What we doAdvisory & ConsultancyFinancial Crime & FATF Readiness
Effectiveness you can evidence, not only rules you can cite.
Under the FATF’s 2022 Methodology, a mutual evaluation asks two questions: whether laws and regulations meet the technical requirements of the 40 Recommendations, and whether the system actually works — judged across 11 immediate outcomes, with greater emphasis on the major risks and context. The fifth round began in 2024. Banks are where much of that effectiveness becomes visible: in the risk assessment, the alerts reviewed, the reports filed and the decisions recorded. A policy library is not evidence of effectiveness. A trail of risk-based decisions is.
Where this begins
Three conversations this practice usually starts with.
The policies are complete; the evidence is not
The AML/CFT manual maps to every Recommendation and the last internal audit closed its findings. But asked how the enterprise-wide risk assessment changed a control, why alerts did or did not become suspicious transaction reports, or how sanctions screening was calibrated, the bank produces documents rather than evidence of outcomes.
The evaluation is on the horizon and the supervisor is asking
A mutual evaluation is approaching and the supervisor has begun asking institutions what they can demonstrate. The board wants to know where the bank stands before the questions become formal — which gaps are real, which are presentational, and which are the bank’s to close.
Monitoring that alerts on everything and finds little
Transaction monitoring scenarios and screening thresholds were set when the systems went live and have rarely been revisited. Alert volumes swamp investigators, false positives dominate, and nobody can say whether the rules reflect the risks the enterprise-wide assessment actually identified.
What we deliver
Every control tied to a risk, every decision traceable.
A financial crime engagement leaves the institution able to explain its AML/CFT and sanctions framework from risk to outcome: the framework reviewed, the risk assessment sound, the evidence of effectiveness organised, the monitoring and screening configuration justified, and the people who must answer questions prepared. The deliverables are working documents, prepared with your compliance, operations and audit teams.
AML/CFT and sanctions framework review
Governance, policies, procedures and the three lines of defence reviewed against the FATF Recommendations and international best practice — including the role and resourcing of the money laundering reporting officer, board oversight and the quality of financial crime reporting to senior management.
Enterprise-wide risk assessment
The methodology reviewed or redesigned: inherent risk by customer, product, channel and geography; the strength of the controls against each; residual risk; and the link from results to risk appetite, resourcing and control changes — so the assessment drives decisions rather than sitting in a file.
The effectiveness evidence pack
The evidence an institution would put forward to show its preventive measures work in practice — risk-based decisions, customer due diligence outcomes, the quality of suspicious transaction reporting, sanctions alerts and the action taken, and the management information the board sees — organised and gap-tested against the effectiveness focus of the FATF Methodology.
Transaction monitoring and screening tuning review
Scenarios, thresholds, customer segmentation, list management and name-matching settings reviewed against the risk assessment and alert outcomes, with each recommended change documented with its rationale so that the calibration can be explained to an examiner.
Training needs analysis
Training needs mapped by role — board, senior management, front line, operations, investigators and the compliance team — against the risks the assessment identified, with the annual refresher and specialist programmes sequenced accordingly.
Senior management and board readiness
Briefings for the people who may have to explain the framework to a supervisor or assessor: what the bank’s risks are, how its controls answer them and what evidence shows it — prepared honestly, gaps included.
How the engagement runs
Assess. Evidence. Remediate. Brief.
Assess
Framework, risk assessment, monitoring and screening reviewed against the FATF Recommendations and the effectiveness focus of the Methodology — delivered in weeks, with the gaps ranked by risk.
Evidence
The decisions, outcomes and management information that show effectiveness gathered and organised, and the places where evidence is missing named plainly.
Remediate
The risk assessment, policies, monitoring calibration and training plan revised with your teams, each change documented with its reasoning.
Brief
Senior management and the board prepared to explain the framework from risk to outcome — then ownership handed over.
Perimeter and fee are fixed at the diagnostic. No adviser can promise an evaluation outcome; the engagement is scoped to a defined end: evidence that is organised, honest and ready.
Questions we are asked
Before the first conversation.
What is a FATF mutual evaluation?
It is a peer review of a country’s measures against money laundering, terrorist financing and the financing of proliferation. Under the FATF’s 2022 Methodology it looks at technical compliance — whether laws, regulations and other instruments meet the requirements of the 40 FATF Recommendations — and at effectiveness, judged across 11 immediate outcomes. The resulting report identifies the priority actions the country should take.
What is different about the current round?
The FATF amended its methodology in 2022 and began its fifth round of evaluations under it in 2024; FATF-Style Regional Bodies move to it progressively as they complete their previous round. The round runs on a six-year cycle, significantly shorter than earlier rounds, and places greater emphasis on the major risks and context, so assessors concentrate where risk is highest. The methodology continues to be updated, most recently in June 2026.
Why does a mutual evaluation matter to an individual bank?
Because effectiveness is demonstrated largely through what regulated institutions actually do: the risks they identify, the customers they understand, the activity they report and the decisions they record. A bank whose framework can be evidenced from risk to outcome is better placed with its supervisor whatever the timetable. The engagement prepares the institution’s evidence; it does not and cannot promise any evaluation result.
How is this different from an AML audit?
An audit tests whether controls operate as documented. Effectiveness readiness asks a wider question: whether the controls address the risks the bank actually faces and produce outcomes it can show. We work alongside internal audit and the compliance function, and do not replace either.
Do you change monitoring and screening systems directly?
The tuning review assesses scenarios, thresholds and screening configuration and documents each recommended change with its rationale; the institution’s technology team or vendor applies the changes under its own change control. Where detection models need to move into production, the Smart IT practice can support that work under the same governance.
Background reading on this subject
Written by the practitioners who lead the programme — read before you enquire.
The Capability Arc™
This practice is one point on the arc.
Most financial crime clients pair the engagement with the programmes that build the internal bench — the FATF readiness masterclass, an in-house Annual AML, Sanctions & KYC Refresher, the AML & CTF Business Case Study, and AI, Big Data and ML in Combating Financial Crime — because effectiveness is shown by the people who run the controls every day.
Learn it · Training
FATF Mutual Evaluation Readiness: Effectiveness in Practice
Two days on the 2022 Methodology, the immediate outcomes and the evidence of effectiveness — for MLROs, compliance, financial crime, audit and risk teams.
Fix it · Advisory
Risk Appetite & Enterprise Risk Governance
When financial-crime risk has to sit inside the board’s risk appetite, with limits, indicators and named owners.
Automate it · Smart IT
AI Build & Deployment
When detection models for monitoring or screening need to move from proof of concept into production with governance, monitoring and an owner.
The ask
Ask for a confidential FATF readiness review.
A senior practitioner reads your enterprise-wide risk assessment, your AML/CFT and sanctions framework and the management information your board receives — and tells you, in a private working session, where the evidence of effectiveness is strong, where it is thin, and what would need to be in place before an assessor asks.
Confidential by default; under NDA on request. A senior practitioner replies within two working days.
Financial Crime & FATF Readiness
Leave the question with us.
Two lines on the mandate is enough — a senior practitioner replies within one business day.