How to Research an AML Jurisdiction

1. Define the research question before collecting sources#

Avoid starting with an unlimited request such as “research AML in Country X”. Define the operational purpose:

  • customer onboarding;
  • transaction monitoring;
  • sanctions and TFS;
  • STR or SAR reporting;
  • correspondent banking;
  • VASP activity;
  • real-estate or DNFBP exposure;
  • group-policy localisation;
  • licensing or market entry;
  • country-risk assessment.

The purpose determines which sources, sectors and dates matter. A country-risk note for customer EDD is not a substitute for a legal implementation review for a regulated entity.

2. Establish the international baseline#

Start with the current FATF Recommendations, Interpretive Notes and glossary. Identify the Recommendations most relevant to the question.

Common starting points include:

Topic FATF focus
Risk-based approach Recommendation 1
Customer due diligence Recommendation 10
PEPs Recommendation 12
Correspondent banking Recommendation 13
Wire transfers Recommendation 16
Third-party reliance Recommendation 17
Internal controls and groups Recommendation 18
Suspicious transaction reporting Recommendation 20
Tipping-off and confidentiality Recommendation 21
Beneficial ownership Recommendations 24 and 25
Supervision Recommendations 26 to 28
Sanctions for non-compliance Recommendation 35

This step gives you the common framework. It does not establish the current domestic rule.

3. Identify the country's FATF network body#

Determine whether the country is assessed directly by FATF or through a FATF-Style Regional Body, such as:

  • APG;
  • CFATF;
  • EAG;
  • ESAAMLG;
  • GABAC;
  • GAFILAT;
  • GIABA;
  • MENAFATF;
  • MONEYVAL.

The FATF Global Network covers more than 200 jurisdictions through FATF and the regional bodies. The relevant country page or regional-body page is usually the best entry point for mutual-evaluation and follow-up materials.

Record:

  • the responsible assessment body;
  • the latest mutual-evaluation report;
  • the latest follow-up report;
  • the assessment round and publication dates;
  • whether newer national legislation post-dates the evaluation.

4. Read the mutual evaluation selectively#

A mutual-evaluation report can be hundreds of pages. Do not begin by reading it linearly unless the assignment requires a full-system review.

Start with:

  1. Executive Summary and Key Findings;
  2. Risks and Context;
  3. Preventive Measures;
  4. Supervision;
  5. Legal Persons and Arrangements;
  6. Financial Intelligence and Reporting;
  7. Technical Compliance Annex.

The most useful technical Recommendations for an institutional review are often R.1, R.10, R.12, R.20, R.24, R.25, R.26–28 and R.35.

Capture both:

  • formal deficiencies in law or regulation;
  • effectiveness findings showing weak implementation or outcomes.

Do not reduce a mutual evaluation to its ratings table. The reasons behind a rating are more useful than the letter or number alone.

A mutual evaluation is a dated snapshot. A country may subsequently:

  • amend its AML law;
  • issue new regulations;
  • change beneficial-ownership rules;
  • create a new supervisor;
  • revise STR procedures;
  • expand VASP regulation;
  • receive technical re-ratings.

Always check the latest follow-up report and then verify whether additional changes occurred after that report.

Maintain separate fields for:

  • evaluation date;
  • follow-up date;
  • current-law review date;
  • source access date.

6. Build the national source hierarchy#

Use sources in the following order:

Primary AML/CFT/CPF legislation
→ implementing regulations and binding rulebooks
→ FIU reporting rules, forms and portal instructions
→ sector-supervisor rules and guidance
→ official FAQs and notices
→ enforcement decisions and thematic reviews
→ national risk assessment and strategy
→ reliable secondary commentary

Primary legislation#

Identify the main AML statute and any connected laws covering sanctions, beneficial ownership, criminal offences, data protection, company law or sector licensing.

Implementing regulations#

Confirm commencement dates, amendments, transitional provisions, scope and definitions. A consolidated version is preferable, but the legal status of the consolidated text must be clear.

FIU material#

Find:

  • who must report;
  • what is reported;
  • reporting deadlines;
  • reporting forms or electronic channels;
  • urgent-reporting procedures;
  • confidentiality and tipping-off rules;
  • feedback, typologies and indicators.

Sector-supervisor material#

The central bank may regulate banks but not securities firms, insurers, lawyers, accountants, casinos, real-estate professionals or TCSPs. Identify the competent authority for the exact sector.

Enforcement material#

Review public penalties, inspection findings, thematic reviews and remediation notices. These show which failures supervisors actually prioritise.

7. Do not assume the central bank is the whole system#

A common beginner error is to search only the central bank website. National AML authority may be distributed across:

  • the FIU;
  • central bank;
  • securities regulator;
  • insurance regulator;
  • gambling authority;
  • ministry of justice or finance;
  • company registrar;
  • sanctions authority;
  • self-regulatory or professional bodies;
  • law-enforcement and prosecution agencies.

Build an authority map before concluding that a requirement does not exist.

Authority Questions to answer
FIU Who reports, how, when and under what confidentiality rules?
Sector supervisor Which controls, governance and testing expectations apply?
Sanctions authority Which lists and freezing/reporting duties apply?
Company or BO registrar What ownership data exists and how reliable is it?
Professional body Are there binding or recognised sector rules for DNFBPs?

8. Create a jurisdiction worksheet#

Use one standard template for every country:

Field Research output
Legal framework Current principal laws, regulations and effective dates
Regulators Authorities by financial and DNFBP sector
FIU Name, mandate and reporting channel
Covered entities Financial institutions, VASPs and DNFBPs in scope
Risk assessment National and institution-level requirements
CDD Trigger events, identification and verification duties
Beneficial ownership Definition, threshold, control test and verification
PEPs Categories, family/associates and approval requirements
EDD/SDD Mandatory triggers and permitted simplification
Ongoing monitoring Review and event-driven requirements
STR/SAR Trigger, deadline, channel and urgent procedure
Threshold reports Cash, transfer or other mandatory reporting
Recordkeeping Duration, form and accessibility
Sanctions/TFS Applicable lists, freezing and reporting duties
MLRO/responsible officer Appointment, seniority and authority
Tipping-off Prohibition, exceptions and information sharing
Stop/freeze/reject Legal trigger and authorised decision maker
Outsourcing/reliance Conditions and retained responsibility
Enforcement Recent penalties, common findings and liability
Review date Date each material source was checked

A blank field is a research gap, not evidence that no rule exists.

Label every source correctly:

  • law in force;
  • regulation in force;
  • enacted but not yet effective;
  • proposed rule or consultation;
  • official guidance;
  • FAQ or explanatory notice;
  • supervisory expectation;
  • enforcement example;
  • mutual-evaluation finding;
  • commercial summary.

Do not merge a proposal with a binding requirement. Record the publication date, effective date and any transition period.

10. Resolve conflicts between sources#

When sources appear inconsistent:

  1. check whether they address different sectors;
  2. compare publication and effective dates;
  3. identify whether one source is law and the other guidance;
  4. look for amendments, exemptions or transitional rules;
  5. check whether an English translation is official;
  6. escalate unresolved legal interpretation rather than silently choosing the convenient answer.

For material obligations, preserve the exact provision or official passage used, while respecting copyright and access limitations.

11. Check language and translation risk#

For jurisdictions where the controlling text is not in the analyst's language:

  • prefer an official translation where available;
  • retain the original-language title and citation;
  • record whether the translation is official or informal;
  • avoid treating machine translation as final legal interpretation;
  • escalate ambiguous definitions, thresholds or deadlines.

Translation can support discovery. It should not manufacture certainty.

12. Common research mistakes#

  • using FATF Recommendations as a substitute for national law;
  • reading only the mutual-evaluation ratings table;
  • ignoring follow-up reports;
  • relying only on a central bank website;
  • applying EU, UK or US terminology to another jurisdiction without verification;
  • confusing FATF listing with a complete country-risk assessment;
  • treating regulator guidance as legislation, or legislation as a complete operating procedure;
  • using an old law because it ranks higher in search results;
  • citing a commercial summary without tracing the underlying official source;
  • failing to record access and effective dates;
  • assuming no rule exists because it was not found in English;
  • copying a group policy without testing stricter local requirements.

13. Minimum evidence pack for a jurisdiction review#

A defensible research file should contain:

  • research question and scope;
  • authority map;
  • current primary legislation;
  • key regulations and sector guidance;
  • FIU reporting instructions;
  • relevant sanctions/TFS sources;
  • mutual evaluation and latest follow-up report;
  • national risk assessment where available;
  • completed jurisdiction worksheet;
  • unresolved questions and escalation owner;
  • source dates and version notes;
  • final reviewer approval where the output affects operational policy.

14. Research boundary#

This methodology supports structured research. It does not provide legal advice or replace qualified local counsel, regulator confirmation or institution-specific implementation review.

A jurisdiction profile should state:

  • which sectors it covers;
  • what it does not cover;
  • its review date;
  • which items require local legal validation;
  • whether the material is suitable for education, risk orientation or operational configuration.

15. Source basis#

  • SRC-FATF-001: FATF Recommendations and Interpretive Notes.
  • SRC-FATF-009: FATF Methodology, mutual evaluations and follow-up framework.
  • SRC-FATF-010: FATF national risk assessment guidance.
  • SRC-FATF-025: FATF Global Network and regional assessment bodies.

See Also#