Cyprus gaming regulator reports FATF removal of four grey-listed jurisdictions

The Cyprus Gaming and Casino Supervision Commission on 3 November 2026 reported that the Financial Action Task Force (FATF) had removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco from its list of jurisdictions under increased monitoring, known as the “Grey List”. FATF announced the changes on 30 October after identifying progress in those jurisdictions’ anti-money laundering and counter-terrorist financing (AML/CFT) frameworks.

For casinos, gaming operators and suppliers, the change is a geographic-risk data point rather than an announced amendment to Cyprus licensing rules. Firms with country-risk tables, customer profiles or transaction-monitoring scenarios that refer to FATF list status should update the four jurisdictions’ classification and preserve an audit trail showing when the change was made. In Atlas’s view, removal from increased monitoring should not be treated as a direction to remove all enhanced controls: the Commission’s notice records progress against strategic deficiencies, not the elimination of country or customer-specific risk.

Three FATF categories remain relevant

The Commission said Vietnam remains on the Grey List. Myanmar, Iran and the Democratic People’s Republic of Korea (North Korea) remain on FATF’s list of high-risk jurisdictions subject to a call for action, referred to as the “Black List”.

That distinction matters operationally. The Cyprus notice presents the four removed jurisdictions, Vietnam and the three black-listed jurisdictions as separate FATF outcomes. A compliance framework that uses only a single “FATF-listed” flag could therefore lose the difference between increased monitoring and a call for action.

The notice does not set out new customer due diligence, reporting or transaction restrictions for Cyprus-regulated gambling businesses. Its supervisory signal is instead that FATF country-status information remains relevant to AML/CFT controls and should be reflected accurately in firms’ risk assessments.

Part of a wider sanctions-information flow

The update fits the Commission’s recent pattern of publishing external financial-crime and sanctions developments for the sector. On 14 October, it reported EU Regulation 2026/2278 adding seven individuals and entities to DPRK-related restrictive measures. The same day, it published the Council’s Russian sanctions package, covering 1,569 individuals and entities linked to Russia’s military-industrial complex.

Atlas reads the sequence as a reminder that firms need to maintain both FATF country classifications and EU restrictive-measures screening. The four jurisdictions’ removal changes their FATF status, but it does not by itself resolve other sanctions, customer-specific or transaction-specific risks. The latest list therefore leaves Vietnam in the Grey List and Iran, Myanmar and North Korea in the Black List.