The Fintech Onboarding Spike and the Reluctant MLRO
Coral Ridge Bank (Barbados) has just signed a partnership with a regional mobile-wallet provider. In the first six weeks, 3,200 new accounts are opened, 71% through remote onboarding. The bank's automated identity-verification tool rejects 4% of applicants, but the compliance analyst is instructed by the business head to 'override rejects under $2,000 balance to protect conversion'. Two accounts later flagged by the FIU were among those overridden. The MLRO, who is also the Head of Retail Banking, signs off the monthly STR report showing zero suspicious transactions. A staff member privately emails the Board secretary raising concern. The bank's AML/CFT programme was last independently audited 26 months ago, and the risk assessment still describes the business as 'branch-based, low-risk, face-to-face'.
1. Identify the governance and structural weaknesses in this arrangement, and explain why the MLRO's dual role is problematic under Barbados AML/CFT expectations.
Read the worked answer
The central defect is a conflict of interest embedded in governance. The MLRO is also Head of Retail Banking, meaning the person responsible for detecting and reporting suspicious activity is the same person whose revenue targets are hit when onboarding conversion improves. Independence is the point of the MLRO function: it must be able to escalate, block, or report without commercial consequence. Combining the roles creates an obvious incentive to under-report, and the zero-STR month during a 3,200-account remote onboarding surge is a red flag rather than reassurance.
Second, the business head's instruction to override verification rejects is an unlawful circumvention of controls. An override policy set by a revenue owner, with no compliance veto and no documented risk-based rationale, converts a control into a formality. The two FIU-flagged accounts demonstrate the control failure was not theoretical.
Third, the enterprise-wide risk assessment is stale and inaccurate: it describes a branch-based face-to-face business while 71% of onboarding is remote. Controls calibrated to the wrong risk profile will be mis-sized. Fourth, the 26-month audit gap breaches the expectation of independent, periodic testing. Fifth, the whistleblower's private email to the Board secretary suggests no protected reporting channel exists; the Board should have a direct, documented escalation route.
2. Recommend a remediation plan with sequenced priorities, and state what should happen to the overridden accounts.
Read the worked answer
Sequence matters: stop the bleeding, then fix governance, then rebuild assurance.
Immediate (0–30 days): freeze the override practice and require compliance sign-off for any deviation, with written rationale per case. Re-screen all 3,200 new accounts against sanctions and PEP lists, prioritising the 2,264 remote accounts. Place the two FIU-flagged relationships under enhanced monitoring and conduct a look-back. Preserve all onboarding records and the business head's instruction as evidence.
Governance (30–90 days): separate the MLRO role from Retail Banking, appointing an independent MLRO with direct Board or Board-committee access and a protected reporting line. Establish a whistleblower policy with a confidential channel to the Board secretary or audit committee. Re-draft the enterprise-wide risk assessment to reflect remote onboarding, mobile-wallet distribution, and the actual customer base.
Assurance (90–180 days): commission an independent AML/CFT audit covering onboarding, monitoring, and reporting; remediate findings on a tracked plan. Retrain staff on tipping-off, STR obligations, and override authority. Report the control failure to the FIU on a voluntary basis if the look-back confirms unreported suspicion.
Overridden accounts: each must be re-underwritten. Accounts that fail verification should be frozen pending satisfactory CDD; where CDD cannot be completed, exit the relationship and consider an STR. The override log itself should be reviewed to determine whether any override was itself suspicious.