I85PREP
⌘ K
CAFP study materials
CAFP study resources

CAFP: AML Compliance Program Governance: Risk Assessment, Policies, Training, Audit, and the Role of the Compliance Officer

CAFP · Work through your exam, one topic at a time.

All guide sections

AML Compliance Program Governance: Risk Assessment, Policies, Training, Audit, and the Role of the Compliance Officer

What the exam tests

This domain tests programme design and governance: the elements of an AML programme, the enterprise-wide risk assessment (EWRA), training, independent audit and the compliance officer's authority.

Core rules and concepts

  • The classic five pillars are: a designated compliance officer; written policies and procedures; ongoing training; independent testing/audit; and customer due diligence. The US PATRIOT Act Section 352 requires a risk-based AML programme for financial institutions.
  • The EWRA identifies inherent risk by customer, product, channel and geography; assesses control effectiveness; and produces residual risk. It should be dynamic, documented and approved by senior management or the board.
  • Policies translate law and risk appetite into procedures. They should cover CDD, EDD, sanctions, monitoring, reporting, recordkeeping and escalation.
  • Training must be role-based and ongoing. Front-line staff need red-flag and escalation training; board members need governance and risk-appetite training. Testing should verify comprehension, not just attendance.
  • Independent audit should be risk-based, conducted by qualified persons free from operational influence, and report findings to the audit committee or board. Remediation should be tracked to closure.
  • The compliance officer needs authority, independence, resources and direct access to the board. A token compliance officer without authority is a governance failure.

Worked example

A bank's EWRA shows high inherent risk in correspondent banking and virtual-asset customers. Controls are weak: only annual training, no independent testing, and a compliance officer who reports to the head of sales. The board should strengthen independence, require quarterly training for high-risk teams, commission an independent audit, and enhance due diligence for those segments. Reasoning: high inherent risk with weak controls produces unacceptable residual risk; governance must match the risk profile.

Traps that cost marks

Do not treat the risk assessment as a one-time exercise. Do not place the compliance officer under the business line without escalation. Do not equate training completion with effectiveness. Do not accept an audit performed by the internal audit team that also designed the controls. Do not write policies that cannot be operationalised.