AML governance: who is actually accountable.

Who is accountable

Ask most institutions who is responsible for anti-money laundering and the answer is the compliance department. That answer is wrong in a way that matters, because it describes who does the work rather than who carries the obligation.

The board owns it. The Basel Committee's guidance on the sound management of money laundering and terrorist financing risk places the duty at the top: the board of directors is expected to ensure that senior management appoints an appropriately qualified AML officer with overall responsibility for the function. The board does not run the programme. It is accountable for there being one, for it being adequately resourced, and for knowing whether it works.

Accountability does not delegate. A board can delegate execution. It cannot delegate the consequence. This is the distinction that surfaces during enforcement, when the question becomes not "did the compliance team do its job" but "did those running the institution ensure there was a job being done, and did they check".

What a board must actually be able to say, in its own words rather than by pointing at a policy:

• What the institution's principal money laundering and terrorist financing risks are, and why those.
• Whether the controls against them are working, and how that is known.
• Where the gaps are, who owns each, and by when.
• Whether the compliance function has the resources and the authority to do what is asked of it.
• What the institution's risk appetite is, and whether the business is operating inside it.

A board that can answer those five is governing. One that receives a quarterly pack of alert volumes and report counts is being informed, which is not the same thing.

Senior management's part. Between the board and the function sits executive management, whose job is to turn the board's appetite into an operating reality: appointing the officer, approving policies, allocating people and budget, and ensuring the business lines actually carry the controls they have been given. Most programme failures live here rather than at either end — a board that approved the right things and a compliance function that designed the right controls, with a business that never operated them.

Culture is a governance output, not a poster. The practical test is simple and uncomfortable: what happens when compliance and revenue disagree? If the honest answer is that the business usually prevails, the institution's controls are advisory, whatever the organisation chart says. The Basel guidance addresses this structurally by requiring that conflicts between the first and second lines of defence be resolved at the highest level — which only works if the highest level is willing to resolve some of them against the business.

The three lines of defence

The model is simple to describe and routinely misapplied. Its value is that it assigns ownership, which is the thing most programmes lack.

First line: the business. The Basel guidance places the business units — front office and customer-facing activity — as the first line of defence, in charge of identifying, assessing and controlling the risks of their business. Read that again: identifying, assessing and controlling. Not "cooperating with compliance". The relationship manager who onboards the customer, the operations team that processes the payment, the branch staff who see the cash: these people own the risk they create.

Second line: compliance and risk. The Basel guidance places the AML officer in the second line. Its role is to set the framework, provide expertise, advise, challenge, and monitor whether the first line is actually doing what it owns. It is oversight, not performance.

Third line: internal audit. Independent assurance that the first two lines work, reporting to the audit committee rather than to management.

How it fails in practice. Four patterns, each common:

• The second line doing the first line's job. Compliance performs the due diligence, clears the alerts and writes the files. It feels efficient and it is fatal to the model: the business stops owning the risk, and the function that is supposed to challenge the work has become the work's author. Nobody is left to review it.
• The first line treating controls as compliance's problem. Identification done badly because "compliance will catch it", escalations not raised because they slow a deal.
• The third line not being independent. Internal audit reporting to the executives whose programme it examines, or lacking the specialist knowledge to assess AML controls at all, so its reviews test whether the policy was followed rather than whether it works.
• No line owning data. Customer and transaction data is produced by the first line, depended on by the second, and owned by neither. Data quality failures therefore sit in a gap and are nobody's remediation.

The test for whether your model is real. Ask who would be accountable if a high-risk customer were onboarded with inadequate due diligence. If the answer is "compliance, for not catching it", the first line is not a line of defence — it is a source of work.

The AML officer: authority, independence, and what the role is not

The title varies — MLRO, AML officer, BSA officer, nominated officer, chief compliance officer. The substance is what matters, and the standards are specific about it.

The appointment is a board-level concern. The Basel guidance puts the board in the position of ensuring senior management appoints an appropriately qualified officer with overall responsibility for the function. "Appropriately qualified" is doing real work in that sentence: the role is given to someone capable of it, not to whoever is available.

Independence, stated concretely. The Basel guidance says the AML officer should not have business line responsibilities, and should not be entrusted with responsibility for data protection or the internal audit function. Each exclusion addresses a specific conflict:

• No business line role, because a person carrying revenue targets cannot credibly decline business.
• Not internal audit, because the third line cannot audit a function it also runs.
• Not data protection, because the two regimes pull in opposite directions — one requiring minimisation and deletion, the other retention and disclosure. One person holding both resolves those tensions privately, where nobody can see the trade-off being made.

What the role may be combined with. The same guidance allows that the AML officer may also perform the function of chief risk officer or chief compliance officer or equivalent. So the model is not that the role must be standalone — it is that it must not be compromised by the specific conflicts above. In a small institution, combination is often the only realistic arrangement, and it is permitted.

Reporting suspicious transactions. The guidance assigns the officer responsibility for reporting suspicious transactions. This is the part of the role that is genuinely personal: in many jurisdictions the decision to report, or not to, attaches to a named individual rather than to the institution — which is precisely why the authority to make that decision cannot sit with someone whose judgement is subject to commercial pressure.

Resources and standing. The officer should be provided with sufficient resources to execute all responsibilities effectively and should play a central and proactive role in the institution's AML regime. Those two phrases are worth quoting to a board that regards the function as an administrative cost. A role that is reactive, under-resourced and consulted after decisions have been taken does not meet the standard, however diligently the individual performs.

What the role is not. It is not the person who does all the AML work — that is the first line. It is not a signature that makes a decision someone else wanted acceptable. And it is not a shield: an institution that appoints an officer and leaves them without authority has not transferred its obligation to them. It has created a person to blame.

What the programme has to contain

FATF Recommendation 18 requires financial institutions to implement programmes against money laundering and terrorist financing, and specifies what those programmes include. Four components, each with a failure mode worth knowing.

1. Compliance management arrangements, including a compliance officer at management level. Not merely an appointment — a level. An officer who cannot reach the people who decide things cannot discharge the role, and placing the appointment several layers down is a common way of appearing to comply while removing the authority.

2. Screening procedures for hiring employees. The least discussed and genuinely important: the insider is the control that bypasses every other control. An employee at a counter, in operations, or in compliance itself, who is complicit, defeats systems designed for external threats. Screening at hire, and proportionate re-screening in sensitive roles, is the control.

3. An ongoing training programme. The failure here is uniformity. The same annual module for everyone trains nobody: a relationship manager, a payments operator, a branch cashier and a board member need different things. Training that does not reflect what this institution actually faces — its products, its corridors, its risk assessment — is general education, not a control.

4. An independent audit function to test the system. Independent of what it tests, and competent to test it. An audit that confirms policies exist and were followed is a compliance check. An audit that asks whether the controls work — sampling outcomes, testing data, re-performing decisions — is assurance.

Group-wide programmes. Where an institution operates across borders, the programme should apply group-wide, with the ability to share information within the group for AML purposes — and with local law sometimes limiting what can be shared, which has to be identified and managed rather than discovered during an incident.

Policies that the business can actually follow. A policy nobody can comply with produces either ignored rules or paralysed operations, and both are governance failures. The useful test is whether the people expected to apply a policy can state what it requires of them in their own words. If they cannot, the document is not a control.

And the programme must be proportionate. The standards require measures commensurate with the risks identified. A small institution running a programme copied from a global bank will exhaust itself on the wrong things; a large one running a minimal programme will miss what its complexity creates. Both are failures of judgement at the governance level, not at the operational one.

What actually breaks programmes

Enforcement actions rarely describe an institution with no controls. They describe institutions whose controls existed and did not work, and the causes repeat.

Resourcing that does not track growth. The business grows, the customer base changes, a new market opens, an acquisition completes — and the compliance headcount is set in a budget cycle that assumed none of it. Backlogs appear, alert queues age, reviews slip, and the measurable failure arrives years after the decision that caused it. A board question worth asking every cycle: what has changed about the business, and did the control functions change with it?

Alert and case backlogs, treated as an operational nuisance. A backlog is unexamined risk, and it compounds: the older an alert, the harder it is to resolve, so the pressure is always to close rather than investigate. Backlog age, not backlog size, is the number to report.

Escalation that does not travel. Staff see things and say nothing, because nothing happened last time, or because raising it was uncomfortable. Any institution can test this cheaply: ask front-line staff what route an observation takes, and how often they have used it.

The business overriding the function quietly. Not by formal decision — by pressure, delay, and relationships retained while the paperwork is sorted out. The Basel guidance's requirement that first and second line conflicts be resolved at the highest level is the structural answer, and it only functions if the escalations are visible and some are decided against revenue.

Reporting that measures activity rather than effect. Alert volumes, reports filed, training completion percentages, cases closed. All easy to produce and none of it says whether the institution is finding what it should. A board pack of rising numbers is consistent with both an improving programme and a deteriorating one.

What a board should ask for instead. Harder to produce and far more informative: what the risk assessment found and what changed because of it; where controls are known to be weak and what is being done; what the backlog ages are; what independent testing concluded, including the unflattering findings; how many escalations went against the business; and what came back from authorities about what the institution filed.

On personal exposure. In many jurisdictions the AML officer, and in some cases directors, carry personal regulatory or criminal exposure for failures in the programme — the detail varies and specific advice is a matter for local counsel. The governance point is independent of the jurisdiction: a person carrying personal exposure for an outcome must have the authority, the resources and the access to influence it. Where a board grants the exposure without the authority, it has not managed a risk. It has only located someone to carry it.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.