Risk, controls and financial crime prevention
What this domain tests
The risk and control framework a platform must operate, and the financial crime obligations that sit across onboarding, payments and trading.
Risk and control framework
- Three lines of defence: the business owns risk, risk and compliance oversee it, internal audit provides independent assurance.
- Core tools: risk register, risk appetite statement, key risk indicators, incident management and root cause analysis.
- Principal risks: cyber and technology failure, outsourcing concentration (SYSC 8), key person dependency, wind-down and client asset risk, and liquidity where relevant.
Financial crime
- MLR 2017: risk-based approach, customer due diligence, enhanced due diligence for PEPs and high-risk jurisdictions, ongoing monitoring, five-year record retention.
- Sanctions screening against UK lists and OFSI asset freezing obligations.
- Suspicious activity reports go to the National Crime Agency via the UKFIU; the MLRO controls reporting and tipping-off is an offence.
- Fraud: authorised push payment reimbursement rules (from 7 October 2024) with an £85,000 cap make strong payment and new-payee controls essential.
- Market abuse: platforms must monitor orders and report suspicious transaction and order reports under MAR.
Worked example
A client requests a £60,000 withdrawal to a bank account in a different name from the one previously used. The platform should pause, call the client on a known number, apply new-payee verification and cooling measures, and consider a SAR. Reason: this pattern matches an authorised push payment scam where the client is being manipulated, and both the reimbursement rules and Consumer Duty place detection responsibility on the firm.
Traps that cost marks
- Treating AML as a one-off onboarding check rather than continuous monitoring.
- Sending a SAR to the FCA - it goes to the NCA.
- Forgetting the five-year record retention requirement.
- Assuming outsourcing a function transfers the associated risk.