By: Paul Cochrane
Sanctions may have eased on Syria, but the country and its financial institutions face an uphill struggle to integrate and comply with anti-money laundering (AML) and countering the financing of terrorism (CFT) requirements—not only those of the Financial Action Task Force (FATF), but also the international financial sector’s particular demands.
Given the length of time Syria has been cut off from the international banking system, leaving the country on the back foot vis-à-vis the latest AML requirements, best practices, and AML technological systems, Syria, as a former MONEYVAL official put it, “is going to have to learn how to fly a plane while flying” to get its AML regime up to par.
The global AML system is structured in such a way as to be largely stacked against Syria. The launch of Syria’s National AML/CFT Strategy in July 2026 is an important step toward addressing this challenge. But no matter how quickly the Central Bank, the Financial Intelligence Unit (FIU), regulators, and law enforcement get up to speed in developing a National Risk Assessment (NRA) of money laundering and terrorist financing risks and establishing the institutional foundations needed for evaluators from MENA-FATF to assess the country’s progress, Syria and its private sector entities will continue to be viewed as high risk by international financial institutions.
Such risk perception is highly influenced by commercial providers of regulatory technology (regtech). These platforms and software solutions use machine learning and automation to perform AML compliance functions, including transaction monitoring, detecting unusual activity, sanctions screening, and generating reports for regulatory review and audit. They also rely heavily on risk indices and third-party data providers, whose assessments and intelligence feed directly into regtech platforms and banks’ compliance systems, reinforcing perceptions of risk.
At the same time, Syrian institutions need access to such commercially provided services in order to demonstrate their AML regime to the regulator and, crucially, to meet the requirements of foreign correspondent banks. According to Syrian bankers, however, access to these services has been constrained by sanctions. For example, Bankers Almanac, a provider of reference data for the international banking and financial services sector owned by US-based LexisNexis Risk Solutions, and World-Check, a screening database owned by the London Stock Exchange Group (LSEG), are not providing services to Syrian financial institutions. LexisNexis confirmed that it does not operate in Syria, but did not provide further explanation.
How far behind Syrian banks are in adopting AML software is indicated by the fact that, for instance, the screening of sanctioned individuals and entities—which is typically automated elsewhere—is done manually, said a senior Syrian banker.
The reasons for not granting Syrian institutions access may lie in providers’ heightened risk aversion rather than sanctions, said Gary Youinou, managing director of KnowYourCountry Limited, a commercial provider of geographical AML data and information.
“If, say, a US company wants to sell a system to Syria, they would normally have to do due diligence on the Syrian business, so the sanctions issue will be raised. And very often lawyers err on the side of caution. Head offices may also have [a mindset of], ‘let others take on the risk in that jurisdiction’,” he said.
A further obstacle, even without such sanctions-related constraints, is that Syrian institutions face high costs to acquire commercial services and systems, as well as to train their staff to operate and develop bespoke systems in line with local, regional, and global particularities. Without these systems, Syria will struggle to get its AML regime on track, attract investment and, crucially, get off the FATF grey list and have a “clean bill of health.”
The Gap Between Legal Permission and Commercial Willingness
In mid-2025, following the overthrow of Bashar al-Assad’s regime, unilateral sanctions by the US, EU, and others that had been imposed prior to and during the conflict were eased to enable Syria’s economy to reintegrate. That enabled the Brussels-based SWIFT financial messaging system and US-based Visa and Mastercard payment systems to operate in Syria. But the easing of sanctions has not translated into Syria being completely open for business. Risk aversion still abounds.
Michael Stellini, managing director of Vienna-based Stellini Advisors, and former deputy executive secretary of MONEYVAL, the Council of Europe’s Committee of Experts on the Evaluation of AML Measures and the Financing of Terrorism, said there was a distinction between the legal opening of Syria for business and the commercial willingness of the private sector to enter the market. “It is one thing to say, okay, all the sanctions have now been revoked and there’s to be an evaluation by FATF or its regional partners, but banks do not necessarily follow these decisions. There’s a big time lag, in fact,” he said.
Indeed, private institutions have no compulsion to enter the Syrian market—it is their choice to do so or not—despite the ostensible encouragement of the US, UK, and European governments to support the war-torn Syrian economy. This also applies to AML service providers.
With no public or not-for-profit service providers in this space, the privately-run providers do not have to follow government policy, such as engaging with Syria. “There’s nothing that is particularly unique about Syria to merit a Syria-driven intervention because this issue is pervasive,” said Anna Bradshaw, partner at law firm Peters & Peters in London.
Syrian institutions are essentially beholden to the whims of the private sector and service providers, in particular their appetite for risk. Such providers are extremely important for correspondent banking relations, but also in shaping perceptions of Syria through indices used to determine the perceived risk of a jurisdiction. Such indices include Transparency International’s Corruption Perceptions Index (CPI), the World Bank’s Worldwide Governance Indicators (WGI), and the Basel AML Index, as well as US reports, particularly State Department and Treasury reports.
US reports are linked to the Treasury’s Financial Crimes Enforcement Network’s (FinCEN) eight priorities for AML and CFT, issued in 2021: corruption; cybercrime; foreign and domestic terrorist financing; fraud; transnational criminal organization activity; drug trafficking; human trafficking; and proliferation financing.
Syria scores very low on every one of FinCEN’s priorities. Its designation as a state sponsor of terrorism (SST) is now subject to a formal rescission process: on July 8, 2026, the US administration notified Congress of its intent to rescind the designation, beginning the required 45-day notification period. “Anybody following the FinCEN rules will say that Syria would be good as an emerging market, but it is very difficult for the time being until more positive information comes out of Syria,” said Youinou.
The risk indices typically use mathematical models, drawing on indicators and data. For example, Transparency International’s CPI, which it claims is “the most widely used global corruption ranking in the world,” measures how corrupt a country’s public sector is perceived to be. The CPI draws on “at least” three data sources from 13 different corruption surveys and assessments, including data sourced from institutions such as the World Bank and the World Economic Forum. The score is on a scale from zero to 100, with zero indicating “highly corrupt” and 100 “very clean.” In 2025, Syria had a score of 15—the same as North Korea and Equatorial Guinea—ranking 172nd out of 182 jurisdictions. Syria scored 12 in 2024 and 13 in 2023.
The Global Terrorism Index (GTI) 2025 is another example. Considered to be the most widely used dataset (as two other databases, the RAND Corporation’s and the University of Maryland’s are no longer operational) it draws exclusively on raw data from Dow Jones-owned Dragonfly Intelligence. A June briefing note by a UN Special Rapporteur on the “global terrorism data deficit” argues that “there is no comprehensive, methodologically sound, and reliable dataset on the global prevalence and severity of terrorist acts, groups and threats,” which results in “incomplete, unreliable, and inflated data [that] can distort counter-terrorism policy and funding decisions.”
The report further notes that the GTI’s data is “inadequate, whether because it is too geographically limited, out of date, methodologically unsound, or over-inclusive.” The briefing noted that the index ranks countries by terrorism impact, using incidents, fatalities, injuries, and hostages weighted over five years, “but since the underlying data is unreliable, so too is GTI’s analysis.” Syria ranked sixth among the top ten countries most impacted by terrorism in 2026.
While the CPI and GTI are updated annually, other indices are often incomplete and rely on information that could be 12 to 24 months out of date. For instance, the World Bank’s WGI on Syria is for 2024, as is the US State Department’s latest International Narcotics Control Strategy Report on Money Laundering, released in March 2025 (the 2026 report has yet to be released). “The data may not even have caught up with the fact that the regime fell,” said Luna Zitani, a senior financial crime and sanctions specialist.
This time lag is compounded by the central role that FATF mutual evaluation reports play in AML risk indices and assessments. These evaluations are typically conducted every five years. Syria’s most recent evaluation, however, was published two decades ago, when MENA-FATF released its report in 2006. FATF grey-listed Syria in 2010. Although FATF acknowledged in 2014 that Syria had completed an action plan addressing key technical deficiencies in its AML/CFT regime, the country was not removed from the grey list because an on-site assessment could not be conducted owing to the security situation.
With MENA-FATF evaluating countries only periodically, “there is no up-to-date list of the risks a country may pose,” said Stellini. He said that Syria may struggle to shake off its reputation because of the time it will take to improve its system and undergo a further evaluation from MENA-FATF. “It is also not only a question of whether a country has a reputable system or not, but how it is perceived by other countries. Those perceptions are greatly influenced by indexes, which sometimes rely on outdated information.”
Terra Incognita
The evaluation reports are a key factor for private sector country assessments. For instance, the platform KnowYourCountry incorporates data from international agencies and rankings, including FATF reports, to determine jurisdictional risk. “We use those to calculate and come up with an index based on the evaluation report, as [the FATF] are basically global policemen and tied in with any other indices that are useful. But that means for Syria it is going to be hard to move up on these indices, as the evaluation will be a slow process,” said Youinou.
In the leadup to the evaluation, FATF’s Recommendation 1 requires a jurisdiction to carry out a National Risk Assessment (NRA) on its money laundering and terrorist financing risks, based on a collaborative assessment between the public authorities and the private sector. Syria is continuing its NRA work and launched its National AML/CFT Strategy in July 2026, intended to translate that risk analysis into coordinated reforms. The Central Bank’s reform agenda adds operational priorities covering beneficial ownership, Know Your Customer (KYC) and electronic Know Your Customer (e-KYC), risk-based supervision, AML/CFT tools, and compliance training.
With no independent or reliable global risk assessments available other than the NRA and FATF assessments, compliance officers at international institutions have to check the different private indices to determine a country’s risk, as well as other open-source information, from government-issued statistics and data to media reports.
Syria, however, is not far off from being terra incognita to the Western AML community, which is impacting the perception of the country. “Precisely because Syria is such an unknown part of the world, people are even more reliant on commercial data service providers as opposed to Googling [for information],” said Bradshaw.
There were minimal to no relations between international financial institutions and Syria during the conflict, while prior to 2011 relations with the Syrian financial sector had also been relatively limited. Yet while the lack of direct knowledge of the country is a hindrance in gauging risk, the larger drawback is the lack of insight into what is currently happening on the ground.
Zitani pointed to the Central Bank of Syria having had a large statistical department that collated macroeconomic data. “It no longer exists, so there’s no official data on the country. For a European bank revisiting country risk at the moment, they don’t have enough access to information or data to determine if Syria is high risk or not. International banks are saying they don’t know where to start,” she said.
In Bradshaw’s view, the dearth of reliable open-source information on Syria impacts indices and risk assessments, as the indices are scanning for news on Syria but not necessarily distinguishing between credible and less credible sources. Furthermore, for Syria there may not even be “a meaningful distinction, as everything is ‘not really verifiably credible’ in a Western sense.”
Indicative of the challenge is that when the EU court hears applications for removals from the Syrian sanctions lists, it will accept reliance being placed by the Council on social media, such as LinkedIn and Facebook posts, as sources of information in support of a decision to include and maintain an individual on the list. “Anything goes,” said Bradshaw, “so if that’s the approach the courts take in de-listing cases, there is no reason why the same approach would not be taken by the financial services industry, which is desperate for information about Syria, Syrian persons, and Syrian businesses. The opportunities for abuse are rife, but the only way to fix this is for more people to go to Syria and report on it from the ground, and to recognize that there’s a real gap in the market for balancing more partisan needs with more neutral reporting.”
Until there is more in-situ reporting, as well as more data and transparency from the government, such as on company registries (including beneficial ownership), businesses that want to better understand their risk exposure will have to carry out private due diligence investigations and commission bespoke compliance reports on new Syrian customers and counterparties. “This is another can of worms, as this kind of due diligence is incredibly expensive to carry out. Even when you go to these lengths, there is no guarantee that the intelligence could not potentially turn out to be wrong, and no amount of money can make it foolproof,” said Bradshaw.
Correspondent Banking Relations and “Mini Evaluations”
A particularly fraught area for Syria is re-establishing correspondent banking relationships with international institutions. Such a relationship is essential for a Syrian (respondent) bank to carry out cross-border transactions and access foreign financial markets without a physical presence abroad.
Since 2025, a handful of banks in Europe have opened correspondent relationships with Syria, as have some Arab banks. But some Syrian banks have not been able to secure any correspondent banking relationships with European banks, being told by institutions that “internal policies are no transactions with Syria right now,” a Syrian banker said.
Establishing such a relationship places both the correspondent bank and respondent bank under heavy scrutiny. The correspondent bank’s compliance department will require the respondent bank to meet its requirements, in addition to demonstrating to the national regulator that it has carried out a thorough assessment of the respondent bank.
Under FATF’s Recommendation 13, a correspondent bank is mandated to gather information about a respondent institution’s business, reputation, and supervisory qualities; assess its AML/CFT regime, including transaction monitoring systems (TMS), suspicious activity reports (SARs) and suspicious transaction reports (STRs), and record-keeping requirements; and verify the customer due diligence and KYC processes carried out by the respondent bank.
The requirements have increased over the years Syria has been cut off from the international financial system. Before Syria was grey-listed, correspondent banks typically requested the respondent bank’s policies and procedures, and conducted an interview. “The bigger banks now want to stress-test the AML/CFT frameworks of the bank receiving the services, so essentially they’re conducting a mini [FATF] evaluation of a bank,” said Stellini.
For Syrian institutions, unless AML/CFT frameworks are more advanced, “they may not stand up to the scrutiny bigger banks will apply,” Stellini added. “It’s a bit of a vicious circle.” A vicious circle is where one problem in a chain of circumstances creates a new problem that increases the difficulty of solving the original problem. In Syria’s case, banking institutions have been unable to enhance frameworks due to sanctions, the lack of access to commercial databases and AML software, and the absence of pressure to follow the latest best practices, and therefore cannot meet the requirements demanded by external actors.
Indicative of this problem is the guidance published by the Wolfsberg Group, an association of 12 global banks, which are not legally binding but are considered benchmarks the industry should apply. A widely followed guidance document is its Correspondent Banking Due Diligence Questionnaire (CBDDQ), which has 132 questions that “should be used” by financial institutions engaging in cross-border and higher-risk relationships. The 2004 questionnaire was updated in 2014, 2018, and again in 2023, which means there may be situations where a Syrian bank onboarded a client based “on the outdated framework for managing correspondent banking risk on 28 questions as Syria went into the war, and now it’s over 100 questions, which is a completely different kettle of fish,” said Zitani.
Meeting the requirements of the questionnaire will prove challenging for Syrian institutions without access to commercial databases and AML software as, under the updated CBDDQ, respondent banks have to confirm they have processes for sanctions screening, politically exposed persons (PEPs) screening, and adverse information screening, as well as disclose the use of third parties in any component of an AML/CFT program. The latest CBDDQ includes a section on fraud and updated questions relating to sanctions policies and their approval.
Getting the Regtech… Right
Correspondent banks expect respondent banks to have adopted a risk-based, data-driven compliance framework that is in line with the shift from procedural compliance to tech-enabled risk management. The respondent bank may not necessarily use the same regtech and commercial service providers as the correspondent bank, but there is an increasingly common “unspoken assumption” that a bank should at least use recognized, well-established providers, “being closer to: What the hell are you doing if you’re not?” said Bradshaw. Some of the leading global providers are Refinitiv, NICE Actimize, World-Check, ComplyAdvantage, and Sanction Scanner.
Regulators also expect banking institutions to use these larger, established commercial systems that have been “tried and tested” and have a stamp of regulatory approval. This is to ensure accountability at all stages of an AML program and to enable financial institutions to demonstrate to regulators that they have appropriate controls in place. As a result of such unspoken requirements, the systems financial institutions are expected to use are far more limited than what is on offer.
“The tech offerings are narrowed to the larger, more established providers, and they also have relationships with the Big Four (accounting firms, which carry out audits on banks and companies, as well as consultancy work on AML programs), as they work with them,” said Dr. Mariola Marzouk, an honorary lecturer on ML at the University of Portsmouth, England, who has extensive experience in AML regulatory software.
The regtechs, meanwhile, will require a banking client to have a commercial relationship with a recognized data provider or third-party vendor that supplies information and intelligence for integration into their platforms to perform screening and due diligence.
“The regtech will ask the bank to provide it with the most up-to-date data to put in their system. They don’t want to be a link between the bank and the data provider, as that blurs accountability, and regulators don’t like that either,” said Dr. Marzouk. “It is hard to sell regtech if it doesn’t follow the indices you are kind of required to follow. It’s easier to sell tech that complies with the regulations; they are a safer backing for everyone.”
According to Dr. Marzouk, Syrian banks are therefore expected to have to acquire top-shelf AML systems, which come with a correspondingly high price tag. A commercial enterprise-grade sanctions screening deployment, for instance, may cost USD 400,000–500,000 for a bank to access the platform. Additional professional services are often required to tailor the platform to the institution’s data, monitoring rules, workflows, and reporting requirements. Depending on the scope of implementation, the total five-year cost of a licensed package can reach USD 2.5 million–4 million. For a mid-tier bank, the license can be around USD 200,000, depending on transaction volume, number of jurisdictions, sanctions list coverage, real-time vs. batch screening, and cloud vs. on-premises deployment.
“For a bank in Syria this is expensive, and it is not tailored to that particular market,” said Dr. Marzouk. “Financial institutions outside of Europe and the US face a lot of issues to face this status quo. They don’t have the same level of human expertise, are not as advanced in technology, and earn significantly less money. Their data is different, and so is the culture, so the problems are different, as is the perception of money laundering. It becomes extremely challenging to comply.”
Syrian institutions will nonetheless have to comply as best they can, whether through workarounds, as is happening now by obtaining information from strategic partners (such as accessing the Bankers Almanac), or by biting the bullet and paying for commercial service providers willing to enter the Syrian market. What will be key is to have an AML system in place that is defensible with regulators and correspondent banks.
“It is a narrowing window of opportunity, to rebuild the compliance infrastructure in Syria enough so it is not reliant on political will to deal with the country, but dealing with a country with a sensible, albeit not perfect, AML model from a risk point of view. To at least be in a defensible position with the regulator,” said Zitani.
Evaluation, Framework, Coordination and Outreach
Syria faces three key challenges that are interconnected and require strategic planning. In Stellini’s view, the challenges are to rebuild the whole AML structure, reintegrate the banking sector into the global system, and prepare for the MENA-FATF evaluation. “These are three separate yet integrated layers, and it is really about the sequencing of these layers, which is what the global community needs to get right,” said Stellini.
With the NRA process under way and the National AML/CFT Strategy launched, Syria is gearing up for the MENA-FATF evaluation. FATF and its regional body have discussed when it will be an appropriate time to carry out the Syria assessment, but no decision has yet been announced. FATF continued to list Syria as a jurisdiction under increased monitoring in its June 19, 2026, statement. It reiterated that Syria had substantially completed its agreed technical action plan in 2014, but that an on-site visit was still required to confirm that implementation had begun and was being sustained. FATF said the visit would be conducted at the earliest possible date, but did not specify when.
In preparation for the evaluation, Kevin Vandergrift, a partner at Stellini Advisors and a former member of the FATF Secretariat for 24 years, recommends that Syria establishes a strong coordination team on AML policy that works with MENA-FATF, FATF, and external players while domestically coordinating the process. “Syria should be extremely active in the FATF world to dispel and debunk misinformation and myths about the country,” he said. “Countries that do not do well in evaluations are those that don’t engage with FATF or its peers—going to the meetings and training sessions, organizing events, and becoming part of the community. That helps foster trust with other members and beyond.”
International cooperation by the FIU and financial institutions should also be encouraged to bolster Syria’s standing in the evaluation. “It can give direct insight into how a country’s procedures work,” Vandergrift added. “How quickly it responds to international requests, how open it is to dialogue. This is used as a tool in the evaluation process, as six months before the evaluation FATF circulates a feedback questionnaire on experiences in cooperation with a country. The extent to which a country communicates with the private sector is also an insight for outsiders into what a country is doing.”