What FATF's global review of public-private partnerships means for jurisdiction risk

On 8 July 2026, FATF published Information Sharing to Combat Illicit Finance: Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements. It's the first attempt to map, across 55 surveyed jurisdictions, how many actually run a working channel between banks and their financial intelligence unit, and where those channels break down.

For compliance teams, FATF's barrier data is the useful part.

The finding that matters most

FATF identified at least 84 public-private partnerships (PPPs) globally. Of the jurisdictions it surveyed, 52 run at least one domestic PPP, and 18 run more than one.

 

But a PPP existing on paper and a PPP moving information at speed are different things. FATF's survey found that 41% of respondent countries say the absence of a clear legal gateway, meaning explicit legal authority for what can be shared, with whom, and under what basis, limits how much detail they can put through a partnership. The report names two other recurring barriers alongside it: limited institutional and technical capacity, and trust or cultural resistance between agencies and firms, though it doesn't quantify those two by percentage.

 

Roughly three in four surveyed jurisdictions report having the safeguards (encryption, access controls, audit trails) that make higher-detail sharing legally defensible in the first place. Most country risk models don't currently price in the gap between a jurisdiction with those safeguards and one without them.

The country risk angle

A jurisdiction can have a PPP in place and still leave a firm exposed, if that partnership has no clear legal gateway, no defined scope for what can move between bank and FIU, and no certainty about how it interacts with bank secrecy law. That gap sits outside the areas most country risk frameworks were built to capture. FATF mutual evaluations assess a country's legal framework and its effectiveness in applying it. They don't tell you, on their own, whether a bank operating in that country has a functioning, low-friction way to flag a suspicious pattern to a regulator and get something back.

 

This is the same shift SI 2026/621 forced on UK firms in June: list membership and headline ratings are a starting point, not a substitute for evidencing the specific risk profile of a jurisdiction. The FATF PPP report extends that logic to a dimension country risk models often miss. Information-sharing maturity, and the legal barriers around it, is itself a measurable input into how much residual risk a jurisdiction carries, independent of its FATF list status.

Where it's working

The report gives two concrete examples worth knowing. Singapore's Project FRONTIER+, an anti-scam alliance spanning 13 jurisdictions, has led to more than 2,100 arrests and the freezing of over 36,000 bank accounts. In South Africa, a tactical operation group used bank-analysed suspicious activity to dismantle a pyramid scheme and freeze 60 accounts holding over USD 450,000. Both cases share the same structure: a defined legal basis for sharing, and a partnership built to move from tip to action quickly, rather than sharing for its own sake.

What this means for country risk assessment

FATF finds most domestic PPPs are led by financial intelligence units, though it names at least 8 that are law-enforcement-led (including the UK's JMLIT+ and the US's CI-FIRST) and 15 coordinated by other authorities. A PPP functions when the legal basis for sharing is clear enough that a bank's compliance team will actually use it, regardless of which body leads it.

 

At KnowYourCountry, our jurisdiction assessments already track financial system transparency, beneficial ownership quality, and enforcement effectiveness across 245 jurisdictions. The FATF report is a reminder that information-sharing architecture, and the legal clarity around it, belongs in that same category of country risk evidence. A jurisdiction with a strong legal framework on paper but no functioning gateway between banks and its FIU carries a different risk profile than one where that gateway is legally clear and actively used, even if both sit outside the FATF grey list.

 

For compliance teams building the documented, defensible basis regulators now expect, that distinction is worth having in the file.