Compliance Programme, Governance, and Record Keeping
The compliance programme
Every reporting entity must maintain a written AML/CFT programme derived from its risk assessment. It must cover: policies and procedures, CDD and EDD processes, monitoring and reporting, designation of a compliance officer, staff training, independent audit/review, and record keeping. The programme must be approved by senior management and reviewed regularly.
The compliance officer
The compliance officer is responsible for administering and maintaining the programme and reporting to senior management. The role requires seniority and access to the board/governing body; a trap is assuming the compliance officer can be a junior staff member with no authority.
Training and independent review
Staff must be trained on an ongoing basis and the training documented. An independent audit or review tests whether the programme is effective - it should be performed by someone independent of the programme's day-to-day operation.
Record keeping
Records of CDD, risk assessments, monitoring alerts and investigations, reports, and training must be kept for the period required by the Act (generally at least five years after the relationship ends or the transaction is completed) and be readily retrievable for supervisors. A trap is keeping records but not in a form that can be produced on request.
Worked example
A supervisor inspects and asks: where is your written programme, who is the compliance officer, when was the last independent review, and show me five years of CDD for a closed customer. If any of these cannot be produced, there is a compliance gap.
Rule of thumb
An effective programme is written, owned, trained, tested, and recorded. If any of those five is missing, the programme is deficient.