Safety Norms: Regulatory Compliance and Anti-Money Laundering

1Purpose, Scope, and Safety Principles

These norms exist to prevent harm in regulatory compliance and AML work. Harm includes financial loss to customers, fraud against the organization, exposure of personal data, unintentional facilitation of financial crime, regulatory penalties, and staff being pressured into unsafe decisions. The norms apply to anyone who onboards customers, screens transactions, investigates alerts, files reports, maintains policies, tests controls, or supports examinations, including contractors and outsourced providers.

Three principles guide every rule. First, controls protect the institution and the public, so a shortcut is never acceptable if it weakens a control. Second, decisions must be traceable, meaning the reason, evidence, and approver are recorded. Third, when in doubt, escalate rather than decide alone. Specific legal duties, thresholds, and deadlines are jurisdiction-dependent and must be confirmed against current law and regulator guidance.

• Mandatory: follow the approved AML policy and written procedures for your role.
• Mandatory: do not bypass screening, monitoring, verification, or approval steps.
• Recommendation: review your procedures whenever your role, products, or customer base changes.

2Roles, Competence, and Accountability

Accountability is layered. The board and senior management approve the risk appetite and compliance program. A designated compliance officer or AML officer owns the program day to day, with authority and independence defined by the institution and applicable rules. Business line managers own risk in their products and customer relationships. Operations staff execute controls. Internal audit provides independent assurance. Each person must know which decisions they own and which must be escalated.

Competence and authorization matter because many AML decisions carry legal consequences. Only staff who have completed role-specific training and received written authorization may approve high-risk customers, close alerts, file reports, or change screening lists. Access should be granted by documented role, not by seniority or personal request.

• Mandatory: confirm your authority in writing before approving exceptions or filing reports.
• Mandatory: complete required training before handling live alerts or customer files.
• Mandatory: declare any conflict of interest, such as reviewing the account of a relative or former client, and step aside.
• Recommendation: maintain a current responsibility matrix for each compliance process.

3Realistic Hazards and Risk Assessment

The hazards in this field are mostly financial, legal, and informational rather than physical, but they are serious. Realistic hazards include money laundering through layering and structuring, terrorist financing, sanctions evasion, proliferation financing, fraud using synthetic or stolen identities, account takeover, insider collusion, and bribery. Hazards also arise inside compliance work itself. Alert backlogs cause missed deadlines, alert fatigue leads to rushed closures, and poorly controlled spreadsheets can silently drop or alter records.

Risk should be assessed using a documented methodology that considers customer types, products, delivery channels, geographic exposure, and transaction patterns. Ratings can be expressed as low, medium, high, or unacceptable, with criteria defined in the institution's own risk assessment. Ratings must be reviewed when new products launch, when a customer's activity changes, or when audit or a regulator identifies a weakness.

Realistic examples help. A cash-intensive business that begins depositing many amounts just below a reporting threshold presents a structuring risk. A new account opened by email, with identity documents that do not match the stated business, presents identity and beneficial ownership risk. A relationship manager who pressures an analyst to clear an alert quickly for a valuable client presents an insider and pressure risk. Each case should be documented, scored, and routed to the proper reviewer rather than resolved informally.

• Mandatory: rating criteria must be documented and approved; individual staff must not set ratings by personal preference.
• Mandatory: record the risk rating and the reason for it in the customer file.
• Recommendation: calibrate risk scenarios against recent case outcomes and typology reports from recognized sources.
• Note: specific high-risk factors, such as jurisdictions, politically exposed persons, and business types, must be taken from current law, regulator lists, and institutional policy.

4Preventive Controls and Safe Work Practices

Preventive controls stop problems before money moves or records are corrupted. Core controls include customer identification and verification, enhanced due diligence where risk is elevated, beneficial ownership identification as required by applicable rules, sanctions and watchlist screening at onboarding and on an ongoing basis, transaction monitoring with documented tuning, and periodic customer review. Each control needs a named owner, an input standard, and evidence of completion. Verify requirements, thresholds, and timelines against current law and regulator guidance in your jurisdiction.

Segregation of duties prevents one person from creating, approving, and executing the same high-risk action. Examples include separating customer onboarding from approval of high-risk accounts, separating payment release from beneficiary setup, and separating alert investigation from alert closure quality review. Where full separation is impractical in a small team, compensating controls such as second-person review of samples, dual authorization, and independent reporting must be documented and approved by the compliance function.

Fraud prevention depends on verification habits. Changes to customer contact details, payment instructions, or beneficiary accounts must be confirmed through a channel independent of the request, such as a callback to a number already on file. Staff must never accept bank detail changes from email alone. Dormant accounts that suddenly show significant activity require heightened review before further transactions are processed.

Safe working practices also include handling every alert on its merits, documenting the rationale in plain language, and never clearing an alert because a customer is important. Staff should not use personal devices or messaging applications for case discussions, should lock screens when leaving workstations, and must not run test transactions in production accounts without written approval.

• Mandatory: complete customer due diligence before opening or materially changing a high-risk relationship.
• Mandatory: do not release a payment or change a beneficiary when a verification step is incomplete or has been overridden.
• Mandatory: document the reason for every alert closure and every exception approval.
• Mandatory: keep sanctions screening active; do not disable, whitelist, or suppress a match without documented second-level review.
• Prohibited: sharing login credentials, or approving or releasing work you created.
• Recommendation: sample closed alerts periodically to test quality and consistency across analysts.
• Recommendation: use standard checklists for onboarding files to reduce omissions.

5Information, Data Confidentiality, and Safeguards

AML work relies on sensitive personal and financial data, including identity documents, account histories, ownership records, and investigation notes. Access must follow least privilege, with permissions reviewed periodically and removed promptly when roles change or people leave. Data should be stored only in approved systems. Extracts should be minimized, protected with approved encryption, and deleted according to retention rules confirmed by the records and legal teams.

Tipping off is a serious risk. Staff must not disclose to a customer or any unauthorized person that a suspicious activity report or internal investigation exists, unless legal guidance expressly permits it. Conversations with customers about unusual activity should follow scripts approved by the compliance function. Confidentiality applies to colleagues as well, so cases should be discussed only with people who need the information to perform their duties.

• Mandatory: use only approved case management and document storage tools; never use personal email or personal cloud storage for customer data.
• Mandatory: report lost devices, suspected phishing, or unexpected access to customer records immediately.
• Mandatory: do not copy customer data to removable media unless approved and encrypted.
• Mandatory: follow jurisdiction-specific privacy and data protection rules, verified with qualified advisers.
• Recommendation: use privacy screens in open areas and clear desks of case papers before leaving.

6Incident Reporting, Escalation, and Emergency Response

Escalate promptly. Suspicious activity, potential sanctions matches, suspected insider misconduct, data breaches, and regulatory inquiries each have defined routes. Report to your line manager and the AML officer through the approved channel as soon as the concern arises. Do not wait for certainty. Record facts, dates, and times in the case system, and preserve evidence without altering it.

Near misses must also be reported. Examples include a payment nearly released without the required callback, an alert closed in error and later reopened, or a screening list update that failed silently. Near-miss reporting allows root cause analysis before harm occurs. Blame-focused responses discourage reporting and should be avoided. Where fraud is in progress or someone may be in physical danger, contact local emergency services first, then notify the security or fraud team.

• Mandatory: escalate suspected money laundering or terrorist financing to the designated AML officer without delay.
• Mandatory: do not contact the customer about a report or investigation without approved guidance.
• Mandatory: preserve records and never destroy, backdate, or edit evidence.
• Mandatory: follow regulatory reporting timelines defined by applicable law and internal policy.
• Recommendation: run tabletop exercises for insider fraud and sanctions scenarios at a set interval defined by policy.

7Records, Training, Monitoring, and Review

Accurate records are a core control. Each decision needs an audit trail showing who acted, what evidence was reviewed, which rule applied, and who approved the outcome. Corrections must be made through documented amendments rather than by overwriting history. Retention periods depend on jurisdiction and must be confirmed with the records or legal team.

Training should be role-based and refreshed when laws, typologies, or internal procedures change. Monitoring should track key indicators such as alert backlog age, quality review results, screening timeliness, and training completion. Review the program periodically and after significant incidents, audit findings, or regulatory changes, and track corrective actions until they are closed and tested.

• Mandatory: complete required AML and compliance training before live case work and on the schedule set by policy.
• Mandatory: maintain case files complete enough that a reviewer can follow the reasoning without interviewing the analyst.
• Recommendation: measure alert aging and rework rates to identify pressure points before they cause failures.
• Recommendation: hold lessons-learned reviews after serious events, focusing on system and process causes rather than individuals.

Implementation checklist

• Confirm your written authority and training before approving exceptions or filing reports.
• Verify every payment instruction or beneficiary change through an independent channel.
• Document the rationale for every alert closure and every exception approval.
• Keep sanctions and watchlist screening active and never self-approve a match.
• Separate creation, approval, and release duties for high-risk actions.
• Use only approved systems for customer data; never use personal email or storage.
• Escalate suspicious activity to the AML officer promptly and never tip off customers.
• Report near misses and control failures so root causes can be corrected.
• Confirm current laws and regulator guidance with qualified professionals before relying on them.