FATF’s Dual Evaluation Tracks Tighten Pressure on Jurisdictions as New Procedures Recast Global AML Expectations

Across the FATF network, the evaluation machinery has shifted into a noticeably higher tempo, with the fifth round of assessments now running parallel to the final stretch of the fourth. Countries are navigating a denser landscape of expectations that spans technical compliance, effectiveness, follow up obligations and potential ICRG escalation. What were once background procedural documents have effectively become operational blueprints, guiding how supervisors structure inspections, how ministries plan legislative timetables, and how financial institutions design and sequence their AML transformation programmes.

Two procedural frameworks now operate side by side: the fourth-round rules and the updated structure governing the new AML/CFT/CPF cycle and ICRG workflow. Jurisdictions still being assessed under the fourth round remain tied to the 2013 methodology, while entrants to the fifth round face the 2022 methodology and its integrated model for follow up and Key Recommended Actions. For practitioners, this layering is not academic—it dictates the timing of the next mutual evaluation, the benchmarks against which remediation will be judged, and the speed with which weak performance can escalate into international scrutiny.

What emerges is a far more continuous pressure environment. Instead of a single assessment followed by years of relative calm, the new architecture connects the Mutual Evaluation Report, the KRA Roadmap, follow up reporting requirements and any ICRG review into a single extended chain of monitoring. Understanding that chain is now a critical skill for senior AML officials and supervisors who must anticipate FATF’s next line of questioning rather than rely solely on what was highlighted in the last report.

At the system’s centre sits the FATF mutual evaluation itself, built on two interdependent pillars. The first, technical compliance, tests whether the necessary legal, regulatory and institutional elements exist on paper and in practice. The second, effectiveness, probes whether those elements produce demonstrable outcomes across the eleven Immediate Outcomes that define the FATF’s evaluation model. While technical compliance still pivots around the 40 Recommendations, the procedures clarify that assessors expect proof of operational institutions—a functioning FIU, active supervisors, capable law enforcement and a judiciary applying laws—not just legislative text. Fourth-round countries continue under the 2013 methodology, whereas fifth-round jurisdictions are assessed under the 2022 methodology, which incorporates all revisions adopted since then.

Effectiveness analysis reaches well beyond a checklist. Before arrival, assessors study national risk assessments, sectoral statistics and old MERs to identify priority themes. During the on-site—typically lasting around one and a half weeks—they examine how supervisors apply risk to schedule inspections, whether suspicious transaction reports evolve into financial intelligence and prosecutions, how confiscation is pursued, how non-financial sectors are regulated and how beneficial ownership data is obtained and utilised. The updated procedures urge assessors to tailor their approach to a jurisdiction’s specific risk profile rather than impose a one-size-fits-all template.

The assessment process is intentionally rigorous. Teams conduct months of desk-based review, exchange multiple rounds of questions with the country, refine a detailed scoping note and then engage with authorities, private sector entities and civil society on the ground. The resulting Mutual Evaluation Report includes narrative analysis, ratings for every Recommendation and Immediate Outcome, and a catalogue of Key Recommended Actions that form the backbone of the KRA Roadmap—an instrument that subsequently guides follow up and possible ICRG review.

For financial institutions, the mutual evaluation is no longer merely a state-facing exercise. Assessors routinely meet with banks, DNFBPs and virtual asset service providers, testing the credibility of risk assessments, monitoring frameworks, onboarding controls and escalation procedures. What institutions demonstrate during those sessions can shape assessors’ views on supervisory effectiveness, private sector implementation and even law enforcement outcomes. Treating the evaluation as an opportunity to present mature, risk-based controls—rather than as a burdensome compliance inspection—can influence national ratings for years.

With the fourth and fifth rounds running concurrently, a two-speed landscape has materialised. Countries whose MERs were finalised under the fourth round remain governed by its procedures until their next full evaluation. Those rules distinguish between regular follow up for stronger performers and enhanced follow up for those with sizeable deficiencies. Regular follow up generally entails a single report about three years after the MER; enhanced follow up requires multiple reports in tighter succession, with close scrutiny of technical and effectiveness reforms.

Under the fourth round, jurisdictions may seek re-ratings for Recommendations initially deemed non-compliant or partially compliant. Technical gaps are expected to be largely resolved within three years, while effectiveness weaknesses should be meaningfully addressed within roughly five. If a country’s performance deteriorates after the MER, the Plenary can require remediation in follow up and may shift it from regular to enhanced follow up—a built-in warning system that activates when progress stalls.

The fifth round extends this framework in three major respects. It fully integrates counter-proliferation financing, expanding the scope to AML/CFT/CPF. It employs Key Recommended Actions as the principal tool for monitoring, anchoring follow up in a strategic KRA Roadmap. And it consolidates evaluation, follow up and ICRG procedures into a single architecture, reducing fragmentation and tightening expectations.

The implications for countries are clear: long quiet intervals after an evaluation are no longer common. Fifth-round procedures emphasise regular submission of progress data, structured analysis of KRA implementation and more precise timelines—including for Technical Compliance Re-Ratings and their interaction with the KRA Roadmap. Follow-up experts and Joint Groups are encouraged to evaluate not only legislative fixes but also whether KRAs linked to effectiveness—confiscation, supervision, enforcement outcomes—have advanced in practice.

For financial institutions, this perpetual-pressure environment means AML enhancements cannot pause once an MER is issued. A country’s KRA Roadmap often contains actions requiring substantial support from banks, insurers and other obliged entities—for example improving STR quality, strengthening beneficial ownership data collection or enhancing monitoring of high-risk sectors. Jurisdictions in enhanced follow up face even steeper expectations, and private sector complacency can quickly lead to misalignment with regulatory priorities.

Above these layers sits the escalation mechanism: the ICRG review, reserved for jurisdictions with strategic deficiencies posing increased global risk. Entry into ICRG review depends on a matrix of technical and effectiveness weaknesses, and once a jurisdiction crosses that threshold, the KRA Roadmap becomes the central reference for required reforms during a defined observation period.

For FATF members, the observation period begins when the Plenary adopts the MER. For regional-body members, it starts after the FATF Plenary endorses a tailored KRA Roadmap. The period typically lasts twelve months—occasionally extended to two years for lower-income countries—and is dedicated to addressing critical reforms covering both major effectiveness gaps and priority technical issues such as criminalisation, targeted financial sanctions and preventive measures.

At the period’s end, the jurisdiction submits a Post-Observation Period Report describing how each KRA has been addressed. The Joint Group rates each KRA as fully addressed, largely addressed, partly addressed or not addressed. Strong ratings may support an exit from ICRG review, subject to Plenary approval, after which the country returns to the standard evaluation cycle and may seek technical re-ratings. Weaker ratings trigger a revised KRA Roadmap—often with tighter timelines—and typically require renewed high-level political commitments.

For AML officers, ICRG review carries significant operational consequences. Jurisdictional listing affects correspondent banking, shapes foreign due diligence and can trigger de-risking. Institutions operating in or connected to such jurisdictions must recalibrate risk appetite, strengthen controls and prepare to answer questions from foreign partners that mimic the structure of the KRA Roadmap itself. Knowing precisely which KRAs are only partly or not addressed becomes essential to designing institution-level remediation that aligns with national commitments.

Taken together, the updated fourth-round rules and the integrated fifth-round/ICRG framework create a more demanding and structured environment for jurisdictions with underdeveloped AML systems. Emphasis on consistency, peer review and defined escalation criteria produces a deliberate and predictable—but unforgiving—cycle. Strong performers benefit from reduced monitoring, while weaker jurisdictions face a roadmap of closely monitored reforms.

For financial institutions and DNFBPs, this shift should reshape internal AML programmes. Compliance can no longer rest on adherence to domestic regulations alone. The benchmark is whether a programme withstands the questions assessors apply to Immediate Outcomes: Are supervisors genuinely driving risk-based oversight? Are STRs meaningful? Do beneficial-ownership systems function? Is cross-border cooperation effective?

Compliance leaders should orient strategies toward three horizons: the next supervisory cycle and related national reforms; the next follow-up milestone—whether under fourth-round timelines or the fifth-round KRA system; and the potential ICRG scenario, where the KRA Roadmap becomes the template for both national policymaking and global perception.

Practical steps follow naturally. Institutions should obtain and study their jurisdiction’s MER, KRA Roadmap and follow-up reports, aligning major change programmes with documented gaps. Governance bodies should receive briefings on the country’s position in the cycle—regular or enhanced follow up—and the likelihood of ICRG attention in coming years. Monitoring, onboarding, sanctions screening and correspondent-banking controls should be stress-tested against the most sensitive Recommendations and Immediate Outcomes, especially those commonly tied to enhanced follow up or ICRG escalation.

The fifth round also elevates expectations around data quality. Assessors increasingly expect coherent, granular statistics on supervision, enforcement, STR flows, prosecutions and confiscation. Financial institutions can prepare by refining how they collect and present AML data, making it easier to demonstrate effectiveness and support national authorities during evaluation preparation. Institutions able to show that their own remediation cycles mirror national KRA Roadmaps will be well positioned when supervisors seek concrete examples of effective practice.

Ultimately, the new procedures highlight the need for consistent political and institutional commitment. National AML strategies, legislative schedules and supervisory priorities must remain steady enough to deliver progress across an entire evaluation and follow-up cycle. For compliance professionals, this moment offers an opportunity to reposition AML frameworks as key pillars of national financial integrity. When leadership understands that FATF ratings shape access to finance, investment confidence and a country’s broader reputation, AML budgets and staffing become investments in systemic resilience rather than mere compliance costs.

By fLEXI tEAM