Category: International Bodies and Standards
FATF Methodology
Also known as: Methodology for Assessing Compliance with the FATF Recommendations and the Effectiveness of AML/CFT Systems
Simply put
The FATF Methodology is the framework the Financial Action Task Force (FATF) uses to evaluate how well a country follows international standards for fighting money laundering and terrorist financing. It looks at two things: whether a country's laws and rules match the FATF Recommendations, and whether its systems actually work in practice. FATF applies this Methodology when it conducts country reviews known as mutual evaluations.
Formal definition
The FATF Methodology is the assessment instrument used to evaluate a jurisdiction's compliance with the FATF Recommendations (the 2012 FATF Standards) and the effectiveness of its AML/CFT system during mutual evaluations and follow-up monitoring. It assesses two distinct dimensions: technical compliance, meaning the extent to which a country's legal and institutional framework is consistent with the FATF Recommendations, and effectiveness, measured against a set of immediate outcomes that an effective framework should achieve to protect the financial system from abuse. The Methodology underpins FATF's mutual evaluation process and is applied together with the applicable FATF procedures for a given evaluation round; specific versions (such as the 2013 and 2022 Methodologies) and procedural details should be confirmed against the current FATF documents applicable to the relevant evaluation round.
Why it matters
The FATF Methodology matters because it is the yardstick against which a jurisdiction's entire AML/CFT regime is measured during a mutual evaluation. Its results carry significant weight: a country's ratings on technical compliance and effectiveness shape its international reputation, influence how other jurisdictions and financial institutions perceive its risk profile, and can inform whether it becomes subject to increased FATF monitoring. Because the Methodology separates whether laws are written correctly (technical compliance) from whether the system actually works in practice (effectiveness), it discourages jurisdictions from treating formal legal transposition as sufficient and pushes them toward demonstrable outcomes.
Who it's relevant to
National AML/CFT policymakers and legislators
Government officials responsible for designing and enacting a jurisdiction's AML/CFT framework use the Methodology to understand how their laws and institutions will be assessed against the FATF Recommendations, and to identify gaps in both technical compliance and effectiveness ahead of a mutual evaluation.
Financial intelligence units and supervisory authorities
FIUs, supervisors, and other competent authorities are directly examined under the effectiveness dimension, since the immediate outcomes concern how well the system works in practice. Understanding the Methodology helps these bodies demonstrate that their supervision, information sharing, and enforcement produce the outcomes FATF expects.
Compliance officers and MLROs at obliged entities
While the Methodology assesses jurisdictions rather than individual firms, its effectiveness focus often shapes how national supervisors evaluate the AML/CFT programs of the entities they oversee. Compliance professionals benefit from understanding how their jurisdiction may be assessed, as evaluation outcomes can influence supervisory priorities and expectations.
Assessors and mutual evaluation teams
The individuals conducting mutual evaluations and follow-up monitoring rely on the Methodology as their core assessment instrument, applying it alongside the FATF procedures for the relevant evaluation round to reach ratings on technical compliance and effectiveness.
Risk and correspondent banking teams
Professionals assessing country risk, including those managing correspondent banking relationships, may consider a jurisdiction's mutual evaluation results, which are produced through the Methodology, as one input among many when evaluating the AML/CFT risk associated with a country.
Inside FATF Methodology
Technical Compliance Assessment
One of the two core components of the FATF Methodology, this evaluates whether a country has enacted the necessary laws, regulations, and institutional frameworks to give effect to the FATF Recommendations. It focuses on the existence and legal adequacy of measures rather than their real-world results, and is assessed on a scale ranging from compliant to non-compliant.
Effectiveness Assessment
The second core component, introduced to move beyond a purely legal 'tick-box' review, this examines whether a country's AML/CFT system produces the intended outcomes in practice. It is organized around a set of Immediate Outcomes, each rated by the degree to which the desired result is being achieved.
Immediate Outcomes
The outcome-based benchmarks used within the effectiveness assessment, addressing operational results such as risk understanding, supervision, preventive measures by obliged entities, investigation and prosecution, confiscation, and international cooperation. They frame effectiveness in terms of what a system actually accomplishes rather than what it formally provides for.
Mutual Evaluation Reports (MERs)
The published outputs of assessments conducted under the Methodology, prepared through peer review by assessors from other jurisdictions or FATF-style regional bodies. MERs document ratings for technical compliance and effectiveness and typically include recommended actions for the assessed country.
Link to the FATF Recommendations
The Methodology operationalizes the FATF Recommendations, which are international standards rather than binding law. It provides the criteria assessors apply, but the Recommendations themselves must be transposed into each jurisdiction's domestic legal framework to take effect.
Common questions
Answers to the questions practitioners most commonly ask about FATF Methodology.
Is the FATF Methodology itself a set of binding legal requirements that countries must follow?
No. The FATF Methodology is an assessment tool used to evaluate how well a country implements the FATF Recommendations, which are international standards rather than binding law. Obligations become legally enforceable only when a jurisdiction transposes them into its own domestic legal and regulatory framework. The Methodology guides assessors; it does not by itself impose duties on obliged entities.
Does the FATF Methodology assess only whether a country has passed the right laws?
No. The Methodology distinguishes between two dimensions: technical compliance, which examines whether the necessary laws, regulations, and institutional frameworks are in place, and effectiveness, which examines whether those measures actually produce the intended outcomes in practice. A country can have strong laws on paper yet score poorly on effectiveness if implementation, supervision, or outcomes fall short. Both dimensions are evaluated, and they are rated separately.
How should a compliance team use the FATF Methodology when preparing for a mutual evaluation of its jurisdiction?
Compliance teams generally use the Methodology to understand the criteria assessors will apply, particularly the Immediate Outcomes tied to effectiveness. Teams may map their AML program's controls, data, and case examples against the relevant outcomes to help demonstrate that measures work in practice, not just on paper. Exact expectations vary by jurisdiction and by the national authorities coordinating the evaluation, so scope and requirements should be confirmed with the relevant supervisor or coordinating body.
Which parts of the FATF Methodology are most relevant to an individual obliged entity rather than to national authorities?
Many components of the Methodology address country-level systems, such as legislation, national risk assessment, and inter-agency coordination, which fall outside a single firm's direct control. However, the effectiveness assessments touching on preventive measures, supervision, and reporting can be informed by data from obliged entities. Firms are typically most affected indirectly, through the domestic rules and supervisory expectations that a jurisdiction adopts or strengthens in response to evaluation findings.
How does the technical compliance rating differ from the effectiveness rating in practice?
Technical compliance ratings assess the extent to which the legal and institutional framework meets the criteria for each Recommendation, typically using a graded scale from non-compliant to compliant. Effectiveness ratings assess the degree to which defined outcomes are being achieved, generally using a scale from low to high level of effectiveness. A jurisdiction may rate well on one dimension and poorly on the other, and both should be read together rather than treated as a single overall score.
What should a firm do if its jurisdiction receives a poor effectiveness rating in a mutual evaluation?
A poor effectiveness rating often prompts national authorities to strengthen laws, supervision, or enforcement, which can translate into new or heightened expectations for obliged entities. Firms may respond by monitoring published evaluation reports and follow-up processes, anticipating changes to domestic requirements, and reviewing whether their own controls address the weaknesses identified. Because responses are driven by domestic action rather than by FATF directly, firms should confirm specific implications with their relevant supervisor.
Common misconceptions
A high technical compliance rating means a country's AML/CFT system is working well.
Technical compliance measures only whether the required laws and structures exist, not whether they deliver results in practice. The FATF Methodology deliberately separates technical compliance from effectiveness precisely because a jurisdiction can have strong laws on paper yet weak outcomes, which is why both dimensions are assessed.
The FATF Methodology and the FATF Recommendations are the same thing, and both are legally binding.
The Recommendations are the standards, while the Methodology is the framework used to assess how well a country meets them. Neither is binding law; the Recommendations are international standards that generally take legal effect only once transposed into a jurisdiction's own legislation and regulations.
A poor rating in a Mutual Evaluation Report is itself a penalty or a finding of wrongdoing.
An MER is a peer-review assessment of a country's system and its outcomes, not a sanction or a determination of criminal conduct. It identifies deficiencies and recommended actions, and any consequences that follow are separate processes rather than a direct feature of the rating itself.
Best practices
Read both the technical compliance and effectiveness sections of a relevant Mutual Evaluation Report together, since a strong rating in one dimension does not imply strength in the other.
Map your program's controls against the applicable Immediate Outcomes to focus on whether measures achieve results, rather than treating the existence of a policy as sufficient.
Treat the FATF Recommendations as standards that must be checked against your specific jurisdiction's transposed laws and regulations, because obligations take legal effect domestically and can diverge between regimes.
Use MER findings and recommended actions as inputs to risk assessments and remediation planning, while recognizing they describe country-level systems rather than any individual entity's compliance.
Confirm any specific ratings, thresholds, or requirements against the current version of the Methodology and the relevant regulation, as terminology and criteria are periodically revised.
Distinguish clearly in internal reporting between what the Methodology assesses (system design versus operational outcomes) so stakeholders do not conflate legal adequacy with real-world effectiveness.