40 FATF 40 Recommendations
28

Recommendation 28 · Group F · Powers of Competent Authorities

Former: R.24

Regulation of DNFBPs

Recommendation 28 extends the regulatory and supervisory framework of Recommendation 26 to DNFBPs: casinos must be licensed, regulated and supervised; other DNFBPs must be subject to effective AML/CFT monitoring — by a designated supervisor or by a self-regulatory body (SRB) acting under official authority. The supervisor must apply a risk-based approach and prevent criminals from being beneficial owners of DNFBP businesses.

Who must comply?

  • Casino regulators and gambling commissions
  • Real-estate sector supervisors
  • Bar associations, notarial chambers, accounting institutes acting as SRBs
  • Tax authorities supervising DNFBPs (e.g., Mexico's SAT for vulnerable activities)
  • Specialised DNFBP AML supervisors

Key requirements

  1. 1

    Casinos: licensing, regulation and supervision

    Casinos (including internet casinos) must be subject to comprehensive licensing, ongoing regulation and AML/CFT supervision. Operators that fail to obtain a licence must face effective sanctions.

  2. 2

    Other DNFBPs: effective monitoring

    Real estate, dealers in precious metals/stones, lawyers, notaries, accountants and TCSPs must be subject to effective monitoring for AML/CFT compliance — either by a designated public supervisor or by a self-regulatory body (SRB) under appropriate authority.

  3. 3

    SRB conditions

    Where SRBs supervise their members, they must operate under appropriate legal authority and oversight, ensure their supervisors are adequately resourced, apply effective sanctions for non-compliance, and not have conflicts of interest that compromise enforcement.

  4. 4

    Risk-based supervision

    DNFBP supervisors must apply a risk-based approach — focusing resources on higher-risk subsectors (e.g., real-estate cash transactions, casino VIP rooms, TCSPs in offshore structures).

  5. 5

    Fit-and-proper for DNFBP owners

    Supervisors must take measures to prevent criminals or their associates from becoming beneficial owners or holding senior management positions in DNFBP businesses (especially casinos and TCSPs).

  6. 6

    Effective sanctions for non-compliance

    DNFBP supervisors must have authority to impose effective, proportionate and dissuasive sanctions — fines, restrictions, suspensions, removals and revocations.

Practical example

Example: SAT supervision of vulnerable activities in Mexico

In Mexico the SAT supervises 16 categories of vulnerable activities (Art. 17 LFPIORPI). It maintains the SPPLD registry, conducts inspections, audits avisos filed, applies fines (200-65,000 UMA = MXN 23,462 - 7.6M), and as of the 2026 Regulation reform can request public-force assistance for obstructed visits. Casinos (Fr. I) operate under SEGOB licensing plus SAT vulnerable-activity supervision — a dual regime that matches Recommendation 28's casino-specific requirement.

How Mexico implements it

Country-specific section in Spanish — Mexican regulatory references (LFPIORPI, CNBV, SAT, UIF).

México estructura la supervisión APNFD bajo el SAT con coordinación de varias autoridades:

SAT — Supervisor primario de AV

El SAT mantiene el padrón SPPLD, recibe avisos, realiza visitas de verificación, dictamina multas y, desde 2026, puede exigir auditoría externa anual y solicitar fuerza pública. Cobertura: 16 fracciones del Art. 17 LFPIORPI.

SPPLD: portal antilavado del SAT 2026

SEGOB — Casinos

La Dirección General de Juegos y Sorteos de SEGOB autoriza y supervisa casinos (permisos de juegos con apuestas y sorteos). Coordina con SAT (Fr. I del Art. 17) y UIF para detección de operaciones sospechosas.

Notarios y corredores — Colegios + SAT

Los notarios y corredores tienen su régimen profesional (Colegios de Notarios, Colegio de Corredores Públicos) con función disciplinaria. Para PLD, son supervisados por el SAT bajo Fr. XII del Art. 17. La verificación cruzada incluye revisión de DeclaraNot y SPPLD.

Reforma julio 2025 + marzo 2026

Reforzaron la supervisión APNFD con auditoría obligatoria, EBR explícito, mecanismos automatizados, capacitación anual y aviso 24h por intento — alineando el régimen mexicano con la R.28 GAFI.

Milestones

  1. 2003

    Original Recommendation 24 on DNFBP supervision

  2. 2012

    Renumbered as Recommendation 28

  3. 2024

    DNFBP-supervision guidance updated, real-estate focus

  4. 2025

    October 2025 update reinforces SRB-oversight expectations

Related Recommendations

Other Recommendations in Group F — Powers of Competent Authorities

26 R.26 Regulation of financial institutions 27 R.27 Powers of supervisors 29 R.29 Financial intelligence units (FIUs) 30 R.30 Law enforcement responsibilities 31 R.31 Law enforcement powers 32 R.32 Cash couriers 33 R.33 Statistics 34 R.34 Guidance & feedback 35 R.35 Sanctions

Official citation

FATF (2012-2025), International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, Recommendation 28, FATF, Paris, France. Last updated October 2025.

Read the official text on fatf-gafi.org