Almost every anti-money laundering rule a bank, payment firm or crypto exchange follows traces back to one document: the FATF Recommendations, and a country that implements them badly can land on the FATF grey list and raise costs for every business it hosts. The Financial Action Task Force (FATF) sets the global standard for combating money laundering, terrorist financing and proliferation financing. Its 40 Recommendations are not law in themselves, but countries turn them into national rules, and FATF then assesses each country through mutual evaluations. This guide explains how the 40 are structured, the requirements practitioners meet most often, how mutual evaluations and the grey and black lists work, what Recommendations 15 and 16 mean for virtual assets and payments, and what the standard implies for digital identity, automated systems and machine identities. It is for compliance officers, MLROs, risk teams at banks, fintechs and virtual asset service providers (VASPs), and the identity and security teams who build their onboarding and monitoring. Status checked on 8 November 2026.
Key takeaways
- The standard is current to June 2026: FATF's Recommendations page shows the 2012 Recommendations, adopted on 16 February 2012, "as amended June 2026", with recent changes to R.1 and R.10 on proportionality (February 2025), R.24 and R.25 on beneficial ownership (February 2023) and R.16 on payment transparency (June 2025).
- The risk-based approach comes first: Recommendation 1 requires countries and firms to identify and assess their risks and apply measures in proportion, including simplified measures where risk is lower.
- Effectiveness matters more than law on paper: mutual evaluations rate both technical compliance with the 40 and effectiveness against 11 immediate outcomes, and FATF says the effectiveness ratings are the most important part.
- Grey listing changes three times a year: FATF publishes its "Jurisdictions under Increased Monitoring" and "High-Risk Jurisdictions subject to a Call for Action" documents after each plenary. Check the current FATF lists for which jurisdictions were added or removed at the latest plenary.
- Payment messages get richer by 2030: revised R.16 requires name, address and date of birth for sender and recipient on cross-border peer-to-peer payments above USD/EUR 1,000, with implementation due by the end of 2030.
What it is and who it applies to
FATF is an inter-governmental body created in 1989. It writes the standard, assesses countries against it and names jurisdictions with weak regimes. The Recommendations are addressed to countries: each country must give them legal effect through laws, regulations and supervision. Businesses meet the standard indirectly, through national rules such as the US Bank Secrecy Act Guide obligations, the EU AML Regulation and AMLA Guide rules and the UK Money Laundering Regulations.
| Who | How FATF reaches them | What it means in practice |
|---|---|---|
| Governments and regulators | Directly: must implement the 40 and are assessed in mutual evaluations | National risk assessment, laws, supervision, FIU, sanctions regimes |
| Financial institutions | Through national law implementing R.9 to R.21 | CDD, record keeping, monitoring, suspicious transaction reporting, internal controls |
| Virtual asset service providers | Through national law implementing R.15 and its Interpretive Note | Licensing or registration, the full preventive measures, the travel rule |
| Designated non-financial businesses and professions (DNFBPs) | Through national law implementing R.22 and R.23 | Casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, accountants, trust and company service providers |
| Companies and trusts | Through R.24 and R.25 beneficial ownership rules | Accurate, up-to-date beneficial ownership information available to authorities |
Countries outside FATF's membership are assessed by FATF-style regional bodies (FSRBs) using the same methodology, so the standard reaches almost every jurisdiction.
Structure and key requirements
The 40 Recommendations sit in seven groups. Each comes with an Interpretive Note (INR) that carries much of the operational detail, and a glossary that defines terms such as beneficial owner and virtual asset.
| Group | Recommendations | What they cover |
|---|---|---|
| A. AML/CFT policies and coordination | R.1 to R.2 | Assessing risks and applying a risk-based approach; national cooperation and coordination |
| B. Money laundering and confiscation | R.3 to R.4 | Money laundering offence; confiscation and provisional measures (revised October 2023 for asset recovery) |
| C. Terrorist financing and financing of proliferation | R.5 to R.8 | TF offence; targeted financial sanctions for terrorism and proliferation; non-profit organisations |
| D. Preventive measures | R.9 to R.23 | CDD, record keeping, PEPs, correspondent banking, money or value transfer services, new technologies and virtual assets, wire transfers, reliance, internal controls, higher-risk countries, suspicious transaction reporting, tipping-off, DNFBPs |
| E. Transparency and beneficial ownership | R.24 to R.25 | Legal persons and legal arrangements |
| F. Powers and responsibilities of competent authorities | R.26 to R.35 | Regulation and supervision, FIUs, law enforcement, cash couriers, statistics, guidance and feedback, sanctions |
| G. International cooperation | R.36 to R.40 | International instruments, mutual legal assistance, extradition, other cooperation |
The requirements practitioners meet most
- R.1 Risk-based approach: identify, assess and understand ML/TF risks and apply proportionate measures. The February 2025 revision of R.1 and INR.1 increased the focus on proportionality and requires countries to allow and encourage simplified measures in lower-risk areas, which supports financial inclusion.
- R.10 Customer due diligence: identify and verify the customer and beneficial owner, understand the purpose of the relationship and conduct ongoing due diligence. INR.10 was revised alongside R.1 in February 2025.
- R.11 Record keeping: keep transaction and CDD records so that authorities can reconstruct transactions.
- R.12 Politically exposed persons: enhanced measures for foreign PEPs, risk-based measures for domestic and international organisation PEPs. See CDD, EDD, PEP and sanctions screening.
- R.15 New technologies: assess risks of new products and technologies before launch, and regulate virtual assets and VASPs (below).
- R.16 Payment transparency: originator and beneficiary information must travel with payments (below).
- R.17 Reliance: a firm may rely on a third party for CDD, but ultimate responsibility stays with the firm that relies.
- R.18 Internal controls: programmes, compliance management, screening on hiring, training and independent audit, applied across groups.
- R.20 Suspicious transaction reporting: report promptly to the FIU where funds are suspected to be proceeds of crime or related to terrorist financing; R.21 protects reporters and prohibits tipping-off.
- R.24 and R.25 Beneficial ownership: the February 2023 revisions strengthened legal person transparency and added definitions for "nominator" and "nominee shareholder or director".
Recommendation 15: virtual assets
FATF updated R.15 in 2019 to apply the standard to virtual assets and VASPs. In practice the Interpretive Note requires countries to license or register VASPs, supervise them, and apply the preventive measures, including the travel rule, to them. FATF publishes targeted updates on how jurisdictions implement R.15 (the fifth was dated 9 July 2024) and risk-based guidance for the sector (28 October 2021). Our Crypto Travel Rule Compliance Guide covers the transfer data rules in depth.
Recommendation 16: payment transparency
FATF announced revisions to R.16 on 18 June 2025. The payment chain now starts with the institution that receives the customer's instruction, which must include the required information and keep it unchanged. Cross-border peer-to-peer payments above USD/EUR 1,000 must carry the sender's and recipient's name, address and date of birth. Institutions must use technology against fraud and error, for example checking recipients' banking details. Card purchases of goods and services stay exempt from full R.16 requirements. The changes take effect by the end of 2030, and an Annex IV to the assessment methodology, published after the October 2025 plenary, sets out how the revised R.16 will be assessed.
Identity and NHI requirements
FATF is technology-neutral, but its preventive measures are identity requirements. R.10 is a customer identity and verification standard, R.12 and R.6 depend on accurate name screening, R.16 is about identity data moving between institutions, and R.24 and R.25 are about the people behind legal entities. As these processes become automated, the machine identities behind them become part of compliance.
| FATF requirement | Identity dependency | Machine identity and automation control |
|---|---|---|
| R.10 CDD and digital onboarding | Reliable, independent identity evidence | Protect API keys and service accounts that call identity verification and document services; log which service returned each result. See the Identity Proofing and KYC Guide |
| R.11 Record keeping | Reconstructable records | Immutable logs that record which system, rule version or model made a CDD or monitoring decision |
| R.15 VASPs | Custody keys and wallet signers are machine identities | Inventory signing keys and the services that hold them; see the Crypto Exchange Identity and Key Security Guide |
| R.16 Payment transparency | Originator and beneficiary data in messages | Integrity controls on message-building services; the credentials of messaging and travel rule integrations should be owned and rotated |
| R.17 Reliance and third parties | Accountability stays with the relying firm | Third-party API access scoped and reviewed; see the NHI Discovery guide to find integrations |
| R.20 Suspicious transaction reporting | Human judgement on suspicion | AI agents may triage and draft, but humans decide; see the AI Agent Audit Trails for Regulators Guide |
Implementation steps
For a regulated firm, "implementing FATF" means implementing your national law well and being able to show that your controls match the risk FATF and your regulator expect.
- Map national rules to the Recommendations. For each jurisdiction you operate in, list the law that implements R.10 to R.21 (and R.15 for crypto) and note local thresholds and differences.
- Write an enterprise-wide risk assessment. Follow R.1: customers, products, channels, geographies and new technologies. Use your country's national risk assessment and FATF's lists as inputs.
- Apply risk-based CDD. Define simplified, standard and enhanced due diligence triggers. The February 2025 changes mean regulators may expect you to use simplified measures where risk is genuinely low, not just enhanced measures where it is high.
- Handle listed jurisdictions. Apply enhanced due diligence and countermeasures for "call for action" jurisdictions as your national law requires, and treat grey list status as a risk factor. Re-check after every plenary.
- Prepare for revised R.16. Inventory payment flows, identify where you are the first institution in the chain and plan data capture for name, address and date of birth before the 2030 deadline.
- Assess new technology before launch. R.15 requires a risk assessment before new products, practices or technologies are launched, including AI-driven onboarding and monitoring.
- Govern automation. Treat the systems that run CDD and monitoring as part of the control environment: owners, access reviews, change control and decision logs.
- Test and evidence. Independent audit under R.18, with results that would stand up if your country's mutual evaluation team sampled your firm.
Evidence and assessment
FATF assesses countries, not firms, but evaluation teams meet supervisors and private-sector firms during on-site visits, and poor sector effectiveness drives low ratings. The 2022 methodology (adopted February 2022, amended June 2026) applies to FATF's fifth round, which began in 2024. Check FATF's publications for which reports have been adopted in the current round.
| Component | What is assessed | Rating scale |
|---|---|---|
| Technical compliance | Whether laws and instruments meet each of the 40 Recommendations | Compliant, Largely Compliant, Partially Compliant, Non-Compliant |
| Effectiveness | Whether the system works in practice, against 11 immediate outcomes (for example supervision, preventive measures, beneficial ownership, FIU use) | High, Substantial, Moderate, Low |
| Follow-up | Progress on deficiencies after the report | Regular or enhanced follow-up |
| Listing | Strategic deficiencies with an agreed action plan (grey list) or serious deficiencies requiring countermeasures (black list) | Published three times a year |
Firm-level evidence to keep: the risk assessment and its approval, CDD files with verification results, monitoring scenario coverage and tuning records, suspicious transaction report timeliness, training records, audit findings and closure, and new-technology risk assessments.
Metrics that show it works: share of customers with a current risk rating, proportion of high-risk customers with completed enhanced due diligence, median days from alert to report decision, percentage of payment volume carrying complete originator and beneficiary data, and audit findings overdue.
Mapping to other frameworks
| FATF | United States | European Union | Where to read more |
|---|---|---|---|
| R.1 risk-based approach | Risk-based programme under the BSA; FinCEN's April 2026 programme proposal places risk assessment in the core pillars | Business-wide risk assessment under the AMLR | AML programme and transaction monitoring |
| R.10 CDD and R.24 beneficial ownership | CIP (31 CFR 1020.220) and beneficial ownership rule (31 CFR 1010.230) | AMLR CDD chapter | Bank Secrecy Act Guide |
| R.15 virtual assets | Money transmitter rules for virtual currency businesses | MiCA licensing plus AMLR obligations for CASPs | MiCA and DORA for Crypto-Asset Service Providers Guide |
| R.16 travel rule | Funds transfer recordkeeping and travel rule | Regulation (EU) 2023/1113 (TFR) | Crypto Travel Rule Compliance Guide |
| R.20 suspicious transaction reporting | Suspicious activity reports (31 CFR 1020.320) | Reports to the national FIU | EU AML Regulation and AMLA Guide |
Common pitfalls
- Treating FATF as a checklist for firms: the Recommendations bind countries; firms must follow national law, which may be stricter or differ in thresholds.
- Static country risk lists: grey list membership changes after each plenary; a list updated once a year is wrong for most of it.
- Over-derisking: refusing whole customer segments instead of managing risk; the 2025 proportionality changes push the other way.
- Reliance without oversight: outsourcing CDD to a vendor or partner and assuming responsibility moved with it, contrary to R.17.
- Launching new technology without a risk assessment: AI onboarding or a new crypto product goes live before the R.15 assessment is done.
- Ignoring the 2030 R.16 deadline: payment data changes need long lead times in messaging, core banking and partner integrations.
Practitioner checklist
- Keep a map of national laws implementing R.10 to R.21 for every jurisdiction you serve.
- Refresh the enterprise risk assessment at least annually and after major product changes.
- Update country risk ratings within days of each FATF plenary.
- Define simplified, standard and enhanced due diligence triggers in writing.
- Run a documented risk assessment before launching new products or technology, including AI tools.
- Plan R.16 data capture and messaging changes against the end-2030 deadline.
- Give every service account, API key and signing key in the CDD, monitoring and payment chain an owner and rotation date.
- Keep decision logs that let an examiner reconstruct any CDD or reporting decision.
Standards and references
- FATF: The FATF Recommendations
- FATF: Methodology for assessing technical compliance and effectiveness
- FATF: Mutual evaluations
- FATF: Black and grey lists
- FATF: Virtual assets
- FATF: Update to Recommendation 16 on payment transparency
Related NHI Mgmt Group resources: Crypto Travel Rule Compliance Guide · AML programme and transaction monitoring · Bank Secrecy Act Guide · EU AML Regulation and AMLA Guide · CDD, EDD, PEP and sanctions screening. This guide summarises the FATF Recommendations and is not legal advice.