Growth Outran the Controls
Northgate Pay is a UK-headquartered e-money institution. In fourteen months it grew from 42,000 to 910,000 customers. Seventy-one percent of acquisitions came through a single affiliate that supplies pre-verified leads; the affiliate's KYC pack relies on one national ID type that Northgate's own policy rates as only medium assurance. Alert volume rose 340% while analyst headcount fell from eleven to six after two departures and one long absence. The MLRO's last formal risk assessment is 26 months old and still scores the affiliate channel as low risk. The board pack shows high-risk customers rising from 3% to 19% of the book over four quarters, with no change to monitoring thresholds. The CEO wants to double affiliate spend next quarter to hit the growth target.
1. You are the interim Head of Compliance. What do you recommend, and in what order?
Read the worked answer
Sequence matters more than the recommendation itself.
1. Anchor on the risk assessment, not on the headline. The stale assessment is the root defect: every downstream judgement (thresholds, channel rating, resourcing) was calibrated to a business that no longer exists. Refreshing it for the affiliate channel is the first defensible action because it converts an opinion into a documented, auditable baseline that supervisors and the board can both test.
2. Treat the monitoring threshold mismatch as a live control failure. High-risk share rising 3%→19% with unchanged thresholds means alert generation is structurally under-calibrated. Until a tuning exercise is done, the firm is not monitoring the book it actually has.
3. Address the backlog before adding volume. Six analysts against a 340% alert increase produces an ageing queue; an unworked alert is an unreviewed suspicion. This is a resourcing decision, not a compliance preference.
4. Recommend a conditional pause on affiliate growth, not a blanket stop - with written exit criteria (remediation of the ID-assurance gap, completed back-testing of thresholds, alert backlog under a defined age, refreshed risk assessment signed off). Conditional pauses survive board challenge better than absolutes.
5. Document the dissent if overruled. Record the recommendation, the reasons, and the decision taken in the board minutes.
2. The CEO argues that pausing growth breaches fiduciary duty and that KYC quality is the affiliate's contractual responsibility. How do you respond?
Read the worked answer
Separate the two claims, because they fail for different reasons.
On outsourcing: contractual allocation between Northgate and the affiliate does not move regulatory responsibility. Where a firm relies on a third party for CDD, the firm remains accountable for the adequacy of that CDD; reliance is permitted, delegation of liability is not. The ID-type mismatch is decisive here - Northgate's own policy grades that document as medium assurance, so the firm is accepting onboarding that its own standard rejects. That is an internal control failure regardless of who gathered the document.
On fiduciary duty: the argument assumes growth and control are traded off. Reframe as a quantified comparison. At current thresholds, doubling customers plausibly doubles alert volume on an already-aged queue; the binding constraint is review capacity, not marketing spend. Present the CEO with (a) cost of remediation now, (b) cost of a supervisory finding plus the growth foregone during a possible business restriction, (c) a middle path - double spend only after the ID-assurance gap is closed and backlog cleared, which protects both the growth target and the control environment.
Your credibility depends on offering the middle path, not just the objection.
3. Which metrics belong in the board pack, and why those rather than the ones currently there?
Read the worked answer
The current pack reports outcome volumes (customers, growth, high-risk share). Those are lagging and tell the board what already happened. A financial crime pack needs leading indicators tied to control performance:
- KYC quality by channel - sample-based first-time-right and rejection rates, split by affiliate vs. direct. This is the only metric that would have surfaced the ID-type problem.
- Alert backlog ageing (median and 90th percentile days open), not just alert counts. Volume without ageing hides the risk.
- Ratio of alerts to analysts, and cases closed per analyst per month, to make the capacity gap arithmetic rather than rhetorical.
- Risk appetite breaches with days-out-of-appetite, so tolerance is measured in time, not asserted.
- Control testing results and open remediation items with owners and dates.
- SAR/STR volume per 1,000 customers by segment, with a note that a falling rate is not automatically good news.
Each should carry a trend line and a threshold. A metric with no threshold is a statistic, not a control.