AML/CTF risk control techniques are implemented by financial institutions to prevent and detect illicit activities such as money laundering, terrorist financing, and other financial crimes.
Internal control may be defined as the process designed, put in place, and maintained to assure a reasonable level regarding the achievement of an entity’s objectives. These objectives relate to the reliability of the financial reports, the efficiency and effectiveness of operations, and adherence to relevant and applicable laws and regulations.
AML/CTF Risk Control Techniques Implemented in FIs
The following points should be noted from this definition:
- It is the responsibility of management to design and put in place a suitable system of internal controls.
- Internal controls are designed to deal with financial, operational, and compliance risks.
Organizations prepare the risks and control matrix, where risks and related controls are documented. Such a matrix enables the management to review the risks and related controls according to the risk classification, inherent and residual risk assessments, and any apparent weaknesses.
Further, the controls are marked into different control categories according to the nature of the controls, which are as follows:
Preventive Controls
Prevention of risks, errors, and irregularities should be the aim of the organizations. However, some errors and risks occur in practical scenarios despite implementing preventive controls.
AML/CTF preventive controls are designed to prevent ML/TF risk incidents. Examples of preventive controls are the following:
- Adequate segregation of duties, and
- Proper identification and verification of customers
Preventive control aims to prevent the occurrence of an error in a process, and it includes maker checker concepts and authorizations. Such AML/CTF controls ensure that ML/TF risks are prevented before their occurrence.
Directive Controls
Directive controls aim to ensure that identified risks are managed through formal directions provided in various forms to the management and employees of the organization. Directive control requires cross-departmental process understanding, including the embedded regulatory requirements, which are converted into policies and procedures. These policies and procedures also lead to the development of standard operating procedures and formal directions in specific areas.
For example, management prepares the compliance policy to ensure that broader regulatory requirements are complied with. However, management also develops specific operating procedures for the employees, such as procedures or directives to deal with customers before onboarding them. These directions shall refer to the compliance policy and the regulatory requirements for the customer onboarding process.
Similarly, management identifies broader risks and their integration to ensure relevant directives are prepared and approved for compliance.
Detective Controls
Errors in an AML/CTF compliance process must be detected to ensure corrective measures are taken to minimize the impact on the whole compliance culture and process. If the weaknesses or errors in the AML/CTF policies and processes are not detected on time, then the effectiveness of performing risk assessment may not be ensured.
These controls are designed to find errors or irregularities after they have occurred. The examples of detective controls are the following:
- Exception reports computerized reports to identify unexpected results or unusual conditions that require follow-up.
- Periodic audits, both internal and independent external audits, are done to detect errors, irregularities, and non-compliance with AML/CTF laws and regulations.
Corrective Controls
Corrective controls are designed to attend to and address the ML/TF risks and irregularities that occurred. Corrective AML/CTF controls are built in the form of AML/CTF and KYC policies and procedures for the reference of the employees and the AML compliance team. Some controls are built into the AML system, preventing ML/TF risks and generating alerts to perform investigations.
The examples of corrective controls are the following:
- Policies and procedures for reporting ML/TF risks or incidents so they can be attended to and corrected promptly.
- Training employees on new AML/CTF and KYC policies and procedures developed as part of the corrective actions.
Final Thoughts
AML/CTF risk control techniques are critical to the operation of FIs to prevent money laundering and terrorist financing activities. Overall, these techniques help FIs to identify and mitigate the risks of money laundering and terrorist financing activities.
