#Blog

FATF Compliance for Financial Institutions in Nepal: Practical Legal Guide for AML/CFT Readiness

October 6, 2025 Compliance and Global Standards by admin_lawsagar

Table of Contents

Introduction

FATF compliance is not a one-off box-ticking exercise. For financial institutions operating in Nepal — banks, BFIs, microfinance institutions, insurance companies, money remitters, and payment service providers — implementing a robust, risk-based Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) program is a legal and commercial imperative. This guide explains the international FATF framework, Nepal’s domestic AML/CFT obligations, concrete steps institutions must take to comply, supervisory expectations, and practical risk-mitigation measures you should implement now.

FATF’s 40 Recommendations form the international standard that financial institutions must follow.
Nepal’s AML legal framework (Money Laundering Prevention Act and related regulations) and the Financial Intelligence Unit (FIU-Nepal) operationalise these standards domestically.
Institutions must adopt a documented risk-based AML/CFT program covering governance, CDD/KYC, STR reporting, recordkeeping, AML training, and independent audit.

1. What does FATF compliance mean for financial institutions?

The Financial Action Task Force (FATF) issues the 40 Recommendations that set minimum global standards for preventing money laundering (ML), terrorist financing (TF), and proliferation financing (PF). Compliance means the country has adopted laws, regulators enforce them effectively, and private sector actors (financial institutions) apply controls consistent with those recommendations.

Nepal’s AML/CFT architecture is built on the Money Laundering Prevention Act and implementing regulations, while the Financial Intelligence Unit (FIU-Nepal) and Nepal Rastra Bank (NRB) supervise reporting and compliance for regulated financial entities. The FIU centralises suspicious transaction reporting (STR) and disseminates financial intelligence to law enforcement.

Recent FATF plenaries and listings demonstrate that jurisdictions are under continuous monitoring for effectiveness — Nepal itself was placed under increased monitoring in 2025 and has undertaken legislative and institutional reforms to align with FATF standards. This evolution means domestic institutions can expect heightened supervisory scrutiny and more detailed expectations on implementation.

2. Core obligations for Nepali financial institutions

From a lawyer’s vantage point, the compliance duties fall into regulatory (statutory) duties and operational (internal controls) duties. Key obligations include:

Customer Due Diligence (CDD) / Know Your Customer (KYC) — identify and verify customers and beneficial owners, apply enhanced due diligence (EDD) for higher risk customers and PEPs (politically exposed persons). CDD must be risk-based and proportionate.
Beneficial ownership transparency — ensure mechanisms to identify and verify beneficial owners of corporate customers and maintain appropriate records. This is a central FATF requirement and an area of interest for supervisors.
Ongoing monitoring & transaction screening — monitor customer activity, screen transactions for red flags, and filter against sanctions and watchlists.
Suspicious Transaction Reporting (STR)/Reporting to FIU — timely reporting of unusual or suspicious transactions via the FIU portal (e.g., goAML or domestic reporting mechanisms). Retain records to justify decisions not to file where appropriate.
Recordkeeping — maintain CDD, transactional and STR-related records for prescribed retention periods to support investigations and prosecutions.
AML/CFT Governance & Risk Assessment — adopt a board-approved AML/CFT compliance program, appoint a compliance officer with autonomy, and conduct periodic ML/TF risk assessments.
Training & Independent Audit — periodic training for staff and independent reviews/audits of the AML program, with findings remediated promptly.
Sanctions & Asset Freezing — implement controls to comply with UN and domestic sanctions; screen clients and transactions against sanctions lists.

These obligations must be documented, enforced, and demonstrable to supervisors.

3. Institutional governance: what the Board & senior management must do

From a legal compliance perspective, the Board and senior management carry ultimate responsibility for FATF compliance. Recommended governance actions:

Board-level oversight: Approve AML/CFT policies, allocate resources, and receive regular compliance reports (at least quarterly). Document minutes evidencing oversight decisions.
Senior management: Ensure systems, staff, and budget are available; ensure escalation of significant STRs/alerts to senior levels.
Compliance Officer: Designate a senior, independent AML Compliance Officer (ACO), with direct reporting to the Board or the highest executive level. The ACO should be empowered to stop suspicious transactions if necessary.
Policies & procedures: Maintain a policy manual covering CDD, EDD, transaction monitoring, STR filing, recordkeeping, sanctions, third-party relationships, and outsourcing controls.

Carefully drafted minutes, policies, and job descriptions create an evidentiary trail demonstrating a culture of compliance — a legal shield in enforcement or litigation.

4. Risk-based approach: design and test your AML program

FATF requires a risk-based approach (RBA): institutions must identify, assess, and mitigate ML/TF risks proportionate to their risk profile. Practical steps:

Institutional Risk Assessment (IRA): document customers, products, delivery channels, geographies, and transaction types that may present risk.
Customer Risk Scoring: implement a scoring matrix (low/medium/high) with documentation on risk justification.
Enhanced Due Diligence for high-risk customers: source of wealth checks, senior management approval for onboarding, and enhanced ongoing monitoring.
Transaction Monitoring Rules: tune parameters through a combination of rules-based and anomaly detection methods and periodically back-test thresholds.
Third-Party & Correspondent Banking Due Diligence: obtain and verify AML controls of correspondent/agent banks, and impose contractual AML obligations.
Record and test controls: log results of monitoring, investigations, and remediation actions. Conduct scenario testing, red-team exercises, and periodic effectiveness reviews.

FATF emphasises that an RBA should be documented and defended — auditors and supervisors will demand evidence of the reasoning behind risk classifications and mitigations.

5. Customer Due Diligence: the practical checklist

A practical KYC/CDD checklist for onboarding:

Identify the customer and verify using government-issued ID (passport, citizenship) and certified documents where necessary.
For legal persons, obtain incorporation documents, board resolution, and directors’ IDs.
Identify natural beneficial owners owning/controlling >25% (or specified threshold under Nepal law), and verify their identities.
Perform sanctions and PEP screening.
Assess risk rating, document the rationale, and record whether EDD is required.
For high-risk relationships: obtain a source of wealth, a source of funds, and an enhanced transaction monitoring set-up.

6. STR filing: legal standards and practical drafting points

Suspicious Transaction Reports (STRs) are the primary mechanism by which the private sector provides financial intelligence to law enforcement via the FIU. Practical legal points:

Timing: File STRs promptly when suspicion arises. Most regimes require filing without tipping off the subject. Document the rationale and evidence supporting your suspicion in internal records.
Content: Provide a factual, concise narrative with supporting transaction data, counterparty information, reasons for suspicion, and any corroborating documents or intelligence.
Legal protections: Confirm statutory protections for STR filers (confidentiality and immunity from customer liability), and ensure staff understand the prohibition on tipping-off.
Record of non-filings: Where red flags are investigated and a decision is made not to file, record the decision and reasoning — supervisors will want to see why a filing was not made.

STR quality is as important as timeliness. Poor STRs waste FIU resources and weaken the case for enforcement.

7. Beneficial ownership — why it matters and how to implement?

FATF places great emphasis on beneficial ownership transparency because clandestine ownership is a core enabler of ML/TF. For Nepali institutions:

Verify beneficial owners when customers are legal persons or legal arrangements. Use corporate records, shareholder registers, and independent sources.
If beneficial owners cannot be identified through reasonable measures, escalate to EDD and consider refusing or terminating the relationship.
Maintain BO register: keep BO information and verification documents in customer files, and be prepared to provide to supervisors or FIU upon lawful request.

Supervisors now expect institutional action on BO; opaque practices will draw enforcement scrutiny.

8. Technology, transaction monitoring and data quality

Modern AML compliance is data-driven. Key legal/technical checklists:

Data quality: ensure consistent, machine-readable customer identifiers (IDs, DOBs, addresses). Poor data quality creates false positives and investigatory blind spots.
Screening & monitoring tooling: employ sanctioned-list screening, name-matching algorithms, transaction pattern analysis, and machine learning tools where appropriate — but keep human oversight for alerts.
Audit trails & logs: preserve immutable logs of screening results, alert investigations, and escalation decisions for supervisory review.
Outsourcing: if using third-party vendors (e.g., SaaS AML solutions), contractually require data protection, audit rights, and SLAs. Ensure the outsourced activity is subject to the institution’s controls and independent review.

Remember: using high-tech tools does not shift legal responsibility away from the institution or the Board.

9. Reporting, supervision and penalties in Nepal

Nepal’s NRB and the FIU are primary supervisors for financial institutions’ AML obligations — they issue directives and procedural guidelines. Failure to comply can result in regulatory action, fines, reputational damage, and, potentially, criminal prosecution for complicity in ML/TF under the Money Laundering Prevention Act. Institutional self-testing, timely remediation and cooperative engagement with supervisors mitigate enforcement risk.

Importantly, because FATF also evaluates national effectiveness, supervisory focus may intensify if the jurisdiction is under increased monitoring. Nepali institutions should expect more detailed inquiries and may be asked to demonstrate progress on specific FATF deficiencies.

10. Practical implementation roadmap (90-day, 6-month, 12-month)

1–90 days (stabilise & assess):

Board sign-off on AML/CFT program and appointment of ACO.
Complete an Institutional Risk Assessment (IRA).
Review and update CDD/KYC procedures.
Ensure the STR reporting mechanism is known and technically accessible.

3–6 months (implement & test):

Implement or tune transaction monitoring rules and sanctions screening.
Begin targeted training for front-line staff and investigators.
Pilot EDD procedures for high-risk clients.
Run an internal AML readiness audit.

6–12 months (measure & improve):

Independent audit of AML/CFT program; remediate findings.
Establish metrics for effectiveness (e.g., STR quality, false positive rates, time to investigate).
Strengthen BO verification processes and recordkeeping.
Review correspondent/agent relationships and update contracts with AML clauses.

Embed continuous improvement: AML/CFT is iterative, not static.

11. Cross-border & correspondent banking issues

Correspondent banking due diligence is a perennial FATF concern. Nepali institutions must:

obtain information on correspondent banks’ AML controls;
include contractual AML clauses;
conduct periodic reviews;
Apply enhanced monitoring for high-risk corridors.

For incoming cross-border transactions flagged by partners, act promptly to request supporting originator information and, where necessary, file STRs.

12. Practical litigation and enforcement considerations

From the standpoint of legal risk:

Document, document, document — contemporaneous records of decisions, red flag investigations, and Board minutes are crucial in defending enforcement actions.
Whistleblowing channels — implement internal channels and non-retaliation policies; these can generate early intelligence.
Legal privilege — legal advice relating to suspicious activity investigations should be documented and, where appropriate, marked as privileged; coordinate carefully with internal counsel to maintain privilege where legitimate.
Engage early with regulators — voluntary disclosure and cooperation mitigate penalties.

13. Common pitfalls & how to avoid them

Over-reliance on automated alerts without human investigation.
Poor beneficial-ownership verification — relying only on customer-provided documents.
Inadequate training, especially for new delivery channels (mobile banking).
Weak controls on third-party agents and onboarding intermediaries.
Failure to update the AML program after product/market changes.

These are not merely operational failures; they create legal exposure.

14. Compliance checklist

Board-approved AML/CFT policy in place.
Named, independent AML Compliance Officer.
Documented Institutional Risk Assessment.
CDD/KYC and EDD procedures, with BO verification.
Transaction monitoring and sanctions screening are in place.
STR reporting procedures and FIU interface tested.
Recordkeeping policy with retention periods.
Periodic independent audit and remediation plan.
Staff training programme and training records.
Contracts with third-party service providers include AML obligations.

15. FAQs

Q1. What is the FIU, and how do I file an STR in Nepal?
A1. The Financial Intelligence Unit (FIU-Nepal) is the central repository for STRs and financial intelligence. Regulated entities file STRs using the FIU’s designated portal/process (refer to NRB/FIU directives). Always file promptly and maintain confidentiality.

Q2. How is beneficial ownership determined under Nepali rules?
A2. Beneficial ownership should identify natural persons who ultimately own or control the customer (share ownership, control, voting rights). If ownership is unclear, undertake enhanced measures and consult NRB guidance and the Money Laundering Prevention Act.

Q3. Does filing an STR expose the institution to liability?
A3. Properly filed STRs are protected by confidentiality and statutory provisions; institutions are expected to report suspicious activity. “Tipping off” the subject is a criminal offence. Always follow FIU guidelines.

Q4. What happens if Nepal is on the FATF grey list?
A4. Increased monitoring can lead to heightened supervisory expectations and potential reputational and transactional friction (e.g., correspondent banks applying more scrutiny). Institutions should expect more frequent supervisory reviews and be prepared to demonstrate effective AML implementation.

Q5. How often should we do independent AML audits?
A5. Annual independent audits are generally recommended; higher-risk entities or those with significant changes should consider more frequent reviews.

16. Practical templates & language

Below are suggested short clauses to insert into corporate policy documents and third-party agreements:

Board resolution:
“The Board hereby approves the institution’s AML/CFT policy, appoints [Name] as the AML Compliance Officer, and directs senior management to allocate sufficient resources for the implementation of the AML program.”

Third-party contract clause:
“[Vendor] shall maintain AML/CFT controls consistent with applicable laws and shall permit [Institution] and regulators to audit compliance. [Vendor] shall promptly notify [Institution] of any suspicious activity detected in relation to services provided.”

17. Conclusion

FATF compliance for financial institutions in Nepal is a combined exercise of legal adherence, effective governance, documented risk evaluation, and demonstrable operational controls. Given evolving global standards and Nepal’s engagement with FATF/APG processes, institutions should treat AML/CFT as a strategic, board-level priority. Failure to act invites regulatory enforcement, reputational loss, and operational impediments that can cripple cross-border relationships. Approach compliance proactively: document decisions, test controls, and build a culture of demonstrable compliance.

Write a comment