Regulatory Compliance and Anti-Money Laundering

01Purpose and scope

• This manual supports the course Regulatory Compliance and Anti-Money Laundering. It describes how compliance and anti-money laundering (AML) staff at banks, credit unions, payment firms, broker-dealers, money services businesses and similar institutions carry out their work from day to day.
• The manual covers the main activities of a compliance program: assessing money laundering and sanctions risk, onboarding and reviewing customers, monitoring transactions, investigating alerts, escalating concerns, filing reports with authorities, and keeping the records that show all of this was done. It does not replace the specific statutes, regulations or supervisory guidance that apply to your institution. Those rules differ by jurisdiction and change over time, so confirm current requirements with the authoritative source in your country, such as the financial intelligence unit, the primary banking or securities regulator, or the sanctions authority, and with your legal counsel.
• This guidance does not replace qualified professional judgment, approved internal procedures or required authorization. Decisions to exit a relationship, file a report, or approve an unusual transaction should follow your written policy and be made by someone with the appropriate authority.

02Core principles

• The working foundation for most AML programs is a risk-based approach. Controls should be stronger where the institution's products, customers, geographies and delivery channels present higher risk, and lighter where risk is lower. A common failure is applying the same heavy process to every customer, which exhausts staff and leaves real risk under-examined. Regulators in most jurisdictions expect the risk-based logic to be visible in the design of controls and in the way resources are allocated.
• Know your customer is more than collecting documents at account opening. It means understanding who the customer is, what they are expected to do with the account, where their money comes from, and whether their activity fits that picture. A small import business that suddenly receives wires from unrelated jurisdictions is a concrete example of activity that should prompt review, even when every document on file is current.
• Decisions must be documented and explainable. A reviewer should be able to reconstruct why an alert was closed, why a customer was rated high risk, or why a report was or was not filed, months later and without speaking to the original analyst. Independence matters as well. Those who originate business or earn revenue from a relationship should not be the only people deciding whether its risk is acceptable.
• Finally, compliance controls exist to detect and prevent harm, not to produce paperwork. A control that generates work but never changes an outcome should be redesigned or retired.

03Planning and preparation

• Start with an enterprise-wide money laundering and sanctions risk assessment. This document looks at the institution's customer types, products such as cross-border payments, prepaid cards or trade finance, geographic exposure, and delivery channels such as non-face-to-face onboarding or third-party introducers. For each category, the assessment rates inherent risk, describes the controls in place, and records a residual rating. Keep the methodology written down and review it whenever the business changes materially, such as a new product launch or entry into a new market.
• Next, build an inventory of obligations. List every applicable requirement, including customer identification, beneficial ownership identification, ongoing monitoring, suspicious activity reporting, currency transaction or large cash reporting where relevant, recordkeeping periods, sanctions screening against the lists the institution must follow, and training requirements. Map each obligation to a named control, an owner, and a procedure. Gaps found at this stage are much cheaper to fix than gaps found in an examination.
• Resourcing and tools come next. Estimate alert volumes using historical data from a pilot or a comparable business line, then staff investigators accordingly and plan for peaks such as month-end or seasonal activity. Confirm that your transaction monitoring system, case management platform and know your customer repository can hold the data you need, and that data feeds from core banking or payment systems are complete. Many AML failures trace back to a monitoring scenario that never received a field it depended on.
• Define the escalation path before the first case arrives. Decide who can close alerts, who must approve a high-risk onboarding, who holds authority to file a suspicious activity report, and who can instruct a relationship exit. Write these roles into the procedure so that staff do not have to guess under pressure.

04Recommended workflow

1. 1
   : Identify the trigger. Work typically starts from one of four sources: a customer onboarding or periodic review, a transaction monitoring alert, a screening hit against a sanctions or politically exposed person list, or a referral from a branch, relationship manager or outside party. Log every trigger in the case system with the date received, the source, and the initial description of the concern.
2. 2
   : Verify the match or the facts. For a screening hit, compare the name, date of birth, nationality and other identifiers against the list entry before deciding anything. Many hits are false positives that can be cleared with documented reasons. For an alert, pull the customer profile, prior activity, and the transactions that generated the alert, and confirm that the data is complete and accurate.
3. 3
   : Gather and assess the context. Compare the observed activity with the expected activity recorded at onboarding. Ask whether the transaction has a plausible business purpose, whether the counterparties and locations make sense, and whether the pattern resembles any typology your institution has documented. Request information from the customer where your procedure and local law allow it, and record the request and the response. Be careful about how you ask, because a request that signals suspicion can create tipping-off risk.
4. 4
   : Decide and document. Choose one of the outcomes your procedure permits, such as clear with rationale, enhanced review, escalate to a senior investigator, or prepare a suspicious activity report. The rationale should cite the specific facts that drove the decision. A line such as no concerns noted gives the next reviewer nothing to work with.
5. 5
   : Escalate and report where required. If the decision requires a report to the financial intelligence unit or other authority, prepare it within the timeframe set by your jurisdiction and your procedure. Timing rules differ, and some start running when suspicion is formed rather than when an investigation concludes, so confirm the rule with your authoritative source and your legal team. Restrict knowledge of the report to people who need it.
6. 6
   : Act on the relationship. Depending on the outcome, you may apply enhanced monitoring, restrict certain products, request updated documents, or exit the relationship. Exit decisions should follow a documented policy, consider any obligation to hold or freeze funds under sanctions rules, and be reviewed for fair treatment and legal constraints.
7. 7
   : Close and record. Confirm that the case file holds the source data, the analyst notes, the approval trail, and any correspondence. Set a review date for the customer's risk rating if the outcome changes it. Closing a case without these elements is one of the most common examination findings.

05Quality checks, risk controls and compliance

• Quality assurance should sit outside the team that performs the work. A typical approach is to sample a fixed percentage of closed alerts and cases each period, selecting a mix of closed-without-action, escalated and reported outcomes. Reviewers test whether the facts were correct, whether the reasoning was sound, whether the decision matches policy, and whether the documentation would satisfy an examiner. Track the results by analyst and by alert type so that training can be targeted. The sample size and selection method should be documented and approved by the compliance head.
• Model and scenario governance is a separate control. Transaction monitoring rules and thresholds should have a documented rationale, be tested against known typologies and historical cases, and be reviewed on a schedule and after significant changes. Threshold tuning is a trade-off: loosening a rule reduces alert volume and may miss suspicious activity, while tightening it increases workload and can bury analysts in low-value alerts. Record the decision and the evidence behind it.
• Sanctions screening carries its own discipline. Lists must be updated promptly when the sanctions authority publishes changes, and screening should cover customers, beneficial owners, counterparties and payment messages where your obligations require it. Confirm the lists and screening scope that apply to your institution in your jurisdiction, since the obligations vary by country and by the nexus of your business.
• Confidentiality is a legal requirement in many jurisdictions. Staff who know a report was filed or is being considered must not disclose that fact to the customer or to anyone without a need to know. Build this into training, system access controls and communication templates.
• Records must be retained for the period your jurisdiction specifies, and they must be retrievable. Confirm the retention rule with the authoritative source and make sure deletion processes respect legal holds. Privacy and data protection laws may also apply to how customer information is collected, shared and stored, so involve privacy counsel in cross-border data transfers.
• This section describes common practice and does not replace the judgment of qualified compliance officers, legal counsel or approved institutional procedures. Regulatory expectations vary and examiners may interpret the same facts differently, so keep your reasoning documented and seek formal guidance when a case is unusual.

06Collaboration and documentation

• Most AML work crosses team boundaries. Frontline staff and relationship managers supply information and often spot the first warning sign. Operations teams hold payment data and can explain processing failures. Technology teams maintain monitoring systems and data feeds. Legal and compliance set policy and interpret obligations. Internal audit tests whether the whole program works as designed. Define who owns each activity so that a gap does not fall between teams.
• Working relationships with the authorities and with correspondent banks also matter. Respond to information requests on time and keep a log of what was provided. When a correspondent asks for due diligence information, supply accurate, consistent answers and make sure the same facts appear in your own records.
• Documentation should answer three questions for any decision: what was known, what was decided, and why. Keep templates for alert closure, enhanced due diligence memos, risk rating rationale, and escalation notes. Avoid free-text fields as the only record of key facts, because they are hard to search and easy to leave incomplete. Version-control policies and procedures, and keep a record of which version was in force on each date a decision was made.
• Training is part of documentation. Maintain records of who was trained, on which version of the procedures, and whether they passed any assessment. Tailor training to roles, so that investigators learn typologies and report writing while front-line staff learn red flags and escalation paths.

07Measures and continuous improvement

• Track indicators that show whether the program is working, not only whether it is busy. Useful measures include the age of the alert backlog, the share of alerts closed with documented rationale, the rate at which escalated alerts result in reports, the proportion of high-risk customers whose periodic reviews are completed on schedule, the time from escalation to report filing, the quality assurance pass rate, and the number of sanctions list updates processed within your internal service level. Set targets with the risk owner rather than copying figures from another institution, since appropriate levels depend on your size, mix of business and risk appetite.
• Interpret the numbers carefully. A falling alert volume may reflect better controls, or it may reflect a monitoring rule that was switched off. A high close rate may reflect efficient analysts or a rushed process. Pair each metric with a qualitative review of sampled cases before drawing a conclusion.
• Use findings from internal audits, quality reviews, regulatory examinations and lessons from actual cases to drive change. Keep a register of issues with owners, due dates and validation steps, and report progress to senior management and the board or its designated committee. Close an issue only when someone independent has confirmed the fix works.
• Review the enterprise risk assessment at least as often as your procedures require and whenever a significant event occurs. Feed new typologies, emerging risks and changes in the sanctions environment into monitoring scenarios and training.

08Common mistakes and how to prevent them

• One frequent mistake is treating the customer risk rating as a fixed label set at onboarding. Ratings should change when behavior, ownership, geography or adverse information changes. Prevent this by linking rating reviews to trigger events and to periodic review cycles, and by recording the reason for every change.
• A second mistake is closing alerts without explaining the reasoning. Analysts often assume the next reader will understand, but examiners and auditors do not. Require a short rationale that names the facts reviewed and the conclusion reached, and sample closures for quality.
• A third mistake is letting data gaps go unaddressed. Missing beneficial ownership details, incomplete counterparty information in payment messages, or stale expected-activity profiles weaken every downstream control. Run regular data completeness checks and treat a failed check as an incident to fix, not a note to file.
• Another common problem is inconsistent application of policy across business lines. One desk may apply enhanced due diligence to a category of customer while another does not. Address this through a single policy owner, a shared risk assessment method, and periodic cross-business testing.
• Finally, organizations sometimes tip off customers by accident. A relationship manager who asks why a wire was held, or a customer service agent who mentions a review, may reveal a report or investigation. Train staff on approved scripts and restrict case information in shared systems.

09Practical checklist

• Confirm the current AML, sanctions and reporting requirements for each jurisdiction where you operate, using the authoritative source and legal counsel.
• Keep the enterprise risk assessment current and approved, and link each residual risk to a named control.
• Verify that customer risk ratings have been reviewed on schedule and after any trigger event, with reasons recorded.
• Confirm that screening lists are updated promptly and that screening scope matches your obligations.
• Check that every alert or screening hit has a documented outcome, rationale and approver where policy requires one.
• Test a sample of closed cases each period, including escalated and reported outcomes, and record the results.
• Confirm that suspicious activity reports and other filings were prepared and submitted within the timeframe your jurisdiction requires.
• Review monitoring rules and thresholds against typologies and the data they receive, and document any change.
• Restrict access to case and report information to staff with a need to know, and confirm that tipping-off controls are working.
• Maintain training records by role, and refresh training after procedure or regulatory changes.
• Log issues from audits, examinations and quality reviews, assign owners and due dates, and validate fixes independently.
• Escalate decisions that exceed your authority to the person named in the approval matrix, and do not proceed on informal approval.

★Learning sources

• Micro Degree: Regulatory Compliance and Anti-Money Laundering
• Micro Degree: Accounts Payable Management
• Micro Degree: Bank Reconciliation Operations
• Micro Degree: FinTech Fundamentals