FATF sets no law itself, yet almost every AML/CFT regime on earth derives from its 40 Recommendations. Mutual evaluations grade countries; the grey and black lists carry real economic weight; the travel rule extends it all to crypto.
The Financial Action Task Force (FATF) is the inter-governmental body that sets the global standards for combating money laundering, terrorist financing and proliferation financing. Founded by the G7 in 1989, it does not pass laws — it issues standards, and countries implement them. Its influence is enormous precisely because failing to meet them carries real cost.
Almost every national AML/CFT regime in the world — including South Africa's FIC framework — is built to satisfy FATF. So while FATF is not a regulator you report to directly, it is upstream of nearly every regulator you do report to. Understanding FATF is understanding why your compliance rules look the way they do.
The global AML/CFT standard — CDD, beneficial ownership, STRs, supervision, targeted financial sanctions and more.
FATF grades both whether the laws exist and whether they actually work in practice. The second is harder to pass.
Peer reviews by FATF or regional bodies (e.g. MENAFATF) that grade a country against the standards.
Grey = increased monitoring with an action plan. Black = call for action. Both carry real economic and correspondent-banking cost.
FATF's standards are the 40 Recommendations — covering customer due diligence, beneficial ownership, suspicious-transaction reporting, supervision, sanctions and more. Compliance is assessed two ways: technical compliance (are the laws in place?) and effectiveness (do they actually work?). The assessment happens through Mutual Evaluation Reports (MERs), conducted by FATF or its regional bodies (such as MENAFATF for the Middle East and North Africa).
Where a country falls short, FATF can name it publicly. The grey list — officially "Jurisdictions under Increased Monitoring" — flags countries with strategic deficiencies that are working through an agreed action plan. The black list — "High-Risk Jurisdictions subject to a Call for Action" — is reserved for the most serious cases. Listing is not symbolic: it raises correspondent-banking friction, due-diligence costs and capital flow risk for the named country.
Grey and black lists are revised at FATF plenaries (roughly three a year). Never quote a listing without checking the current FATF page.
Many jurisdictions have legislation but uneven enforcement; cross-border VASP transfers can hit a counterparty with no compliant rail.
Passing laws is the easy half. FATF's effectiveness assessment is where many regimes — and follow-up processes — actually stall.
FATF extended its standards to crypto through Recommendation 15 and the "travel rule": virtual-asset service providers (VASPs) must collect and transmit originator and beneficiary information with transfers, just as banks do for wire payments. Implementation has spread — by FATF's 2025 survey, well over 80 jurisdictions had passed travel-rule legislation — but coverage and enforcement remain uneven globally, which is itself a risk for cross-border crypto flows.
On country context, a note for accuracy: Saudi Arabia is a full FATF member and, per the February 2026 plenary, is not on the grey list — it has been in an enhanced follow-up process since its 2018 mutual evaluation. (By contrast, the UAE was grey-listed in 2022 and removed in 2024.) Country statuses change at each plenary, so always check the live FATF list rather than relying on a remembered figure.
If you run compliance at a regulated institution, FATF is the source code your national rulebook compiled from. When a regulator tightens beneficial-ownership rules or expands STR obligations, it is usually responding to FATF pressure or a looming mutual evaluation. Reading FATF directly — especially MER findings for your markets — tells you what local rules are coming before they arrive.
If you operate cross-border or in crypto, country listing status is a live input to your risk model. A counterparty in a grey-listed jurisdiction means heavier due diligence, slower correspondent banking, sometimes de-risking entirely. For VASPs, travel-rule coverage on both ends of a corridor determines whether a compliant transfer is even possible.
The honest framing: FATF is not optional and not negotiable, but it is also not a fixed target. Standards evolve (crypto, beneficial ownership, proliferation financing are all moving), and country statuses shift every plenary. Treat FATF as a feed to monitor, not a document you read once — and verify any country claim against the current list before you act on it.