FATF Recommendations: all 40 by group and how they are rated

A bank or fintech cannot be "FATF compliant" in the strict sense, although questionnaires use the phrase often. The FATF Recommendations are addressed to countries. Each country writes them into its own laws and supervisory rules, and your firm complies with those rules. FATF then assesses the country, not the firm, in a peer review called a mutual evaluation.

So a Recommendation reaches a compliance team only after a national rule says so, and the wording differs from country to country, as the KYC requirements by country show. The same frame sits behind the money laundering methods and typologies that monitoring teams already watch for.

What are the FATF Recommendations?

The FATF Recommendations are the international standard against money laundering, terrorist financing and the financing of weapons proliferation. The Financial Action Task Force (FATF), established in 1989 and based in Paris, writes them. Its own page says "more than 200 countries and jurisdictions have committed to implement the FATF's Standards".

FATF's Recommendations page sets the scope: "The FATF Standards comprise the Recommendations themselves and their Interpretive Notes, together with the applicable definitions in the Glossary." An Interpretive Note explains how a Recommendation works, and many thresholds live there. In the Glossary, "without delay" means "ideally, within a matter of hours of a designation".

Guidance is a separate layer: FATF's introduction says it is "not mandatory for assessing compliance with the Standards", and the examples inside Interpretive Notes "are not mandatory elements of the FATF Standards". On 24 June 2026, for example, FATF opened a public consultation on guidance for Recommendation 16, with responses due by 21 August 2026. The rules were already in the Recommendation; the guidance explains how to apply them.

The Forty Recommendations were drawn up in 1990 against the laundering of drug money and revised in 1996. In October 2001 FATF took on terrorist financing with "the Eight (later expanded to Nine) Special Recommendations". The 2003 revision, together with the Special Recommendations, was "endorsed by over 180 countries", and in 2008 the mandate grew to proliferation financing. The February 2012 revision folded the terrorist financing measures into the 40, "obviating the need for the Special Recommendations". The current text was "Last updated in June 2026."

How are the 40 FATF Recommendations grouped?

Table 1. The 40 FATF Recommendations by group. Group names as in FATF's list of the Recommendations, updated June 2026. The last column is the author's reading for a compliance team.

Group D holds 15 of the 40 Recommendations, and most of them set duties that a bank, a payment institution or a DNFBP carries out itself. A compliance team spends its day here. Banks meet those duties through their own sector rules, which the AML in the banking industry whitepaper reviews. The other groups reach a firm through its supervisor, the national risk assessment or a request passed on by the FIU.

In group C, FATF's introduction calls Recommendations 5, 6 and 8 "unique to terrorist financing"; most other terrorist financing measures run through the rest of the 40. The terrorist financing guide covers Recommendations 5 to 8 in detail.

FATF's list also gives each Recommendation its 2003 number. Today's Recommendation 5 was Special Recommendation II, and Recommendation 16 was Special Recommendation VII. An asterisk marks a Recommendation with an Interpretive Note, "which should be read in conjunction with the Recommendation".

Which FATF Recommendations apply directly to banks, fintechs and DNFBPs?

DNFBPs are designated non financial businesses and professions: casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, accountants, and trust and company service providers. These eight items reach your firm most directly.

1. Recommendation 1, the risk based approach. Countries must require firms to identify, assess and act on their own money laundering, terrorist financing and proliferation financing risks. Since February 2025 the text also says "Where countries identify lower risks, they should allow and encourage simplified measures as appropriate." Why: the depth of every other control follows from the risk based approach.
2. Recommendation 10, customer due diligence. Due diligence applies when a firm opens a business relationship, carries out an occasional transaction above "USD/EUR 15,000" or a transfer covered by the Interpretive Note to Recommendation 16, suspects money laundering or terrorist financing, or doubts identification data it already holds. The measures cover (a) the customer, (b) the beneficial owner, including the ownership and control structure when the customer is a company or a trust, (c) the purpose of the relationship and (d) ongoing due diligence, including scrutiny of transactions. For virtual asset service providers (VASPs) the occasional transaction threshold is USD/EUR 1,000. Why: point (b) is where KYB and UBO verification starts, and point (d) is where transaction monitoring comes from.
3. Recommendation 12, politically exposed persons. For a foreign PEP, firms need systems to identify the PEP, senior management approval, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. For a domestic PEP or a person with a prominent function at an international organization, the last three measures apply when the relationship is higher risk. The requirements for every type of PEP also cover family members and close associates. Why: only the foreign PEP measures are fixed; the rest follow the firm's PEP screening and risk assessment. A single name can be run through the free PEP check.
4. Recommendations 6 and 7, targeted financial sanctions (TFS). Countries freeze, without delay, the funds or other assets of persons and entities the UN Security Council designates for terrorism and for proliferation, and of persons a country designates under resolution 1373. Firms carry out the freeze. Why: the Glossary's "within a matter of hours" puts a clock on how fast screening lists refresh. You can test one name with the free sanctions check from Complead, formerly Sanction Scanner.
5. Recommendation 16, payment transparency. Payment messages carry "required and accurate originator information, and required beneficiary information", and institutions monitor for messages that lack it. Why: it was rewritten in June 2025, and the next section covers what changed.
6. Recommendation 19, higher risk countries. Firms apply enhanced due diligence to business relationships and transactions with persons from countries "for which this is called for by the FATF", and countries apply countermeasures when FATF calls for them. Why: the FATF lists feed straight into country risk scores.
7. Recommendation 20, suspicious transaction reporting. A firm that suspects, or has reasonable grounds to suspect, that funds are the proceeds of crime or related to terrorist financing reports "promptly" to the FIU. Why: national law sets the actual deadline, as the SAR and STR filing guide shows.
8. Recommendations 22 and 23, DNFBPs. They extend due diligence, record keeping, PEP checks, internal controls and suspicious transaction reporting to DNFBPs in set situations, such as a real estate agent involved in buying or selling property for a client. Why: the duty follows the transaction, not the type of license.

What changed in the FATF Recommendations in 2025 and 2026?

FATF records every amendment in Annex II of the Recommendations PDF. Four since February 2025 reach a compliance team.

1. February 2025, Recommendation 1. FATF revised Recommendation 1, the Interpretive Notes to Recommendations 1, 10 and 15, the Introduction and the Glossary "to increase focus on proportionality of measures and require countries to allow and encourage simplified measures in lower risk areas". The Plenary outcomes tie the change to financial inclusion: "around 1.4 billion people around the world still do not have a bank account".
2. June 2025, Recommendation 16. Recommendation 16 and its Interpretive Note were rewritten "to adapt the Standards to the changes in payment business models and messaging standards". Its title is now payment transparency. Türkiye's ratings on FATF's site, assessed before the change, still list it as wire transfers.
3. October 2025, Recommendations 7 and 16. After the UN Security Council measures on Iran were reapplied, the Interpretive Note to Recommendation 7 lists resolutions 1737, 1747, 1803 and 1929 for Iran. A factual clarification went into paragraph 31 of the Interpretive Note to Recommendation 16, on when a receiving institution executes, rejects or suspends a payment that lacks required information.
4. June 2026, Recommendation 6. The Interpretive Note now requires countries to comply with the humanitarian exemption in Security Council resolutions 2664 (2022) and 2761 (2024), as well as resolution 2615 (2021), when they implement UN asset freezes (FATF, 23 June 2026).

Earlier changes are still recent: virtual assets in Recommendation 15 (October 2018), beneficial ownership of legal persons in Recommendation 24 (March 2022) and of legal arrangements in Recommendation 25 (February 2023), nonprofit organizations in Recommendation 8 (October 2023), and asset recovery in Recommendations 4, 30, 31 and 38 (October 2023). FATF adds each new change to Annex II, and the free AML News Radar follows rule changes like these as they publish, pinned to the jurisdictions they touch.

What does the new Recommendation 16 on payment transparency require?

Recommendation 16 asks countries to make sure payment messages carry "required and accurate originator information, and required beneficiary information", in a form "structured to the extent possible". Paragraph 4 of the Interpretive Note names ISO 20022 as an example of the standard to follow.

FATF's 18 June 2025 release spells out what changes in practice. Peer to peer cross border payments above USD/EUR 1,000 carry standardized information: name, address and date of birth. The payment chain now starts at the institution that receives the customer's instruction, which matters if you run a fintech that sits in front of a bank; the AML in the fintech industry whitepaper covers the wider rules such firms work under. Institutions must use tools against fraud and error, "such as verification of recipients' banking information". Card purchases of goods and services stay exempt from the full requirements. And "The changes will come into effect by the end of 2030."

For cross border payments above the de minimis threshold, paragraph 30 of the Interpretive Note asks the beneficiary institution to take at least one of three measures: (a) a check, for each transaction, of how far the beneficiary name and account number in the message align with its own records; (b) holistic ongoing monitoring that picks up misaligned beneficiary information; or (c) a pre validation mechanism "such as confirmation/verification of payee", where both institutions take part in one. Alignment "does not imply that there must be an exact match" (footnote 62). In October 2025 FATF added Annex IV to its Methodology, setting out how assessors will rate the revised text; the Methodology marks those revisions "not yet in effect".

Picture a payment institution whose customer sends 1,800 euros from an app to a relative's account abroad. The figures are illustrative. Under the revised Recommendation 16 the payment institution received the instruction, so it starts the payment chain and sends name, address and date of birth in structured fields. The receiving bank checks that the beneficiary name aligns with the account. A message without the address becomes a missing information case for monitoring.

Transfers of virtual assets follow their own version of the rule through Recommendation 15, covered in the FATF travel rule guide. How each market licenses and supervises those providers is compared in cryptocurrency regulations by country.

How does FATF assess a country against the Recommendations?

Table 2. FATF rating scales. Source: FATF Methodology (2022, as amended in June 2026), paragraphs 42 and 72. Quotation marks show FATF's own wording.

A mutual evaluation rates a country twice. Technical compliance asks whether the laws and powers are in place, with one rating for each of the 40 Recommendations. Effectiveness asks whether the system works in practice, with one rating for each of 11 Immediate Outcomes. They run from risk, policy and coordination (IO.1) and international cooperation (IO.2) through supervision and preventive measures, rated separately for financial institutions and VASPs (IO.3) and for DNFBPs (IO.4), to proliferation financing (IO.11). The Methodology is plain about scope: "Assessors must assess all eleven of the Immediate Outcomes".

FATF style regional bodies (FSRBs), such as MENAFATF, use the same Methodology for their own assessments, as do the IMF and the World Bank. FATF began its fifth round under the 2022 Methodology in 2024, on a six year cycle against 10 years on average for earlier rounds. FSRBs move to it once they complete their previous round, so the 2013 Methodology still applies to some countries.

Türkiye's 2026 report shows the two scales side by side. FATF adopted it at the June 2026 Plenary and published it on 23 September 2026; it describes the system as at the end of the on site visit on 28 November 2025 (FATF country page). On technical compliance Türkiye has 15 C, 23 LC and 2 PC ratings, the two PCs on Recommendations 7 and 8, and no NC. On effectiveness it is substantial on IO.1, IO.2 and IO.6 (financial intelligence) and moderate on the other eight. The report page summarizes the findings, and the country page gives the result: Türkiye is placed in enhanced follow up.

How does a mutual evaluation lead to the FATF grey list?

Türkiye's record shows the full cycle. Its previous evaluation was adopted at the October 2019 Plenary. On 21 October 2021 FATF's increased monitoring statement read "the FATF now also identifies Jordan, Mali, and Turkey". At the Plenary of 26 to 28 June 2024 FATF "congratulated Jamaica and Türkiye" on completing their action plans and leaving the list. The 2026 evaluation placed it in enhanced follow up, not back under review. The AML in Türkiye whitepaper covers the national framework behind those results.

The rules for each step are in FATF's Procedures for mutual evaluations, follow up and the ICRG (2022), last updated in June 2026.

Regular follow up is the default. The country reports back "ten Plenary cycles (approximately 3 years) after the adoption" of its report (paragraph 129).

Enhanced follow up applies if any one of these is true (paragraph 154):

1. 5 or more PC ratings.
2. 1 or more NC ratings.
3. A PC on any of Recommendations 3, 5, 6, 10, 11 and 20.
4. A moderate rating on 6 or more of the 11 Immediate Outcomes.
5. A low rating on 1 or more Immediate Outcomes.

Türkiye's 8 moderate ratings meet the fourth test on their own. Its 2 PCs sit outside the six named in the third test, and it has no NC and no low rating, so none of the referral tests below applies.

Referral to the ICRG. The International Cooperation Review Group (ICRG) runs the review that can end in public listing. The Plenary refers a country to it for observation if any one of these is true (paragraph 159):

1. "15 or more NC/PC ratings for technical compliance".
2. An NC or PC on 3 or more of Recommendations 3, 5, 6, 10, 11 and 20.
3. A low or moderate rating on 9 or more of the 11 Immediate Outcomes, "with a minimum of 2 low level ratings".
4. A low rating on 6 or more Immediate Outcomes.

Paragraph 164 prioritizes for active review an FATF member, a World Bank high income country, or one with broad money above USD 10 billion. A country under active review then has an observation period of "generally 12 months", or two years for a least developed country, to work on its key recommended actions. Once its revised roadmap is adopted, FATF identifies it publicly as under review (paragraph 183), and it appears among the Jurisdictions under Increased Monitoring.

FATF's statement of 19 June 2026 says "This list is often externally referred to as the 'grey list'", and adds: "The FATF does not call for the application of enhanced due diligence measures to be applied to these jurisdictions". It also warns against derisking whole classes of customers. The High Risk Jurisdictions subject to a Call for Action, "often externally referred to as the 'black list'", named the DPRK, Iran and Myanmar on the same day. For those, FATF calls for enhanced due diligence and, in the most serious cases, countermeasures: the Recommendation 19 duty from the checklist above.

At the June 2026 Plenary, Bosnia and Herzegovina and Iraq were added to increased monitoring, and Algeria and Namibia were removed. The public lists are updated at each Plenary as necessary (paragraph 186). The high risk countries and FATF lists page tracks the current names, and the free AML country risk index puts FATF status beside other country risk indicators.

What do the FATF Recommendations mean for a compliance program?

Table 3. From Recommendation to control. Source: the FATF Recommendations, updated June 2026. The last two columns are the author's reading for a compliance team.

An examiner asks whether your firm meets the national rule, not Recommendation 10 itself. The table lets a policy cite both.

Two rows carry most of the volume. Screening covers Recommendations 6, 7 and 12, and it runs on every list update as well as at onboarding. Monitoring covers point (d) of Recommendation 10, the missing information checks of Recommendation 16 and the suspicion that leads to a Recommendation 20 report. The guide to AML transaction monitoring covers the program, and the transaction monitoring rules library has geography rules to start from.

In Complead, screening and monitoring sit on the same engine as onboarding, fraud and investigation, which gives a customer a single risk score across all five.

Volume is the test for the screening row. At Moldcell, a Complead customer with 1.5 million users, about 100,000 transactions passed through screening and about 10,000 needed a person to review them (the Moldcell case).

What should a compliance team check this week?

1. The country risk model. Compare it with FATF's 19 June 2026 lists and with each country's latest mutual evaluation result.
2. Outgoing payment messages. List where cross border messages miss the name, address or date of birth that the revised Recommendation 16 asks for by the end of 2030.
3. List refresh timing. Confirm that screening picks up a new UN designation within hours, the Glossary's meaning of "without delay".