Account for how ML/FT risks should be managed across a banking group and across borders.
The idea
A banking group must manage ML/FT risk on a consolidated basis. The parent should set group-wide AML/CFT policies and procedures and implement them in every branch and subsidiary. It should also have a group-level function that sees the whole risk picture, including customers that appear in several entities. Entities should share the customer, account and transaction information needed for risk management, with safeguards. Where host-country rules are less strict than the group standard, the foreign entity applies the group standard as far as host law allows. Where host rules are stricter, it follows the host rules. If host law prevents proper implementation, the group must apply additional measures to manage the risk and inform its home supervisor. The common error is thinking that a locally compliant subsidiary has satisfied the group. The exam point is that the strictest workable standard, applied consistently, governs.
A practice question
How should a banking group apply its AML/CFT policies across its branches and subsidiaries?
- Each subsidiary should write its own policies with no reference to the parent bank or to the other group entities.Why not: Fragments the group's controls and leaves no consolidated view of ML/FT risk.
- It should implement group-wide policies and procedures that apply consistently to all branches and subsidiaries. - correct
- The policies should apply to the parent's head office only.Why not: Excludes the branches and subsidiaries where much of the risk arises.
- They should apply to foreign branches only, because domestic entities follow national law.Why not: Leaves domestic group entities outside the group framework; group policies apply across the whole group.
Consolidated risk management requires group-wide policies, applied consistently to all branches and subsidiaries, domestic and foreign.
A harder one
Which description best fits consolidated ML/FT risk management in a multinational bank group?
- Each entity reports ML/FT risk only to its local board and no group-level view is built.Why not: Prevents the group from seeing customers with accounts in several entities and aggregate exposure.
- A group-level function with information from all entities, able to assess risk across the group. - correct
- The group's ML/FT risk is aggregated only through the annual consolidated financial statements.Why not: Financial statements do not carry the customer-level information needed to manage ML/FT risk.
- A group-wide function is needed only if every entity of the group is located in one and the same country.Why not: Misses that cross-border structures are exactly where a group-level view is most needed.
A consolidated approach needs a group-wide function and information flow so that risks arising in one entity, or from customers spread across entities, are visible and managed at group level.
The hardest tier
Data protection law in a host country prevents a subsidiary from sharing certain customer information with its parent, which the group policy would otherwise require. What should the group do?
- Comply with the host law and say nothing, since it is lawful locally.Why not: Fails to tell the home supervisor and leaves the group's risk unmanaged.
- Require the information to be shared anyway, since group policy overrides local law.Why not: Would breach host law; group policy cannot override local legal prohibitions.
- Apply appropriate additional measures to manage the ML/FT risk, and inform the home supervisor of the problem. - correct
- Withdraw immediately from every country that has similar data protection rules.Why not: Overreaction; additional controls and supervisory notification come first, and exit is a last resort.
When host law blocks proper implementation of group policy, the bank should apply additional measures to manage the risks and inform the home supervisor. Exit is considered only if risks cannot be managed.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →