ANFI cheat sheet

AML/CFT obligations derive from the FATF 40 Recommendations, which set the international standard that national laws implement.

The three core pillars of any AML regime are customer due diligence, recordkeeping, and suspicious transaction reporting.

Regulated entities must appoint a designated AML compliance officer with authority and resources to enforce the program.

Independent testing of the AML program is required at least annually for many institution types; results go to senior management.

Risk-based approach: controls must be proportionate to the assessed money laundering and terrorist financing risk of the business.

A compliance program typically has four elements: internal policies, a compliance officer, ongoing training, and independent audit.

Regulators may impose civil money penalties, cease-and-desist orders, or license revocation for program failures.

Cross-border activity triggers obligations under both home-country and host-country rules; the stricter standard generally applies.

Regulatory changes must be incorporated into written policy within a defined timeframe and evidenced by training records.

CDD requires identifying the customer, verifying identity, and understanding the purpose and intended nature of the relationship.

Standard verification documents: government-issued photo ID for individuals; certificate of incorporation and ownership records for entities.

Beneficial ownership threshold: identify natural persons owning or controlling 25% or more, plus the controlling person if none qualify.

Enhanced due diligence applies to PEPs, high-risk jurisdictions, and unusually large or complex transactions with no clear purpose.

Simplified due diligence may be permitted only for demonstrably low-risk customers and never where suspicion exists.

Onboarding must screen against sanctions lists and adverse media before the relationship is established where feasible.

Ongoing monitoring includes periodic KYC refresh; risk rating determines refresh frequency (e.g., high risk annually).

If identity cannot be verified, the relationship must not be established or must be terminated, and a SAR considered.

Source of funds explains the origin of the specific money used; source of wealth explains the total accumulated estate.

Three stages of money laundering: placement (entering the system), layering (obscuring origin), and integration (returning as legitimate).

Red flags include structuring below reporting thresholds, rapid movement of funds, unexplained third-party payments, and unusual cash activity.

Structuring means deliberately breaking transactions to evade a currency transaction reporting threshold; it is itself a crime.

Suspicious activity reporting must be timely; many regimes require filing within 30 days of detection with a possible 30-day extension.

Tipping off - disclosing a SAR filing to the subject - is prohibited and separately sanctionable.

Sanctions screening differs from AML monitoring: sanctions require asset freezing and blocking, not just reporting.

Terrorist financing differs from money laundering in that the funds may be legally sourced; intent and destination are key.

Correspondent banking requires enhanced scrutiny of the respondent's AML program, ownership, and shell-bank risk.

Record retention for AML purposes commonly requires five years after the transaction or after the relationship ends.

Higher-risk products include wire transfers, prepaid instruments, private banking, and trade finance due to anonymity or value opacity.

Stored-value and prepaid cards carry elevated risk where reloadable, transferable, or usable across borders.

Trade finance risk arises from over/under-invoicing, phantom shipments, and mispricing to move value between parties.

Correspondent accounts (nostro/vostro) allow foreign banks to hold balances and process payments; they are a known layering channel.

Private banking and wealth management risk is elevated by high-value clients, offshore structures, and use of intermediaries.

New products must undergo a risk assessment before launch, with controls documented and approved by compliance.

Cash-intensive businesses and money services businesses present structural risk due to volume and limited audit trails.

Digital assets and virtual currency require specific controls: wallet screening, counterparty due diligence, and travel-rule data.

Product risk ratings should be reviewed when features change, such as adding cross-border capability or anonymity.

Enterprise-wide risk assessment combines customer, product, channel, geographic, and delivery risk into a single rating.

Inherent risk is the risk before controls; residual risk is the risk remaining after controls are applied.

Risk rating = likelihood of the event multiplied by the impact or severity if it occurs.

Control effectiveness should be tested independently; a control that exists on paper but is not operating is a deficiency.

Country risk considers FATF listings, sanctions regimes, corruption indices, and the jurisdiction's AML supervision quality.

Risk appetite defines the level of risk the institution is willing to accept; tolerance is the acceptable variance around it.

Risk assessments must be documented, dated, and refreshed when the business, customers, or regulations materially change.

Mitigation options include enhanced due diligence, transaction limits, additional approvals, or exiting the relationship.

Residual risk above appetite requires escalation to senior management and documented remediation or de-risking decisions.

Confidentiality applies to customer data but is overridden by legal obligations to report suspicious activity to authorities.

Conflicts of interest must be identified, disclosed, and managed; personal account dealing is typically restricted or pre-cleared.

Staff must not accept gifts or hospitality that could improperly influence a business decision; thresholds are set in policy.

Whistleblower protections require a confidential channel to report misconduct without retaliation.

Fitness and propriety standards assess honesty, financial soundness, and competence of key personnel.

Independence of the compliance function means it must not report through revenue-generating lines that create conflicts.

Insider information must not be used for personal benefit or shared; trading on it is market abuse.

Ethical escalation: unresolved concerns go up the chain and, if unresolved, to the regulator or an independent channel.

Suspicious activity reports are filed with the national financial intelligence unit, not with the customer or the police directly.

Currency transaction reports are filed for cash transactions above the jurisdiction's threshold (commonly USD/EUR 10,000).

Cross-border wire transfers above threshold require originator and beneficiary information to travel with the payment.

Records must be sufficient to reconstruct individual transactions and to demonstrate CDD was performed.

Retention periods typically run five years after the transaction or after the end of the relationship, whichever is later.

Reports must be complete, accurate, and timely; late or incomplete filings can themselves trigger enforcement.

Management information reporting should track alert volumes, closure rates, SAR counts, and overdue KYC reviews.

Records may be retained electronically if retrievable without undue delay and protected from alteration.

Regulators may request records on short notice; failure to produce them is a separate compliance breach.