Compliance reports to the CFO

Several deficiencies stand out. First, the compliance function lacks independence: the head of compliance reports to the CFO, whose objectives are financial, and has no direct access to the board. FATF Recommendation 18 expects an independent compliance function, and the State Bank of Pakistan's AML/CFT framework expects board-approved policies and a compliance officer with appropriate standing and access. Second, board oversight is nominal: ten minutes a quarter is not enough for a bank with 38% high-risk customers and a new mobile wallet. Third, the enterprise-wide risk assessment is stale. It was last updated in 2021 and does not cover the mobile wallet or agent-based cash-in services, which are new delivery channels with different ML/TF risks. FATF Recommendation 15 requires risk assessment of new technologies. Fourth, training completion at 41% is inadequate for the risk profile, and training should cover board members, staff and agents. Fifth, the fall in STRs while alerts rose 45% is a red flag, not a success. It could indicate under-reporting, poor alert triage, a backlog, or a compliance culture that discourages reporting. Sixth, outsourcing internal audit to a firm that also does loan review creates an independence conflict; AML/CFT audit should be independent and report to the audit committee. Finally, the proposal to cut the compliance budget because STR numbers are down is backwards: STR volume is not a performance target, and reduced reporting may increase regulatory risk.

The board should approve a time-bound remediation plan with named owners and evidence. The compliance head should report to the CEO or directly to the board audit committee, with unrestricted access to the board and a formal annual report. The board should receive at least quarterly AML/CFT reporting covering risk assessment, alerts, STRs, sanctions hits, training, audit findings and high-risk customer numbers. The enterprise-wide risk assessment should be refreshed immediately to cover the mobile wallet, agent network, high-risk customer mix and new products. It should be risk-based and dynamic, with customer and product risk ratings, and should drive CDD, monitoring and training. Training should be mandatory and role-based: board and senior management, front line, operations, compliance and agents. Completion should be tracked and reported to the board; 41% is not acceptable. Internal audit should be independent of loan review, with AML/CFT expertise and a direct reporting line to the audit committee. The bank should review alert-to-STR conversion, clear any backlog, and test whether the fall in STRs reflects improved triage or under-reporting. Resources should be allocated according to risk, not STR counts. The bank should document the reasons for any budget decision and should not cut compliance capacity while high-risk exposure is growing. A credible plan should include timelines, metrics and escalation if milestones are missed, and the bank should consider proactive engagement with the regulator.