AML/CFT weaknesses in agent banking and remittances

The findings point to a risk-based AML/CFT framework that is not operating, not just a backlog problem.

• Governance and resourcing: management's six-month clearance plan is not supported by evidence of additional capacity, interim controls or risk acceptance. A system upgrade is an explanation, not a control. The audit committee needs a dated remediation plan with owners and metrics.
• Sanctions screening: 4,300 open alerts, with 18% older than 90 days, means potential matches are not being resolved timely. The root cause may be poor rule calibration, understaffing or system defects; each produces different remediation.
• CDD/EDD: 22 high-risk customers without refreshed EDD is an ongoing due diligence failure. The bank cannot assess whether their risk profile has changed, and some may require exit or restriction.
• STR timeliness: filing 12–40 days after internal escalation suggests a weak escalation and decision process. The obligation is to report promptly once suspicion arises; delay increases regulatory risk.
• Agent oversight: 12 of 45 agents never visited is a significant gap in a high-risk distribution channel. Agent onboarding, monitoring and termination controls need testing.
• Monitoring rules: a flat RM 50,000 threshold is not risk-based and can be evaded by structuring. The 60 customers making 8–14 deposits just below the threshold is a red flag that the rule set is producing false comfort.
• Recordkeeping and training: branch-cabinet storage and month-end scanning create loss and access risk; 72% training completion is too low for a high-risk business.

The root causes are likely to include weak first-line ownership, inadequate compliance capacity, poorly calibrated systems and a culture that treats AML/CFT as a back-office function.

The procedures must be evidence-based and must not tip off the customers.

• Re-perform the analytics: extract 12 months of cash deposits for the 60 customers, not just two months. Calculate frequency, amounts, branch and agent locations, and the pattern relative to each customer's stated business and income.
• Link accounts and parties: use common addresses, phone numbers, employers, counterparties and beneficial owners to see whether the 60 customers are connected. Structuring may be spread across multiple customers.
• Test against KYC profiles: compare expected turnover with actual deposits; identify source-of-funds gaps and whether EDD was performed.
• Review alert and STR history: check whether any of the 60 generated alerts, whether alerts were closed without rationale, and whether any STR was filed. If an STR was filed, assess timeliness.
• Test the monitoring rule: sample transactions below RM 50,000 to see whether the rule set captures structuring typologies; compare with the bank's risk assessment and typologies.
• Interview staff cautiously: discuss escalation and decision-making without disclosing the specific customers to front-line staff who do not need to know.
• Escalate to the AML compliance officer: if the analytics support suspicion, the AMLCO should assess whether an STR is required. Internal audit should not itself tip off the customer or conduct a criminal investigation.

The workpaper should record the analytical population, the criteria, the exceptions and the escalation. The conclusion should distinguish 'no evidence of structuring' from 'not yet investigated'.

I would separate immediate risk from longer-term remediation.

Immediate escalation (within 24–48 hours)

• The sanctions-screening backlog and the potential structuring pattern go to the AML compliance officer, the CEO and the audit committee chair. These are time-sensitive because they may involve ongoing customer activity and possible reporting obligations.
• The bank's AMLCO should assess whether any matter requires a suspicious transaction report or regulatory notification. Internal audit should not file the STR itself unless the bank's procedures require it, and it must avoid tipping off.

Report content

• Rate the AML/CFT control environment as unsatisfactory or the equivalent under the bank's rating scale, with the findings grouped by control area.
• State the root causes, the affected populations and the residual risk, including the 4,300 alerts, 22 EDD files, 12 unvisited agents and the threshold-based monitoring gap.
• Include management's six-month plan, but test whether it is resourced and whether interim controls exist. A plan without capacity is not a remediation.

Timing and follow-up

• The full report should go to the next audit committee meeting, or an extraordinary meeting if the sanctions backlog is worsening.
• Follow-up should be at 30, 60 and 90 days, with re-testing of alert clearance and agent visits. The audit committee should receive a dashboard, not a one-line 'in progress' update.

Given the regulatory sensitivity, the board should consider proactive engagement with BNM once the facts are validated, rather than waiting for the next inspection.