What does the AML compliance officer do?

Every obliged entity must appoint a compliance officer from its senior management with the skills, knowledge and expertise needed to receive and assess reports of suspected money laundering or terrorist financing. Belonging to senior management gives the officer the authority the role needs. In CySEC-supervised firms the Board makes the appointment and records the officer's duties in the procedures manual; the officer reports to senior management, and to the Board both through the Annual Report and directly whenever the officer considers it necessary. Under the EBA guidelines that CySEC applies, the designated Board member is the officer's main contact on the Board. The officer does not have to be a director.

The firm must also appoint an alternate compliance officer, who replaces the compliance officer temporarily during absences, performs the same duties and must meet the same conditions of appointment. The alternate's function may be outsourced, but only to a natural person, and the firm records the appointment procedure in its manual. Where the volume or geographic spread of the business makes it necessary, assistants are appointed, by district or otherwise, to support the compliance officer and pass internal suspicion reports to them. The firm tells CySEC immediately the names, positions and contact details of everyone appointed to these roles.

The officer turns the Board's policy principles into practice: designing the firm's AML procedures and controls and allocating responsibilities between departments, including controls for online and telephone services, new products and new markets; drawing up the customer acceptance policy, with at least three risk categories, for the Board to approve; and preparing the risk management and procedures manual.

The officer then checks that everything is applied correctly, using tools such as on-site visits to departments, gives guidance to correct weaknesses and informs the Board where needed. At least once a year the officer identifies, records and assesses the risks posed by new and existing customers and by new financial instruments and services, updates the firm's systems accordingly, and keeps up-to-date lists of customers by risk category.

On suspicious activity, the officer receives staff's Internal Suspicion Reports, evaluates each one in an Internal Evaluation Report, reports to MOKAS through goAML where there is knowledge or reasonable suspicion, records full reasons when deciding not to report, and acts as MOKAS's first point of contact. The officer also approves in writing any reliance on a third party for customer due diligence after checking that it is an obliged entity, makes sure that branches and subsidiaries based outside the European Economic Area (EEA) have taken every measure needed to comply fully with the Directive's identification, due diligence and record-keeping requirements, advises staff, keeps their own knowledge current, identifies training needs and runs an annual training programme, answers all requests from MOKAS and CySEC, and keeps a registry of internal reports, evaluations and reports to MOKAS with the related statistics.

Every month the officer prepares the Monthly Prevention Statement and submits it to CySEC within 15 days of the month-end. It covers the total cash deposits the firm accepted, the internal suspicion reports and the reports made to MOKAS, and gives the firm a regular chance to spot unusual cash activity early. Since May 2023 it has been submitted electronically through CySEC's Transaction Reporting System.

Every year the officer prepares the Annual Report, a significant tool for judging how well the firm complies. It is submitted to the Board for approval within two months of the year-end, so by the end of February. After approval it is sent to CySEC with the minutes of the Board meeting, which must record the corrective measures decided and their timetable, within 20 days of that meeting and no later than three months after the year-end. The report covers, among other things, changes made for new legal requirements, the officer's inspections and the weaknesses found, the numbers of internal reports and reports to MOKAS, cash deposits above €10,000, high-risk customers, monitoring systems, the training given and how its effectiveness was assessed, next year's training plan, and the staffing of the compliance function.