CISI CFC FATF and the risk-based approach Guide

FATF and the risk-based approach belongs to the CISI Combating Financial Crime Money Laundering exam topic, weighted at 8%. Study this page as the bridge between international AML standards and practical firm controls. The exam may test whether you know what FATF does, what it does not do, why mutual evaluations matter, and how a risk-based approach changes customer due diligence, monitoring, escalation, and control depth.

Learning Objectives

• Describe FATF’s role as the main international standard setter for AML, CFT, and proliferation-financing controls.
• Identify the main categories covered by the FATF Recommendations, including policy coordination, preventive measures, transparency, supervision, and international cooperation.
• Understand how FATF mutual evaluations influence national policy, supervisory focus, and market perception.
• Explain why FATF evaluates both technical compliance and practical effectiveness.
• Explain the purpose of high-risk and increased-monitoring jurisdiction designations within FATF-style international AML supervision.
• Understand why a FATF-style risk-based approach requires firms to justify stronger or weaker controls with evidence.
• Identify the role of regional bodies aligned with FATF in promoting consistent standards.
• Recognize the limits of relying on jurisdiction labels alone when a customer’s specific risk profile is higher or lower than the country stereotype.

Key Concepts

FATF’s Role in the Exam

FATF is not a police force and does not supervise an individual UK investment firm directly. Its importance is that it shapes the international baseline that countries build into national law, regulation, guidance, and supervisory practice. CISI questions often use FATF to test whether you can separate standard setting from firm-level compliance.

FATF-style thinking is practical: countries should understand their financial-crime risks, maintain laws and authorities that can respond, supervise firms, require preventive measures, make beneficial ownership more transparent, and cooperate internationally. Firms then translate those expectations into customer due diligence, monitoring, escalation, training, governance, and record keeping.

FATF Role Map

The exam often tests role confusion. Use the following map before choosing an answer.

If an answer says the firm should “report to FATF” or wait for FATF to approve a customer, it is usually wrong. A firm applies domestic law and internal procedures influenced by FATF standards; it does not interact with FATF as its day-to-day supervisor.

What the Recommendations Cover

The FATF Recommendations form a broad framework rather than a single customer checklist. They cover the national system, the private-sector control environment, transparency of ownership, supervision, sanctions, and cooperation.

For CISI CFC, the important move is translating the theme into a firm control. Beneficial-ownership transparency becomes customer due diligence and ownership verification. Supervision becomes policies, management information, training, assurance, and remediation. International cooperation becomes careful records and escalation where cross-border facts are relevant.

Applying the Risk-Based Approach

The risk-based approach is a disciplined way to allocate control effort. It does not mean doing less because the firm wants less friction. It means the firm can explain why a customer or activity is lower, standard, or higher risk and can show that the control depth matches that assessment.

The risk-based approach requires two kinds of discipline. First, higher risk must lead to deeper evidence, stronger approvals, closer monitoring, or a decision not to proceed. Second, lower-risk treatment must be justified by evidence and legal conditions, not convenience. Simplified due diligence is not a shortcut when ownership, purpose, or source of funds remains unclear.

Risk-Based Control Depth

Controls should become stronger as uncertainty, opacity, speed, value movement, or jurisdictional concern increases.

The exam may ask for the “best” response after a new risk factor appears. The answer is often not immediate exit. It may be enhanced due diligence, senior escalation, monitoring changes, or restriction pending review. Exit becomes more likely when the risk cannot be understood, evidence is unreliable, activity is unlawful, sanctions apply, or suspicion cannot be managed within the firm’s risk appetite.

Mutual Evaluations and Jurisdiction Risk

FATF mutual evaluations matter because they assess whether a country’s framework exists on paper and whether it works in practice. A country can have laws but still perform weakly if supervision, enforcement, beneficial-ownership transparency, suspicious-reporting quality, asset recovery, or international cooperation is ineffective.

Technical compliance asks whether the required laws, rules, and institutions exist. Effectiveness asks whether the system produces the intended results. CISI questions may use this distinction to test whether you understand that a formal legal framework is not enough if firms are not supervised, ownership is not transparent, or suspicious activity is not acted on.

In an exam question, a FATF concern about a jurisdiction is usually an input into risk assessment, not the whole answer. The firm should consider the country, customer, product, transaction, channel, beneficial ownership, and purpose of the relationship together.

High-Risk and Increased-Monitoring Jurisdictions

FATF public statements and monitoring processes can identify jurisdictions with strategic deficiencies or heightened concern. These labels influence how firms and supervisors think about geography risk, but they should not be used mechanically.

A customer in a generally lower-risk jurisdiction can still present high risk, and a customer connected to a higher-risk jurisdiction may need enhanced controls rather than automatic rejection if the relationship is lawful and can be understood. The risk-based answer depends on the full facts.

Jurisdiction Labels Are Inputs, Not Conclusions

Country risk is important because legal systems, supervision, corruption exposure, sanctions risk, conflict, terrorism-financing activity, secrecy, and cooperation quality vary. But jurisdiction labels do not replace the firm’s assessment.

This distinction is high-yield because exam stems often include one reassuring fact and several risk facts. The reassuring fact may be that the jurisdiction is not prohibited, the product is familiar, or the customer was introduced by a known intermediary. Do not let that single fact override opaque ownership, third-party funding, adverse media, unusual activity, or sanctions proximity.

FATF-Style Regional Bodies

FATF-style regional bodies help extend consistent standards beyond FATF membership. They participate in mutual evaluations, typology work, technical assistance, and regional cooperation. For exam purposes, their role is to support the same standard-setting and evaluation ecosystem. They do not turn a private firm into an international regulator, and they do not replace the firm’s domestic legal obligations.

The practical implication is consistency. Criminals exploit uneven controls across jurisdictions. Regional bodies help reduce gaps by encouraging countries to implement and test comparable AML, CFT, and proliferation-financing frameworks.

Evidence, Documentation, and Governance

A risk-based approach is only defensible if the firm can show its reasoning. A high-risk customer file should show what the risk factors were, what evidence was obtained, who approved the decision, what conditions were imposed, how monitoring was adjusted, and when the relationship will be reviewed. A lower-risk file should also show why reduced intensity is justified.

The exam may include a policy that looks good but is not evidenced. A firm that records “risk-based approach applied” without explaining the evidence and control decision is not applying the approach in a defensible way.

Common Exam Scenarios

The best answer normally uses proportionate escalation. If the risk is unclear, gather more evidence and escalate. If the risk is understood but elevated, apply enhanced controls and approvals. If the risk is unlawful, prohibited, or cannot be mitigated within appetite, restrict or exit.

Common Pitfalls

• Treating FATF as the authority that receives a firm’s SAR.
• Assuming a risk-based approach permits weak controls without evidence.
• Using country risk as the only factor and ignoring customer behaviour.
• Forgetting that effectiveness matters as much as technical legal compliance.
• Confusing enhanced due diligence with a guaranteed decision to exit the customer.
• Applying simplified due diligence where ownership, source of funds, or purpose remains unclear.
• Treating a non-listed jurisdiction as automatically low risk.
• Treating a high-risk jurisdiction label as the only fact that matters.
• Recording a risk score without documenting the evidence and control decision.
• Ignoring event-driven review when a customer’s activity changes after onboarding.

Sample Exam Question

A firm’s AML policy says customers from a particular jurisdiction are always low risk because the country is not subject to a current FATF high-risk call. A new customer from that country is a private investment vehicle with unclear beneficial owners and funding from multiple third parties. What is the best criticism of the policy?

A. It wrongly treats the absence of a FATF high-risk designation as a complete risk assessment. B. It should reject all customers from countries that have not been reviewed by FATF in the current year. C. It should rely only on transaction monitoring after onboarding. D. It should report the customer directly to FATF.

Answer: A. FATF jurisdiction status is relevant, but the risk-based approach requires customer, ownership, product, funding, transaction, and channel risks to be assessed together. The unclear ownership and third-party funding may require enhanced due diligence and escalation.

Study Notes

For final review, write FATF in one line: international standard setter, not firm supervisor. Then write risk-based approach in one line: identify, assess, understand, and mitigate risk with evidence-backed control depth.

Use this sequence for scenario questions:

1. Identify the FATF-related cue: standard setting, mutual evaluation, jurisdiction risk, or risk-based control.
2. Identify the firm-level facts: customer, ownership, product, geography, channel, transaction, and behaviour.
3. Decide whether standard, enhanced, simplified, restricted, or exit treatment is justified.
4. Check whether the answer preserves evidence, documents rationale, and escalates to the right internal function.
5. Reject answers that assign firm duties to FATF or use a country label as a complete answer.

Key Takeaways

• FATF shapes AML, CFT, and proliferation-financing expectations across jurisdictions.
• FATF is a standard setter and evaluator, not the day-to-day supervisor of a UK firm.
• Mutual evaluations influence national reform, supervisory focus, and market perception.
• The risk-based approach requires evidence, proportionality, and documented control decisions.
• Jurisdiction labels matter, but they do not replace customer-specific assessment.
• Enhanced due diligence means deeper evidence and stronger controls, not automatic exit in every case.

Continue Review

Return to the CISI Combating Financial Crime guide for the full exam-topic table, or use the CFC Cheat Sheet for threat classification, UK authority cues, and final review prompts.