What country are you backing in the World Cup? Thanks to office sweepstakes and online betting, many of us may be researching the footballing history of Curaçao or studying the team composition of Uzbekistan along with cheering on our home nation.
With 48 countries in this year’s World Cup, more than a quarter of the teams raise some form of jurisdictional AML question, whether through current listing, recent delisting, sanctions exposure or watchlist concerns. A transaction related to one of 13 World Cup nations should reasonably trigger EDD for any regulated entity.
To be clear, that does not mean a quarter of World Cup countries are on the FATF high-risk list. They are not. It also does not mean ordinary fans, players, businesses or nationals from those countries should be treated as inherently suspicious. However jurisdictional risk is no longer as simple as “is this country on the current FATF list, yes or no?” For regulated entities, the more important question is whether something within the transaction should change the level of scrutiny.
With the UK decoupling automatic requirements for EDD to the FATF Grey List, this World Cup presents an important question for regulated entities: would your screening processes capture the risk inherent in some of these jurisdictions?
The AML rule change that firms should consider
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 recently passed by Parliament technically narrow mandatory country-based enhanced due diligence. Under the changes, mandatory EDD would be tied to FATF “call for action” jurisdictions, e.g. the blacklist, rather than automatically applying across the wider FATF Grey List.
However the whistle has not blown on jurisdiction risk. The referee has just moved from strict liability to judgement call. Grey List countries are not automatically off scott-free, and neither does it mean countries not on the list are free of risk,
In practice, better jurisdictional risk requires better risk assessment, better file reasoning and better evidence. A firm that simply deletes all Grey List references from its AML policy may find itself in difficulty. Whereas a firm that updates its country-risk methodology, trains staff on contextual risk and records the rationale for its decisions is in a far stronger position.
The Bosnia problem: when a country is not listed, yet not exactly comfortable
Bosnia and Herzegovina (FIFA rank #64) is a good case study of today’s jurisdictional compliance risk. Bosnia does not appear on the current FATF Grey List or Black List, or the EU’s list of high risk jurisdictions. On a simple list-checking approach, that might be the end of the matter. However, that would miss the point.
Bosnia has been under renewed scrutiny after MONEYVAL identified significant weaknesses in its AML/CFT framework. In February 2025, the country entered a one-year FATF observation period. That period has now expired, meaning Bosnia faces a credible risk of being placed under increased monitoring if it cannot show sufficient progress.
The concerns are familiar to anyone working in financial crime compliance: gaps in beneficial ownership transparency, incomplete targeted financial sanctions arrangements, weaknesses in supervision outside the banking sector, problems with asset confiscation, and wider issues around institutional coordination and enforcement. Bosnia’s highly decentralised constitutional structure makes reform especially difficult, since AML/CFT responsibilities are spread across different levels of government and often require political agreement between state and entity authorities.
Recent cases have highlighted the country’s inherent risk. A Sarajevo-based firm marketing Dubai property allegedly suggested that clients could use cash or cryptocurrency without proving the origin of funds, and could avoid cross-border transfers through informal value transfer mechanisms. For compliance teams, that is exactly the kind of scenario where the realities of official jurisdictional rankings miss the inherent risk that Bosnia is not necessarily a safe bet. A jurisdiction can sit outside the current list and still present enough warning signs to justify closer scrutiny in the right circumstances.
FATF delisting is not a risk amnesty
A country coming off the FATF Grey List usually means the jurisdiction has made enough progress against its FATF action plan to be removed from increased monitoring. But with the UK’s AML amendments to decouple the FATF list with automatic EDD, delisting is not so much a risk amnesty but just one factor to consider in a holistic assessment.
For example the United Arab Emirates was added to the FATF Grey List in March 2022 over strategic deficiencies in its anti-money laundering regime. It was removed by FATF in March 2024, only two years later. The European Parliament then voted to keep the UAE on the EU’s list of High Risk Third Countries, in effect rejecting FATF’s conclusion that the jurisdiction should be treated as lower risk for EU purposes.
That split shows that the FATF list is not the only lens through which jurisdictional risk should be viewed. Dubai in particular has continued to attract scrutiny over luxury real estate, gold markets, cash movements, sanctions circumvention, and opaque ownership structures. Not to mention the purchase of property via Sarajevo-based firms. For the regulated sector, it’s important to properly understand the risk exposure if a transaction involves Dubai property, UAE-based structures, high-value goods, politically exposed persons, unexplained wealth or cross-border funds, the fact that the UAE is no longer on the FATF Grey List should not end the risk assessment.
Panama tells a similar story from a different angle. It was removed from the FATF Grey List in October 2023 and from the EU list in June 2025. That is a meaningful development. Yet Panama’s historic role in offshore company formation, asset-holding structures and financial secrecy still makes it relevant in a risk-based assessment, especially where beneficial ownership is unclear or funds are moving through layered corporate vehicles.
That’s why it can be a mistake to automatically assume no official listing is a free pass to the final round. The better approach is to distinguish between automatic EDD and risk-based EDD. A country may no longer trigger mandatory EDD under a strict reading, while still raising enough questions to justify enhanced scrutiny in a particular matter. While delisting should prompt firms to update their controls, it should not prompt them to switch off their judgement.
What the World Cup can teach us about jurisdictional risk
The 2026 World Cup offers a surprisingly useful way to think about modern AML risk. The tournament is bigger, the combinations are less predictable, and the old assumptions do not always survive first contact with reality. Even Curaçao can equalise with Germany (for a few minutes). In football, surprises are part of the drama. In compliance, they are part of the risk assessment.
The same is true of jurisdictional risk. FATF and EU listing remains an important factor, yet it is only one part of the picture. A country may be on the Grey List, off the Grey List, on the EU list, recently delisted, subject to sanctions, exposed to corruption risk, or relevant because of the way funds, ownership structures or intermediaries are being used. A simple “listed or not listed” approach is not enough to protect your firm.
For UK firms, the 2026 AML amendments quietly reflect this new reality. Decoupling EDD from the Grey List should not be read as permission to do less due diligence. They are an invitation to do better-targeted due diligence. Risk assessment is not a sweepstakes. It is instead a choice that requires judgement, documentation and defensible decision-making.
Putting money on a team would necessitate that same sort of evidence-based approach. When you’re playing with your firms’ reputation or your client’s money, it’s vital to make a proper, risk-based judgement, not just take a punt in the dark.
Full list of risky jurisdictions in the 2026 World Cup
Algeria (FIFA rank #28): currently on the FATF Grey List and the EU High Risk Third Countries list.
Côte d’Ivoire / Ivory Coast (FIFA rank #34): currently on the FATF Grey List and the EU High Risk Third Countries list.
DR Congo (FIFA rank #46): currently on the FATF Grey List and the EU High Risk Third Countries list, with UK financial sanctions also relevant.
Haiti (FIFA rank #83): currently on the FATF Grey List and the EU High Risk Third Countries list.
Iran (FIFA rank #21): on the FATF Black List and the EU High Risk Third Countries list, with UK financial sanctions also relevant.
Jordan (FIFA rank #63): removed from the FATF Grey List in October 2023, while regional exposure to Iran and Syria-related risks may still be relevant in some matters.
Morocco (FIFA rank #8): removed from the FATF Grey List in February 2023, although people smuggling, drug trafficking and related proceeds risks remain relevant to a broader country-risk assessment.
Panama (FIFA rank #33): removed from the FATF Grey List in October 2023 and from the EU list in June 2025.
Senegal (FIFA rank #14): removed from the FATF Grey List in October 2024 and from the EU list in June 2025, although precious metals, informal value transfer and broader money laundering concerns may still be relevant.
South Africa (FIFA rank #60): removed from the FATF Grey List in October 2025, although terrorist financing, proliferation financing and broader financial crime risk indicators may still need to be considered.
Türkiye (FIFA rank #22): removed from the FATF Grey List in June 2024, while terrorist financing, sanctions-adjacent exposure and forced labour concerns may remain relevant depending on the client, sector and transaction.
Croatia (FIFA rank #11): recently removed from the FATF Grey List. As an EU member state, it is not treated as an EU High Risk Third Country.
Bosnia and Herzegovina (FIFA rank #65): not currently on the FATF Grey List, yet under scrutiny after its FATF observation period expired in February 2026, with unresolved MONEYVAL concerns around beneficial ownership, asset confiscation, targeted financial sanctions and non-bank supervision.
