What are the Board's responsibilities for AML compliance?

A firm's AML compliance starts and ends with its Board. CySEC's AML Directive gives the Board of every CySEC-supervised firm a set of duties. It determines, records and approves the firm's general policy principles on preventing money laundering and terrorist financing, and communicates them to the compliance officer, who turns them into detailed procedures.

The Board appoints the compliance officer, an alternate compliance officer to stand in during absences (the Directive requires one) and, where necessary, assistants, and defines their duties in the firm's risk management and procedures manual. It approves that manual and makes sure it reaches every employee who manages, monitors or controls customers' transactions. It must also make sure that the requirements of the Law, in particular its Article 58, and of the Directive are actually applied, with systems and controls that are adequate and work in practice.

The compliance officer, the alternate, the assistants and anyone else working on AML procedures must be able to see, fully and promptly, all customer identification data, transaction documents and other relevant records. The Board must also give the compliance officer and the alternate enough resources, including competent staff and technology.

Staff need to know where to go. The Board makes sure every employee knows who the compliance officer, the alternate and the assistants are, and sets up a clear and quick reporting chain so that information about suspicious transactions reaches the compliance officer without delay, directly or through the assistants. The chain is written into the procedures manual.

Each year the Board assesses and approves the compliance officer's Annual Report and takes whatever action is needed to fix the weaknesses and deficiencies it reveals. It does the same with the internal auditor's findings. CySEC also expects the Board and senior management to approve the compliance officer's annual training programme, to receive information on how it is carried out, and to be adequately trained themselves. The Board oversees; the daily work, the evaluation of internal reports, reporting to MOKAS and acting as its first point of contact stay with the compliance officer.

Under Article 58C of the Law, senior management approves the policies, procedures and controls the firm applies against money laundering and terrorist financing, and then monitors the measures and, where appropriate, reinforces them. Approval is not a one-off signature.

Under Article 58D, a firm that has a Board designates one Board member who is responsible for implementing the Law and the directives, circulars and regulations issued under it, including relevant EU acts. CySEC's Directive adds that this person may be an executive or a non-executive director and, depending on the nature and size of the firm, may take on other duties as well; the Board records how the arrangement works in the procedures manual.

CySEC has also asked the firms it supervises to follow the EBA's 2022 guidelines on AML/CFT compliance management, which describe this Board member as the person ultimately responsible for AML/CFT at management body level and set out the tasks of the compliance officer and, in groups, of a group compliance officer.