Anti-Money Laundering Supervision
The supervisory framework
Anti-money laundering (AML) supervision rests on a chain of obligations. Firms must identify and verify customers (customer due diligence, CDD), monitor transactions, keep records, and report suspicions to the financial intelligence unit. Enhanced due diligence (EDD) applies to higher-risk situations: politically exposed persons, correspondent banking relationships, and customers in jurisdictions with weak AML regimes. Simplified due diligence is permitted only where risk is demonstrably low, and it is never a blanket exemption.
The risk-based approach is the organising principle. Supervisors expect a documented business-wide risk assessment, a written policy, a nominated officer (often called the money laundering reporting officer), and staff training. Supervision is typically split between a prudential regulator and a dedicated financial intelligence unit; know which body receives suspicious activity reports versus which inspects the firm.
Traps in questions
- Reporting is not the same as closing the account. A suspicious activity report is filed; tipping off the customer is prohibited.
- Record retention periods are commonly five years after the relationship ends, but check the jurisdiction stated in the stem.
- PEP status is risk-based and time-limited. A former PEP may still be higher risk, but the label does not apply forever.
- CDD before the relationship, not after, except for narrow permitted deferrals.
Worked rule of thumb
A customer requests a large transfer to an unrelated third party in a high-risk jurisdiction, with no apparent economic rationale. Apply the sequence: identify the risk trigger, apply EDD, document the rationale, and escalate to the reporting officer. Do not simply refuse the transaction and say nothing; the obligation is to report the suspicion, not to adjudicate guilt.
Remember that supervision is about evidence of a system, not perfection. A firm with a clear policy, trained staff, and documented decisions fares better than one with no framework but no detected breaches.