Core Concepts
Module map#
| Module | Primary source IDs | Practitioner use |
|---|---|---|
| Risk-Based Approach | SRC-FATF-001 | Decide depth of controls based on risk |
| CDD/KYC | SRC-FATF-001 | Identify, verify, understand and monitor customer |
| Record Keeping | SRC-FATF-001 | Preserve evidence for audit/law enforcement |
| PEP | SRC-FATF-001 | Apply EDD and senior approval when required |
| Sanctions / TFS / CPF | SRC-FATF-001, SRC-UN-001, SRC-FATF-007 | Freeze/no-dealing escalation and sanctions screening |
| Beneficial Ownership | SRC-FATF-001, SRC-FATF-004, SRC-FATF-005 | Identify natural persons who own or control customer |
| STR/SAR | SRC-FATF-001, SRC-EGMONT-001 | Escalate suspicion to MLRO/FIU process |
| Internal Controls | SRC-FATF-001, SRC-BASEL-001 | Policies, controls, training and independent audit |
| VASP / Crypto | SRC-FATF-001, SRC-FATF-003 | Crypto exposure, VASP licensing and Travel Rule context |
| TBML | SRC-FATF-006 | Trade finance and goods-flow risk indicators |
Core operating rules#
Risk-Based Approach#
The reviewer should allocate effort based on identified risk. Higher risk requires enhanced measures. Lower risk may allow simplified measures only where implementation policies and risk assessment permit it.
CDD/KYC#
The reviewer must understand who the customer is, who owns or controls the customer, why the relationship exists, and whether activity remains consistent with the customer risk profile.
Record keeping#
The reviewer should preserve enough evidence to reconstruct what was checked, which sources were used, what was found, what was missing, who reviewed it and why the decision was made.
PEP#
The reviewer must not treat all PEPs as automatically prohibited. It should identify PEP type, role, geographic/organisational context, risk relevance, source of wealth/source of funds needs, senior approval needs and monitoring intensity.
Sanctions / TFS / CPF#
The reviewer must treat sanctions hits as time-sensitive. Possible matches require controlled escalation. Likely or true matches require MLRO/legal process under applicable sanctions obligations.
Beneficial ownership#
The reviewer must identify natural persons behind ownership and control. If ownership is complex or opaque, the reviewer must document the chain and escalate unresolved control risk.
STR/SAR#
The reviewer should not decide final filing alone. It should assemble facts, chronology, red flags and evidence for MLRO review.
Internal controls#
The reviewer should support repeatability: every check should be explainable, logged and quality-reviewable.
Digital Jurisdiction Exposure#
Digital Jurisdiction Exposure is a practical KYB/EDD module. It reviews public domain, DNS and email infrastructure records for jurisdictional references that may not be visible from website IP geolocation alone.
It is not a traditional FATF-mandated standalone AML check. It is a supporting risk-based indicator used to enrich KYB/EDD analysis and evidence packs.
Related article: Digital Jurisdiction Exposure
Industry-practice risk-based layer#
SRC-WOLF-003 complements the FATF risk-based framework with practical financial-institution guidance on proportionality, prioritisation and effectiveness. It is a secondary industry-practice source and must remain subordinate to applicable law, FATF standards and institution-specific risk governance.