IFMP Compliance Officer Certification (COC), Pakistan cheat sheet

Compliance is independent, risk-based adherence to applicable laws, regulations, rules, codes and internal standards; it is not the same as legal advice or internal audit.

Primary regulatory sources in Pakistan: SECP (Companies Act 2017, AML/CFT Regulations 2020), SBP (Prudential Regulations, AML/CFT), FBR, and, for non-bank financial sectors, the relevant sector regulator.

The FATF 40 Recommendations set the global AML/CFT standard; Pakistan's AML Act 2010 (as amended) and FMU reporting duties implement it domestically.

Three lines model: business units own risk (first line), compliance and risk functions monitor and advise (second line), internal audit provides independent assurance (third line).

A compliance programme has seven core elements: governance and tone at the top, policies and procedures, risk assessment, training, monitoring and testing, escalation and reporting, and remediation.

Proportionality principle: the intensity of controls should match the institution's size, complexity, products, customer base and geographic footprint.

'Compliance risk' means the risk of legal or regulatory sanctions, material financial loss, or reputational damage from failure to comply with applicable requirements.

Record retention is a compliance obligation in itself: keep KYC/CDD records and transaction records for the period set by the applicable regulator (commonly five years after the relationship ends).

Regulatory change management requires a documented process to identify, interpret, map, implement and evidence new requirements before their effective date.

The board approves the compliance policy and risk appetite and receives periodic compliance reports; it does not run day-to-day compliance.

The compliance officer/function has authority to monitor, advise, escalate and report, and must have direct access to the board or its audit/risk committee.

Independence test: the compliance function should not have profit-and-loss responsibility for the business it monitors and should not design the products it reviews.

Senior management is responsible for implementing the compliance programme, resourcing it, and acting on compliance findings within agreed timelines.

First-line staff responsibilities: know and apply policies, complete CDD, identify and escalate red flags, and attend mandatory training.

The compliance officer typically owns the AML/CFT programme as designated compliance officer, including STR filing decisions where the regulator requires a named person.

Segregation of duties: the person who approves a transaction or relationship should not be the same person who monitors or tests it.

Escalation matrix must state who is informed, in what timeframe, and what happens if the escalation recipient is implicated.

Programme build sequence: risk assessment, then policy and procedures, then control design, then training and communication, then monitoring and testing, then remediation and reporting.

A compliance risk assessment ranks inherent risk by likelihood and impact, then adjusts for control effectiveness to give residual risk.

Monitoring is ongoing, process-embedded surveillance (dashboards, exception reports, reconciliations); testing is periodic, independent sample-based review of control design and operation.

Compliance monitoring plan should state scope, frequency, methodology, sample size rationale, owner, and reporting line for each review.

Key Risk Indicators (KRIs) with thresholds and escalation triggers make monitoring measurable (e.g., overdue CDD percentage, training completion rate, late STR filings).

Compliance reports to the board should show breach trends, root causes, remediation status, regulatory developments and residual risk against appetite.

Training must be role-based and risk-based, with completion tracked and tested; new joiners and high-risk roles require enhanced frequency.

Findings management requires a written action plan with owner, due date, evidence of closure and validation by compliance before closure is accepted.

Enterprise risk categories typically include credit, market, liquidity, operational, compliance, reputational, strategic and, where relevant, Shariah non-compliance risk.

Risk appetite statement defines the amount and type of risk the institution accepts; compliance tolerances convert it into measurable limits.

Inherent risk x control effectiveness = residual risk; residual risk above appetite requires escalation and remediation.

Risk-based approach for AML/CFT: customer risk rating combines customer type, geography, products, delivery channel and transaction behaviour.

Enhanced Due Due Diligence (EDD) applies to PEPs, high-risk jurisdictions, complex ownership structures and unusual transaction patterns; simplified due diligence is not permitted for high-risk customers.

Risk register records risk description, owner, inherent and residual rating, controls, and review date; it is a living document reviewed at least annually.

Stress testing and scenario analysis test whether controls hold under adverse conditions, not just business-as-usual.

Risk transfer (insurance, outsourcing) reduces financial impact but does not eliminate regulatory accountability.

Compliance cost categories: personnel, technology and systems, training, external advice and audit, regulatory fees, and opportunity cost of restricted business.

Non-compliance cost categories: regulatory fines and penalties, remediation costs, legal defence, business restrictions or licence conditions, restitution, and reputational loss.

Cost-benefit analysis for a control compares expected loss avoided (probability x impact x reduction in risk) against the control's total cost of ownership.

Reputational damage is hard to quantify but affects funding cost, customer attrition, correspondent banking access and share value.

Regulators expect proportionality: controls should be commensurate with risk, so cost justification must be documented in the risk assessment.

Technology investment in automated screening and monitoring reduces manual cost per alert over time and improves auditability.

Compliance is a cost centre but its value is loss prevention and licence protection; frame benefits as avoided losses and enabled sustainable growth.

De-risking (exiting whole customer segments) can be a false economy: it creates concentration and reputational risk without addressing the underlying control weakness.

Regulatory instruments hierarchy: primary legislation, then regulations/rules, then directives and circulars, then guidance (guidance explains expectation but may not itself create a legal duty).

Guidance should be read together with the enabling law; where guidance conflicts with a rule, the rule prevails.

Policy documents need version control, approval authority, effective date, review cycle and a defined exception process.

Exception handling: exceptions must be documented, time-bound, risk-assessed and approved at the level defined in the policy, never by the requester alone.

Regulatory correspondence should be logged, owned, answered within the stated deadline, and the response approved before submission.

Whistleblowing channels must be independent, confidential and protect the reporter from retaliation; logs should be reviewed for trends.

Conflicts of interest policy requires identification, disclosure, and where needed, recusal or Chinese walls.

Outsourcing and third-party guidelines: perform due diligence, retain accountability, monitor performance, and ensure regulator access to records.

COSO internal control framework: control environment, risk assessment, control activities, information and communication, monitoring activities.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; and key vs non-key controls.

Segregation of duties, dual authorisation, maker-checker, and access controls are the core preventive controls in financial operations.

A control is well designed if it addresses the risk and operates effectively if it works as designed consistently over the review period.

Reconciliations, exception reports, system logs and independent confirmations are detective controls that evidence operation.

Control testing samples must be selected on a documented basis; a control failure rate above tolerance means the control cannot be relied upon.

Automated controls require testing of the underlying system logic and change-management controls, not just the output.

Compensating controls can mitigate a known control gap temporarily but do not remove the need to remediate the gap.

Internal audit provides independent, objective assurance on governance, risk management and internal controls; it is the third line.

Independence requires a direct reporting line to the audit committee, unrestricted access to records and people, and no operational responsibility.

Audit planning is risk-based: the annual audit plan is derived from the risk assessment and approved by the audit committee.

Audit process phases: planning and scoping, fieldwork and evidence gathering, findings and rating, reporting, management response, and follow-up.

Findings are rated (e.g., high/medium/low) by impact and likelihood; high findings require prompt escalation to the audit committee.

Internal audit tests control effectiveness; compliance monitors and advises; the two must not be merged or subordinated to each other.

Follow-up confirms that management actions were implemented and effective; overdue actions are reported to the audit committee.

Audit reports should state scope, criteria, condition, cause, effect and recommendation so findings are actionable and evidenced.

Core ethical principles: integrity, objectivity, confidentiality, professional competence and due care, and professional behaviour.

Objectivity requires avoiding conflicts of interest and refusing gifts or hospitality that could influence judgement; gifts registers support this.

Confidentiality continues after employment ends; information may be disclosed only when legally required or authorised.

Whistleblowing is a professional duty when internal escalation fails; protected disclosure channels should be used before external disclosure.

Competence requires continuing professional development and only performing work within one's knowledge and skill, seeking expert advice where needed.

Documentation standard: if it is not written down and evidenced, it cannot be demonstrated to a regulator or auditor.

Professional scepticism means challenging information and assumptions rather than accepting explanations at face value.

Handling of inside or market-sensitive information requires need-to-know access and no dealing or tipping before public disclosure.

Governance pillars: accountability, transparency, fairness and responsibility toward shareholders and stakeholders.

Board committees: audit committee (financial reporting and internal audit oversight), risk committee (risk appetite and framework), and nomination/remuneration committee.

Under the Companies Act 2017 and SECP code, listed companies must meet requirements on board composition, independent directors and audit committee formation.

The audit committee should comprise non-executive directors with at least one financially literate member and should meet independently with internal and external auditors.

'Comply or explain' regimes permit departure from a governance code provision only with a reasoned public explanation.

Three lines model separates ownership of risk (business), oversight (risk and compliance) and independent assurance (internal audit) to prevent conflicts.

Tone at the top is set by the board and CEO; it is evidenced by resource allocation, consequences for breaches, and how bad news is received.

Related-party transactions require disclosure, arm's-length terms and approval by disinterested directors to protect minority shareholders.

Compliance means conforming to laws, regulations, rules and internal standards applicable to the institution's activities, evidenced through documented controls and records rather than intent alone.

The FATF 40 Recommendations set the international AML/CFT standard that Pakistan implements through the AML Act 2010, SECP AML/CFT Regulations 2020 and SBP regulations.

The three lines model assigns risk ownership to business units, oversight to compliance and risk functions, and independent assurance to internal audit.

Proportionality requires control intensity to match the institution's size, complexity, products and geographic footprint rather than a uniform template.

Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage arising from failure to meet applicable requirements.

Core programme elements are governance, policies and procedures, risk assessment, training, monitoring and testing, escalation and reporting, and remediation.

KYC and transaction records must be retained for the period set by the applicable regulator, commonly five years after the relationship ends.

Regulatory change management requires identifying, interpreting, mapping and implementing new requirements before their effective date, with evidence retained.

The board approves the compliance policy and risk appetite and receives periodic compliance reporting; it does not perform day-to-day compliance tasks.

The compliance function must have authority to monitor, advise, escalate and report, with direct access to the board or its audit and risk committee.

Independence is tested by absence of profit-and-loss responsibility for the business the compliance function monitors and reviews.

Senior management implements the programme, allocates resources and ensures findings are remediated within agreed timelines.

First-line staff apply policies, complete customer due diligence, escalate red flags and complete mandatory training.

Segregation of duties requires that the approver of a transaction or relationship is not the person who monitors or tests it.

The escalation matrix must specify who is informed, within what timeframe, and the alternate route where the normal recipient is implicated.

Programme build sequence runs from risk assessment to policy, control design, training, monitoring and testing, then remediation and board reporting.

The compliance risk assessment rates inherent risk by likelihood and impact, then adjusts for control effectiveness to produce residual risk.

Monitoring is ongoing, process-embedded surveillance such as exception reports and dashboards; testing is periodic independent sample-based review.

The monitoring plan states scope, frequency, methodology, sample rationale, owner and reporting line for each review.

Key risk indicators with thresholds and escalation triggers make monitoring measurable, for example overdue CDD percentage and training completion rate.

Board compliance reports should show breach trends, root causes, remediation status, regulatory developments and residual risk against appetite.

Findings require a written action plan with owner, due date, closure evidence and validation by compliance before closure is accepted.

Risk categories include credit, market, liquidity, operational, compliance, reputational, strategic and, where relevant, Shariah non-compliance risk.

The risk appetite statement defines acceptable risk types and levels; compliance tolerances convert appetite into measurable limits.

Residual risk equals inherent risk adjusted for control effectiveness; residual risk above appetite requires escalation and remediation.

AML/CFT customer risk rating combines customer type, geography, products, delivery channel and transaction behaviour.

Enhanced due diligence applies to politically exposed persons, high-risk jurisdictions, complex ownership and unusual transaction patterns.

The risk register records description, owner, inherent and residual rating, controls and review date, and is reviewed at least annually.

Outsourcing or insurance transfers financial impact but does not transfer regulatory accountability to the third party.

Compliance costs include personnel, systems, training, external advice, regulatory fees and opportunity cost of restricted business.

Non-compliance costs include fines, remediation, legal defence, licence conditions, restitution and reputational loss.

Control cost-benefit compares expected loss avoided, calculated as probability times impact times risk reduction, against total cost of ownership.

Reputational damage affects funding cost, customer attrition, correspondent banking access and share value, and is difficult to quantify.

Proportionality requires control cost to be justified by the underlying risk, documented in the risk assessment.

Automated screening and monitoring reduce manual cost per alert over time and improve auditability of decisions.

De-risking by exiting whole customer segments can create concentration and reputational risk without fixing the underlying control weakness.

Instrument hierarchy runs from primary legislation to regulations, then directives and circulars, then guidance that explains expectations.

Where guidance conflicts with a binding rule, the rule prevails and the conflict should be documented and escalated.

Policies need version control, approval authority, effective date, review cycle and a defined exception process.

Exceptions must be documented, time-bound, risk-assessed and approved at the level stated in policy, never by the requester alone.

Regulatory correspondence should be logged, assigned an owner, answered by the deadline and approved before submission.

Whistleblowing channels must be independent and confidential, protect reporters from retaliation, and have their logs reviewed for trends.

Third-party and outsourcing guidelines require due diligence, retained accountability, ongoing monitoring and regulator access to records.

The COSO framework comprises control environment, risk assessment, control activities, information and communication, and monitoring activities.

Controls are classified as preventive or detective, manual or automated, entity-level or transaction-level, and key or non-key.

Segregation of duties, dual authorisation, maker-checker and access controls are core preventive controls in financial operations.

A control is well designed if it addresses the risk and effective if it operates as designed consistently across the review period.

Reconciliations, exception reports, system logs and independent confirmations are detective controls that evidence operation.

Sample selection must follow a documented basis; failure rates above tolerance mean the control cannot be relied upon.

Automated controls require testing of system logic and change-management controls, not only of the output produced.

Internal audit provides independent objective assurance on governance, risk management and controls, and sits in the third line.

Independence requires a direct reporting line to the audit committee, unrestricted access to records and people, and no operational duties.

The annual risk-based audit plan is derived from the risk assessment and approved by the audit committee.

Audit phases are planning and scoping, fieldwork and evidence, findings and rating, reporting, management response and follow-up.

Findings are rated by impact and likelihood, and high-rated findings are escalated promptly to the audit committee.

Internal audit tests control effectiveness while compliance monitors and advises; the two functions must remain separate.

Follow-up confirms that management actions were implemented and effective; overdue actions are reported to the audit committee.

Core ethical principles are integrity, objectivity, confidentiality, professional competence and due care, and professional behaviour.

Objectivity requires avoiding conflicts of interest and refusing gifts or hospitality capable of influencing judgement, supported by a gifts register.

Confidentiality survives the end of employment; disclosure is permitted only when legally required or properly authorised.

Continuing professional development maintains competence, and work outside one's expertise requires expert advice rather than assumption.

Professional scepticism means challenging information and assumptions instead of accepting explanations at face value.

Documentation standard: an unevidenced action cannot be demonstrated to a regulator, auditor or court.

Handling inside information requires need-to-know access and prohibits dealing or tipping before public disclosure.

Governance pillars are accountability, transparency, fairness and responsibility toward shareholders and wider stakeholders.

Board committees include audit (reporting and internal audit oversight), risk (appetite and framework) and nomination and remuneration.

The Companies Act 2017 and SECP governance requirements set rules on board composition, independent directors and audit committee formation for listed companies.

The audit committee should comprise non-executive directors, include a financially literate member and meet separately with internal and external auditors.

Comply-or-explain regimes allow departure from a code provision only with a reasoned public explanation.

Tone at the top is evidenced by resource allocation, consequences for breaches and how the board receives adverse information.

Related-party transactions require disclosure, arm's-length terms and approval by disinterested directors to protect minority shareholders.