Understanding the FATF: A Guide for Private Sector Stakeholders

What do the United States, Mexico, China, Iceland, the United Arab Emirates, Australia, Bahrain, and Saudi Arabia have in common?

They are all expected to host “on-site” visits in 2026 by the Financial Action Task Force (FATF) or a FATF-style regional body (FSRB) to evaluate the effectiveness of their Anti-Money Laundering, Countering the Financing of Terrorism, and Countering Proliferation Financing (AML/CFT/CPF) systems.

This will be followed by visits in 2027 to the United Kingdom and 14 other jurisdictions, and over time nearly all nations will be evaluated under the FATF’s recently updated methodology.

These visits and the broader FATF assessment process—and in some cases the grey- or black-listings that result—have major implications for private sector financial integrity stakeholders:

• Participation in On-Site Assessments: A representative sample of managers and compliance officers of financial institutions (FIs), designated non-financial businesses and professions (DNFBPs, which include casinos, real estate agencies, precious metals/stones businesses, lawyers, notaries, accountants, and trust and company service providers), and virtual assets service providers (VASPs) are typically involved in the on-site visit.

• Increased Scrutiny from Supervisors: Jurisdictions undergoing a “Mutual Evaluation” by the FATF or an FSRB, or implementing a follow-up action plan, are usually under significant pressure to demonstrate effectiveness, which is generally reflected in increased scrutiny and enforcement actions by AML and sanctions regulators.

• Legal Requirements Associated with FATF Listings: FIs, DNFBPs, VASPs, and their employees need to understand the legal requirements and supervisory expectations associated with FATF listings in the jurisdictions where they operate. These requirements and expectations may differ across jurisdictions. They may demand certain conditions or restrictions with respect to financial relationships, operations, and transactions implicating jurisdictions identified on the FATF lists.

• Country-Risk Rating Methodologies: Compliance and risk management professionals should incorporate the FATF listings into their country risk-rating methodologies—and should do so in a nuanced way. Not every listed country presents an equal risk. The use of FATF status in risk-rating methodologies should consider the underlying bases for each jurisdictional listing by the FATF. FIs, DNFBPs, and VASPs should understand the FATF lists’ limitations for determining jurisdictional risk and should consider referring to the underlying Mutual Evaluation Reports (MERs), rather than listed status alone, across listed and non-listed jurisdictions.

• Risk Mitigation Measures: FIs, DNFBPs, and VASPs should also consider the bases of FATF listings in determining the institution’s risk appetite and the risk mitigation measures appropriate for developing or maintaining relationships or operations in or with FATF-listed jurisdictions. In addition, they should monitor MERs and FATF listing processes and regulatory expectations.

It’s critical for private sector financial integrity professionals—particularly those responsible for financial crime and sanctions compliance and risk management within FIs, DNFBPs, and VASPs—to have a sophisticated understand the FATF standards, mutual evaluations, and listings. Therefore, IFI is publishing a three-part FATF guide breaking down (1) the 40 Recommendations, (2) the mutual evaluation process and follow-up monitoring and listings, and (3) consequences of FATF listings and associated lessons learned.

FATF Standards: The 40 Recommendations

The FATF—an inter-governmental body with 38 member jurisdictions and two regional organizations—sets international standards for the counter-illicit finance (CIF) regimes of countries, including AML/CTF/CPF preventive measures that countries apply to their FIs, DNFBPs, and VASPs. Since its founding in 1989, the FATF’s remit has grown from money laundering alone to combating the financing of terrorism and proliferation of weapons of mass destruction. Similarly, with each revision, its standards have become more expansive, detailed, and stringent, requiring more of both jurisdictions and private sector institutions. The FATF standards, known as “The 40 Recommendations,” were last revised comprehensively in 2012 and have been regularly updated since.

Some FATF standards require a “whole-of-government” approach to implement, while others apply to supervisors or private sector entities.

• An example of a “whole-of-government” standard is Recommendation 1, which indicates that countries should identify, assess, and understanding their ML/TF/PF risks, apply a risk-based approach to preventing ML/TF/PF, and require FIs and DNFBPs identify, assess, and take effective and risk-based actin to mitigate their ML/TF/PF risks.

• An example of a supervisory standard is Recommendation 27, which states in part that “supervisors should have adequate powers to supervise or monitor, and ensure compliance by, FIs with requirements to combat ML and TF, including authority to conduct inspections.”

FIs, DNFBPs, and VASPs should be familiar with the FATF standards that apply directly to private sector entities, as they almost certainly have been implemented by regulatory requirements in the jurisdictions in which they operate. The most prominent of these recommendations include:

1. R10-CDD: FIs, DNFBPs, and VASPs should perform customer due diligence (CDD) measures when establishing business relations and in other specified circumstances and should not hold anonymous accounts or accounts in obviously fictitious names.
2. R11-Recordkeeping: FIs, DNFBPs, and VASPs should maintain, for at least five years, all necessary records on transactions to enable them to comply swiftly with information requests from competent authorities.
3. R12-PEPs: FIs, DNFBPs, and VASPs should perform enhanced due diligence (EDD) and take other precautions if a customer is a politically exposed person (PEP).
4. R13-Correspondent Banking: FIs should perform EDD and take special precautions when providing correspondent banking services.
5. R15-New Technologies: FIs, DNFBPs, and VASPs should understand and prepare for the AML/CFT/CFP impact of new technologies before introducing them.
6. R16-Travel Rule: FIs sending or receiving wire transfers and VASPs sending or receiving virtual asset transfers should ensure that the identity of the sender and receiver is known at all points during the transfer.
7. R17-Reliance on 3Ps: FIs, DNFBPs, and VASPs that rely on third parties to carry out AML/CFT/CFP programs must ensure they meet at least the same standards.
8. R18-Foreign Branches: FIs, DNFBPs, and VASPs should have internal controls and AML/CFT/CFP programs that apply to all their foreign branches and majority-owned subsidiaries and that are designed to effectively manage the risk of ML/TF/PF.
9. R19-Higher-Risk Countries: FIs, DNFBPs, and VASPs should perform EDD and take special precautions when working with clients from, and engaging in transactions with, higher-risk countries.
10. R20-STRs: FIs, DNFBPs, and VASPs should file Suspicious Transaction Reports (STRs) when they suspect that transactions are related to ML/TF/PF.

The FATF is only a policy-setting body; it has no power to enforce its Recommendations. Nevertheless, the endorsement of the FATF’s Recommendations by governments in almost all countries around the world has given them significant weight, and in many cases, they are seen practically as binding rules. A jurisdiction’s adherence to the FATF standards, as periodically assessed in peer review reports called “mutual evaluations,” is one of the most widely accepted markers of its seriousness in combating money laundering and the financing of terrorism and the proliferation of weapons of mass destruction (WMD).

Stay tuned for our next article in this series, which will describe the mutual evaluation process, including the technical compliance and effectiveness components, and what happens when jurisdictions are found to have strategic AML/CFT/CPF deficiencies that present risks to the international financial system.