FATF and GAFILAT

In short

The FATF, the Financial Action Task Force (GAFI in Spanish), is the intergovernmental body that issues the international standard against money laundering and terrorist financing. That standard is the 40 Recommendations.

GAFILAT, the Financial Action Task Force of Latin America, is the FATF system's regional body for much of Latin America, with its own membership: it applies the same standard across Latin America and evaluates the countries that belong to it.

What's worth understanding before anything else: neither one regulates companies. The FATF issues recommendations and evaluates countries. What obligates a specific organization is the national law its country enacted to comply with that standard.

What the FATF does and doesn't do

The FATF produces three things, and all three are aimed at states.

• The 40 Recommendations — the international standard on the matter. They define what a country must require: identifying customers, keeping records, reporting suspicious transactions, supervising exposed sectors and cooperating with other jurisdictions.
• Mutual evaluations — peer reviews that examine a country on two levels: whether its regulatory framework reflects the standard and whether it also works in practice. A country can have the law on the books and still score poorly because it doesn't apply it.
• The public identification of jurisdictions with strategic deficiencies — the mechanism through which the FATF flags countries whose regimes show significant gaps. The review process is run by the International Co-operation Review Group (ICRG), and the stage where the result is made public is called Public Identification.

The two lists have official names, and they aren't the ones the market uses:

• Jurisdictions under Increased Monitoring — jurisdictions that made a high-level commitment to resolve their deficiencies within agreed timeframes and remain subject to follow-up.
• High-Risk Jurisdictions subject to a Call for Action — high-risk jurisdictions, for which the FATF calls for enhanced due diligence and, in the most severe cases, countermeasures.

"Gray list" and "black list" are common, convenient, widely used names, but they aren't the official ones and they don't clearly distinguish the consequences of one from the other.

What the FATF doesn't do matters just as much. It doesn't supervise entities, doesn't receive suspicious transaction reports, doesn't authorize or license anyone, and can't sanction a company. An organization never answers to the FATF: it answers to its national supervisor.

GAFILAT doesn't write its own standard, it implements it in the region

GAFILAT is one of the FATF system's regional bodies, the one covering much of Latin America. Much of the Caribbean belongs to another regional body, though not all of it: some Caribbean countries are part of GAFILAT.

Its role isn't to write a Latin American standard, but to bring the global standard into regional practice, and that's more than a translation. GAFILAT adheres to the 40 Recommendations and implements them in the region, participates as an associate member of the FATF itself, and produces its own guidance, technical assistance, evaluations and reports.

In concrete terms: it evaluates its member countries with the same methodology, follows up on the action plans that come out of those evaluations, and publishes regional typologies, descriptions of how money is laundered in this part of the world and not in another.

That last piece is the most underrated. The standard is one, but the methods aren't, and that regional work is what explains why the region's rules focus where they do.

Two facts that help place it. The body was born on December 8, 2000 as GAFISUD, the Financial Action Task Force of South America, and changed its name to GAFILAT when countries from Central America and the Caribbean joined, so the name would reflect its wider geography. Today it's made up of 18 member countries (verified as of August 2026). This page deliberately doesn't list them: the list changes, and an outdated enumeration ages worse than the concept.

How a FATF recommendation reaches your onboarding process

The chain has four links, and it explains almost everything a compliance team runs into day to day.

• The FATF issues the recommendation — for example, that countries require identifying and knowing the customer before establishing a relationship.
• The country writes it into its law — with its own legislative technique, its own thresholds and its own sectoral scope.
• A supervisor enforces it — and this is where the practical difference between countries shows up, because it isn't always the same body, nor with the same powers.
• The obligated organization carries it out — and has to be able to prove that it did.

That path is why the region's regimes resemble each other without being identical. In Colombia the standard is expressed through the SARLAFT that the Financial Superintendence requires from its supervised entities. In Mexico it's expressed in the anti-money-laundering law, which also reaches a broad catalog of activities outside the financial system. In Brazil it's expressed through the prevention duties placed on regulated institutions.

Same root, three drafts, three supervisors. Whoever operates in several countries in the region doesn't face three different philosophies: it faces the same requirement with three implementations.

A FATF evaluation is not an audit of your company

Two common confusions are worth clearing up together.

The first: a country being flagged for strategic deficiencies is not a sanction against that country's companies. It's a rating of the national regime. The effect on organizations arrives through a different path, because their counterparts abroad start treating them as higher risk and asking for more evidence.

The second: the FATF's jurisdiction lists are not **watchlists**. The former rate countries. The latter identify specific people and entities, and are what a customer gets screened against at sign-up. They come up in the same conversation and aren't consulted the same way or carry the same consequence.