FATF Standards, Implemented in Practice
The Financial Action Task Force sets the global benchmark every national regulator builds on. One Constellation maps to the FATF 40 Recommendations, the Travel Rule for virtual assets, and the high-risk-jurisdiction list — so satisfying your local supervisor satisfies the global standard.
The Global Standard-Setter for AML and CFT
The Financial Action Task Force (FATF) is the inter-governmental body that sets the global standards for combating money laundering, terrorist financing, and proliferation financing. It does not regulate financial institutions directly — that is the role of national supervisors — but its 40 Recommendations form the framework that every major regulator translates into local rules.
FATF assesses each member jurisdiction through Mutual Evaluations, scoring how well the country's laws and supervisory practices implement each Recommendation. Poor scores produce remediation plans; sustained underperformance places a country on the FATF grey list, while serious deficiencies trigger black-list status. Both designations have direct commercial consequences for institutions doing business with those jurisdictions.
For financial institutions, FATF matters in three practical ways: the Recommendations shape every domestic AML rule, FATF guidance defines best practice on emerging issues like virtual assets and beneficial ownership, and the list designations feed customer and transaction risk: the FATF calls for enhanced due diligence on black-listed jurisdictions, while grey-listing is a risk factor firms weigh in their own assessments.
The 40 Recommendations and Their Practical Reach
The Recommendations cluster into seven thematic groups. Below are the ones that bite hardest at the operational level — and that One Constellation addresses directly.
Risk-Based Approach
The cornerstone — every institution must identify, assess, and mitigate its money-laundering and terrorist-financing risks. Higher risk requires enhanced measures; lower risk permits simplified ones.
Customer Due Diligence & PEPs
Identify and verify customers, identify beneficial owners, and apply enhanced measures to foreign politically exposed persons — and, where the risk is higher, to domestic and international-organisation PEPs.
The Travel Rule
Originator and beneficiary information must travel with funds transfers above the de-minimis threshold. Applied since June 2019 to virtual-asset transfers between VASPs, and revised in June 2025.
Reporting of Suspicious Transactions
Promptly report suspicions of money laundering or terrorist financing to the country's Financial Intelligence Unit, with full investigative context.
Virtual Assets & VASPs
Virtual-asset service providers must be licensed or registered, supervised for AML/CFT compliance, and subject to the same CDD, monitoring, and reporting obligations as traditional financial institutions.
High-Risk Countries
Apply enhanced due diligence, proportionate to the risks, to relationships and transactions with persons from countries for which the FATF calls for it — the call-for-action (“black”) list. Grey-list status is a risk factor, not an automatic EDD trigger.
From Recommendation to Operational Reality
FATF Recommendations land on the institution as concrete operational requirements. Here is how the most consequential ones translate into day-to-day controls.
Risk-Based Methodology (R.1)
Document the institution's ML/TF risk assessment, calibrate controls to the assessed risk, and review the assessment regularly.
Customer Due Diligence (R.10)
Identify the customer and verify the identity using reliable, independent sources. For corporates, identify and verify the beneficial owner.
PEP Screening (R.12)
Identify whether a customer or beneficial owner is a domestic, foreign, or international-organisation PEP, and apply enhanced measures including senior-management approval.
Travel Rule for Wires & VASPs (R.16)
Pass originator and beneficiary information with every funds transfer above the threshold. For virtual-asset transfers between VASPs, the same rule applies.
Ongoing Monitoring & Reporting (R.20)
Monitor transactions throughout the relationship and report any suspicion to the relevant FIU promptly, with the investigative basis fully documented.
VASP Compliance (R.15)
Virtual-asset service providers must register, implement CDD and monitoring on a par with banks, and apply the Travel Rule to inter-VASP transfers.
High-Risk Jurisdiction Handling (R.19)
Apply enhanced due diligence where the FATF calls for it, and treat grey-listed and other higher-risk jurisdictions as risk factors in customer and transaction risk assessment.
The Commercial Cost of Grey- and Black-Listing
FATF doesn't fine institutions directly. But its public lists drive every other regulator's response — and the commercial consequences are immediate.
What FATF-Aligned Compliance Looks Like
Common Questions
Recommendations in Practice
The Recommendations are written as standards for countries, not as instructions for firms. These guides translate the ones with the most direct operational consequence.
The FATF Grey List — which jurisdictions are under increased monitoring, what listing changes for firms with exposure to them, and how country risk should feed customer risk.
Recommendation 16: the Travel Rule — originator and beneficiary information for virtual asset transfers, the sunrise problem, and the messaging protocols in production.
Recommendation 12: PEPs and RCAs — the three PEP categories, why R12 mandates enhanced measures for foreign PEPs but permits a risk-sensitive approach for domestic ones, and where national regimes go further.
These map onto sanctions screening, PEP screening, customer risk assessment and transaction monitoring.
FATF-Aligned by Design, Localised by Configuration
See how the 40 Recommendations translate into rule libraries, monitoring scenarios, and exportable evidence — calibrated to whichever national supervisor regulates your firm.
