The FATF's new priorities: fraud moves to the top of the agenda

At a glance

What happened: the FATF, the global standard setter for anti-money laundering and counter-terrorist financing, has put fraud at the centre of its work for 2026 to 2028. A Roadmap on Combatting Fraud was launched as the United Kingdom took over the FATF Presidency on 1 July 2026.
Why: nearly 90 percent of the countries assessed in the FATF's last evaluation round identified fraud as a major source of criminal proceeds, and the FATF cites an estimate of about USD 500 billion lost to scams in 2024 and 2025.
Three priorities: fraud, including scam compounds and the cross-border networks behind them; a stronger risk based approach and risk based supervision; and better information sharing between public and private sectors, between institutions, and across borders.
Status: the roadmap is a programme of work, not a new rule. Policy proposals on fraud are expected from early 2027, and the strengthened Recommendation 16 on payment transparency is to be implemented by the end of 2030. Supervisors and mutual evaluators are already asking the questions the roadmap raises.

What has changed, and when

When	What the FATF did
February 2025	Amended its Standards so that measures must be "proportionate" to risk, and required countries to allow and encourage simplified measures in lower risk situations. This is the basis for directing effort to the highest risks, which fraud now clearly is.
24 February 2026	Published its paper on cyber-enabled fraud. It describes phishing, AI enabled deepfakes and messaging applications as the tools of the trade, professional launderers using shell companies and mule accounts to move the proceeds, and instant payments and virtual assets as the rails. It points to confirmation of payee, tools to suspend or freeze payments, faster information sharing, and machine learning on transaction data as the measures that work.
February 2026	At its Plenary, committed to focusing on fraud over the coming years.
17 to 19 June 2026	At its Plenary, approved a public consultation on guidance for the strengthened Recommendation 16 on cross-border payment transparency, aimed at predicate crimes "in particular fraud", with comments due by 21 August 2026. Approved a Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements for publication in July 2026.
1 July 2026	The UK Presidency began, running to 30 June 2028, with Giles Thomson as President. The Roadmap 26-28 on Combatting Fraud was launched. It points to the FATF toolkit of "freezing and seizing assets, suspending fraudulent transactions, and enhancing cross-border intelligence sharing", to the financial flows around scam compounds, and to a new private sector consultative group.
What comes next	The first Plenary of the UK Presidency in October 2026. Fraud policy proposals expected in early 2027 and a global event on the response to fraud planned for 2027. Implementation of the revised Recommendation 16 by the end of 2030. Fifth round mutual evaluations that test effectiveness, including against fraud, in each country assessed.

The three priorities, and what they mean for you

Priority	What the FATF intends	What it means for an institution
Fraud	Follow the money from scams to the networks behind them. Make it easier to freeze, seize and recover proceeds, to suspend suspicious payments, and to cooperate across borders. Examine scam compounds and transnational criminal groups.	Fraud proceeds are laundered money. An institution that receives them into mule accounts is part of the laundering chain, whoever the victim banks with. Expect questions about inbound payments, how quickly you can stop a payment, and how you work with other institutions and the authorities.
Risk based approach and supervision	Strengthen implementation of the risk based approach so that institutions and supervisors direct their resources to the highest risks, with simplified measures where risk is low.	Your risk assessment must show fraud by typology, and your controls must be calibrated to it with evidence. Supervisors will ask whether controls work, not whether policies exist. Proportionality cuts both ways: lighter controls where risk is low, stronger controls where it is high.
Information sharing	Improve sharing between public and private sectors, between private institutions, and across borders, with data protection arrangements that make it lawful.	Be ready to receive intelligence and act on it quickly, and to share what you see, for example mule account indicators, through lawful channels. Participation in national public-private partnerships is likely to become an expectation.

Seven things to do first

Put fraud into the enterprise-wide risk assessment as both a predicate offence and a laundering risk, broken down by typology: authorized push payment scams, account takeover, impersonation of banks and officials, investment and romance scams, mule recruitment, and business email compromise.
Look at inbound payments, not only outbound. Identify the accounts that receive fraud proceeds, the signs of a mule account at onboarding and in use, and what happens when another institution or the police tell you that funds you hold are stolen.
Prepare for payment transparency. Check that originator and beneficiary information is complete across your payment chains, and plan for the alignment checks the revised Recommendation 16 introduces to catch misdirected payments. Confirmation of payee, where your market offers it, is the practical first step.
Test how fast you can stop a payment and freeze an account. Rehearse the procedure, including out of hours, measure the time from report to action, and record the result. Recovery rates are a metric supervisors understand.
Join up fraud, AML and cyber. Agree who owns mule accounts, share typologies and intelligence between the teams, and make sure a phishing campaign seen by the security team reaches the fraud team in time. Report fraud-related suspicions to the financial intelligence unit with the detail an investigator needs.
Get ready to share. Establish the legal basis for sharing under your data protection law, the secure channels you will use, and who may authorise it. The FATF overview of partnership and data protection arrangements is a useful reference when you discuss this with legal counsel and your supervisor.
Measure outcomes, not activity. Gross and net losses, the share of fraud your own controls detect before customers report it, time to block, recoveries and customer harm, reported to the board against an agreed appetite. The number of alerts reviewed says little about whether fraud is falling.

Questions for the board

Does our risk assessment identify the fraud typologies that affect our customers and our products, and are controls calibrated to them?
Do we know how much fraud money comes into our institution, and how we detect and close mule accounts?
How quickly can we suspend a payment, freeze an account and return funds, and when did we last test it?
Can we lawfully share and receive intelligence about fraud, and do we take part in a public-private partnership?
Does the board see fraud losses, detection and recovery figures against an appetite, every quarter?

Where the Gulf stands

Central banks in the region moved before the FATF did. The new UAE Central Bank law requires licensed institutions to operate fraud prevention and detection mechanisms, the Qatar Central Bank requires real-time fraud monitoring and a senior fraud review group, and SAMA's Counter-Fraud Framework sets out governance, prevention, detection and response in detail. The FATF agenda adds an international dimension: the next round of mutual evaluations will test whether these requirements work in practice, and institutions will be expected to show that they do. Our article on implementing central bank fraud requirements sets out the regional requirements and how to turn them into controls, metrics and evidence.

Keep in mind

This explainer summarises a programme of work that is still developing. Several of the items above are announcements or consultations rather than final texts, and the FATF's fraud policy proposals are not yet published. Check the FATF website for the current position before relying on any point, and watch for the outcomes of the October 2026 Plenary.

Related terms

Sources

Sources last checked: 20 October 2026. General information, not legal, regulatory or professional advice. Requirements change, so confirm the current text before relying on any point. Spotted an error? Tell us.