Compliance
Domain focus
Compliance tests the independent compliance function, compliance risk assessment, AML/CFT, conduct and board reporting.
Core rules
- BNM's Compliance policy document expects a board-approved compliance framework and an independent compliance function headed by a Chief Compliance Officer with direct access to the board or its committee.
- Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage from failure to comply.
- AML/CFT requirements include customer due diligence, enhanced due diligence for PEPs and high-risk customers, ongoing monitoring, and suspicious transaction reports (STRs) to BNM's Financial Intelligence and Enforcement Department (FIED).
- Tipping off is prohibited. Records must be retained as required.
- Conduct rules under BNM's fair treatment of financial consumers cover sales, disclosure and complaints.
Worked example
A compliance officer reports to the Chief Operating Officer, and the COO chairs the committee that decides whether to report a breach. This is not independent. Remediation: move the reporting line to the Board Risk Committee, give the CCO direct board access, and separate breach escalation from business management.
Traps
Do not equate compliance with internal audit. Do not send STRs to the police in Malaysia - they go to BNM's FIED. Do not ignore tipping-off. Do not treat compliance as only legal/regulatory - conduct risk is included. Do not let business heads set the compliance plan.