Financial Crime Compliance Programs and Risk Management
Program architecture
A credible financial crime compliance (FCC) program is risk-based, documented and independently tested. Candidates must know the building blocks: board and senior-management oversight; a designated compliance officer with authority and independence; an enterprise-wide risk assessment (EWRA) that feeds customer, product, channel and geographic risk assessments; written policies and procedures; CDD/EDD and beneficial ownership identification; sanctions and negative-news screening; transaction monitoring and alert triage; SAR/STR filing and escalation; training; recordkeeping; and independent testing or audit. The three-lines-of-defense model is examinable: business units own risk (first line), compliance designs and monitors controls (second line), internal audit provides independent assurance (third line).
Traps
The most common wrong answers promise "zero risk" or treat the risk assessment as a one-time annual form. A risk-based approach prioritizes and mitigates; it does not eliminate. Another trap is confusing compliance monitoring (a second-line control) with independent testing (third line). Board accountability cannot be delegated, even though execution is. Remember tipping-off restrictions around SARs and the typical five-year retention period after account closure under the U.S. BSA.
Worked rule
A bank plans a prepaid card for gig workers. The correct sequence is: update the EWRA for the new product, channel and customer base; set risk appetite and limits; design CDD and monitoring thresholds; train staff; then schedule independent testing. "Launch now, assess later" is always wrong.