The third and last step to building an effective AML/CTF compliance program is implementing organizational measures.  And hereby, we make use of the results of step 2. 

We use the money laundering risk assessment results to identify gaps or opportunities for building and improving organizational measures.

Step 3: Organizational Measures

In practice, it is very much an iterative process.  Suppose your organization is starting out building an initial AML/CTF compliance program or has had one in place for many years. In that case, four basic pillars should be considered.  These are internal policies, procedures, and controls; a designated compliance function; an independent audit function; and ongoing employee training program;

We will explore each of these pillars in a little bit more detail so that you have the basic knowledge to design an effective AML/CTF compliance program.

Pillar 1: Policies, Procedures, And Controls

Let’s start with internal policies, procedures, and controls.  The establishment and development of an organization’s policies, procedures, and controls are the foundation to a successful AML/CTF compliance program.  Together, these three parts define and support the entire AML/CTF compliance program, and at the same time, act as a blueprint that outlines how an organization is fulfilling its regulatory requirements.

All three parts should be designed to mitigate the identified AML risks and consider the applicable AML laws and regulations that the organization must comply with.

Policies

First of all, an overall AML policy should be formalized in a written document and validated by its leadership.  The policy should contain a chapter dedicated to money laundering risk management.  This chapter should outline three points: The maximum money laundering risk tolerance, the guidelines to be followed when defining the money laundering risk management procedures, and the internal countermeasures and controls.

Procedures

Secondly, the internal procedures should be in line with the AML policy.  It is recommendable that the procedures cover all the essential money laundering procedures.  The top 5 areas that you will see covered in the organizations’ procedures are

1. How to conduct the Money laundering risk assessment
2. Customer and transaction due diligence measures
3. Analysis of atypical customer behavior and reporting requirements
4. Embargoes, sanctions, and trade
5. Internal whistleblowing

Controls

Lastly, organizations should implement an internal control system to monitor compliance with AML procedures.  This internal control system should be proportionate to the nature and extent of the organization’s activities.  This system, which may take multiple forms, should also be adapted to the risk classification established by the organization.  The internal control system should cover all activities that could potentially expose the organization to money laundering risks and apply to the entire AML system.  It should contain at least the following three elements:

• Checks relating to the activities of the operational services and departments
• Checks relating to the activities of the compliance or AML function
• And Checks relating to third-party business introducers or subcontractors

Pillar 2: Compliance AML Function

This brings us the right to the second pillar of an effective AML/CTF compliance program, which is the compliance or AML function.

AML/CTF compliance programs should appoint a designated principal compliance function, including a mainly responsible compliance officer.  This compliance officer must be responsible for overseeing the general implementation of AML policy within their organization.

AML Compliance Officers should have sufficient experience and authority within their organization to perform their duties effectively.  Those duties include communicating with authorities and auditors, briefing senior management, and making AML policy recommendations based on audits and reports.  AML compliance officers should be experts in their local environment’s legislative requirements.

Pillar 3: Independent Audit

The third pillar of an effective AML/CTF compliance program is somewhat related to this: An independent audit function.  An effective AML/CTF compliance program should build in a schedule of independent testing and auditing.  Independent testing should be mandated to occur every 12-18 months, although organizations working in particularly high-risk areas might consider a more frequent schedule than that.  The audit function can either be internally or externally. Still, whatever is chosen to test AML compliance, it must be qualified to conduct a risk-based audit appropriate to the organization.

Excursus: The 3 Lines of Defense

Before we move on to the last pillar, this is a good time to explore the three lines of defense.  The three lines of defense are a concept used in the wider field of corporate governance, compliance, and risk management.  So for an organization to design an efficient risk management system, the processes used to control the company risks should be interconnected in a holistic system.  These three lines of defense model does exactly that; it integrates the main roles and responsibilities of the internal control system of the company in a consistent system.  Because money laundering is a risk, the three lines of defense concept are also commonly applied here.

The 1^st Line of Defense

In the first line of defense, the operative management is confronted with risks in daily business operations which have to be controlled.  This line is responsible for identifying and assessing these risks as early as possible and setting up effective control measures to prevent the risks from occurring.

The 2^nd Line of Defense

The second line of defense is a function that primarily monitors the control activities of the first line of defense.  In most organizations, this is the Compliance unit, and this is also where the AML function should be.

The 3^rd Line of Defense

The third line of defense is the function that is carrying out internal audits.  They ensure the reduction of risk based on the highest level of independence and objectivity within the company.

Pillar 4: Employee Training Program

The fourth pillar to consider for an effective AML/CTF compliance program is employee training.  While every employee within an organization should have a working knowledge of AML procedure, specific employees will bear greater responsibility for implementing its AML/CTF compliance program. 

It may be appropriate for an organization to implement a base level of training for all employees and add further targeted training to more AML-specific responsibilities.  Therefore, like creating an audit and testing schedule, an AML/CTF compliance program should ensure that those employees receive regular training and know-how to perform assigned duties.

Final Thoughts

To establish a strong and effective AML-CFT system with comprehensive rules covering anti-money-laundering and counter-terrorist financing requirements for both the banking and non-banking sectors, an adequately operational legal and institutional or administrative framework must be established, not only with the regulatory power that provides competent authorities with the necessary duties, powers, and sanctions, but also with the laws that create money laundering.

An effective AML-CFT system also includes laws and regulations imposing the required obligations on financial institutions and designated non-financial businesses and professions, as well as other enforceable means that allow a country to provide the broadest range of international cooperation.