Financial Crime Compliance and Risk Management
The Compliance Program and Risk Framework
Financial crime compliance (FCC) is about building a program that identifies, measures, mitigates, and monitors financial crime risk. Candidates should know the core components: governance and tone at the top, a written policy suite, a risk assessment (enterprise-wide and customer/product/channel/geography-specific), customer due diligence, transaction monitoring, sanctions screening, training, independent testing/audit, and recordkeeping. The three lines of defense model is frequently tested: the business (first line) owns risk; compliance and risk functions (second line) set frameworks and challenge; internal audit (third line) provides independent assurance.
Risk Appetite, Metrics, and Traps
Understand risk appetite statements and key risk indicators (KRIs) such as alert volumes, false-positive rates, backlog aging, and training completion. Know the difference between inherent risk (before controls) and residual risk (after controls). A recurring trap is treating compliance as purely the second line's job - in the three-lines model, the front office is accountable for identifying and escalating risk. Another trap: confusing a risk assessment (forward-looking, prioritization) with an audit (independent testing of control effectiveness). Also know that de-risking (exiting whole customer categories) can itself create risk and may conflict with financial inclusion expectations; risk mitigation is preferred to wholesale exit where feasible.
Be alert to questions about outsourcing: the regulated firm retains accountability even when a vendor performs the activity. And understand escalation and governance: material issues go to senior management and the board, with documented remediation plans and owners.
Rule of thumb: When asked "who is responsible?" the answer is usually everyone in a defined role - business owns it, compliance advises and challenges, audit assures.
Worked example: A bank's monitoring backlog grows while alert volume is stable. KRI = aging backlog; root cause may be insufficient analyst capacity; response = staffing, tuning rules to cut false positives, documented remediation plan with board reporting.