The 42% Backlog: Governance and Remediation at a Money Transmitter
Pangea Pay is a US money transmitter with 14,000 agents, $2.1 billion in annual volume, and six transaction-monitoring analysts. Its BSA officer resigned five months ago; the interim BSA officer is the corporate controller, who has no AML background. Independent testing was last completed 26 months ago. The enterprise risk assessment was last updated in 2019, before Pangea launched a prepaid card and remittance corridors to Pakistan and Nigeria in 2023. Of 8,900 alerts generated in the last year, 42% remain unreviewed after 90 days and only 3% of alerts have been closed with a documented rationale. A FinCEN examination is scheduled in four months. The CFO's board deck proposes cutting AML training from two hours to 30 minutes and deferring independent testing to 2025 to fund a marketing campaign, arguing that 'the backlog is just alert volume, not real risk'.
1. Identify the most serious deficiencies and set out a 30/60/90-day remediation plan.
Read the worked answer
Most serious deficiencies: (1) no qualified BSA officer and no clear board accountability; (2) independent testing 26 months overdue; (3) a 2019 risk assessment that predates the prepaid card and Pakistan/Nigeria corridors; (4) 42% of alerts unreviewed and only 3% closed with a documented rationale. The backlog is not 'just volume'; unreviewed alerts may contain unfiled SARs.
0–30 days: appoint a qualified interim BSA officer with written authority and board resolution; preserve data; triage the backlog by risk (sanctions, terrorism, high-risk corridors, large amounts, repeat customers); engage counsel; brief the board. 30–60 days: refresh the enterprise risk assessment with the new products and corridors; engage independent testing; adopt a staffing and training plan. 60–90 days: complete a lookback, file any late SARs, remediate alert closures, and report progress to the board. Do not wait for the exam.
2. How should the interim BSA officer respond to the CFO's proposal, and what should be documented?
Read the worked answer
Reject the CFO's proposal. Two hours of training is already modest; cutting it to 30 minutes weakens a required element of the AML program. Independent testing is a required independent review, and deferring it to 2025 while the company is four months from a FinCEN exam is not defensible. The CFO's assertion that the backlog is 'not real risk' is unsupported; sample the unreviewed alerts and document what is found.
Escalation: Put the response in a memo to the CFO, CEO and audit committee. Explain the regulatory requirements, exam risk, potential civil money penalties, and personal exposure for responsible officers. Risk acceptance, if any, must be made by the board with full information, not by a CFO seeking marketing funds. If the board proceeds, document the BSA officer's dissent and seek legal advice. Do not sign a risk assessment that conceals the backlog.
3. What should the board receive, and how should its decision be minuted?
Read the worked answer
Board reporting package: report the 2019 risk assessment, 26-month testing gap, 42% alert backlog, 3% documented closure rate, SAR filing trends, staffing ratio (six analysts for $2.1 billion and 14,000 agents), training completion, high-risk corridor and agent oversight results, and a remediation plan with owners, dates and budget. Distinguish inherent risk from residual risk and state what the board is being asked to approve.
Governance point: The board should minute its challenge and decision. If it approves the remediation plan, it should also approve the resources. If it rejects the plan, the minutes should record the BSA officer's warning and the legal advice. The exam will test whether the board understood the backlog and whether management acted; a marketing-driven cut is exactly the narrative regulators treat as 'tone at the top' failure.