Pack contents: FATF baseline

In short

The global-fatf pack is a baseline taken from the FATF Recommendations and typologies. It fits any country, and every jurisdiction recommends it. It has 8 post-event rules, all switched off when installed, that add to the core pack rather than repeat it:

• the FATF black and grey lists, carried in the rules’ parameters;
• structuring spread over a week;
• money moving straight through new accounts;
• PEPs moving funds across borders;
• trade-based laundering (invoice mismatches, payments to a third country);
• new companies sending large sums abroad.

Amounts follow your workspace’s currency

The pack’s amounts are starting points written in US dollars. When you install it, a workspace whose base currency is GHS, NGN, XOF, EUR, SLE, LRD, GMD, GNF or KES gets equivalent defaults in that currency instead. fatf.structuring_week takes the local cash reporting threshold.

Rule	Parameter	USD (as written)	GHS	NGN	XOF	EUR	SLE	LRD	GMD	GNF	KES
fatf.structuring_week	threshold	10,000	50,000	5,000,000	15,000,000	10,000	30,000	1,000,000	450,000	100,000,000	1,300,000
fatf.rapid_movement_new_account	min_amount	5,000	60,000	7,500,000	3,000,000	5,000	125,000	1,000,000	300,000	40,000,000	600,000
fatf.pep_cross_border	threshold	5,000	60,000	7,500,000	3,000,000	5,000	125,000	1,000,000	300,000	40,000,000	600,000
fatf.tbml_invoice_mismatch	min_amount	10,000	120,000	15,000,000	6,000,000	10,000	250,000	2,000,000	750,000	80,000,000	1,250,000
fatf.tbml_third_country	min_amount	10,000	120,000	15,000,000	6,000,000	10,000	250,000	2,000,000	750,000	80,000,000	1,250,000
fatf.shell_company_outflow	min_total	100,000	1,200,000	150,000,000	60,000,000	100,000	2,500,000	20,000,000	7,500,000	800,000,000	12,500,000

The amounts for SLE, LRD, GMD, GNF and KES, added in version 1.2.0, are the dollar figures scaled at a rough exchange rate and rounded, and the cash thresholds behind them are themselves research to verify with counsel. Review them for your customers before you enable a rule.

In any other base currency the dollar figures are installed as they are, and the rule library shows a warning on the pack before you install it: set every amount for your currency first. The same warning appears on any pack whose amounts are in another currency than your workspace’s (a Ghana pack in a naira workspace, for example). Whatever the currency, the amounts are starting points, not regulatory values: calibrate them with a backtest before enabling a rule. The tables below show the dollar defaults.

The FATF lists change three times a year

The FATF updates its lists after each plenary (February, June and October). The lists in this version are from the June 2026 plenary (as_of: 2026-06-19). SpeculaPro publishes a new pack version after each plenary: upgrade the pack when one arrives, or edit the countries parameter yourself in a new version.

Two rules read optional fields that you send as transaction attributes: invoice_amount (FATF6) and supplier_country (FATF7). Payments without them are skipped.

All rules at a glance

Key	Library	Name	Pack	Mode · action	Alert about	Severity · score
fatf.call_for_action	FATF1	FATF call-for-action jurisdiction	global-fatf	post-event · alert	customer	critical · 85
fatf.increased_monitoring	FATF2	FATF increased-monitoring jurisdiction	global-fatf	post-event · alert	customer	medium · 40
fatf.structuring_week	FATF3	Cash deposits kept below a threshold all week	global-fatf	post-event · alert	customer	high · 65
fatf.rapid_movement_new_account	FATF4	New account moving money straight through	global-fatf	post-event · alert	account	high · 70
fatf.pep_cross_border	FATF5	PEP sending or receiving funds abroad	global-fatf	post-event · alert	customer	high · 70
fatf.tbml_invoice_mismatch	FATF6	Trade payment that doesn’t match its invoice	global-fatf	post-event · alert	customer	high · 60
fatf.tbml_third_country	FATF7	Trade payment to a country other than the supplier’s	global-fatf	post-event · alert	customer	medium · 50
fatf.shell_company_outflow	FATF8	New company sending large sums abroad	global-fatf	post-event · alert	customer	high · 60

The global-fatf pack (8 rules)

FATF baseline (any country) (in French: Socle GAFI (tous pays)), version 1.2.0.

A baseline from the FATF Recommendations and typologies, usable in any country: the FATF black and grey lists (carried in the rules’ parameters and updated with new pack versions after each plenary), structuring over a week, rapid movement through new accounts, PEP cross-border activity, trade-based laundering and shell-company indicators. It complements the core pack without repeating its rules. The amounts are starting points in US dollars; workspaces in GHS, NGN, XOF and EUR get equivalent defaults at install (the structuring rule takes the local cash reporting threshold). In any other currency the dollar figures are installed as they are: set them for your currency before enabling.

Values to confirm with the regulator

These come from SpeculaPro’s research, not an official confirmation. Confirm each with the FIU or regulator before relying on it:

• The FATF lists change three times a year (February, June, October plenaries): the lists here are from the June 2026 plenary; check for a newer pack version after each plenary
• Thresholds are generic starting points, not regulatory values: US dollar figures, with rounded equivalents installed for GHS (about 12 to the dollar), NGN (about 1,500) and XOF (about 600) workspaces, and the local cash reporting threshold (GHS 50,000, NGN 5,000,000, XOF 15,000,000) in the structuring rule. Calibrate them with backtesting before go-live

Sources the pack cites:

• FATF Recommendations (International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation), updated 2025
• FATF high-risk and other monitored jurisdictions, June 2026 plenary
• FATF Guidance on Politically Exposed Persons (Recommendations 12 and 22), 2013
• FATF/Egmont Trade-Based Money Laundering: Trends and Developments, 2020
• FATF/Egmont Concealment of Beneficial Ownership, 2018

fatf.call_for_action

FATF call-for-action jurisdiction · library FATF1 · High-risk jurisdiction (FATF black list) · alert about the customer · severity critical, score 85

In French: Pays sous appel à l’action du GAFI.

Funds to or from a jurisdiction on the FATF list of high-risk jurisdictions subject to a call for action (the black list: North Korea, Iran, Myanmar as of the June 2026 plenary). FATF Recommendation 19 calls for enhanced due diligence and, for the first two, countermeasures. The list is a parameter that new pack versions update.

Parameter	Meaning	Default
countries	Call-for-action jurisdictions (ISO codes)	["KP", "IR", "MM"]
as_of	FATF plenary the list comes from	"2026-06-19"
min_amount	Amount at or above (base currency)	0

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} to/from {{= txn.counterparty_country != ‘’ ? txn.counterparty_country : txn.country }}, on the FATF call-for-action list (as of {{params.as_of}}).

Expression

txn.amount >= params.min_amount && ((txn.counterparty_country != '' && txn.counterparty_country in params.countries) || (txn.country != '' && txn.country in params.countries))

fatf.increased_monitoring

FATF increased-monitoring jurisdiction · library FATF2 · High-risk jurisdiction (FATF grey list) · alert about the customer · severity medium, score 40

In French: Pays sous surveillance renforcée du GAFI.

Cross-border funds to or from a jurisdiction under FATF increased monitoring (the grey list, 22 jurisdictions as of the June 2026 plenary). Not a prohibition: FATF asks for the risks to be taken into account. Domestic payments are skipped: if your own country is listed, put it in home_countries.

Parameter	Meaning	Default
countries	Jurisdictions under increased monitoring (ISO codes)	["AO", "BO", "BA", "BG", "CM", "CI", "CD", "HT", "IQ", "KE", "KW", "LA", "LB", "MC", "NP", "PG", "SS", "SY", "VE", "VN", "VG", "YE"]
as_of	FATF plenary the list comes from	"2026-06-19"
home_countries	Your own countries (never flagged)	[]
min_amount	Amount at or above (base currency)	0

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} to/from {{txn.counterparty_country}}, under FATF increased monitoring (as of {{params.as_of}}).

Expression

txn.amount >= params.min_amount && txn.counterparty_country != '' && txn.counterparty_country != txn.country && !(txn.counterparty_country in params.home_countries) && txn.counterparty_country in params.countries

fatf.structuring_week

Cash deposits kept below a threshold all week · library FATF3 · Structuring / smurfing · alert about the customer · severity high, score 65

In French: Dépôts en espèces maintenus sous un seuil toute la semaine.

Many cash deposits or cash-ins over seven days, each below the reporting threshold but together above it: structuring spread over a week to stay under a cash report (FATF Recommendation 20 and the structuring typology). The core pack’s structuring rule looks at 48 hours; this one catches the slower pattern.

Parameter	Meaning	Default
threshold	Reporting threshold being avoided (base currency)	10,000
min_count	Cash deposits in 7 days, at least	5

Explanation shown to analysts: {{features.cash_count_7d}} cash deposits totalling {{txn.base_currency}} {{features.cash_sum_7d}} in 7 days, each below the {{txn.base_currency}} {{params.threshold}} threshold.

Expression

txn.direction == 'in' && txn.channel == 'cash' && txn.amount < params.threshold && features.cash_count_7d >= double(params.min_count) && features.cash_sum_7d >= params.threshold && features.cash_max_7d < params.threshold

fatf.rapid_movement_new_account

New account moving money straight through · library FATF4 · Money mule / rapid movement · alert about the account · severity high, score 70

In French: Compte récent faisant transiter les fonds.

An account opened in the last few weeks that sends on almost everything it receives within a day: a mule or layering account (FATF money mule and rapid-movement typologies).

Parameter	Meaning	Default
max_age_days	Account opened within (days)	30
min_amount	Inflow in 24 hours, at least (base currency)	5,000
out_ratio	Out as share of in (0.9 = 90%)	0.9

Explanation shown to analysts: Account opened {{account.age_days}} days ago: {{txn.base_currency}} {{features.in_24h}} in and {{txn.base_currency}} {{features.out_24h}} out within 24 hours.

Expression

txn.direction == 'out' && account.age_days >= 0 && account.age_days <= params.max_age_days && features.in_24h >= params.min_amount && features.out_24h >= params.out_ratio * features.in_24h

fatf.pep_cross_border

PEP sending or receiving funds abroad · library FATF5 · Politically exposed person / corruption proceeds · alert about the customer · severity high, score 70

In French: PPE envoyant ou recevant des fonds de l’étranger.

A politically exposed person (or relative or close associate) moving funds across borders at or above the threshold: FATF Recommendation 12 and the PEP guidance list foreign transfers, especially to jurisdictions with which the PEP has no apparent link, as a red flag for the proceeds of corruption.

Parameter	Meaning	Default
threshold	Amount at or above (base currency)	5,000
home_countries	Your own countries (domestic, not flagged)	[]

Explanation shown to analysts: PEP customer: {{txn.base_currency}} {{txn.amount}} to/from {{txn.counterparty_country}}, at or above {{txn.base_currency}} {{params.threshold}}.

Expression

customer.is_pep && txn.amount >= params.threshold && txn.counterparty_country != '' && txn.counterparty_country != txn.country && !(txn.counterparty_country in params.home_countries)

fatf.tbml_invoice_mismatch

Trade payment that doesn’t match its invoice · library FATF6 · Trade-based money laundering (mis-invoicing) · alert about the customer · severity high, score 60

In French: Paiement commercial ne correspondant pas à sa facture.

A cross-border trade payment whose amount differs from the invoice amount sent with it (txn.attributes.invoice_amount, in the transaction’s currency) by more than the tolerance: over- or under-invoicing, the core trade-based laundering technique (FATF/Egmont 2020). Payments without an invoice amount are skipped.

Parameter	Meaning	Default
tolerance	Allowed difference (0.1 = 10%)	0.1
min_amount	Amount at or above (base currency)	10,000

Explanation shown to analysts: {{txn.currency}} {{txn.amount_original}} paid to {{txn.counterparty_country}} against an invoice of {{txn.currency}} {{txn.attributes.invoice_amount}}.

Expression

txn.amount >= params.min_amount && txn.counterparty_country != '' && txn.counterparty_country != txn.country && 'invoice_amount' in txn.attributes && double(txn.attributes.invoice_amount) > 0.0 && (txn.amount_original > double(txn.attributes.invoice_amount) * (1.0 + params.tolerance) || txn.amount_original < double(txn.attributes.invoice_amount) * (1.0 - params.tolerance))

fatf.tbml_third_country

Trade payment to a country other than the supplier’s · library FATF7 · Trade-based money laundering (third-party payment) · alert about the customer · severity medium, score 50

In French: Paiement commercial vers un pays autre que celui du fournisseur.

A trade payment sent to a country other than the supplier’s (txn.attributes.supplier_country): payment through an unrelated third party, a trade-based laundering and sanctions-evasion red flag (FATF/Egmont 2020). Payments without a supplier country are skipped.

Parameter	Meaning	Default
min_amount	Amount at or above (base currency)	10,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} paid to {{txn.counterparty_country}} for goods from a supplier in {{txn.attributes.supplier_country}}.

Expression

txn.direction == 'out' && txn.amount >= params.min_amount && txn.counterparty_country != '' && 'supplier_country' in txn.attributes && string(txn.attributes.supplier_country) != '' && string(txn.attributes.supplier_country) != txn.counterparty_country

fatf.shell_company_outflow

New company sending large sums abroad · library FATF8 · Shell / front company · alert about the customer · severity high, score 60

In French: Société récente envoyant d’importantes sommes à l’étranger.

A business customer onboarded in the last months whose outflows abroad over 30 days are already large: a shell or front company used to move funds (FATF/Egmont Concealment of Beneficial Ownership, 2018: recently formed companies with high-value cross-border flows and no apparent business).

Parameter	Meaning	Default
max_age_days	Customer for at most (days)	180
min_total	Outflows in 30 days, at least (base currency)	100,000

Explanation shown to analysts: Business customer for {{customer.age_days}} days has sent {{txn.base_currency}} {{features.out_30d}} in 30 days; this payment of {{txn.base_currency}} {{txn.amount}} goes to {{txn.counterparty_country}}.

Expression

customer.type == 'business' && customer.age_days >= 0 && customer.age_days <= params.max_age_days && txn.direction == 'out' && txn.counterparty_country != '' && txn.counterparty_country != txn.country && features.out_30d >= params.min_total

Related

• Pack contents
• Jurisdictions
• Installing a pack
• Tuning and calibration