AML Source Library & Register
A linked source-to-process system for evidence-based AML work.
Related glossary terms: TFS , FIU , Red Flag .
This register links official standards, legislation, FIU materials, industry practice, open data, aggregators and training references. Each card records purpose, limitations and the AML Bible pages that actually use the source.
Use rule: A source name is not evidence by itself. The case file must record the exact document or dataset, access date, relevant finding, limitations and effect on the decision.
Editorial and Source Policy# Source priority hierarchy ##
FATF Recommendations and Interpretive Notes : the main AML/CFT/CPF control architecture.
FATF guidance and typologies : practical sector indicators, red flags and risk patterns.
UN sanctions / TFS sources : official baseline for targeted financial sanctions screening.
Industry best practice : Wolfsberg and Basel for governance, correspondent banking and due diligence quality.
Institutional sources : Egmont for FIU and suspicious reporting concepts.
Open official data sources : sanctions lists, corporate registries, LEI data and debarment lists for direct evidence anchors.
Aggregators and investigative datasets : OpenSanctions, OpenCorporates, ICIJ and OCCRP for discovery, enrichment and leads, with source limitations recorded.
Training references : ACAMS and ICA for role competence mapping and learning paths.
What is intentionally outside the public knowledge base ## The knowledge base does not hard-code domestic filing deadlines, local STR/SAR portals, regulator-specific forms, local legal thresholds, domestic sanctions programmes or MLRO approval rules.
Those items should be sourced from applicable national law and regulator/FIU material, then reflected in the institution’s policies, systems and procedures.
Internal Concept Pages and Source Layer# These pages are AML Bible concept pages built from the existing source register and do not create new external source authority:
Customer Risk Assessment & Risk Rating
Transaction Monitoring & Alert Triage
AML Quality Assurance & Audit Readiness
AML Review Examples
Practitioner and Academic References# A standalone reference page is available here: Practitioner & Academic References .
Books and practitioner references are secondary sources in AML Bible. They are used for professional framing, historical perspective and review-mindset calibration. Official FATF, regulator, FIU, sanctions, court, registry and other primary sources remain the main authority for control design, evidence use and public-source interpretation.
Copyright rule: do not reproduce long passages from proprietary books or paid training materials. Use short citations, high-level paraphrase and transformed control concepts only.
Official Typology and Advisory Sources#
FATF Methods and Trends publications — official typology and risk-indicator reports used for defensive red-flag framing.
FATF Virtual Assets Red Flag Indicators — VASP and virtual-asset risk indicators.
FATF / APG / Egmont trade-based money laundering indicators — TBML defensive indicators.
FinCEN advisories, notices and fact sheets — public threat, typology and monitoring context.
AUSTRAC typology papers and indicators — public ML/TF risk indicators and reporting-entity education.
Egmont Group public summaries — FIU context and financial-intelligence practice.
Practitioner Books & Academic References# ID Reference Use in AML Bible
BOOK-COX-001 Dennis Cox, Handbook of Anti-Money Laundering Implementation framing, governance, controls and operational AML perspective. BOOK-PARKMAN-001 Tim Parkman, Mastering Anti-Money Laundering and Counter-Terrorist Financing Compliance programme and practitioner control framing. BOOK-PLATT-001 Stephen Platt, Criminal Capital Risk-control critique and financial-industry accountability framing. BOOK-MCOTTERILL-001 Nigel Morris-Cotterill, How Not to Be a Money Launderer Historical practitioner perspective, early risk-based thinking and compliance-system audit mindset. BOOK-MCOTTERILL-002 Nigel Morris-Cotterill, Understanding Suspicion in Financial Crime Suspicion as a reasoned analytical conclusion rather than a keyword match. BOOK-CASSARA-001 John A. Cassara, Money Laundering and Illicit Financial Flows Value movement, enforcement perspective and effectiveness framing. BOOK-CASSARA-002 John A. Cassara, Trade-Based Money Laundering TBML value-trail lens and defensive trade-risk framing. BOOK-CASSARA-JORISCH-001 John A. Cassara & Avi Jorisch, On the Trail of Terror Finance CTF mindset and destination/use-of-value perspective. BOOK-MADINGER-001 John Madinger, Money Laundering: A Guide for Criminal Investigators Evidence chain, proceeds tracing and investigator mindset. BOOK-LILLEY-001 Peter Lilley, Dirty Dealing Historical view of laundering through legitimate business and global financial systems. BOOK-GILMORE-001 William C. Gilmore, Dirty Money International legal evolution of AML/CFT measures. BOOK-REUTER-TRUMAN-001 Peter Reuter & Edwin Truman, Chasing Dirty Money AML effectiveness, system outcomes and policy critique. BOOK-UNGER-BUSUIOC-001 Brigitte Unger & Elena Busuioc, The Scale and Impacts of Money Laundering Economic impact, measurement limits and scale framing. BOOK-MULLER-KALIN-GOLDSWORTH-001 Muller, Kälin & Goldsworth, Anti-Money Laundering: International Law and Practice Cross-border law and practice reference. BOOK-WORLDBANK-001 World Bank, Combating Money Laundering and the Financing of Terrorism: A Comprehensive Training Guide Institutional training baseline and AML/CFT learning structure. BOOK-MCCARTHY-001 Killian J. McCarthy, The Money Laundering Market Criminal-economy and regulatory market lens. BOOK-RYDER-001 Nicholas Ryder, The Financial War on Terrorism CTF strategy and counter-terrorist-financing policy limits. BOOK-UNGER-LINDE-001 Unger & van der Linde, Research Handbook on Money Laundering Academic coverage of history, scale, RBA, TBML, real estate and governance.
Search the library
SRC-ACAMS-001 ACAMS CAMS Certification Tier 4 Domain Training / competency map Operational use AML professional competency benchmark and practical learning map Role Analyst→MLRO Type Training reference Edition / date Living source / current edition Jurisdiction International training reference Authority tier Tier 4 — training reference Limitations Secondary learning reference; not a legal, regulatory or final operational authority. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-ACAMS-002 ACAMS Specialist Certifications Tier 4 Domain Training / specialist map Operational use Sanctions, fraud and specialist AFC certification pathways Role Senior→MLRO Type Training reference Edition / date Living source / current edition Jurisdiction International training reference Authority tier Tier 4 — training reference Limitations Secondary learning reference; not a legal, regulatory or final operational authority. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-ACAMS-003 ACAMS AML Glossary Tier 4 Domain Training / terminology Operational use Plain-language AML term reference for learner orientation Role Foundation→Analyst Type Glossary Edition / date Living source / current edition Jurisdiction International training reference Authority tier Tier 4 — training reference Limitations Secondary learning reference; not a legal, regulatory or final operational authority. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-ICA-001 ICA Certificate in Anti Money Laundering Tier 4 Domain Training / junior-mid Operational use Practical introductory AML course for core ML/TF risks Role Junior→Analyst Type Training reference Edition / date Living source / current edition Jurisdiction International training reference Authority tier Tier 4 — training reference Limitations Secondary learning reference; not a legal, regulatory or final operational authority. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-ICA-002 ICA Diploma in Anti Money Laundering Tier 4 Domain Training / senior-MLRO Operational use Advanced AML qualification for MLROs and professionals managing ML risk Role Senior→MLRO Type Training reference Edition / date Living source / current edition Jurisdiction International training reference Authority tier Tier 4 — training reference Limitations Secondary learning reference; not a legal, regulatory or final operational authority. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-ICA-003 ICA Subject Areas Tier 4 Domain Training / subject taxonomy Operational use AML, compliance, CDD/KYC, sanctions and financial crime topic taxonomy Role Junior→MLRO Type Training reference Edition / date Living source / current edition Jurisdiction International training reference Authority tier Tier 4 — training reference Limitations Secondary learning reference; not a legal, regulatory or final operational authority. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-025 FATF Global Network and FATF-Style Regional Bodies Tier 1
Domain Global AML/CFT/CPF implementation and jurisdiction research
Operational use Identify the FATF or FSRB assessment body, country pages, mutual evaluations and follow-up materials
Role Analyst→MLRO
Type Official global-network directory
Edition / date Living source / current edition
Jurisdiction Global / FATF
Authority tier Tier 1 — official / primary source
Limitations Directory and network overview; verify the current country page, assessment body, report edition and subsequent national legal changes.
Review cadence At each jurisdiction review
Last reviewed 2026-07-12
Tier 4 — Training references# SRC-ICIJ-001 ICIJ Offshore Leaks Database Tier 3 Domain Investigative offshore data Operational use Offshore entity and relationship leads from public leak investigations Role Senior→MLRO Type Investigative dataset Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 3 — aggregator / investigative source Limitations Investigative lead source; identity, context and allegations require corroboration and careful source weighting. Review cadence Dynamic / after release Last reviewed 2026-07-11 SRC-OC-001 OpenCorporates API Tier 3 Domain Global company data aggregator Operational use Cross-jurisdiction company discovery with provenance and source links Role Analyst→Senior Type Aggregator Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 3 — aggregator / investigative source Limitations Discovery and enrichment only; trace material findings to primary sources and record coverage limits. Review cadence Dynamic Last reviewed 2026-07-11 SRC-OCCRP-001 OCCRP Aleph Tier 3 Domain Investigative data platform Operational use Public records, leaks and investigative document/entity discovery Role Senior→MLRO Type Investigative platform Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 3 — aggregator / investigative source Limitations Discovery and enrichment only; trace material findings to primary sources and record coverage limits. Review cadence Dynamic Last reviewed 2026-07-11 SRC-OS-001 OpenSanctions Tier 3 Domain Sanctions / PEP / risk data aggregator Operational use Discovery and enrichment across sanctions, PEP and risk datasets Role Analyst→MLRO Type Aggregator Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 3 — aggregator / investigative source Limitations Discovery and enrichment only; trace material findings to primary sources and record coverage limits. Review cadence Dynamic Last reviewed 2026-07-11 Tier 3 — Aggregators and investigative sources# SRC-BASEL-001 Basel Committee: ML/TF Risk Management Tier 2 Domain Banking governance Operational use Bank-level ML/TF risk management, governance and supervisory cooperation Role Senior→MLRO Type Banking best practice Edition / date Living source / current edition Jurisdiction International / banking sector Authority tier Tier 2 — recognised institutional / industry source Limitations Institutional or banking-practice source; does not replace local law or customer-specific assessment. Review cadence Annual Last reviewed 2026-07-11 SRC-BASEL-INDEX-001 Basel AML Index 2025 — Public Edition Tier 2 Domain Comparative jurisdiction risk Operational use Independent jurisdiction-risk comparison and benchmarking alongside FATF, MERs and NRAs Role Analyst→MLRO Type Independent risk index Edition / date 2025 Public Edition Jurisdiction Global comparative index Authority tier Tier 2 — independent institutional methodology Limitations Composite indicator, not a legal classification, FATF substitute, automatic EDD trigger or customer score. Review cadence Annual Last reviewed 2026-07-11 SRC-EDPB-001 EDPB Statement on AML Action Plan and Personal Data Protection Tier 2 Domain Data protection / AML overlap Operational use Privacy-aware recordkeeping, retention tension, data protection framing for AML evidence Role Senior→MLRO Type Data protection authority statement Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 2 — supporting source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Annual / after EU AML or GDPR updates Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-EGMONT-001 Egmont Group FIUs Tier 2 Domain FIU / STR intelligence Operational use FIU role in receipt, analysis and dissemination of financial intelligence Role Analyst→MLRO Type Institutional source Edition / date Living source / current edition Jurisdiction International FIU network Authority tier Tier 2 — recognised institutional / industry source Limitations FIU institutional/practice context; not a universal reporting threshold or filing instruction. Review cadence Annual Last reviewed 2026-07-11 SRC-EGMONT-ASSET-001 Egmont — Increasing FIU Effectiveness in the Asset Recovery Process: Phase II Tier 2 Domain FIU / asset recovery Operational use Asset tracing, securing, FIU cooperation and recovery-process context Role Senior→MLRO Type FIU practice report Edition / date 2025 public summary Jurisdiction International FIU network Authority tier Tier 2 — intergovernmental/FIU practice Limitations Institutional practice context; does not confer legal powers to freeze, seize or recover assets. Review cadence After new Egmont edition Last reviewed 2026-07-11 SRC-EGMONT-BECA-001 Best Egmont Cases — Financial Analysis Cases 2021–2023 Tier 2 Domain FIU cases / typologies Operational use Cross-border examples of FIU financial analysis, predicate offences and investigative value Role Analyst→MLRO Type FIU casebook / typologies Edition / date 2024 publication; cases 2021–2023 Jurisdiction International FIU network Authority tier Tier 2 — intergovernmental/FIU practice Limitations Illustrative cases; does not create universal suspicion thresholds or filing rules. Review cadence After new Egmont edition Last reviewed 2026-07-11 SRC-EGMONT-NRA-001 Egmont — The Role of FIUs in the National Risk Assessment Process Tier 2 Domain National risk assessment / FIU role Operational use FIU data, coordination, methodology, stakeholder involvement and implementation of NRA findings Role Senior→MLRO Type FIU practice report Edition / date 2024 Jurisdiction International FIU network Authority tier Tier 2 — intergovernmental/FIU practice Limitations Describes FIU practice; does not replace a jurisdiction’s own NRA, law or FATF assessment. Review cadence After new Egmont edition Last reviewed 2026-07-11 SRC-OO-001 Open Ownership Beneficial Ownership Data Standard Tier 2 Domain Beneficial ownership data model Operational use Structured BO data collection, sharing and representation concepts Role Senior→MLRO Type Open standard Edition / date Living source / current edition Jurisdiction Global Authority tier Tier 2 — recognised institutional / industry source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence After standard update Last reviewed 2026-07-11 SRC-STAR-ASSET-001 StAR — Asset Recovery Handbook Tier 2 Domain Asset tracing and recovery Operational use Asset-tracing lifecycle, evidence preservation, international cooperation and recovery-process context Role Senior→MLRO Type Intergovernmental handbook Edition / date StAR handbook Jurisdiction Global Authority tier Tier 2 — World Bank/UNODC StAR practice guidance Limitations Practice handbook; does not replace current local criminal, civil, confiscation or mutual-assistance law. Review cadence Annual review Last reviewed 2026-07-11 SRC-STAR-NOMINEES-001 StAR — Signatures for Sale: How Nominee Services for Shell Companies Are Abused to Conceal Beneficial Owners Tier 2 Domain Beneficial ownership / nominees Operational use Nominee arrangements, shell-company control, evidence questions and corruption-proceeds context Role Senior→MLRO Type Intergovernmental research / practice Edition / date 2022 Jurisdiction Global Authority tier Tier 2 — World Bank/UNODC StAR practice research Limitations Research and practice source; does not itself determine legal ownership, wrongdoing or local BO thresholds. Review cadence Annual review Last reviewed 2026-07-11 SRC-UK-JMLSG-001 JMLSG Current AML/CTF Guidance Tier 2 Domain United Kingdom financial-sector implementation guidance Operational use Translate UK legal requirements into risk-based, sector-specific financial-services controls and operating expectations Role Analyst→MLRO Type Industry guidance with relevant approval status Edition / date Living guidance / current published revisions Jurisdiction United Kingdom Authority tier Tier 2 — recognised industry guidance Limitations Check the exact part, sector chapter, revision and approval status. It is not legislation and must not be applied as a mechanical checklist. Review cadence Monitor JMLSG revisions and approvals Last reviewed 2026-07-11 SRC-WOLF-001 Wolfsberg Correspondent Banking Resources Tier 2 Domain Correspondent banking Operational use CBDDQ/FCCQ due diligence questionnaires and FI-to-FI baseline Role Senior→MLRO Type Best practice Edition / date Living source / current edition Jurisdiction International / banking industry Authority tier Tier 2 — recognised institutional / industry source Limitations Industry best practice; not binding law and must be mapped to local rules and institutional risk governance. Review cadence Annual Last reviewed 2026-07-11 SRC-WOLF-002 Wolfsberg Sanctions Screening Guidance Tier 2 Domain Sanctions / name screening Operational use Screening design, alert review, effectiveness, list/data quality and false-positive context Role Analyst→MLRO Type Best practice Edition / date Living source / current edition Jurisdiction International / banking industry Authority tier Tier 2 — recognised institutional / industry source Limitations Industry best practice; not binding law and must be mapped to local rules and institutional risk governance. Review cadence Annual / after Wolfsberg update Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-WOLF-003 Wolfsberg Guidance on the Risk-Based Approach Tier 2 Domain Financial-institution risk-based approach Operational use Proportionality, prioritisation, effectiveness, risk appetite and risk-assessment design Role Senior→MLRO Type Industry best practice Edition / date June 2026 Jurisdiction International / banking industry Authority tier Tier 2 — recognised industry practice Limitations Not binding law; primarily financial-institution oriented and must be mapped to local rules. Review cadence After Wolfsberg update Last reviewed 2026-07-11 SRC-WOLF-004 Wolfsberg Source of Wealth and Source of Funds FAQs Tier 2 Domain EDD / SoW / SoF Operational use Evidence questions, proportionality and distinction between source of wealth and source of funds Role Analyst→MLRO Type Industry best practice Edition / date 2020 Jurisdiction International / banking industry Authority tier Tier 2 — recognised industry practice Limitations Not binding law; evidence expectations must follow local law, policy and customer risk. Review cadence After Wolfsberg update Last reviewed 2026-07-11 SRC-WOLF-005 Wolfsberg Negative News Screening FAQs Tier 2 Domain Adverse media / negative news Operational use Risk-based screening scope, source classification, relevance, governance and QA Role Analyst→MLRO Type Industry best practice Edition / date 2022 Jurisdiction International / banking industry Authority tier Tier 2 — recognised industry practice Limitations Not binding law; media findings require identity resolution and source-quality assessment. Review cadence After Wolfsberg update Last reviewed 2026-07-11 SRC-WOLF-006 Wolfsberg Statement on Effective Monitoring for Suspicious Activity — Part I Tier 2 Domain Suspicious-activity monitoring Operational use Monitoring outcomes beyond narrow automated transaction monitoring Role Senior→MLRO Type Industry best practice Edition / date 2024 Jurisdiction International / banking industry Authority tier Tier 2 — recognised industry practice Limitations Not a universal model standard or regulatory threshold; requires institution-specific validation. Review cadence After Wolfsberg update Last reviewed 2026-07-11 SRC-WOLF-007 Wolfsberg Statement on Effective Monitoring for Suspicious Activity — Part II Tier 2 Domain Monitoring innovation / model transition Operational use Transition, validation, model-risk balance, explainability and investigation readiness Role Senior→MLRO Type Industry best practice Edition / date 2025 Jurisdiction International / banking industry Authority tier Tier 2 — recognised industry practice Limitations Not binding law; innovation governance must be mapped to local supervisory expectations. Review cadence After Wolfsberg update Last reviewed 2026-07-11 SRC-WOLF-008 Wolfsberg Principles for Auditing for Effectiveness Tier 2 Domain QA / internal audit / effectiveness Operational use Design and operating-effectiveness testing for financial-crime controls Role Senior→MLRO Type Industry best practice Edition / date 2024 Jurisdiction International / banking industry Authority tier Tier 2 — recognised industry practice Limitations Not binding law; should be mapped to regulatory, supervisory and internal-audit standards. Review cadence After Wolfsberg update Last reviewed 2026-07-11 Tier 2 — Recognised institutional and industry sources# SRC-ADB-001 ADB Debarment and Suspension Register Tier 1 Domain Procurement integrity Operational use ADB debarred, suspended and cross-debarred entities Role Analyst→MLRO Type Official debarment register Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Dynamic Last reviewed 2026-07-11 SRC-CH-001 Companies House API Tier 1 Domain UK corporate registry Operational use Live UK company information, officers, filings and company identifiers Role Analyst→Senior Type Official registry API Edition / date Living source / current edition Jurisdiction United Kingdom Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Dynamic Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-EBRD-001 EBRD Ineligible Entities Tier 1 Domain Procurement integrity Operational use Entities and individuals ineligible to become EBRD counterparties Role Analyst→MLRO Type Official ineligibility list Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Dynamic Last reviewed 2026-07-11 SRC-EU-001 EU Sanctions Map Tier 1 Domain EU sanctions Operational use EU sanctions regimes, measures and consolidated sanctions context Role Analyst→MLRO Type Official data portal Edition / date Living source / current edition Jurisdiction European Union Authority tier Tier 1 — official / primary source Limitations Confirm current status, identifiers, scope, effective date and applicable jurisdiction at the time of review. Review cadence Dynamic Last reviewed 2026-07-11 SRC-EU-AMLA-001 Regulation (EU) 2024/1620 — AMLA Regulation Tier 1 Domain EU AML authority and supervision Operational use AMLA mandate, direct/indirect supervision, convergence and technical-standard context Role Senior→MLRO Type Supranational legislation Edition / date 31 May 2024; OJ 19 June 2024 Jurisdiction European Union Authority tier Tier 1 — binding supranational law Limitations Institutional framework; verify current AMLA measures, supervisory scope and transition arrangements. Review cadence Monitor AMLA standards and implementation Last reviewed 2026-07-11 SRC-EU-AMLD6-001 Directive (EU) 2024/1640 — AMLD6 Tier 1 Domain EU national AML/CFT mechanisms Operational use FIU, supervision, registers, cooperation and national implementation overlay Role Senior→MLRO Type Supranational directive Edition / date 31 May 2024; OJ 19 June 2024 Jurisdiction European Union Authority tier Tier 1 — binding supranational law requiring transposition Limitations Requires national transposition; verify Member State law, dates and competent-authority guidance. Review cadence Monitor national transposition and amendments Last reviewed 2026-07-11 SRC-EU-AMLR-001 Regulation (EU) 2024/1624 — AMLR Tier 1 Domain EU AML/CFT rules for obliged entities Operational use EU CDD, EDD, beneficial ownership, internal controls, reporting and recordkeeping overlay Role Senior→MLRO Type Supranational legislation Edition / date 31 May 2024; OJ 19 June 2024 Jurisdiction European Union Authority tier Tier 1 — binding supranational law Limitations Verify legal scope, application date, delegated acts, consolidated text and national interaction. Review cadence Monitor amendments, delegated acts and application dates Last reviewed 2026-07-11 SRC-FATF-001 FATF Recommendations 2012-2026 Tier 1 Domain Global AML/CFT/CPF standard Operational use AML/CFT/CPF framework; RBA; CDD; BO; PEP; STR; internal controls; DNFBPs; VASPs Role Junior→MLRO Type Core standard Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Review at each FATF update Last reviewed 2026-07-11 SRC-FATF-002 FATF High-Risk and Increased Monitoring Lists Tier 1 Domain Dynamic geographic risk source Operational use Neutral geographic exposure trigger for EDD/countermeasure consideration; no country-specific legal interpretation Role Analyst→MLRO Type Dynamic risk source Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence After each FATF plenary Last reviewed 2026-07-11 SRC-FATF-003 FATF Virtual Assets Guidance Tier 1 Domain VASP / crypto AML Operational use Virtual assets, VASP controls, RBA and Travel Rule concept mapping Role Senior→MLRO Type Sector guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual / after FATF VA update Last reviewed 2026-07-11 SRC-FATF-004 FATF Beneficial Ownership Guidance - Legal Persons Tier 1 Domain Beneficial ownership Operational use Legal person misuse, adequate/accurate/up-to-date BO information and multi-pronged approach Role Analyst→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-005 FATF Beneficial Ownership Guidance - Legal Arrangements Tier 1 Domain Trusts / legal arrangements Operational use Settlor, trustee, protector, beneficiaries, control and cross-border trust structures Role Senior→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-006 FATF/Egmont TBML Risk Indicators Tier 1 Domain Trade-based money laundering Operational use Structural, trade activity, document/commodity and account/transaction indicators Role Senior→MLRO Type Typologies / red flags Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-007 FATF Proliferation Financing Risk Assessment Guidance Tier 1 Domain CPF / TFS evasion Operational use PF risk assessment and mitigation; TFS evasion indicators Role Senior→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-008 FATF Guidance for Legal Professionals RBA Tier 1 Domain Legal services / DNFBP Operational use Risk-based approach for legal professionals, client due diligence and sector risk Role Senior→MLRO Type Sector guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-009 FATF Methodology and Mutual Evaluations Tier 1 Domain Country risk / effectiveness Operational use Technical compliance and effectiveness assessment; mutual evaluation context Role Senior→MLRO Type Methodology Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Review at each FATF update Last reviewed 2026-07-11 SRC-FATF-010 FATF Money Laundering National Risk Assessment Guidance Tier 1 Domain National risk assessment Operational use Country and sector risk assessment concepts Role Senior→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual / after update Last reviewed 2026-07-11 SRC-FATF-011 FATF Risk-Based Approach for Banking Sector Tier 1 Domain Banking RBA Operational use Risk-based approach concepts for banking-sector controls Role Senior→MLRO Type Sector guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-012 FATF Money Laundering from Environmental Crime Tier 1 Domain Environmental crime Operational use Typologies for illegal logging, mining, land clearance, waste trafficking and related laundering risks Role Senior→MLRO Type Typologies Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-013 FATF/APG Financial Flows from Human Trafficking Tier 1 Domain Human trafficking Operational use Financial indicators and typology context for human trafficking-related proceeds Role Senior→MLRO Type Typologies Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-014 FATF Migrant Smuggling ML/TF Risks Tier 1 Domain Migrant smuggling Operational use Typology context for migrant smuggling proceeds and ML/TF risk Role Senior→MLRO Type Typologies Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 SRC-FATF-015 FATF Professional Money Laundering Tier 1 Domain Professional money laundering Operational use Typology context for professional laundering networks and facilitators Role Senior→MLRO Type Typologies Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-016 FATF Glossary Tier 1 Domain Terminology Operational use Core AML/CFT/CPF terms used across Recommendations and Methodology Role Foundation→MLRO Type Glossary Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Review at each FATF update Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-017 FATF Recommendation 10 - Customer Due Diligence Tier 1 Domain CDD / ongoing due diligence Operational use CDD scope, ongoing monitoring, customer profile refresh and relationship understanding Role Analyst→MLRO Type Core standard Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Review at each FATF update Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-018 FATF Recommendation 17 - Reliance on Third Parties Tier 1 Domain Third-party reliance Operational use Reliance / introducer / third-party evidence boundaries and responsibility mapping Role Senior→MLRO Type Core standard Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Review at each FATF update Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-019 FATF Recommendation 18 - Internal Controls Tier 1 Domain AML governance Operational use Internal controls, compliance function, training, group-wide AML programme concepts Role Senior→MLRO Type Core standard Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Review at each FATF update Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FATF-020 FATF Private Sector Information Sharing Guidance Tier 1 Domain Information sharing / privacy safeguards Operational use AML/CFT information-sharing concepts and safeguards for data movement and governance Role Senior→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction Global / FATF Authority tier Tier 1 — official / primary source Limitations Global standard/guidance; does not replace local law, regulator guidance or institution-specific policy. Review cadence Annual Last reviewed 2026-07-11 Used in: Digital Jurisdiction Exposure Layer
SRC-FFIEC-001 FFIEC BSA/AML Examination Manual Tier 1 Domain BSA/AML governance Operational use Practical governance, risk assessment and examination concepts Role Senior→MLRO Type Regulatory manual Edition / date Living source / current edition Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Annual / after update Last reviewed 2026-07-11 SRC-FINCEN-001 FinCEN SAR Narrative Guidance Package Tier 1 Domain SAR narrative quality Operational use Suspicious activity narrative quality and evidence concepts Role Analyst→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Annual Last reviewed 2026-07-11 SRC-FINCEN-ADVISORIES-001 FinCEN Alerts, Advisories, Notices, Bulletins and Fact Sheets Tier 1 Domain US FIU advisories / typologies Operational use Public typologies, red flags, monitoring context and SAR-quality examples Role Analyst→MLRO Type National FIU guidance Edition / date Living source Jurisdiction United States Authority tier Tier 1 — national FIU/regulatory source Limitations US-specific; not a universal filing rule, threshold, deadline or legal standard. Review cadence Dynamic / after FinCEN publication Last reviewed 2026-07-11 SRC-GLEIF-001 GLEIF API / LEI Data Tier 1 Domain Legal entity identifier Operational use LEI lookup, reference data, ownership data and fuzzy name/address matching Role Analyst→Senior Type Official LEI data Edition / date Living source / current edition Jurisdiction Global Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Dynamic Last reviewed 2026-07-11 SRC-OFAC-001 OFAC Sanctions List Search Tier 1 Domain US sanctions Operational use Fuzzy sanctions search and US list matching context Role Analyst→MLRO Type Official list/tool Edition / date Living source / current edition Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Confirm current status, identifiers, scope, effective date and applicable jurisdiction at the time of review. Review cadence Dynamic Last reviewed 2026-07-11 SRC-OFAC-002 OFAC Framework for Compliance Commitments Tier 1 Domain Sanctions compliance programme Operational use Risk assessment, internal controls, testing, training and sanctions compliance programme context Role Senior→MLRO Type Guidance Edition / date Living source / current edition Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Confirm current status, identifiers, scope, effective date and applicable jurisdiction at the time of review. Review cadence Annual / after OFAC update Last reviewed 2026-07-11 SRC-UK-001 UK Sanctions List Tier 1 Domain UK sanctions Operational use Current UK sanctions designations source Role Analyst→MLRO Type Official list Edition / date Living source / current edition Jurisdiction United Kingdom Authority tier Tier 1 — official / primary source Limitations Confirm current status, identifiers, scope, effective date and applicable jurisdiction at the time of review. Review cadence Dynamic Last reviewed 2026-07-11 SRC-UK-FCA-FCG-001 FCA Financial Crime Guide (FCG) Tier 1 Domain United Kingdom financial-crime systems and controls Operational use Use FCA examples of good and poor practice for governance, risk assessment, CDD, monitoring, sanctions and control effectiveness Role Senior→MLRO Type Regulatory guidance Edition / date Living FCA Handbook source Jurisdiction United Kingdom Authority tier Tier 1 — official regulatory guidance Limitations Guidance does not replace binding law or apply identically outside FCA-supervised firms; verify current Handbook status and sector scope. Review cadence Monitor FCA Handbook changes Last reviewed 2026-07-11 SRC-UK-MLR-001 Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 Tier 1 Domain United Kingdom preventive AML/CFT controls Operational use Map regulated-sector scope, risk assessment, CDD, EDD, policies, controls, training, recordkeeping and supervision Role Senior→MLRO Type United Kingdom legislation Edition / date 2017 Regulations / current consolidated status Jurisdiction United Kingdom Authority tier Tier 1 — binding national law Limitations Verify the current consolidated text, amendments, sector scope, territorial application and supervisor-specific guidance. Review cadence Monitor amendments and commencement dates Last reviewed 2026-07-11 SRC-UK-OFSI-GUIDANCE-001 OFSI UK Financial Sanctions General Guidance Tier 1 Domain United Kingdom financial sanctions Operational use Map UK financial-sanctions scope, asset-freeze concepts, ownership/control, reporting and licensing context Role Analyst→MLRO Type Official sanctions guidance Edition / date Living source / current edition Jurisdiction United Kingdom Authority tier Tier 1 — official / primary source Limitations Sanctions are a distinct legal regime. Verify the current UK Sanctions List, applicable regulations, licences, reporting duties and legal advice. Review cadence Dynamic / before sanctions decisions Last reviewed 2026-07-11 SRC-UK-POCA-001 Proceeds of Crime Act 2002 — Part 7 Money Laundering Tier 1 Domain United Kingdom money-laundering offences and disclosure regime Operational use Frame suspicion, regulated-sector disclosure duties, consent/DAML context and tipping-off boundaries Role Senior→MLRO Type United Kingdom primary legislation Edition / date 2002 Act / current consolidated status Jurisdiction United Kingdom Authority tier Tier 1 — binding national law Limitations Legal interpretation is fact-sensitive; verify current amendments, case law, statutory thresholds and professional legal advice. Review cadence Monitor legislative amendments Last reviewed 2026-07-11 SRC-UK-TACT-001 Terrorism Act 2000 — Part III Terrorist Property Tier 1 Domain United Kingdom counter-terrorist financing Operational use Map terrorist-property offences, regulated-sector disclosure and nominated-officer escalation context Role Senior→MLRO Type United Kingdom primary legislation Edition / date 2000 Act / current consolidated status Jurisdiction United Kingdom Authority tier Tier 1 — binding national law Limitations Verify current amendments, scope, definitions, applicable disclosure rules and specialist legal interpretation. Review cadence Monitor legislative amendments Last reviewed 2026-07-11 SRC-UK-UKFIU-SAR-001 UK Financial Intelligence Unit — Suspicious Activity Reports guidance Tier 1 Domain United Kingdom suspicious activity reporting Operational use Identify the UKFIU reporting context, current guidance and quality expectations for SAR submissions Role Analyst→MLRO Type National FIU guidance portal Edition / date Living source / current edition Jurisdiction United Kingdom Authority tier Tier 1 — official / primary source Limitations Use the current UKFIU guidance and portal instructions; do not generalise UK filing procedures, thresholds or terminology to other jurisdictions. Review cadence Before UK SAR procedure changes Last reviewed 2026-07-11 SRC-UN-001 UN Security Council Consolidated List Tier 1 Domain UN sanctions / TFS Operational use UN consolidated sanctions list in multiple official formats for neutral TFS screening baseline Role Analyst→MLRO Type Official list Edition / date Living source / current edition Jurisdiction Global / United Nations Authority tier Tier 1 — official / primary source Limitations Confirm current status, identifiers, scope, effective date and applicable jurisdiction at the time of review. Review cadence Daily/weekly screening source Last reviewed 2026-07-11 SRC-UNODC-UNCAC-AR-001 UNODC — UNCAC Chapter V: Asset Recovery Tier 1 Domain Corruption proceeds / asset recovery Operational use Institutional framework for tracing, freezing, preserving, confiscating and returning corruption proceeds Role Senior→MLRO Type UN convention / institutional guidance Edition / date Living institutional source Jurisdiction Global / UNCAC Authority tier Tier 1 — UN convention framework Limitations High-level framework; specific powers and procedures depend on applicable domestic and international law. Review cadence Annual review Last reviewed 2026-07-11 SRC-US-AMLA-001 Anti-Money Laundering Act of 2020 — FinCEN implementation page Tier 1 Domain United States AML reform Operational use Track AML Act implementation, priorities, beneficial-ownership reforms, information sharing and rulemaking status Role Senior→MLRO Type Official implementation source Edition / date AML Act 2020 / living implementation page Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations The Act is implemented through multiple rules and actions; do not treat an implementation page or pending workstream as a complete current obligation. Review cadence Monitor FinCEN implementation updates Last reviewed 2026-07-11 SRC-US-AMLPROG-NPRM-001 FinCEN 2026 proposed AML/CFT programme reform Tier 1 Domain United States proposed AML/CFT programme reform Operational use Separate proposed risk-based programme changes from rules currently in force Role Senior→MLRO Type Notice of proposed rulemaking summary Edition / date 7 April 2026 Jurisdiction United States Authority tier Tier 1 — official proposal / not final law Limitations Proposal only. Do not encode as a current obligation unless and until a final rule becomes effective. Review cadence Monitor rulemaking status Last reviewed 2026-07-11 SRC-US-BSA-001 Bank Secrecy Act — FinCEN statutory overview Tier 1 Domain United States AML/CFT statutory framework Operational use Identify the federal statutory basis for reporting, recordkeeping and AML/CFT obligations; route to the applicable regulation and institution type Role Senior→MLRO Type Official statutory overview Edition / date Living source / current edition Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Overview page; verify the controlling statute, regulation, institution scope, exemptions and current amendments. Review cadence Monitor statutory and FinCEN updates Last reviewed 2026-07-11 SRC-US-CDD-001 FinCEN Customer Due Diligence Final Rule Tier 1 Domain United States CDD and beneficial ownership Operational use Determine the CDD framework for covered financial institutions, including customer risk profile, monitoring and legal-entity beneficial-owner identification Role Analyst→MLRO Type Final rule and official guidance hub Edition / date Final rule / current guidance hub Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Applies to specified covered financial institutions and is subject to exclusions, exemptions, exceptive relief and later rulemaking. Verify current status before use. Review cadence Monitor FinCEN CDD updates Last reviewed 2026-07-11 SRC-US-CDD-RELIEF-001 FinCEN 2026 exceptive relief for CDD beneficial-owner collection Tier 1 Domain United States CDD current-status overlay Operational use Flag that the timing and circumstances for collecting and verifying legal-entity beneficial-owner information must be checked against current relief Role Senior→MLRO Type Official exceptive-relief order summary Edition / date 13 February 2026 Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations Narrow current-status measure; verify the underlying order, covered institutions, effective period and later rulemaking. Review cadence Before each US CDD implementation decision Last reviewed 2026-07-11 SRC-US-CFRX-001 31 CFR Chapter X — Financial Crimes Enforcement Network regulations Tier 1 Domain United States BSA regulations Operational use Locate current institution-specific AML programme, reporting, recordkeeping, CDD and information-sharing provisions Role Senior→MLRO Type Federal regulations / eCFR Edition / date Continuously updated eCFR Jurisdiction United States Authority tier Tier 1 — official / primary source Limitations eCFR is continuously updated but is not the official legal print edition; verify effective dates, Federal Register history and applicable part. Review cadence Dynamic / before legal reliance Last reviewed 2026-07-11 SRC-WB-001 World Bank Listing of Ineligible Firms and Individuals Tier 1 Domain Procurement integrity Operational use Debarred and ineligible firms/individuals for World Bank-financed contracts Role Analyst→MLRO Type Official debarment list Edition / date Living source / current edition Jurisdiction Source-specific / cross-border Authority tier Tier 1 — official / primary source Limitations Use within stated scope; verify currency, provenance, coverage and applicable legal context. Review cadence Dynamic Last reviewed 2026-07-11 Tier 1 — Official and primary sources# Internal practical controls#
AMLB-DIG-001 Digital Jurisdiction Exposure Layer Internal practical control
Internal practical control #
Domain Digital KYB / EDD
Operational use Public DNS and email infrastructure review as a supporting jurisdictional exposure indicator
Role Analyst→MLRO
Type Practical control
Edition / date Living source / current edition
Jurisdiction Internal / implementation-neutral
Authority tier Internal practical control
Limitations Internal practical control; not external legal or regulatory authority.
Review cadence Review annually
Last reviewed 2026-07-11
Used in: Digital Jurisdiction Exposure Layer.
Register maintenance rules#
Register the exact document, not only the organisation name.
Add the Source ID to every page where the source is materially used.
Verify URL, edition, date and limitations.
Do not promote an aggregator to official-source status.
Do not convert national guidance into a universal rule.
Regenerate the Used in field from actual page citations.
Additional FATF sector and typology sources#
SRC-FATF-021 FATF Risk-Based Approach Guidance for the Real Estate Sector Tier 1
Domain Real estate AML/CFT
Operational use Sector risk, beneficial ownership, SoW/SoF, intermediaries and risk-based controls for real-estate activity
Role Analyst→MLRO
Type Sector guidance
Edition / date July 2022
Jurisdiction Global / FATF
Authority tier Tier 1 — official / primary source
Limitations Global standard or guidance; verify applicable law, current edition, scope and institution-specific policy.
Review cadence Annual / after relevant FATF update
Last reviewed 2026-07-11
SRC-FATF-022 FATF Money Laundering and Terrorist Financing in the Art and Antiquities Market Tier 1
Domain Art and antiquities market
Operational use Risk indicators, intermediaries, provenance, ownership and value-transfer context for art and antiquities
Role Senior→MLRO
Type Methods and trends report
Edition / date February 2023
Jurisdiction Global / FATF
Authority tier Tier 1 — official / primary source
Limitations Global standard or guidance; verify applicable law, current edition, scope and institution-specific policy.
Review cadence Annual / after relevant FATF update
Last reviewed 2026-07-11
SRC-FATF-023 FATF Complex Proliferation Financing and Sanctions Evasion Schemes Tier 1
Domain Proliferation financing and sanctions evasion
Operational use Defensive indicators and risk-assessment context for PF-related sanctions evasion, procurement, ownership and payment networks
Role Senior→MLRO
Type Methods and trends report
Edition / date June 2025
Jurisdiction Global / FATF
Authority tier Tier 1 — official / primary source
Limitations Global standard or guidance; verify applicable law, current edition, scope and institution-specific policy.
Review cadence Annual / after relevant FATF update
Last reviewed 2026-07-11
SRC-FATF-024 FATF 2025 Targeted Update on Virtual Assets and VASPs Tier 1
Domain Virtual assets and VASPs
Operational use Current implementation, Travel Rule and risk context for virtual assets, VASPs and cross-border service exposure
Role Senior→MLRO
Type Targeted implementation update
Edition / date June 2025
Jurisdiction Global / FATF
Authority tier Tier 1 — official / primary source
Limitations Global standard or guidance; verify applicable law, current edition, scope and institution-specific policy.
Review cadence Annual / after relevant FATF update
Last reviewed 2026-07-11
← Previous Research Desk Next → Open Source Limitations and Evidence Weight