Risk and Compliance (GRC): Governance, Financial Crime and Conduct
What this domain tests
Risk and Compliance tests governance, the three lines model, risk appetite, financial crime controls and regulatory conduct. Questions often ask who owns a risk and what evidence proves the control works.
Core rules
- The three lines model: the business owns and manages risk; risk and compliance provide oversight; internal audit gives independent assurance.
- A risk appetite statement sets metrics, limits, escalation triggers and reporting to the board.
- AML controls include customer due diligence, enhanced due diligence for politically exposed persons and high-risk customers, ongoing monitoring, suspicious transaction reports and record keeping. Tipping off is an offence.
- Fitness and Probity applies to controlled functions; due diligence and regulatory approval are required.
- GDPR requires a lawful basis, breach notification within 72 hours where required, and handling of data subject requests.
- Whistleblowing channels must protect protected disclosures.
Worked example
A customer receives frequent small transfers from unrelated third parties and immediately moves funds to a crypto exchange. This is a red flag. The bank performs enhanced due diligence, asks for source of funds and source of wealth, and documents the rationale. If suspicion remains, it files a suspicious transaction report with the Financial Intelligence Unit and does not tell the customer. Ordinary monitoring continues; the report is not proof of guilt.
Traps
- Saying compliance owns the risk.
- Treating a suspicious report as evidence of crime.
- Tipping off the customer.
- Leaving risk register actions without owners or dates.