Compliance Programme Governance, Risk Assessment, Training and Record Keeping
Domain 8 covers governance, risk assessment, training and record keeping. The exam tests who owns the AML/CFT programme, how risk assessment drives controls, and what evidence an examiner expects.
Core rules
- The board approves the AML/CFT policy and appetite; senior management implements it; the compliance function is independent and has access to the board.
- The three lines of defence: business owns risk, compliance advises and monitors, internal audit provides independent assurance.
- Enterprise-wide ML/TF risk assessment covers customers, products, channels, geography and delivery; customer risk rating must be applied consistently.
- Training must be role-specific, documented and refreshed; board and senior management need appropriate training too.
- Records must be sufficient to reconstruct transactions and demonstrate CDD for at least five years.
Worked example
A bank launches a digital wallet with agent cash-in. Before launch, it should complete a product risk assessment, set tiered CDD and limits, screen agents, configure monitoring for rapid pass-through, train staff and agents, and define record retention. Launching first and writing the policy later is a governance failure even if the app works.
Traps
- Treating compliance as a single department rather than a three-lines model.
- Running generic annual training with no role-specific content or testing.
- Treating the risk assessment as a one-time document rather than a living control.
- Keeping records for less than five years or failing to keep the rationale for decisions.