From FATF Standards to National AML Rules

FATF is the global standard setter for measures against money laundering, terrorist financing and proliferation financing. Its Recommendations describe the outcomes, institutions and controls that countries should establish.

FATF also recognises that countries have different legal, administrative and operational frameworks and different financial systems. They therefore cannot all apply identical measures.

The practical chain is:

FATF Recommendations and Interpretive Notes
→ national risk assessment and policy choices
→ legislation and regulations
→ FIU and sector-supervisor rules
→ institution policy and operating processes
→ case-level evidence, review and escalation

A FATF concept becomes an enforceable obligation only through the applicable legal and regulatory framework. An institution may use FATF material to understand purpose and international expectations, but it must use domestic law and competent-authority guidance to determine what it must actually do.

2. The common AML foundation#

Most FATF-aligned jurisdictions contain broadly recognisable versions of the following components:

Common component Typical purpose
National and business-wide risk assessment Identify material ML/TF/PF threats and vulnerabilities
Customer identification Establish who the customer is
Beneficial ownership Identify the natural person who ultimately owns or controls a customer or arrangement
CDD and EDD Apply controls proportionate to customer, product, geography and activity risk
PEP controls Address corruption and influence risks connected with prominent public functions
Ongoing monitoring Detect material changes, unusual activity and inconsistencies
Suspicious transaction reporting Send suspicion to the competent FIU without tipping off the subject
Recordkeeping Preserve an auditable history of evidence, decisions and transactions
Internal controls Allocate responsibility, oversight, training, testing and escalation
Targeted financial sanctions Implement applicable freezing and prohibition duties
Supervision and enforcement Test compliance and sanction failures

The labels, scope and legal detail can differ. The underlying control logic remains recognisable because jurisdictions are working from a shared international framework.

3. What FATF does not standardise into one global operating process#

FATF does not create one universal filing portal, deadline, customer form or approval chain. National systems decide matters such as:

  • which businesses and professions are reporting or obliged entities;
  • which authority supervises each sector;
  • which body receives suspicious transaction reports;
  • the legal definition and treatment of domestic, foreign and international-organisation PEPs;
  • beneficial-ownership thresholds and control tests;
  • when simplified due diligence may be used;
  • which situations require enhanced due diligence;
  • whether threshold, cash or mandatory-control reports exist in addition to STRs or SARs;
  • the deadline, format and transmission channel for reports;
  • the period for which records must be retained;
  • which domestic, UN, regional or other sanctions lists must be applied;
  • when an operation must be rejected, delayed, suspended, frozen or escalated;
  • whether a specific MLRO, compliance officer or responsible officer is required;
  • the extent of personal, civil, administrative or criminal liability;
  • permitted reliance on third parties and outsourcing conditions;
  • data-sharing, confidentiality and localisation rules;
  • sector-specific requirements for banks, securities firms, insurers, VASPs and DNFBPs.

These differences are not decorative footnotes. They determine whether an otherwise sensible AML process complies with local law.

4. Why the local layer matters operationally#

A firm may understand the FATF framework correctly and still breach local law if it applies:

  • the wrong STR deadline;
  • the wrong reporting threshold;
  • an incomplete sanctions list;
  • another jurisdiction's PEP definition;
  • the wrong recordkeeping period;
  • an unauthorised outsourcing model;
  • the wrong decision authority for account rejection, suspension or freezing;
  • a group policy that does not include stricter local requirements.

The universal core explains why a control exists. The jurisdictional layer determines how, when, by whom and under which legal authority it must be performed.

5. Why national regimes diverge#

Common-law, civil-law, federal, unitary and supranational systems distribute legislative, regulatory and enforcement authority differently. In some countries, detailed obligations are placed directly in legislation. In others, the law is supplemented by extensive regulations, rulebooks and sector guidance.

Financial-system structure#

A global financial centre, a cash-intensive economy, an offshore business centre and a rapidly digitalising payments market do not have the same exposure profile. National rules often reflect the products, sectors and cross-border flows most important to that economy.

National risk assessment#

FATF's risk-based approach requires countries to identify, assess and understand their risks and apply proportionate measures. A national risk assessment can therefore influence:

  • supervisory priorities;
  • high-risk sectors;
  • reporting expectations;
  • resource allocation;
  • licensing or registration requirements;
  • targeted remediation programmes.

Institutional design#

Some jurisdictions use a central bank as a major AML supervisor; others distribute responsibility across a central bank, securities regulator, insurance regulator, professional bodies, gambling authority, company registrar and specialist FIU.

Policy choices and implementation history#

Countries may add requirements beyond the FATF baseline, preserve older reporting models, respond to enforcement failures or introduce transitional rules. Implementation can also lag behind a FATF amendment or change through later legislation and guidance.

6. Technical compliance is not the same as effectiveness#

FATF mutual evaluations assess two distinct dimensions:

Dimension Core question
Technical compliance Are the required laws, powers, institutions and formal controls present?
Effectiveness Do those measures work and produce the intended outcomes in practice?

A country may have detailed legislation but weak supervision, poor beneficial-ownership transparency, limited use of financial intelligence or ineffective enforcement. Another country may achieve stronger operational outcomes while still having technical deficiencies.

For an analyst, a legal rule answers what should happen. Mutual-evaluation findings and enforcement materials help show what happens in practice.

7. FATF alignment does not make countries interchangeable#

The shared standard allows comparison, but it does not justify copying one country's procedures into another.

Model Illustrative implementation feature
European Union Supranational rules and coordination combined with national FIUs, supervisors and implementation layers
United Kingdom Risk-based obligations with strong firm-wide assessment, MLRO and sector-guidance components
United States Institution-specific BSA rules, suspicious activity reporting and separate transaction-reporting duties
Russia Suspicious-operation reporting combined with statutory categories of mandatory control and detailed internal-control requirements
Mauritius FATF-aligned framework with multiple sector supervisors and material cross-border and legal-arrangement exposure
Vietnam More prescriptive reporting timelines, national risk classifications, local lists and sector-specific statutory indicators

These examples are orientation only. They are not substitutes for current national law or a jurisdiction overlay.

8. Three layers of AML knowledge#

A useful knowledge architecture separates three layers:

Layer 1 — Universal core#

Stable concepts such as risk-based controls, CDD, beneficial ownership, PEPs, monitoring, reporting, governance and evidence.

Layer 2 — Jurisdiction overlay#

Domestic laws, supervisors, FIU arrangements, deadlines, thresholds, lists, local roles, enforcement practice and sector rules.

Layer 3 — Institution-specific policy#

The organisation's risk appetite, products, customer base, systems, approval authorities, escalation routes and evidence standards.

AML Bible can explain Layers 1 and 2. It should not imply that it describes the final institution-specific configuration in Layer 3.

9. What this means for an AML analyst#

Learn the universal AML core once. For every new jurisdiction, establish at least:

  • the primary legal framework;
  • the competent regulators and FIU;
  • the scope of covered entities;
  • local CDD, beneficial-ownership and PEP rules;
  • suspicious and threshold-reporting duties;
  • filing deadlines and channels;
  • recordkeeping periods;
  • sanctions and TFS sources;
  • required AML roles and decision authorities;
  • relevant enforcement and supervisory expectations;
  • the date on which each source was checked.

Do not treat knowledge of FATF as proof of compliance with local law. Do not treat a national law as proof that the system is effective. Keep the standard, the legal implementation and the operational evidence separate.

10. Source basis#

See Also#