The grey list changed in June, and so did your country risk file

The FATF is a standard setter and its statements are law nowhere. An obligation reaches a firm through national rules that refer to the lists, and each jurisdiction picks them up on its own timing and in its own words. In the United Kingdom the Money Laundering Regulations define a high-risk third country by reference to the FATF lists, and HM Treasury updated its money laundering advisory notice on 22 June 2026 to reflect the June plenary. UK regulated firms apply enhanced due diligence to those countries.

So the answer to when a plenary bites depends on where a firm is regulated and where its counterparties sit. Even where no rule changes at all, banks, administrators and investors adjust their questionnaires within weeks, because their own risk methodologies cite the FATF lists directly. A fund can find that its regulatory position is untouched while three counterparties independently ask it the same new question.

A list change is easy to read and hard to apply. The question a bank or an investor asks is which investors, directors, service providers, counterparties, accounts and underlying assets in this structure are connected to the jurisdiction that moved, and what has been done about each one. That is a question about relationships already recorded, in several systems, by several teams.

Fund and holding structures feel it more sharply than a single company, because a jurisdiction usually enters the structure sideways. It is the residence of one director on one SPV, the domicile of a nominee holding a small stake, the location of an asset two levels down, or the seat of a service provider engaged years ago. None of those is a country in the fund's own particulars, and a group that records country only as an attribute of the entity itself will answer the question wrongly and confidently.

The fix is an index. Jurisdiction should be a recorded attribute of every relationship the group holds, and not only of its entities: the officers and their residence, the shareholders and their domicile, the counterparties and service providers, the banks holding accounts, and the assets. Given that, a list change becomes a query, and the response is a list of names with owners. Record the decision as well as the exposure: for each affected relationship, the risk rating applied, the additional measures taken, who approved them and the date. Removals need the same discipline. When a jurisdiction leaves the increased-monitoring list a firm may lower its rating, but the change should be deliberate, dated and evidenced, because the next reviewer will ask why the rating moved and the honest answer cannot be that the list did.

The register holds entities with their jurisdictions, the ownership between them, the officers who serve them, the bank accounts and mandates they hold, the documents that evidence all of it and the KYC requests raised against them. Those are connected records, so the group can be read by jurisdiction: which entities sit there, which officers are connected to it, which accounts, which counterparties.

The review work that follows a plenary sits with the other dated obligations, so a reassessment has an owner and a date. Reports draw on the record, and the audit trail shows when a rating or a document changed and who changed it. No sanctions feed runs here and no names are screened. The obligation Alethia does carry is the one that outlasts the news: whoever picks up the file in two years can see which relationships were reviewed in June 2026, what was decided, and by whom.