Regulatory Framework and Compliance
The architecture of anti-money-laundering (AML) regulation
A candidate must understand that AML obligations sit in layers: primary legislation (which creates the offences and the duty to have controls), regulations or rules made under it (which specify the mechanics), and guidance from the supervisor (which explains how to comply in practice). Know the difference between a rule (mandatory), guidance (expected practice, not itself an offence to breach but evidence of failure), and industry best practice (aspirational). Supervisory bodies typically combine registration, off-site review, on-site inspection, and enforcement powers such as fines, public censure, or restriction of business.
Concepts to master
- The risk-based approach: controls must be proportionate to assessed risk, not applied uniformly.
- Senior management responsibility: the board or equivalent must approve policy and appoint a compliance officer with sufficient authority and resources.
- Fourth EU Anti-Money-Laundering Directive (4AMLD) and 5AMLD: 4AMLD introduced a harmonised risk-based regime; 5AMLD extended coverage to virtual asset service providers and broadened beneficial ownership transparency. Treat exact article numbers as low-confidence and verify against the current text.
- Record retention periods (commonly five years after the end of a business relationship, longer if requested by authorities).
Traps in questions
Questions often swap "must" for "should," or imply that outsourcing AML functions transfers legal responsibility - it does not. Another trap: assuming a supervisor's guidance has the force of law, or that a risk-based approach permits ignoring high-risk customers.
Rule of thumb
If a control is described as optional in guidance but mandatory in a rule, the rule wins; when unsure, ask whether the question tests obligation or expectation.