The FATF Framework and Global AML Standards

FATF was created in 1989 with a mandate to examine money laundering techniques and recommend responses. Its first 40 Recommendations appeared in 1990, focused on drug money. By 1996 they had been revised to cover all serious crimes. The September 2001 attacks produced Eight Special Recommendations on terrorism financing, incorporated into a revised single set of 40 Recommendations in 2012 that also added proliferation financing as a third pillar alongside AML and CTF.

FATF has 40 members: 38 countries and two regional organizations, the European Commission and the Gulf Co-operation Council. Nine FATF-Style Regional Bodies (FSRBs), including MONEYVAL for Council of Europe members, GIABA for West Africa, and the Asia/Pacific Group on Money Laundering (APG), extend the framework to more than 200 jurisdictions as associate or observer members. The FATF Secretariat is housed at the OECD in Paris.

The 40 Recommendations are grouped into seven thematic sections. They do not prescribe exactly how a country must implement them, only the outcome that must be achieved, which is why national laws can take quite different forms while all claiming FATF compliance.

Recommendation 10, on customer due diligence (CDD), is the most operationally significant for financial institutions. It requires identifying and verifying customers and beneficial owners, understanding the nature of the business relationship, and conducting ongoing monitoring of transactions. The risk-based extension in Recommendations 1 and 10 means higher-risk customers must receive enhanced CDD, while lower-risk relationships can receive simplified measures.

Mutual evaluations are the enforcement mechanism of the FATF system. Each member country is assessed on a rolling four-to-seven-year cycle. An evaluation team of eight to twelve experts, drawn from other FATF member institutions, spends roughly two weeks on-site reviewing laws, interviewing supervisors, financial institutions, and prosecutors, and testing whether the system produces results: convictions, confiscations, and financial intelligence that leads to cases.

The evaluation produces two sets of ratings. Technical compliance ratings (Compliant, Largely Compliant, Partially Compliant, Non-Compliant) assess whether the legal framework meets each Recommendation. Effectiveness ratings assess eleven Immediate Outcomes covering results such as the use of financial intelligence by law enforcement, the quality of supervision, and the prosecution of money laundering. A country can have technically sound laws yet receive low effectiveness ratings if convictions and confiscations are rare.

FATF publishes two public lists at each of its three plenary sessions per year. The Jurisdictions Under Increased Monitoring list, universally called the grey list, currently contains around twenty jurisdictions that have committed to addressing strategic deficiencies within an agreed timeline. The High-Risk Jurisdictions Subject to a Call for Action, the black list, currently names only a handful of countries including North Korea and Iran, to which FATF calls on members to apply counter-measures.

• Correspondent banking withdrawal: major banks apply enhanced or prohibitive due diligence to grey-listed jurisdictions, sometimes exiting the relationship entirely. The World Bank has documented de-risking as a serious secondary consequence of grey listing for smaller economies.
• IMF and multilateral lending: the IMF and regional development banks treat FATF ratings as a factor in program conditions and risk assessments, affecting access to concessional financing.
• Foreign direct investment: private investors apply their own enhanced due diligence to grey-listed jurisdictions, raising transaction costs and deterring investment.
• Diplomatic pressure: FATF listing has become a tool of foreign policy; listing decisions are not purely technical and have been contested by listed countries on those grounds.

FATF standards become operational through domestic legislation. Three major legislative frameworks illustrate how different jurisdictions have implemented the same international baseline.

• USA PATRIOT Act (2001): Title III of the Act, the International Money Laundering Abatement and Anti-Terrorist Financing Act, imposed CDD requirements on US financial institutions for foreign correspondent accounts, prohibited accounts for foreign shell banks, mandated beneficial ownership identification for private banking accounts, and empowered FinCEN to issue special measures against jurisdictions of primary money laundering concern under Section 311.
• EU Anti-Money Laundering Directives: the EU has issued six successive AMLDs. The 4th AMLD (2015) introduced beneficial ownership registers for companies. The 5th AMLD (2018) made those registers publicly accessible and brought virtual asset service providers and art dealers under AML obligations. The 6th AMLD (2018) harmonised the list of predicate offences and strengthened criminal liability for legal persons.
• India Prevention of Money Laundering Act 2002 (PMLA): enacted in 2002 and in force from 2005, the PMLA criminalises money laundering as a standalone offence, establishes attachment and confiscation powers for proceeds of crime, creates reporting obligations for banks and other reporting entities, and empowers the Enforcement Directorate to investigate. Significant amendments in 2012 widened the schedule of predicate offences and strengthened FIU reporting. The Supreme Court's 2022 judgments in Vijay Madanlal Choudhary v. Union of India upheld the ED's broad powers under the PMLA.