Asset recovery: taking it back.

Why recovery is the point

Money laundering is not an end in itself. People launder because they want to keep what the crime produced and spend it without being asked where it came from. If the money is never taken back, the crime still pays and the laundering has done its job, whoever was convicted.

That is why confiscation sits at the centre of the anti-money laundering regime rather than at its edge. A suspicious transaction report that leads to nothing recovered has moved information. A report that leads to money frozen and returned has removed the reason the crime was committed.

The words matter, and people use them loosely. Keep these apart:

• Freezing — a temporary prohibition on moving, converting or dealing with property, which leaves ownership untouched. The property stays where it is.
• Seizure — temporarily taking custody or control of property, usually on the authority of a court or competent authority.
• Confiscation, also called forfeiture in some systems — the permanent deprivation of property by order of a court or other competent authority. Ownership moves to the state.
• Repatriation or return — sending confiscated property back to the country or the victims it was taken from. Confiscation and return are not the same step, and the second does not follow automatically from the first.

Two further distinctions decide what can actually be reached:

• Property-based confiscation targets the specific asset tied to the offence: this house, this account. Value-based confiscation orders payment of a sum equal to the benefit obtained, which can then be enforced against any assets the person has. Value-based orders survive the money being spent or hidden; property-based orders do not.
• Conviction-based confiscation requires someone to be convicted first. Non-conviction based (NCB) confiscation acts against the property itself, in separate proceedings, without requiring a conviction. NCB matters when the suspect is dead, has fled, is immune, or cannot be convicted for reasons that have nothing to do with whether the money is dirty.

The scale of what is not recovered. Precise global figures do not exist, and anyone quoting one with confidence should be treated carefully. What can be said is that every serious attempt to measure the gap has found it very wide. The Stolen Asset Recovery Initiative — a joint World Bank and UNODC programme — recorded, in its Asset Recovery Watch database, assets in the order of billions of dollars frozen, confiscated or returned across more than two decades of recorded cases. Estimates of what is stolen from developing countries run to tens of billions in a single year. The two numbers are built differently and are not a clean ratio, but no reading of them makes recovery look like a solved problem.

Treat that gap as the working assumption behind everything in this course. The framework exists; it does not yet produce much money back.

What the standards now require

Two of the FATF's forty Recommendations carry asset recovery. Recommendation 4 covers confiscation and provisional measures domestically. Recommendation 38 covers doing the same on behalf of another country — freezing, seizing and confiscating in response to a foreign request.

For a long time these were the quietest corners of the standards. That changed in October 2023, when the FATF revised both. The revision was the first substantial move on asset recovery since its 2012 best-practices work, and three changes matter most:

• Asset recovery becomes a policy priority. Countries are expected to treat recovery as a national objective with the institutions and resources that implies, rather than as an occasional by-product of prosecutions.
• Non-conviction based confiscation is now expected. Countries are required to establish an NCB confiscation regime — qualified by the phrase "to the extent consistent with fundamental principles of domestic law", which leaves room for legal systems where such a regime would conflict with constitutional protections. Before this, NCB was encouraged rather than required, and under the UN Convention against Corruption it was left to the receiving country to decide whether to act on a foreign NCB request at all.
• Extended confiscation and recognition of foreign orders. The revised standards address extended confiscation, which allows a court to reach assets beyond those tied to the specific offence charged where it is satisfied they derive from wider criminal conduct. They also expect countries to recognise one another's preliminary and final orders over property subject to confiscation, which is what turns a freezing order in one country into something that actually holds in another.

In November 2025 the FATF published Asset Recovery Guidance and Best Practices, supporting the revised Recommendations and aimed at the two effectiveness outcomes the assessment methodology measures here: Immediate Outcome 8, on proceeds and instrumentalities of crime being confiscated, and Immediate Outcome 2, on international cooperation. Reporting on that guidance emphasised acting early — provisional measures taken while the money is still identifiable, including the power of a financial intelligence unit to suspend or withhold consent for a transaction.

The treaty layer sits underneath. The United Nations Convention against Corruption (UNCAC) devotes its Chapter V entirely to asset recovery and states that the return of assets is a fundamental principle of the Convention — unusually strong treaty language. The United Nations Convention against Transnational Organized Crime (UNTOC) carries its own confiscation and international cooperation provisions. Countries that are party to both already have obligations that pre-date the FATF revision.

Why effectiveness is the harder half. Having the law is assessed separately from using it. Across the FATF's fourth round of mutual evaluations, the outcomes covering confiscation and international cooperation have been among the weakest scored anywhere in the methodology, with only a small minority of assessed countries reaching a substantial or high level of effectiveness on confiscation. A country can hold a good technical rating on Recommendations 4 and 38 and still recover almost nothing — and assessors now say so explicitly.

Trace, freeze, manage, return

Recovery is a chain, and it breaks at whichever link is slowest. Work through it in order.

1. Trace. Someone has to establish what the proceeds are, what they were turned into, and where they are now. The raw material is financial: account records, payment messages, customer due diligence files, beneficial ownership registers, property and company registries, and the reports institutions file. Tracing is not only a law-enforcement task — the FIU's analysis frequently produces the first usable picture, because it holds reports from many institutions that each saw only a fragment.

2. Freeze, fast. Money moves faster than process. The window between a transaction looking wrong and the funds being beyond reach is often hours. Several things can hold it:

• An FIU suspension or postponement power, where the law gives one, allowing a transaction to be held for a short statutory period while analysis is done. Some FIUs can also act on a request from a foreign counterpart.
• A court freezing or restraint order, obtained by investigators or prosecutors.
• The institution's own decision to decline to execute a specific instruction, within whatever its law allows.

3. Manage what has been frozen. This is the step most often forgotten and the one that destroys the most value. Frozen assets are rarely cash. They are vehicles, businesses, livestock, perishable goods, property, digital assets. They lose value, incur storage and maintenance costs, and sometimes need to be run as going concerns for years before a court decides anything. Countries that recover well tend to have a dedicated asset management function with the power to sell depreciating property early and hold the proceeds instead.

4. Confiscate. A court orders permanent deprivation — on conviction, through NCB proceedings, or by an extended confiscation order.

5. Return. Confiscated property is returned to the country or the victims. This is a negotiation as much as a legal process, and the share, the conditions and the monitoring of how returned funds are spent are usually agreed case by case.

Across borders, two routes run in parallel. A mutual legal assistance (MLA) request is the formal route: it produces evidence and orders admissible in court, and it is slow, often taking many months. Informal cooperation runs alongside it — practitioner to practitioner, before and during the formal request — to find out quickly whether the asset is there at all, so the formal effort is not wasted.

The informal layer has its own institutions. The Camden Asset Recovery Inter-Agency Network (CARIN), whose secretariat sits at Europol, connects law-enforcement and judicial practitioners working on tracing and confiscation, and a family of regional Asset Recovery Inter-Agency Networks (ARINs) covers other regions, including Asia-Pacific, the Caribbean, Eastern Africa, Southern Africa, West Africa and West-Central Africa. The Egmont Group provides the equivalent channel between financial intelligence units, with a secure network for FIU-to-FIU exchange. A practitioner who knows which of these to use, and uses it early, changes the outcome more than any amount of later paperwork.

What the institution has to do

The firm is almost always where the asset is. That is the whole reason the regime leans on institutions, and it is why a compliance function that thinks of itself as a reporting function has only understood half the job.

Write reports that can be acted on. A suspicious transaction report is the start of a possible recovery, and most are useless for it. What makes one usable:

• Identify the money, not just the suspicion. Account numbers, exact amounts, value dates, currencies, counterparties, correspondent routing, device and channel if known. An investigator cannot freeze "a large transfer last month".
• Say what you think happened and why, in plain sentences, with the facts that support it separated from the inference. Analysts triage on the narrative.
• Name the people and entities properly, with identifiers, dates of birth and registration numbers, and record the beneficial owner you identified, not only the account holder.
• File while it still matters. A technically perfect report filed six weeks late is a historical record.

Expect to be asked for more, and be able to answer. Production orders, court orders and foreign requests arriving through your authorities all require you to produce records quickly and completely — sometimes years after the event, when systems have been migrated and staff have left. Retention that merely satisfies a minimum period is not the same as being able to retrieve, reconstruct and attest to a transaction history that will be challenged in court.

Handle the freeze properly. When an order arrives, the obligations are specific: apply it to the right accounts, apply it immediately, do not move the funds, do not net them off against your own exposure unless the law allows it, and do not tell the customer. Tipping off is an offence in most systems, and the practical difficulty is real: the customer will ask why a payment failed. Firms that cope have agreed, lawful wording prepared in advance and staff trained not to improvise.

Think before you exit. Closing an account and returning the balance is often the commercially obvious move, and it can be the single most damaging thing a bank does to a recovery. The money leaves your control, goes somewhere you cannot see, and the trail that your own records would have supported ends. Where an investigation is live, the right question is not "how do we get this off our books" but "who do we need to speak to before we do anything".

What an auditor should be testing. Internal audit and external reviewers looking at this area properly will ask for evidence, not policy:

• How long from alert to filed report, measured, with the outliers explained.
• Whether freezing orders were applied within the time the law allows — sampled, with timestamps.
• Whether records requested by authorities were produced complete and on time.
• Whether anyone closed an account that was subject to a live request, and what governance was applied.
• Whether the beneficial ownership recorded on file was the one actually identified, or a restatement of what the customer said.

Supervision, SupTech and the regulator's mind

If you want to anticipate a supervisor, understand what they are being measured on. Assessors do not grade a country on how many policies it has. They grade it on outcomes — whether proceeds are actually confiscated, whether international requests are actually executed, and whether what the country recovers reflects its own assessed risks. A supervisor carrying that pressure is looking for institutions whose records show something happening, not institutions whose manuals read well.

The data is changing how that is done. SupTech — supervisory technology — was defined by Broeders and Prenio in a 2018 Financial Stability Institute paper as the use of innovative technology by supervisory agencies to support supervision. The following year, in FSI Insights No 18, Suptech applications for anti-money laundering (Coelho, De Simoni and Prenio, August 2019), the FSI deliberately widened that definition to cover advanced data collection and analytics tools used by financial authorities generally — not only supervisors and regulators, but other authorities such as financial intelligence units.

That paper, drawing on nine AML/CFT authorities, describes what the tools are actually used for:

• By supervisors: risk-scoring supervised institutions, so that attention goes where the likelihood of non-compliance is highest. One authority described in the paper builds its score from an institution's profile, its compliance history and — significantly — its reporting behaviour, drawing on the reports the institution itself has filed, alongside other intelligence. Supervisors also use network identification to see relationships across institutions.
• By financial intelligence units: network analysis over the report database and other sources, combining what different institutions filed at different times to surface relationships none of them could see alone, and models that estimate the likelihood that a given set of activity is laundering.

Read that twice if you are an MLRO. Your reporting is no longer only an input to investigations. It is an input to how your own supervisor rates you. Thin, late or templated reports are a visible signal in a dataset, and they are being read that way.

The same paper is careful about the limits, and the caution is worth carrying: because assessing the effectiveness of these tools is itself difficult, expert human judgment remains necessary to interpret and validate what they produce. SupTech is described as a complement to experienced staff at AML/CFT authorities, not a substitute for them. A firm meeting a data-driven supervisor should expect better-targeted questions, not automated conclusions.

A note on recovery agents. Alongside the public chain there is a private one: civil recovery lawyers, asset tracing firms, insolvency practitioners and investigators engaged by victims, liquidators or states. Civil proceedings have a lower standard of proof than criminal ones and can be faster, and for a victim who will otherwise recover nothing they are sometimes the only realistic route. They also carry risks worth naming: contingency fee arrangements that can consume much of what is recovered, investigative methods that may not be lawful in every country touched, data protection obligations that apply regardless of who is paying, and the possibility of a private action cutting across a live criminal investigation. An institution asked to assist a private recovery effort should establish who is actually instructing, under what legal authority, and whether the relevant authorities know.

What all of this means in practice. Recovery is slow, international, and decided mostly in the first hours. The institution rarely gets to finish the job, but it is the only participant present at the moment the money could still be stopped. That is the whole of the compliance function's contribution to asset recovery, and it is not a small one.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.