Off the Grey List, Still Under the Microscope

A milestone, not the finish line

On 24 October 2025, the Financial Action Task Force (FATF) removed South Africa from its list of jurisdictions under increased monitoring, commonly known as the grey list.

The decision recognised significant progress in addressing weaknesses in the country’s framework for combating money laundering, terrorist financing and proliferation financing.

It was an important milestone for South Africa. It did not, however, bring an end to regulatory obligations or the need for effective financial crime controls.

The FATF made clear that South Africa should continue working with the FATF and the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG) to sustain the improvements achieved.

Why scrutiny continues

Removal from the grey list reflects progress against an agreed action plan. It does not mean that every underlying financial crime risk has been eliminated.

South Africa must continue demonstrating that its regulatory framework works effectively in practice.

National Treasury has also emphasised the importance of sustained improvements in supervision, enforcement and governance ahead of South Africa’s next FATF mutual evaluation, expected to conclude in October 2027.

For businesses, the practical message is straightforward: regulatory compliance remains an ongoing responsibility, irrespective of the country’s grey-list status.

What this means for accountable institutions

Organisations that qualify as accountable institutions under the Financial Intelligence Centre Act must continue meeting the obligations applicable to their activities.

These may include understanding their exposure to money laundering and terrorist financing risks, implementing appropriate controls, maintaining an effective Risk Management and Compliance Programme (RMCP), and fulfilling relevant reporting and recordkeeping requirements.

The applicable obligations depend on the institution’s classification, activities and regulatory circumstances.

An RMCP should therefore be more than a generic policy document. It should reflect the business’s actual risks and explain how those risks are identified, assessed, managed and monitored.

A greater focus on implementation

An organisation may have policies and procedures in place without those arrangements being consistently applied.

This is why practical implementation matters.

Businesses should be able to demonstrate that their risk assessments are relevant, their procedures are understood, and their controls operate as intended.

For management, useful questions include:

• Does our RMCP reflect how our business operates today?
• Have we identified and assessed the financial crime risks relevant to our activities?
• Are employees clear about their responsibilities?
• Can we demonstrate that our controls are implemented and maintained?
• Have we assessed whether any recent FIC directives or reporting requirements apply to us?

These questions help move compliance from documentation towards effective risk management.

What businesses should do next

The removal of South Africa from the grey list provides an opportunity to assess whether existing compliance arrangements remain appropriate.

For accountable institutions, a practical starting point is to review the current risk assessment and RMCP, identify gaps between documented procedures and day-to-day practice, and confirm which reporting and submission requirements apply.

This does not necessarily require creating an entirely new compliance framework. In many cases, the priority will be strengthening and updating what already exists.

The objective is a proportionate, workable approach that supports compliance while recognising the realities of running a business.

The bottom line

South Africa’s exit from the FATF grey list was a positive development, but it should not be mistaken for a reduction in the responsibilities of individual accountable institutions.

The strongest position for a business is not simply to have compliance documentation available. It is to understand its risks, apply appropriate controls and maintain evidence that its compliance arrangements work in practice.