Most NPOs are exactly what they appear to be — which is what makes the sector useful to the few that are not: FATF Recommendation 8 targets terrorist-financing abuse of non-profits while explicitly warning against treating every charity as suspect.
The rating above is indicative — it reflects inherent risk as assessed in the published frameworks, not a verdict on any business. Entire industries serve these sectors as business as usual; the rating your firm actually applies comes from its own business-wide risk assessment, where the sector factor combines with your customer base, controls and risk appetite.
Recommendation 8 and the FATF's best-practices paper are deliberately risk-based: only the subset of NPOs within the FATF definition is in scope, and the documented abuse typologies — sham charities, diversion of funds by insiders, exploitation of legitimate NPOs as conduits — concentrate where money crosses into cash economies or conflict-adjacent regions with weak banking.
The FATF is equally explicit about the other failure mode: over-application. Wholesale derisking of charities harms legitimate humanitarian work, and supervisors expect measures proportionate to an NPO's actual risk profile — purpose, governance and destination of funds — not blanket refusal.
Apply risk-based due diligence proportionate to the NPO's profile: verify registration and governance, understand funding sources and the destination of funds, monitor for diversion patterns — and avoid wholesale derisking of the sector. Sector risk combines with geography, the customer’s profile and the product to set the overall rating — and every client still needs sanctions, PEP and adverse-media screening on the parties themselves.
