How a FATF mutual evaluation works under the 2022 Methodology — technical compliance with the 40 Recommendations, effectiveness across 11 Immediate Outcomes, the rating scales — and what assessors look for from banks under Immediate Outcome 3: risk understanding, customer due diligence, suspicious transaction reporting and internal controls.
In short
- A FATF mutual evaluation assesses two things: technical compliance with the 40 FATF Recommendations, and effectiveness across 11 Immediate Outcomes.
- Each Immediate Outcome is rated at a high, substantial, moderate or low level of effectiveness, judged in the context of the risks the jurisdiction faces.
- For banks the central test is Immediate Outcome 3: do financial institutions understand their risks, apply preventive measures adequately and report suspicious transactions?
- Assessors form their view from evidence and interviews, including with the private sector, so a bank’s ability to explain and demonstrate its controls matters as much as the controls themselves.
On this page
When a jurisdiction prepares for a FATF mutual evaluation, the work is often led by the government, the financial intelligence unit and the supervisors. Banks can be forgiven for thinking it is someone else’s exam. It is not. A large part of the judgement assessors reach about effectiveness rests on what financial institutions actually do, and on what they can show when assessors ask.
The FATF assesses its members through peer reviews: experts from other jurisdictions examine a jurisdiction’s system against the FATF Methodology. The current Methodology was adopted in February 2022 and has been amended since, most recently in June 2026.
The FATF began its fifth round of evaluations under it in 2024, and the FATF-Style Regional Bodies move to it as they complete their previous rounds. The FATF describes the new round as a six-year cycle, significantly shorter than earlier rounds.
Technical compliance and effectiveness#
Every evaluation looks at two distinct areas. Technical compliance asks whether the jurisdiction has the laws, regulations and other legal instruments required by the 40 FATF Recommendations. Each Recommendation receives one of four ratings: compliant, largely compliant, partially compliant or non-compliant.
Effectiveness asks a harder question: are those laws and policies being used, and do they work, in the context of the risks the jurisdiction is exposed to? The assessment team looks at 11 key areas, the Immediate Outcomes, and rates each one at a high, substantial, moderate or low level of effectiveness.
A high rating means the outcome is achieved to a very large extent with minor improvements needed; a low rating means it is not achieved, or only to a negligible extent.
A jurisdiction can have every law the Recommendations require and still be rated low on effectiveness, because effectiveness is judged on results.
Immediate Outcome 3: where banks are assessed#
Several Immediate Outcomes touch banks: the national understanding of risk, the use of financial intelligence, and the transparency of legal persons and arrangements among them. The one written about them directly is Immediate Outcome 3.
It is achieved when supervisors appropriately supervise, monitor and regulate financial institutions for compliance with anti-money laundering and counter-terrorist financing requirements, and financial institutions adequately apply preventive measures and report suspicious transactions, with actions proportionate to the risks.
The core issues assessors consider for financial institutions under this outcome include:
- How well institutions understand the level and nature of their money laundering and terrorist financing risks, and how that understanding evolves over time.
- How well they apply customer due diligence and record-keeping, including beneficial ownership information and ongoing monitoring.
- How well they apply enhanced or specific measures, for example for politically exposed persons, correspondent banking, new technologies and wire transfers.
- How well they meet their reporting obligations, and the practical measures that prevent tipping off.
- Whether internal controls, procedures and audit, including at group level, ensure compliance.
The same outcome also asks how well supervisors monitor compliance, and whether their supervision, outreach, remedial actions and sanctions have had a demonstrable positive impact on compliance by financial institutions over time. That links the two halves of the outcome.
Supervisory findings about banks, the follow-up to inspections and the way institutions responded all become evidence of effectiveness, so an inspection a bank treated as routine years earlier can reappear in the assessment. Immediate Outcome 3 relates primarily to the Recommendations on preventive measures and supervision, which is why technical gaps in those Recommendations and weak practice in banks tend to show up together.
Get the FATF Mutual Evaluation Readiness: Effectiveness in Practice brochure
Outline, format and dates — a course advisor sends it within one business day.
Request the brochureHow assessors reach a view#
The Methodology is explicit that assessors are not expected to conduct an in-depth review of financial institutions’ operations. They form their view on the basis of evidence and interviews with supervisors, the financial intelligence unit and other authorities, as well as the private sector.
In practice that means selected institutions may meet the assessment team, and the supervisor’s own findings, data on reporting and examples of cases all feed the conclusion. A bank that can explain its risk assessment clearly, and show how it shapes due diligence and monitoring, supports the jurisdiction’s case; a bank that recites its policy manual does not.
Where banks go wrong#
- An enterprise risk assessment that is generic, out of date or disconnected from the national risk assessment and the bank’s own customer base.
- Customer due diligence that is complete on paper but thin on beneficial ownership and on the purpose of the relationship.
- Suspicious transaction reports filed defensively in volume, or rarely, with little evidence of quality or of feedback being used.
- Group-wide policies that are not applied consistently in branches and subsidiaries.
- Senior management and front-line staff who cannot explain the bank’s main risks in their own words.
What good preparation looks like#
- Refresh the institution-wide risk assessment against the latest national risk assessment and supervisory findings.
- Test due diligence and monitoring files for the highest-risk segments, not just a random sample.
- Review suspicious transaction reporting for quality, timeliness and use of feedback from the financial intelligence unit.
- Confirm that group policies are applied in every branch and subsidiary, with evidence.
- Prepare senior management and key staff to explain, with examples, how risk understanding drives the controls.
FATF Mutual Evaluation Readiness: Effectiveness in Practice gives compliance, risk and senior management teams two days on the Methodology and on how institutions demonstrate effectiveness. The AML & CTF Business Case Study works through money laundering typologies from the bank’s side, and the Annual AML, Sanctions & KYC Refresher keeps the wider staff population current.
Frequently asked
What is a FATF mutual evaluation?
A mutual evaluation is a peer review in which experts from other jurisdictions assess a jurisdiction’s measures against money laundering, terrorist financing and proliferation financing, using the FATF Methodology. The report sets out the system’s strengths and weaknesses and the priority actions to strengthen it.
How many Immediate Outcomes are there in the FATF Methodology?
There are 11 Immediate Outcomes. Each is rated at a high, substantial, moderate or low level of effectiveness. Technical compliance is assessed separately against the 40 FATF Recommendations, each rated compliant, largely compliant, partially compliant or non-compliant.
Which Immediate Outcome covers banks?
Immediate Outcome 3 covers the supervision of financial institutions and whether they adequately apply preventive measures and report suspicious transactions. Banks also contribute evidence to other outcomes, such as the use of financial intelligence and the transparency of legal persons and arrangements.
Do FATF assessors meet banks during the on-site visit?
The Methodology says assessors form their view on the basis of evidence and interviews with supervisors, the financial intelligence unit and other authorities, as well as the private sector. They are not expected to review institutions’ operations in depth, so the interviews and the evidence institutions can provide carry real weight.
The programme behind this article
Work through this material with the practitioners who wrote it.
FATF Mutual Evaluation Readiness: Effectiveness in Practice
FATF mutual evaluation training for MLROs, AML/CFT compliance, financial crime, internal audit and risk teams — the 2022 FATF Methodology, the immediate outcomes and the effectiveness assessment, with evidence tested against peer benchmarks and case studies.
View the programme →AML & CTF Business Case Study
Anti-money laundering and counter-terrorist financing through the case study of a major scandal — CDD, sanctions monitoring and the MLRO role in practical terms.
View the programme →Annual AML, Sanctions & KYC Refresher
Annual AML refresher training run in-house for one institution — anti-money laundering, sanctions screening and KYC red flags taught through role-based examples for front, middle and back office, so every colleague knows what to spot and how to escalate it.
View the programme →