The FATF's 11 Immediate Outcomes are how a mutual evaluation measures whether a country's AML system actually works, not just whether the laws exist. Four of them turn on what financial institutions do, so a compliance team's evidence feeds the country's effectiveness rating directly. Knowing which outcomes your evidence supports is how you prepare for 2027.
This piece explains the Immediate Outcomes from the private sector's side. It is not a search-led topic, so treat it as a reference and a sales-enablement asset, useful for briefing a board or a client, not as a page that will rank.
It is written for CCOs, CROs and heads of AML at BSP-supervised institutions preparing for the 2027 mutual evaluation, and for anyone who needs to explain the effectiveness framework in plain terms.
What are the FATF's Immediate Outcomes?
They are the 11 results the FATF expects an effective AML and CFT system to achieve, assessed separately from whether a country's laws are technically compliant.
The FATF methodology assesses two distinct things. Technical compliance asks whether a country has the right laws and regulations, measured against the 40 Recommendations and rated compliant, largely compliant, partially compliant or non-compliant. Effectiveness asks whether the system works in practice, measured against 11 Immediate Outcomes and rated high, substantial, moderate or low. The fifth-round methodology, which the 2027 evaluation uses, puts more weight on effectiveness, so a country can have strong laws and still rate poorly if it cannot show results. The distinction is the one our guide to effectiveness evidence for 2027 builds on.
What are the 11 Immediate Outcomes?
They run from risk understanding and international cooperation through supervision, preventive measures and financial intelligence to investigation, confiscation and sanctions.
The 11 outcomes cover the whole chain from understanding risk to acting on it.
The outcomes most assessors test with financial institutions are IO.3, IO.4, IO.6, IO.10 and IO.11. Those are the ones a compliance programme can move.
Which outcomes does a compliance team's work feed?
Mainly IO.4 preventive measures and IO.6 financial intelligence, with supporting evidence for IO.3 supervision and the sanctions outcomes.
Four outcomes turn on institutional behaviour. IO.4 covers how well institutions apply customer due diligence, monitoring and record-keeping, so it is fed by your risk rating, your transaction monitoring and your case audit trail. IO.6 covers whether financial intelligence is used, which depends on the quality and timeliness of your suspicious transaction reports. IO.3 covers supervision, where your response to findings and your independent testing are the evidence, a point our guide to who checks the auditors develops. IO.10 and IO.11 cover targeted financial sanctions for terrorism and proliferation financing, fed by your screening. A programme that can show these working is contributing to the country's rating.
How are the outcomes rated, and what does the private sector contribute?
Each outcome is rated high, substantial, moderate or low, based on evidence that the result is being achieved, and institutions supply a large share of that evidence.
Assessors do not score effort; they score results, supported by cases, data and files. Malaysia's 2025 evaluation shows the pattern: its mutual evaluation report rated it substantial on six of the eleven outcomes and moderate on the rest, and flagged difficulty turning investigations into prosecutions, an IO.7 and IO.8 concern. For a financial institution, the lesson is that documentation is not enough. An assessor sampling IO.4 will want to see monitoring that caught real cases, determinations with reasoning, and reports filed on time, the kind of record our STR versus CTR guide describes.
How should a lean team prepare for the Immediate Outcomes?
Map your existing evidence to IO.4, IO.6, IO.3 and the sanctions outcomes, and fix the gaps before an assessor finds them.
Preparation is an evidence exercise, not a new programme. Three steps make it manageable. First, take each of the four private-sector outcomes and list what you could show an assessor today: rule inventories and tuning records for IO.4, filing timeliness and narrative quality for IO.6, independent-test findings and their closure for IO.3, and screening coverage for IO.10 and IO.11. Second, find the thin spots, such as determinations without recorded reasoning or tests whose findings were never closed. Third, fix them now, because an evidence gap found in 2026 is a task and the same gap found in 2027 is a finding. Our guides to the 2027 evaluation and the APG transaction-monitoring angle go deeper, and the broader supervisory context sits in our note on the grey-list exit.
How does Fyscal ARCX support effectiveness evidence?
Fyscal ARCX produces the records that an Immediate Outcomes assessment samples. Transaction Monitoring holds the rule inventory, the calibration history and the dry-run evidence that supports IO.4. Case Management keeps each determination with its reasoning and approver, and Regulatory Reporting tracks filing timeliness for IO.6. The Admin Control Center governs the configuration and the audit trail, so an assessor's sample can be traced end to end. The system does not raise a rating on its own, but it makes the evidence retrievable instead of reconstructed.
If you want to see what an IO.4 or IO.6 evidence sample looks like end to end, book a walkthrough of Fyscal ARCX and bring an outcome you want to evidence.