Key Takeaways
- The regulatory question is not simply whether an anti-money laundering (AML) program exists, but whether it is working in practice. Firms should be able to demonstrate that controls identify, investigate and escalate relevant risks on a timely basis.
- Risk assessments, customer due diligence and monitoring controls should reflect the institution’s current risk profile including its customers, products, services, geographies and transaction activity.
- Management and the board need to evidence clarity and oversight of open issues, alert backlogs and remediation progress, with ownership, deadlines and evidence that corrective actions have addressed the underlying weakness.
A recent enforcement action against a large U.S. bank involved more than $1.21 billion in combined penalties, a multi-year breakdown in anti-money laundering (AML) controls and the failure to timely report more than $5 billion in suspicious activity. Its scale is exceptional, but the underlying message is broadly relevant: missed warning signs, delayed investigations and unresolved control weaknesses can arise in institutions of any size.
The scale and complexity of the infrastructure supporting an AML program will vary across institutions. The underlying expectation does not: each institution should be able to evidence a risk-based program, proportionate to its size and risk profile, that can identify, investigate and report relevant activity on a timely basis. Recent enforcement is not a reason to over-engineer a program. It is a reason to test whether the current program can demonstrate that it works.
The Key Message is Follow-Through
Transaction monitoring needs to be effective, but Treasury’s description of the recent case indicates broader failure: a failure to act on information already available to the bank. Testing had identified significant problems; suspicious activity was not consistently escalated; customer due diligence did not sufficiently reflect third-party payment activity; and backlogs left potentially suspicious activity uninvestigated for extended periods.
These are not isolated technical failures. They can emerge when an AML framework does not keep pace with the institution’s changing risk profile. Common pressure points include:
- An inherited or rapidly changing customer base
- New products, payment channels or third-party relationships
- Higher-risk commercial lending or customer activity
- Alert volumes that exceed available investigation capacity
- Incomplete customer information or risk ratings that no longer reflect actual activity
- Reliance on vendor-supported monitoring systems whose coverage has not been independently challenged
The issue is not whether the program has a policy, a system or an annual risk assessment. It is whether the controls, data, staffing and escalation process work together in the areas where the institution is actually exposed and whether management acts when weaknesses are identified.
Key Questions for Management and Boards to Ask Now
A full program rebuild is often not the first step. Begin with a focused review to determine whether management’s confidence in the existing AML program and controls is, in fact, supported by current evidence.
Questions to Ask | Supporting Evidence to Review |
Does monitoring reflect our actual risk profile? | How monitoring covers the institution’s higher-risk customers, products, services, geographies and transactions, with gap testing. |
Are alerts reviewed and investigated promptly? | The age and volume of outstanding alerts and investigations, review of investigation quality and defined procedures for dealing with delays or staffing constraints. |
Are customer risk ratings kept current? | Review of risk ratings and additional due diligence are triggered by changes in customer activity, ownership, third-party payments or geographic exposure. |
Can we rely on our data and vendor systems? | Monitoring systems are receiving complete and accurate data, vendor systems are addressing the institution’s risks and proper implementation of system changes and sanctions watchlist updates. |
Are identified weaknesses corrected? | Findings, assigned responsibilities and deadlines, reporting of overdue items to leadership and independent verification that underlying issues were resolved by corrective actions. |
Gaining Clarity in the Next 90 Days
If you find yourself wondering where to begin, the following steps can help you gain more clarity as to where your AML program currently stands, what needs to be addressed and how you can protect your institution from further risk.
- Update your risk assessment. Confirm that it reflects your institution’s current customers, products, services, payment flows, geographies and delivery channels. Controls must be re-evaluated to understand if they adequately address new risks introduced by changes in the business.
- Review higher-risk customer files. Test whether customer information is accurate and sufficient to understand the relationship and expected activity. Risk ratings may change and beneficial-ownership, source-of-funds or enhanced due-diligence information may require updating.
- Test monitoring and sanctions controls. Confirm that systems receive complete and accurate data, identify activity requiring review and route alerts appropriately. Review investigation quality, Suspicious Activity Report (SAR) decisionmaking and timeliness, sanctions screening and watchlist updates.
- Address backlogs and unresolved findings. Determine whether delays or control weaknesses warrant a transaction lookback, customer review or root-cause analysis. It must be clear who is responsible for corrective action and in what timeframe. You can then verify that the changes resolved the underlying issues.
- Keep management and the board informed. Report back on your findings. Explain significant delays, resource needs and how corrective actions have been validated. This provides a strong basis for regulatory examinations.
Use This as an Opportunity for a Focused Response
Not every institution has the same exposure. Nonetheless, where risk indicators, testing or internal concerns point to a weakness, management must be able to show that it understood the issue, acted on it and verified that the response was effective. A well-scoped review now can provide that evidence before the next examination, or before a manageable issue becomes a much harder remediation exercise.
How Independent Support Can Add Value
You may have specific questions regarding testing whether a monitoring system addresses a newly material risk, reviewing alert backlogs and SAR decision quality, assessing the effectiveness of completed remediation or giving the board an independent view of a known concern. This is where working with an independent team of advisors can add the most value, particularly one with specialized expertise in risk, regulatory and forensics.
Our team at PKF O’Connor Davies brings together regulatory, investigative and operational-risk experience to help clients turn these questions into a focused, practical plan of action. We partner with clients to provide focused, risk-based BSA/AML and sanctions support. We help institutions assess program effectiveness, test monitoring and sanctions controls, investigate issues and develop and validate practical remediation. Engagements can range from a targeted health check or knowledge-sharing discussion to independent testing, investigation support and remediation validation. The scope should match the institution’s risk profile, the evidence already available and the decision management needs to make.
Contact Us
If you have any questions or need assistance, please contact your PKF O’Connor Davies client service team or:
Helen Rexwinkel
Partner
hrexwinkel@pkfod.com
Beth da Silva, CPA, CFF
Partner
edasilva@pkfod.com
Darryl Wegner
Managing Director
dwegner@pkfod.com
Patrick Moran, CPA
Partner
pmoran@pkfod.com