The global AML architecture: FATF, FSRBs and mutual evaluations

I begin every foundations course by disabusing officials of a common misconception: that FATF is a treaty body with the power to compel states. It is nothing of the sort. The Financial Action Task Force was established at the 1989 G7 summit in Paris as a policy-making body with no independent legal personality of its own, hosted administratively by the OECD in Paris but answerable only to its own plenary of member jurisdictions and observer organisations. It has never had the power to fine a government, expel a bank or override a domestic legislature. What it has built instead, over three and a half decades, is something arguably more durable than a treaty: a single, near-universally accepted technical standard — the 40 RecommendationsThe 40 RecommendationsFATF's core technical standard, organised into seven thematic groups covering policy, criminalisation, preventive measures, transparency, institutions and cooperation., against which every other actor in the system, from the IMF to a correspondent bank's compliance department in Frankfurt, now benchmarks a country's legitimacy as a financial counterparty.

The 40 RecommendationsThe 40 RecommendationsFATF's core technical standard, organised into seven thematic groups covering policy, criminalisation, preventive measures, transparency, institutions and cooperation. themselves have been revised repeatedly since their first issuance in 1990, most substantially in 2003 and again in 2012, with the 2012 revision folding in counter-proliferation financing and restructuring the standard around a risk-based approach rather than a rules-based checklist. The Recommendations are not static text sitting untouched between major revisions; FATF issues interpretive notes and targeted amendments on a near-annual basis; the February 2025 amendments to Recommendation 16 on payment transparency, discussed in the layering modules, are a good example of this continuous tightening. I tell officials never to cite "the FATF Recommendations" as though they were a fixed document; always cite the specific Recommendation number and the date of its most recent revision, because a mutual evaluation conducted against an outdated version of the standard is worthless as an assessment.

Structurally the 40 RecommendationsThe 40 RecommendationsFATF's core technical standard, organised into seven thematic groups covering policy, criminalisation, preventive measures, transparency, institutions and cooperation. divide into seven thematic groups: AML/CFT policies and coordination (R.1–2), the legal system covering money laundering and confiscation offences (R.3–4), terrorist financing and proliferation financing (R.5–8), preventive measures for financial institutions and designated non-financial businesses and professions (R.9–23), transparency of legal persons and arrangements (R.24–25), the powers and responsibilities of competent authorities including FIUs, supervisors and law enforcement (R.26–35), and international cooperation (R.36–40). This architecture matters practically because a mutual evaluation report scores each Recommendation individually, and a country's overall exposure to greylisting risk is driven disproportionately by weaknesses clustered in a handful of Recommendations, historically R.24/25 on beneficial ownership, R.8 on non-profit organisations, and R.6/7 on targeted financial sanctions have been the recurring soft spots across African and Asian evaluations alike.

FATF's own thirty-eight full members plus the European Commission and the Gulf Cooperation Council do not, however, cover the roughly 200 jurisdictions the standard purports to bind. The mechanism that achieves near-universal coverage is the network of FATF-style regional bodies, or FSRBs, each an autonomous membership organisation modelled on FATF's own structure but operating within a defined geography and reporting its evaluation findings back into the global network through the FATF plenary. For a Southern and East African audience the operative body is the Eastern and Southern Africa Anti-Money Laundering Group, ESAAMLG, headquartered in Dar es Salaam, whose membership spans from South Africa and Botswana through to Ethiopia and Comoros. Three sister bodies matter for comparative purposes: GABAC, covering Central Africa under the CEMAC framework and headquartered in Libreville; GIABA, the Inter-Governmental Action Group against Money Laundering in West Africa, based in Dakar and serving the ECOWAS states, and MENAFATF, covering the Middle East and North Africa from its secretariat in Manama. Each FSRB adopts the FATF standard verbatim as its own technical benchmark, trains its own cadre of assessors drawn substantially from its member states' supervisory and FIU staff, and conducts its own mutual evaluations on a rotating cycle, typically every eight to ten years for a full evaluation with lighter follow-up reporting in between.

The relationship between FATF and the FSRBs is best understood as a franchise rather than a hierarchy. FATF does not itself evaluate most of the world's jurisdictions; ESAAMLG evaluated South Africa, not FATF directly, and it was ESAAMLG's own mutual evaluation report, adopted in 2021, that supplied the technical findings which FATF's International Co-operation Review Group later used to justify South Africa's 2023 greylisting. This means the FSRB assessors — often officials seconded from a neighbouring member state's central bank, FIU or prosecuting authority — are simultaneously colleagues within a regional professional community and the evaluators whose findings determine whether a country's banks face correspondent de-risking. I have sat on both sides of that table, and the tension between regional collegiality and evaluative rigour is real; ESAAMLG's credibility as an institution depends on resisting the temptation to soften findings for a neighbour, precisely because a lenient FSRB evaluation that FATF later has to override is far more reputationally damaging to that FSRB than an honest low rating would have been.

The final piece of the architecture worth fixing early is FATF's own two-list mechanism, operated through its International Co-operation Review Group: the public statement, colloquially the blacklist, reserved for jurisdictions with the most serious strategic deficiencies and typically only two or three countries at any time (Iran and the Democratic People's Republic of Korea have occupied this list for years), and the grey list, formally "Jurisdictions under Increased Monitoring," which is both far larger and, for a working official, far more consequential because it is the list that active reform and delisting campaigns are actually fought over. Understanding this architecture, standard-setter, regional evaluator, review mechanism — is the necessary precondition for everything that follows in this module, because every subsequent lesson assumes you can locate, without prompting, which body produced a given finding and under which version of the standard.

The single most important conceptual shift FATF made in its 2013 Methodology for assessing technical complianceTechnical complianceThe assessment of whether a country's laws and regulations formally meet the requirements of each FATF Recommendation, rated on a four-point scale. and effectivenessEffectivenessThe assessment of whether a country's AML/CFT system actually achieves real-world results, measured against eleven Immediate Outcomes. was to split every mutual evaluation into two analytically distinct exercises rather than one. Before this reform, evaluations asked essentially one question: does the country have the right laws on the books? The revised methodology retains that question, now called technical complianceTechnical complianceThe assessment of whether a country's laws and regulations formally meet the requirements of each FATF Recommendation, rated on a four-point scale., but adds a second and much harder one: does the system actually work? That second question is assessed against eleven Immediate Outcomes, and it is effectivenessEffectivenessThe assessment of whether a country's AML/CFT system actually achieves real-world results, measured against eleven Immediate Outcomes., not technical complianceTechnical complianceThe assessment of whether a country's laws and regulations formally meet the requirements of each FATF Recommendation, rated on a four-point scale., that has driven every consequential grey-listing decision since the reformed methodology entered use around 2014–2015, South Africa's included.

Technical complianceTechnical complianceThe assessment of whether a country's laws and regulations formally meet the requirements of each FATF Recommendation, rated on a four-point scale. ratings are assigned Recommendation by Recommendation on a four-point scale, compliant, largely compliant, partially compliant, non-compliant — and are relatively mechanical to produce: an assessor checks whether the specific legal or regulatory provision required by a Recommendation exists in the country's statute book and subordinate regulation, essentially a gap analysis against a checklist. A country can score respectably on technical complianceTechnical complianceThe assessment of whether a country's laws and regulations formally meet the requirements of each FATF Recommendation, rated on a four-point scale. while still failing badly on effectivenessEffectivenessThe assessment of whether a country's AML/CFT system actually achieves real-world results, measured against eleven Immediate Outcomes., and South Africa is the textbook illustration: its 2021 ESAAMLG evaluation found the country's legal architecture — the FIC Act 38 of 2001, POCA 121 of 1998, the Companies Act 71 of 2008's beneficial-ownership provisions, technically largely sound, yet rated the country low on several of the eleven Immediate Outcomes precisely because prosecutions, confiscations and supervisory action were not materialising from that architecture in numbers commensurate with the country's risk profile.

The eleven Immediate Outcomes are organised around three overarching goals. The first cluster addresses risk, policy and coordination (Immediate Outcome 1), asking whether the country understands its own money-laundering and terrorist-financing risks through a credible national risk assessment and coordinates a policy response around that understanding. The second and largest cluster covers the operational core of the system: financial intelligence use (IO.6), money-laundering investigation and prosecution (IO.7), confiscation of criminal proceeds (IO.8), terrorist-financing investigation and prosecution (IO.9), preventive measures by financial institutions and DNFBPs (IO.4), supervision (IO.3), transparency of legal persons and arrangements (IO.5), and international cooperation (IO.2). The third addresses the specific counter-terrorist-financing and counter-proliferation-financing preventive regime (IO.10–11). For South Africa, the 2021 report's low ratings clustered heavily on IO.7 and IO.8; the country was not securing money-laundering convictions or confiscating proceeds of crime at a rate its risk profile demanded, a finding that resonated directly with the state-capture-era evidence emerging from the Zondo Commission about captured procurement and diverted state-owned-enterprise funds moving largely unprosecuted.

The assessment process itself is a substantial undertaking that I encourage every mid-career official to observe at least once before they are asked to serve as a national counterpart. An assessment team, typically comprising four to six assessors drawn from other FSRB or FATF member states plus a secretariat coordinator, spends roughly a year on the exercise: several months of desk-based review of the country's laws, national risk assessment and statistics; an on-site visitOn-site visitThe one-to-two-week in-country phase of a mutual evaluation during which assessors meet the FIU, supervisors, prosecutors, industry and civil society. of one to two weeks during which the team meets the FIU, the central bank and other supervisors, the prosecuting authority, representative banks and DNFBPs, and civil society, and a further drafting and quality-review period before the draft report is negotiated, sometimes contentiously, at the FSRB's plenary. The country under review is not a passive subject in this process; it has the right to comment on and contest draft findings, and much of the diplomatic friction in any evaluation cycle occurs during this negotiation stage, where a government's own delegation will argue vigorously against a low effectivenessEffectivenessThe assessment of whether a country's AML/CFT system actually achieves real-world results, measured against eleven Immediate Outcomes. rating it regards as unfair or based on an incomplete statistical picture.

Once an evaluation is adopted, a country does not simply move on. Countries rated with a sufficient number of low technical complianceTechnical complianceThe assessment of whether a country's laws and regulations formally meet the requirements of each FATF Recommendation, rated on a four-point scale. or effectivenessEffectivenessThe assessment of whether a country's AML/CFT system actually achieves real-world results, measured against eleven Immediate Outcomes. scores enter "enhanced follow-upEnhanced follow-upA more intensive post-evaluation reporting track for countries with significant technical compliance or effectiveness deficiencies, requiring regular progress reports to the FSRB plenary.," requiring them to report back to the FSRB plenary, typically annually, on progress against an agreed action plan, with re-ratings possible as reforms bed in. This follow-up process is the direct institutional bridge to ICRG engagement: where an FSRB's own follow-up process concludes that a member's deficiencies are serious enough or have persisted long enough without adequate progress, that finding is escalated for ICRG review, which is exactly the pathway that took South Africa from its 2021 ESAAMLG mutual evaluation report to its February 2023 FATF grey-listing barely eighteen months later. Practitioners who only track the headline grey-list announcement without understanding this preceding evaluation and follow-up machinery consistently misjudge both how a listing arises and, more importantly for policy purposes, what specific evidentiary showing is required to reverse it.

Grey-listing is often described in the press as a punishment, and I actively correct that framing whenever I teach this lesson, because the ICRG's own self-description is closer to a structured remediation programme than a sanction. The formal designation is "Jurisdictions under Increased MonitoringJurisdictions under Increased MonitoringFATF's formal name for the grey list, denoting countries with strategic AML/CFT deficiencies that have committed to a time-bound action plan.," and a country lands on it when the ICRG, drawing on findings escalated from an FSRB's mutual evaluation and follow-up process, concludes that the jurisdiction has strategic deficiencies in its AML/CFT regime but has made a high-level political commitment to work with FATF to address them within an agreed timeframe. That political commitment is formalised as an action plan, a jointly negotiated list of specific, time-bound reforms, typically between fifteen and thirty items for a country with wide-ranging deficiencies — against which the country reports progress at each of FATF's three annual plenaries.

South Africa's February 2023 grey-listing followed exactly this template. FATF's public statement identified deficiencies clustered around beneficial-ownership transparency for legal persons and trusts, the effective use of financial intelligence to pursue serious and complex money-laundering cases, the investigation and prosecution of terrorist-financing cases, and the implementation of targeted financial sanctions related to proliferation financing — findings that traced directly back to the low Immediate Outcome ratings in ESAAMLG's 2021 evaluation. The South African government's own response is instructive as a case study in what a credible remediation trajectory looks like: the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act 22 of 2022, already enacted before the listing took effect, had introduced the beneficial-ownership register requirements under an amended Companies Act 71 of 2008 and closed several of the specific technical gaps the ICRG had flagged; National Treasury and the Financial Intelligence Centre thereafter published a sequence of public progress reports tracking each action-plan item, and the Directorate for Priority Crime Investigation, the National Prosecuting Authority's Investigating Directorate and SARS jointly increased the volume and public visibility of financial-crime prosecutions and asset-forfeiture actions over the following two years, precisely targeting the IO.7 and IO.8 weaknesses the evaluation had identified.

Economically, the consequences of grey-listing are real but frequently overstated in early media coverage and understated in their persistence. The immediate effect is not a formal sanction, no state is obliged by the listing itself to restrict trade or investment with a grey-listed country, but a reputational signal that raises the compliance cost of doing business with counterparties there. Correspondent banks, already primed by the de-risking dynamics discussed elsewhere in this curriculum, frequently apply enhanced due diligence to any counterparty domiciled in a grey-listed jurisdiction, and institutional investors subject to their own compliance policies sometimes restrict new allocations to grey-listed markets altogether. IMF and World Bank research published in the years following the 2023 listing estimated measurable, if not catastrophic, effects on South African capital flows and correspondent relationships, concentrated particularly in the cost and availability of trade finance for smaller South African exporters rather than in headline portfolio-flow figures, a pattern broadly consistent with earlier studies of other grey-listed economies.

The exit process, formally called delistingDelistingThe FATF plenary decision removing a jurisdiction from increased monitoring once its action plan is substantially and verifiably complete., requires the ICRG to be satisfied that the country has substantially completed its action plan and that an on-site visit, a further, targeted assessment distinct from the full mutual evaluation — has verified that the reforms are not simply legislated but are being implemented and sustained in practice. South Africa's delistingDelistingThe FATF plenary decision removing a jurisdiction from increased monitoring once its action plan is substantially and verifiably complete., adopted by the FATF plenary in October 2025, followed this sequence: completion of the outstanding action-plan items, a confirmatory on-site visitConfirmatory on-site visitA targeted ICRG visit conducted before delisting to verify that legislated reforms are actually being implemented in practice. by the ICRG earlier in 2025 to verify implementation on the ground rather than take the government's own progress reporting at face value, and a plenary decision removing the country from the increased-monitoring list after roughly two and a half years under enhanced scrutiny. I use the full arc of the South African case — 2021 evaluation, 2022 legislative amendment, February 2023 listing, sequential action-plan progress, 2025 confirmatory on-site visitConfirmatory on-site visitA targeted ICRG visit conducted before delisting to verify that legislated reforms are actually being implemented in practice., October 2025 delistingDelistingThe FATF plenary decision removing a jurisdiction from increased monitoring once its action plan is substantially and verifiably complete., as the running spine of this lesson precisely because it demonstrates that the process rewards sustained, verifiable institutional reform rather than one-off legislative gestures; a country that merely passes a statute without the prosecutorial and supervisory follow-through to make it operative should not expect delistingDelistingThe FATF plenary decision removing a jurisdiction from increased monitoring once its action plan is substantially and verifiably complete., and the ICRG's insistence on a confirmatory on-site visitConfirmatory on-site visitA targeted ICRG visit conducted before delisting to verify that legislated reforms are actually being implemented in practice. before removing any country is designed specifically to catch exactly that gap between paper compliance and demonstrated effectiveness.

For officials working in still-listed or at-risk jurisdictions, the practical lesson of the South African experience is that credibility accrues incrementally and is judged against the specific wording of the action plan rather than against the country's own preferred narrative of reform. Each plenary progress report is compared line by line against the original action-plan commitments, and countries that attempt to substitute adjacent but non-responsive reforms for the specific item the ICRG asked for tend to see their listing extended rather than lifted. The blacklist, by contrast, is reserved for a much smaller number of jurisdictions where either no credible action plan exists or a previously agreed plan has been abandoned or persistently unmet, and its consequences are correspondingly more severe, effectively signalling to global financial institutions that the reputational and compliance risk of maintaining relationships in that jurisdiction is no longer manageable through enhanced due diligence alone.

Every mutual evaluation, and every ICRG action plan built on one, ultimately measures the performance of a national system whose component parts I want officials to be able to name and place in relation to one another without hesitation, because confusion about institutional roles is itself a recurring effectiveness weakness in the jurisdictions I have assessed. At the centre of that system sits the financial intelligence unit, the FIU, which in South Africa is the Financial Intelligence Centre established under the FIC Act 38 of 2001. An FIU's core statutory function is to receive suspicious transaction and activity reports and other prescribed disclosures from accountable institutions, to analyse that information, both tactically, in support of specific ongoing investigations, and strategically, to identify sector-wide typologies — and to disseminate actionable financial intelligence to law enforcement, prosecutors and supervisors. What an FIU is not, and this is a distinction I labour over because it is so often misunderstood even by officials who work adjacent to one, is an investigative or prosecutorial body in its own right; the FIC does not arrest anyone or bring a criminal charge, and conflating the FIU's analytical function with law enforcement's investigative function is one of the most common design flaws FATF evaluators find when a country's Immediate Outcome 6 rating on financial intelligence use comes back weak.

FIUs are typically classified into one of four institutional models recognised by the Egmont GroupEgmont GroupThe global network of over 170 FIUs, founded in 1995, that facilitates secure cross-border information exchange and sets common FIU operational standards., the global network of FIUs founded in 1995 and now numbering over 170 members, which exists to facilitate secure information exchange between FIUs across borders through the Egmont Secure Web, and to set and monitor common standards for FIU operational independence and information security through its own membership admission and review process. The administrative model, to which South Africa's FIC belongs, places the FIU within the public administration but outside the police and prosecution services, typically reporting to a finance ministry, which is intended to balance operational independence from law enforcement politics against continued access to financial-sector regulatory context. The law-enforcement model embeds the FIU within the police service itself; the judicial model places it within the prosecutorial or judicial branch, and the hybrid model combines elements of more than one, most commonly integrating law-enforcement powers with an otherwise administrative structure. Each model carries characteristic strengths and vulnerabilities that a mutual evaluation will probe directly: administrative FIUs risk being starved of the operational law-enforcement context needed to prioritise disseminations effectively, while law-enforcement-model FIUs risk accountable institutions under-reporting for fear that a suspicious transaction report will trigger an immediate criminal referral rather than a considered analytical process.

An FIU does not operate in isolation; it is one node within a national coordination architecture that a mutual evaluation assesses under Immediate Outcome 1, and the organising instrument for that architecture is the national risk assessment, or NRA. A properly conducted NRA is a structured, evidence-based exercise — increasingly conducted using the World Bank's own NRA methodology tool, though FATF does not mandate a single methodology, that brings together the FIU, financial and DNFBP supervisors, law enforcement, prosecutors, customs and tax authorities, and often private-sector representatives to jointly assess the country's exposure to money-laundering and terrorist-financing threats across specific sectors, products and geographic corridors, and to rank those risks so that supervisory and enforcement resources can be allocated proportionately rather than spread evenly across low- and high-risk activity alike. South Africa's most recent NRA update, conducted in the lead-up to and during its grey-listing period, explicitly identified state-capture-related corruption, illicit financial flows connected to the extractive sector and cross-border cash smuggling within the Southern African Development Community corridor as elevated national risks, findings that in turn shaped both the FIC's own supervisory guidance to accountable institutions and the specific commitments made in the country's ICRG action plan.

Supervision is the function most often under-resourced relative to its evaluative weight, and I want officials to understand why: FATF's Recommendation 26 and Immediate Outcome 3 require that supervisors; the Prudential Authority and the FIC itself for South African banks and other accountable institutions, sector-specific bodies for DNFBPs such as the Legal Practice Council for attorneys or the Estate Agency Affairs Board for property practitioners, apply a genuinely risk-based approach to supervisory intensity, meaning higher-risk institutions receive proportionately more frequent and more probing on-site inspection, rather than a uniform compliance-calendar approach that treats a small currency exchange bureau the same as a systemically significant bank. Under-resourced DNFBP supervisors, a chronic finding across ESAAMLG member states, are precisely the gap that launderers exploit when they move from heavily supervised banks toward lawyers' trust accounts, estate agents and dealers in high-value goods, which is why FATF's 2012 extension of preventive-measure obligations to DNFBPs under Recommendations 22 and 23 remains one of the hardest parts of the standard for developing-country systems to operationalise in practice, requiring not new legislation so much as sustained supervisory capacity-building that a single legislative amendment cannot substitute for.

Bringing this lesson's threads together with the module as a whole: FATF sets the standard, FSRBs like ESAAMLG evaluate compliance and effectiveness against it, the ICRG escalates and monitors serious deficiencies through grey-listing and action plans, and the entire apparatus exists to pressure-test a genuinely domestic architecture — the FIU, the Egmont network that connects it internationally, the supervisors, law enforcement and prosecutors, all organised around a shared understanding of national risk. An official who can trace a single finding, such as South Africa's 2023 grey-listing, back through the ESAAMLG evaluation to the specific Immediate Outcome and the specific domestic institution responsible for remedying it, has understood the architecture in the way this module intends.