4.4 Sources of Guidance for Building Anti-Financial Crime Processes
Key Takeaways
Statutes and regulations bind firms directly, while FATF Recommendations bind countries and reach firms through national law.
FinCEN alerts and advisories give SAR key terms, such as FIN-2024-DEEPFAKEFRAUD, that firms enter in SAR field 2 and the narrative.
FATF updates its black and grey lists of high-risk jurisdictions three times a year, after its February, June and October plenaries.
In the UK, the JMLSG guidance is industry guidance approved by HM Treasury; the FCA considers it when judging compliance with the Money Laundering Regulations.
When a FinTech designs a new onboarding flow, monitoring scenario or SAR process, it needs a basis for each control. CAFCA sub-topic 1.7 asks which types of sources can guide that work. The underlying skill is judging authority. A blog post from a vendor is not equal to a regulator's rulebook.
The source hierarchy
| Tier | Examples | How binding? |
|---|---|---|
| 1. Law and regulation | US Bank Secrecy Act and 31 CFR Chapter X; EU AML Regulation and directives; UK Money Laundering Regulations 2017 and POCA 2002; Singapore's MAS Notices | Legally binding on the firm |
| 2. Supervisory rules and guidance | FFIEC BSA/AML Examination Manual; FCA Handbook and Financial Crime Guide; EBA guidelines (for example on ML/TF risk factors and remote onboarding); MAS guidelines | Rules bind; guidance sets examiners' expectations |
| 3. International standards | FATF Recommendations, interpretive notes, guidance papers and mutual evaluation reports; Basel Committee papers | Bind countries and shape national law; firms use them to interpret risk |
| 4. FIU products | FinCEN advisories and alerts with SAR key terms; UK Financial Intelligence Unit material; Egmont Group papers | Practical red flags and reporting instructions |
| 5. Industry guidance | UK JMLSG Guidance (approved by HM Treasury); Wolfsberg Group principles and questionnaires; trade association papers | Persuasive; some is formally recognised |
| 6. Threat and typology reports | FATF typology studies; national risk assessments; Europol reports; blockchain analytics firms' crime reports | Evidence for risk assessments and scenario design |
| 7. Enforcement actions | Consent orders, final notices, penalty announcements | Show what regulators treat as failure |
| 8. Internal sources | Business-wide risk assessment, audit and QA findings, SAR trends, loss data | Firm-specific evidence; drives tuning |
How each source is used in practice
- Designing remote onboarding. In the EU, the EBA Guidelines on the use of remote customer onboarding solutions (EBA/GL/2022/15) set expectations for document and biometric checks. FATF's 2020 Guidance on Digital Identity explains assurance levels for digital ID systems.
- Setting high-risk country lists. FATF publishes its "high-risk jurisdictions subject to a call for action" (the black list) and "jurisdictions under increased monitoring" (the grey list) after each plenary in February, June and October. National lists, such as the EU's list of high-risk third countries, may differ. Firms combine these with their own risk indicators.
- Writing monitoring scenarios. FIU alerts describe current typologies and ask for specific key terms. FinCEN's 2023 pig-butchering alert asks filers to use FIN-2023-PIGBUTCHERING, and its 2024 deepfake alert asks for FIN-2024-DEEPFAKEFRAUD, in SAR field 2 and the narrative.
- Answering partner-bank due diligence. The Wolfsberg Group, an association of global banks, publishes the Correspondent Banking Due Diligence Questionnaire (CBDDQ) and the Financial Crime Compliance Questionnaire (FCCQ). Bank partners often send these to FinTechs.
- Benchmarking controls. Enforcement actions show which failures attract penalties: unmanaged growth, alert backlogs, weak partner oversight, and missing data feeds.
Judging a source
Before relying on a source, check five things:
- Authority. Who issued it, and is it law, rule, guidance or opinion?
- Jurisdiction. Does it apply where the firm is licensed and where its customers are?
- Currency. Has it been replaced, withdrawn or amended? Guidance changes. For example, FinCEN withdrew its 2020 unhosted-wallet proposal in October 2026.
- Applicability. Does it cover the firm's type of institution and product?
- Consistency. Does it conflict with a higher-tier source? If so, the higher tier wins.
Record the sources behind each policy in a regulatory mapping or obligations register. Then, when a source changes, the affected procedures can be found and updated. That link also feeds the change triggers covered in Chapter 18.
A simple register row might read: Obligation: verify the identity of remote applicants. Source: national AML law article and EBA/GL/2022/15. Owner: Head of Onboarding (first line). Control: document check plus liveness plus database match. Test: monthly QA sample by second line. Last reviewed: date. Keep the register current. When a supervisor issues new guidance, the row shows at once which procedure, owner and test must change. This also gives evidence that the firm follows a defined review process. FinTechs that grow quickly often lose this traceability, and examiners then find controls that nobody can explain.
Internal sources belong in the same register. A rising rate of SARs filed on a single product, repeated audit findings on alert closure quality, or fraud losses concentrated in one channel are often better guides to where controls need work than any external publication. Treat them as evidence, and record what changed as a result.
Realistic exam scenario
A FinTech authorised in Ireland is designing onboarding for customers in Ireland and Germany. The project team has collected a FATF guidance paper, the EBA remote onboarding guidelines, a vendor white paper claiming "liveness is optional for low-risk users", and a Central Bank of Ireland supervisory statement. The compliance lead should base the design on the binding Irish AML law and the EBA guidelines, which supervisors apply. FATF guidance helps interpret risk. The vendor paper is commercial opinion and cannot override the guidelines.
Common exam traps
- "FATF Recommendations directly bind private firms." They bind countries. Firms are bound by the national law that implements them.
- Treating vendor marketing as regulatory guidance.
- Using withdrawn or superseded guidance without checking whether it is current.
- Ignoring internal sources. The firm's own SAR and loss data are often the best evidence for tuning.
A compliance analyst wants to cite the most authoritative basis for a customer identification requirement at a US bank's FinTech program. Which source ranks highest?
The CIP regulation at 31 CFR 1020.220
A Wolfsberg Group questionnaire
A FATF typology report on digital identity
A blockchain analytics firm's annual crime report
How often does FATF normally update its lists of high-risk jurisdictions and jurisdictions under increased monitoring?
Every five years, in line with each country's mutual evaluation cycle
Three times a year, after its February, June and October plenaries
Only when the UN Security Council requests it
Daily, through an automated feed from member country regulators
Which statement best describes how FATF Recommendations reach a private FinTech?
They are voluntary industry best practice with no effect on national law
They are directly enforceable against the FinTech by FATF
They bind countries, whose national laws then bind the FinTech
They apply only to banks and never to FinTechs or other non-bank firms
Sections you finish are checked off in the contents.