Applying the FATF Recommendations in an Organisation

Why This Topic Matters
The Financial Action Task Force (FATF) is the global standard-setter for anti-money laundering (AML), counter-terrorist financing (CTF) and counter-proliferation financing. Its 40 Recommendations are not laws in themselves, but more than 200 jurisdictions have committed to implementing them, and national regulators translate them into binding rules. For a CAMS candidate, understanding how an organisation operationalises the FATF Recommendations is essential because exam questions frequently test whether you can move from principle (what FATF says) to practice (what a compliance officer actually does). Weak implementation leads to regulatory enforcement, reputational damage, correspondent banking de-risking and, in the worst case, placement of a country on the FATF grey or black list.

What the FATF Recommendations Are
The 40 Recommendations (last comprehensively revised in 2012 and updated periodically) are organised into seven groups:
1. AML/CFT policies and coordination (Recommendations 1–2) – including the risk-based approach and national cooperation.
2. Money laundering and confiscation (3–4) – criminalising ML and enabling asset freezing and confiscation.
3. Terrorist financing and financing of proliferation (5–8) – criminalising TF, targeted financial sanctions, and non-profit organisation oversight.
4. Preventive measures (9–23) – the core obligations for financial institutions and DNFBPs: customer due diligence (R.10), record keeping (R.11), PEPs (R.12), correspondent banking (R.13), MVTS (R.14), new technologies (R.15, including virtual assets), wire transfers (R.16), reliance on third parties (R.17), internal controls and foreign branches (R.18), higher-risk countries (R.19), suspicious transaction reporting (R.20), tipping off (R.21), and DNFBP obligations (R.22–23).
5. Transparency and beneficial ownership of legal persons and arrangements (24–25).
6. Powers and responsibilities of competent authorities (26–35) – supervision, FIUs, law enforcement, sanctions.
7. International cooperation (36–40) – mutual legal assistance, extradition, information exchange.

In addition, FATF publishes Interpretive Notes, Guidance papers (e.g., on the risk-based approach for banks, virtual assets, beneficial ownership) and Typology reports that help organisations apply the standards in practice.

How an Organisation Applies the Recommendations

1. Adopt a Risk-Based Approach (Recommendation 1)
The foundation of implementation is an enterprise-wide risk assessment. The organisation identifies and assesses its ML/TF risks across customers, products and services, delivery channels, geographies and transactions, considering also the national risk assessment published by its jurisdiction. Based on this, it allocates resources proportionately: enhanced measures where risks are higher and simplified measures where risks are demonstrably lower. The risk assessment must be documented, kept current, approved by senior management and made available to supervisors.

2. Build the Internal Control Framework (Recommendation 18)
FATF requires programmes that include: (a) policies, procedures and controls, including compliance management arrangements and appointment of a compliance officer at management level; (b) screening procedures to ensure high standards when hiring employees; (c) an ongoing employee training programme; and (d) an independent audit function to test the system. Financial groups must apply group-wide programmes, including information sharing for CDD and risk management purposes, and ensure foreign branches and subsidiaries apply measures consistent with home-country requirements where host-country rules are weaker.

3. Implement Customer Due Diligence (Recommendation 10)
Organisations must prohibit anonymous accounts and apply CDD when establishing business relations, conducting occasional transactions above the designated threshold (USD/EUR 15,000, or 1,000 for wire transfers), when there is suspicion of ML/TF, or when there are doubts about previously obtained data. CDD comprises: identifying and verifying the customer; identifying the beneficial owner and taking reasonable measures to verify identity; understanding the purpose and intended nature of the relationship; and conducting ongoing due diligence and transaction scrutiny. If CDD cannot be completed, the institution should not open the account, should terminate the relationship and should consider filing a suspicious transaction report.

4. Apply Enhanced Measures to Higher-Risk Scenarios
– PEPs (R.12): risk management systems to identify PEPs, senior management approval, source of wealth and funds checks, enhanced ongoing monitoring. Foreign PEPs are always treated as higher risk; domestic PEPs and international organisation PEPs on a risk-sensitive basis.
– Correspondent banking (R.13): gather information on the respondent, assess its AML controls, obtain senior management approval, understand respective responsibilities, and prohibit relationships with shell banks.
– Higher-risk countries (R.19): apply enhanced due diligence and any countermeasures called for by FATF regarding jurisdictions on its public statements.
– New technologies and virtual assets (R.15): assess risks before launching new products or technologies; apply AML/CFT obligations to virtual asset service providers, including the "travel rule".

5. Record Keeping (Recommendation 11)
Maintain all transaction records and CDD information for at least five years after the transaction or end of the relationship, sufficient to reconstruct individual transactions and provide evidence for prosecution. Records must be made available swiftly to competent authorities.

6. Suspicious Transaction Reporting and Tipping Off (Recommendations 20–21)
Where the organisation suspects, or has reasonable grounds to suspect, that funds are proceeds of crime or related to TF, it must report promptly to the Financial Intelligence Unit. Staff are protected from liability for good-faith reporting and are prohibited from disclosing ("tipping off") that a report has been or will be filed. Operationally this requires transaction monitoring systems, escalation procedures, investigative capability and a designated reporting officer.

7. Targeted Financial Sanctions (Recommendations 6–7)
Organisations must screen customers and transactions against UN and national sanctions lists relating to terrorism and proliferation financing, and freeze assets without delay and without prior notice.

8. Reliance on Third Parties and Group Arrangements (Recommendation 17)
An institution may rely on a third party to perform CDD elements, but ultimate responsibility remains with the relying institution. It must obtain the necessary information immediately, ensure copies can be obtained without delay, and satisfy itself that the third party is regulated and supervised.

9. Beneficial Ownership (Recommendations 24–25)
Organisations should obtain and verify beneficial ownership information for legal persons and trusts, typically using the 25 percent ownership threshold as a starting point but also identifying those exercising control by other means, and senior managing officials where no natural person is identified.

10. Governance, Culture and Testing
Successful application depends on board and senior management ownership ("tone at the top"), clear accountability, adequate resources, management information, and periodic independent testing. FATF's mutual evaluation methodology assesses both technical compliance (are the rules in place?) and effectiveness (are outcomes being achieved?). Organisations should likewise measure effectiveness, not simply the existence of policies.

Common Implementation Challenges
– Treating the risk-based approach as a one-time exercise rather than a living process.
– Inconsistent application across jurisdictions in a global group.
– Over-reliance on automated systems without skilled human review.
– Difficulty obtaining reliable beneficial ownership data in opaque jurisdictions.
– Confusing FATF guidance (non-binding) with national law (binding) – always follow the stricter requirement where they differ.

Exam Tips: Answering Questions on Applying the FATF Recommendations in an Organisation

Tip 1 – Think "risk-based" first. When a question asks what an institution should do, the answer that reflects proportionate, risk-sensitive action is usually correct. Options that apply the same rigid control to every customer, or that ignore risk altogether, are typically distractors.

Tip 2 – Know the core preventive measures by number and substance. You may not be asked to cite numbers, but you must recognise CDD, record keeping, PEP handling, correspondent banking, wire transfer rules, STR filing and tipping-off as FATF-derived obligations and know their key elements (e.g., five-year retention, senior management approval for PEPs, no shell banks).

Tip 3 – Remember that responsibility cannot be outsourced. In third-party reliance questions, the institution relying on another party remains ultimately responsible for CDD.

Tip 4 – Distinguish FATF from national regulators. FATF sets standards and conducts mutual evaluations; it does not license, supervise or fine individual institutions. If an answer suggests FATF directly penalises a bank, it is wrong.

Tip 5 – Choose the complete programme over the partial one. Recommendation 18 lists four pillars: policies and procedures with a compliance officer, employee screening, training, and independent audit. An answer that omits one pillar is weaker than one that includes all.

Tip 6 – Apply "stricter standard prevails" logic. For foreign branches and subsidiaries, apply home-country standards where host-country rules are less strict, and inform the home supervisor if local law prohibits this.

Tip 7 – Watch for the tipping-off trap. Any answer involving notifying the customer about a suspicious report, or delaying a report to gather consent from the customer, is incorrect.

Tip 8 – When CDD cannot be completed, the correct sequence is: do not open or terminate the relationship, then consider filing an STR. Do not choose options that allow the account to proceed with reduced monitoring.

Tip 9 – Read scenario questions for key risk indicators such as foreign PEP, high-risk jurisdiction, complex ownership structure, cash-intensive business or shell company. These signal that enhanced due diligence and senior management involvement are expected.

Tip 10 – Focus on effectiveness. Modern FATF thinking, and modern CAMS questions, emphasise whether controls actually work. Prefer answers that involve testing, updating risk assessments, management information and independent review over answers that simply state a policy exists.

Quick Recap
Applying the FATF Recommendations means translating global standards into a documented, risk-based, board-approved AML/CFT programme with sound CDD, enhanced measures for higher risk, robust record keeping, timely suspicious activity reporting, sanctions screening, trained staff and independent testing – implemented consistently across the whole group and measured for effectiveness, not just existence.