FATF 40 Recommendations: what it asks of a monitoring programme

Countries identify, assess and understand their money laundering and terrorist financing risks, designate an authority or mechanism to coordinate the assessment and the allocation of resources, and apply a risk-based approach so that preventive and mitigating measures are proportionate to the risks found, addressing higher risks adequately and allowing and encouraging simplified measures where risks are lower; they do the same for proliferation financing risk, meaning strictly the risk of breach, non-implementation or evasion of the targeted financial sanctions of Recommendation 7, while always implementing those sanctions in full; and they require financial institutions and DNFBPs to identify, assess and take effective risk-based action against their own money laundering, terrorist financing and proliferation financing risks. The Interpretive Note sets out the country and institution obligations, the treatment of financial inclusion and the conditions for simplified measures.

Countries criminalise money laundering on the basis of the Vienna and Palermo Conventions and apply the offence to all serious offences so as to include the widest range of predicate offences; the Interpretive Note requires coverage of the designated categories of offences, extraterritorial predicates, the mental element inferable from objective circumstances, self-laundering where fundamental principles permit, ancillary offences and liability of legal persons with effective, proportionate and dissuasive sanctions.

Countries implement targeted financial sanctions regimes giving effect to the UN Security Council resolutions on terrorism and terrorist financing, freezing without delay the funds and other assets of persons and entities designated by or under the authority of the Security Council under Chapter VII (resolution 1267 and successors) or designated by the country under resolution 1373, and ensuring that no funds or assets are made available to or for their benefit; the Interpretive Note sets the designation authorities and procedures, the freezing obligations without delay and without prior notice, the prohibitions, the communication of designations, the reporting duties of institutions, the delisting and unfreezing procedures and access to frozen funds for basic expenses.

Countries implement targeted financial sanctions giving effect to the UN Security Council resolutions on the prevention, suppression and disruption of proliferation of weapons of mass destruction and its financing, freezing without delay the funds and other assets of persons and entities designated by or under the authority of the Security Council under Chapter VII and ensuring that no funds or assets are made available to or for their benefit; the Interpretive Note sets the freezing and prohibition obligations, communication, reporting, delisting and the treatment of contracts and basic expenses under the resolutions.

Countries identify the organisations that fall within the FATF definition of non-profit organisations, assess their terrorist financing risks, and apply focused, proportionate and risk-based measures that protect them from abuse by terrorist organisations posing as legitimate entities, as conduits for terrorist financing including to escape asset freezing, and through concealed diversion of funds intended for legitimate purposes, without unduly disrupting or discouraging legitimate NPO activity; the Interpretive Note covers outreach, risk-based supervision, effective investigation and information gathering and international cooperation, and warns against applying the measures to the whole sector.

Financial institutions may not keep anonymous accounts or accounts in obviously fictitious names and must, by a principle set out in law, undertake customer due diligence when establishing a business relationship, carrying out an occasional transaction above USD or EUR 15,000 or a payment or value transfer covered by INR.16, when money laundering or terrorist financing is suspected, or when they doubt previously obtained identification data: identify and verify the customer from reliable independent sources; identify the beneficial owner and take reasonable measures to verify that identity, understanding the ownership and control structure of legal persons and arrangements; understand and where appropriate obtain information on the purpose and intended nature of the relationship; and conduct ongoing due diligence and transaction scrutiny consistent with the customer's profile including, where necessary, the source of funds. The extent of each measure follows a risk-based approach; verification takes place before or during establishment of the relationship, or as soon as reasonably practicable after it where risks are managed and business would otherwise be interrupted; an institution that cannot complete CDD does not open the account or perform the transaction, or terminates the relationship, and considers a suspicious transaction report; the requirements apply to new customers and, on materiality and risk, to existing ones. The Interpretive Note sets the risk-based approach, enhanced and simplified measures, the specific measures for legal persons, arrangements and beneficiaries of life insurance, reliance on prior verification and the timing rules.

In relation to foreign PEPs as customers or beneficial owners, financial institutions, beyond normal CDD, have risk-management systems to determine whether a customer or beneficial owner is a PEP, obtain senior management approval to establish or continue the relationship, take reasonable measures to establish the source of wealth and source of funds, and conduct enhanced ongoing monitoring; they take reasonable measures to determine whether a customer or beneficial owner is a domestic PEP or a person entrusted with a prominent function by an international organisation and apply the same three measures where the relationship is higher risk; the requirements extend to family members and close associates; the Interpretive Note extends the measures to beneficiaries and beneficial owners of beneficiaries of life insurance policies.

For cross-border correspondent banking and similar relationships, financial institutions, beyond normal CDD, gather enough information to understand the respondent's business and to determine from public information its reputation and the quality of its supervision including any money laundering or terrorist financing investigation or regulatory action, assess its AML/CFT controls, obtain senior management approval before establishing new relationships, clearly understand each institution's responsibilities, and for payable-through accounts satisfy themselves that the respondent has conducted CDD on customers with direct access and can supply CDD information on request; they may not enter into or continue a correspondent relationship with a shell bank and must satisfy themselves that respondents do not allow their accounts to be used by shell banks; the Interpretive Note extends the requirements to similar relationships such as those for securities transactions or funds transfers.

Countries ensure that providers of money or value transfer services are licensed or registered and subject to effective systems for monitoring and ensuring compliance with the relevant Recommendations, act to identify and sanction unlicensed or unregistered providers, require agents to be licensed or registered or the provider to keep a current list of agents accessible to competent authorities in every country where it and its agents operate, and ensure that providers include their agents in their AML/CFT programmes and monitor their compliance; the Interpretive Note adds that where agents are not themselves licensed the provider is responsible for them.

Countries ensure that financial institutions include required and accurate originator information and required beneficiary information on payments or value transfers and related messages, structured to the extent possible and remaining with the transfer throughout the payment chain; monitor transfers to detect those lacking required information and take appropriate measures; and, in processing transfers, take freezing action and do not conduct transactions with persons and entities designated under the UN Security Council resolutions on terrorism and proliferation financing. The Interpretive Note, revised in June 2025 with implementation expected by the end of 2030, sets the information requirements and de minimis thresholds, the exemptions, and the duties of ordering, intermediary and beneficiary institutions and MVTS providers; it is modelled paragraph by paragraph as the separate framework FATF Recommendation 16 - Payment Transparency (Travel Rule).

Financial institutions implement programmes against money laundering and terrorist financing, financial groups implement group-wide programmes including policies and procedures for sharing information within the group for AML/CFT purposes, and institutions ensure that their foreign branches and majority-owned subsidiaries apply AML/CFT measures consistent with home country requirements through the group programme; the Interpretive Note specifies the programme's elements (compliance management including a compliance officer at management level, screening of employees, ongoing training, an independent audit function), the group-wide sharing of customer, account and transaction information including from branches and subsidiaries for risk management, and the treatment of host countries that do not permit implementation of the home standards.

Financial institutions apply enhanced due diligence, effective and proportionate to the risk, to business relationships and transactions with natural and legal persons and financial institutions from countries for which the FATF calls for it, and countries can apply appropriate, effective and proportionate countermeasures when the FATF calls for them and independently of any such call; the Interpretive Note lists possible countermeasures, from enhanced reporting and limits on correspondent relationships to prohibiting the establishment of branches, and requires measures to advise institutions of concerns about other countries' weaknesses.

A financial institution that suspects or has reasonable grounds to suspect that funds are the proceeds of criminal activity or are related to terrorist financing is required by law to report its suspicion promptly to the financial intelligence unit; the Interpretive Note requires reporting of all suspicious transactions including attempted ones, regardless of amount and regardless of whether they involve tax matters.