FATF ¦ R.26 Reg­u­la­tion and Su­per­vi­sion of Fi­nan­cial In­sti­tu­tions

Recommendation 26: Strengthening Regulation and Supervision of Financial Institutions

Recommendation 26 requires countries to make sure financial institutions are properly regulated and supervised so they implement the FATF standards effectively. The core aim is to prevent criminals, their associates, or shell banks from controlling or hiding ownership of financial institutions, and to ensure that institutions which pose higher risks receive proportionate regulatory attention. In short, Recommendation 26 ties prudential regulation to anti–money laundering and counter‑terrorist financing (AML/CFT) outcomes and demands that supervisors use resources where they matter most.

Risk-based supervision: focus and flexibility

The interpretive note clarifies that supervision should follow a risk-based approach. That means supervisors must understand the domestic and international money laundering and terrorist financing threats and allocate their efforts accordingly. A risk-based approach has two linked meanings: first, a general allocation of supervisory resources informed by a country’s risk picture; second, targeted supervision of institutions that themselves apply risk-based AML/CFT controls. Supervisors should therefore shift attention and more intensive on-site work to institutions, business lines, customers or products that present higher risks.

Supervisors need access to comprehensive information on the specific risks associated with an institution’s customers, products, services and the quality of its compliance function. The frequency and intensity of on-site and off-site supervision should reflect each institution’s risk profile and the national risk environment. Importantly, risk assessments are not one-off. Supervisors must review an institution’s risk profile periodically and whenever significant events or changes in management, ownership, or operations occur. Supervisory activity must be dynamic and responsive as threats evolve and as institutions exercise discretion under a risk-based approach.

Applying prudential measures to AML/CFT

For institutions covered by the Basel Core Principles (BCP), Recommendation 26 requires that prudential regulatory and supervisory tools relevant to money laundering and terrorist financing be applied similarly for AML/CFT. This includes using consolidated group supervision so that risks and controls are assessed at the group level and cross-border vulnerabilities are captured. In other words, a strong prudential regime should be harnessed to detect and deter illicit finance, and supervisors should align their AML/CFT work with existing prudential oversight.

Bastian Schwind-Wagner_Follow

"Recommendation 26 requires supervisors to allocate attention and resources according to the assessed money laundering and terrorist financing risks, and to review those assessments periodically or when major changes occur. This approach ensures higher-risk institutions receive more intensive on-site and off-site scrutiny while allowing lower-risk entities proportionate oversight.

Effective implementation depends on legal powers, adequate resourcing, and operational independence for supervisors, together with robust licensing, disclosure and group-level oversight to prevent criminal control and shell banks. When regulators and industry align prudential and AML/CFT regimes, the financial system is better protected against misuse and systemic vulnerabilities are reduced."

Licensing and supervision for other financial sectors

The standard also covers other financial sectors beyond banks and major deposit-takers. Non-core financial institutions must be licensed or registered, subject to regulation, and monitored for AML/CFT risks proportionate to the threat they pose. At minimum, providers of money or value transfer services (MVTS) and currency exchange services must be licensed or registered and placed under effective monitoring systems to ensure compliance with national AML/CFT rules. This prevents regulatory gaps that criminals could exploit by moving activities into less supervised corners of the financial system.

Preventing criminal control and shell banks

Recommendation 26 obliges competent authorities to take legal or regulatory measures to stop criminals, their associates, or hidden beneficial owners from holding significant or controlling interests or management roles in financial institutions. Countries must also refuse to authorize the establishment or continued operation of shell banks, and should not permit institutions that lack a physical presence and adequate supervision to operate. These measures protect the integrity of ownership and management structures and reduce the risk that financial institutions will be misused to launder proceeds or finance terrorism.

Resourcing and independence of supervisors

Effective supervision requires properly resourced authorities. The interpretive note emphasizes adequate financial, human and technical resources, professional standards, confidentiality safeguards, and staff integrity. Supervisory bodies must enjoy operational independence and autonomy to act without undue influence. Where supervisors lack capacity or independence, even clear rules will fail to produce meaningful AML/CFT protection.

Supervisory approach to institutions’ internal controls

Supervisors should scrutinize whether institutions’ AML/CFT policies, controls and procedures are adequate and properly implemented. Where institutions are allowed discretion under a risk-based approach, supervisors must assess the underlying risk assessments that justify that discretion and the effectiveness of internal controls that result. This supervisory oversight must consider institution characteristics such as size, diversity, complexity and the number of entities in a group.

Practical implications for policymakers and supervisors

Policymakers must ensure legal frameworks empower supervisors to: license and refuse unsuitable applicants, require disclosure of beneficial ownership, remove unfit directors, and close or deny authorization to shell banks. Supervisors should adopt methodologies for profiling institutions by risk and for conducting proportionate on-site and off-site work. They should also coordinate with other domestic and foreign authorities to capture cross-border risks and apply consolidated supervision where relevant.

For industry, Recommendation 26 reinforces that compliance cannot be siloed from prudential governance. Boards and senior management must maintain robust AML/CFT frameworks, invest in controls and risk assessments, and be transparent about beneficial ownership and governance arrangements. Firms should expect targeted supervisory scrutiny based on their risk profiles and changes in their operations or ownership.

Conclusion

Recommendation 26 links strong regulation and supervision with effective AML/CFT outcomes. It demands a risk-sensitive supervisory model, adequate resourcing and independence for supervisors, and concrete measures to prevent criminals and shell banks from gaining control of financial institutions. Properly implemented, these measures reduce opportunities for misuse of the financial system and strengthen trust in financial markets.

Dive deeper

• FATF ¦ The FATF Recommendations ¦ Link
• FATF ¦ Luxembourg’s measures to combat money laundering and terrorist financing ¦ Link