Understanding the FATF: A Guide for Private Sector Stakeholders

Part 2: The Mutual Evaluation Process and Follow-up Monitoring and Listings

📅 April 28, 2026

As members of the FATF or an FATF-style regional body (FSRB), jurisdictions agree to subject themselves to periodic, peer driven mutual evaluations that assess how well they’re meeting their commitments to combat illicit finance. The results of the mutual evaluation process feed directly into the FATF’s black-listing and grey-listing decisions.

So it’s important to understand how the mutual evaluations work. The entire process is designed to be rigorous, technical, and apolitical, with all participating jurisdictions subjected to the set of standards and evaluation criteria.

The FATF Mutual Evaluation

An FATF mutual evaluation is an intensive process that unfolds over the course of more than a year culminating in a public report that details the positive and negative elements of a jurisdiction’s performance.

The review is performed by either the FATF, an FSRB, or a dedicated office within the World Bank or International Monetary Fund (IMF). The review is called a Mutual Evaluation Report (MER) if performed by the FATF or an FSRB, or a Detailed Assessment Report if performed by the World Bank or IMF.

Partially compliance (PC): There are moderate shortcomings
Non-compliant (NC): There are major shortcomings

FATF Mutual Evaluations assess countries’ Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) frameworks through two main components: Technical Compliance and Effectiveness.

Figure 1 Mutual Evaluation Report Sample

Technical Compliance

Included below is an example of Technical Compliance Ratings for the Maldives from its October 2025 Mutual Evaluation Report.

Effectiveness

The effectiveness component assesses whether a country’s AML/CFT/CPF system is working, and the extent to which the country is achieving a defined set of outcomes. It doesn’t involve checking whether specific requirements are met, or that all elements of a given Recommendation are in place. Instead, it requires a judgement as to whether, or to what extent, defined outcomes are being achieved.

To do this, FATF assessors work in consultation with the assessed country to evaluate “Immediate Outcomes” in the following areas:

Risk Assessment: ML and TF risks are identified, assessed, and understood.
Policy Coordination: Policies are cooperatively developed and, where appropriate, actions coordinated domestically to combat ML and TF.
Supervision: Supervisors appropriately supervise, monitor, and regulate FIs, DNFBPs, and VASPs for compliance with AML/CFT requirements.
Investigation and Prosecution: ML and TF offences and activities are investigated and offenders are prosecuted and subject to effective, proportionate, and dissuasive penalties.
Financial Intelligence: Financial intelligence and all other relevant information is appropriately used by competent authorities for ML and TF investigations.
Asset Seizures: Asset recovery processes lead to confiscation and permanent deprivation of criminal property and property of corresponding value.
Private Sector: FIs, DNFBPs, and VASPs adequately apply AML/CFT preventive measures proportionate to the risks and report suspicious transactions.
International Cooperation: International coordination delivers appropriate information, financial intelligence, and evidence, and facilitates action against criminals and their property.
Terrorist Financing: Terrorists, terrorist organizations, and terrorist financiers are prevented from raising, moving, and using funds.
Proliferation Financing: Individuals and entities involved in proliferation of WMD are prevented from raising, moving, and using funds, consistent with the relevant United Nations Security Council Resolutions (UNSCRs).

For each of the Immediate Outcomes, the FATF assessors try to answer two overarching questions: to what extent is the outcome being achieved, and what can be done to improve effectiveness? There are four possible ratings for effectiveness:

High (HE): The Immediate Outcome is achieved to a very large extent. Minor improvements needed.
Substantial (SE): The Immediate Outcome is achieved to a large extent. Moderate improvements needed.
Moderate (ME): The Immediate Outcome is achieved to some extent. Major improvements needed.
Low (LE): The Immediate Outcome is not achieved or achieved to a negligible extent. Fundamental improvements needed.

Included below is an example of Effectiveness Ratings for the Maldives from its October 2025 Mutual Evaluation Report.

Financial institutions and an increasing number of DNFBPs, and VASPs now make a jurisdiction’s performance on its MER an important factor in their AML/CFT/CPF risk-rating systems. Correspondents and other clients located in jurisdictions that perform poorly may be subject to enhanced due diligence or rejected altogether. This differentiated treatment in turn creates incentives for the private sector within jurisdictions receiving poor FATF assessments and ratings to lobby its government to improve its AML/CFT/CPF performance—or at least to improve its standing with the FATF.

Follow-Up Monitoring and Listings

If reviewers give high marks to the country or jurisdiction, the publication of the Mutual Evaluation Report generally brings the process to an end. However, a significant majority of those reviewed have deficiencies significant enough to warrant a follow-up report.

Within this group, a minority are deemed to have substantial and strategic deficiencies in their AML/CFT/CPF regimes that necessitate their placement under special review by the FATF’s International Co-operation Review Group (ICRG) to begin an enhanced follow-up process in which the jurisdiction will face additional scrutiny.

There are four ways that a jurisdiction can earn a referral to the ICRG:

It receives 20 or more “Non-Compliant” or “Partially Compliant” ratings on the FATF’s 40 Recommendations related to technical compliance.
It receives “Non-Compliant” or “Partially Compliant” rating on three or more of the six most important FATF recommendations related to technical compliance (3, 5, 6, 10, 11, and 20).
It receives a “Low” or “Moderate” rating for 9 or more of the 11 Immediate Outcomes used to assess effectiveness, with a minimum of two “Low” ratings.
It receives a “Low” rating for 6 or more of the 11 Immediate Outcomes used to assess effectiveness.

Once placed under review by the ICRG, a country has a year to work with the FATF or its FSRB to address deficiencies using an action plan formulated by the FATF and the country of concern. At the end of the year, the ICRG assesses the progress achieved in implementing the remedies. If sufficient progress has not been made, the country is publicly placed under increased monitoring, which is often referred to as being on the FATF “Grey List.”

Jurisdictions Under Increased Monitoring (FATF Grey List)

The purpose of this list is to protect the international financial system from money laundering, terrorist financing, and proliferation financing risks and to encourage greater compliance with FATF standards by identifying jurisdictions whose strategic AML/CFT/CPF deficiencies present substantial risks to the international financial system.

The list is included in the statement published after each FATF Plenary Meeting, which take place three times a year. Specific deficiencies for each listed jurisdiction are described in the FATF public statement, together with a summary of current progress in addressing such deficiencies. Listed countries maintain their status until they implement all or nearly all elements of their agreed remedial action plan.

, jurisdictions on the Grey List included Algeria, Angola, Bolivia, Bulgaria, Cameroon, Cote D’Ivoire, Democratic Republic of Congo, Haiti, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Namibia, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK), and Yemen.

High-Risk Jurisdictions Subject to a Call for Action (FATF Black List)

Countries with strategic deficiencies that have repeatedly failed to make progress toward remediating those deficiencies are listed in a separate FATF public statement following each Plenary Meeting called “High-Risk Jurisdictions Subject to a Call for Action.” This list is colloquially known as the FATF “Black List.” For all countries identified as high risk, the FATF calls on all members and urges all jurisdictions to apply enhanced due diligence, and in the most serious cases, countries are called upon to apply countermeasures to protect the international financial system from the ML/TF/PF risks emanating from the country. The listings are maintained as long as listed jurisdictions continue to present ongoing and serious risks to the international financial system.

As of January 2026, jurisdictions subject to an FATF call on its members and other jurisdictions to apply countermeasures included Iran and North Korea, and Myanmar was the only jurisdiction subject to an FATF call on its members and other jurisdictions to apply enhanced due diligence measures.

Stay tuned for our next article in this series, which will describe the consequences of FATF listings for listed and non-listed countries and for the international financial system, as well as lessons learned from countries that have exited the Grey List.

Upcoming Webinar

Join us for a webinar on the FATF mutual evaluation process—the driving force behind global AML/CFT progress. As nearly 200 jurisdictions are assessed on compliance and effectiveness, this process shapes regulatory expectations, increases supervisory scrutiny, and impacts risk frameworks across financial institutions, DNFBPs, and VASPs.

Our expert panel will break down how evaluations work, why jurisdictions are grey-listed or black-listed and how they are removed, what to take from Mutual Evaluation Reports, and what to expect from the FATF’s evolving Fifth-Round methodology and future priorities.

View Agenda and Register

Recommended Blogs

Data as a Critical Business and Compliance Asset

April 15, 2026

Data is an increasingly critical asset. It plays a key role in due diligence, identifying and responding against illicit finance, and identifying fraud, as well as for commercial decisions and business success. Explore global data protection and retention requirements in this article.

Understanding the FATF: A Guide for Private Sector Stakeholders

April 8, 2026

The FATF standards, known as the 40 Recommendations, have become more expansive, detailed, and stringent over time, requiring more of both public and private sector institutions.

February 2026 Monthly Sanctions and Export Controls Report

March 3, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from February 2026.

Electronic Fund Transfer Consumer Protection

February 5, 2026

The Electronic Fund Transfer Act (EFTA) was established to protect consumers using electronic fund transfers. Explore what is considered in scope and the changes proposed to include crypto.

January 2026 Monthly Sanctions and Export Controls Report

February 3, 2026

There were several major sanctions-related developments in January, most notably the U.S.’s easing of sanctions to facilitate Venezuelan oil sales and the ratcheting up of western sanctions in response to Tehran’s violent crackdown on protestors, among others.