FATF Guidelines
International standards from the Financial Action Task Force setting AML and counter-terrorism financing requirements.
The Financial Action Task Force (FATF) is an intergovernmental organization established in 1989 by the G7 that sets international standards for combating money laundering (AML), terrorist financing (CFT), and proliferation financing (CPF). Its 40 Recommendations constitute the globally recognized framework that over 200 jurisdictions have committed to implement.
FATF's 40 Recommendations cover: risk-based approach (countries and institutions should identify, assess, and understand their ML/TF risks and focus resources proportionally); customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk customers; record-keeping requirements; reporting of suspicious transactions; targeted financial sanctions for terrorism and proliferation; transparency and beneficial ownership of legal persons; powers and responsibilities of competent authorities; and international cooperation.
FATF conducts mutual evaluations (peer reviews) of member countries, assessing technical compliance with the 40 Recommendations and the effectiveness of their AML/CFT systems. Countries with significant deficiencies are placed on the FATF 'grey list' (increased monitoring) or 'black list' (call for action), triggering enhanced due diligence requirements from financial institutions globally and potential loss of correspondent banking relationships.
FATF Guidance Notes clarify how Recommendations apply to specific sectors: virtual assets (cryptocurrencies), professional money launderers, real estate, and high-risk third-party payment processing. The guidance on virtual assets and Virtual Asset Service Providers (VASPs) has driven global cryptocurrency regulation.
Financial institutions implement FATF standards through their internal AML compliance programs, which are examined by national supervisors (FinCEN, OCC, FCA) for alignment with FATF-based national AML frameworks.
FAQs
What is the FATF grey list and what are its consequences?
The FATF grey list (officially the 'Jurisdictions under Increased Monitoring') identifies countries with strategic deficiencies in their AML/CFT frameworks who have made a high-level political commitment to address them within agreed timelines. Grey-listed jurisdictions face heightened scrutiny: financial institutions globally must apply enhanced due diligence to transactions involving grey-listed countries, corresponding banking relationships may be restricted or terminated, and investor confidence in grey-listed economies declines. For businesses operating in grey-listed countries, banking services become more expensive and difficult to access. Countries work actively to exit the grey list by implementing FATF-required reforms and demonstrating effectiveness.
How has FATF regulated cryptocurrency under its guidance?
FATF extended its AML/CFT standards to Virtual Assets (VA) and Virtual Asset Service Providers (VASPs) through revised Recommendation 15, requiring countries to regulate and supervise VASPs and apply the same CDD, suspicious activity reporting, and record-keeping requirements as traditional financial institutions. The 'Travel Rule' (FATF Recommendation 16 applied to VASPs) requires VASPs to collect and transmit beneficiary and originator information with virtual asset transfers, analogous to wire transfer requirements. Implementation varies globally—major jurisdictions (EU, Singapore, UAE, UK) have enacted VASP registration and AML frameworks; the U.S. has applied existing FinCEN regulations to VASPs.
What is the risk-based approach under FATF?
The FATF risk-based approach requires countries, supervisors, and financial institutions to identify, assess, and understand their specific money laundering and terrorist financing risks, and to apply resources and controls proportionally to those risks rather than applying uniform measures to all customers and transactions. High-risk situations require enhanced controls (deeper due diligence, more frequent monitoring, senior management approval); lower-risk situations may justify simplified measures. This approach acknowledges that not all customers, products, and geographies carry equal risk and allows compliance programs to be more effective and efficient than a one-size-fits-all approach. Regulators expect documented risk assessments justifying the risk rating assigned to different customer and product segments.
Related Terms
CDD (Customer Due Diligence)
Process of verifying customer identity and assessing risk before and during a financial relationship.
EDD (Enhanced Due Diligence)
More intensive customer due diligence applied to higher-risk customers, including PEPs and high-risk jurisdictions.
BSA (Bank Secrecy Act)
U.S. primary anti-money laundering law requiring financial institutions to assist in detecting and preventing financial crimes.
Beneficial Ownership
Identification of natural persons who ultimately own or control a legal entity above a defined ownership threshold.
