Financial-crime risk-based control guidance

The maintained February 2025 FATF Recommendations and coordinated sector/topic risk-based guidance publish risk assessment, proportionate mitigation, CDD, enhanced and simplified measures, screening, ongoing monitoring, escalation/reporting, and supervisory expectations with authority, sector/product scope, edition, and amendment context. They are international standards and guidance, not proof that a domestic legal duty applies.

Within U.S.-bank examination scope, the FFIEC Manual provides official examiner guidance on BSA/AML risk assessment, CDD and EDD, risk-based controls, manual and automated monitoring, alert research and escalation, SAR decision-making and filing, and OFAC screening/blocking/rejection. The Manual distinguishes regulatory requirements from guidance and expressly does not itself create legal requirements; it must not be generalized to insurance carriers or other non-bank entities without separate authority.

Scoped FinCEN advisories and notices publish risk-based due-diligence and enhanced-review considerations, ongoing-monitoring expectations, escalation channels, SAR triggers and filing instructions, and reminders of existing BSA obligations, with audience, authority, issue-date, relationship, and withdrawal context. They do not constitute a complete legal code or independently establish applicability to every entity.

FATF typology reports provide useful supplemental recommendations and good practices for detection, screening, monitoring or examination, and SAR/STR reporting, pinned to each report’s scope, date, methodology, and limitations. These analytical recommendations are not the FATF Standards, domestic law, or a complete control framework.