Name the functions first
An AML/CTF governance chart identifies who makes decisions and who oversees compliance. The governing body oversees risk and compliance. Senior managers make specified approvals. The compliance officer oversees and coordinates daily compliance.
A small business may combine roles, but the functions remain distinct. Map each function to a person with authority to perform it. Give the compliance officer sufficient independence, resources and access to information. A title alone does not show that the arrangement works.
Sources: AUSTRAC: Governing body responsibilities; AUSTRAC: Responsibilities of a senior manager; AUSTRAC: Responsibilities of an AML/CTF compliance officer.
- Governing body
Oversight and resources.
- Senior manager
Specified decisions and approvals.
- Compliance officer
Daily oversight and coordination.
Three governance functions
Functions may be combined where the applicable conditions are met.
Connected concepts. Lines do not show ownership or a reporting hierarchy.
Give each issue a route
A practical design separates three questions: who investigates an issue, who approves the response and who receives oversight information. Invented example: a recurring intake failure may need operational repair, a policy change and a report about the wider risk. One email marked for everyone can leave all three tasks unclear. Use a simple issue record with named owners and decision dates. Make escalation possible when the operational team cannot resolve a problem within its authority or available resources.
Sources: AUSTRAC: Governing body responsibilities; AUSTRAC: Responsibilities of a senior manager; AUSTRAC: Responsibilities of an AML/CTF compliance officer.
Invented example: an unresolved backlog
Suppose staff report a growing backlog of customer reviews. The compliance officer gathers facts and explains the effect on controls. A responsible manager decides the operational response within the applicable procedures. The governing body considers whether resources and oversight are adequate.
This is an illustrative division of work, not a complete rule for every backlog. The point is that receiving a report is different from approving a policy or completing an individual customer review. Each step needs an identifiable output.
Sources: AUSTRAC: Governing body responsibilities; AUSTRAC: Responsibilities of a senior manager; AUSTRAC: Responsibilities of an AML/CTF compliance officer.
Test authority in practice
Test the chart with a recent issue rather than only asking whether all names are filled in. Could the compliance officer obtain the needed records? Did the decision maker have authority? Did significant findings reach the governing body intact?
Record the changes needed to make the route usable. Link the chart to role descriptions, absence cover and meeting arrangements. Review the chart when staff or business structure change. Assign each function to a person who can still perform it.
Sources: AUSTRAC: Governing body responsibilities; AUSTRAC: Responsibilities of a senior manager; AUSTRAC: Responsibilities of an AML/CTF compliance officer.
Examine reporting quality
Ask whether governance reports distinguish open issues, completed actions and untested claims of improvement. A report that lists activity alone may hide whether controls work. Identify confirmed facts and unresolved questions. State the resource or policy decision needed.
Sources: AUSTRAC: Governing body responsibilities; AUSTRAC: Responsibilities of a senior manager; AUSTRAC: Responsibilities of an AML/CTF compliance officer.