AML Governance & Three Lines of Defence
AML/KYC is a governance system, not a pile of isolated customer checks. Good programmes define ownership, policy, escalation, quality assurance and independent testing.
1. Why governance matters #
A good AML programme needs more than alert review. It needs clear ownership, policies, risk assessment, controls, training, independent testing, issue remediation and senior accountability. Without governance, even good analysts can produce inconsistent results.
| Control layer | Purpose | Weakness if missing |
|---|---|---|
| Policy | Defines what must be done and where escalation is required. | Analysts improvise decisions case by case. |
| Ownership | Assigns who performs, approves and reviews controls. | Controls fall between teams. |
| Training | Builds shared judgment and common language. | Junior staff may over-rely on checklists. |
| Independent review | Tests whether controls work in practice. | Weaknesses remain invisible until an incident or regulator review. |
2. The three lines idea #
The “three lines” model is a common way to separate operational ownership, compliance oversight and independent assurance.
| Line | Plain meaning | AML/KYC examples |
|---|---|---|
| First line | The business and operations teams that own customer relationships and day-to-day controls. | Collecting customer information, identifying unusual customer behaviour, following onboarding requirements. |
| Second line | Compliance / AML function that designs, oversees and challenges the control framework. | AML policy, risk methodology, sanctions/PEP standards, escalation review, MLRO oversight. |
| Third line | Independent assurance, often internal audit. | Testing whether AML controls are operating as designed and whether issues are remediated. |
3. MLRO and compliance function #
The MLRO or equivalent role is usually responsible for suspicious activity escalation governance and for ensuring that relevant AML issues are handled under applicable law and policy. The MLRO is not just a “last approver”; the role sits inside a wider control system.
Useful distinctions:
- Analyst: gathers facts, reviews sources, documents inconsistencies and prepares evidence.
- Compliance / AML manager: oversees methodology, quality and escalation standards.
- MLRO: handles regulated escalation/reporting responsibilities under the local framework.
- Senior management / board: owns risk appetite, resources, governance and accountability.
4. Training and culture #
Training is not only a formal annual course. It should help people understand risk-based thinking, evidence quality, escalation discipline and the limits of open-source information. Culture matters because AML failures often come from pressure to onboard, poor challenge, weak documentation or treating controls as box-ticking.
5. Management information and remediation #
Governance needs feedback loops. Useful management information may include volumes, alerts, escalations, overdue reviews, quality findings, unresolved issues, training completion and audit results. The goal is not only reporting numbers; it is finding where the system is weak.
6. Source basis #
- FATF Recommendations for internal controls, CDD, STR/SAR and risk-based programme concepts.
- Basel Committee ML/TF risk management guidance for banking governance and risk management framing.
- Wolfsberg Group resources for practitioner financial crime compliance and risk-based controls.