Concept
Any cross-border capital movement today—opening a private banking account, purchasing real estate, obtaining residence by investment—begins with the same procedure: the bank or provider must understand who they are dealing with and where the money comes from. This is AML/KYC—rules against money laundering (Anti-Money Laundering) and client identification (Know Your Customer).
The global standard is set by FATF—an intergovernmental body whose 40 Recommendations countries transpose into national law. Around forty jurisdictions are direct FATF members, but through nine regional groups its standard covers over two hundred countries, so the basic verification logic is nearly identical everywhere. At its core is a risk-based approach: the higher the risk of the client or transaction, the deeper the check.
These rules have their own history. FATF was created in 1989 at the G7 summit in Paris—to combat drug cartels laundering proceeds through the banking system. The first set of 40 Recommendations appeared in 1990; after the September 11, 2001 attacks, the mandate expanded to include terrorist financing, and since 2019 it has become permanent. Over three decades, targeted anti-money laundering efforts have grown into a global verification infrastructure connecting nearly the entire financial world.
CDD and EDD
Basic verification (customer due diligence, CDD) means establishing the client's identity, confirming it with documents, identifying the beneficial owner behind a company, and understanding the purpose of the relationship. For higher-risk clients and transactions, enhanced due diligence (EDD) kicks in: additional documents, senior management approval, more frequent monitoring. The relationship doesn't end at onboarding—the bank conducts ongoing transaction monitoring and checks against sanctions lists.
Source of funds and source of wealth
For high-net-worth clients, the bottleneck is the origin of money, and here two levels are distinguished. Source of funds describes the origin of specific funds in a specific transaction: where the money for this payment came from. Source of wealth explains how the overall wealth was formed—business sale, dividends, inheritance, years of income. The bank expects a documentary chain: contracts, tax returns, statements, asset sale documents.
PEP and elevated risk
A separate category is politically exposed person (PEP): high-ranking officials, top managers of state-owned companies, deputies, judges of supreme courts, as well as their close associates and related persons. Foreign PEPs, domestic PEPs, and heads of international organizations are distinguished; the regime is strictest for foreign PEPs. PEP status does not prohibit service but automatically moves the client to EDD mode with verification of source of wealth and transaction approval at senior management level. The status itself does not disappear on the day of resignation: such a client is checked under the enhanced standard for at least another year, and in practice longer. A similar regime is triggered by adverse media mentions and connections to high-risk jurisdictions.
FATF and the new EU package
After FATF, the most notable shift in recent years is the EU reform. The package adopted in 2024 replaces fragmented national laws with a unified set of rules. The central regulation AMLR will apply directly in all EU countries from July 10, 2027: it sets a uniform beneficial ownership threshold at 25%, limits cash payments in business to €10,000 (countries may set an even lower limit), and requires identification of one-off cash transactions from €3,000. Supervision is centralized by a new body—AMLA, operating in Frankfurt from July 1, 2025. From 2028, it will directly supervise around forty of the largest cross-border financial groups—those operating in at least six EU countries and carrying the highest residual risk; the rest remain supervised by national regulators.
FATF grey and black lists
FATF backs its risk-based approach with two public lists. The black list—"call for action"—comprises jurisdictions with the most serious gaps: as of February 2026, it contains three countries—Iran, North Korea, and Myanmar. FATF calls for countermeasures against the first two, and enhanced due diligence for Myanmar. The grey list—"jurisdictions under increased monitoring"—is softer: the country has acknowledged deficiencies and agreed on a remediation plan, but any transactions with it automatically require EDD.
The grey list is fluid and reviewed at each FATF plenary. As of February 2026, it contains 23 jurisdictions; for private clients it's important that familiar financial centers are among them—Monaco, British Virgin Islands, Bulgaria, Lebanon. In February 2026, Kuwait and Papua New Guinea were added, while in autumn 2025 South Africa, Nigeria, Mozambique, and Burkina Faso exited. The lists are updated quarterly (the next plenary is in June 2026, results require verification), so the jurisdiction of counterparty and bank should be checked against the current version before structuring.
Beneficial ownership registers after the EU Court decision
Beneficial ownership transparency long moved toward full publicity until the EU Court intervened. On November 22, 2022, it invalidated (joined cases C-37/20 and C-601/20) open public access to beneficial ownership registers: unlimited ability for anyone to view owner data is a serious interference with the right to private life and protection of personal data (Articles 7 and 8 of the EU Charter). After the decision, many countries temporarily closed public registers.
Access was preserved but narrowed to those with legitimate interest: competent authorities, obliged entities like banks, journalists, and NGOs on money laundering topics. The new EU package enshrines this model at regulation level and maintains the uniform 25% ownership threshold. The balance for the beneficiary is this: data is no longer in open access but remains visible to banks, regulators, and those who prove legitimate interest. And the benefit of hiding ownership behind nominee holders is becoming ever smaller.
Crypto, CARF, and automatic exchange
Crypto-assets have ceased to be a rule-free zone. FATF's Travel Rule has been extended to crypto providers (VASPs): when transferring, they must transmit data about sender and recipient—just as banks do with regular transfers. In parallel, the OECD launched CARF (Crypto-Asset Reporting Framework)—the tax equivalent of CRS for crypto. Its rules have been in effect since January 1, 2026; the first automatic exchange will occur in 2027 among approximately 48 jurisdictions, including the EU (via DAC8). The second wave—Switzerland, Hong Kong, Canada—will join in 2028, the US by 2029.
Together with CRS expansion, data on accounts and wallets is increasingly stitched together between countries automatically. For clients with Russian roots, an additional layer is added: suspension of DTAs and exchange with a number of countries changes the disclosure picture, and general rules work differently here. The conclusion is one: both regular and crypto capital must be documentarily confirmed—bringing together scattered data is now much easier for regulators than ten years ago.
Who must verify: obliged entities
Verification is conducted far beyond just banks. AML rules are addressed to an entire class of obliged entities: besides banks and brokers, these include insurers, notaries, lawyers and auditors in certain transactions, corporate and trust service providers, real estate agents. Each of them at their point must identify the client and their beneficiary, assess risk, and report suspicious transactions to the financial intelligence unit (FIU).
The new EU package significantly expanded this list. With AMLR application from July 10, 2027, full AML regime covers crypto providers (CASPs) licensed under MiCA, crowdfunding platforms, as well as traders in luxury goods, precious metals, stones, and art for payments exceeding €10,000. Professional football was separately included in the perimeter—clubs and agents in large transfers. For CASPs, this is the same set of obligations as for banks: CDD, UBO establishment, transaction monitoring, and suspicious transaction reports.
Sanctions screening: the 50% rule and control
Parallel to AML, every onboarding undergoes sanctions screening. The client and their beneficiaries are checked against lists of OFAC (US), EU, OFSI (UK), and national registers. Inclusion on a list—for the US this is the SDN List—almost completely closes access to the financial system: assets are frozen, transactions blocked, correspondent banks refuse to process payments.
The key nuance is the 50% rule. A company in which one or more sanctioned persons directly or indirectly own 50% or more is considered sanctioned itself, even if it's not on any list. Shares of different blocked persons are aggregated. Therefore, the bank unwinds the entire ownership chain to the ultimate beneficiary and adds up the shares of all blocked participants. In recent years, OFAC has also gone beyond the formal 50%, assessing actual control over the company.
After 2022, the sanctions layer became especially dense for capital with Russian roots. By mid-2026, the EU had adopted two dozen sanctions packages: asset freezes, disconnection of banks from transactions, restrictions on "shadow fleet" and crypto infrastructure for circumvention. In practice, this often results in de-risking—the bank closes entire client categories to avoid dealing with nuances. Even a client without a single restriction faces refusals based on passport or money origin, and here again a carefully assembled capital history decides.
FATCA and CRS: senior contours of auto-exchange
Entry verification is only half the picture; the other half is automatic data exchange after account opening. The senior contour is American FATCA (2010): foreign banks must identify accounts of US citizens and tax residents and report them to the IRS, otherwise 30% is withheld from their US income. The mechanism works through intergovernmental agreements (IGAs): under Model 1, the bank reports to its tax authority, which transmits data to the IRS. FATCA's peculiarity is one-sidedness: the US receives data more broadly than it gives, and therefore remains a notable exception in global transparency.
The global response is CRS, the OECD standard from 2014, which over 120 jurisdictions have joined. Banks in participating countries determine the account holder's tax residency and annually transmit data on balances and income to their country. From January 1, 2026, an updated version—CRS 2.0—is in effect: it closes previous gaps and adds to the perimeter electronic money, central bank digital currencies, and indirect crypto ownership; the first exchange under new rules will occur in 2027.
The third contour is CARF for crypto-assets, discussed above: it completes the system to on-chain operations. Together, FATCA, CRS, and CARF form an almost continuous automatic exchange network. For the client, this means that an account opened "quietly" in another country still becomes visible to their tax authority. The Russian layer here is its own: suspension of exchange and DTAs with a number of countries changes data routes but doesn't cancel the obligation to declare accounts and income at home.
Trusts, foundations, and who counts as beneficiary
High-net-worth clients rarely own assets directly—between person and asset usually stands a structure: holding, trust, private foundation (Stiftung), sometimes private trust company (PTC). Any such structure is transparent for AML by design: the bank unwinds it to ultimate natural persons, whoever formally owns the asset.
In a trust, beneficiaries for AML purposes are considered several roles at once: settlor, trustee, protector if present, and beneficiaries—up to the class of persons in whose interests the trust was created. The bank identifies all. Separately, it's interested in the "economic" settlor: if the formal settlor turned out to be a nominee covering the real asset owner, verification will follow the real one.
In a foundation, the logic is similar: the founder is comparable to the settlor, and although transferred assets legally leave their personal property, they will still be established as beneficiary. FATF itself raised the global bar: revised Recommendations 24 (2022, legal entities) and 25 (2023, trusts and other arrangements) obliged countries to keep current beneficiary data accessible to competent authorities—through registers or equivalent mechanism.
Russian context: residency, DTAs, and amnesties
For clients with Russian roots, a separate layer is added to general rules. Russian currency residency requires notifying the tax authority about opening foreign accounts and submitting reports on fund movements; violations bring fines. Suspension of key DTA articles with "unfriendly" countries from 2023 changed taxation of cross-border income and data exchange routes—previous benefits on dividends, interest, and royalties largely ceased to work.
In parallel, the state offers legalizing mechanisms: capital amnesties and voluntary disclosure, as well as special administrative regions (SAR) for holding redomiciliation. Route choice depends on whether the client remains a Russian tax resident or loses residency upon relocation—and this determines which accounts and structures must be disclosed and where.
Document package and typical stop factors
In practice, onboarding most often stalls on the documentary side—what confirms the capital history. The basic package consists of three layers: identity (passport, address confirmation), ownership structure (registry extracts, charter documents, chain to beneficiary), and origin of funds and wealth (business or asset sale contracts, tax returns, bank statements, inheritance or dividend documents). The larger the amount and more complex the structure, the longer and more detailed the package.
Certain signals move the client to EDD mode or lead to refusal. Among typical stop factors: gap between declared income and account amount, cash of unclear origin, transit through high-risk jurisdictions, convoluted chain of companies without clear business purpose, freshly created structures for one deal, unwillingness to disclose beneficiary. Each of these is not a sentence by itself but requires clear explanation and documents.
Verification doesn't end at account opening: the bank conducts ongoing monitoring and periodically updates the file (KYC refresh), requesting fresh documents. Therefore, it's convenient to keep the "capital folder" alive—replenishing it with new deals and large receipts. A coherent and pre-explained history passes verification noticeably faster than one assembled at the last moment.
Where compliance is heading
Three systems—AML, tax transparency, and sanctions—worked separately ten years ago; today they increasingly converge. Checking source of funds, the bank simultaneously looks at tax logic and sanctions connections, and data from registers, CRS, and CARF are pulled into a unified client profile. Manual verification is being displaced by automatic screening and ongoing monitoring (perpetual KYC), and space for opaque structures shrinks with each new standard. The direction of movement is steady—toward greater transparency and earlier disclosure, so capital whose history is assembled and explained in advance wins.
What this means for the client
The practical conclusion is simple. Onboarding has become longer and stricter, unified EU rules leave less space for a "convenient" bank, and data is increasingly stitched together between countries through CRS and CARF. The winner is the one who assembled the documentary capital history in advance and keeps their structures transparent and explainable.
Section map: private client compliance
Below are related wiki materials on main directions of private capital compliance, grouped by topic.
Verification and source of funds: Source of funds · Investor onboarding to fund · Marketplace revenue and KYC
Beneficiaries and transparency: Beneficial ownership and nominee · Beneficial ownership registers (UBO)
Sanctions and screening: OFAC sanctions removal · Goods under EU sanctions · Unfriendly countries for Russia
Automatic data exchange: Tax transparency: CRS, FATCA · CRS overview · FATCA, FBAR, Form 8938 · CRS/FATCA and HMRC data
Structures—trusts, foundations, holdings: How trusts work · Trusts and CFC · Private trust company · Liechtenstein foundation · Panama private foundation · Holding ladder
Russian context: Russia: relocation and capital · DTA suspension · Capital amnesty · Currency residency · Loss of tax residency · SAR and redomiciliation · CFC
Crypto and banking: Crypto-friendly jurisdictions · MiCA—EU regime · Private banking
This material is an expert overview and does not constitute individual legal advice.