Beyond the Grey List: What Pakistan’s EU Delisting Means for AML Risk

Pakistan’s removal from the European Union’s list of high-risk third countries in March 2023 marked an important regulatory milestone in the country’s long-running effort to strengthen its anti-money laundering and counter-terrorist financing framework. The decision followed the Financial Action Task Force’s removal of Pakistan from increased monitoring in October 2022, after the country completed two action plans covering 34 reform items.

For a FinCrime audience, the significance is broader than a change in country classification. EU listing had created an automatic legal trigger for enhanced customer due diligence in relationships and transactions involving Pakistan. Delisting removed that mandatory country-list consequence, potentially reducing friction in correspondent banking, trade finance, remittances and investment.

It did not declare Pakistan free from financial-crime risk. Nor did it require institutions to abandon enhanced scrutiny where customer, sector, product or transaction indicators remain elevated. The central compliance challenge is therefore recalibration: replacing blanket treatment based on a regulatory list with evidence-led assessment of the risks that persist beneath the country label.

Why the EU high-risk-country list matters

The European Commission identifies third countries whose strategic AML/CFT deficiencies may threaten the integrity of the EU financial system. Under the framework applicable at the time, obliged entities were required to apply defined enhanced measures to business relationships and transactions involving listed jurisdictions.

Those measures could include obtaining additional information on the customer and beneficial owner, establishing the source of funds and wealth, understanding the purpose of transactions, securing senior-management approval and applying enhanced ongoing monitoring.

Listing therefore has consequences beyond reputation. It affects onboarding, payment processing, correspondent relationships, transaction-review queues and the commercial appetite of institutions that may apply broader restrictions than the law requires.

The effect can become self-reinforcing. Where international banks reduce exposure, remaining payment corridors become more concentrated and expensive. Legitimate businesses and families may move toward less transparent channels, potentially increasing rather than reducing financial-crime risk.

FATF grey listing and EU listing are related but distinct

Pakistan’s regulatory journey involved two connected but separate processes.

The FATF placed Pakistan under increased monitoring in June 2018. This status—commonly called the grey list—meant that the country had committed to address identified strategic deficiencies within agreed timeframes and was subject to closer review.

The FATF does not automatically call for enhanced due diligence against every grey-listed jurisdiction. Its standards emphasise a risk-based approach and caution against indiscriminate de-risking.

The EU list has a different legal function. Once a country is identified under the EU framework, regulated firms in Member States face specific enhanced-due-diligence obligations. Removal from the FATF list strongly influenced the Commission’s assessment, but EU delisting required a separate delegated regulation and legal process.

That distinction matters operationally. Compliance teams should not treat FATF, EU, UK or national country lists as interchangeable. Each framework has its own authority, effective date and regulatory consequences.

Pakistan’s path out of increased monitoring

Pakistan’s 2018 action plan focused heavily on counter-terrorist financing. The reforms required stronger understanding of terrorist-financing risk, more effective supervision, enforcement against illegal money or value-transfer services, improved implementation of targeted financial sanctions and credible investigation and prosecution of designated persons and their support networks.

A second action plan adopted in 2021 addressed broader technical weaknesses in the AML/CFT framework. Together, the plans covered 34 items.

By June 2022, FATF concluded that Pakistan had substantially completed both plans and authorised an on-site visit to determine whether implementation had begun and could be sustained. FATF highlighted evidence that terrorist-financing investigations and prosecutions were reaching senior leaders and commanders of UN-designated groups, alongside an upward trend in money-laundering investigations and prosecutions consistent with the country’s risk profile.

Following the on-site assessment, FATF removed Pakistan from increased monitoring in October 2022. It nevertheless stated that Pakistan should continue working with the Asia/Pacific Group on Money Laundering to improve its system further.

What the reforms changed

The reform programme extended across legislation, supervision, investigation and institutional coordination.

Pakistan strengthened legal and regulatory requirements for financial institutions and designated non-financial businesses and professions. Supervisory arrangements were developed for sectors such as real estate, precious metals, accountants and company-related services, which can be used to place or integrate illicit funds outside conventional banking channels.

Authorities also increased attention to beneficial ownership, suspicious transaction reporting, asset freezing and the use of financial intelligence. Measures targeted unlicensed hawala and hundi activity, cross-border cash movement and weaknesses in the implementation of UN financial sanctions.

Technical progress was significant. By February 2022, the Asia/Pacific Group assessed Pakistan as compliant or largely compliant with 38 of the FATF’s 40 Recommendations.

That figure is important, but it requires interpretation. Technical compliance measures whether laws, regulations and institutional arrangements reflect FATF standards. It does not by itself prove that suspicious funds are consistently detected, complex networks are successfully prosecuted or criminal assets are recovered.

Delisting is not a clean bill of health

The European Commission concluded that Pakistan no longer had the strategic deficiencies that justified inclusion on the EU list. Delegated Regulation 2023/410 deleted Pakistan from the relevant annex, with the change entering into force in March 2023.

The decision recognised specific progress against an agreed benchmark. It did not certify every public body, financial institution, business or transaction connected to Pakistan as low risk.

Country risk is only one component of customer risk. A Pakistan-linked relationship may still require enhanced measures because of the customer’s ownership structure, political exposure, industry, delivery channel, source of wealth, counterparties or transaction geography.

The reverse is also true. A transparent, regulated customer with a clear business purpose should not automatically face disproportionate restrictions because of historical country concerns.

Good compliance practice therefore moves from list-based treatment to differentiated assessment.

Pakistan’s current risk environment remains material

Pakistan’s 2023 National Risk Assessment demonstrates why continued vigilance is necessary. It rated corruption and bribery, illegal money or value-transfer services, tax crime, smuggling and cash smuggling among the country’s highest money-laundering threats. Narcotics trafficking, human trafficking, migrant smuggling, fraud, forgery and cybercrime also remained significant.

These risks reflect structural features of the economy and region. Cash remains important, informal transfer systems serve legitimate remittance and commercial needs, and Pakistan sits across major trade and migration corridors.

Hawala and hundi are not inherently synonymous with terrorism or money laundering. They can provide rapid and accessible value transfer where formal services are costly or unavailable. The risk arises where providers operate outside licensing, customer due diligence, recordkeeping and reporting requirements.

Trade-based money laundering is another priority. Over- or under-invoicing, false descriptions, phantom shipments, multiple invoicing and manipulation of trade finance can move value while appearing to support legitimate commerce.

Detecting it requires more than screening names. Institutions must understand the goods, prices, routes, customers, counterparties and documentary consistency behind the transaction.

Terrorist financing remains a distinct analytical problem

Pakistan’s progress on counter-terrorist financing was central to FATF delisting, but terrorist-financing controls cannot become static once an action plan is completed.

The amounts involved may be small, and funds can originate from lawful income before being diverted. Risk can arise through donations, cash collection, informal transfers, front organisations, commercial activity and abuse of non-profit structures.

Institutions need current sanctions and designation data, multilingual name screening and the ability to identify aliases, associates and indirect control. A match against a historic list or media report is not enough; decisions must reflect the applicable legal framework and verified identity information.

Transaction monitoring should also be contextual. Geography alone is a weak indicator. Relationships with high-risk border areas, unexplained payments to intermediaries, inconsistent charitable activity and rapid movement through informal channels may be more informative when assessed together.

What delisting changed for financial institutions

For EU-regulated entities, Pakistan’s removal ended the automatic enhanced-due-diligence requirement that arose solely from its inclusion on the Commission’s list.

Institutions could review policies, country-rating models, onboarding rules and transaction scenarios that treated every Pakistan-linked relationship as subject to mandatory enhancement. Correspondent banks could reassess restrictions, and trade-finance teams could reconsider documentary or approval requirements imposed only because of the listing.

Recalibration should not mean deleting every existing control. Historical alerts, customer files and risk assessments may contain valuable information. Institutions should identify which measures were legally triggered by the listing and which remain justified by independent risk factors.

A defensible review records the reason for any change, the data considered and the controls retained. Silent downgrades create governance risk, while failure to update can perpetuate unnecessary exclusion.

Avoiding both de-risking and under-reaction

Country lists are attractive because they provide a simple decision rule. Simplicity can produce two opposite errors.

The first is blanket de-risking: refusing customers, transactions or sectors without assessing actual exposure. This can damage financial inclusion, remittance access and legitimate trade while pushing activity toward less transparent channels.

The second is automatic normalisation after delisting: assuming that removal eliminates the need for enhanced scrutiny. This ignores customer-level and transaction-level risk.

A better model uses the country as one factor within a wider assessment. The institution should consider the customer’s sector, ownership, regulatory status, products, expected activity, counterparties and exposure to other jurisdictions.

Risk appetite should distinguish between a regulated bank, an export business, a cash-intensive dealer, a charity operating near a conflict zone and an opaque company using multiple intermediaries. Treating them identically is not risk based.

What a resilient control stack looks like

The first layer is accurate country-list governance. Systems should record the source, legal authority, adoption date and effective date of each list change. FATF announcements, EU delegated regulations and national requirements should not be collapsed into one undifferentiated field.

The second layer is customer and beneficial-ownership transparency. Firms should understand who ultimately owns or controls the relationship, whether nominees or layered companies are involved and how wealth and funds were generated.

The third layer is sector-sensitive monitoring. Trade finance, remittances, charities, real estate, precious metals and cash-intensive businesses require different indicators. Generic country alerts create volume without necessarily improving detection.

The fourth layer is network analysis. Shared directors, addresses, devices, telephone numbers, beneficiaries and counterparties can reveal connections that individual-customer reviews miss.

The fifth layer is outcome testing. Institutions should assess whether country-risk rules generate useful investigations, suspicious transaction reports and defensible risk decisions—or merely create repeated false positives.

What this means for financial crime leaders

Pakistan’s removal from the EU high-risk-country list was a meaningful recognition of sustained legal, supervisory and enforcement reform. It reduced an important source of mandatory friction and created an opportunity for more proportionate engagement with Pakistan-linked customers and transactions.

The decision should not be interpreted as the end of the risk-management process. Pakistan continues to face significant exposure to corruption, informal value transfer, tax crime, smuggling, trade-based laundering and terrorist financing.

For FinCrime leaders, the correct response is disciplined recalibration. Controls should be updated to reflect the legal change while preserving enhanced measures where independent risk indicators justify them.

The broader lesson is that country lists are regulatory signals, not substitutes for analysis. Listing should not produce automatic exclusion, and delisting should not produce automatic trust.

An effective AML/CFT programme can recognise Pakistan’s progress while continuing to examine the people, entities, sectors and payment routes that create real exposure. That balance—between removing unnecessary friction and maintaining risk-sensitive scrutiny—is the practical meaning of a mature risk-based approach.