# FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation: The FATF Recommendations (consolidated text updated October 2025)

Source: https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations
Last updated: Oct 15, 2026

The FATF Recommendations are the global AML/CFT standard that national regimes (the US Bank Secrecy Act, the EU anti-money-laundering framework, the UK Money Laundering Regulations) implement; adopted by the FATF Plenary on 15 February 2012, the consolidated text is marked 'Updated October 2025'. Four Recommendations carry the weight for AI and data: Recommendation 1 (the risk-based approach, revised in February 2025 to stress proportionality and simplified measures where risk is lower), Recommendation 10 (customer due diligence, including ongoing scrutiny of transactions), Recommendation 15 (new technologies: identify and assess the risks of new or developing technologies before launch and mitigate them) and Recommendation 20 (report suspicions promptly to the financial intelligence unit). None of them mentions artificial intelligence; Recommendation 15 is the hook the FATF itself uses for AI.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) |
| Type | Framework |
| Status | In force |
| Published | Feb 15, 2012 |
| Applies to | FATF member jurisdictions and the FATF Global Network, which implement the Recommendations in national law; financial institutions, virtual asset service providers and designated non-financial businesses through that national law |
| Official text | https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html |

## Key points

- Recommendation 1: countries should apply a risk-based approach so that AML/CFT measures are 'proportionate to the risks identified', and should require financial institutions to 'identify, assess and take effective and risk-based action to mitigate' their money laundering, terrorist financing and proliferation financing risks; where risks are lower, countries 'should allow and encourage simplified measures as appropriate'.
- Recommendation 10: customer due diligence is required when establishing business relations, for occasional transactions above USD/EUR 15,000, on suspicion of money laundering or terrorist financing, or on doubts about earlier identification data; the measures are (a) identify the customer and verify identity 'using reliable, independent source documents, data or information', (b) identify and verify the beneficial owner, (c) understand the purpose and intended nature of the relationship and (d) conduct ongoing due diligence and scrutiny of transactions, with the extent of each measure set by a risk-based approach.
- Recommendation 15: countries and financial institutions should identify and assess the risks of new products, new business practices and delivery mechanisms, and of 'the use of new or developing technologies for both new and pre-existing products'; for financial institutions 'such a risk assessment should take place prior to the launch', followed by appropriate mitigation. The same Recommendation brings virtual asset service providers into AML/CFT regulation.
- Recommendation 20: if a financial institution 'suspects or has reasonable grounds to suspect that funds are the proceeds of a criminal activity, or are related to terrorist financing, it should be required, by law, to report promptly its suspicions to the financial intelligence unit' — the obligation that AI alert triage and SAR drafting serve.
- The February 2025 Plenary revised Recommendation 1, its interpretive note and the interpretive notes to Recommendations 10 and 15 'to increase focus on proportionality of measures and require countries to allow and encourage simplified measures in lower risk areas'; the amendments table on the FATF page records every change since 2013.
- The Recommendations are technology-neutral: the 2020 digital identity guidance, the 2021 new-technologies report and the December 2025 horizon scan on AI and deepfakes all present themselves as applications of Recommendations 1, 10 and 15, not as changes to them.

## What changed for banks

The October 2025 consolidation carries the February 2025 proportionality revisions to Recommendation 1 and the interpretive notes to Recommendations 10 and 15, which give national supervisors explicit room to allow simplified, technology-assisted measures where risk is lower. For a bank's AI programme the practical change is small — the obligations have been risk-based since 2012 — but the Recommendations are the text every national AML rule on machine-learning monitoring, digital onboarding and suspicious-activity reporting traces back to.

## Use cases it governs

- [AML / KYC](https://www.bankingnewsai.com/ai-regulation/by-use-case#aml-kyc)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)

## Which FATF Recommendations apply to AI and data in AML/CFT?

Four Recommendations frame every AI deployment in an AML/CFT programme. Recommendation 1 requires that measures be proportionate to assessed risk and, since February 2025, that lower-risk areas get simplified measures. Recommendation 10 defines customer due diligence — verification from 'reliable, independent' sources, beneficial ownership, purpose of the relationship and ongoing scrutiny of transactions — the elements digital onboarding and transaction monitoring automate. Recommendation 15 requires a risk assessment of 'new or developing technologies' before launch. Recommendation 20 requires prompt reporting of suspicions to the financial intelligence unit. None names AI; all four are implemented through national law.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Recommendation 1 — assessing risks and applying a risk-based approach | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Countries apply a risk-based approach so measures are 'proportionate to the risks identified' and require financial institutions to 'identify, assess and take effective and risk-based action' to mitigate ML, TF and proliferation financing risks; lower risks should get simplified measures (revised February 2025). | In force (consolidated text updated October 2025) | [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) |
| Recommendation 10(a) — identification and verification | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Identify the customer and verify identity 'using reliable, independent source documents, data or information' — the standard the 2020 digital identity guidance applies to digital ID and biometric onboarding. | In force | [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) |
| Recommendation 10(d) — ongoing due diligence | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Conduct ongoing due diligence and 'scrutiny of transactions undertaken throughout the course of that relationship' so that transactions are consistent with the institution's knowledge of the customer, their business and risk profile — the obligation AI transaction monitoring serves. | In force | [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) |
| Recommendation 15 — new technologies | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Identify and assess the ML/TF risks of 'the use of new or developing technologies for both new and pre-existing products'; for financial institutions the assessment 'should take place prior to the launch', with appropriate measures to manage and mitigate the risks. | In force (interpretive note revised February 2025) | [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) |
| Recommendation 20 — reporting of suspicious transactions | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | An institution that 'suspects or has reasonable grounds to suspect' that funds are criminal proceeds or linked to terrorist financing must be required by law to report promptly to the FIU. | In force | [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) |

The Recommendations do not prescribe how due diligence or monitoring is done, so a machine-learning monitoring model, an agent that triages alerts or a language model that drafts SAR narratives is permissible under the Standards as long as the institution has assessed its risks before launch (R.15), applies it proportionately (R.1), still meets each element of R.10 and still reports promptly (R.20). The FATF's 2021 new-technologies report and 2025 horizon scan are the places where the FATF says what that assessment should cover.

### What this means in practice

- Treat the pre-launch risk assessment under Recommendation 15 as the global root of the model-risk and third-party reviews national supervisors expect for AI AML tools.
- Map each AI control to the R.10 element it serves — verification (a), beneficial ownership (b), purpose (c), ongoing scrutiny (d) — so the programme can show the obligation is still met when the tool replaces a manual step.
- Keep the R.20 clock in view: an AI triage layer must not delay a report once suspicion exists.

## FAQ

### Do the FATF Recommendations mention artificial intelligence?

No. The consolidated text updated in October 2025 does not use the term. The FATF treats AI through Recommendation 15 (new technologies), which requires countries and financial institutions to assess the risks of 'new or developing technologies' before launch, and through the risk-based approach of Recommendation 1.

### Which FATF Recommendation covers AI in AML?

Recommendation 15 is the one the FATF itself cites: its December 2025 horizon scan says the FATF 'has adopted a broad and inclusive approach to New Technologies (FATF Recommendation 15) requiring reporting entities to identify and assess risks associated with emerging products'. Recommendations 10 (customer due diligence) and 20 (suspicious transaction reporting) define the obligations that AI-based KYC, monitoring and SAR tools help meet.

### Are the FATF Recommendations binding on banks?

Not directly. They bind FATF members politically and are enforced through mutual evaluations; banks are bound by the national laws that implement them — the Bank Secrecy Act and FinCEN rules in the US, the EU AML regulation and directives, the UK Money Laundering Regulations.

## Related documents

- [FATF horizon scan on AI and deepfakes (2025)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-horizon-scan-ai-deepfakes-2025) — Horizon Scan: Artificial Intelligence and Deepfakes — Impacts on Money Laundering, Terrorist Financing and Proliferation Financing (Dec 22, 2025)
- [FATF new technologies for AML/CFT report (2021)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-new-technologies-aml-cft-2021) — Opportunities and Challenges of New Technologies for AML/CFT (Jul 1, 2021)
- [FATF data pooling and collaborative analytics stocktake (2021)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-data-pooling-collaborative-analytics-2021) — Stocktake on Data Pooling, Collaborative Analytics and Data Protection (Jul 1, 2021)
- [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) — Guidance on Digital Identity (Mar 6, 2020)
- [FIN-2026-Alert005 (Digital Asset Investment Scam Centers)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2026-scam-centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (Sep 3, 2026)
- [FIN-2026-Alert004 (Federal Student Aid Fraud)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2026-federal-student-aid-fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026)
- [Hill House oversight testimony (Jun 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-oversight-prudential-regulators-2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026)
- [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Revised Guidance on Model Risk Management (Apr 17, 2026)

Last reviewed Oct 15, 2026. Cite the official text (https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (42 authorities, 243 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.