Ask a compliance officer for the restricted country list and you usually get a spreadsheet. Ask where each entry came from and when it was last checked, and the room goes quiet. That second question is the one an auditor, an acquirer and a correspondent bank all ask, and it is the reason a list is a weak artefact while a country policy is a strong one.
The difference is structure. One flat column of banned countries cannot express the four different reasons a country ends up there, and those reasons carry different obligations, different review cycles and different owners.
Four tiers, not one
Tier one is prohibited. Country-wide sanctions programmes, jurisdictions your banking chain will not touch, and markets where serving a resident would be a criminal offence. No client, no payment, no marketing, no exception process at all. This tier is set by law and by your bank, not by appetite.
Tier two is not authorised. Countries where the activity requires local licensing you do not hold. The firm can neither solicit nor onboard, but the reason is licensing rather than crime, and the tier changes if the firm's authorisation changes. The mapping is the licence test in deciding which countries you accept.
Tier three is enhanced. Countries you serve with extra evidence: source of funds, senior sign-off, tighter transaction monitoring, lower initial limits. This is where FATF increased-monitoring jurisdictions sit, along with markets with high fraud rates or heavy PEP exposure. FATF grey list impact and source of funds checks describe what that tier costs you operationally.
Tier four is commercially closed. Legally acceptable, but the payments do not work, the approval rate is unviable, or you cannot advertise there. This tier is owned by the commercial team and reviewed against actual data, not by compliance.
The tiers describe a control structure. Which country belongs in which tier for your firm is a legal and licensing question specific to your entity, your permissions and your banking chain. Get that determination in writing from advisers who cover each market.
What feeds the list
Sanctions authorities publish their measures and update them without notice, which is why screening has to run against a maintained feed rather than a downloaded file. That mechanism is set out in sanctions screening basics, and the country dimension is only half of it, since listed persons appear in countries you otherwise serve.
The Financial Action Task Force publishes its lists on a plenary cycle, and both your bank and your PSP will react to changes faster than you do. Regulator warning lists in each market you touch are a second input, since an entry naming your entity changes the analysis in that country immediately. Then there are your own operational sources: chargeback rate by country, verification failure rate by country, fraud patterns, and any notice from an acquirer or a bank about specific geographies.
The last source is your licence conditions themselves. Several regimes restrict where an authorised firm may solicit, and some prohibit serving residents of the regulator's own country from an offshore affiliate, which quietly puts your home market on your own list.
Ownership and cadence
Every country entry needs four fields: the tier, the reason in one sentence, the source, and the effective date. Without the reason you cannot explain the entry, and an entry you cannot explain is an entry someone will remove when it becomes commercially inconvenient.
Sanctions changes apply immediately. FATF changes should be picked up within days of a plenary. Licensing tiers get a full review whenever authorisation changes and at least annually. Commercial tiers get reviewed against the numbers each quarter. Assign one named owner, usually the compliance officer described in the compliance officer role, with authority to close a country without a commercial veto.
The failure modes worth naming
Copying a competitor list is the first. It encodes their licence and their bank, and it usually includes countries they closed for reasons that do not apply to you while omitting the ones your correspondent will not clear.
The second is treating nationality and residency as the same field. A national of a restricted country who is a long-term resident elsewhere is a different case from a resident, and some sanctions measures attach to nationality while most licensing rules attach to residence. Store both, apply the rule that fits the reason.
Third is forgetting corporate clients. For a company the relevant geography includes incorporation, place of management and every beneficial owner, which is why a clean-looking entity can sit behind an owner in a tier one country. KYB verification covers the ownership chain.
Fourth is the marketing gap. If the restricted list is not mirrored into ad targeting and affiliate agreements, the firm keeps promoting into markets it will refuse at onboarding, which wastes budget and manufactures exactly the evidence a supervisor wants: adverts delivered to residents of a market you claim not to serve.
Make it machine readable
A policy in a document is a policy nobody enforces at three in the morning. The list has to exist as data that the sign-up form, the verification step, the account provisioning and the payment routing all read, with the effective date attached so a country closed today is closed everywhere today. The enforcement points are covered in implementing geo blocking properly.
Keep the history. When someone asks in eighteen months why an account from a given country was opened last March, the answer is the tier that country held on that date. Firms whose country policy lives inside their CRM can answer that from the record. Firms with a spreadsheet answer it from memory, which is not an answer.
"If nobody can tell me why a country is on the list, it will come off the list the first time sales wants it off."
— Alex Onta, Executive Director, SINGUARD
Key Takeaways
- Split the list into four tiers: prohibited, not authorised, enhanced due diligence and commercially closed, because each has a different owner and review cycle.
- Every entry needs a tier, a one-line reason, a source and an effective date, or the entry cannot be defended or maintained.
- Store nationality and residency separately, since sanctions measures and licensing rules attach to different attributes.
- Mirror the list into ad targeting and affiliate agreements, otherwise you keep advertising into markets you refuse at onboarding.
Frequently Asked Questions
Where do we get the data for a restricted country list?
From sanctions authorities in the regimes that touch your entity and your settlement currencies, from FATF plenary statements, from regulator warning lists in each market, from your licence conditions, and from your own operational data on declines, fraud and disputes. Screening should run against maintained feeds rather than a file someone downloaded once.
Does a FATF grey list entry mean we must refuse that country?
Not automatically. It generally means enhanced due diligence and closer monitoring, and your bank or PSP may apply their own stricter position. Some firms close such markets because the added cost is not worth the volume, which is a commercial decision rather than a legal requirement.
How quickly must the list be updated?
Sanctions changes take effect immediately and should be applied on the same day. FATF changes should be reflected within days of a plenary. Licensing tiers change when your permissions change, and commercial tiers can move on a quarterly review of your own performance data.
About the Author
Alex Onta is an Executive Director at SINGUARD. He built eTrader, the terminal, the mobile apps, eTrader Broker, Copytrading, Business and Community, along with the worldwide clustered-server infrastructure it all runs on, with his brother Roman Onta helping on the design, and he leads that division today. Together with Roman he builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals, and the two of them carry worldwide compliance, payment processing and international business structuring side by side. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.