OR 10 – Sound Management of Risks related to Money Laundering and Financing of Terrorism

A bank can be pulled into crime without anyone inside it meaning to help. Criminals need a way to make illegal proceeds look clean, and people who fund terrorism need a way to move money quietly, so both groups look for accounts, payment channels and products that will carry their funds without questions. The Basel Committee on Banking Supervision issued guidance on money laundering (ML) and terrorist financing, abbreviated FT, so that banks treat these exposures as part of ordinary risk management rather than as a side compliance chore. The Financial Action Task Force (FATF), the intergovernmental body that sets the global standards in this area, describes money laundering as processing the proceeds of crime so that their illegal source is hidden.

Where the guidelines come from

The Committee has been working on this theme for decades. Its first statement on preventing criminal use of the banking system appeared in 1988, and in September 2012 it restated its position in the revised Core principles for effective banking supervision, where BCP 29 is the principle devoted to abuse of financial services. The Committee also backs the FATF standards. The FATF released its revised international standards, covering proliferation financing too, in February 2012 after receiving input from the Committee, and followed in March 2013 with guidance on financial inclusion (the guidance itself is dated February 2013), which the Committee also took into account.

The relationship between the two bodies matters. The Basel guidelines complement the FATF standards and help countries apply them to banks, drawing on what each organisation knows best. They do not rewrite the FATF standards, and a bank should never read them as tightening or loosening those standards. Cross-references to specific FATF Recommendations appear only where they help a bank meet national rules built on them, not as a routine feature.

The risks a weak programme creates

The Committee’s mandate is to strengthen regulation, supervision and bank practice so that the financial system stays stable, and sound ML/FT risk management serves that mandate in two ways. First, it protects the reputation of individual banks and of national banking systems by keeping criminals and terrorist financiers from using them. Second, it protects the integrity of the international financial system and supports governments in their fight against corruption and terrorist financing.

When a bank manages this risk badly, or not at all, it faces four serious exposures that the guidelines name directly.

These four risks are linked, and any one of them can cost a bank far more than the penalty itself. Wholesale funding lines and facilities can be withdrawn, claims can be brought against the bank, investigations must be paid for, assets can be seized or frozen, and loans to tainted borrowers can go bad. Senior managers also lose time and operational capacity that they would otherwise spend running the business. Recent enforcement cases suggest that effective, risk-based AML/CFT policies would probably have spared the banks involved much of this damage.

Scope of the guidelines

The guidelines apply to all banks. Small or specialised institutions may need to adapt some requirements to their size or business model, although the guidance itself does not spell out those adjustments. The material is organised for three audiences: individual banks, banking groups and banking supervisors. Because many countries split AML/CFT oversight between the banking supervisor and other bodies, such as financial intelligence units (FIUs), the word “supervisor” can cover those other authorities too. A July 2020 revision added detailed guidance on cooperation and information exchange between the “prudential supervisor”, which handles prudential banking supervision, and the “AML/CFT supervisor”, in both domestic and cross-border settings (paragraph 96 and Annex 5), and it stressed cooperation with third parties such as law enforcement agencies and FIUs. FATF requirements aimed at non-bank sectors, or at the powers of competent authorities, are outside the document.

The guidelines are not meant to be read in isolation. Money laundering controls depend on the same board oversight, compliance function, internal audit and operational risk discipline that the Committee describes in its broader governance papers, so the guidance points readers to a set of companion documents.

Two older papers merged into one

To tidy up its AML/CFT material, the Committee folded two earlier publications into this guidance and replaced them: its October 2001 paper on customer due diligence for banks and its October 2004 paper on KYC risk management at consolidated level. It also gave more weight to two areas that had grown in importance. One is the use of third parties to introduce business to a bank (Annex 1). The other is correspondent banking, where one bank provides services to another bank (Annex 2).

Some topics that the older papers covered are deliberately not developed here, even though they remain important: politically exposed persons (PEPs), private banking and particular legal structures. The FATF already publishes guidance on these, including its guidance on PEPs under Recommendations 12 and 22, so the Committee leaves them to that work.

Later revisions

The document has been amended several times since it first appeared. In February 2016 a general guide to account opening was added as Annex 4. In June 2017 both Annex 2 and Annex 4 were revised to help banks apply the risk-based approach to correspondent banking. That revision accepts that correspondent relationships do not all carry the same risk and gives an updated list of risk indicators for the correspondent bank’s assessment. In July 2020 the cooperation framework between prudential and AML/CFT supervisors was added, as described in the previous section.

Consolidated supervision and scope

The guidance should also be read with the Committee’s standards on supervising banking groups on a consolidated basis, such as BCP 12. This link is especially relevant for ML/FT because the same customer often holds several relationships or accounts across one banking group, booked in offices located in different countries.

BCP 29 expects every bank to maintain adequate policies and processes, strict customer due diligence (CDD) rules among them, that promote high ethical and professional standards and stop the bank being used for crime, whether knowingly or not. The Committee reads this as one part of a bank’s general duty to run sound risk management for all kinds of risk. Adequate policies need more than CDD on its own, and every measure should be proportionate to risk and informed by the bank’s own assessment of its ML/FT exposure. Where no specific AML/CFT guidance exists, the Committee’s general governance papers fill the gap.

Identify, then design controls to fit

The starting point is a comprehensive risk assessment. The bank identifies and analyses the ML/FT risks present in its business and then designs and runs policies and procedures that match what it found. A thorough assessment looks at both inherent and residual risk factors at several levels, and where appropriate it also reflects AML/CFT assessments made at a supranational level.

Inherent risk is the exposure that exists before any control is applied. It comes from the bank’s customer base, its products, its delivery channels, its services (including products still under development or about to be launched) and the jurisdictions in which the bank or its customers do business. The bank’s view of that inherent risk should rest on evidence: its own operating and transaction records and other internal data, supported by outside material such as national risk assessments and reports on countries published by international organisations.

Acceptance rules, due diligence and continuing monitoring are then designed to control the inherent risks that were identified. Whatever exposure is left after those controls is residual risk, and the bank should manage it in line with the risk profile that came out of its assessment. The outcome of the assessment, the bank’s resulting risk profile and the level of mitigation it chooses then shape every downstream policy, from acceptance and identification of customers to the monitoring of relationships and products.

Show the work to the supervisor

An assessment that lives only in the heads of managers is not enough. The bank needs mechanisms to document its risk assessment and to pass the information to competent authorities such as supervisors, and it must be able to demonstrate its understanding of risk in a form the supervisor finds acceptable.

Managing ML/FT risk well needs the same governance arrangements the Committee asks for in every other risk area. The board of directors approves and oversees the bank’s policies on risk, risk management and compliance, and that duty applies fully to ML/FT risk. The board therefore needs a clear understanding of these risks. Findings from the ML/FT risk assessment should reach directors promptly and in full, in a form they can understand and rely on, so that they can make informed decisions rather than approve policies they cannot judge.

The board should also allocate explicit responsibility for making sure the bank’s AML/CFT policies and procedures are managed effectively, taking the bank’s governance structure into account. Together with senior management, the board should appoint a suitably qualified chief AML/CFT officer who carries overall responsibility for the AML/CFT function. This person needs enough stature and authority inside the bank that the board, senior management and business lines pay proper attention to the issues the officer raises.

Independence from business pressure

A bank’s commercial interests should never work against the chief AML/CFT officer’s ability to do the job. Whatever the bank’s size or structure, potential conflicts of interest should be avoided, so that the officer can make unbiased judgments and give impartial advice. The guidelines give examples of roles that should not be combined with this one:

When the role is combined with that of chief risk officer or chief compliance officer, or an equivalent, the officer should still report directly to the board or to senior management. Where the roles are held by different people, the relationship between these chief officers and their respective duties must be clearly defined and understood. If a conflict ever arises between a business line and the AML/CFT officer, the bank should have procedures that bring the AML/CFT concern to the highest level for objective consideration.

What the officer does

The chief AML/CFT officer is responsible for ongoing monitoring of whether the bank fulfils all its AML/CFT duties. In practice that means testing samples for compliance and reviewing exception reports, and it means alerting senior management, or the board, if the officer believes management is not dealing with AML/CFT procedures responsibly. The officer is also the single point of contact on AML/CFT matters for internal and external authorities, including supervisors and FIUs, and is responsible for reporting suspicious transactions.

To play this central and proactive role, the officer needs sufficient resources and must know the bank’s AML/CFT regime thoroughly: its statutory and regulatory requirements and the ML/FT risks that the business generates.

Front office staff who open accounts and process customer instructions are the people most likely to notice something odd, which is why the business units form the first line of defence. They identify, assess and control the ML/FT risks of their own business, they must know and apply the bank’s policies and procedures, and they should be given enough resources to do so properly. The second line of defence is led by the chief AML/CFT officer and includes the compliance function, along with support functions such as human resources and technology. The third line of defence is internal audit.

First line: written rules, staff screening and training

The first line works from policies and procedures that are written down clearly and communicated to every member of staff. They should tell employees what their obligations are, give instructions, and explain how to keep the bank’s activity compliant with regulation. There should also be internal procedures for spotting and reporting suspicious transactions.

People matter as much as paper. The bank should screen both prospective and existing staff to keep ethical and professional standards high, and every bank should run continuing training so that staff can actually apply its AML/CFT policies. The timing and content of training should fit each group of employees, because needs differ with job function, responsibilities and length of service. New joiners should be trained as soon as practical after they are hired, and refresher sessions should remind staff of their duties and keep their knowledge current. How often and how deeply someone is trained should depend on the risk attached to that person’s role and on the overall risk the bank carries.

Second line: monitoring and escalation

The second line oversees the first. The chief AML/CFT officer monitors whether all AML/CFT duties are being met, through sample testing and the review of exception reports, and escalates to senior management or the board when management is falling short.

Third line: internal and external audit

Internal audit independently evaluates risk management and controls and reports to the board’s audit committee, or an equivalent oversight body, through periodic evaluations of how well the bank complies with its AML/CFT policies. A bank should have policies for auditing four things.

Senior management should staff audit with knowledgeable people, make sure audit scope and methodology fit the bank’s risk profile, and set audit frequency by risk. Auditors should periodically run bank-wide AML/CFT audits and follow up on their own findings and recommendations. Audit processes should follow internal audit’s broader mandate, subject to any specific auditing requirements for AML/CFT.

In many countries external auditors also review internal controls during the financial audit and confirm compliance with AML/CFT rules. When a bank hires external auditors specifically to assess its AML/CFT policies, it should check that the scope fits its risks, that the team has the right expertise and experience, and that the bank itself oversees the engagement properly.

A bank’s monitoring system should be adequate for its size, its activities, its complexity and the risks it carries. For most banks, and certainly for internationally active ones, that means an automated system, because no team of people can watch millions of transactions with the consistency a computer brings. A bank that judges an IT monitoring system unnecessary must record that judgment and be ready to prove to its supervisor or external auditors that an effective alternative is working.

Coverage and analytics

An automated system should cover all customer accounts and all transactions made by or for those customers. It should support trend analysis of activity so that unusual relationships and transactions can be identified and ML or FT prevented. The system should also give senior management accurate information on key matters, including changes in customers’ transactional profiles. To build those profiles the bank feeds in the current, comprehensive and accurate CDD information the customer has provided.

A good system lets the bank, and where appropriate the whole group, see information in a centralised way: organised by customer, by product, across group entities, or by the transactions made over a chosen period. The bank is not required to hold a single unique file per customer, but it must be able to rate each customer’s risk and work through alerts using every piece of relevant information it holds.

Parameters must fit the bank

The detection logic is only as good as its settings. Parameters should reflect national and international experience of how ML and FT are carried out and prevented. A bank may start from the standard parameters supplied by the software developer, but the settings it actually runs must reflect its own risk situation. The system should let the bank set its own criteria for extra monitoring, for filing a suspicious transaction report (STR) or for other risk-reducing steps, and any risk criteria should be consistent with the bank’s risk assessment.

Alerts of unusual transactions are generated by the system’s parameters and then assessed further by the chief AML/CFT officer. The officer should have access to the system, and benefit from it, wherever it is relevant to the AML/CFT function, even when another business line operates it. Finally, internal audit should evaluate the system itself to check that it is appropriate and that the first and second lines use it effectively.

Before anyone becomes a customer, the bank needs a clear customer acceptance policy that, in line with its risk assessment, identifies which types of customer are likely to pose a higher ML/FT risk. Judging a particular customer’s overall risk calls for several factors to be weighed together:

Due diligence that scales with risk

Every customer receives basic due diligence, and the depth increases as the risk rises. Where lower risk has been proven, simplified measures may be used, but only if the law allows them. The guidelines give the example of an individual who expects to keep a small balance and use the account for routine retail transactions; basic account-opening procedures may be enough there. At the other end, higher risk calls for enhanced due diligence (EDD). Examples include an individual who plans to hold a large balance and send regular cross-border wire transfers, and any customer who is a politically exposed person. For foreign PEPs, EDD is required. A typical enhanced measure is that senior management, rather than a branch officer, approves entering into or continuing a higher-risk relationship.

Not so strict that people are shut out

A risk-based policy cuts both ways. The acceptance policy should not be so restrictive that the general public, and especially people who are financially or socially disadvantaged, end up denied access to banking. The FATF financial inclusion guidance helps banks design AML/CFT procedures that do not exclude such people.

The policy should also state in advance the circumstances in which the bank will refuse a new relationship or end an existing one, so that front office staff are not left to improvise under pressure from an important prospect.

Following FATF Recommendation 10, a customer is any person, natural or legal, or any legal arrangement, that enters into a business relationship with the bank or carries out an occasional financial transaction with it. Due diligence reaches beyond the customer to two other groups: persons acting on the customer’s behalf, and beneficial owners. The FATF defines a beneficial owner as the natural person or persons who ultimately own or control a customer, or on whose behalf a transaction is carried out, including anyone exercising ultimate effective control over a legal person or arrangement. Banks must identify their customers and verify that identity, unless a country has found through a risk assessment that certain activities carry a proven low risk and may be exempted on a limited basis, as the interpretive note to Recommendation 1 allows.

Identify first, then transact

Banks should have a systematic procedure for identifying and verifying customers, anyone acting for them and any beneficial owners. As a general rule, the bank should not open a relationship or carry out a transaction until the customer’s identity has been satisfactorily established and verified. In line with BCP 29 and the FATF standards, the procedures should include reasonable measures to verify who the beneficial owner is. If someone claims to act for a customer, the bank should confirm that the person is authorised and verify that person’s identity as well.

What counts as good evidence

Verification should rely on reliable, independent source documents, data or information. The strongest documents are the ones a criminal would find hardest to forge or to acquire illegally. When the bank relies on non-documentary sources, such as references from other financial institutions or financial statements, it must make sure that the methods and sources are appropriate and consistent with its policies and the customer’s risk profile. A bank may ask customers to sign a written declaration of the beneficial owner’s identity, but that declaration alone is never sufficient. As with every element of CDD, the depth of verification should match the customer’s risk.

The bank should collect whatever information it needs to be fully satisfied about the identity of the customer, anyone acting for the customer and the beneficial owners. National legislation usually prescribes what is required for natural persons. Beyond that floor, the nature and extent of information depends on risk, on whether the applicant is a person or a company, and on how large the account is likely to be and how it will be used. Higher-risk customers need enhanced verification, and complex relationships or large accounts may justify extra identification measures.

Non-face-to-face customers and distant jurisdictions

A customer who cannot attend an interview does not get a lighter process. The bank must not drop its identification and verification procedures for a non-face-to-face customer, and it should ask why the customer chose to open an account far from its own location, particularly in another jurisdiction. Customers from jurisdictions known to have strategic AML/CFT deficiencies also need attention, with enhanced due diligence wherever national authorities, the FATF or other international bodies require it.

What to keep on file

The bank should keep the customer’s identification papers and everything gathered through CDD. That includes copies or records of official documents such as passports, identity cards and driving licences, account files such as transaction records, and business correspondence, together with the results of any analysis, for example the risk assessment and inquiries into the background and purpose of the relationship.

Anonymous and numbered accounts

No account should be opened, and no business continued, for a customer who insists on anonymity or uses an obviously fictitious name. A numbered account, where the customer’s and beneficial owner’s names are known to the bank but replaced by a number or code name in later paperwork, may offer the holder more confidentiality, but it must not become an anonymous account in disguise. It goes through exactly the same CDD as any other account, even if only selected staff handle it. The holder’s identity must be verified and known to enough staff for effective due diligence, especially when other factors point to higher risk, and the internal control, compliance and audit functions, the chief AML/CFT officer and the supervisors must all be able to see the information when needed.

The default rule is simple: unfinished CDD means no account, no new relationship and no transaction.

Verification after onboarding

In some cases verification may be finished after the relationship begins, because interrupting the normal conduct of business would be harmful. When a bank uses this exception, it must have proper risk management procedures that set the conditions and restrictions on how the customer may use the relationship before verification is complete. If verification problems then surface and prove impossible to fix, the bank should close the account or otherwise shut off access to it. Whenever there are problems with completing CDD, the bank should consider filing an STR, subject to national rules on handling suspicious transactions.

When CDD itself raises suspicion

A harder case arises when the checks leave the bank suspicious, or with reasonable grounds for suspicion, that the prospect’s assets or funds come from predicate offences and crimes linked to ML/FT. The bank should not voluntarily open accounts for such customers. It should report the matter to the relevant authorities through an STR, and it must keep the customer from learning, even indirectly, about any past, current or planned report.

Transfers from another bank and refused applicants

A new customer may move funds in from an account held in their own name at another bank that applies the same CDD standard. That may provide some comfort, but the receiving bank should still carry out its own due diligence, and it should bear in mind that the previous bank might have asked the customer to leave because of concerns about illicit activity. Customers are free to move their business. If, however, the bank has reason to believe an applicant was turned away by another bank over concerns about illicit activity, it should consider treating the applicant as higher-risk and applying enhanced due diligence, filing an STR, declining the customer, or a combination, in line with its own risk assessment and procedures.

Designated persons at the front door

Front office staff need the procedures and the practical means to recognise designated entities or individuals, such as terrorists and terrorist organisations, as defined by national law and by the applicable United Nations Security Council Resolutions (UNSCRs). This check happens at onboarding and continues throughout the relationship, as the section on asset freezing explains.

Identification and verification happen at the start of a relationship or before an occasional transaction, but the information gathered then has a longer life. The bank should use it to understand the customer’s profile and behaviour. Typical data points include the purpose of the relationship or transaction, the customer’s level of assets or the size of their transactions, and how regular or long-lasting the relationship is expected to be.

Customer risk profiles

A bank should therefore have policies to carry out enough due diligence to build customer risk profiles, either for individual customers or for categories of customers. How much information is collected depends on the risk of the customer’s business model and activities and on the products or services requested. A profile captures what the bank expects the relationship to be for, the expected level of activity, the type of transactions and, where needed, the sources of the customer’s funds, income or wealth.

Profiles do two jobs. They set a baseline of “normal” behaviour for that customer or category, so that activity which departs from it can be recognised as unusual or even suspicious. They also help the bank decide whether the customer or category is higher-risk and needs enhanced CDD measures and controls. Any significant new information about the customer’s activity should flow back into the bank’s risk assessment of that customer.

Ongoing monitoring

Ongoing monitoring is essential because a bank can only manage ML/FT risk if it understands what normal and reasonable activity looks like for its customers. Without that knowledge it cannot spot attempted or unusual transactions that fall outside the regular pattern, and it will probably fail in its obligation to identify suspicious transactions and report them to the authorities. Monitoring covers all relationships and transactions, but its intensity follows the risk identified in the bank’s risk assessment and CDD, with enhanced monitoring for higher-risk customers and transactions. Beyond customers and their transactions, the bank should also run cross-sectional monitoring of products and services to catch emerging risk patterns.

Every bank needs systems to detect unusual or suspicious transactions and patterns. When it designs detection scenarios, it should draw on customer risk profiles, CDD information and intelligence from law enforcement and other authorities. If the authorities have reported a laundering scheme operating in the bank’s jurisdiction, the bank should assess whether that scheme could be running through a category of its customers, a group of accounts, a transaction pattern or a product, and then build tools to catch it, such as alert scenarios in its computerised system or limits on a particular class of activity. Using CDD information, the bank should be able to pick out transactions that make no economic sense, that involve large cash deposits or that do not fit the customer’s normal and expected behaviour.

Enhanced monitoring and information systems

For customers rated higher-risk, the bank should have enhanced due diligence policies that go beyond account-opening approvals and set the extent of CDD required, the frequency of ongoing monitoring and how often CDD information and records are updated. Effective monitoring needs up-to-date, comprehensive and accurate profiles and records. Integrated management information systems, sized to the bank’s scale, structure and complexity, should give relationship managers and risk and compliance officers, including investigators, timely information across business lines: transaction history, missing account-opening documents, significant changes in behaviour or business profile, and unusual transactions.

Screening is a recurring duty. The bank should screen its customer databases whenever sanction lists change, and also at regular intervals to pick out foreign PEPs and other higher-risk accounts, which then move to enhanced due diligence.

Due diligence that is not written down cannot be proved, used or audited. A bank should record all the information it obtains during CDD in two forms: it keeps the documents provided to verify the identity of the customer or beneficial owner, and it transcribes the relevant CDD details, from those documents or from other sources, into its own IT systems.

Rules on what to keep and for how long

The bank should set clear rules on the records it must keep to document due diligence on customers and on individual transactions, taking into account any prescribed privacy measures where possible. The rules should define which types of information and documents go into the records, and they should fix a retention period of at least five years counted from the day the banking relationship ends or the occasional transaction takes place. If an investigation or litigation is still open, the records must be kept until the case is closed, even if the accounts have already been closed.

Complete, current records serve several users. The bank needs them to monitor the relationship and understand the customer’s ongoing business. They also provide an audit trail if there is a dispute, legal action, or an inquiry or investigation that could lead to regulatory action or criminal prosecution. Records of the evaluation process behind ongoing monitoring and reviews, and of the conclusions reached, should also be kept, because they demonstrate that the bank complies with CDD requirements and can manage ML and FT risk.

Keeping information current

Old records lose value quickly. Only if banks keep records accurate, current and relevant, through regular reviews and updates of CDD information, can competent authorities, law enforcement agencies and FIUs use that information to do their own AML/CFT work. Current information also improves the bank’s own ability to monitor accounts for unusual or suspicious activity.

Supplying information to supervisors

On request, a bank should be able to show its supervisors that it is doing all of the following adequately: assessing, managing and mitigating ML/FT risks; applying its customer acceptance policy; identifying and verifying customers; monitoring accounts and reporting suspicious transactions; and carrying out every other AML/CFT measure it has adopted.

Monitoring and review of accounts lets a bank spot suspicious activity, clear false positives and report genuine cases promptly. How the bank spots, investigates and reports suspicious transactions to the financial intelligence unit should be written into the bank’s policies and taught to all personnel through regular training. Employees need a clear description of their obligations, instructions for analysing and investigating such activity inside the bank, and guidance on completing the reports.

Deciding and reporting

The bank also needs procedures for deciding whether the law, under the reporting regime that applies to it, obliges it to report a transaction to the police or another law enforcement agency, to the FIU or, where relevant, to supervisors. These procedures should protect confidentiality, ensure that investigations move quickly, and make sure that reports contain relevant information and are filed on time. Where funds or other property suspected to be criminal proceeds are still sitting in an account, the chief AML/CFT officer should ensure prompt disclosure.

Reporting does not end the bank’s job. Once suspicion has arisen about an account or relationship, the bank should act to reduce the risk of being used for crime. That may mean reclassifying the customer or the account, or reconsidering the whole relationship, and may require escalation to an appropriate decision-maker who weighs other factors such as cooperation with law enforcement or the FIU.

How terrorist financing differs from money laundering

Terrorist financing resembles money laundering in many ways, but it has features of its own that banks must allow for.

Because terrorist money can be clean in origin and small in size, the usual red flags of laundering can miss it. CDD still helps, by giving the bank a better picture of its customers and their transactions, and acceptance policies should give proper weight to the specific risks of dealing with people or entities linked to terrorist groups.

Screening and freezing

Before opening a relationship or carrying out an occasional transaction with a new customer, the bank should check the customer against the terrorist lists published by competent authorities at national and international level, and ongoing monitoring should confirm that existing customers have not since been added to those lists. Every bank needs systems to detect prohibited transactions, such as dealings with entities designated under the relevant UNSCRs or national sanctions.

The key point is that terrorist screening is not risk-sensitive. It applies to every customer, whatever risk rating the bank has assigned. Automatic screening systems are allowed, but the bank must make sure they are fit for purpose. The bank must also be able to recognise and carry out freezing orders issued by the competent authority, must not otherwise deal with designated parties, and should freeze whatever money or assets designated persons and entities hold with it, without delay and without prior notice, under applicable laws and regulations.

When a bank operates in several countries, its ML/FT risk management must also respect the legal requirements of each host country. The guidelines expect every group to develop AML/CFT policies and procedures that apply group-wide, consistently, and under group supervision. Branch and subsidiary procedures can reflect local business conditions and host rules, but they must still be consistent with, and support, the group’s broader policies. The term “group” here covers one or more banks together with their branches and subsidiaries, and “head office” includes the parent bank or the unit that manages AML/CFT risk on a business line basis.

Consolidated risk management

Consolidated risk management means setting up and running a process that coordinates and applies policies and procedures across the whole group, so that the bank has one consistent and comprehensive baseline for managing risk in all its international operations. The aim is broader than legal compliance in each country: the policies should identify, monitor and mitigate risks across the group. Local adaptations required by local law must not weaken the group’s access to the information its global AML/CFT policies depend on, so robust information-sharing between the head office and all branches and subsidiaries is essential.

Which standard wins

Two rules decide conflicts between home and host requirements. Where local law in the host country is tougher than group policy, the group should allow its branch or subsidiary there to follow the tougher local rules. More generally, when home and host minimum legal or regulatory requirements are not the same, an office in the host country should apply the higher standard of the two.

A harder case arises when the host country does not allow the FATF standards to be implemented properly. Following the FATF interpretive note to Recommendation 18, the chief AML/CFT officer should then inform the home supervisors, and the group should consider further measures, including, where appropriate, closing its operations in that host country.

Why group-wide AML/CFT is hard

The Committee accepts that group-wide AML/CFT is more difficult than many other group risk processes, because some jurisdictions still restrict banks from sending customer names and balances across borders. For effective group-wide monitoring and ML/FT risk management, banks must be authorised to share customer information with their head office or parent bank, subject to adequate legal protection, and this applies to branches and subsidiaries alike.

A banking group should understand all the risks attached to its customers across the group, individually or by category, and should document and update that understanding regularly in proportion to the group’s risk. In assessing customer risk it identifies the relevant factors, such as where the customer is located, how it transacts (as declared or self-stated by the customer) and which products and services it uses, and sets criteria for recognising higher-risk customers. Those criteria apply across the bank, its branches, its subsidiaries and its outsourced activities, so that higher-risk customers are identified the same way everywhere in the group.

Customer risk assessments should either be run on a group basis or line up with the group’s overall assessment. Group policy should nonetheless recognise that customers in the same category can carry different risks in different jurisdictions. The information gathered then tells the group how much risk it carries overall and of what kind, and it guides the design of group controls. Mitigants can include asking the customer for more information, monitoring more closely, refreshing personal data more often and sending staff to visit the customer.

Checking that the group policy works

Compliance and internal audit staff, above all the chief AML/CFT officer, or else external auditors, should test adherence to every aspect of the group’s policies, including how well centralised CDD works and whether group members share information and answer head office queries. Internationally active groups need a robust internal audit function and compliance that operates globally, because these are the main ways of monitoring global CDD and information-sharing.

Relying on introducers

A bank must understand how far AML/CFT law lets it rely on procedures performed by another bank, for instance one in the same group, when business is referred to it. The rules are summarised below.

Even with a trusted group introducer, the receiving bank must actually hold the customer information, because it may have to report it to FIUs if a transaction involving the referred customer turns out to be suspicious. Annex 1 develops these points further.

Consistent procedures, local monitoring

The group’s head office should be able to access relevant information to enforce group AML/CFT policies, and each office should be able to comply with the minimum AML/CFT and accessibility policies set by head office in line with the Committee’s guidelines. Customer acceptance, CDD and record-keeping should be applied consistently throughout the organisation, adjusted for risk differences between business lines or regions. Different approaches to collecting and retaining information may be needed to meet local rules, but they must stay consistent with group standards.

Each office, wherever it is, should monitor in a way that fits the risks of its jurisdiction and the bank, and should share information with head office, and where appropriate with other branches and subsidiaries, about accounts and activity that may signal heightened risk. To manage those risks, the bank should integrate this information by customer, by beneficial owner and by the funds involved, monitoring significant relationships, balances and activity on a consolidated basis, whether the accounts are on-balance sheet, off-balance sheet, assets under management or held on a fiduciary basis, and wherever they are held. Although written for banks, these ideas may also interest conglomerates that include banks.

Large banks often centralise processing systems and databases for effectiveness or efficiency. When they do, they should document and integrate the local and central transaction and account monitoring so that suspicious patterns can be seen across the whole group, not just at the local or the central level.

A bank that does business both nationally and abroad should appoint a chief AML/CFT officer for the whole group, the group AML/CFT officer. As part of global risk management, this officer creates and coordinates a single group AML/CFT strategy, including binding group policies and the authority to give orders to every branch, subsidiary and subordinated entity at home and abroad, and assesses how that strategy is implemented across the group.

The role includes ongoing monitoring that all AML/CFT requirements are met group-wide. The group AML/CFT officer should be satisfied, including through regular on-site visits, that the group complies, and should have the power to issue orders or act on behalf of the whole group when needed.

Group-wide information-sharing

Banks should coordinate how information is shared. Subsidiaries and branches should proactively send head office information on higher-risk customers and activities relevant to global AML/CFT standards, and answer head office or parent bank requests for account information promptly. Group standards should describe the process every location follows for identifying, monitoring and investigating potentially unusual circumstances and for reporting suspicious activity.

These policies must respect local data protection and privacy laws. They should also cover the different types of information that can be shared within the group and set requirements for storing, retrieving, sharing or distributing, and disposing of it.

The group’s overall ML/FT risk management function should evaluate the risks posed by activity that branches and subsidiaries report and, where appropriate, assess the group-wide risk of a given customer or category. It needs procedures to discover whether the same customer, or a related or affiliated party, also banks with other parts of the group, and policies for global relationships judged higher-risk or linked to possible suspicious activity, with escalation procedures and guidance on restricting activity, up to closing accounts.

Under their domestic laws, the bank and its branches and subsidiaries should answer when law enforcement, supervisors or FIUs ask for customer information needed to fight ML and FT. Head office should be able to order every branch and subsidiary to check its files against named lists or requests covering people or organisations suspected of helping ML and FT, and to report any hits. On request, the bank should be able to walk its supervisors through how it manages customer risk globally, how it assesses and manages ML/FT risk, its consolidated AML/CFT policies and the way information flows around the group.

Mixed financial groups

Many banking groups also run securities and insurance businesses. Applying ML/FT controls in these mixed financial groups raises issues that deposit-taking and lending do not. Mixed groups should be able to monitor and share information on customer identity, transactions and account activity across the whole group, and should watch for customers who use their services in several sectors.

Because activities and customer relationships differ by sector, AML/CFT requirements may legitimately vary between sectors. The group should keep these differences in mind when cross-selling products and services from different business arms, and should apply the AML/CFT requirements appropriate to each sector.