FATF, FIUs, Regulators and Law Enforcement: Who Does What?

Table of Contents

• • Role Map
• • What FATF Does—and Does Not Do
• • What Regulators and Supervisors Do
• • What an FIU Does
• • Law Enforcement, Evidence and Courts
• • How External Intelligence Should Change Controls
• • CAMS Exam Traps

Quick answer: FATF sets international standards; national authorities turn them into law and regulation. Regulators supervise. FIUs receive and analyse suspicious reports. Law enforcement investigates crimes and gathers evidence. Courts make legal determinations and impose outcomes within their authority.

Many CAMS questions are role-allocation questions disguised as financial-crime scenarios. Two answers may describe useful actions, but only one assigns the task to the actor with the proper authority.

Role Map

Actor	Primary function	Common exam mistake
FATF	International standards, risk-based approach, typologies and mutual evaluation	Treating recommendations as identical law everywhere
National legislature or authority	Creates the applicable legal and regulatory framework	Ignoring jurisdictional differences
Regulator or supervisor	Supervises firms, examines controls and uses regulatory powers	Treating supervision as criminal prosecution
FIU	Receives and analyses reports and develops intelligence	Treating intelligence as a court judgment
Law enforcement	Investigates crime and gathers evidence	Expecting a private firm to use police powers
Court	Determines legal questions and outcomes within its jurisdiction	Assuming an alert or report proves guilt

What FATF Does—and Does Not Do

FATF sets international standards for anti-money laundering, counter-terrorist financing and proliferation financing. It promotes a risk-based approach, studies methods and trends and assesses whether jurisdictions have effective systems.

FATF recommendations are not a single global statute. Countries implement standards through national law, regulation, guidance and supervision. A CAMS answer becomes weak when it applies a familiar requirement from one country to every jurisdiction without checking the governing framework.

FATF-style regional bodies support regional cooperation, assessments and guidance. Mutual evaluations consider technical compliance and effectiveness. Public statements and monitoring can inform country risk, but they do not replace customer-specific analysis.

What Regulators and Supervisors Do

Regulators protect the integrity and stability of their sectors through the powers given by their legal framework. They may license or supervise institutions, set expectations, conduct examinations, require remediation and take enforcement action.

A regulatory finding can identify weak governance, data, due diligence, monitoring, investigation or reporting. The institution remains responsible for correcting the control. It should also record a supervisory request separately from an FIU request because the legal gateway, response owner, confidentiality and purpose can differ even where both seek the same transaction records.

What an FIU Does

A financial intelligence unit receives suspicious activity or transaction reports, analyses the information, develops intelligence and disseminates it to competent authorities or other FIUs where permitted.

The reporting institution should provide accurate, useful information without claiming that a crime has been proved. The FIU combines reports and other permitted data to see connections that one organisation may not observe.

FIU intelligence and formal evidence are not interchangeable. Cross-border intelligence sharing may use different gateways from legal processes used to obtain admissible evidence.

Law Enforcement, Evidence and Courts

Law-enforcement agencies investigate crimes, gather evidence and use the powers available under law. Courts determine legal outcomes. Private institutions investigate activity to manage risk, comply with obligations and decide whether escalation or reporting is required; they should not present themselves as prosecutors.

Cross-border cooperation may involve regulatory coordination, FIU exchange, law-enforcement requests or formal legal mechanisms. The correct route depends on whether the need is supervision, intelligence, evidence or asset restraint.

Organisations should centralise official requests with qualified staff, verify legitimacy, preserve records, respond within the applicable requirements and protect confidentiality.

How External Intelligence Should Change Controls

Reports from FATF, FIUs, regulators and other competent bodies can identify typologies, sector vulnerabilities, geographic threats and control weaknesses. A sound AFC function uses them to:

• update risk assessments;
• test scenario coverage;
• review policies and procedures;
• adjust training;
• inform governance reporting; and
• check whether the information is relevant to its customers, products, markets and data.

Copying an external typology directly into a monitoring rule without assessing local relevance can create false confidence.

CAMS Exam Traps

• FATF recommendation equals national law: identify implementation in the relevant jurisdiction.
• FIU equals police: intelligence analysis and criminal investigation are distinct.
• Institution equals prosecutor: firms investigate for control and reporting decisions.
• Report equals proof: a suspicious report communicates concern, not a conviction.
• Country list equals customer decision: combine external country risk with customer-specific facts.
• Information sharing overrides confidentiality: confirm authority, purpose, security and restrictions.

Connect these roles to internal ownership through the three lines of defence and review the complete blueprint in the CAMS exam guide.

When an exam option is unclear, ask one question: does this actor have the authority and purpose described?