These questions started appearing in compliance Slack channels the week FATF opened its public consultation on June 24 for revised Recommendation 16 guidance. The Travel Rule has been a persistent headache since its expansion to virtual assets, and now FATF is refining how it expects institutions to screen payment originators and beneficiaries. Here's what fraud risk managers and AML officers are asking behind closed doors.
What exactly is changing in Recommendation 16?
FATF is updating the guidance on identifying, verifying, and screening parties in wire transfers and virtual asset transfers. The core obligation remains: you still need originator and beneficiary information for transactions above the threshold. What's changing is FATF's expectation on using that information for sanctions screening, PEP identification, and ongoing transaction monitoring.
The revised guidance clarifies screening standards, specifically when to run names against watchlists, how to handle incomplete or transliterated names, and what constitutes adequate verification before processing a payment. If you're currently doing batch screening once daily or relying solely on exact-match algorithms, you'll likely need adjustments.
Do we need to screen every payment in real-time now?
Not every payment, but your risk-based approach must justify any delays. FATF expects screening before completing the transaction for high-risk corridors, high-value transfers, or when you've identified red flags in the originator or beneficiary data.
For cross-border payments to jurisdictions FATF has flagged in its public statements, real-time screening is mandatory. Your transaction monitoring system should hold the payment pending sanctions clearance. For domestic transfers below your institutional threshold, you can still use near-real-time or batch processes, but document why that's appropriate for your risk profile.
The practical issue: your payment processing pipeline probably wasn't designed for inline screening. Evaluate whether your current architecture can query sanctions lists and return a decision within your SLA window, or if you need to pre-screen during customer onboarding and rely on event-triggered rescreening.
How do we handle name variations and transliterations?
This is where most false positives originate, and FATF knows it. The updated guidance acknowledges that exact-match screening generates noise, but it doesn't permit loosening controls. Instead, you need fuzzy matching algorithms that account for:
- Romanization differences (Arabic, Cyrillic, Chinese names rendered in Latin characters)
- Name order variations (family name first vs. given name first)
- Patronymics and matronymics in certain cultures
- Abbreviated or incomplete names on payment messages
Your screening vendor should support phonetic matching (Soundex, Metaphone) and edit-distance algorithms (Levenshtein). Configure match thresholds based on the quality of your source data. If you're receiving ISO 20022 messages with structured name fields, you can tighten thresholds. If you're still processing ISO 8583 messages with unstructured name data, you'll need wider tolerances and manual review queues.
Don't rely on automated screening alone for high-risk matches. FATF expects human review when the algorithm flags a potential sanctions hit, especially if the name similarity is above 85% but below your auto-block threshold.
What happens if we can't get complete beneficiary information?
You have three options, none ideal:
- Reject the payment and return funds to the originator
- Hold the payment and request additional information through your correspondent bank
- File a Suspicious Activity Report and process the payment with enhanced monitoring
FATF's position is clear: incomplete beneficiary data is a red flag, not a processing inconvenience. If you're routinely accepting payments with missing or obviously false beneficiary information, you're creating AML risk and examiner findings.
The challenge is that payment message formats don't always support the granularity FATF wants. ISO 8583 messages have character limits. SWIFT MT103 messages have field constraints. When receiving payments through correspondent banking channels, you're dependent on upstream banks to populate those fields correctly.
Document your escalation process for incomplete data. Define what "incomplete" means for your institution (missing address? Missing account number? Generic beneficiary name?). Train your operations team to recognize placeholder data like "Customer," "Beneficiary," or repeated characters.
How does this affect our correspondent banking relationships?
Your correspondents are evaluating the same guidance, which means they're going to tighten due diligence on the payments you send them. Expect requests for:
- Enhanced KYC documentation on your customers
- Explanation of your sanctions screening procedures
- Evidence that you're screening against the same lists they use
- Confirmation that you're applying FATF standards, not just local regulatory minimums
If you're a regional bank routing international payments through a money center correspondent, you're particularly exposed. The correspondent assumes regulatory risk when they process your payments, and FATF's updated guidance gives them more reason to be cautious. You may see longer processing times, more frequent payment holds, or requests to pre-screen customers before initiating transfers.
The Wolfsberg Principles already set expectations for correspondent banking due diligence. FATF's guidance reinforces those expectations and adds specificity around beneficial ownership identification and screening protocols.
Do we need to change our technology stack?
Possibly. Evaluate whether your current sanctions screening platform can:
- Ingest FATF's consolidated list plus OFAC, EU, UN, and HMT lists
- Update watchlists within 24 hours of publication
- Support fuzzy matching with configurable thresholds
- Screen in real-time or near-real-time (sub-second response)
- Generate audit trails showing screening logic and match scores
- Integrate with your payment processing core without introducing latency
If you're using a legacy screening system that requires overnight batch updates or can't handle non-Latin character sets, you're going to struggle. The revised guidance assumes you have modern screening infrastructure, not a 15-year-old rules engine running on a mainframe.
For institutions processing high volumes, consider implementing pre-screening during account opening. Screen the customer once during KYC, then monitor for list updates and rescreen automatically when a sanctioned entity is added. This reduces inline screening load and improves payment processing speed.
What should we do while the consultation is open?
Review the consultation document and submit comments if you have operational concerns FATF hasn't addressed. The consultation period is your opportunity to flag implementation challenges before the guidance is finalized.
Internally, conduct a gap assessment:
- Map your current screening process against the draft guidance
- Identify where you're relying on manual review or delayed screening
- Test your screening platform's accuracy with transliterated names
- Review your correspondent banking agreements for screening obligations
- Document your risk-based approach to screening thresholds
Don't wait for final guidance to start planning. FATF's mutual evaluation process will eventually assess your jurisdiction's implementation of Recommendation 16, and examiners will expect you to demonstrate progress toward the updated standards even if your local regulator hasn't formally adopted them yet.
Where to go for more
FATF publishes its consultation documents and public statements at fatf-gafi.org. Your primary regulator (FinCEN, FCA, BaFin, etc.) will issue implementation guidance once FATF finalizes Recommendation 16 updates. The Wolfsberg Group maintains correspondent banking questionnaires that reflect evolving AML expectations. If you're processing virtual asset transfers, monitor FATF's Virtual Assets Contact Group publications for sector-specific guidance.
Your sanctions screening vendor should be tracking these developments and planning product updates. Ask them directly how they're preparing for the revised guidance and what configuration changes you'll need to make.
