Heritage Wealth Partners: AML Alert Backlog and Remediation
Heritage Wealth Partners manages $14bn for ultra-high-net-worth clients across five jurisdictions. Its transaction-monitoring system generates 18,000 alerts a month; 35 analysts close most as false positives, but a backlog of 4,200 alerts is more than 90 days old. The bank outsources alert triage to a managed service whose staff have not been trained on the firm's higher-risk jurisdictions. A recent internal review found 12 suspicious activity reports filed late and two client files missing beneficial-ownership evidence. The regulator has issued a remediation letter requiring a lookback, root-cause analysis and board oversight. The COO proposes hiring 10 more analysts and clearing the backlog in six months. The CRO notes that the alert rules have not been tuned in three years and that relationship managers can override risk ratings without second-line approval. The board wants to know whether the firm's compliance risk appetite is still within tolerance.
1. Assess whether the firm is within compliance risk appetite and identify root causes rather than symptoms.
Read the worked answer
The firm is likely outside appetite, but the more important issue is that it cannot demonstrate appetite. 18,000 alerts a month with a 4,200-alert backlog older than 90 days means the monitoring system is not operating effectively. 35 analysts closing most alerts as false positives may be rational, but without tuning the rules have not adapted to risk. Outsourced triage staff not trained on higher-risk jurisdictions is a control gap. 12 late SARs and missing beneficial-ownership evidence are reportable failures. Relationship managers overriding risk ratings without second-line approval breaks the control hierarchy. The root causes are rule governance, training, outsourcing oversight and escalation, not simply analyst headcount. The board should treat this as a compliance risk appetite breach because the firm cannot show timely detection and reporting.
2. Critique the COO's plan and propose a risk-based remediation plan, including lookback scope, tuning, outsourcing controls, and SAR backlog.
Read the worked answer
Hiring 10 analysts may help, but it treats a symptom. A risk-based plan should: (1) immediately triage the 4,200 backlog by risk score, prioritising higher-risk jurisdictions, PEPs and high-value clients; (2) tune alert rules using a documented threshold methodology and validate them; (3) restrict relationship-manager overrides and require second-line approval with rationale; (4) assess the managed service against contractual controls, train staff on the firm's risk profile, and set quality metrics; (5) conduct a lookback over a defined period, at least 12 months, covering alerts, SARs and client files; (6) remediate missing beneficial-ownership evidence. The COO's six-month backlog clearance may be too slow for high-risk cases. The plan should have owners, dates and independent validation. The CRO should report progress to the board monthly and to the regulator as required.
3. Define board metrics and escalation triggers. How should the firm handle regulator communications?
Read the worked answer
Board metrics should include alert volumes, backlog aging, false-positive rate after tuning, SAR timeliness, override counts, training completion, outsourcing quality scores, and lookback completion. Escalation triggers should be set in advance: any SAR filed late, any backlog over 30 days for high-risk clients, any override without second-line approval, or any missed remediation milestone. The board should receive a one-page compliance dashboard with trends, not just counts. Regulator communications should be factual, acknowledge the findings, set out root causes and the remediation plan, and avoid overpromising. The firm should provide regular updates and notify the regulator of any new issues. The CRO should ensure the board understands that compliance risk appetite is not a static limit: it requires evidence of control operation, and the firm should consider a temporary restriction on onboarding higher-risk clients until controls are stable.