29 November 2025
FATF ¦ IO11 PF Financial Sanctions
Immediate Outcome 11: Preventing the Financing of Weapons of Mass Destruction
Immediate Outcome 11 (IO11) focuses on preventing persons and entities involved in the proliferation of weapons of mass destruction (WMD) from raising, moving or using funds, in line with the United Nations Security Council Resolutions (UNSCRs). This outcome sits at the intersection of Recommendation 7 (targeted financial sanctions for proliferation financing) and elements of Recommendations 1, 2 and 15, which cover risk-based approaches, national risk assessment, and supervision and enforcement. IO11 does not address proliferation risk in a general sense; it is narrowly concerned with risks of breaches, non-implementation or evasion of targeted financial sanctions obligations described in R.7.
Coordination and cooperation among competent authorities
A core determinant of effectiveness under IO11 is whether competent authorities meaningfully cooperate and coordinate both policy development and operational activity. The FATF methodology expects jurisdictions to demonstrate structures or mechanisms — formal or informal — that enable timely sharing of information, joint risk assessment and coordinated operational responses. These mechanisms should include all relevant authorities involved in sanctions listing, law enforcement, financial intelligence, supervision, foreign affairs and customs, and where relevant the entities responsible for DNFBPs, VASPs and beneficial ownership registries. Evidence of sustained engagement at both senior policy and operational levels (for example regular multi-agency fora, joint task forces or permanent inter-agency groups) strengthens confidence that a country can both design and implement effective counter-proliferation financing measures.
Risk identification, assessment and mitigation
Assessing IO11 requires examining how well a country has identified, assessed and understood risks of potential breaches, non-implementation or evasion of targeted financial sanctions, and whether risk-based measures have been deployed to mitigate those risks. The FATF methodology expects jurisdictions to produce coherent PF risk assessments and to use robust information sources and analytical methods when doing so. Assessors will not re-evaluate whether the identified PF risks are “correct” but will judge the reasonableness and thoroughness of the country’s processes, the comprehensiveness of data used, and the degree to which senior officials and policymakers are engaged.
Risk assessments should consider both high- and low-risk scenarios and incorporate indicators such as use of front companies, trade-based evasion, misuse of legal persons and arrangements, transnational channels and exploitation of gaps in VASP oversight. Effective mitigation includes supervisory priorities, targeted outreach, tailored guidance to reporting entities, proportionate measures for sectors or actors presenting higher PF vulnerability, and the ability to adapt measures to evolving threats.
Timely and full implementation of targeted financial sanctions
A central pillar of IO11 is whether targeted financial sanctions lists derived from relevant UNSCRs are implemented without delay and in full. That requires clear national procedures for timely transposition of UNSCR designations into domestic lists, prompt communication of designations to regulated sectors, and mechanisms for immediate freezing of assets and funds of designated persons or entities. Assessors will look for demonstrable timelines — for example how quickly a jurisdiction freezes assets after a UNSC designation — and the operational chain that ensures freezing measures reach account-holding institutions, DNFBPs and VASPs without avoidable delay.
Equally important are procedures for de-listing, unfreezing and for issuance of authorisations or licences that comply with UNSCR requirements while safeguarding legitimate rights (including due process and human-rights considerations). Effective systems include clear legal bases for freezing, standardised notice and reporting mechanisms to reporting entities, and domestic rules or guidance to avoid legal or operational impediments to immediate action (such as cumbersome internal approval requirements or unclear data-sharing restrictions).
Detection, disruption and enforcement against designated persons and their networks
IO11 evaluates how well jurisdictions identify and prevent designated persons and entities — or those acting on their behalf — from conducting transactions or continuing operations. This requires effective identification of accounts, assets and transaction pathways used by designated targets, and the ability to take enforcement or investigative action where breaches occur. Examples of strong performance include timely investigations of sanctions-breach allegations, freezing or of assets, prosecutions or administrative sanctions where appropriate, and mutual legal assistance or asset recovery actions that demonstrate the reach of domestic measures.
Authorities’ capacity to obtain accurate basic and beneficial ownership information on legal persons and arrangements is critical. Front companies and opaque ownership structures are common tools in proliferation financing; the ability of competent authorities to pierce corporate veils quickly for investigative or freezing purposes materially improves effectiveness.
Private sector understanding, compliance and supervisory oversight
Financial institutions, DNFBPs and VASPs are frontline implementers of targeted financial sanctions. IO11 examines whether these sectors understand their obligations, can identify designated persons and entities, and are able to take timely action — freezing transactions, filing required reports, and refusing transactions that would contravene UNSCRs. Effective jurisdictions provide targeted guidance, outreach and feedback to reporting entities and maintain supervisory programmes that monitor compliance and apply proportionate sanctions for breaches.
Supervisors and competent authorities should show evidence of active monitoring: frequency of inspections or reviews, thematic assessments focused on PF vulnerabilities, tailored outreach initiatives, and enforcement actions when non-compliance is found. VASPs and emerging technology sectors should feature explicitly in guidance and supervision where they present PF risk.
Intelligence exchange, information-sharing and resources
Effective PF countermeasures depend on routine intelligence exchange among domestic agencies and, where relevant, with international partners. IO11 expects to see mechanisms for sharing operational intelligence, financial intelligence (FIU products), supervisory findings and strategic risk analysis. The quality and timeliness of this information exchange underpin investigations, freezing action and sanctions enforcement. Assessors will also consider whether competent authorities have adequate resources — human, technical and legal — to manage PF-related workstreams, including the capacity to maintain and query beneficial ownership data, carry out complex financial investigations and support international cooperation.
Monitoring, review and proportionality
Jurisdictions should have monitoring systems to review compliance and the effectiveness of their targeted sanctions implementation. This includes periodic reviews of how designations are communicated and enforced, the efficacy of freezing and licensing arrangements, and whether mitigation measures remain proportionate to identified risks. Safeguards to protect legitimate humanitarian, legal and human-rights needs — such as clear licensing processes and safeguards against misuse — are an important part of demonstrating a balanced, rights-conscious approach.
Practical indicators of success and common shortcomings
Positive indicators that IO11 is being achieved include documented cases of timely asset freezes following UNSCR listings, robust inter-agency coordination mechanisms with regular policy and operational engagement, detailed PF risk assessments informing targeted supervisory activity, and demonstrable enforcement outcomes for breaches. Conversely, common shortcomings seen in assessments include delays in transposing UNSCR designations into domestic lists, weak or inconsistent communication to DNFBPs and VASPs, limited supervisory focus on proliferation financing, gaps in beneficial ownership access, and insufficient resourcing of key agencies.
Conclusions and priorities for improvement
Meeting IO11 requires a combination of clear legal frameworks, timely operational procedures, strong inter-agency cooperation, informed and supervised private sector compliance, and sufficient resourcing. Priorities for improvement typically include strengthening mechanisms for rapid domestic implementation of UNSCR listings, enhancing supervision and guidance for DNFBPs and VASPs, improving access to accurate beneficial ownership information, institutionalising regular intelligence sharing, and ensuring proportional safeguards for legitimate transactions. Countries that align these components reduce the ability of proliferators to access financial channels and strengthen global compliance with UNSCR-mandated sanctions.
For policymakers and practitioners focused on AML/CFT/CPF, IO11 is a focused but essential measure of how well national systems prevent financial support for WMD proliferation. It tests not only legal conformity with UNSCRs but also the operational agility and cooperative structures necessary to translate designations into immediate, effective prevention on the ground.
FATF Ratings Overview
Luxembourg ¦ FATF Effectiveness & Technical Compliance Ratings
Anti-money laundering and counter-terrorist financing measures
Luxembourg Mutual Evaluation Report, September 2023
This assessment was adopted by the FATF at its June 2023 Plenary meeting and summarises the anti-money laundering and counter-terrorist financing (AML/CFT) measures in place in Luxembourg as at the date of the on-site visit: 2-18 November 2022.
Table 1. Effectiveness Ratings
Note: Effectiveness ratings can be either a High- HE, Substantial- SE, Moderate- ME, or Low – LE, level of effectiveness.
IO1 Risk, policy and coordination
Money laundering and terrorist financing risks are identified, assessed and understood, policies are co-operatively developed and, where appropriate, actions co-ordinated domestically to combat money laundering and the financing of terrorism.
Substantial
IO2 International cooperation
International co-operation delivers appropriate information, financial intelligence and evidence, and facilitates action against criminals and their property.
Substantial
IO3 Supervision
Supervisors appropriately supervise, monitor and regulate financial institutions and VASPs for compliance with AML/CFT requirements, and financial institutions and VASPs adequately apply AML/CFT preventive measures, and report suspicious transactions. The actions taken by supervisors, financial institutions and VASPs are commensurate with the risks.
Moderate
IO4 Preventive measures
Supervisors appropriately supervise, monitor and regulate DNFBPs for compliance with AML/CFT requirements, and DNFBPs adequately apply AML/CFT preventive measures commensurate with the risks, and report suspicious transactions.
Moderate
IO5 Legal persons and arrangements
Legal persons and arrangements are prevented from misuse for money laundering or terrorist financing, and information on their beneficial ownership is available to competent authorities without impediments.
Substantial
IO6 Financial intelligence
Financial intelligence and all other relevant information are appropriately used by competent authorities for money laundering and terrorist financing investigations.
Substantial
IO7 ML investigation & prosecution
Money laundering offences and activities are investigated, and offenders are prosecuted and subject to effective, proportionate and dissuasive sanctions.
Moderate
IO8 Confiscation
Asset recovery processes lead to confiscation and permanent deprivation of criminal property and property of corresponding value.
Moderate
IO9 TF investigation & prosecution
Terrorist financing offences and activities are investigated and persons who finance terrorism are prosecuted and subject to effective, proportionate and dissuasive sanctions.
Substantial
IO10 TF preventive measures & financial sanctions
Terrorists, terrorist organisations and terrorist financiers are prevented from raising, moving and using funds.
Moderate
IO11 PF financial sanctions
Persons and entities involved in the proliferation of weapons of mass destruction are prevented from raising, moving and using funds, consistent with the relevant UNSCRs.
Moderate
Table 2. Technical Compliance Ratings
Note: Technical compliance ratings can be either a C – compliant, LC – largely compliant, PC – partially compliant or NC – non compliant.
R.1 Assessing Risks and applying a Risk-Based Approach
C – compliant
R.2 National Co-operation and Co-ordination
C – compliant
R.3 Money laundering offence
C – compliant
R.4 Confiscation and provisional measures
LC – largely compliant
R.5 Terrorist financing offence
C – compliant
R.6 Targeted financial sanctions related to terrorism and terrorist financing
LC – largely compliant
R.7 Targeted financial sanctions related to proliferation
LC – largely compliant
R.8 Non-profit organisations
PC – partially compliant
R.9 Financial institution secrecy laws
C – compliant
R.10 Customer due diligence
C – compliant
R.11 Record-keeping
C – compliant
R.12 Politically exposed persons
C – compliant
R.13 Correspondent banking
C – compliant
R.14 Money or value transfer services (MVTS)
C – compliant
R.15 New technologies
LC – largely compliant
R.16 Payment transparency
C – compliant
R.17 Reliance on third parties
C – compliant
R.19 Higher-risk countries
C – compliant
R.20 Reporting of suspicious transactions
C – compliant
R.21 Tipping-off and confidentiality
C – compliant
R.22 DNFBPs: Customer due diligence
C – compliant
R.23 DNFBPs: Other measures
C – compliant
R.24 Transparency and beneficial ownership of legal persons
LC – largely compliant
R.27 Powers of supervisors
C – compliant
R.28 Regulation and supervision of DNFBPs
C – compliant
R.29 Financial intelligence units
C – compliant
R.30 Responsibilities of law enforcement and investigative authorities
LC – largely compliant
R.32 Cash Couriers
LC – largely compliant
R.33 Statistics
LC – largely compliant
R.34 Guidance and feedback
C – compliant
R.35 Sanctions
LC – largely compliant
R.36 International instruments
LC – largely compliant
R.37 Mutual legal assistance
C – compliant
R.38 Mutual legal assistance: freezing and confiscation
C – compliant
R.39 Extradition
C – compliant
R.40 Other forms of international co-operation
LC – largely compliant