The Financial Action Task Force mutual evaluation process is the most rigorous external assessment a jurisdiction's anti-money laundering and counter-terrorist financing framework will face. For financial institutions operating in the Gulf Cooperation Council, the outcomes of these evaluations — and the remediation commitments that follow — directly shape the regulatory environment in which they operate.

Understanding how mutual evaluations work, what they assess, and what the findings mean for your compliance programme is no longer a matter for government relations teams alone. It is a practical compliance priority.

What a Mutual Evaluation Actually Assesses

FATF mutual evaluations assess two dimensions simultaneously: technical compliance and effectiveness.

Technical compliance examines whether a jurisdiction's laws, regulations, and institutional frameworks meet the requirements of the FATF Recommendations. This is the easier dimension to satisfy — it is largely a matter of having the right legislation on the books.

Effectiveness is where evaluations become genuinely demanding. Evaluators assess whether the framework actually works in practice — whether supervisors are using their powers, whether financial institutions are identifying and reporting suspicious activity, whether law enforcement is converting financial intelligence into prosecutions. A jurisdiction can have technically compliant legislation and still receive poor effectiveness ratings if the framework is not being applied.

For firms, the effectiveness dimension matters most. It is what drives supervisory intensity, shapes enforcement priorities, and determines whether the jurisdiction's correspondent banking relationships remain intact.

The GCC Evaluation Landscape

The GCC jurisdictions have undergone significant transformation in their FATF standing over the past decade.

The UAE completed its fourth-round mutual evaluation in 2020, receiving a mixed assessment that ultimately contributed to its placement on the FATF grey list in 2022. The subsequent remediation programme — one of the most intensive in the region's regulatory history — resulted in removal from the grey list in 2024. The UAE's experience is instructive: grey-listing has immediate, material consequences for correspondent banking relationships, transaction costs, and institutional reputation.

Saudi Arabia is currently subject to ongoing FATF monitoring following its fourth-round evaluation. The Kingdom has made substantial progress in strengthening its AML/CFT framework, driven in part by Vision 2030's emphasis on financial sector development and international integration. SAMA and the Capital Market Authority have both issued updated guidance that reflects the evaluation findings.

Bahrain received a broadly positive assessment in its most recent evaluation, with the Central Bank of Bahrain's supervisory framework recognised as one of the more effective in the region. The CBB's risk-based approach to supervision has become a reference point for other GCC regulators.

Kuwait and Qatar are both in various stages of their evaluation cycles, with supervisory frameworks that are continuing to develop in response to FATF expectations.

What Evaluators Look For in Financial Institutions

When FATF evaluators assess a jurisdiction's financial sector, they are looking at the aggregate behaviour of regulated firms — not individual institutions. But the aggregate is built from individual compliance programmes, and the quality of those programmes directly influences the jurisdiction's effectiveness ratings.

Evaluators focus on several key areas.

Risk understanding. Do financial institutions genuinely understand the money laundering and terrorist financing risks they face? Evaluators look for evidence that risk assessments are current, comprehensive, and genuinely inform compliance decisions — not documents produced for regulatory inspection and then filed away.

Customer due diligence quality. The depth and quality of CDD information held on customers is a primary indicator of AML programme effectiveness. Evaluators assess whether firms are applying enhanced due diligence where the risk warrants it, and whether their beneficial ownership verification processes are robust.

Suspicious activity reporting. The volume, quality, and timeliness of suspicious activity reports submitted to financial intelligence units is a direct measure of how well the financial sector is contributing to the broader AML/CFT system. Low SAR volumes are not a sign of a clean customer base — they are typically a sign of under-detection.

Supervisory responsiveness. How quickly and effectively do firms respond to supervisory findings? Evaluators look for evidence that compliance deficiencies are identified, escalated, and remediated — not managed through correspondence.

The Correspondent Banking Dimension

One of the most significant practical consequences of FATF evaluations for GCC firms is their impact on correspondent banking relationships. International banks — particularly those headquartered in FATF member jurisdictions — use evaluation outcomes as a key input into their correspondent banking risk assessments.

A jurisdiction on the grey list, or with poor effectiveness ratings in key areas, faces increased scrutiny from correspondent banks. In some cases, this translates into enhanced due diligence requirements, higher transaction costs, or withdrawal of correspondent relationships altogether.

For GCC firms that depend on correspondent banking for cross-border payments, trade finance, and access to international capital markets, maintaining strong AML/CFT frameworks is not merely a regulatory obligation — it is a commercial necessity.

Preparing Your Compliance Programme

Firms that want to be well-positioned ahead of — and during — a FATF evaluation cycle should focus on several practical priorities.

Conduct a genuine risk assessment. Not a template exercise, but a substantive analysis of the specific money laundering and terrorist financing risks relevant to your business model, customer base, and geographic footprint. The risk assessment should be the foundation of your compliance programme, not a document produced in parallel with it.

Invest in CDD quality. Review whether your customer due diligence processes are generating the information needed to make meaningful risk decisions. Common weaknesses include insufficient beneficial ownership verification for complex structures, inadequate source of funds documentation for higher-risk customers, and CDD files that are complete on paper but thin on substance.

Review your SAR programme. Assess whether your transaction monitoring systems are calibrated to your actual risk profile, whether your staff are trained to recognise the typologies relevant to your business, and whether your SAR quality meets the standards expected by your financial intelligence unit.

Engage with your supervisor. Firms that have open, constructive relationships with their supervisors are better positioned during evaluation periods. Proactive engagement — sharing your risk assessment, discussing emerging typologies, seeking guidance on complex cases — builds the supervisory relationship that matters when evaluators are in country.

The Role of Licensed Governance Frameworks

For firms seeking to demonstrate compliance credibility during an evaluation cycle, licensed governance frameworks provide a structured, independently validated approach. A framework that has been designed to meet the requirements of both UK and GCC regulators — and that is regularly updated to reflect the current FATF methodology — provides a defensible foundation for supervisory engagement.

Our advisory services include dedicated support for firms preparing for regulatory engagement, including FATF evaluation readiness assessments and compliance programme reviews.

The FATF evaluation landscape does not exist in isolation from other compliance disciplines. Firms strengthening their AML/CFT frameworks will find that KYC and customer due diligence and sanctions compliance require parallel attention — the three disciplines are deeply interconnected in how evaluators assess effectiveness.

Conclusion

FATF mutual evaluations are not an abstract regulatory process. They shape the supervisory environment, influence correspondent banking relationships, and set the standard against which individual compliance programmes are measured.

For GCC firms, the lesson of the past decade is clear: jurisdictions that invest in genuine AML/CFT effectiveness — not just technical compliance — are better positioned to maintain international standing, attract investment, and sustain correspondent banking relationships.

To discuss your firm's FATF readiness or explore how our advisory services can support your compliance programme, contact us at [email protected].