FATF Recommendations and AML Frameworks

Why This Topic Matters

Money laundering is the process by which criminals disguise the illicit origin of funds so that the proceeds of fraud, corruption, drug trafficking and other crimes appear legitimate. Because virtually every major fraud scheme produces dirty money that must be cleaned, the ACFE treats anti-money laundering (AML) knowledge as core competence for a Certified Fraud Examiner. The Financial Transactions and Fraud Schemes section of the CFE Exam contains a dedicated money laundering area, and a meaningful share of those questions test the international AML architecture, with the Financial Action Task Force (FATF) at its center.

Fraud examiners need this knowledge for practical reasons too. When you trace proceeds across borders, you rely on suspicious transaction reports, Financial Intelligence Units (FIUs), beneficial ownership registers and mutual legal assistance channels that exist only because jurisdictions implemented the FATF standards. Understanding the framework tells you what records should exist, who holds them, which institutions had a legal duty to perform due diligence, and where the control failures are likely to be found.

What Is the FATF?

The Financial Action Task Force is an intergovernmental policy-making body established in 1989 by the G7 summit held in Paris. Its original mandate was to examine money laundering techniques and set standards to combat them. After the September 2001 attacks its mandate expanded to cover terrorist financing, and later to the financing of the proliferation of weapons of mass destruction. In 2019 its members made the mandate open-ended rather than renewable.

Key facts examiners should remember:
• The FATF Secretariat is housed at the OECD headquarters in Paris, but the FATF is not part of the OECD.
• The FATF has roughly 40 members, including two regional organizations (the European Commission and the Gulf Cooperation Council). Many more countries participate through FATF-Style Regional Bodies (FSRBs) such as APG (Asia/Pacific), MONEYVAL (Council of Europe), CFATF (Caribbean), GAFILAT (Latin America), ESAAMLG and GIABA (Africa), MENAFATF (Middle East and North Africa) and EAG (Eurasia).
• The FATF is not a law enforcement agency, does not investigate cases, does not prosecute, and does not have a treaty basis. Its standards are soft law: they are not binding treaties, yet they are enforced through peer pressure, mutual evaluations and public listing of non-compliant jurisdictions.
• The Egmont Group (founded 1995) is a separate body that networks national FIUs. The Wolfsberg Group is a separate association of large private banks that issues industry guidance. The Basel Committee on Banking Supervision issues prudential and customer due diligence guidance for banks. Exam questions frequently test whether you can tell these organizations apart.

The FATF Recommendations: Structure

The FATF first issued Forty Recommendations in 1990. They were revised in 1996 and 2003, and after 2001 the FATF added Nine Special Recommendations on terrorist financing (often cited as the 40+9). In February 2012 the standards were consolidated into a single set of 40 Recommendations that incorporate terrorist financing and proliferation financing. The 2012 text, with ongoing amendments, is the current standard and is accompanied by Interpretive Notes and a Glossary that carry equal weight.

The 40 Recommendations are grouped into seven sections:

A. AML/CFT Policies and Coordination (R.1–2). R.1 requires countries and institutions to adopt a risk-based approach: identify, assess and understand ML/TF risks and apply resources proportionately. Countries must conduct national risk assessments. R.2 requires national cooperation and coordination among policy makers, the FIU, law enforcement and supervisors.

B. Money Laundering and Confiscation (R.3–4). R.3 requires countries to criminalize money laundering on the basis of the 1988 Vienna Convention and the 2000 Palermo Convention, applying it to the widest range of predicate offenses (the FATF lists designated categories of offenses, including fraud, corruption, tax crimes, insider trading and market manipulation). R.4 requires provisional measures and confiscation of laundered property, proceeds and instrumentalities, including the ability to freeze and seize without prior notice.

C. Terrorist Financing and Financing of Proliferation (R.5–8). Criminalization of terrorist financing, targeted financial sanctions pursuant to UN Security Council resolutions (including UNSCR 1267 and 1373), proliferation financing sanctions, and risk-based oversight of non-profit organizations that may be abused.

D. Preventive Measures (R.9–23). This is the heart of the compliance program and the most heavily tested section:
• R.9 – Financial institution secrecy laws must not inhibit implementation of the Recommendations.
• R.10 – Customer Due Diligence (CDD). Anonymous accounts and accounts in obviously fictitious names are prohibited. CDD must be performed when establishing a business relationship, when carrying out occasional transactions above the designated threshold (USD/EUR 15,000) or wire transfers covered by R.16, when there is a suspicion of ML/TF, or when there are doubts about previously obtained customer data. CDD involves identifying and verifying the customer, identifying the beneficial owner, understanding the purpose and nature of the relationship, and conducting ongoing monitoring. Where risk is higher, enhanced due diligence applies; where risk is lower, simplified measures may be permitted.
• R.11 – Record keeping. Transaction records and CDD information must be kept for at least five years and be available swiftly to competent authorities.
• R.12 – Politically Exposed Persons (PEPs). Foreign PEPs always require enhanced measures: risk management systems to identify them, senior management approval, establishing source of wealth and source of funds, and enhanced ongoing monitoring. Domestic PEPs and persons entrusted with prominent functions by international organizations are treated on a risk basis. Family members and close associates are included.
• R.13 – Correspondent banking. Gather information on the respondent, assess its AML controls, obtain senior management approval, and prohibit relationships with shell banks (banks with no physical presence and no affiliation with a regulated group).
• R.14 – Money or value transfer services must be licensed or registered and supervised.
• R.15 – New technologies. Amended in 2018–2019 to cover virtual assets and virtual asset service providers (VASPs), which must be licensed or registered and subject to AML obligations.
• R.16 – Wire transfers. Originator and beneficiary information must accompany transfers (the so-called travel rule), with a de minimis threshold of USD/EUR 1,000.
• R.17 – Reliance on third parties for CDD is permitted under conditions, but ultimate responsibility remains with the relying institution.
• R.18 – Internal controls, including a compliance officer, employee screening, ongoing training and an independent audit function; group-wide programs and foreign branches.
• R.19 – Enhanced due diligence for business relationships and transactions with higher-risk countries called out by the FATF, and the ability to apply countermeasures.
• R.20 – Reporting of suspicious transactions. If an institution suspects or has reasonable grounds to suspect that funds are the proceeds of crime or related to terrorist financing, it must report promptly to the FIU. There is no monetary threshold for suspicion-based reports.
• R.21 – Tipping-off and confidentiality. Institutions, directors and employees are protected from liability for good-faith reporting and are prohibited from disclosing to the customer that a report has been filed.
• R.22–23 – Designated Non-Financial Businesses and Professions (DNFBPs). CDD, record keeping and reporting obligations extend to casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries and other independent legal professionals, accountants, and trust and company service providers.

E. Transparency and Beneficial Ownership (R.24–25). Countries must ensure adequate, accurate and up-to-date information on the beneficial ownership of legal persons (companies) and legal arrangements (trusts) is available to competent authorities. Bearer shares and nominee arrangements must be controlled. The 2022 revisions require a public authority or body to hold beneficial ownership information in a registry or alternative mechanism.

F. Powers and Responsibilities of Competent Authorities (R.26–35). Risk-based supervision of financial institutions and DNFBPs, powers of supervisors, the establishment of a Financial Intelligence Unit (R.29) as the national center for receiving and analyzing suspicious transaction reports, responsibilities of law enforcement, investigative powers, controls on cross-border cash couriers (R.32, with declaration or disclosure systems), statistics, guidance and feedback, and effective, proportionate and dissuasive sanctions (R.35).

G. International Cooperation (R.36–40). Ratification of the Vienna, Palermo, Merida (UN Convention Against Corruption) and Terrorist Financing Conventions; mutual legal assistance; freezing and confiscation at the request of foreign states; extradition; and other forms of information exchange between FIUs, supervisors and law enforcement.

How the FATF Framework Works in Practice

1. Standard setting. The FATF plenary meets three times a year and adopts amendments, interpretive notes, guidance papers and typologies reports describing emerging laundering methods.

2. Mutual evaluations. Each member is periodically assessed by a team of peers. Since the fourth round began in 2014, evaluations measure both technical compliance (is each Recommendation reflected in law and regulation, rated Compliant, Largely Compliant, Partially Compliant or Non-Compliant) and effectiveness (are results being achieved, measured against 11 Immediate Outcomes and rated High, Substantial, Moderate or Low). Countries with weak results enter enhanced follow-up.

3. Public identification of high-risk jurisdictions. The FATF publishes two lists. Jurisdictions under Increased Monitoring (commonly called the grey list) have strategic deficiencies but have committed to an action plan. High-Risk Jurisdictions Subject to a Call for Action (the black list) have such serious deficiencies that members are told to apply enhanced due diligence or countermeasures; Iran and North Korea have been on this list for years. Listing damages a country's access to correspondent banking and investment, which is the main source of the FATF's leverage.

4. National implementation. Each country translates the Recommendations into domestic law. In the United States the framework comprises the Bank Secrecy Act of 1970 (currency transaction reports for cash transactions over USD 10,000, record keeping, and later suspicious activity reports), the Money Laundering Control Act of 1986 (which first made money laundering a federal crime and criminalized structuring), the USA PATRIOT Act of 2001 (Title III, which mandated written AML programs, customer identification programs, enhanced due diligence for correspondent and private banking accounts, information sharing under Sections 314(a) and 314(b), and a prohibition on shell bank relationships), and the Anti-Money Laundering Act of 2020 (which created the FinCEN beneficial ownership registry through the Corporate Transparency Act and expanded whistleblower rewards). FinCEN is the US FIU. In the European Union, successive Anti-Money Laundering Directives and the 2024 AML Regulation and new EU AML Authority (AMLA) implement the standards. The United Kingdom relies on the Proceeds of Crime Act 2002 and the Money Laundering Regulations.

5. Institutional compliance programs. Within a bank or DNFBP, the framework becomes the familiar pillars of an AML program: written policies and procedures, a designated compliance officer, employee training, independent testing, a risk-based CDD process, transaction monitoring, suspicious activity reporting, and record retention. Fraud examiners assess these pillars when evaluating whether an institution was negligent or complicit.

Connecting the Framework to Laundering Methods

Remember the three stages of laundering: placement (introducing cash into the financial system), layering (complex transactions to obscure the trail) and integration (returning the funds as apparently legitimate wealth). FATF preventive measures target each stage. CDD and cash reporting attack placement; wire transfer rules, correspondent banking controls and beneficial ownership transparency attack layering; DNFBP coverage of real estate agents, lawyers and dealers in high-value goods attacks integration. When a question describes a scheme, mentally identify the stage and then the Recommendation designed to detect it.

Exam Tips: Answering Questions on FATF Recommendations and AML Frameworks

Tip 1 – Know what the FATF is and is not. It is an intergovernmental, standard-setting body created by the G7 in 1989 and headquartered in Paris. It is not a court, not a treaty organization, not a law enforcement agency and not a regulator. If an answer choice says the FATF investigates launderers, imposes fines on banks, or passes laws, it is wrong.

Tip 2 – Recommendations are not binding law. Questions often ask whether FATF Recommendations have the force of law. They do not; countries implement them through domestic legislation. Their power comes from mutual evaluations and public listing. Choose answers that describe them as standards, best practices or soft law.

Tip 3 – Remember the numbers. There are 40 Recommendations today (the former 40+9 structure was consolidated in 2012). Record retention is a minimum of five years. The occasional transaction CDD threshold is USD/EUR 15,000. The wire transfer threshold is USD/EUR 1,000. The US currency transaction report threshold is USD 10,000. Suspicious transaction reports have no minimum threshold.

Tip 4 – Distinguish the organizations. FATF sets international standards; the Egmont Group connects FIUs; the Wolfsberg Group is a bank-industry body issuing voluntary principles; the Basel Committee supervises prudential banking standards; FinCEN is the US FIU; the United Nations produces the Vienna, Palermo and Merida Conventions that the FATF requires countries to ratify. Questions that pair a function with the wrong body are common distractors.

Tip 5 – Master CDD and PEP rules. Be able to list the four triggers for CDD, the four components of CDD, and the four enhanced measures for foreign PEPs (risk-based identification systems, senior management approval, source of wealth and funds, enhanced monitoring). Know that family members and close associates of PEPs are included and that shell banks must never be onboarded.

Tip 6 – Know the DNFBP list. Casinos, real estate agents, dealers in precious metals and stones, lawyers and notaries, accountants, and trust and company service providers. If a question asks which non-financial profession is subject to AML obligations under the FATF standards, select from this list and be suspicious of professions not on it.

Tip 7 – Apply the risk-based approach. Recommendation 1 is the organizing principle of the entire framework. When a scenario asks how an institution should allocate resources or whether simplified measures are acceptable, the correct answer almost always references assessing and mitigating risk proportionately rather than applying identical controls to every customer.

Tip 8 – Watch the tipping-off trap. A compliance officer who files a report must never inform the customer. Scenario questions in which an employee warns a client, or a manager delays a report to consult the customer, describe violations. Also remember that good-faith reporters are protected from civil and criminal liability.

Tip 9 – Link schemes to stages and controls. If a question describes smurfing or structuring, think placement and currency reporting rules. If it describes shell companies, nominee directors and layered wire transfers, think beneficial ownership transparency and R.16. If it describes purchases of real estate or luxury goods, think integration and DNFBP coverage.

Tip 10 – Read for qualifiers. ACFE questions frequently turn on words such as always, never, required and permitted. Reliance on third parties for CDD is permitted but responsibility remains with the institution. Simplified due diligence is permitted only where lower risk is demonstrated and never where there is suspicion. Enhanced due diligence is required for foreign PEPs and correspondent relationships.

Tip 11 – Expect scenario questions on US law. The CFE Exam is international in scope but frequently references the Bank Secrecy Act, Money Laundering Control Act and USA PATRIOT Act. Associate the BSA with reporting and record keeping, the 1986 Act with criminalizing laundering and structuring, the PATRIOT Act with mandatory AML programs, customer identification programs and shell bank prohibitions, and the AML Act of 2020 with beneficial ownership reporting and whistleblower incentives.

Tip 12 – Eliminate systematically. When unsure, discard any option that attributes enforcement power to the FATF, that mischaracterizes a threshold or retention period, that treats recommendations as binding treaties, or that assigns a duty to the wrong institution. What remains is usually the answer.

Quick Review Summary

• FATF: founded 1989 by the G7, Paris-based, intergovernmental, standard setter, not an enforcer.
• 40 Recommendations (2012 consolidation) in seven sections covering policy, criminalization, terrorist and proliferation financing, preventive measures, beneficial ownership, competent authorities and international cooperation.
• Core preventive duties: risk-based approach, CDD, PEP enhanced due diligence, correspondent banking controls, wire transfer information, five-year record keeping, suspicious transaction reporting, no tipping-off, DNFBP coverage, virtual asset coverage.
• Enforcement through mutual evaluations (technical compliance and effectiveness), grey list and black list.
• National frameworks (BSA, PATRIOT Act, AMLA 2020, EU Directives, POCA) translate standards into binding law and empower FIUs such as FinCEN.

A fraud examiner who can explain how these pieces fit together will not only answer exam questions confidently but will also know exactly where to look when tracing the money in a real investigation.