UK FATF Mutual Evaluation

Introduction

Every decade or so, countries are assessed on their technical compliance with the Recommendations of the Financial Action Task Force (FATF) on money laundering, terrorist financing and proliferation financing and on the effectiveness of the measures that they have put in place. The on-site visit for the UK’s next evaluation is scheduled for August 2027 and preparations will begin in earnest in 2025. While the UK has generally been regarded as having a robust legal and regulatory framework, FATF’s increasing focus on the effectiveness of a country in managing money laundering, terrorist financing and proliferation financing risks means that technical compliance with the Recommendations alone is not enough.

The UK’s last evaluation, in 2018, was positive overall, however, some areas of significant weakness were identified. The UK has sought to address these over the last decade, but has it done enough? How will the UK fare when it comes to its effectiveness ratings? How will the changes in methodology for this round of evaluations impact the assessment of the UK? What about new areas, such as the FATF’s recommendations on virtual assets and the strengthening of its recommendations on asset recovery?

To help answer these questions, the Centre for Finance and Security (CFS) at RUSI has established a UK FATF Taskforce, bringing together a small group of experts to explore these areas and provide practical recommendations on how the UK can best prepare for its upcoming evaluation.

The Taskforce held its first meeting in October 2024. The discussion was divided into two parts. First, Taskforce members reflected on the UK’s 2018 mutual evaluation, some of the areas of weakness that were identified, and the extent to which progress had been made by the UK in the intervening years. Second, the group discussed some of the major global challenges over the last decade and what impact those could potentially have on the UK’s evaluation. Given the overlap between these two areas, this report sets out the themes that emerged during the Taskforce meeting, rather than being a narrative description of the points raised by participants. While there was some discussion about changes to some of the technical requirements of FATF’s Recommendations, such as the standards on virtual assets, this will be covered in more detail in the second Taskforce meeting. Although the Taskforce’s remit focuses on the UK’s fifth round evaluation, many of the points raised will be relevant for other jurisdictions as they contemplate their next mutual evaluations.

The Direction of Travel since 2018

There was broad consensus in the group that the UK’s 2018 mutual evaluation was better than could have been expected and, for some, better than the UK deserved. The months of hard work and organisation in the lead-up to the evaluation enabled the UK to present a coherent and persuasive narrative to the assessors. This was rewarded with the headline that the “UK takes top spot in fight against dirty money” and much was made of the UK’s, at the time, world-leading ranking in compliance with the FATF standards.

Members of the Taskforce did not doubt the UK government’s continued public commitment to tackling financial crime: participants pointed to the two Economic Crime Plans that previous governments had issued; legislative changes, including much-needed reforms to Companies House; and increased investment in the UK’s response, for example through the Economic Crime Levy. This, together with the UK’s global lead in the response to Russia’s full-scale invasion of Ukraine in 2022, suggests that the UK will again have the basis from which to craft a strong narrative to the assessors in 2027.

That said, it is clear that there are a number of potential pitfalls for the UK. These can be broadly grouped into two themes. First, participants discussed the overall application of the risk-based approach in the UK, from the National Risk Assessment (NRA) to risk-based supervision and the application of risk-based preventative measures. Second, participants identified specific areas where they felt that there had been little progress since the 2018 mutual evaluation, including enforcement, the role of the financial intelligence unit (FIU), and public–private partnerships (PPPs).

The Changing Global Context

All participants acknowledged the significant global changes and challenges over the decade since the UK’s last evaluation. Of these, Russia’s full-scale invasion of Ukraine in February 2022 has had the most impact on the UK’s response to illicit finance. The design, implementation and enforcement of sanctions against Russia have dominated the work of policymakers, regulators and regulated institutions. While acknowledging the point made above, that the UK’s response to the invasion of Ukraine may feed into a positive narrative for the evaluation, some Taskforce members felt that the increased focus on sanctions implementation had hindered the ability of the UK to make progress on anti-money laundering (AML) and counterterrorist financing (CTF), particularly in the application of the risk-based approach by supervisors and institutions. This is primarily because of the resources – at both levels – that have had to pivot towards compliance with sanctions regulations rather than AML/CTF, but also because of the difference in the type of regime, one being risk-based and the other being more rules-based.

The impact of the post-2022 sanctions on Russia was also felt to have had a similar knock-on impact on resourcing of law enforcement, with efforts directed towards kleptocracy and sanctions evasion rather than areas like international corruption. From a purely technical perspective, only targeted financial sanctions under the UN’s sanctions regime are within scope of the FATF (that is, sanctions associated with proliferation financing activity). Therefore, Russia sanctions, or indeed other autonomous sanctions regimes, are outside the scope of the FATF’s assessments, and robust and effective implementation of these type of sanctions does not necessarily buy you any credit with the FATF.

While the full-scale invasion of Ukraine may have dominated the past few years, there have been other developments which have had an impact on the application of AML/CTF controls, such as regulatory changes in the UK. The consumer duty requirements of the Financial Conduct Authority (FCA) were given as one example of this, where there needs to be a balance between effective measures to prevent financial crime and good outcomes for consumers, recognising that these two principles can, occasionally, come into conflict. While banks and others have had to manage the implementation of multiple new sanctions, the significant global attention on the issue of fraud has also demanded much of their time and attention, further “squeezing” the available time and resourcing for tackling AML/CTF.

The UK’s Understanding of the Risks to which it is Exposed

FATF’s assessment of effectiveness of the risk-based approach, as set out in its Immediate Outcome 1 (IO1), requires that countries not only understand their risks, but also take action to combat those risks where appropriate.

Almost all participants felt that there was poor and inconsistent understanding of the UK’s risks at all levels, particularly in terms of the UK’s role as one of the world’s most significant global financial centres. The UK’s NRA, last published in 2020, was given as an example of this, being described as somewhat haphazard and of limited use to its target audience. The UK’s approach to identifying risk was also seen as very much reactive rather than proactive and, while noting the size and complexity of the UK’s exposure to financial crime risks, it was felt that other jurisdictions prioritised keeping their understanding of risks and threats up to date and sharing that information on a timely basis with supervisors and regulated institutions to inform the application of the risk-based approach.

It was also felt, however, that the 2018 mutual evaluation itself did not acknowledge the scale and extent of the threats facing the UK, leading to what many felt was a more positive outcome than the UK deserved and/or that assessors may not have focused enough on some of the higher-risk areas, including the overarching risks associated with the UK’s role as a global financial centre. This is a topic that will be discussed further in the second Taskforce meeting.

Risk-based Supervision

The application of effective and risk-based AML/CTF supervision in the UK formed a significant part of the Taskforce’s discussions. Participants felt that the lack of a coherent and robust understanding of risks extended beyond the NRA, to include supervisors and regulated institutions as well. This was discussed particularly in the context of risk-based supervision. For example, some participants expressed the view that the FCA’s supervision of financial institutions was too focused on the systemically important banks, rather than on other parts of the financial system that may present significant vulnerabilities, such as new entrants to the market who may have poor AML/CTF controls and expose the UK to higher risk.

It was felt that supervisors may not have the confidence to apply a truly risk-based approach to supervision, the proper application of which would require supervisors to deprioritise areas, whether industry sectors or specific services and products. The FCA, and indeed other supervisors, may not be willing to do this or to be seen to be doing this. Linked to this point, and maybe a consequence of it, some Taskforce members felt that the FCA had recently been moving away from a risk-based approach to supervision and towards more of a formal and technical approach, driven by a large number of data requests to firms (not limited to AML/CTF but also extending to sanctions and fraud). As a result of this, regulated entities may not be encouraged to take a risk-based approach to preventative measures. This, in turn, can lead to unintended consequences, such as de-risking.

While much of the discussion focused on AML/CTF supervision of the financial sector, participants also acknowledged broader issues with supervision in other sectors, particularly supervision by the Professional Body Supervisors (PBSs) responsible for the legal and accountancy sectors. Improvements were introduced after the mixed assessment in the 2018 evaluation, with the establishment of the Office for Professional Body Anti-Money Laundering Supervisors (OPBAS). This was intended to bring consistency and drive improvement in standards of supervision across the 22 legal and accountancy PBSs. While participants acknowledged the positive impact of OPBAS to date, it was still felt that there were weaknesses in the performance of some of the PBSs, as evidenced by recent publications from OPBAS itself.

In 2023, the government consulted on reforms to the structure of supervision in the UK and, in particular, on the extent to which there should be consolidation of the PBSs and the statutory supervisors in order to improve the effectiveness of the UK’s regime. The timing of the government’s consultation means that it is likely that the UK will be in some sort of transition phase by the time of the next mutual evaluation, at least as it relates to the supervision of the professional services. As a result, the UK may struggle to evidence the required level of effectiveness in supervisory outcomes to the FATF assessors, and consideration needs to be given to what type of data can be provided to assessors while the system is in a state of flux.

While the methodology changes for the fifth round of evaluations will be a focus for the next Taskforce meeting, specific changes to the IOs relating to supervision (IO3 and IO4) were also raised as part of the discussion. The previous assessment methodology (which the UK was assessed under in 2018) combined the assessment of supervision of financial institutions and non-financial institutions into one IO (IO3). The UK was rated as only being moderately effective in relation to this IO in 2018, although it is not significantly out of step with its international peers; no country received the top rating (“highly effective”) and only a handful received a rating of “substantially effective”.

Under the new methodology that will be used in 2027, countries will receive separate ratings for the effectiveness of supervision in the financial (IO3) and non-financial sectors (IO4). However, the reformulated IO3 and IO4 will extend beyond just considering the effectiveness of supervision to include the effectiveness of the preventative measures put into place by regulated entities.12 These changes may have a number of implications for the UK’s assessment. First, the lack of progress on addressing the weaknesses that the FATF assessors identified on supervision of the legal and accountancy sectors in 2018 may be more clearly called out now that it is considered as its own separate IO. On the other hand,Under the new methodology that will be used in 2027, countries will receive separate ratings for the effectiveness of supervision in the financial (IO3) and non-financial sectors (IO4). However, the reformulated IO3 and IO4 will extend beyond just considering the effectiveness of supervision to include the effectiveness of the preventative measures put into place by regulated entities. These changes may have a number of implications for the UK’s assessment. First, the lack of progress on addressing the weaknesses that the FATF assessors identified on supervision of the legal and accountancy sectors in 2018 may be more clearly called out now that it is considered as its own separate IO. On the other hand, combining the assessment of effectiveness to include both supervision and preventative measures into one score may mean that deficiencies in supervision will be ignored and/or negated by a more positive relative assessment of preventative measures.

Three Areas of Concern

When reflecting on the 2018 evaluation and looking ahead to the next evaluation, participants raised three further areas of concern: enforcement; the role of the UK FIU; and the UK’s approach to PPPs.

Enforcement

While the UK was described in 2018 as “routinely and aggressively” investigating and prosecuting money laundering, the assessors did highlight that it was not clear whether the level of prosecutions and convictions in relation to high-end money laundering were consistent with the UK’s risks. Taskforce members felt that enforcement in this area continued to be a challenge for the UK, pointing to the lack of standalone money laundering prosecutions. Participants felt that there remains a lack of skills, expertise and/or resources for law enforcement to investigate high-value cases, including cases of trade-based money laundering. These, however, are the types of cases that the FATF assessors should expect to see the UK authorities prosecuting, especially given the threats to which the UK is exposed and the size and complexity of its financial services sector.

The Role of the FIU

In the 2018 mutual evaluation, the UK’s FIU was singled out for criticism by the assessors. The 2018 report states that “the UKFIU suffers from a lack of available resources (human and IT) and analytical capability which is a serious concern considering similar issues were raised over a decade ago in the UK’s previous FATF mutual evaluation”. Taskforce members felt that little had changed with regards to the UK FIU since the last evaluation; a concern, given the comments in the 2018 evaluation about how longstanding the issues were at that point.

Consistent with the finding in 2018, a number of Taskforce members highlighted that the UK FIU is not well regarded overseas, with delays in responding to requests for information and a lack of effective data sharing. While this is, in part, reflective of broader issues with cross-border information sharing, it is a weakness identified by the previous evaluation that does not seem to have been addressed by the UK to date.

The UK’s Approach to PPPs

In the 2018 evaluation, the UK’s PPP, the Joint Money Laundering Intelligence Taskforce (JMLIT) was described as “an innovative model for public/private information sharing that has generated very positive results since its inception in 2015 and is considered to be an example of best practice”. While this could be fairly said in 2018, members of the Taskforce felt that other countries had managed to accelerate progress of their own PPPs, whereas JMLIT was felt to have stalled in comparison. While the lack of progress in JMLIT may not necessarily count against the UK in its assessment, it was felt that the UK was unlikely to get any continued credit for its efforts in PPPs and that this could harm the narrative of the UK as a world leader in tackling financial crime.

Conclusion

Participants generally felt that the UK would perform well in its next mutual evaluation, not least because of the ability of the machinery of the UK government to spring into action, but that it would be challenging to receive as glowing an evaluation as in 2018. A broader point was made that the dynamic of the discussion between a country’s delegation and the assessment team can influence the outcome of the evaluation. The likelihood of the UK repeating its success of 2018 could well be determined, therefore, by the makeup and experience of the assessment team. However, a well-organised and thorough approach by the UK authorities would also likely mean that the UK performs well.

A second meeting of the Taskforce is planned for spring 2025 to discuss the FATF’s new methodology for the fifth round of assessments and how the UK might fare under the revised criteria, including the implementation of the FATF standards in relation to virtual assets and virtual asset service providers, and the progress the UK has made as it relates to areas of the FATF’s recent priorities, such as asset recovery and non-profit organisations.

Kathryn Westmore is a Senior Research Fellow at the Centre for Finance and Security at RUSI. She leads the Financial Crime Policy Programme, which tracks the implementation and evolution of anti-financial crime policy both in the UK and globally.