The AML/CTF Function and MLRO play important roles in finance. A sound governance structure is the foundation of an effective AML/CFT program and will include the board of directors and senior management setting the tone at the top, hiring a qualified chief AML/CFT officer, and properly resourcing the three lines of defense. In an organization such as a bank or a financial institution, the Board of Directors is primarily responsible for setting a strong compliance culture and implementing the compliance program.
The “tone at the top” is a public commitment at the highest levels of the bank to comply with AML/CFT requirements as part of its core mission and recognition that this is critical to the overall risk management framework of the bank.
The AML/CTF Function and MLRO
To ensure appropriate oversight of the compliance culture, the Board of Directors form a Board level sub-committee, to periodically monitor the compliance practices and measures taken by the management.
The Board of Directors may delegate the responsibility to the Board Compliance Committee (BCC). The members of BCC periodically conduct the compliance meetings, where significant compliance issues, breaches, and new regulatory requirements are reviewed and discussed.
The Board ensures that a strong compliance culture and control environment is maintained. The Board provides oversight and guidance to the Compliance Committee and Senior Management to implement the Compliance program and policies, approved by the Board. The management forms the set of processes, reporting lines, systems, and structures that provide the basis for carrying out regulatory requirements across the organization. Control environment relates to the commitment of management and employees to integrity and ethical values.
For internal controls to be effective, an appropriate control environment should demonstrate the following behaviors:
The Board reviews policies and procedures periodically and ensures their compliance.
The Board determines whether there is an audit and control system in place to periodically test and monitor compliance with internal control policies/procedures and to report to the board instances of noncompliance.
The Board ensures independence of internal and external auditors such that internal audit directly reports to the audit committee of the board which is responsible to the Board and that external auditor interacts with the said committee and presents management letter to the board directly.
The Board ensures that appropriate remedial action has been taken when the instance of non-compliance is reported, and that system has been improved to avoid recurring errors/mistakes.
Management information systems provide adequate information to the board and that the board can have access to records if the need arises.
The Board and Management ensure communication of compliance policies down the line within the organization.
The Board forms a Board sub-committee, known as the Board Compliance Committee (BCC), to provide strong oversight to the Compliance Committee and the Management, to ensure effective and continued implementation of applicable regulatory requirements.
The BCC ensures the Board-approved Compliance Program is implemented by the Management, for effective compliance. The BCC forms a Management level Compliance Committee known as the “Central Compliance Committee (CCC)”. The CCC works on behalf of the BCC, to regularly review and provide appropriate feedback to the management and employees, regarding the overall compliance profile of the organization.
MCC comprises all the departmental heads, as members of the MCC, and they meet periodically to discuss the compliance status for their respective departments. The Chief Compliance Officer (CCO) serves as the secretary to the BCC, CCO prepares and presents the agenda of the BCC meeting, before the members of the BCC before each periodic meeting.
The Money Laundering Reporting Officer (MLRO) being part of the Compliance Function, serves as the second line of defense and works in coordination with the first line of defense, which include Business and Operation Managers, who are responsible for establishing the business relationships and processing the transactions of the clients and customers. MLRO is mainly responsible to adopt the risk-based approach towards managing the AML and Regulatory Compliance-related roles and responsibilities.
As a best practice, the MLRO of a larger organization or business should not be directly involved in the business operations, receipt, transfer, or payment of funds. The appointed MLRO should also have independent oversight and be able to communicate directly with those parties who make decisions about the business such as senior management or the board of directors.
An MLRO needs to:
Have the necessary authority and access to resources to implement an effective compliance program and make any desired changes.
Know your business’s functions and structure.
Have knowledge of your business sector’s ML/TF risks and vulnerabilities as well as ML/TF trends and typologies.
Understand your business sector’s requirements under the PCMLTFA and associated Regulations.
MLRO is mainly responsible to:
Ensure compliance with applicable AML/CFT and KYC laws, rules, regulations, and instructions.
Develop end-to-end compliance programs and all AML/KYC policies, procedures, methods, tools, etc. in the light of these guidelines and ensure/monitor/oversee their entity-wide implementation.
Determine the resources required to perform compliance roles and responsibilities professionally and of desired quality.
Ensure that appropriate AML/KYC policies and processes are developed and implemented, to ensure that all the customers are identified, screened, and verified, before opening an account or establishing a business relationship with them.
Provide summary data and report findings on compliance issues to the board or its subcommittee and CCM periodically.
Report to the Management Compliance Committee (MCC) and the Board Compliance Committee (BCC) promptly on any material regulatory noncompliance for example, failures that may attract a significant penalty.
Ensure that customer accounts are regularly monitored to identify suspicious activities, and transactions.
Review the Compliance policies and procedures, to ensure that AML/CFT/KYC-related regulatory requirements are incorporated for meticulous compliance.
Coordinate with senior management to implement overall Compliance Program.
Respond and facilitate regulatory authorities or agencies, in performing inspections or investigations.
Apprise the Board of Directors and Senior Management on AML/KYC initiatives;
Ensure that the employees are provided with AML/KYC training timely and accurately report the Suspicious Activity Report (SAR) to the relevant regulatory authority.
Final Thoughts
Money laundering is the process of making money that has been obtained illegally appear to have been obtained legally. It is the process of concealing and integrating criminal proceeds into the legitimate financial system. Simply put, it is the process of converting the proceeds of illegal activity into legitimate income. It is also defined as activities aimed at concealing, concealing, or revealing the qualification, source, location, status, or movement.
Organizations are more vulnerable to financial crime than individuals. As a result, financial firms must protect their organizations and customers from this risk. Furthermore, it necessitates systematic preparation for potential situations. The MRLO makes decisions on AML reporting that may have an impact on a company’s relationship with its customers as well as its exposure to criminal, legal, regulatory, and disciplinary action. He keeps track of all activities that take place within the AML framework.