Compliance
Domain focus
The Compliance domain tests whether you can describe the compliance function as a control function, apply the risk-based approach, and map obligations to Sri Lankan law - chiefly the Banking Act, the Financial Transactions Reporting Act No. 6 of 2006 (FTRA) and the Prevention of Money Laundering Act, plus CBSL directions and FATF Recommendations.
Core rules
- Compliance risk is the risk of legal or regulatory sanctions, material financial loss or loss of reputation from failure to comply with laws, regulations, self-regulatory standards and codes of conduct (Basel Committee, 2005).
- The compliance function must be independent of business lines, have a direct reporting line to the board or a board committee, and have unrestricted access to information and people.
- Three lines of defence: business units own risk; compliance and risk functions monitor and advise; internal audit provides independent assurance.
- CDD/KYC under a risk-based approach: identify the customer and beneficial owner, understand the purpose of the account, apply enhanced due diligence to politically exposed persons (PEPs) and high-risk relationships, and keep records.
- Reporting: suspicious transactions go to the Financial Intelligence Unit (FIU) promptly; tipping off the customer is an offence. Sanctions screening is a separate control from STR reporting.
- Culture and escalation: staff must be able to raise concerns without retaliation, and material breaches must be escalated to the board committee, not settled informally.
Worked example
A branch proposes onboarding a former military commander identified as a PEP. The relationship manager argues that local prominence is not a risk. The compliance officer's reasoning: PEP status triggers enhanced due diligence regardless of perceived integrity; source of wealth and source of funds must be evidenced; senior management approval must be documented; ongoing monitoring must be heightened. Onboarding is paused until these steps are complete. That is correct - the risk-based approach adjusts the intensity of controls, not whether they apply.
Traps
- Treating compliance as advisory: it is a control function with escalation authority.
- Confusing "no STR filed" with "no risk": STRs need suspicion, not proof of an offence.
- Letting the business line own CDD files while compliance carries the blame.
- Ignoring beneficial ownership for corporate customers.