What changed
FATF issued a new statement on February 18, 2010, categorizing jurisdictions with strategic AML/CFT deficiencies into three groups: Iran (subject to countermeasures), Angola, DPRK, Ecuador, Ethiopia (no action plan committed), and Pakistan, Turkmenistan, Sao Tome and Principe (previously identified deficiencies remain). RBI updated its earlier November 2009 circular to reflect this revised FATF classification.
What it means for you
Banks and All India Financial Institutions must reassess their exposure and transaction monitoring for entities linked to these eight countries. Iran requires the strictest countermeasures, while the other two groups demand enhanced risk assessment. Failure to adjust AML/CFT controls could expose banks to regulatory action and reputational risk.
What you must do
- Update your AML/CFT risk assessment framework to include the three FATF tiers for these eight jurisdictions.
- Apply enhanced due diligence or countermeasures as per FATF guidance for Iran, Angola, DPRK, Ecuador, Ethiopia, Pakistan, Turkmenistan, and Sao Tome and Principe.
- Ensure Principal Officer acknowledges receipt of this circular and briefs relevant compliance and operations teams.
- Review existing customer relationships and transactions linked to these countries and escalate any suspicious activity.
Who it affects
Scheduled Commercial Banks (excluding RRBs), Local Area Banks, All India Financial Institutions, Compliance and AML/CFT teams, Principal Officers
What is the difference between the three FATF groups in this circular?
Group 1 (Iran) requires members to apply countermeasures to protect the financial system. Group 2 (Angola, DPRK, Ecuador, Ethiopia) have deficiencies but no action plan committed, so members must consider risks. Group 3 (Pakistan, Turkmenistan, Sao Tome and Principe) have previously identified deficiencies that remain unaddressed.
Do we need to stop all transactions with these countries?
No, but you must apply risk-based measures. For Iran, countermeasures are called for; for others, enhanced due diligence and risk assessment are required. The circular does not mandate a blanket ban.
How does this circular affect our existing KYC/AML procedures?
It requires you to update your risk assessment to incorporate these specific jurisdictions and adjust transaction monitoring, customer due diligence, and reporting processes accordingly.