Who Pays for Compliance? The Unintended Consequences of Extraterritorial AML Law

In June 2000, the Financial Action Task Force (FATF) published its first list of Non-Cooperative Countries or Territories, identifying fifteen jurisdictions deemed deficient in their anti-money laundering (AML) controls. The initiative was presented as a necessary corrective: a mechanism for bringing the global financial system into alignment with a common set of standards.

Twenty-six years on, the FATF’s mutual evaluation process has matured into one of the most powerful instruments of international financial governance. It shapes legislation, enforcement priorities and market access across more than 200 jurisdictions. At its February 2026 Plenary, the FATF added Kuwait and Papua New Guinea to its grey list. The same session adopted mutual evaluation reports for Austria, Italy and Singapore under a new, more time-bound assessment round that had begun with Belgium and Malaysia in October 2025.

Yet the system designed to create a level playing field has produced something closer to a hierarchy. Smaller, less-resourced jurisdictions bear disproportionate compliance costs, face exclusion from the global financial system, and are driven towards the very behaviours the regime was intended to prevent.

Extraterritorial reach creates dependency, not convergence

The legal foundations of this hierarchy are well established. The US asserts jurisdiction over any transaction that touches the dollar clearing system. This reach is formalised through the Bank Secrecy Act 1970, the USA PATRIOT Act 2001, and a succession of enforcement actions by the Department of Justice and the Office of Foreign Assets Control (OFAC).

The European Union, through its Anti-Money Laundering Regulation adopted in 2024 and due to apply from July 2027, imposes obligations on entities interacting with the EU financial system regardless of domicile. The UK exercises comparable authority through the Proceeds of Crime Act 2002, the Sanctions and Anti-Money Laundering Act 2018, and its particular influence over the Overseas Territories and Crown Dependencies.

The stated objective is harmonisation; the operational effect is dependency. At the apex of this structure sit the jurisdictions that write the rules and possess the institutional capacity to enforce them. Beneath them are jurisdictions that must adopt those rules, often without the resources, expertise or political infrastructure to do so meaningfully. This is not convergence in any substantive sense. It is regulatory subordination.

De-risking is not a market correction

The most visible consequence of this regime is the phenomenon of de-risking: the systematic withdrawal of correspondent banking services from jurisdictions, institutions and customer categories deemed to present elevated compliance risk. Global correspondent banks, faced with penalties running into billions of dollars, have adopted a blunt calculus. If a jurisdiction presents compliance costs that exceed its commercial value, the rational response is withdrawal.

The Caribbean provides a stark illustration. A 2016 survey by the Caribbean Association of Banks, cited in an International Monetary Fund (IMF) analysis, found that 58 per cent of regional banks had lost at least one correspondent banking relationship. The pattern has been replicated across the Pacific Islands, sub-Saharan Africa and parts of Central Asia.

The consequences extend well beyond the financial sector. Remittance corridors, on which millions of families depend, have been disrupted or redirected through informal channels that are less transparent and less regulated. Trade finance has become more expensive and harder to obtain. In some cases, entire categories of legitimate economic activity have been rendered unviable.

Banks do not de-risk because they have conducted a nuanced assessment of money laundering exposure. They de-risk because the cost of getting it wrong vastly exceeds the revenue from maintaining the relationship. The regulator, in this sense, has become the risk.

Grey-listing punishes; it does not reform

The FATF’s grey list, formally the list of Jurisdictions under Increased Monitoring, is the primary instrument through which the global AML regime exerts pressure on non-compliant states. The consequences are immediate and tangible: correspondent banking relationships are withdrawn or repriced, foreign direct investment declines, sovereign borrowing costs rise and the cost of international transactions increases.

A 2021 IMF working paper by Kida and Paetzold estimated that grey-listing reduces capital inflows to affected countries by an average of 7.6 per cent of GDP. For developing economies, this is not a marginal inconvenience. It is an existential threat to financial stability and inclusion.

The stated purpose of grey-listing is to incentivise reform. In practice, the mechanism operates less as a diagnostic tool than as a sanction. Jurisdictions placed on the list face a compliance treadmill. They must demonstrate progress against technical criteria that may bear limited relation to actual money laundering risks. They must do so whilst simultaneously managing the economic damage that grey-listing itself inflicts.

The pressure to satisfy external evaluators produces a compliance culture that is performative rather than substantive. Laws are enacted but not enforced. Institutions are created but not empowered. Reports are filed but not analysed.

The October 2025 Plenary illustrates the paradox. Burkina Faso, Mozambique, Nigeria and South Africa were removed from the grey list after completing their action plans. South Africa had spent almost three years under heightened monitoring, during which its financial sector bore measurable costs in higher transaction fees and constrained cross-border access. The delisting was presented as a success. The damage inflicted during the process was treated as incidental.

More telling than the formal requirements is what the process reveals about the distribution of power within the global AML regime. The jurisdictions on the FATF’s decision-making body are overwhelmingly Western or aligned with Western financial interests. Those evaluated, grey-listed and sanctioned are overwhelmingly not. This structural asymmetry does not invalidate the evaluation process. It does demand a degree of self-awareness that has been largely absent from the policy discourse.

The compliance paradox fuels the corruption it claims to fight

When access to the formal financial system becomes contingent on externally imposed standards, and when the capacity to meet those standards is unevenly distributed, the conditions are created for regulatory arbitrage at the state level. Smaller jurisdictions, desperate to retain correspondent banking access, may adopt the appearance of compliance without its substance.

Resources that might otherwise support genuine capacity building are consumed by the production of documentation designed to demonstrate adherence to standards that remain aspirational in operational terms. The irony is acute: a regime designed to combat financial crime can foster the very conditions in which corruption thrives.

Where legitimate channels of financial access are curtailed, the incentive to exploit illegitimate ones increases. Where correspondent banking withdraws, informal value transfer systems expand. Where trade finance becomes prohibitively expensive, invoice fraud and trade-based money laundering become more attractive. The Royal United Services Institute and the Financial Integrity Network have documented this dynamic extensively in their research on sanctions evasion. Restriction does not eliminate demand; it redirects it towards channels that are harder to monitor and control.

The FATF has acknowledged the problem; the question is whether acknowledgement is enough

To its credit, the FATF has begun to confront the unintended consequences of its own regime. In February 2025, the FATF revised Recommendation 1 to replace the term ‘commensurate’ with ‘proportionate’ throughout its Standards. The revision introduced an explicit requirement for countries to allow and encourage simplified measures in lower-risk scenarios. Updated guidance on financial inclusion, adopted at the June 2025 Plenary in Strasbourg, stated plainly that wholesale de-risking is contrary to the risk-based approach and contributes to broader financial exclusion.

In July 2025, the FATF launched new procedures to address unintended consequences arising from the misapplication of its Standards. These include formal trigger mechanisms that allow member states and international bodies such as the IMF and the World Bank to raise concerns during the grey-listing and follow-up process. The stated ambition is to ensure that AML controls do not themselves create conditions for financial exclusion.

These are meaningful developments. They signal that the structural critique articulated by civil society, development institutions and affected jurisdictions has registered at the policy level. Yet the gap between guidance and enforcement culture remains wide. Regulators may welcome the language of proportionality in FATF communiqués. Whether they will tolerate it in practice, when a supervised institution applies simplified measures and an adverse outcome follows, is a different question entirely.

The risk-based approach has been hollowed out

The concept behind the risk-based approach is sound: resources should be allocated in proportion to assessed risk, and low-risk relationships should not attract the same scrutiny as high-risk ones. Genuinely applied, this principle would argue for continued engagement with developing economies rather than wholesale withdrawal.

In practice, the risk-based approach has been undermined by the enforcement culture that surrounds it. Regulators emphasise proportionality in their guidance but penalise institutions for failing to apply controls that go well beyond what a proportionate assessment would require. The Financial Conduct Authority’s (FCA) enforcement record in the UK illustrates the tension. Firms are told to adopt a risk-based approach, yet penalties frequently reflect an expectation of comprehensive coverage.

The result is a form of regulatory dissonance. Institutions are counselled to be proportionate but penalised for anything short of maximalism. The risk-based approach functions not as a tool for proportionate compliance but as a mechanism for transferring risk from the regulator to the regulated institution. The incentive structure is clear, and it does not favour proportionality, engagement or inclusion.

Compliance frameworks must account for the full reach of the regime

For firms operating across multiple jurisdictions, the implications are both strategic and operational. Compliance frameworks must account not only for domestic regulation but for the extraterritorial reach of US, EU and UK law. This demands a level of legal and regulatory intelligence that is costly to maintain and difficult to calibrate.

Firms that serve clients in grey-listed or high-risk jurisdictions face a particularly acute challenge. The commercial imperative to maintain relationships must be balanced against the regulatory imperative to avoid exposure. The answer is not withdrawal; it is sophistication.

Firms must invest in the capacity to conduct genuinely risk-based assessments that go beyond country-level classifications. Correspondent banking due diligence must be granular, evidence-based and defensible. Compliance teams must be empowered to make proportionate judgements, supported by governance structures that do not penalise engagement with complexity. Control effectiveness, not control existence, must be the standard.

The cost of integrity without accountability

The extraterritorial reach of Western AML law is, at its core, an exercise of power. Like all exercises of power, it carries an obligation of accountability. Those who set the rules and enforce the penalties must reckon with the full spectrum of their consequences, intended and otherwise.

The FATF’s recent reforms suggest an institution beginning to grapple with these contradictions. The revision to Recommendation 1, the financial inclusion guidance and the unintended consequences procedures represent genuine, if incremental, progress. Yet reform at the level of guidance is insufficient if enforcement culture remains unchanged.

If the global AML regime is to fulfil its stated purpose, Western regulators must confront the tension between enforcement maximalism and financial inclusion. The risk-based approach must be reclaimed as a principle of proportionality rather than a euphemism for risk transfer. The appointment of the UK’s Giles Thomson as incoming FATF President for 2026 to 2028 places this challenge squarely within reach of a jurisdiction that shapes both the rules and their consequences.

Until that reckoning takes place, the pursuit of financial integrity, conducted without self-awareness or proportionality, will continue to export compliance and import risk. A compliance architecture that protects the integrity of Western financial markets whilst undermining the stability of developing economies is not merely imperfect. It is ethically incoherent.

Is your firm prepared for the compliance demands of extraterritorial AML law?

 

At OpusDatum, we work with firms navigating the complexities of multi-jurisdictional AML and sanctions compliance. Our advisory and data solutions support institutions in building frameworks that are proportionate, defensible and operationally effective, including in higher-risk jurisdictions where engagement demands greater sophistication, not less.

Contact us to discuss how we can help you build correspondent banking and jurisdictional risk frameworks that withstand regulatory scrutiny from every direction.