africa and Nigeria have both been explicit that delisting is not an endpoint: both remain subject to post-observation monitoring and are preparing for the next (fifth) round of mutual evaluations. NPOs in recently delisted jurisdictions should expect continued, and potentially more sophisticated, risk-based oversight rather than a relaxation of it, and should keep governance and financial-control documentation current accordingly.
- Watch for new or amended NPO-specific legislation and test it against the proportionality principle. Where a government under increased monitoring proposes new NPO legislation, the Venezuela example is instructive: broad disclosure duties, funding restrictions and wide executive sanctioning powers applied to the whole sector, rather than a defined, risk-assessed subset, are the pattern FATF itself has now publicly flagged as inconsistent with its standards. Advisers assisting NPOs or coalitions responding to draft legislation in an affected jurisdiction can usefully frame submissions by reference to this precedent.
“FATF’s own products now provide concrete, citable language to challenge over-broad regulation and disproportionate de-risking.”
In summary, two years on from the 2023 revision of Recommendation 8, the FATF grey list shows that proportionate, risk-based NPO oversight remains one of the harder items on national action plans to close out. The practical opportunity is that FATF’s own products, that is, its action plans, its Best Practices Paper, and its 2025 unintended-consequences procedure, now provide concrete, citable language to challenge over-broad domestic regulation and disproportionate de-risking by financial institutions, rather than leaving proportionality as an abstract aspiration. The real question remains in interpretation, but at least the path is visible.
[1] Aarti Thakor is a leading English charity barrister in Mishcon de Reya and served as the English and Welsh Charity Regulator’s chief legal and accountancy director until 2024. She currently specialises in international charity regulation, governance and philanthropy.
[2] Spaces for Change, ‘EFCC, SCUML KICK OFF SECOND NATIONAL RISK ASSESSMENT OF NPO SECTOR’, noting the Money Laundering (Prohibition) Act 2023 amendment delisting NPOs as designated non-financial businesses and professions.
This project is funded by the European Union.