40 FATF 40 Recommendations
21

Recommendation 21 · Group D · Preventive Measures

Former: R.14

Tipping-off & confidentiality

Recommendation 21 protects two crucial elements of the AML/CFT system: (1) financial institutions and their staff who file STRs in good faith are protected from liability for breach of confidentiality, and (2) it must be a criminal offence to disclose to the customer — or to any unauthorised third party — that an STR has been filed or that an investigation is underway ('tipping-off'). Without these guarantees, no compliance officer would ever file an STR.

Who must comply?

  • All financial institutions and DNFBPs subject to STR obligations
  • Compliance officers, internal auditors and senior managers
  • Front-line employees who detect or escalate suspicions
  • Third parties (auditors, lawyers, consultants) with access to STR information

Key requirements

  1. 1

    Liability protection for good-faith reporting

    Financial institutions and their directors, officers and employees must be protected by law from criminal and civil liability for breach of confidentiality if they report suspicions in good faith — even if they do not know precisely what the underlying criminal activity was, and even if no illegal activity actually occurred.

  2. 2

    Tipping-off prohibition as criminal offence

    It must be a criminal offence for financial institutions, their directors, officers or employees to disclose ('tip off') the customer or any unauthorised person about the fact that an STR has been filed, is being considered, or that any related information is being provided to authorities.

  3. 3

    Scope of tipping-off

    The prohibition extends to disclosure of: the fact that an STR was filed, the contents of an STR, the existence of an investigation, requests from competent authorities for information, and any related correspondence.

  4. 4

    Permitted disclosures within groups

    Sharing of relevant information within a financial group — for AML/CFT purposes — must not be considered tipping-off, provided adequate safeguards exist to prevent leakage to the customer.

  5. 5

    Limited disclosures for legal purposes

    Lawyers, notaries and accountants may, within strict limits, communicate with each other about a client to dissuade them from engaging in illegal activity — without this constituting tipping-off — but disclosure to the client of the fact that an STR has been filed remains prohibited.

Practical example

Example: a Mexican compliance officer's protection

A SOFOM ENR's compliance officer files a ROI with the CNBV after detecting a structured cash deposit pattern. The customer notices that their account has been temporarily frozen and threatens to sue for breach of confidentiality and damages. Under R.21 (Art. 38 LFPIORPI and Art. 115 LIC) the compliance officer and the SOFOM are protected from civil and criminal liability for the report. Separately, the branch manager who tells the customer 'we filed something with the regulator about your account' commits the offence of tipping-off — which in Mexico can result in imprisonment under Art. 400 Bis 1 CPF for AML-regime personnel.

How Mexico implements it

Country-specific section in Spanish — Mexican regulatory references (LFPIORPI, CNBV, SAT, UIF).

México implementa la R.21 mediante protección al reportante y prohibición expresa de tipping-off:

Art. 38 LFPIORPI — Protección al reportante

Protege de responsabilidad civil, penal y administrativa a quien presenta avisos de buena fe. La presentación no se considera violación de obligaciones de confidencialidad. Aplica a empleados y directivos.

Art. 39 LFPIORPI — Prohibición de divulgar

Está prohibido divulgar a quien sea objeto del aviso (o a terceros) la información relativa al aviso. Aplica antes, durante y después de la presentación.

Art. 115 LIC — Confidencialidad en sector financiero

Las instituciones de crédito tienen prohibido informar a sus clientes sobre los reportes presentados a la CNBV/UIF. La confidencialidad es absoluta y se extiende a auditores externos y consultores.

Art. 400 Bis 1 CPF — Tipping-off como delito

El servidor público o personal del régimen ALA/CFT que divulga información reservada relacionada con ROS o investigaciones puede ser sujeto de pena agravada bajo el Art. 400 Bis 1 (5-15 años de prisión + agravante de 1/2).

Milestones

  1. 1990

    Original Recommendation 14 on tipping-off

  2. 2012

    Renumbered as Recommendation 21

  3. 2025

    October 2025 update clarifies group-information-sharing carve-outs

Related Recommendations

Other Recommendations in Group D — Preventive Measures

9 R.9 Financial institution secrecy laws 10 R.10 Customer due diligence (CDD) 11 R.11 Record keeping 12 R.12 Politically exposed persons (PEPs) 13 R.13 Correspondent banking 14 R.14 Money or value transfer services (MVTS) 15 R.15 New technologies & virtual assets 16 R.16 Payment transparency (Travel Rule) 17 R.17 Reliance on third parties 18 R.18 Internal controls & foreign branches 19 R.19 Higher-risk countries 20 R.20 Suspicious transaction reports (STRs) 22 R.22 DNFBPs: customer due diligence 23 R.23 DNFBPs: other measures

Official citation

FATF (2012-2025), International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, Recommendation 21, FATF, Paris, France. Last updated October 2025.

Read the official text on fatf-gafi.org