AML Programme Design & Effectiveness

Governance, risk rating, monitoring, outsourcing, QA and recordkeeping controls.

1. Programme architecture#

enterprise and business risk assessment
→ risk appetite, policy and control standards
→ customer, product and transaction controls
→ governance and accountable ownership
→ quality assurance, testing and management information
→ issue management and remediation
→ independent audit and supervisory challenge
→ revised risk assessment and control design

The cycle is continuous. New products, jurisdictions, customers, data, technology, typologies and regulatory changes may alter both risk and control effectiveness.

2. Component map#

Programme component	What it should achieve	Evidence of effectiveness	Canonical page
Enterprise / business risk assessment	Identify and prioritise material ML/TF/PF risks	Current methodology, data, rationale, governance challenge, actions	Customer Risk Assessment and jurisdiction risk pages
Risk appetite and policy	Translate risk decisions into clear requirements and boundaries	Approved policy, exceptions, ownership, review cycle	Rule-to-Action Map
CDD / EDD / ownership	Understand customers and beneficial owners proportionately	Complete files, coherent rationale, resolved discrepancies	CDD / KYC, EDD
Screening and sanctions	Identify relevant names, ownership/control and legal restrictions	Calibrated screening, source dates, escalation and legal decision	Name-Screening Calibration, Sanctions
Ongoing and transaction monitoring	Detect material changes and unusual activity	Relevant scenarios, alert quality, documented review, feedback	Ongoing Monitoring
Reporting and escalation	Route concern without tipping-off or unauthorised decisions	Decision records, confidentiality, timeliness, legal basis	STR / SAR, MLRO Review
Recordkeeping and data	Preserve sufficient, lawful and retrievable evidence	Provenance, retention, access control, retrieval testing	Data Protection & Recordkeeping
Training and competence	Ensure roles can perform and challenge controls	Role-based training, assessment, supervision, remediation	Learning Path
QA and control testing	Identify operating weakness before it becomes systemic	Sampling, findings, root-cause analysis, closure validation	QA & Audit Readiness
Governance and MI	Give accountable leaders a truthful view of risk and weakness	Useful metrics, escalation, minutes, decisions and challenge	Governance & Three Lines
Outsourcing and technology	Retain accountability for third parties, tools and models	Due diligence, service controls, testing, contingency and oversight	Third-Party Reliance
Independent audit	Provide independent assurance over design and operation	Risk-based plan, evidence, findings and tracked remediation	QA & Audit Readiness

3. Governance and accountability#

Effective governance identifies:

who owns each material risk;
who designs, operates, tests and approves each control;
which decisions require senior management, MLRO, sanctions, legal or board authority;
how conflicts, overrides and exceptions are recorded;
how material weakness reaches the correct governing body.

The Three Lines model helps organise responsibility but does not transfer accountability. First-line ownership, second-line oversight and third-line assurance need clear interfaces and evidence.

4. Risk assessment must drive control design#

A risk assessment that does not change controls is mainly documentation.

For each material risk, the programme should be able to show:

risk statement
→ affected customers, products, sectors, channels and jurisdictions
→ inherent risk
→ control objective
→ control owner and frequency
→ evidence produced
→ residual risk
→ monitoring and remediation

Controls should be proportionate. Excessive controls applied indiscriminately can increase cost, reduce data quality and obscure higher-risk cases.

5. Design effectiveness and operating effectiveness#

Design effectiveness#

Ask:

Would the control, if performed as designed, address the risk?
Is the trigger, data, decision rule and escalation path appropriate?
Is the control placed early enough to prevent or detect the issue?
Does an authorised role own the outcome?

Operating effectiveness#

Ask:

Was the control performed consistently and on time?
Was the evidence complete and reliable?
Were exceptions and alerts resolved appropriately?
Did the reviewer challenge weak conclusions?
Were issues corrected and recurrence reduced?

A policy can be well designed but poorly operated. A consistently operated control can still be badly designed.

6. Management information that matters#

Useful MI supports decisions. It may include:

risk distribution and material change;
overdue or incomplete CDD/EDD;
alert, escalation and case ageing;
quality-error type and recurrence;
screening false-positive and false-negative indicators;
high-risk approval and override patterns;
SAR/STR process timeliness without exposing unnecessary confidential detail;
data, system and vendor incidents;
open findings, remediation age and closure validation;
staffing, competence and capacity relative to workload.

Vanity metrics count activity without showing control quality, such as raw searches completed, documents collected or alerts closed.

7. Quality, audit and remediation cycle#

quality review or testing
→ finding
→ severity and risk impact
→ root cause
→ accountable owner
→ corrective action
→ target date
→ closure evidence
→ independent validation
→ trend and recurrence review

Closing a ticket is not the same as correcting the control. Remediation should address the cause, affected population and future prevention where proportionate.

8. Training and competence#

Training should be role-based:

analysts need source, evidence and escalation competence;
reviewers need judgment, challenge and consistency;
MLROs need legal, governance, reporting and board-level competence;
technology teams need data, model, change and human-approval controls;
senior management and the board need sufficient understanding to challenge risk and resource decisions.

Completion records alone do not prove competence. Assessment and observed performance matter.

9. Common programme failures#

enterprise risk assessment is generic or disconnected from products;
policies contain obligations but no operational owner or evidence requirement;
risk-rating models create numbers that no one can explain;
screening and monitoring generate high volumes with poor feedback;
investigators close cases without resolving material discrepancies;
outsourced providers operate as a black box;
first and second line rely on the same unchallenged data;
metrics reward speed rather than quality;
remediation closes administratively but weakness recurs;
the board receives reassuring summaries without material limitations.

10. Programme review questions#

What are the most material current ML/TF/PF risks?
Which controls address each risk?
What evidence shows the controls work?
Where are limitations, overrides and backlogs?
Which failures are isolated and which are systemic?
Who owns remediation and who validates closure?
Which decisions require MLRO, legal, sanctions or board authority?
How does the programme learn from cases, QA, audit, regulatory findings and new typologies?

11. Programme review output#

Scope and period:
Applicable legal / policy framework:
Material risks:
Control architecture:
Design-effectiveness findings:
Operating-effectiveness findings:
Data and technology limitations:
Governance and MI findings:
Open issues and root causes:
Remediation owner / date:
Residual risk:
Required MLRO / senior management / board decision:

Source basis#

FATF Recommendations and Methodology, including the risk-based approach, internal controls, supervision and effectiveness.
Applicable law, regulator guidance and institution-specific risk appetite.
Independent assurance and audit standards where relevant.