Regulatory Hub
The standards and jurisdictional changes that shape control design — the FATF Recommendations, current country listings, and what specific reforms actually require of monitoring, screening, governance and reporting. Every entry points to the primary source, so you can check it rather than take it.
Position as at 19 August 2026.
01 — The standard
Almost every national regime is a local translation of this document.
Risk assessment and the risk-based approach, plus national coordination. R.1 is the Recommendation your enterprise-wide risk assessment has to satisfy, and the one most often cited when a programme's controls are found to be disconnected from the risks it says it faces.
Criminalisation of money laundering in line with the Vienna and Palermo Conventions, and the provisional measures that allow assets to be frozen, seized and confiscated.
TF criminalisation, targeted financial sanctions for terrorism (R.6) and for proliferation (R.7), and non-profit sector risk (R.8). R.6 was strengthened at the June 2026 plenary to protect humanitarian assistance from the unintended consequences of sanctions implementation.
The operational core, and the largest block: customer due diligence (R.10), record-keeping (R.11), PEPs (R.12), correspondent banking (R.13), money value transfer services (R.14), new technologies and virtual assets (R.15), wire transfers (R.16), reliance on third parties (R.17), internal controls and group-wide programmes (R.18), higher-risk countries (R.19), suspicious transaction reporting (R.20–21), and the extension of all of it to DNFBPs (R.22–23).
Transparency of legal persons (R.24) and legal arrangements (R.25). The persistent weak point in mutual evaluations worldwide, and the driver behind registry reform in the EU, the UK and elsewhere.
Risk-based supervision of financial institutions and DNFBPs, the powers and operational independence of the financial intelligence unit, law enforcement and investigative powers, statistics and guidance, and the requirement that sanctions for non-compliance be effective, proportionate and dissuasive (R.35).
Mutual legal assistance, extradition, cross-border freezing and confiscation, and information exchange between supervisors, FIUs and law enforcement.
Technical compliance asks whether the rules exist. Effectiveness asks whether anything happens because of them.
02 — Listings
Reviewed at each plenary — February, June and October.
Unchanged at the June 2026 plenary.
Two added and two removed on 19 June 2026.
The final plenary under the Mexican presidency; the United Kingdom took over on 1 July 2026.
How to use it
Increased monitoring is a country-risk input. It is not a sanctions list, it is not a reject list, and on its own it does not mandate enhanced due diligence everywhere it touches.
The defensible response is to re-run exposure — customers, beneficial owners, counterparties, source of funds, transaction corridors — decide where risk scoring, review cadence or monitoring coverage genuinely changes, and record the reasoning.
Blanket de-risking of a listed jurisdiction is the response hardest to justify afterwards, and the one FATF has consistently warned against.
03 — Jurisdictions
Tracked selectively. The test is whether a change alters what a compliance function has to do.
Proliferation financing enters the Act, including an offence of financing restricted activity. Dealing restrictions now reach any person, inside or outside Malaysia. Supervisors gain administrative monetary penalties, a broadened power to issue directions and standards to reporting institutions and their officers, and the ability to publish enforcement action and its outcome.
A single rulebook replaces the directive patchwork: Regulation (EU) 2024/1624 applies directly in all Member States from 10 July 2027, with Directive (EU) 2024/1640 transposed by the same date. AMLA has been operational in Frankfurt since 1 July 2025 and had a statutory deadline of 10 July 2026 to deliver its first package of technical standards to the Commission.
The AML/CTF regime extends to designated non-financial businesses and professions for the first time: lawyers, conveyancers, accountants, real estate professionals, trust and company service providers, and dealers in precious metals and stones. AUSTRAC enrolment opened on 31 March 2026, with a 29 July 2026 deadline for businesses providing a designated service from commencement.
04 — Sources
Secondary commentary — including this page — is a starting point, not a citation.
Standard setters
Supervisors and authorities
A note on this page
This is general commentary drawn from public regulatory developments, published guidance and industry research. It is written in a personal capacity, contains no confidential or employer-specific information, and is not legal advice.
Regulatory positions move. Always confirm against the issuing authority before relying on anything here — and if something is out of date or wrong, tell me and I will correct it.