Anti-Money Laundering and Counter-Terrorist Financing Compliance Program
The pillars, and what sits under them
A defensible program rests on the pillars most exam candidates learn as five: internal policies, procedures and controls; customer due diligence; a designated compliance officer; ongoing training; and independent testing. Underneath sit the elements examiners actually probe - a documented enterprise-wide risk assessment that drives everything else, board and senior management oversight with real authority and budget, and a risk-based allocation of resources.
Customer due diligence includes identification and verification, beneficial ownership, understanding expected activity, and ongoing monitoring. Enhanced due diligence applies to higher-risk relationships: PEPs, correspondent banks, private banking, customers in weak-supervision jurisdictions. Monitoring is only meaningful if it is compared against a documented expected-activity profile; otherwise every alert lacks a baseline.
Rule of thumb: responsibility cannot be outsourced, only activity. A small institution may contract independent testing or monitoring to a vendor, but the board and compliance officer remain accountable for scope, follow-up and remediation.
Traps that appear in questions: independent testing must be performed by persons independent of the compliance function - self-review fails; training must be role-specific and documented, not a single annual slide deck for everyone; CDD is continuous, not a one-time onboarding event; and the compliance officer needs access to the board and adequate resources, which matters more than a particular job title. A program that exists only on paper, with no evidence of testing or remediation, is the classic deficiency finding.
Worked example: an institution identifies a gap in beneficial-ownership collection. Correct sequence: update the risk assessment, revise policy and procedures, backfile the affected accounts, retrain staff, and have independent testing verify remediation - not simply amend the policy and move on.