FATF ¦ Universal Procedures 2023 (December 2025)

FATF’s “Universal Procedures 2023” – what mutual‑evaluation and follow‑up changes mean for practitioners

The Financial Action Task Force (FATF) consolidated and updated its processes and procedures for mutual evaluations and follow‑up in the Universal Procedures adopted in October 2023 and updated in December 2025. Those procedures set the common playbook for all AML/CFT/CPF assessment bodies – the FATF itself, FATF‑Style Regional Bodies (FSRBs), and (International Monetary Fund) IMF and World Bank staff who perform assessments – and govern how jurisdictions are assessed, how follow‑up is carried out and how the International Co‑operation Review Group (ICRG) operates. The document clarifies sequencing, roles and responsibilities, team composition, risk‑based scoping, timelines for deskwork and on‑site activity, and the post‑plenary quality and consistency mechanisms that safeguard the FATF brand.

Key practical implications for financial crime professionals

The Universal Procedures matter to regulated entities, compliance officers, auditors and advisers because they influence:

• the granularity and timing of public Mutual Evaluation Reports (MERs) and Follow‑Up Reports (FURs);
• the FATF‑approved scope for re‑ratings of technical compliance; the expectations placed on jurisdictions to demonstrate improvements; and
• the way unresolved or inconsistent findings are escalated and corrected.

The procedures formalise a stronger emphasis on risk‑based scoping and a clearer division of labour between technical compliance (laws, regulations, rules) and effectiveness (the 11 Immediate Outcomes). That emphasis shapes what assessors will request, what countries must provide, and the types of operational evidence that carry weight.

Risk‑based scoping, and why it changes the on‑site focus

A central change reinforced in the Universal Procedures is the requirement that mutual evaluations be risk‑and‑context driven from the outset. Assessment teams conduct a scoping exercise early in the timetable, informed by the jurisdiction’s own risk assessment(s), prior MER and follow‑up submissions, and external input from other jurisdictions with experience of international cooperation. The scoping note must identify areas for increased or reduced focus and explain the risk‑based rationale. For financial crime practitioners the practical consequence is twofold:

• first, the on‑site agenda is much more likely to concentrate on specific sectors, typologies or institutional weaknesses that the scoping exercise highlights;
• second, firms should expect targeted requests for operational data and case examples relevant to the scoped issues rather than generic documentary packs.

Technical compliance – process for reviews and re‑ratings

Technical compliance remains a formal, desk‑based component. The procedures reiterate that jurisdictions are assessed against the FATF Standards and the Methodology in force on the date their technical compliance submission is due. For follow‑up and re‑ratings, jurisdictions are assessed against the Methodology in force when their follow‑up submission is due. The FATF requires countries to seek re‑ratings for Recommendations previously scored NC (non compliant) or PC (partially compliant), and will also review compliance with Recommendations that were amended since the country’s original submission.

The practical step sequence for technical compliance is explicit:

• the Secretariat issues a Technical Compliance (TC) questionnaire;
• the country submits a completed TC update with supporting laws and evidence;
• the assessment team conducts a detailed review, circulates a first draft TC Annex, then a second draft with preliminary ratings, and engages with the country on outstanding matters.

Follow‑up experts analyse any re‑rating requests as part of the enhanced follow‑up review and their analyses go to delegations for comment before Plenary approval. For regulated firms, this means that any legislative or regulatory changes in a jurisdiction – new suspicious‑activity reporting rules, changes to beneficial ownership regimes, or amended VASP licensing rules – are the specific elements that can drive re‑ratings and appear in public outputs.

Bastian Schwind-Wagner _Follow

"The Universal Procedures make clear that mutual evaluations are driven by risk and evidence – jurisdictions and private‑sector entities must be ready to provide operational data and targeted case examples that demonstrate outcomes. Timely coordination with national authorities and proactive documentation of STRs, investigations and cross‑border cooperation materially affect how assessors judge effectiveness and technical compliance.

For firms, the practical priority is preparation: map your data to the 11 Immediate Outcomes, ensure designated operational staff can respond during on‑site sessions, and keep track of national timelines for follow‑up and potential re‑ratings. Clear, concise submissions that link actions to measurable results reduce uncertainty and help mitigate reputational and commercial risk."

Effectiveness gets priority in planning and reporting

Although technical compliance is necessary, the Universal Procedures continue to elevate assessment of effectiveness. Countries must present evidence mapped to the 11 Immediate Outcomes well in advance of the on‑site visit. The team’s scoping exercise and the on‑site programme will focus on the core issues within those Immediate Outcomes. Assessors look for concrete operational outputs – investigations, prosecutions, asset recoveries, cross‑border cooperation, STR flows and use of financial intelligence – and will request case studies and statistics that demonstrate outcomes by the end of the on‑site. For private‑sector compliance teams, that raises the importance of supporting supervisors and authorities with clear, well‑documented STR submissions and engagement that shows how private‑sector reporting feeds into operational results.

On‑site logistics and private‑sector engagement

The procedures provide practical expectations: an on‑site will typically last 13–16 working days, normally including nine to ten days of meetings and several days for assessors to draft and agree preliminary findings. Delegations from financial institutions, DNFBPs and VASPs will be expected to attend – often as grouped sessions alongside sector associations – and assessors will seek private meetings with operational staff and compliance officers. Jurisdictions are required to facilitate interpreters and to ensure confidentiality and secure meeting environments. Firms should therefore plan for prompt engagement when national authorities seek private‑sector input and ensure that operational staff can speak candidly about implementation challenges without fear of public attribution.

Follow‑up: regular vs enhanced vs ICRG

The Universal Procedures clarify the three follow‑up tracks.

Regular follow‑up is the default and is a lighter‑touch self‑assessment reported roughly three years after the MER.

Enhanced follow‑up applies where major improvements are needed – numerical thresholds include five or more PC ratings or one or more NC ratings – and involves independent analysis by follow‑up experts of progress against the Key Recommended Actions (KRA) Roadmap and any TCRR requests.

The FATF International Co-operation Review Group (ICRG) is reserved for jurisdictions with systemic or fundamental problems and operates under FATF leadership; ICRG reviews restrict which KRA items are handled by follow‑up experts and can impose more intensive monitoring.

For compliance officers, the key message is that a jurisdiction’s MER rating drives the intensity of ongoing international scrutiny and the timing of reporting obligations. If a jurisdiction is in enhanced follow‑up or ICRG, expect more frequent and more demanding engagement by assessors and potentially an elevated risk that financial partners or counterparties will apply enhanced due diligence.

KRA, ratings and escalation measures

The procedures set a four‑point KRA rating scale (Fully addressed, Largely addressed, Partly addressed, Not addressed) and require follow‑up experts to use that scale when assessing progress. There are explicit thresholds and escalation steps if KRAs are not addressed: high‑level missions to verify political commitment, public FATF/FSRB statements, and, in extreme cases, consideration of suspension of membership. The consequences for jurisdictions can extend beyond reputational damage into practical commercial risk, including enhanced due diligence by correspondent banks and constrained access to international finance.

Quality and consistency – pre‑ and post‑Plenary reviews

To protect consistent application of the Standards, the Universal Procedures formalise multiple quality‑assurance stages: Mutual Evaluation (ME) reviewers perform a pre‑Plenary quality and consistency (Q&C) review (usually three reviewers), and a post‑Plenary Q&C process exists for exceptional circumstances where significant issues are identified after adoption. The Evaluation and Compliance Group (ECG) co‑chairs and the full Plenary may be asked to resolve fundamental issues of misapplication or major inconsistencies. That means that public MERs and executive summaries represent a thoroughly‑vetted product; conversely, significant concerns raised by peers can still delay publication or trigger revisions.

What firms should do now – practical checklist

The Universal Procedures should be used by regulated entities and advisers to inform their compliance and engagement strategies.
Key actions include:

1. Monitor country MER and follow‑up timelines: know when your jurisdiction will be reviewed and whether it is in regular, enhanced or ICRG follow‑up. That determines likely scrutiny levels and timing of public reports.
2. Prepare operational evidence proactively: capture and document STR submission metrics, case referrals, investigative outcomes and examples showing how your firm’s compliance processes contributed to an outcome. Assessors prize operational evidence tied to the Immediate Outcomes.
3. Coordinate with national authorities: ensure authorities have timely and sector‑specific data (including on VASPs and DNFBPs if relevant) for the technical compliance questionnaire and the effectiveness submissions; speed matters in the fixed timelines.
4. Expect focused on‑site questions: if your sector or business model is in scope for increased focus, anticipate targeted requests and ensure staff with operational knowledge can engage confidentially during any on‑site sessions.
5. Track legal and regulatory change: note changes that might justify a re‑rating and prepare clear, criterion‑mapped submissions to support any (Technical Compliance Re-rating) TCRR request.
6. Strengthen cross‑border cooperation practices: FATF will solicit feedback from other jurisdictions on international cooperation experiences – well‑documented mutual legal assistance and timely responses to foreign requests matter.

Conclusion

The Universal Procedures tighten and clarify how mutual evaluations and follow‑up work in practice. For the private sector, the most important operational shifts are the strengthened risk‑based scoping, the elevated emphasis on evidence demonstrating effectiveness, and the formalised timelines and quality controls that make report outcomes more predictable – and publication of MERs and FURs more consequential. Compliance programs that can supply precise, outcome‑oriented evidence and that work closely with national authorities will be better positioned to withstand scrutiny and to limit the commercial and reputational fallout when jurisdictions face intensive follow‑up.

Dive deeper

• FATF ¦ Consolidated Processes and Procedures for Mutual Evaluations and Follow-Up: “Universal Procedures” ¦ Link