When Regulatory Language Shifts: Risk Articulation Gaps Between U.S. and FATF Frameworks

Recent updates to certain U.S. regulatory materials, including revisions to the BSA/AML examination framework, have de-emphasized or removed references to reputational risk.

For institutions operating across multiple jurisdictions, the change introduces a structural issue: risk categories have shifted in U.S. regulatory language, while underlying expectations in FATF-aligned frameworks remain unchanged.

Why It Matters

The removal of reputational risk terminology does not reduce regulatory exposure. It changes how institutions must define, document, and justify risk-based decisions across jurisdictions where regulators and examiners continue to expect consistent, evidence-based analysis.

The divergence becomes more consequential where institutions also face overlapping tax and reporting regimes, including the OECD’s Crypto-Asset Reporting Framework (CARF), which introduce additional cross-border disclosure and documentation obligations without replacing existing AML/CFT expectations.

Key Risks and Issues

• Loss of a shared risk vocabulary across regulatory and international frameworks
• Justification gaps in adverse media and PEP-related decisions
• Cross-border inconsistency in risk classification and documentation standards
• Misalignment between regulatory expectations and examiner assessment practices
• Fragmentation across AML/CFT, tax, and reporting obligations

Assessing Current Frameworks

Institutions should evaluate whether current frameworks can support consistent interpretation and examination across jurisdictions where language and expectations diverge, particularly where AML/CFT, tax, and reporting obligations intersect.

The failure point is typically not the decision, but the supporting record.

Common vulnerabilities include:

• Documentation that reflects conclusions without underlying analytical support
• Adverse media and PEP decisions tied to legacy terminology rather than defined risk factors
• Inconsistent application of risk standards across jurisdictions
• Gaps between AML/CFT controls and tax or reporting frameworks

Legacy terminology introduces a specific examination risk. Where decision records rely on generalized references such as reputational risk, they may not clearly demonstrate how identified facts map to defined regulatory obligations. Examiners do not assess terminology. They assess whether the reasoning behind a decision is evidenced and consistent with applicable requirements. Where that linkage is not explicit, otherwise sound decisions become difficult to support under examination.

Implications for Decision Records

• Risk articulation must be anchored in defined regulatory obligations rather than legacy terminology, particularly where adverse media and PEP exposure are concerned
• Decision records must support reconstruction of reasoning in a manner consistent with FATF-informed expectations and U.S. examination standards
• Cross-border frameworks require alignment to the highest applicable standard, not the most permissive articulation of risk
• Tax and reporting regimes, including CARF, introduce additional documentation expectations that intersect with AML/CFT risk assessment without replacing it
• Governance structures must ensure consistency between stated risk appetite, decision-making, and supporting documentation across jurisdictions

In practice, aligning to the most demanding regulatory framework requires reference to specific obligations rather than generalized standards. FATF Recommendation 12 requires enhanced due diligence for politically exposed persons, including senior management approval, measures to establish source of wealth, and enhanced ongoing monitoring of the relationship. FATF Recommendation 19 addresses higher-risk countries and requires enhanced due diligence, and in appropriate cases countermeasures, in response to country risk. The FinCEN Customer Due Diligence Rule, including 31 CFR § 1010.230, requires covered institutions to identify and verify beneficial owners of legal entity customers and maintain risk-based due diligence procedures that support ongoing monitoring. OFAC guidance focuses on risk-based identification, assessment, control, and recordkeeping for sanctions-related exposure across jurisdictions.

Closing Statement

Institutions that can clearly evidence the reasoning behind risk-based decisions across regulatory and tax regimes are better positioned to defend those decisions under examination and in subsequent legal or regulatory proceedings.