Do you manage the finances of an NGO or CSO and find yourself receiving requests from your bank about the origin of your funds? Are your financial partners demanding enhanced know-your-customer (KYC) procedures? You may have already experienced a refusal to open a bank account, or even an abrupt account closure, without any clear explanation. These situations, which are increasingly common in the humanitarian sector, are directly linked to the growing obligations around anti-money laundering and counter-terrorism financing (AML/CFT). For organisations operating in high-risk areas, transferring funds internationally and working with local partners, regulatory pressure has never been so intense.

Yet AML/CFT compliance should not be seen as just another administrative burden. Properly understood and properly equipped, it becomes a credibility lever with your donors, a guarantee of transparency for your supporters, and a safeguard against major reputational risks. In this article, we decode the regulatory framework that applies to NGOs, the concrete obligations that flow from it, and the best practices to put in place — with the support of tools like Abvius that help structure and automate this compliance on a day-to-day basis.

AML/CFT Compliance for NGOs: Mastering Anti-Money Laundering and Counter-Terrorism Financing Obligations

Reading time: ~14 min

1. What is AML/CFT and why are NGOs concerned?
2. The regulatory framework: FATF, AMLA and national law
3. Specific AML/CFT risks for NGOs
4. Concrete obligations: KYC, screening and due diligence
5. Comparison of AML/CFT compliance approaches
6. How Abvius supports your NGO's AML/CFT compliance
7. Best practices: 5 steps to structure your AML/CFT program
8. Mini FAQ

1. What is AML/CFT and why are NGOs concerned?

Anti-money laundering and counter-terrorism financing (AML/CFT) refers to all the legal, regulatory and operational frameworks designed to prevent the use of the financial system for criminal purposes. While banks and financial institutions are the primary obliged entities, non-profit organisations (NPOs) — including NGOs and CSOs — have been identified by the Financial Action Task Force (FATF) as potentially vulnerable to the diversion of funds for terrorist purposes.

This vulnerability stems from several factors that are inherent to the humanitarian sector: cross-border financial flows, presence in conflict zones or sanctioned territories, the multiplicity of local intermediaries, and sometimes a level of internal process formalisation that is insufficient to ensure full traceability. FATF Recommendation 8 specifically targets NPOs and requires States to identify those that present a high risk of abuse, and then to put in place proportionate supervision and control measures.

FATF's functional definition

FATF adopts a functional definition of an NPO: any legal person, legal arrangement or organisation that is primarily involved in raising or distributing funds for charitable, religious, cultural, educational, social or fraternal purposes. This broad definition therefore covers the vast majority of NGOs and CSOs, whether they are governed by French, European or international law.

It is essential to understand that Recommendation 8 is not intended to criminalise the non-profit sector, but rather to protect legitimate organisations from abuse. The recommended approach is risk-based: not all NGOs are exposed in the same way, and measures must be proportionate to the level of risk identified.

2. The regulatory framework: FATF, AMLA and national law

FATF Recommendations

FATF, the intergovernmental body based in Paris, sets the international standards on AML/CFT. Its 40 Recommendations, updated in October 2025, form the foundation on which national legislation is built. Recommendation 8 remains the central reference for the non-profit sector. It is supplemented by interpretive notes and a best practices guide for combating the abuse of NPOs, which emphasises the need for constructive dialogue between the authorities and the non-profit sector.

AMLA: the new European authority

Since 1 January 2026, the European Anti-Money Laundering Authority (AMLA), based in Frankfurt, has taken over from the European Banking Authority (EBA) to coordinate AML/CFT supervision across the Union. The European Anti-Money Laundering Regulation (AMLR — Regulation 2024/1624) expands the scope of obliged entities and strengthens due diligence requirements. By 10 July 2026, AMLA must publish regulatory technical standards specifying the risk variables and factors to be taken into account when establishing business relationships — including with non-profit organisations.

For NGOs, this evolution means in practice that the banks and financial institutions they work with will be subject to even stricter due diligence requirements. Documentation requests, KYC questionnaires and enhanced controls will only intensify.

The French framework

In France, the Monetary and Financial Code (Book V, Title VI) transposes the European directives and FATF recommendations. While associations and NGOs are not directly subject to AML/CFT obligations in the same way as banks, they are indirectly concerned on two counts: on the one hand as clients of financial institutions (which must exercise their due diligence), and on the other hand as organisations that may be subject to financial transparency and governance obligations reinforced by the 2014 Social and Solidarity Economy (SSE) Act and its implementing decrees.

3. Specific AML/CFT risks for NGOs

NGOs have operational characteristics that, without implying any fraudulent intent, create vulnerabilities that can be exploited by malicious actors. Understanding these risks is the first step in guarding against them.

Cross-border financial flows

International NGOs regularly transfer funds to developing countries, sometimes through lightly supervised financial corridors or informal transfer systems. These flows, even when entirely legitimate, can attract the attention of financial intelligence units (FIUs) and correspondent banks.

Presence in sanctioned or high-risk areas

Humanitarian NGOs operate precisely where needs are most acute — and therefore often in conflict zones, countries under international sanctions or territories controlled by armed groups. This geographic presence, which is essential to their mission, constitutes a major risk factor in banks' AML/CFT assessments.

Multiplicity of local partners

Relying on local partners, subcontractors or community-based organisations is a common practice that is often encouraged by donors as part of the localisation of aid. But every additional link in the chain of fund distribution represents an additional control point that must be secured.

The banking "de-risking" phenomenon

Faced with the complexity and cost of enhanced due diligence procedures, some banks simply prefer to refuse or close the accounts of NGOs operating in sensitive areas. This "de-risking" phenomenon — documented by FATF itself as a perverse effect of regulation — pushes NGOs towards sometimes less transparent alternative solutions, creating a vicious circle.

4. Concrete obligations: KYC, screening and due diligence

Even though NGOs are not obliged entities in the strict sense in France, they must meet the requirements of their banks, their donors and the applicable regulations. Here are the practical obligations to integrate into your compliance program.

Know Your Customer (KYC) and identification of beneficial owners

Your bank is required to know its client. For an NGO, this means providing: up-to-date statutes, the list of directors and board members, the governance chart, the identification of beneficial owners (as defined by the European directive), activity reports and certified accounts. You must be able to produce these documents quickly and keep them permanently up to date.

Sanctions list screening

NGOs must ensure that none of their partners, suppliers, employees or beneficiaries appear on international sanctions lists (UN, EU, OFAC, French Treasury). This screening must be carried out before any new partnership, contract or transfer of funds, and updated regularly. The lack of systematic screening is one of the main criticisms raised during donor audits.

Due diligence and suspicious activity reporting

If your organisation identifies a suspicious transaction — an unknown donor making a large transfer, a local partner unable to justify how funds were used, a payment request to a country under embargo — you have a moral and sometimes legal responsibility to report these situations. In France, the TRACFIN unit is the competent body for receiving these suspicious activity reports.

Document retention and audit trail

The regulation requires that documents relating to financial operations be kept for at least five years after the end of the business relationship. For NGOs, this means archiving all supporting documents in a structured and accessible manner: contracts, invoices, proof of payment, approval minutes, screening results, and any document attesting to the due diligence exercised.

5. Comparison of AML/CFT compliance approaches

NGOs have several options for structuring their AML/CFT compliance program. The table below compares the three most common approaches:

6. How Abvius supports your NGO's AML/CFT compliance

AML/CFT compliance cannot rely on isolated processes or tools disconnected from the rest of financial management. This is precisely where an ERP designed for NGOs delivers structural value. Abvius, as an integrated Finance, Operations and MEAL platform, offers several features that can be put to work directly within your compliance program.

Full traceability and digital audit trail

Every transaction, every validation, every modification in Abvius is automatically timestamped and linked to its author. This digital audit trail is the backbone of your AML/CFT program: it allows you to demonstrate, at any time, who authorised which expense, when, and on what basis. In the event of a donor audit or regulatory review, you have a complete and tamper-proof history at your fingertips.

Multi-level validation workflows

Abvius's validation workflows let you define approval circuits tailored to the nature and amount of each operation. A purchase above a certain threshold can automatically trigger an additional hierarchical validation, including a check on supplier compliance. These workflows ensure segregation of duties and the dual-signature principle — two fundamental requirements in AML/CFT.

Electronic signature and dematerialisation

The electronic signature built into Abvius eliminates the risks associated with paper documents: loss, forgery, delays in transmission between the field and headquarters. Every electronically signed document is legally enforceable and integrated into the overall audit trail.

Real-time headquarters-field centralisation

With Abvius, field teams and headquarters work on the same platform, with the same data, in real time. This centralisation eliminates the blind spots that can arise when field offices manage their finances independently using local spreadsheets. Headquarters has instant visibility over all financial operations, a prerequisite for quickly detecting any anomaly.

Real-time budget monitoring and automatic donor reporting

Abvius's real-time budget monitoring makes it possible to immediately detect any significant gap between planned and actual expenditure — a potential AML/CFT warning signal. Automatic donor reporting, for its part, ensures that the information transmitted to your financial partners is complete, consistent and produced from verified data.

7. Best practices: 5 steps to structure your AML/CFT program

Step 1: Carry out an AML/CFT risk mapping

Start by identifying your specific risk factors: geographic areas of operation, types of partners, fund transfer channels, donor categories. Classify these risks by level (low, moderate, high) and document your analysis. This mapping forms the foundation of your proportionate approach, in line with FATF recommendations. If you have already produced a broader risk mapping, the AML/CFT component should be a dedicated chapter within it.

Step 2: Formalise your policies and procedures

Draft an AML/CFT policy tailored to your organisation, approved by your governance (board of directors or equivalent). This policy should cover: KYC procedures for partners and suppliers, sanctions list screening, handling of suspicious transactions, internal responsibilities, and reporting procedures. Integrate these procedures into your existing internal control framework.

Step 3: Put systematic screening in place

Establish mandatory screening of all new partners, suppliers and employees against international sanctions lists (UN, EU, OFAC). This screening must be renewed periodically (at least annually) and documented. Keep the results — including negative results — in a centralised register. If you use an ERP like Abvius, integrate this check into the workflows for creating supplier and partner records.

Step 4: Train your headquarters and field teams

AML/CFT compliance cannot rest on the finance department alone. Field teams — program coordinators, logisticians, partnership managers — must be made aware of warning signs: unusual transactions, partners reluctant to provide information, sudden changes in beneficiaries. Plan annual training sessions adapted to the operational context of each country office.

Step 5: Audit and improve continuously

Your AML/CFT program must be a living one. Conduct an annual internal audit of your procedures, test the effectiveness of your controls, and update your risk mapping as your areas of operation and partnerships evolve. The findings of this audit should be presented to your governance body and built into your donor audit preparation.

8. Mini FAQ

Are NGOs directly subject to AML/CFT obligations in France?

In France, NGOs are not obliged entities in the same way as banks or notaries. However, they are indirectly concerned because their banks must exercise enhanced due diligence with respect to them. In addition, some donors (ECHO, USAID, AFD) contractually impose screening and due diligence obligations that go beyond the minimum legal framework. In practice, an NGO that does not have a structured AML/CFT program risks losing its banking relationships and its funding.

Are there any free tools for sanctions list screening?

Yes, several sanctions databases are freely accessible: the consolidated list of the United Nations Security Council, the EU sanctions list (via the Official Journal), and OFAC's SDN list. However, manual screening against these lists is tedious and prone to errors. Specialised tools (such as OpenSanctions or modules integrated into ERPs) make it possible to automate this process and document the results for the audit trail.

What should I do if my bank threatens to close my NGO's account?

Banking "de-risking" is a well-documented phenomenon affecting many NGOs. If you are threatened with closure, proactively gather and present your compliance file: AML/CFT policy, screening results, audit trail, certified audit reports, transparent governance. The guide published by the French Ministry of Foreign Affairs in 2024 on NGO-bank relations provides useful recommendations for keeping the dialogue open. A well-documented program, backed by a tool like Abvius, demonstrates your seriousness and can help avoid a closure.

What impact will AMLA have on NGOs in 2026?

AMLA (the European Anti-Money Laundering Authority) will not directly supervise NGOs. However, it will harmonise and strengthen the requirements placed on European banks, which will have an indirect effect on the NGOs that bank with them. The technical standards that AMLA must publish by July 2026 will specify the risk factors to be considered, including for relationships with the non-profit sector. The best-prepared NGOs will be those that have anticipated these requirements by structuring their compliance program now.

Summary

AML/CFT compliance is no longer a concern reserved for financial institutions. For NGOs and CSOs, it has become a strategic issue that determines access to banking services, credibility with donors and protection against major reputational risks. As regulatory pressure intensifies — with AMLA coming into operation, the update of FATF recommendations and the growing requirements of donors — organisations that have proactively structured their program will hold a decisive advantage. By relying on integrated tools like Abvius, which guarantee traceability, centralisation and automated controls, AML/CFT compliance stops being a burden and becomes a lever for trust and transparency.

To explore related topics in more depth, read our articles on anti-fraud, internal control, the digital audit trail and partner due diligence. To find out how Abvius can support you, get in touch.