FATF standards in 2024: proposed revisions and new AML/CFT obligations for banks

FATF in 2024: consultation, not new rules

The FATF's two main standard-setting projects for banks in 2024 were still at the proposal stage in November. When FinCEN published its investment adviser final rule on 4 September 2024, it cited the FATF Recommendations in the version "Updated November 2023". The FATF's own outcomes statement of 23 February 2024 refers to amendments to Recommendation 8 on non-profit organisations agreed at its October 2023 plenary, and records that the February plenary finalised matching changes to its assessment methodology. FinCEN describes the FATF as assessing over 200 jurisdictions against these minimum standards. Changes to the text therefore pass to banks only once national rules take them up.

Recommendation 16: the payment message

According to the US Treasury, the FATF plenary that ended on 23 February 2024 began a public consultation on potential changes to Recommendation 16 on wire transfers and approved new guidance on trusts. The FATF's outcomes statement said the plenary agreed to consult on a range of options for changes to Recommendation 16 and its Interpretive Note, to adapt the standards to changes in payment systems' business models and messaging standards and keep them technology-neutral. It linked the work to the rapid development of cross-border payment systems and to changes in industry standards, in particular ISO 20022. The Financial Stability Board (FSB) reported that the consultation on draft revisions ran from February to May 2024. According to the FSB, the FATF then agreed that, given the complexity of the requirements and their potential impact on payment systems, it needed further dialogue with public and private sector experts before finalising the amendments. The FSB said the revisions are planned for adoption in mid-2025, after another round of public consultation in early 2025.

The FSB described the aim as helping to make cross-border payments faster, cheaper, more transparent and more inclusive while keeping effective AML/CFT controls and technology-neutral standards. The FSB also said it had worked with the FATF to include the legal entity identifier (LEI) as an identifier for both originator and beneficiary in the revised Recommendation 16 published for consultation. For banks, Recommendation 16 is the rule that decides what originator and beneficiary data travel with a payment and what the receiving bank must check. A revision tied to structured messaging and identifiers such as the LEI would mostly be an operations and data project, not a policy one.

Recommendation 1: risk-based approach and financial inclusion

According to the Hong Kong Monetary Authority (HKMA), on 28 October 2024 the FATF issued a public consultation on AML/CFT and financial inclusion, proposing changes to Recommendation 1 on assessing risk and applying a risk-based approach. The HKMA told authorised institutions that the FATF expects to finalise the revisions and supporting guidance in 2025. The US Treasury said the policy objective is to encourage countries to understand areas of lower risk as well as higher risk and, where appropriate, to apply simplified due diligence, promoting a more inclusive financial system with adequate safeguards. The FSB noted that the FATF is also updating its guidance on financial inclusion. A standard that rewards documented lower-risk treatment could change how banks allocate compliance resources and reduce the pressure to exit whole customer segments.

Methodology, guidance and the next assessment round

The FSB noted that the FATF published updated guidance on transparency and beneficial ownership of legal arrangements in March 2024. The US Treasury reported that at the plenary that ended on 28 June 2024 the FATF adopted revisions to its methodology for assessing the standards on asset recovery. It also agreed, the Treasury said, to publish a targeted update on virtual assets, after discussing limited progress on global implementation of its standards in that area. According to the Treasury, the October 2024 plenary adopted the mutual evaluation reports of Argentina and Oman, the final reviews of the fourth round. The Treasury said FATF members are preparing for the fifth round, and that assessors are expected to conduct an onsite evaluation of the US regime in early 2026. A new round of country assessments puts pressure on national authorities to show results, and that pressure usually reaches banks through supervision and enforcement.

The 2024 grey list and what banks must do with it

FinCEN's notices show that the FATF changed its list of Jurisdictions Under Increased Monitoring at each of its three plenaries in 2024. On 23 February it added Kenya and Namibia and removed Barbados, Gibraltar, Uganda and the United Arab Emirates. On 28 June it added Monaco and Venezuela and removed Jamaica and Türkiye. On 25 October it added Algeria, Angola, Côte d'Ivoire and Lebanon and removed Senegal. That gives eight additions against seven removals over the year.

Changes to the FATF list of Jurisdictions Under Increased Monitoring, 2024

Source: Financial Crimes Enforcement Network (US Treasury), Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Deficiencies (February 2024), 29 February 2024; Financial Crimes Enforcement Network (US Treasury), Financial Action Task Force Identifies Jurisdictions with AML/CFT/CPF Deficiencies (July 2024), 3 July 2024; Financial Crimes Enforcement Network (US Treasury), Financial Action Task Force Identifies Jurisdictions with AML/CFT/CPF Deficiencies (October 2024), 30 October 2024.

FinCEN reported in October that the call-for-action list did not change: Iran and the Democratic People's Republic of Korea (DPRK) remain subject to countermeasures, and Burma (Myanmar) to enhanced due diligence. According to the US Treasury, in June the FATF stressed the need to implement targeted financial sanctions against the DPRK robustly and to end any correspondent relationships with DPRK banks. FinCEN's February notice reported the FATF's statement that the suspension of the Russian Federation's membership continues to stand, and its warning of risks from Russia's growing financial connectivity with the DPRK and Iran, as well as proliferation financing, malicious cyber activity and ransomware. In October the US Treasury reported that the FATF is working to help governments and the private sector evaluate the risks of financing weapons of mass destruction and better combat sanctions evasion. For banks with trade finance and correspondent books, these statements point to proliferation financing and sanctions evasion as the risks on which supervisors will expect the most evidence. Listing has direct operational effects. FinCEN said US financial institutions should consider the FATF's stance toward the listed jurisdictions when reviewing their obligations and their risk-based policies, procedures and practices. With respect to jurisdictions under increased monitoring, FinCEN reminded US covered institutions of their due diligence obligations for foreign financial institutions under 31 CFR 1010.610(a), which cover correspondent accounts. It also said that, for delisted jurisdictions, institutions should take into account the FATF's decisions and the reasons behind them when assessing risk. The HKMA told authorised institutions to continue applying enhanced due diligence, proportionate to the risks, to relationships and transactions with persons from Myanmar. It said it would in future send updates on FATF statements to institutions by email for more timely communication. For correspondent banks, the practical task is to refresh country risk ratings after each plenary and not to treat delisting as an automatic downgrade of risk.

European Union: a single rulebook and a new supervisor

For banks operating in the EU, the legislative package adopted in 2024 rewrites the AML/CFT rulebook. Regulation (EU) 2024/1624, the AML Regulation, is dated 31 May 2024 and was published in the Official Journal on 19 June 2024 together with Directive (EU) 2024/1640 and Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). The AML Regulation is binding in its entirety and directly applicable in all Member States, so its core obligations will not depend on national transposition.

What changes for banks

The AML Regulation applies from 10 July 2027. Obliged entities must apply customer due diligence to occasional transactions of at least EUR 10,000. Credit and financial institutions must also apply it to occasional transfers of funds of at least EUR 1,000. For occasional cash transactions of at least EUR 3,000, obliged entities must at least identify the customer and verify the customer's identity. Customer information must be updated at intervals of no more than one year for higher-risk customers subject to enhanced measures and no more than five years for all other customers.

Beneficial ownership through an ownership interest means direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest. The Regulation caps cash payments for goods or services at EUR 10,000. By 10 July 2027 AMLA must issue guidelines on how credit institutions and others establish whether a customer holds total assets of at least EUR 50 million. The compliance manager must report to the management body at least once a year on the implementation of internal policies, procedures and controls.

Sanctions and transposition

Member States must transpose the sixth AML Directive by 10 July 2027, with earlier deadlines for some articles in 2025 and 2026 and a later one, 10 July 2029, for Article 18. For credit and financial institutions, maximum pecuniary sanctions for legal persons must be at least EUR 10 million or 10% of total annual turnover, whichever is higher. For natural persons the floor is at least EUR 5 million.

AMLA

AMLA has its seat in Frankfurt am Main. Its founding regulation applies from 1 July 2025, with some articles applying from 26 June 2024, and direct supervision of selected obliged entities is to begin in 2028. AMLA will directly supervise financial-sector entities with a high risk profile that operate in at least six Member States. The recitals say AMLA should have the resources to supervise up to 40 groups and entities at the same time, at least during the first selection. Where more than 40 entities qualify, AMLA may, in consultation with national supervisors, agree to limit the selection to a specific number greater than 40. It must start the first selection by 1 July 2027 and conclude it within six months. It begins direct supervision six months after publishing the list of selected entities. For cross-border groups, the risk profile reported to national supervisors in the coming years will decide whether they move under a single EU supervisor.

Payments and sanctions screening

Other EU rules reach banks sooner. Under Regulation (EU) 2024/886 on instant payments, published on 19 March 2024, payment service providers offering instant credit transfers must check whether their users are subject to EU targeted financial restrictive measures at least once every calendar day and immediately after new or amended measures enter into force. They must not screen payer and payee against those measures during the execution of each instant transfer, and must comply by 9 January 2025. Euro-area providers must offer verification of the payee by 9 October 2025. The Transfer of Funds Regulation (EU) 2023/1113 applies from 30 December 2024. On 14 November 2024 the European Banking Authority (EBA) published two sets of final guidelines that, for the first time, set common EU standards for the controls firms need to comply with restrictive measures; both sets apply from 30 December 2025. For instant payments, these rules move sanctions compliance from screening each payment towards screening the customer base, backed by explicit governance expectations.

United States: programme reform and the TD resolution

The proposed programme rule

On 3 July 2024 FinCEN proposed a rule requiring financial institutions to establish, implement and maintain effective, risk-based and reasonably designed AML/CFT programmes, including a mandatory risk assessment process. Institutions would also have to review the government-wide AML/CFT Priorities, published on 30 June 2021, and incorporate them as appropriate. The proposal sets six programme components: a risk assessment process; internal policies, procedures and controls; a qualified AML/CFT officer; ongoing employee training; periodic independent testing; and other components depending on the type of institution. It would restate the statutory requirement that the duty to establish, maintain and enforce the programme must rest with persons in the United States who are accessible to, and subject to oversight and supervision by, the Treasury Secretary and the appropriate federal functional regulator.

Comments were due by 3 September 2024. FinCEN proposed an effective date six months after the final rule is issued. It estimated the total annual burden at about $545m to $918m in a year when substantive programme updating is necessary, and $478m to $851m in a year of more modest updates. FinCEN noted that, because beneficial ownership reporting regulations took effect on 1 January 2024, its customer due diligence rule must be revised by 1 January 2025. In practice, the risk assessment becomes the document examiners will test first.

Perimeter extensions

FinCEN also widened the perimeter around banks. A final rule published on 4 September 2024 brings certain investment advisers into the Bank Secrecy Act definition of financial institution, with programme and suspicious activity reporting duties, effective 1 January 2026. A residential real estate rule published on 29 August 2024 requires reports on certain non-financed transfers of residential property to legal entities and trusts from 1 December 2025.

TD: the enforcement benchmark

On 10 October 2024 FinCEN assessed a $1.3bn penalty against TD Bank, N.A. and TD Bank USA, N.A., which it described as the largest against a depository institution in US Treasury and FinCEN history. FinCEN found that TD Bank allowed trillions of dollars in transactions each year to go unmonitored for potentially suspicious activity. It also found that the bank wilfully failed to file suspicious activity reports on thousands of transactions totalling about $1.5bn. Among other failures, its processing of peer-to-peer transactions, including transactions indicative of human trafficking, was insufficient. The bank also let significant backlogs of potentially suspicious activity build up, depriving law enforcement of information. FinCEN imposed a four-year independent monitorship and, for the first time, accountability and data governance reviews.

The Office of the Comptroller of the Currency (OCC) issued a cease and desist order, a $450m civil money penalty and a restriction on the bank's growth. It listed deficiencies across internal controls, risk assessments, customer due diligence, customer risk ratings, suspicious activity reporting, governance, staffing, independent testing and training. It also found significant, systemic breakdowns in transaction monitoring. The Federal Reserve Board fined Toronto-Dominion Bank $123.5m. It found that the parent had failed to conduct adequate risk management and oversight of its US retail banking operations, so that a US subsidiary was used to launder hundreds of millions of dollars of illicit proceeds. It required TD to relocate to the United States the parts of its AML compliance programme responsible for complying with US law. TD must also certify that sufficient resources are allocated to remediation before paying dividends or making capital distributions. The Fed noted that Canada's Office of the Superintendent of Financial Institutions, TD's home supervisor, can act in implementing these requirements within its legal authority. The Fed said the penalties announced by the agencies total about $3.09bn, and that the bank is also pleading guilty to criminal charges. Earlier in the year, Canada's FINTRAC had imposed an administrative monetary penalty of C$9,185,000 on The Toronto-Dominion Bank on 9 April 2024. One of the violations was a failure to submit suspicious transaction reports. FINTRAC also found failures to assess and document money laundering and terrorist financing risks, to take the prescribed special measures for high risk and to conduct ongoing monitoring of business relationships. For other international banking groups, the lesson is that home and host supervisors now look at the same control failures, and that a weakness found by one can be followed by action from another.

The three regulatory penalties shown in the chart below add up to $1,873.5m. The regulators' releases do not itemise the balance of the roughly $3.09bn total; the Fed said its action was taken in conjunction with criminal and regulatory actions by the Department of Justice, the US Attorney's Office for the District of New Jersey, FinCEN and the OCC. The growth restriction, the dividend certification and the monitorship are likely to weigh on the group for longer than the fines.

United Kingdom and Asia

UK: review of the regulations, enforcement on controls

HM Treasury consulted on improving the effectiveness of the Money Laundering Regulations from 11 March to 9 June 2024. The consultation covered four core themes: making customer due diligence more proportionate and effective, strengthening system coordination, clarifying the scope of the regulations and reforming registration for the Trust Registration Service.

On 2 October 2024 the Financial Conduct Authority (FCA) fined Starling Bank £28,959,426 for financial crime failings related to its financial sanctions screening, and for repeatedly breaching a requirement not to open accounts for high-risk customers. Starling grew from about 43,000 customers in 2017 to 3.6 million in 2023. It opened over 54,000 accounts for 49,000 high-risk customers between September 2021 and November 2023. The FCA had identified serious concerns with Starling's anti-money laundering and sanctions framework during a 2021 review of challenger banks, and the bank had agreed to a restriction on opening new accounts for high-risk customers. In January 2023 Starling found that, since 2017, its automated system had screened customers against only a fraction of the full list of those subject to financial sanctions. The penalty reflected a 30% settlement discount from £40,959,426. The FCA said the case took 14 months from opening to outcome, against an average of 42 months for cases closed in 2023/24.

On 12 November 2024 the FCA imposed a penalty of £16,675,200 on Metro Bank. Without a 30% settlement discount it would have been £23,821,700. Metro introduced an automated transaction monitoring system on 6 June 2016. Over the relevant period it failed to monitor over 60 million transactions, about 6.0% of total transaction volume, with a value of over £51bn, about 7.6% of total transaction value. A lookback review completed in 2022 led to 153 suspicious activity reports. Both cases show that controls must keep pace with growth and with new systems.

Asia: Singapore and Hong Kong

Singapore's Inter-Ministerial Committee published its review of the AML framework on 4 October 2024, drawing lessons from the major money laundering case of August 2023. It focused on five areas, including how financial institutions can enhance their controls and collaborate with each other and the authorities to identify and flag suspicious transactions. Its recommendations strengthen three prongs: proactive prevention, timely detection and effective enforcement. Under timely detection it recommends deepening channels for data sharing amongst and with gatekeepers. In Hong Kong, the HKMA's circular of 12 November 2024 passed on the October FATF statements and the Recommendation 1 consultation to authorised institutions.

Selected 2024 AML/CFT enforcement actions against banks

Source: Financial Crimes Enforcement Network (US Treasury), FinCEN Assesses Record $1.3 Billion Penalty against TD Bank, 10 October 2024; Office of the Comptroller of the Currency, OCC Issues Cease and Desist Order, Assesses $450 Million Civil Money Penalty, and Imposes Growth Restriction Upon TD Bank, N.A. for BSA/AML Deficiencies (NR 2024-116), 10 October 2024; Board of Governors of the Federal Reserve System, Federal Reserve Board fines Toronto-Dominion Bank $123.5 million for violations related to anti-money laundering laws, 10 October 2024; Financial Transactions and Reports Analysis Centre of Canada, FINTRAC imposes administrative monetary penalty on The Toronto-Dominion Bank, 2 May 2024; Financial Conduct Authority, FCA fines Starling Bank £29m for failings in their financial crime systems and controls, 2 October 2024; Financial Conduct Authority, Final Notice: Metro Bank Plc, 12 November 2024.

Implications for banks

Taken together, the 2024 changes point in one direction: obligations are becoming more prescriptive on process, and enforcement is targeting the basic machinery of monitoring, screening and reporting rather than exotic typologies. FinCEN's proposal makes a documented risk assessment the core of the US programme, and the EU Regulation fixes maximum refresh periods of one year and five years for customer information. The FATF's Recommendation 1 consultation, meanwhile, is intended, in the US Treasury's description, to encourage simplified due diligence where risk is lower. Banks that can show regulators a credible, data-based risk assessment will be best placed under both trends.

Payment data is the second front. The revision of Recommendation 16, the EU Transfer of Funds Regulation from 30 December 2024 and the instant-payments screening rule from 9 January 2025 all depend on accurate, well-structured data on originators, beneficiaries and customers. The third is supervisory architecture: AMLA's direct supervision from 2028 and the expected US onsite evaluation in early 2026 will test the effectiveness of national regimes and the banks inside them. The TD case shows that, where the parent's controls fail, US authorities are prepared to require compliance functions to sit inside the host country and to restrict the bank's growth.

Primary sources: Financial Stability Board, G20 Roadmap for Enhancing Cross-border Payments: Consolidated progress report for 2024, 21 October 2024; Hong Kong Monetary Authority, Statements issued by the Financial Action Task Force (circular to authorized institutions), 12 November 2024; European Parliament and Council of the EU (Official Journal), Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, 19 June 2024; Financial Crimes Enforcement Network (US Treasury), Anti-Money Laundering and Countering the Financing of Terrorism Programs, notice of proposed rulemaking, 89 FR 55428, 3 July 2024; Financial Crimes Enforcement Network (US Treasury), FinCEN Assesses Record $1.3 Billion Penalty against TD Bank, 10 October 2024; HM Treasury, Improving the effectiveness of the Money Laundering Regulations (consultation), 11 March 2024; Board of Governors of the Federal Reserve System, Federal Reserve Board fines Toronto-Dominion Bank $123.5 million for violations related to anti-money laundering laws, 10 October 2024; European Parliament and Council of the EU (Official Journal), Directive (EU) 2024/1640 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for money laundering or terrorist financing, 19 June 2024; European Parliament and Council of the EU (Official Journal), Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, 19 June 2024; Financial Conduct Authority, FCA fines Starling Bank £29m for failings in their financial crime systems and controls, 2 October 2024; Financial Conduct Authority, Final Notice: Metro Bank Plc, 12 November 2024; Financial Crimes Enforcement Network (US Treasury), AML/CFT Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers, final rule, 89 FR 72156, 4 September 2024; Financial Action Task Force (copy deposited in the UK Parliament, DEP2024-0338), Outcomes FATF Plenary, 19-23 February 2024, 23 February 2024; US Department of the Treasury, FATF Advances Work to Combat Money Laundering and Terrorist Financing, 23 February 2024; US Department of the Treasury, FATF Completes Fourth Round of Mutual Evaluations, Advances Work to Curb Terrorist and Proliferation Finance, 25 October 2024; US Department of the Treasury, FATF Holds Plenary in Singapore, Advances Key Illicit Finance Initiatives, 28 June 2024; Financial Crimes Enforcement Network (US Treasury), Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Deficiencies (February 2024), 29 February 2024; Financial Crimes Enforcement Network (US Treasury), Financial Action Task Force Identifies Jurisdictions with AML/CFT/CPF Deficiencies (July 2024), 3 July 2024; Financial Crimes Enforcement Network (US Treasury), Financial Action Task Force Identifies Jurisdictions with AML/CFT/CPF Deficiencies (October 2024), 30 October 2024; European Parliament and Council of the EU (Official Journal), Regulation (EU) 2024/886 as regards instant credit transfers in euro, 19 March 2024; European Banking Authority, EBA issues final guidance on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures, 14 November 2024; European Banking Authority, Final Report: Two sets of Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (EBA/GL/2024/14 and EBA/GL/2024/15), 14 November 2024; Financial Crimes Enforcement Network (US Treasury), Anti-Money Laundering Regulations for Residential Real Estate Transfers, final rule, 89 FR 70258, 29 August 2024; Office of the Comptroller of the Currency, OCC Issues Cease and Desist Order, Assesses $450 Million Civil Money Penalty, and Imposes Growth Restriction Upon TD Bank, N.A. for BSA/AML Deficiencies (NR 2024-116), 10 October 2024; Financial Transactions and Reports Analysis Centre of Canada, FINTRAC imposes administrative monetary penalty on The Toronto-Dominion Bank, 2 May 2024; Ministry of Finance, Ministry of Home Affairs and Monetary Authority of Singapore, Inter-Ministerial Committee Publishes Recommendations to Strengthen Singapore's Anti-Money Laundering Framework, 4 October 2024.