AML compliance checklist for banks (10 steps)

Banks and other financial institutions (FIs) must implement an anti-money laundering (AML) compliance program to detect and prevent money laundering and terrorism financing activities and satisfy their associated regulatory obligations. Given the administrative burden and the need to manage their responsibilities while ensuring the effectiveness and efficiency of AML measures, it’s good practice for banks to implement a compliance checklist that supports and informs their AML program. 

The AML compliance checklist for banks

Accordingly, a practical AML compliance checklist should involve the following key features and best practices:

1. Assign a compliance officer
2. Take a risk-based approach to AML
3. Develop internal AML policies
4. Establish an AML training program
5. Perform customer due diligence
6. Screen customers against sanctions lists and watchlists
7. Monitor transactions
8. Report suspicious activities
9. Keep records of the bank’s AML processes
10. Use automated AML tools and technology

1. Assign a compliance officer

In keeping with the Financial Action Task Force (FATF) recommendations, a bank must appoint a compliance officer to oversee its AML compliance program and act as a liaison for regulators. The compliance officer should be a senior employee with the authority and skillset to perform their role effectively. Typically, they’ll undertake the following key responsibilities:

• Monitoring and ensuring all operational processes are compliant using compliance software.
• Managing and administering visits from auditors.
• Carrying out risk assessments on activities typically related to money laundering. 
• Investigating and submitting suspicious activity reports (SAR).
• Proposing AML compliance recommendations to senior management – for US banks, this will also include Bank Secrecy Act (BSA) measures.  

2. Take a risk-based approach to AML 

According to the FATF, adopting a risk-based approach is paramount for banks to navigate the complex landscape of financial transactions effectively. This method entails tailoring preventive measures and due diligence efforts based on the assessed level of risk associated with various elements. Key considerations for banks embracing a risk-based approach include:

• Product offerings and their inherent risks: It is crucial to understand the risks associated with different financial products. High-risk products, such as international wire transfers or anonymous bearer share accounts, require more stringent scrutiny than standard transactions. Developing a nuanced awareness of each product’s risk profile enables banks to allocate resources judiciously.
• Clients and their relationships: Clients vary in risk, and a comprehensive risk assessment should factor in aspects like customer behavior, source of funds, and the nature of their transactions. High-net-worth individuals, politically exposed persons (PEPs), or entities operating in high-risk industries demand heightened scrutiny to ensure compliance and deter illicit financial activities.
• The regions in which the bank operates: Geographical considerations play a pivotal role in risk evaluation. Certain areas may pose higher AML risks due to the prevalence of money laundering activities, economic instability, or weak regulatory frameworks. Banks must adapt their compliance measures accordingly, applying enhanced due diligence (EDD) in regions identified as high-risk.
• Transaction activity: Analyzing transaction patterns helps banks identify anomalies and potential red flags. Unusual or complex transactions may signify higher risks, necessitating additional scrutiny. Implementing transaction monitoring systems that flag irregular activities empowers banks to respond to potential AML concerns swiftly.
• The organization’s overall risk tolerance and where it’s prepared to take higher risks: Each bank defines its risk tolerance based on its risk appetite, business strategy, and regulatory environment. Establishing clear risk tolerance thresholds assists in aligning compliance efforts with overarching organizational objectives. This ensures a balanced approach, avoiding over-compliance and exposure to undue risk.

3. Develop internal AML policies.

One of the newly appointed compliance officer’s essential duties will be comprehensively documenting the bank’s AML policies and procedures. For firms operating in the US, this must align with the BSA and the AML compliance regulations defined in the Financial Industry Regulatory Authority’s (FINRA) rule 3310. 

Based on the firm’s product offerings and the markets within which it operates, a bank’s internal AML policies should include:

• A checklist to ensure new products are compliant.
• Procedures for internal reporting and reporting suspicious transactions.
• Transaction monitoring procedures.
• A thorough customer onboarding process, including a robust identification procedure.
• The identity of the person or persons responsible for implementing the day-to-day operations and reporting of the compliance program.

Firms can review FINRA’s free-to-use AML checklist template for small and medium-sized organizations for more information.

4. Establish an AML training program

Under FATF recommendations, bank employees should undergo AML training to remain capable of recognizing suspicious activity that could indicate money laundering or terrorism financing. Due to this, a bank’s compliance checklist should feature an ongoing AML training schedule to allow all employees, regardless of role, to adapt to new legislation and emerging criminal methodologies, with a focus on the following:

• The risks, categories, and types of financial crime – including money laundering and tax evasion.
• How to apply a risk-based approach.
• The importance of compliance in banking.
• Risk management best practices such as sanctions screening, transaction monitoring, and know your customer (KYC) protocols.
• The organization’s specific protocols and procedures.
• Any documentation necessary for their role.

5. Perform customer due diligence (CDD)

Identity verification is a crucial component of a risk-based AML/CFT strategy: banks must know who they are dealing with and any associated risks to deploy the appropriate responses. 

An AML checklist should prioritize identity verification through CDD measures, with EDD for higher-risk customers. A sound CDD process should include the following:

• Identification of the customer by obtaining ID, address, date of birth, and other personal information and data from a reputable source.
• Alongside identification, banks should also define the nature and purpose of their business relationship with the customer.
• If a company or third party is working on behalf of a customer, ultimate beneficial ownership (UBO) should be established – referring to the individual(s) who benefit from the activities of a person or group of persons. 
• Assessment and grading of risks based on the customer.

Banks also have a responsibility to determine if their customers are politically exposed persons (PEPs). Because of the heightened risk of potential corruption, bribery, and money laundering, clients with PEP status are often subject to enhanced due diligence (EDD). Therefore, banks should ideally include PEP screening in their AML checklist during the onboarding process and throughout the entire business relationship to ensure any status changes are detected.

6. Screen customers against sanctions lists and watchlists

Banks must ensure they are not doing business with individuals, companies, or countries listed on international sanctions lists. With that in mind, a bank’s AML checklist should include a sanctions screening process that considers all relevant lists, which may include those issued by national and international authorities. Banks in the United States, for example, must screen customers against the US Office of Foreign Assets Control (OFAC) sanctions list and also by the United Nations Security Council (UNSC) sanctions list.

Sanctions screening best practices:

• Ensure high-quality customer data is collected from verified sources.
• Use the right technology to automate and speed up sanctions screening.
• Ensure the relevant teams are trained using accurate information pertinent to their firm.
• Ensure stakeholders know the right actions to take when a red flag arises.

7. Monitor transactions

Transaction monitoring is an essential regulatory obligation for banks and a crucial part of any comprehensive bank compliance checklist. Banks should monitor customer transactions for suspicious activity concerning their risk profile with the following in mind:

• Transactions above regulatory thresholds.
• Unusual transactions, for example, unexpectedly high amounts or a high volume of transactions.
• Unusual transaction patterns.
• Transactions with high-risk countries.
• Transactions with PEPs or with sanctioned individuals.
• Adverse media stories involving customers.

 8. Report suspicious activities 

Suspicious activity surrounding a client’s bank accounts and transactions can often indicate that they’re involved in financing terrorism, laundering money, or other illicit activities. It’s essential to include a robust process for submitting SAR to the financial authorities.

The SAR submission process should be straightforward and carried out without making the suspected entity aware, recording:

• The verified identity of the entity involved.
• Details about the transaction. 
• The reasoning for suspicion.
• Any other information necessary to the firm’s jurisdiction.

9. Keep records of the bank’s AML process

It is crucial to maintain records of every stage of the AML process, as banks need to evaluate the level of risk based on the information they have on their customers. While there is no standard set of record-keeping requirements applicable to all kinds of businesses, there should be adequate documentation to support a firm’s onboarding procedures that demonstrate why a particular client was onboarded and the steps they went through. The duration for which businesses should retain this information depends on the laws and regulations in their jurisdiction.

The following types of records must be maintained:

• Documents related to client identification and verification.
• Information on the transaction and the institution’s role in it.
• CDD documents prepared during the onboarding process.
• Printouts that identify if the client is sanctioned, a PEP, or subject to any adverse media.
• Information obtained about the client’s source of wealth and funds.
• Information that was not acted upon, including proof of the decision not to act.
• Records of clients who were not onboarded and the reasons for the same.
• Correspondence between the engagement and onboarding teams.
• Evidence of any internal and external escalations and the decisions related to those escalations.
• Material generated in connection with enhanced due diligence and ongoing monitoring.

Firms must also maintain records of their formal risk-based assessment, AML/CFT, and sanctions compliance policies. Any changes to these policies must be recorded.

10. Use automated AML tools and technology

Finally, integrating automated AML tools and technology is indispensable for bolstering a bank’s compliance framework. These tools, such as automated processes in sanctions screening and transaction monitoring, and the incorporation of machine learning (ML) algorithms in fraud detection and adverse media screening solutions, can serve as vigilant gatekeepers if implemented and calibrated appropriately. 

By swiftly and accurately analyzing vast datasets, these technologies excel at flagging suspicious activities in real-time, reducing the risk of human error. Beyond streamlining routine processes, embracing automation enables banks to strategically allocate human resources, focusing on intricate investigative tasks where human expertise remains invaluable. Implementing advanced AML technology is pivotal for effective risk mitigation and regulatory compliance in an era marked by the increasing sophistication of financial crimes.