AML/CFT Compliance Programme

Standards from FATF and national laws expect each regulated firm to maintain a programme proportionate to its size and risk. Its usual parts are a risk assessment, written policies and procedures, customer due diligence, ongoing monitoring, reporting of suspicious activity, record keeping, staff training, a senior officer in charge, and independent testing of the whole arrangement. Larger groups add group-wide policies for branches abroad and rules for sharing information internally. The programme is approved by the board, owned by management and tested by audit. Regulators examine it as a system, so a strong screening tool does not make up for missing training or an unresourced compliance team. Supervisors use the programme to judge whether a firm's controls match the risks it actually runs.

After a supervisory visit, a regional life insurer reviews its AML/CFT programme. The inspector found good customer checks but no independent testing for two years and missing training records for new agents. The insurer commissions an external review, sets annual training deadlines and gives the compliance head a direct line to the board.