FATF Role, Mandate and the 40 Recommendations

Why This Topic Matters for the CAMS Exam

The Financial Action Task Force (FATF) is the single most important reference point in the entire anti-financial crime (AFC) framework. Nearly every national AML/CFT law, every regulator's expectations, and every compliance program you will ever encounter traces back, directly or indirectly, to the FATF Recommendations. For this reason, the CAMS exam tests FATF knowledge heavily, both as direct recall questions (what does FATF do, what does a specific Recommendation require) and indirectly through scenario questions where you must recognise an FATF principle, such as the risk-based approach, customer due diligence or beneficial ownership transparency, applied in practice.

Understanding FATF also helps you organise everything else in the International AFC Standards and Authorities domain. Once you know what FATF is and is not, you can clearly distinguish it from the Basel Committee, the Wolfsberg Group, the Egmont Group, the United Nations, the IMF and the World Bank, which are frequent distractors in exam answer choices.

What FATF Is

Origins. FATF was established in 1989 by the G7 Summit in Paris in response to growing concern about money laundering, initially linked to drug trafficking. Its first task was to examine laundering techniques and recommend countermeasures, which produced the original 40 Recommendations in 1990.

Nature of the body. FATF is an intergovernmental policy-making body. It is important to grasp what this means:
- It is not a treaty-based organisation and it is not a law enforcement agency, a regulator, or a court.
- It sets international standards (soft law) rather than binding legislation. Its Recommendations become binding only when jurisdictions implement them in domestic law.
- It has no direct power to fine or prosecute. Its influence comes from peer pressure, mutual evaluations, and the public identification of deficient jurisdictions.

Location and structure. The FATF Secretariat is housed at the Organisation for Economic Co-operation and Development (OECD) headquarters in Paris, although FATF is independent of the OECD. FATF has a rotating Presidency (now a two-year term) and meets in Plenary, its decision-making body, three times a year (typically February, June and October).

Membership. FATF currently comprises 39 members: 37 member jurisdictions and 2 regional organisations (the European Commission and the Gulf Co-operation Council). Russia's membership was suspended in 2023. In addition, FATF has observer organisations such as the IMF, World Bank, United Nations, Egmont Group, Interpol and the Basel Committee.

The Global Network and FSRBs. FATF's reach extends far beyond its members through nine FATF-Style Regional Bodies (FSRBs), which commit to implementing the FATF standards and conduct mutual evaluations of their own members. These are: APG (Asia/Pacific), CFATF (Caribbean), EAG (Eurasian), ESAAMLG (Eastern and Southern Africa), GABAC (Central Africa), GAFILAT (Latin America), GIABA (West Africa), MENAFATF (Middle East and North Africa) and MONEYVAL (Council of Europe). Together FATF and the FSRBs form a Global Network of more than 200 jurisdictions.

The FATF Mandate and How It Evolved

The exam frequently tests the evolution of the mandate, so memorise this timeline:
- 1989: Created to combat money laundering.
- 1990: Original 40 Recommendations issued.
- 1996: First major revision; predicate offences expanded beyond drug trafficking.
- 2001: Following the 11 September attacks, the mandate expanded to terrorist financing, and FATF issued Eight Special Recommendations on Terrorist Financing.
- 2003: Major revision of the 40 Recommendations, introducing elements of the risk-based approach, beneficial ownership and coverage of designated non-financial businesses and professions (DNFBPs).
- 2004: A Ninth Special Recommendation (cash couriers) was added, making the Nine Special Recommendations (often written 40+9).
- 2008: Mandate expanded to include financing of the proliferation of weapons of mass destruction.
- 2012: Comprehensive revision. The Special Recommendations were integrated into a single consolidated set of 40 Recommendations covering money laundering, terrorist financing and proliferation financing. The risk-based approach was placed at the very front as Recommendation 1.
- 2018 to 2019: Recommendation 15 amended so the standards apply to virtual assets and virtual asset service providers (VASPs).
- 2019: FATF ministers made the FATF mandate open-ended, replacing the previous system of fixed-term renewals.

FATF's three core functions are often summarised as:
1. Setting standards (the Recommendations, Interpretive Notes, Glossary and guidance papers).
2. Assessing compliance through mutual evaluations and follow-up.
3. Identifying threats through typologies research and publicly identifying high-risk and non-cooperative jurisdictions.

The 40 Recommendations: Structure and Content

The 2012 Recommendations are organised into seven thematic groups (A through G). You do not need to recite every Recommendation verbatim, but you should know the groups, the key Recommendations within them and the main obligations.

A. AML/CFT Policies and Coordination (R.1 to R.2)
- R.1 Assessing risks and applying a risk-based approach (RBA). Countries must identify, assess and understand their ML/TF risks and apply resources accordingly; financial institutions and DNFBPs must do the same. Enhanced measures where risks are higher; simplified measures may be permitted where risks are lower.
- R.2 National cooperation and coordination, including national AML/CFT policies and coordination among policy-makers, the FIU, law enforcement and supervisors.

B. Money Laundering and Confiscation (R.3 to R.4)
- R.3 Criminalise money laundering on the basis of the Vienna Convention (1988) and Palermo Convention (2000), applying it to all serious offences with the widest range of predicate offences.
- R.4 Confiscation and provisional measures, including the ability to freeze, seize and confiscate laundered property and proceeds.

C. Terrorist Financing and Financing of Proliferation (R.5 to R.8)
- R.5 Criminalise terrorist financing consistent with the Terrorist Financing Convention, including financing of terrorist organisations and individual terrorists even absent a link to a specific act.
- R.6 Targeted financial sanctions related to terrorism and terrorist financing (implementing UN Security Council resolutions, freezing without delay).
- R.7 Targeted financial sanctions related to proliferation.
- R.8 Non-profit organisations: a focused, risk-based approach to protecting NPOs from terrorist financing abuse.

D. Preventive Measures (R.9 to R.23) - the heart of the Recommendations for compliance professionals.
- R.9 Financial institution secrecy laws must not inhibit implementation of the Recommendations.
- R.10 Customer due diligence (CDD). Anonymous accounts or accounts in obviously fictitious names are prohibited. CDD is required when: establishing a business relationship; carrying out occasional transactions above USD/EUR 15,000 or wire transfers covered by R.16; there is suspicion of ML/TF; or there are doubts about previously obtained customer data. The four CDD elements are: identify and verify the customer; identify the beneficial owner and take reasonable measures to verify; understand the purpose and intended nature of the relationship; conduct ongoing due diligence.
- R.11 Record keeping for at least five years after the transaction or end of the relationship.
- R.12 Politically exposed persons (PEPs). Foreign PEPs always require enhanced measures (senior management approval, establishing source of wealth and funds, enhanced ongoing monitoring). Domestic PEPs and persons entrusted with a prominent function by an international organisation are treated on a risk-sensitive basis.
- R.13 Correspondent banking: gather information on the respondent, assess its AML controls, obtain senior management approval, and prohibit relationships with shell banks.
- R.14 Money or value transfer services (MVTS) must be licensed or registered and subject to monitoring.
- R.15 New technologies, including virtual assets and VASPs, which must be licensed or registered and supervised.
- R.16 Wire transfers: required originator and beneficiary information must accompany transfers (the travel rule), with a de minimis threshold of USD/EUR 1,000.
- R.17 Reliance on third parties to perform CDD, with ultimate responsibility remaining with the relying institution.
- R.18 Internal controls (compliance officer, screening, training, independent audit) and group-wide programmes for foreign branches and subsidiaries.
- R.19 Higher-risk countries: apply enhanced due diligence to relationships with persons from countries identified by FATF, and countermeasures where called for.
- R.20 Reporting of suspicious transactions to the FIU when there are reasonable grounds to suspect funds are proceeds of crime or linked to TF.
- R.21 Safe harbour protection for good-faith reporting and prohibition on tipping off.
- R.22 and R.23 Extend CDD, record keeping, PEP, reporting and internal control obligations to DNFBPs: casinos (CDD threshold USD/EUR 3,000), real estate agents, dealers in precious metals and stones (cash threshold USD/EUR 15,000), lawyers, notaries and accountants (for specified activities), and trust and company service providers.

E. Transparency and Beneficial Ownership (R.24 to R.25)
- R.24 Legal persons: adequate, accurate and up-to-date beneficial ownership information, available to competent authorities in a timely manner; strengthened in 2022 to require a multi-pronged approach including registries.
- R.25 Legal arrangements (trusts and similar): trustees must obtain and hold beneficial ownership information.

F. Powers and Responsibilities of Competent Authorities (R.26 to R.35)
- R.26 to R.28 Regulation and supervision of financial institutions and DNFBPs, with supervisors having adequate powers and applying a risk-based approach.
- R.29 Each country must establish a Financial Intelligence Unit (FIU) as the national centre for receiving and analysing suspicious transaction reports and disseminating results.
- R.30 and R.31 Responsibilities and powers of law enforcement and investigative authorities.
- R.32 Cash couriers: declaration or disclosure systems for cross-border movement of currency and bearer negotiable instruments.
- R.33 Maintaining comprehensive statistics.
- R.34 Guidance and feedback to reporting entities.
- R.35 Effective, proportionate and dissuasive sanctions for non-compliance.

G. International Cooperation (R.36 to R.40)
- R.36 Become party to and implement the key international conventions (Vienna, Palermo, Merida/UNCAC, Terrorist Financing Convention).
- R.37 and R.38 Mutual legal assistance, including for freezing and confiscation.
- R.39 Extradition, with ML and TF as extraditable offences.
- R.40 Other forms of international cooperation, such as FIU-to-FIU and supervisor-to-supervisor exchange.

How FATF Works in Practice: Mutual Evaluations and Public Lists

Mutual evaluations. FATF and the FSRBs assess each member through a peer-review process. An assessment team reviews legislation, conducts an on-site visit, and produces a Mutual Evaluation Report (MER). Under the 2013 Methodology, two dimensions are assessed:
- Technical compliance: does the country have the laws and institutions required by each of the 40 Recommendations? Each Recommendation is rated Compliant (C), Largely Compliant (LC), Partially Compliant (PC) or Non-Compliant (NC).
- Effectiveness: does the system actually work? This is measured against 11 Immediate Outcomes (for example, understanding of risk, international cooperation, supervision, preventive measures, beneficial ownership transparency, use of financial intelligence, ML investigations and prosecutions, confiscation, TF, and PF sanctions), each rated High, Substantial, Moderate or Low.

After the MER, a country enters either regular or enhanced follow-up depending on its results and must report back on progress.

Public identification of jurisdictions. Through the International Co-operation Review Group (ICRG) process, which replaced the earlier Non-Cooperative Countries and Territories (NCCT) initiative of 2000 to 2006, FATF publishes two lists after each Plenary:
- Jurisdictions under Increased Monitoring (commonly called the grey list): countries with strategic deficiencies that have committed to an action plan and are actively working with FATF.
- High-Risk Jurisdictions subject to a Call for Action (commonly called the black list): countries with serious strategic deficiencies where FATF calls on members to apply enhanced due diligence and, in the most serious cases, countermeasures. The Democratic People's Republic of Korea and Iran have long been on this list, joined more recently by Myanmar.

Listing has real economic consequences: increased compliance costs for banks dealing with the jurisdiction, de-risking, reduced investment and reputational harm. This is the main mechanism through which FATF's soft law achieves compliance.

Typologies and guidance. FATF also publishes reports on money laundering and terrorist financing methods and trends (typologies), risk-based approach guidance for specific sectors (banking, securities, legal professionals, virtual assets, etc.), and best-practice papers. These documents are frequently referenced in compliance programs and regulatory expectations.

Distinguishing FATF from Other Bodies

Exam distractors often swap FATF with similar-sounding organisations. Keep these distinctions clear:
- FATF: intergovernmental standard-setter for AML/CFT/CPF; 40 Recommendations; mutual evaluations; grey and black lists.
- Basel Committee on Banking Supervision: central banks and bank supervisors; issues guidance on sound management of ML/TF risks in banks, customer due diligence for banks and the Core Principles; focus is prudential banking supervision.
- Wolfsberg Group: association of global private-sector banks; issues principles on correspondent banking, private banking, trade finance and the Correspondent Banking Due Diligence Questionnaire (CBDDQ). Not a government body.
- Egmont Group: network of national FIUs facilitating secure information exchange and FIU cooperation.
- United Nations: produces binding conventions (Vienna, Palermo, Merida, Terrorist Financing) and Security Council resolutions creating sanctions obligations.
- IMF and World Bank: conduct AML/CFT assessments using the FATF Methodology, provide technical assistance and integrate AML/CFT into financial sector assessments.
- European Union: issues binding AML Directives and Regulations for member states, which implement and often go beyond FATF standards.

Exam Tips: Answering Questions on FATF Role, Mandate and the 40 Recommendations

1. Anchor on what FATF is and is not. If an answer choice describes FATF as enforcing laws, prosecuting launderers, imposing fines, or issuing binding legislation, it is almost certainly wrong. FATF sets standards, evaluates compliance and applies peer pressure. The correct answer will typically use words like recommendations, standards, mutual evaluation, peer review or intergovernmental.

2. Know the timeline cold. Expect questions on when FATF was created (1989, G7, Paris), when terrorist financing was added (2001), when proliferation financing was added (2008), and when the Special Recommendations were folded into the 40 Recommendations (2012). A common trap is an answer referring to 40+9 Recommendations as the current standard; this is historical, not current.

3. Remember Recommendation 1 is the risk-based approach. Many scenario questions describe an institution allocating resources according to risk, applying simplified due diligence to a low-risk product or enhanced due diligence to a high-risk customer. The underlying principle is FATF R.1. If asked what FATF expects a country or institution to do first, the answer is to identify, assess and understand its risks.

4. Memorise the key numerical thresholds and time frames. Occasional transactions: USD/EUR 15,000. Casinos: USD/EUR 3,000. Dealers in precious metals and stones: USD/EUR 15,000 in cash. Wire transfers (travel rule): USD/EUR 1,000. Record retention: minimum five years. Beneficial ownership: FATF interpretive guidance cites a 25% ownership threshold as an example. These appear as both direct questions and as details inside scenarios.

5. Know the four CDD elements and the CDD triggers. If a question asks what CDD requires, look for the answer that includes identifying and verifying the customer, identifying the beneficial owner, understanding the purpose of the relationship, and ongoing monitoring. If it asks when CDD is required, remember: new relationship, occasional transaction above threshold, suspicion, or doubts about existing data.

6. Distinguish foreign PEPs from domestic PEPs. Foreign PEPs are always high risk and always require enhanced measures under R.12. Domestic and international organisation PEPs are handled on a risk basis. An answer stating that all PEPs must automatically receive the same enhanced treatment regardless of type is not aligned with FATF.

7. Know the DNFBP list. Casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, other independent legal professionals and accountants, and trust and company service providers. If a question lists a business and asks whether FATF standards apply, check it against this list and against the definition of financial institution. Note that FATF obligations for lawyers and accountants apply when they carry out specific listed activities, not to all their work.

8. Separate the grey list from the black list. Jurisdictions under Increased Monitoring are cooperating with FATF on an action plan; High-Risk Jurisdictions subject to a Call for Action trigger enhanced due diligence and possibly countermeasures. If a scenario asks what an institution should do with a customer from a listed country, the answer depends on which list: enhanced due diligence for both, with countermeasures reserved for the Call for Action list where FATF has specified them.

9. Understand the two dimensions of mutual evaluations. Technical compliance looks at laws on paper (C, LC, PC, NC ratings against the 40 Recommendations); effectiveness looks at results in practice (11 Immediate Outcomes rated High, Substantial, Moderate, Low). Questions may describe a country with excellent legislation but few prosecutions or confiscations and ask what the problem is; the answer relates to effectiveness, not technical compliance.

10. Read for the best answer, not just a correct one. CAMS questions often offer two plausible answers. Ask which one most directly reflects FATF's stated role or the specific Recommendation at issue. For example, when asked why FATF standards matter to a bank in a non-member country, the best answer references the Global Network and FSRBs or the fact that national regulators implement FATF standards, not that FATF directly supervises the bank.

11. Watch for organisation swaps. If a question describes a private-sector banking group issuing due diligence principles, it is Wolfsberg, not FATF. If it describes FIU-to-FIU information exchange, think Egmont. If it describes a binding convention, think the United Nations. Eliminate choices that attribute these roles to FATF.

12. Link FATF to conventions. R.3 and R.36 rest on the Vienna Convention (drug money laundering), the Palermo Convention (transnational organised crime), the Terrorist Financing Convention and the Merida Convention (corruption). Questions may ask which convention first required criminalising money laundering (Vienna, 1988) or which extended predicate offences to serious crime more broadly (Palermo, 2000).

Quick Revision Summary

- FATF: created 1989 by G7, Paris; Secretariat at OECD; 39 members; nine FSRBs; Global Network of 200+ jurisdictions.
- Role: set standards, assess compliance, identify risks and non-compliant jurisdictions. No enforcement power; influence through peer pressure and public listing.
- Mandate: money laundering (1989), terrorist financing (2001), proliferation financing (2008), virtual assets (2018 to 2019), open-ended since 2019.
- 40 Recommendations (2012 consolidated version) in seven groups: policies and coordination; ML and confiscation; TF and PF; preventive measures; beneficial ownership transparency; competent authorities; international cooperation.
- Key numbers: 15,000 occasional transaction; 3,000 casinos; 1,000 wire transfers; five-year records; 25% beneficial ownership guide.
- Mutual evaluations assess technical compliance (C/LC/PC/NC) and effectiveness (11 Immediate Outcomes).
- Grey list = Increased Monitoring; black list = Call for Action.

Master these points and you will be able to handle both the direct recall questions and the scenario-based questions that the CAMS exam uses to test your understanding of FATF's role, mandate and the 40 Recommendations.