Governance, Compliance Programme and Internal Controls
The programme pillars
An effective AML/CTF programme rests on senior management commitment and a documented, risk-based framework. Candidates must know the core pillars: policies and procedures, designated compliance officer / MLRO, training, independent testing/audit, and customer due diligence and record-keeping.
The MLRO (money laundering reporting officer) or equivalent receives internal reports, decides on external reporting, and acts as the link to the FIU. The compliance function must be independent, adequately resourced, and have access to the board. The three lines of defence model is examinable: business units (first line), compliance/risk (second line), internal audit (third line).
Know the elements of internal controls: segregation of duties, escalation procedures, whistleblowing channels, record retention, and management information (MI) that gives the board visibility of risk, alerts, and breaches.
Understand training - role-based, documented, refreshed, and tested. Know independent testing - periodic, risk-based, and reported to senior management.
Traps and rule of thumb
Traps: assuming a policy document equals an effective programme (implementation and evidence matter); confusing the MLRO with the compliance officer where roles differ; believing internal audit is the second line; and treating training as a one-off. Another trap is the notion that outsourcing compliance transfers accountability - it does not.
Rule of thumb: a regulator will ask not just what is your policy? but show me it working - evidence of training, testing, MI, and remediation. Governance is demonstrated through records.
Worked example: A firm's board receives a quarterly MI pack showing alert volumes, backlog, training completion, and testing findings, with actions assigned and tracked. This evidences an operating programme; a policy manual alone would not.