Spillemyndigheden urges caution on FATF grey and black lists

The Danish Gambling Authority (DGA) has released new guidance reminding licensed gambling operators in Denmark of their obligations under national anti-money laundering (AML) laws, specifically in light of the Financial Action Task Force (FATF)'s updated lists of high-risk jurisdictions. These include countries on the Grey List—jurisdictions under increased monitoring—and the Black List, which consists of countries subject to a call for action due to significant AML/CFT (anti-money laundering and counter-terrorist financing) deficiencies.

While the notice from the DGA is procedural in nature, it underscores the growing international effort to close AML loopholes within gambling, an industry increasingly exposed to cross-border risks, digital anonymity, and misuse for criminal purposes.

FATF lists and their significance for compliance

The FATF, an intergovernmental body established to combat money laundering and terrorist financing, regularly publishes two key lists:

Grey List (Jurisdictions under Increased Monitoring): Countries that have committed to resolving AML/CFT deficiencies swiftly and are actively working with the FATF to do so.

Black List (High-Risk Jurisdictions subject to a Call for Action): Countries with severe strategic AML/CFT deficiencies that have not committed to, or are failing to, resolve the identified issues.

The inclusion of a jurisdiction on either list signals to international stakeholders—including governments, regulators, and financial institutions—that entities within these jurisdictions require enhanced scrutiny.

Updated lists of jurisdictions under FATF monitoring

The Grey List includes the following jurisdictions:

• Algeria
• Angola
• Bolivia
• Bulgaria
• Burkina Faso
• Cameroon
• Ivory Coast
• Democratic Republic of Congo
• Haiti
• Kenya
• Laos
• Lebanon
• Monaco
• Mozambique
• Namibia
• Nepal
• Nigeria
• South Africa
• South Sudan
• Syria
• Venezuela
• Vietnam
• Virgin Islands (Great Britain)
• Yemen

Meanwhile, the Black List features the following jurisdictions:

• Democratic People's Republic of Korea (North Korea)
• Iran
• Myanmar

These countries have been identified as having significant strategic AML/CFT shortcomings and have either failed to engage constructively with the FATF or have not made sufficient progress in their remediation efforts.

Danish AML Act and implications for gambling operators

Under section 17(1) of the Danish Anti-Money Laundering Act, gambling operators are obligated to perform enhanced customer due diligence (EDD) when a player presents a higher risk of being involved in money laundering or terrorist financing.

This risk determination must be guided by a number of indicators, including those provided in Annex 3 of the Danish AML Act, which incorporates the FATF’s high-risk jurisdiction lists. However, it is crucial to understand that the mere presence of a country on the FATF’s Grey or Black list does not automatically trigger the obligation to perform EDD.

EDD is only mandatorily required when a player is connected to a jurisdiction listed in the European Union’s Regulation on High-Risk Third Countries, as outlined in section 17(2) of the AML Act. The FATF’s lists are considered a helpful tool for risk-based assessments but do not carry the same legal weight as the EU list.

Importance of individual risk assessment

The DGA emphasizes that gambling operators must take a risk-based approach when assessing whether to apply EDD procedures. This means operators should consider not only a player’s country of origin but also other high-risk factors such as transaction patterns, source of funds, unusual betting behavior, or links to politically exposed persons (PEPs).

The authority encourages operators to remain vigilant and continuously monitor changes to the FATF lists, as well as any updates to the EU’s own list of high-risk third countries. Operators are expected to maintain robust AML compliance frameworks that can adapt to such changes efficiently.

FATF and EU lists: Distinguishing legal requirements from guidance

Although the FATF’s lists are not legally binding under Danish law, they carry considerable persuasive authority. Operators who fail to consider these lists in their risk evaluations may be exposed to regulatory scrutiny or face sanctions for insufficient AML controls.

In contrast, jurisdictions listed in the EU’s Regulation on High-Risk Third Countries are subject to direct legal consequences under Danish AML regulations. This includes mandatory EDD measures and increased obligations regarding the verification of identity, source of wealth, and the purpose of the gambling relationship.

The dual structure—guidance from the FATF and enforceable obligations under EU law—requires that operators differentiate clearly between what is mandatory and what is advisory. However, in practice, ignoring the FATF lists may still be seen as evidence of an inadequate AML framework, particularly in the case of repeat or high-value transactions involving players from those jurisdictions.

Regulatory expectations for gambling operators

As part of Denmark’s commitment to combat financial crime, the Danish Gambling Authority expects licensed operators to meet the following standards:

• Incorporate FATF high-risk jurisdictions into AML risk assessments.
• Stay up to date with FATF updates and the EU’s high-risk third-country list.
• Implement enhanced due diligence when warranted by overall risk factors.
• Document and justify all risk assessment outcomes.
• Demonstrate an understanding of AML obligations under sections 17(1) and 17(2) of the Danish AML Act.

Operators are also advised to provide ongoing training to compliance officers and customer-facing staff, ensuring that red flags—such as attempts to obscure the country of origin, use of proxies, or repeated large-value deposits—are promptly reported and escalated.

Broader implications for the gambling sector

The DGA’s renewed focus on FATF compliance comes at a time when regulatory scrutiny of gambling’s AML risks is intensifying across Europe. The growing use of cryptocurrencies, digital wallets, and borderless payment platforms has made it easier for bad actors to exploit online gambling services.

As a result, regulators are under pressure to tighten enforcement and ensure that gambling platforms, particularly those licensed within the EU, are not used as conduits for illicit finance. The alignment between national AML acts and international guidance (FATF, EU directives, etc.) is a key part of this strategy.

Risk-based compliance as a legal safeguard

For gambling operators, adopting a risk-based compliance strategy is not just about satisfying the regulator. It is also a legal safeguard. Failure to conduct adequate due diligence—even in cases where the player is not directly tied to a blacklisted jurisdiction—can result in reputational damage, fines, or the loss of a gaming license.

Therefore, even where EDD is not strictly mandatory under Danish law, it may be prudent to implement it when players are linked to jurisdictions on the FATF Grey or Black list, especially if other risk indicators are also present.

Conclusion

The Danish Gambling Authority’s reminder about the FATF lists is a timely and necessary one, aimed at strengthening AML defenses within the country’s regulated gambling market. Operators should use this opportunity to review internal controls, update risk matrices, and ensure that customer due diligence procedures are aligned with evolving international standards.

In doing so, operators not only protect themselves from legal or regulatory exposure but also contribute to the global effort to prevent financial crime through gambling channels.

FAQs

What is the FATF and why does it matter for gambling operators?
The FATF is an international body that sets global standards for combating money laundering and terrorist financing. Its country risk lists help guide compliance efforts.

Are Danish gambling operators legally required to apply EDD for players from FATF grey-listed countries?
No, EDD is not mandatory solely based on FATF listings. Mandatory EDD applies only to countries listed in the EU Regulation on High-Risk Third Countries.

What is the difference between the FATF Grey List and Black List?
The Grey List includes jurisdictions under increased monitoring, while the Black List names countries with serious AML/CFT deficiencies requiring urgent action.

How often are the FATF lists updated?
The FATF typically reviews and updates its lists three times per year, following plenary meetings held in February, June, and October.

How should gambling operators in Denmark use the FATF lists?
Operators should use the lists to inform their player risk assessments and decide whether to conduct enhanced due diligence in high-risk cases.

What is Annex 3 of the Danish AML Act?
Annex 3 outlines high-risk factors that gambling operators must consider in AML compliance, including references to FATF risk jurisdictions.

Can an operator be penalized for not using the FATF lists?
While not legally required, ignoring FATF lists in risk assessments may be seen as a compliance weakness and could attract regulatory attention.

Do players from FATF Black List countries always trigger EDD?
Not automatically. EDD is required only if those countries are also listed in the EU’s high-risk list or if other risk indicators are present.

Is Monaco really on the FATF Grey List?
Yes, as of the latest update, Monaco is included in the FATF Grey List and is considered to be under increased AML monitoring.

Should operators update AML procedures after each FATF update?
Yes, regular updates to internal AML policies are essential to maintain compliance and respond to evolving international risks.