The FATF and the global standard

Almost every anti-money-laundering obligation a crypto business meets, in almost any country, traces back to one standard written by the Financial Action Task Force (FATF). A compliance officer who knows how that standard is built, how countries are graded against it and what the public lists mean can read any national rule in context, explain to a board why a country is high risk, and predict where supervisors will push next.

How the FATF works

The FATF was created in 1989 at the G7 summit in Paris. It is an intergovernmental policy body: it writes standards and checks that countries implement them, but it does not make law. Its force comes from peer pressure and from the market consequences of a poor assessment.

• Members: about 40, including two regional organizations (the European Commission and the Gulf Co-operation Council).
• Plenary: meets three times a year, usually in February, June and October, and decides by consensus. A president drawn from the members serves a two-year term, and a secretariat hosted by the OECD in Paris supports the work.
• Mandate: open-ended since 2019, covering money laundering, terrorist financing and proliferation financing.
• Global network: nine FATF-style regional bodies (FSRBs) are associate members: APG, CFATF, EAG, ESAAMLG, GABAC, GAFILAT, GIABA, MENAFATF and MONEYVAL. Together with the FATF they bring more than 200 jurisdictions under the same standard. Observers include the IMF, the World Bank, UNODC and the Egmont Group.

The standard: Recommendations, Interpretive Notes and Glossary

The first 40 Recommendations (1990) targeted drug money. They were revised in 1996 and 2003, joined by Special Recommendations on terrorist financing from 2001, and merged into the current 40 Recommendations in February 2012. The binding FATF Standards are the Recommendations, their Interpretive Notes and the Glossary. Guidance papers, best practices and red flag reports are not binding, but assessors use them to interpret the standard, so supervisors expect firms to know them.

The standard keeps moving. Recent changes, dated for orientation: the virtual asset amendments to R.15 (October 2018) and its Interpretive Note (June 2019); beneficial ownership revisions to R.24 (March 2022) and R.25 (February 2023); asset recovery revisions (October 2023); a revision of R.1 in February 2025 that replaced "commensurate" with "proportionate" and requires countries to allow and encourage simplified measures for lower risks; and the rewrite of R.16 as "Payment transparency" (June 2025). Changes are adopted at plenaries, so a compliance team should check each plenary's outcomes for amendments that touch its program.

Mutual evaluations: technical compliance and effectiveness

Countries are assessed through mutual evaluations, peer reviews by a team of experts from other jurisdictions, run by the FATF, an FSRB, or the IMF or World Bank using the same Methodology. A team reviews laws and data, visits the country, and the plenary debates and adopts the report, which is then published. Each evaluation gives two kinds of rating.

Technical compliance asks whether the laws and enforceable means exist. Each Recommendation is rated Compliant, Largely compliant, Partially compliant or Non-compliant (or not applicable).

Effectiveness asks whether the system works in practice. It is measured against 11 Immediate Outcomes (IOs), each rated High, Substantial, Moderate or Low.

The fifth round of evaluations began in 2024 under the 2022 Methodology (as since amended). It runs on a six-year cycle, gives more weight to effectiveness, risk and context, and gives a country three years after its evaluation to fix deficiencies before further measures apply. Some FSRB members are still assessed under the 2013 Methodology until their previous round ends. In the 2022 Methodology VASPs sit in IO.3 next to banks, so a country's IO.3 rating now says something direct about how its crypto sector is supervised.

After adoption, a country enters regular follow-up (the default) or enhanced follow-up (when major improvements are needed). Follow-up reports can upgrade technical compliance ratings, so always check the latest follow-up report, not only the original evaluation.

The public lists

Countries with serious deficiencies go to the International Co-operation Review Group (ICRG). Under criteria revised in October 2024 for the new round, the FATF prioritizes for active review FATF members, high-income countries and countries with financial sector assets above USD 10 billion; UN-defined least developed countries are not prioritized unless the FATF agrees they pose a significant risk. A country under review gets an observation period, then commits at a high political level to an action plan.

The FATF publishes two lists after every plenary:

• Jurisdictions under Increased Monitoring (the "grey list"): countries working with the FATF on an agreed action plan. The FATF does not call for enhanced due diligence against them, and states that its standards "do not envisage de-risking, or cutting-off entire classes of customers". A country leaves the list after completing its plan and an on-site visit.
• High-Risk Jurisdictions subject to a Call for Action (the "black list"): countries with significant strategic deficiencies. The FATF calls on all jurisdictions to apply enhanced due diligence and, in the most serious cases, countermeasures under R.19.

Which countries are on the lists changes three times a year; current names are not exam material.

Feeding FATF outputs into the risk assessment

FATF outputs are inputs to the country risk factor in the lesson The risk-based approach, not a substitute for it.

A worked example. A fictional exchange scores country risk from 0 to 10. Country P is on the grey list (+3), has a Low rating for IO.3 (+2) and is Non-compliant on R.15 (+2), for 7 out of 10: high risk. Customers resident there get enhanced monitoring, and counterparty VASPs licensed there get a full due diligence review before any Travel Rule data are exchanged. If Country P leaves the list, its score falls to 4, and the change is documented and approved, not applied silently.

Every plenary should trigger a review of exposure, not just a table update:

-- Active customers and counterparty VASPs linked to newly listed countries
SELECT 'customer' AS party_type, c.customer_id AS party_id, c.residence_country AS country
FROM customers c
JOIN country_list_changes l ON l.country_code = c.residence_country
WHERE l.change_date = DATE '2026-06-19' AND l.new_status <> 'none' AND c.status = 'active'
UNION ALL
SELECT 'vasp', v.vasp_id, v.license_country
FROM counterparty_vasps v
JOIN country_list_changes l ON l.country_code = v.license_country
WHERE l.change_date = DATE '2026-06-19' AND l.new_status <> 'none';

The query joins a table of list changes from one plenary to customers by residence and to counterparty VASPs by licensing country, and returns one worklist. A real review would also match nationality, IP geolocation and the countries customers send funds to; date literal syntax varies slightly between engines.

Exam focus: what the FATF is and is not (an intergovernmental standard setter with nine FSRBs and three plenaries a year); the Standards as Recommendations, Interpretive Notes and Glossary, and how the Recommendations are grouped; technical compliance ratings (C, LC, PC, NC) versus effectiveness ratings on 11 Immediate Outcomes (High to Low), with VASPs in IO.3 under the 2022 Methodology; the fifth round (from 2024, six-year cycle, more weight on effectiveness) and regular versus enhanced follow-up; the ICRG process and the difference between the increased monitoring list and the call for action list, including R.19 countermeasures and the FATF's position on de-risking; how list status and evaluation ratings feed a country risk score and trigger reviews after each plenary.