AML/CFT Risk Management Fundamentals and Governance
Domain 1 tests whether you can explain how an AML/CFT programme is owned, structured and governed: not only what the rules require, but who is accountable, how decisions escalate, and how the institution proves the programme actually works.
Accountability sits at the top
The board (or equivalent governing body) approves the AML/CFT policy and risk appetite, appoints a designated compliance officer with sufficient authority, resources and board access, and receives regular reporting on risk and control effectiveness. Senior management translates that into procedures, systems, training and escalation routes. FATF Recommendation 1 requires a risk-based approach, and the revised standards make clear that senior management must understand the institution's residual risk rather than delegate it entirely downward.
Core programme elements
- Documented policies and procedures, approved at the top and reviewed periodically.
- A named compliance officer plus adequate, trained staffing.
- Role- and risk-tailored training, refreshed and tested.
- Independent testing or internal audit of the programme.
- Customer due diligence, recordkeeping, and reporting (STRs, currency reports, cross-border wire data).
- Screening, transaction monitoring, and an enterprise-wide risk assessment that drives all of the above.
Three lines of defence
The business owns the risk and must identify and escalate it (first line). Compliance and risk set the framework, advise and challenge (second line). Internal audit gives independent assurance (third line). Examiners look for evidence that front-line staff can recognise and escalate suspicion, not merely that compliance files reports.
Worked example
A retail bank finds that 40% of its remittance customers sit in a corridor with weak AML supervision. The board appetite statement permits growth only where residual risk is medium or lower. The business line proposes adding staff rather than exiting. Compliance assesses residual risk as high after controls; the board approves a time-bound risk acceptance with a 90-day remediation plan and monthly reporting. Reasoning: appetite is a limit, and breaching it requires documented acceptance at the right level with escalation, not silent tolerance. Indiscriminate exit would be de-risking, which supervisors criticise when it is applied wholesale.
Traps that cost marks
- Saying the compliance officer owns AML risk; the business owns it and compliance oversees.
- Treating 'risk-based' as 'no fixed rules': CDD, recordkeeping and reporting duties remain mandatory.
- Forgetting that training and independent testing are programme requirements, not optional extras.
- Ignoring group-wide application: policies must extend to branches and subsidiaries, with local-law carve-outs documented.