Explain the Basel committee's recommended approach to evaluating, controlling, reducing and monitoring ML/FT (money laundering and terrorist financing) risks.
The idea
The Basel Committee expects a bank to manage money laundering and terrorist financing (ML/FT) risk like any other major risk. It should identify it, assess it, control it and keep monitoring it, using a risk-based approach. That means a documented, regularly updated assessment of risk across customers, products and services, delivery channels and geographies. Controls proportionate to what the assessment finds then follow. Higher-risk situations get enhanced measures, demonstrably lower-risk ones may get simplified measures, and no situation gets none. The board and senior management own the framework, with three lines of defence. Business units manage the risk day to day. An independent compliance function, led by a senior AML/CFT officer with access to the board, oversees it, and internal audit tests it. Ongoing monitoring and reporting of suspicious transactions to the financial intelligence unit close the loop. The usual mistake is reading risk-based as permission to do less. The exam point is that the assessment drives the controls, and accountability cannot be delegated below senior management.
A practice question
Which statement best describes the risk-based approach to ML/FT risk that the Basel Committee recommends?
- Controls are set in proportion to the ML/FT risk identified, with enhanced measures for higher-risk situations. - correct
- Every customer and product receives identical due diligence so that treatment is consistent.Why not: Confuses consistency of process with uniform intensity; the approach calls for different intensity at different risk levels.
- Customers assessed as low risk are exempt from all further controls and ongoing monitoring once they have been onboarded.Why not: Treats simplified measures as no measures; even low-risk relationships are still monitored.
- The bank avoids every customer category that any authority has labelled high risk.Why not: Describes blanket de-risking, which replaces risk assessment with avoidance and is not the recommended approach.
A risk-based approach means identifying and assessing risk, then calibrating controls to it: enhanced for higher risk, simplified only where risk is demonstrably lower. It is neither uniform treatment, nor exemption, nor blanket exclusion.
A harder one
A bank plans to launch a fully digital account opening service for customers in two new countries, using a product it has never offered. When should it assess the ML/FT risk of this initiative?
- After the first annual internal audit has reviewed the new business.Why not: Defers assessment until after exposure has built up; risks should be understood before the business is taken on.
- Never separately, because existing customer risk ratings already cover the new business.Why not: Ignores that product, channel and geography are risk factors in their own right, not captured by existing customer ratings.
- Only if the host regulator of either of the two new countries requires such an assessment to be carried out.Why not: Treats assessment as a regulatory formality instead of a bank responsibility under its own risk-based framework.
- Before launch, covering the product, the delivery channel and the geographies, with mitigants in place at go-live. - correct
A sound ML/FT assessment considers customers, products and services, delivery channels and geographies, and new business is assessed before launch so that controls are ready on day one.
The hardest tier
A bank's transaction monitoring system produces far more alerts than the compliance team can review, and a growing backlog now exceeds six months. Management proposes to cut the alert rules so the backlog shrinks. What is the most appropriate response under the recommended approach?
- Accept the proposal, since a smaller backlog shows that monitoring is working better.Why not: Treats a falling backlog as success even though the cut reduces detection rather than improving it.
- Leave the system unchanged, because alert volume is a matter for the IT department.Why not: Monitoring effectiveness is a risk management responsibility of senior management, not a technology housekeeping issue.
- Escalate the backlog to the board as a control weakness, then resource it or recalibrate rules on a documented assessment. - correct
- Stop reviewing alerts for low-risk customers and review the high-risk alerts only as capacity allows.Why not: Skips the documented assessment; stopping review of a whole group without evidence leaves unmanaged residual risk.
A persistent backlog means monitoring is not effective and must be escalated to those accountable. Rules may be recalibrated, but only on the basis of a documented risk assessment, not simply to make the numbers look better.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →