FATF Recommendation 18: Internal controls, foreign branches, and subsidiaries

Fecha de última actualización: 27/11/2025

The Financial Action Task Force — FATF — has among its objectives the establishment of standards in the field of anti-money laundering and counter-terrorist financing. Likewise, it promotes the adoption of legal and operational measures aimed at this purpose. In order to develop these guidelines, the FATF established the 40 Recommendations. This post analyses Recommendation 18, which addresses internal controls, as well as foreign branches and subsidiaries.

FATF Recommendation 18 requires financial institutions, as well as other obliged entities, to implement internal programs and controls to combat money laundering and terrorist financing. It also requires financial groups to implement such programs at the group-wide level, including internal controls, policies and procedures.

Recommendation 18 also states that financial institutions and other relevant actors should be required to ensure that their foreign branches and subsidiaries apply preventive measures consistent with the requirements of the home country, as well as with the FATF Recommendations.

The FATF further develops the content of Recommendation 18 through an Interpretative Note. First, it specifies the types of programs that should be implemented, namely:

• the development of internal policies, procedures and controls, as well as adequate procedures to ensure high ethical standards in recruitment;
• ongoing training for employees;
• external and independent audit reports;
• the appointment of a compliance officer at senior management level.

The Interpretative Note reiterates the need for anti-money laundering programs within financial groups to be applicable to all branches and majority-owned subsidiaries. These programs should include those mentioned ut supra and must be appropriate and effective for the branches and subsidiaries concerned. The FATF states that such programs should include procedures that allow for the sharing of information necessary to comply with customer due diligence requirements, as well as with other preventive measures. Nevertheless, safeguards must be established to ensure the confidentiality and proper use of the information exchanged.

Finally, the FATF addresses operations conducted abroad. It notes that where the anti-money laundering requirements of the host country are less stringent, the requirements of the home country should be applied to the extent permitted by the host country’s laws. Where this is not possible, because the host country does not allow the proper implementation of control measures, financial groups should apply additional measures aimed at mitigating this situation.