FATF Mutual Evaluations: What They Mean for Financial Institutions

The FATF grey list (formally Jurisdictions Under Increased Monitoring) identifies countries that have committed to addressing AML/CTF deficiencies under FATF oversight. A grey-listed country is not subject to a blanket call for countermeasures — but financial institutions dealing with customers, transactions, or counterparties in grey-listed jurisdictions are expected to apply enhanced due diligence commensurate with the elevated risk.

The FATF black list (Jurisdictions Subject to a Call for Action, currently consisting of Myanmar, North Korea, and Iran) represents the most severe designation. Financial institutions are expected to apply enhanced due diligence — or in many cases, to decline business altogether — with counterparties in black-listed jurisdictions. Correspondent banking relationships with financial institutions in black-listed countries are rarely maintained by internationally active banks.

For compliance teams, tracking FATF list membership is a standing obligation. Lists are updated three times per year, and additions or removals can affect the due diligence classification of existing customers and correspondents. Automated jurisdiction risk scoring tools that update in response to FATF list changes reduce the manual burden of tracking these developments.

Australia's most recent FATF mutual evaluation, conducted in 2015 and followed up through subsequent rounds, identified significant weaknesses in Australia's AML/CTF regime — most notably the absence of Tranche 2 entities (lawyers, accountants, real estate agents) from the formal regulatory framework. This gap placed Australia as an outlier among FATF member jurisdictions. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, which brings Tranche 2 entities into scope from 1 July 2026, directly addresses this deficiency.

For Australian financial institutions, the Tranche 2 reforms have compliance implications beyond their own obligations. As lawyers, accountants, and real estate agents come into the AML/CTF framework, Australian banks will need to apply due diligence to these entities as customers — which now requires understanding their AML/CTF programme obligations and assessing whether they are meeting them.

FATF evaluation results are a primary input into country risk assessments used by financial institutions. A country with Low or Moderate effectiveness ratings across multiple Immediate Outcomes represents elevated ML/TF risk, even if it is not grey-listed. Compliance teams should incorporate evaluation outcomes — not just list status — into their jurisdiction risk matrices, and update those matrices when new evaluations are published or when countries advance through follow-up processes.

Correspondent banking risk assessment is particularly sensitive to FATF outcomes. Banks applying a risk-based approach to their correspondent relationships are expected to evaluate the correspondent's home jurisdiction's FATF standing, the quality of its supervisory regime, and whether its AML/CTF framework has been assessed as effective. FATF mutual evaluation reports are publicly available and provide the level of detail necessary to support a rigorous correspondent due diligence analysis.

A FATF mutual evaluation is a peer review process in which FATF assessors examine a country's AML/CTF laws, regulatory systems, and the effectiveness of their implementation. Evaluations assess both technical compliance with FATF's 40 Recommendations and practical effectiveness across 11 Immediate Outcomes. Evaluation reports are published on the FATF website.

Countries on the FATF grey list (Jurisdictions Under Increased Monitoring) have committed to address identified AML/CTF deficiencies within agreed timelines. Grey-listing is not a blanket sanction, but it signals elevated financial crime risk. Financial institutions are expected to apply enhanced due diligence to customers, transactions, and correspondent relationships involving grey-listed jurisdictions.

FATF updates its public statements on grey-listed and black-listed jurisdictions three times per year, following FATF Plenary meetings (typically in February, June, and October). Financial institutions should monitor these updates and adjust jurisdiction risk ratings for affected countries.

FATF evaluation reports provide detailed assessments of a jurisdiction's AML/CTF effectiveness across 11 Immediate Outcomes. Banks should incorporate these ratings into their country risk matrices, weighting them alongside other risk factors (corruption indices, financial transparency measures, sanctions status). A country with Moderate or Low effectiveness ratings warrants an elevated country risk rating even if it is not grey-listed.

Australia's next full FATF evaluation is expected to focus on the effectiveness of implementation, including the rollout of Tranche 2 reforms, the supervision of newly regulated entities, and beneficial ownership transparency improvements. Australia's technical compliance rating is expected to improve significantly given the 2024 legislative reforms; the effectiveness ratings will depend on implementation quality and supervisory rigour.

FATF mutual evaluations are a fundamental part of the global AML/CTF architecture — and for financial institutions, they are a primary input into risk assessment, correspondent due diligence, and regulatory change management. Compliance teams that track evaluation outcomes systematically, and incorporate them into their risk frameworks, are better equipped to anticipate regulatory change and manage cross-border exposure.