Anti-Money-Laundering, Fraud Prevention and Complaint Handling
AML: risk-based, not box-ticking
Firms must apply a risk-based approach: identify customers and beneficial owners (typically anyone owning or controlling above a threshold such as 25%), verify identity using independent evidence, and apply enhanced due diligence to higher-risk cases - politically exposed persons, complex offshore structures, correspondent relationships and higher-risk jurisdictions. Sanctions screening is separate from AML and is strict: a match, once confirmed, means no dealing and immediate escalation.
Transaction monitoring generates alerts; an alert is not a report. A suspicious activity/transaction report is filed on suspicion, not proof, and the client must not be told - tipping off is an offence. Records of checks and reports are retained for the required period.
Fraud and complaints
Fraud typologies to recognise: authorised push payment scams, phishing and business email compromise (including change of bank details requests), account takeover, and internal fraud enabled by weak segregation of duties. Controls: call-back verification to a known number, payment controls, dual authorisation, staff training and a speak-up culture.
A complaint is any expression of dissatisfaction, however made; a routine query is not. Handle by logging, acknowledging within the stated timeframe, investigating independently, providing a final response with redress and root-cause analysis, and informing the client of the ombudsman or dispute route.
Traps
- Saying "I wasn't sure, so I didn't report" - suspicion is the threshold.
- Telling the client a report has been made, or that a check is being run.
- Closing an account to "solve" a suspicion instead of reporting it.
- Treating a verbal complaint as not a complaint.
Worked example: A client emails new bank details for a withdrawal, with the email domain one character off the usual one. Correct action: do not pay; verify by calling the known relationship number; escalate as potential business email compromise and record the attempt.