FinCEN Flags FATF Update as Kuwait Added to Watchlist

FinCEN has alerted U.S. financial institutions that the Financial Action Task Force (FATF) updated its country risk lists after its February plenary meeting, adding Kuwait and Papua New Guinea to the “increased monitoring” category.

The update also reiterates FATF’s stance on Iran, urging jurisdictions to apply effective countermeasures tied to proliferation-financing risk, while keeping the “call for action” list otherwise unchanged.

Kuwait and Papua New Guinea join FATF’s “increased monitoring” list

FinCEN said FATF added Kuwait and Papua New Guinea to the list of jurisdictions under increased monitoring—countries with strategic AML/CFT/CPF deficiencies that have committed to address them under an agreed timeline.

For U.S. institutions, the practical message is straightforward: update risk assessments, customer/counterparty screening, and controls around cross-border relationships where these jurisdictions appear in flows.

The high-risk list stays the same: Iran, DPRK, and Burma

FinCEN said FATF’s “high-risk jurisdictions subject to a call for action” list remains the same, with Iran, the Democratic People’s Republic of Korea (DPRK), and Burma (Myanmar) included.

The key nuance: FATF continues to call for countermeasures on Iran and DPRK, while Burma remains subject to enhanced due diligence rather than countermeasures.

FATF’s Iran message: “apply countermeasures,” including for crypto flows

FinCEN highlighted that FATF specifically called out four countermeasures jurisdictions should apply to Iran, including steps that directly touch virtual asset transactions and relationships involving virtual asset service providers (VASPs).

In plain English, FATF is urging countries (and by extension, compliance programs) to reduce exposure to Iran-linked financial and virtual-asset activity—up to and including restricting relationships and correspondent-style connections when risk is high.

FinCEN also warns: don’t use this as an excuse to “de-risk everything”

FinCEN reminded institutions that risk-based due diligence should not turn into “wholesale or indiscriminate de-risking” of customers or other financial institutions.

That’s a notable line for compliance teams: the expectation is “tighten controls where risk is real,” not “shut off broad categories” without analysis.

Why it matters for crypto

• FATF’s update explicitly includes virtual asset transactions in the countermeasures conversation, raising the compliance bar for crypto rails touching high-risk jurisdictions.
• Adding Kuwait and Papua New Guinea to “increased monitoring” can trigger tighter screening, higher friction, and more scrutiny for exchange/fintech corridors involving those markets.
• Countermeasure language around Iran increases pressure on VASPs and payment firms to strengthen sanctions/proliferation-finance controls, not just basic AML.
• FinCEN’s anti–blanket de-risking reminder suggests regulators want precision: targeted controls, documented decisions, and defensible risk frameworks.

What to watch next

• Whether major exchanges, stablecoin issuers, and payment processors update policies for exposure to Kuwait and Papua New Guinea after the FATF change.
• Follow-on FATF updates on Iran-related countermeasures and how jurisdictions operationalize “virtual asset transactions” language in practice.
• Any near-term compliance guidance or enforcement signals from U.S. agencies tied to proliferation-finance risks and crypto flows.
• Changes in correspondent-style access and cross-border banking relationships impacting crypto on/off-ramps connected to high-risk jurisdictions.

Source: FinCEN – March 6, 2026 release on FATF updated lists