It is well understood that money launderers use deceit or theft to capture the processes of financial entities for illicit purposes. As a result, your AML compliance program must implement internal control designs that increase the chances of preventing or detecting such activities.
Financial managers and auditors are familiar with the concept and implementation of internal controls. The difference is that controls as part of an AML compliance program will be focused on mitigating risks discovered in a money laundering risk assessment. Further, internal controls as part of an AML program must be designed to generate the mandated reports and other surveillance, reporting, and records retention required by the Banking Secrecy Act, FinCEN and the Office of Foreign Assets Control, among others.
What’s involved in AML internal controls?
AML internal controls include those policies, procedures, and processes designed to mitigate the risks of money laundering and support compliance with AML regulations.
A compliant internal controls program will be appropriate for the specific organization, and based on its specific risks. Thus, larger or more exposed organizations may have more sophisticated or detailed programs, but ALL financial entities will aim to address the same types of issues. For examples, the program will:
- Use the risk assessment process to identify the products, services, customers, third parties, and locations that are more vulnerable to money laundering.
- Assign responsibility for AML compliance to an appropriate person who will keep senior management and the Board informed.
- Implement risk-based Customer Due Diligence (CDD) policies to help identify vulnerable accounts.
- Identify reportable transactions, and comply with mandating reporting requirements.
- Provide dual control and segregation of duties as appropriate.
- Train and supervise employees as needed to be aware of and compliant with AML regulations.
- Report and maintain records as required.
Your organization’s Board of Directors and senior management are responsible for creating a “culture of compliance” through performance of these tasks. An important support for this culture will be regular internal and external audits that lead to evaluations of AML compliance performance.
External audits by qualified AML experts provide a needed degree of objectivity in evaluating the internal controls program. They should provide a summary judgment about the quality of the program. They will review the existing program, including the analyses it is based upon, on a risk-adjusted basis, looking at risk assessment, structure, training, and reporting effectiveness. External auditors may run tests to evaluate how the process would respond to money laundering threats.
Internal controls are what enable your financial institution to comply with AML requirements. The quality of these outputs will be the basis for enforcement actions if the regulator finds the program deficient or ineffective. When it comes to AML compliance, the importance of the internal controls program is high. With this in mind, your organization should look to implement a comprehensive, compliant internal controls program built around your company’s unique risk profile.