Chapter 1 · Introduction to Financial Crime & the International Response

"Financial crime" isn't a single offence — it's a category. Any modern AML/CFT programme must address all of the following:

• Money laundering (ML)
• Terrorist financing (TF)
• Bribery and corruption
• Fraud
• Tax evasion
• Insider dealing / market abuse
• Sanctions evasion
• Cybercrime and cryptoasset-enabled crime (growing rapidly)

A firm cannot say "we do AML" and ignore sanctions or bribery. Regulatory frameworks (UK MLR, EU MLDs, FATF Recommendations) explicitly cover the whole spectrum.

The IMF's widely-cited estimate: money laundering globally runs at 2-5% of global GDP, roughly $1.6-4 trillion per year. FATF, UNODC and the IMF all use figures in this range.

Impossible to measure precisely — successful laundering is undetected by definition. The UNODC 2011 study is the standard citation. Treat "2-5% of GDP" as an exam-ready number.

Firm-level: regulatory fines, criminal prosecution, licence revocation, remediation cost, reputational damage, loss of correspondent banking, de-banking by counterparties. Recent benchmark cases:

• HSBC — $1.9bn (2012, Mexico cartel)
• BNP Paribas — $8.9bn (2014, sanctions)
• Danske Bank — €2bn+ (2018-22, Estonia branch)
• NatWest — £264m (2021, first UK bank criminal ML conviction)
• Binance — $4.3bn (2023)

Individual-level: criminal prosecution (years of imprisonment), regulatory bans, civil claims, loss of professional membership, career-ending damage. SMCR-style regimes attach personal accountability to Senior Managers even where they did not directly participate — Thomas Borgen (ex-Danske Estonia CEO), various former Deutsche Bank compliance heads.

The Financial Action Task Force (FATF) was established in 1989 by the G7 summit in Paris. Originally focused on drug-related money laundering, its mandate was expanded twice:

• Post-9/11 (2001) — added terrorist financing (TF)
• Post-2012 — added proliferation financing (WMD)

Headquartered at OECD offices in Paris — but independent of OECD. Membership: 40+ jurisdictions plus two regional organisations.

The current FATF standards are the "40 Recommendations" (revised 2012, updated periodically). Timeline:

FATF mutual evaluations now assess each country on two dimensions:

1. Technical compliance with the 40 Recommendations — are the laws/regulations actually in place?
2. Effectiveness across 11 Immediate Outcomes — do they work in practice? E.g. is money actually being confiscated? Are prosecutions happening? Do firms actually stop suspicious activity?

The 11 Immediate Outcomes cover: risk understanding, international cooperation, supervisory action, preventive measures, TF investigation, sanctions implementation, etc. This post-2013 two-dimensional methodology is critical — many countries had "on paper" compliance but poor effectiveness.

Greylisting has real teeth: correspondent banks charge more or de-risk, compliance costs rise, sovereign credit ratings may be affected. Removal requires demonstrating effectiveness improvements over ~2 years of on-site visits.

FATF operates globally through 9 FATF-Style Regional Bodies (FSRBs), together reaching ~200 jurisdictions. Learn the names — exam-tested.

The direction of travel: each MLD has EXPANDED scope and TIGHTENED requirements.

Post-workbook: the AMLR + AMLA package. The EU is now consolidating into an Anti-Money Laundering Regulation (AMLR) with direct effect + an Anti-Money Laundering Authority (AMLA, operational 2025). Represents a shift from Directive (transposed differently per Member State) to Regulation (uniform). Biggest EU AML reform in decades.

FATF was established (1989) partly to help implement Vienna 1988. Palermo broadened the ML criminalisation base beyond drugs. UNCAC brought corruption into the same framework.

UN Security Council sanctions imposed under Chapter VII of the UN Charter are binding on all UN member states and implemented via national law (UK: OFSI). Current regimes:

• Al-Qaida / ISIL (Da'esh)
• North Korea (DPRK)
• Iran (nuclear, reduced under JCPOA)
• Libya, Sudan, Somalia
• Plus various individuals + entities

Beyond UN sanctions: individual countries (US OFAC, EU, UK OFSI) impose their OWN autonomous sanctions — often more extensive than UN measures. Firms must screen against multiple lists.

UK AML supervision is fragmented across:

• FCA — banks, investment firms, insurers under FSMA
• HMRC — money service businesses, high-value dealers, TCSPs, letting/estate agents
• OPBAS (Office for Professional Body AML Supervision, 2018) — oversees ~22 professional-body AML supervisors for lawyers, accountants
• SRA, ICAEW, etc. — supervise their own members

FATF has repeatedly criticised this fragmentation as a UK weakness.

Enforcement is fragmented across FinCEN + banking regulators + DOJ + OFAC (sanctions).

Anchor statute: Federal Decree-Law No. 20 of 2018 (amended by Federal Decree-Law 26/2021). Implementing regulations: Cabinet Decision 10/2019.

Supervisory role split across:

• Central Bank of the UAE
• Securities and Commodities Authority (SCA)
• DFSA / FSRA for the free zones (DIFC / ADGM)

UAE greylisted March 2022 → removed February 2024. Removal followed major reforms: dedicated FIU, sanctions screening, DNFBP supervision, enforcement statistics, beneficial-ownership register. Post-removal, UAE remains under scrutiny — GCC candidates should be able to speak to this trajectory.

The risk-based approach (RBA) emerged progressively — but the pivotal moment was the 2012 FATF Recommendations, where Recommendation 1 explicitly required countries to identify, assess and mitigate their national ML/TF risks, and required firms to do the same.

Before this, rules-based (transaction-threshold-driven) approaches dominated — inflexible, easy to game via structuring / smurfing.

RBA operates as a top-down cascade. Each layer informs the next:

1. FATF standards (global baseline)
2. National Risk Assessment (NRA) — country-level, published by governments (UK NRA is by HM Treasury / Home Office)
3. Sector Risk Assessments — industry-level (e.g. FCA thematic reviews)
4. Firm-wide risk assessment — each firm identifies its own risks
5. Customer-level risk rating — each customer scored

Firms must consider the NRA and sector assessments in their own — treating a "high-risk" NRA finding as no risk in your own firm needs justification.

Regulators must supervise the quality of risk assessment, not just its presence — an under-thought RBA is worse than a solid rules-based programme.

The UK Joint Money Laundering Intelligence Taskforce (JMLIT) — launched 2015 — is a public-private partnership between the National Crime Agency and major banks, enabling structured intelligence-sharing on active financial-crime investigations. Globally considered best-practice.

International peers: FinCEN Exchange (US), FinTerra (Australia).

Sharing customer information between firms is constrained by:

• Data protection (GDPR, national privacy laws)
• Tipping-off offences — can't disclose in a way that prejudices investigation
• Commercial sensitivity — banks reluctant to disclose customer lists to competitors
• Liability — sharing wrong info can expose the sharer

Safe harbours exist: UK Economic Crime Plan (2019, 2023), US Section 314(b) of USA PATRIOT Act, EU 6MLD info-sharing provisions.

Modern threat landscape has expanded to include:

• Cybercrime + cyber-enabled crime (ransomware, business email compromise)
• Cryptoasset-enabled crime (mixers, cross-chain bridges, privacy coins) — see [[Ch 7 — Recent Developments]]
• Deepfake + AI-enabled fraud
• Sanctions evasion at scale (post-2022 Russia)
• Trade-based ML — see [[Ch 3 — Sources + methods]]
• NFT wash-trading
• State-sponsored financial attacks (particularly DPRK)
• ESG-related fraud (greenwashing, carbon-credit scams)

Compliance cost: a major global bank typically spends hundreds of millions to low billions per year on AML/CFT — HSBC has publicly disclosed $3bn+ annual financial-crime spend. Includes thousands of analysts + investigators, transaction monitoring, sanctions screening, external assurance, legacy remediation.