FATF: How It Works and Why It Matters for Your Business

The Financial Action Task Force (FATF) is the most influential intergovernmental body in global anti-money laundering and counter-terrorist financing policy. Founded in 1989 at the G7 Summit in Paris, initially as a temporary body tasked with examining money laundering techniques and developing an international response, FATF has evolved into the de facto global standard-setter for AML/CFT regulation — with standards that shape domestic legislation across more than 200 jurisdictions. For businesses operating in financial services, understanding what FATF is, how it works, and how its decisions translate into the regulatory environment they operate in is not optional background knowledge; it is foundational.

FATF's Structure and Membership

FATF comprises 37 member jurisdictions and two regional organisations (the European Commission and the Gulf Co-operation Council). Members include all G7 and most G20 economies, representing the world's major financial centres. FATF operates through a Plenary — the decision-making body that meets three times per year — and a Secretariat based in Paris at the OECD headquarters. FATF decisions are reached by consensus among members, giving each member a veto over new standards — a feature that has historically slowed some aspects of the standard-setting process but ensures broad buy-in when standards are agreed.

FATF's reach extends well beyond its 37 members through a network of FATF-Style Regional Bodies (FSRBs): Asia-Pacific Group (APG), Caribbean FATF (CFATF), Egmont Group coordination, Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), and others. These FSRBs conduct mutual evaluations and coordinate AML/CFT implementation in regions not covered by FATF member jurisdictions, extending the FATF framework to virtually every corner of the globe.

The 40 Recommendations

FATF's primary standard-setting output is its 40 Recommendations — the internationally recognised framework for AML/CFT compliance. Originally issued in 1990 and revised multiple times (most significantly in 2003 and 2012, with additional revisions in 2016, 2019, 2021, and 2022), the 40 Recommendations cover: the money laundering and terrorist financing offences and confiscation measures (Recs 1–3); preventive measures for financial institutions and designated non-financial businesses (Recs 4–23); transparency and beneficial ownership (Recs 24–25); powers and responsibilities of competent authorities (Recs 26–35); and international cooperation (Recs 36–40).

The 40 Recommendations are not legally binding in their own right — FATF is not a treaty body and cannot impose law. Their influence operates through a different mechanism: FATF's mutual evaluation process assesses how well each member country has implemented the Recommendations in domestic law and practice, and publishes the results. Jurisdictions with poor evaluation results face the prospect of greylist or blacklist designation, which carries severe commercial consequences. This creates powerful incentives for national compliance without requiring formal legal authority.

Mutual Evaluations: How Countries Are Assessed

The mutual evaluation (ME) process is the cornerstone of FATF's influence. Each member jurisdiction is assessed approximately every 10 years by a team of expert assessors drawn from other FATF member countries. The assessment examines both technical compliance (whether the country's laws and regulations meet the formal requirements of the 40 Recommendations) and effectiveness (whether the AML/CFT system actually produces the intended outcomes in practice).

The effectiveness assessment is organised around 11 Immediate Outcomes — the specific results that an effective AML/CFT system should produce. These include: understanding of money laundering and terrorist financing risks; AML/CFT preventive measures; supervision of financial institutions; transparency of beneficial ownership; financial intelligence; investigation and prosecution of money laundering; investigation and prosecution of terrorist financing; confiscation of criminal proceeds; and international cooperation.

Effectiveness ratings range from "Low," "Moderate," "Substantial," to "High." Countries that receive multiple "Low" or "Moderate" effectiveness ratings are typically placed under enhanced follow-up or referred for consideration of grey-listing. The UK's most recent mutual evaluation (2018) noted several areas requiring improvement, including beneficial ownership transparency and prosecution rates for money laundering offences. The next UK evaluation is expected around 2028.

Blacklist and Greylist: The Commercial Impact

FATF maintains two lists of jurisdictions with AML/CFT deficiencies. The "High-Risk Jurisdictions Subject to a Call for Action" (colloquially the black list) currently includes North Korea and Iran. Black-listed jurisdictions are subject to FATF's call for countermeasures — meaning FATF member states are expected to impose enhanced restrictions, and many do so through their domestic sanctions and enhanced due diligence frameworks. Processing payments from or to black-listed jurisdictions is operationally challenging and potentially prohibited.

The "Jurisdictions Under Increased Monitoring" (the grey list) is more commercially significant for most businesses, as it includes a larger and more commercially active group of countries. Grey-list designation requires enhanced due diligence for transactions with listed jurisdictions and typically triggers correspondent banking de-risking. Understanding which countries are currently grey-listed — and monitoring changes — is a core AML risk management activity for any payment institution with cross-border transaction volumes.

FATF's Influence on Domestic Regulation

FATF's impact on domestic regulation is pervasive. The MLR 2017 in the UK, the EU's AMLD series, and the US Bank Secrecy Act programme are all structured around the FATF framework. When FATF revises a Recommendation — as it did for virtual assets in 2019, for beneficial ownership in 2022, and for proliferation financing in 2021 — domestic legislative changes typically follow within two to three years. Understanding FATF's current policy priorities therefore gives compliance professionals an early indicator of where domestic regulatory requirements are heading.