AML Program Governance, Training, and Independent Testing
This domain tests whether an AML program is actually governed, not just written. Korean supervisors expect board and senior management accountability, a designated AML compliance function, risk-based training, independent testing, and clear escalation.
Core rules
- The board approves the AML policy and risk appetite; senior management implements it and receives regular reporting.
- A qualified AML compliance officer or unit coordinates CDD, STRs, sanctions screening, training, and regulatory communication.
- The three lines of defense should be visible: business units own risk, compliance advises and monitors, and internal audit tests independently.
- Training should be role-tailored for frontline staff, compliance, and senior management, and should cover current typologies and reporting duties.
- Independent testing should assess design and effectiveness, sample CDD and STR files, and track remediation to completion.
- Recordkeeping supports supervision and must meet statutory retention periods.
Worked example
An internal audit finds that 15% of high-risk corporate files lack beneficial ownership evidence. Good governance means the finding goes to the AML committee and board, root causes are analyzed, training and file-review controls are revised, and remediation is retested. A memo saying staff will be reminded is not sufficient.
Traps
Training attendance is not evidence of effectiveness. Compliance alone does not own AML risk. Testing performed by the compliance unit that designed the controls is not independent. Do not treat a policy update as remediation without evidence.