What makes a strong AML compliance culture?

A firm's controls are only as strong as the attitude behind them. If a sales target can override a due diligence check, or a profitable client is waved through despite an unexplained source of funds, the written procedures stop mattering. The rule is therefore absolute: meeting AML/CFT obligations takes precedence over commercial priorities and profit. The Board cannot decide otherwise, and nobody in the firm should feel that it can.

The culture has to be set from the top and shared by everyone. The Board and senior management show through their decisions that compliance matters, and every employee, from the front office to operations, should see spotting and reporting possible money laundering as part of the job rather than as the compliance department's problem.

Four elements come up again and again. First, risk-based internal rules: the policies, controls and procedures that turn the law into daily practice. Second, a designated AML compliance officer who oversees the compliance function day to day. Third, an ongoing training programme so that staff know their duties and can recognise suspicious activity. Fourth, an independent audit function that tests, on a continuing basis, whether the policies and controls actually work.

Other duties, such as reporting suspicions to MOKAS or keeping records, are obligations the programme must deliver; they are not extra building blocks. The Law lists the areas the policies must cover: customer due diligence, record keeping, internal reporting and reporting to MOKAS, internal control and risk assessment, close examination of transactions particularly open to money laundering or terrorist financing, especially complex or unusually large ones and unusual patterns with no apparent economic or lawful purpose, informing and training staff, risk management, compliance management, and the recruitment of staff and assessment of their integrity.

They must be adequate and appropriate, and proportionate to the firm's nature and size, so that it can mitigate and manage its money laundering and terrorist financing risks effectively. Designing them starts with the legal framework and the firm's own risk assessment: the stronger the risk, the stronger the control. If the firm decides that some risks are beyond its appetite, for example certain types of customer it will not take on, that decision belongs in its policies, especially the customer acceptance policy, backed by controls that enforce it.

Senior management approves the policies, procedures and controls and then monitors them and, where needed, strengthens them. In CySEC-supervised firms the Board approves the risk management and procedures manual, which records the firm's AML procedures and is communicated to the staff who deal with customers' transactions. Policies are shared across all service lines so that the same standards apply everywhere, and they are reviewed and updated regularly rather than written once and left on a shelf.