40 FATF 40 Recommendations
23

Recommendation 23 · Group D · Preventive Measures

Former: R.16

DNFBPs: other measures

Recommendation 23 extends to DNFBPs the remaining preventive obligations beyond CDD: filing suspicious transaction reports (R.20), tipping-off and confidentiality (R.21), internal controls and group programmes (R.18), and higher-risk-country measures (R.19). Lawyers, notaries, accountants and TCSPs face an important nuance: legal professional privilege and similar protections may exempt them from STR filing for information obtained in privileged circumstances — but never for involvement in a transaction itself.

Who must comply?

  • Casinos and gambling operators
  • Real estate agents
  • Dealers in precious metals and stones
  • Lawyers, notaries and independent legal professionals
  • Accountants and accounting firms
  • Trust and company service providers (TCSPs)

Key requirements

  1. 1

    STR filing (R.20)

    DNFBPs must file STRs with the FIU when they suspect funds are proceeds of crime or related to TF — even if the transaction has not been completed.

  2. 2

    Legal professional privilege carve-out

    Lawyers, notaries and accountants are not required to report suspicions arising from information obtained in circumstances where they are subject to professional secrecy or legal professional privilege — but only when defending or representing the client in legal proceedings, or providing legal advice on legal proceedings. They cannot use privilege to shield themselves when they are party to or facilitating the suspicious transaction.

  3. 3

    Tipping-off (R.21)

    DNFBPs must comply with tipping-off prohibitions. Disclosing the existence of an STR or investigation to the customer is a criminal offence.

  4. 4

    Internal controls and programmes (R.18)

    DNFBPs must implement internal AML/CFT programmes proportionate to their size and risk: written policies, compliance officer, staff training, independent audit and (for larger firms) group-wide programmes.

  5. 5

    Higher-risk countries (R.19)

    DNFBPs must apply enhanced measures to relationships and transactions with persons from countries identified by FATF as having strategic deficiencies.

  6. 6

    Sanctions for non-compliance

    Effective, proportionate and dissuasive sanctions must apply to DNFBPs and their officers for failures to comply with the obligations under Recommendations 22 and 23.

Practical example

Example: lawyer-client privilege limits in Mexico

A Mexican lawyer is consulted on whether to defend a client against a money-laundering charge — privileged communication exempt from STR. But when the same lawyer is asked to set up a holding company structure to move USD 2M offshore, that is a 'specified transaction' under Art. 17 Fr. XI LFPIORPI: she must perform full CDD, identify the beneficial owner, verify source of funds, file an aviso with SAT if thresholds are crossed, and file a suspicious-transaction aviso if she identifies suspicion. Privilege does not apply when the lawyer is acting as financial intermediary.

How Mexico implements it

Country-specific section in Spanish — Mexican regulatory references (LFPIORPI, CNBV, SAT, UIF).

México extiende todas las obligaciones preventivas a las AV (espejo de DNFBP) en el Art. 18 LFPIORPI:

Art. 18 Fr. VI — Aviso al SAT por operaciones sospechosas

Las AV deben presentar aviso al SAT cuando detecten operaciones que, sin importar umbrales, parezcan estar vinculadas a actividad ilícita. La reforma de marzo 2026 introdujo el Art. 7 Bis del Reglamento: aviso 24h por intento.

Art. 38 LFPIORPI — Protección al reportante

Aplica también a las AV — los profesionales y empleados que presentan avisos de buena fe están protegidos de responsabilidad civil, penal y administrativa.

Secreto profesional con límites

El Art. 17 Fr. XI LFPIORPI obliga a abogados y contadores cuando actúan en operaciones específicas (compraventa, gestión de bienes, constitución de personas morales). El secreto profesional no exime de las obligaciones cuando el profesional es parte de la operación.

Reforma Reglamento marzo 2026 — Auditoría obligatoria

El Reglamento reformado introdujo la auditoría interna o externa anual (Art. 12 Bis) para todas las AV — alineando con la R.18 sobre controles internos y la R.23 sobre extender obligaciones de programa a APNFD.

Milestones

  1. 2003

    Original Recommendation 16 extends preventive measures to DNFBPs

  2. 2012

    Renumbered as Recommendation 23

  3. 2024

    Updated DNFBP guidance clarifies legal-professional-privilege scope

  4. 2025

    October 2025 update reinforces TCSP-specific obligations

Related Recommendations

Other Recommendations in Group D — Preventive Measures

9 R.9 Financial institution secrecy laws 10 R.10 Customer due diligence (CDD) 11 R.11 Record keeping 12 R.12 Politically exposed persons (PEPs) 13 R.13 Correspondent banking 14 R.14 Money or value transfer services (MVTS) 15 R.15 New technologies & virtual assets 16 R.16 Payment transparency (Travel Rule) 17 R.17 Reliance on third parties 18 R.18 Internal controls & foreign branches 19 R.19 Higher-risk countries 20 R.20 Suspicious transaction reports (STRs) 21 R.21 Tipping-off & confidentiality 22 R.22 DNFBPs: customer due diligence

Official citation

FATF (2012-2025), International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, Recommendation 23, FATF, Paris, France. Last updated October 2025.

Read the official text on fatf-gafi.org