Governance and programs

Connect responsibilities, people and the AML/CTF program.

These guides explain who is responsible for what inside a small business: the senior manager who approves the program, the compliance officer who runs it, and the people who carry out the checks. Start with the guide on the three governance roles if those words are new to you.

The later guides cover the practical questions that follow: how a sole trader can hold more than one role, what an independent evaluation adds to your own review, how to oversee an external provider or a software product, and what to record when a control fails.

• How do the three AML governance roles differ?

  Separate oversight, approval and daily coordination so that each decision has an owner.

• What does a senior manager approve in the AML program?

  Tie approval to the actual risk assessment, policies and changed versions.

• What makes an AML compliance officer appointment workable?

  Assess eligibility, authority, resources and arrangements for absence.

• Can one person perform all AML governance roles?

  Small size can change the role arrangement without removing the underlying work.

• Independent evaluation versus your own internal review

  Use internal review to maintain the program and independent evaluation to examine it with suitable independence.

• How should you oversee an external compliance provider?

  Give external providers clear tasks, evidence requirements and an escalation route while retaining business oversight.

• When does an AML program become a working process?

  Connect the written AML program to the staff actions, decisions and evidence that show it operates in practice.

• How to assess an AML service provider

  Identify the people, work and acceptance criteria before you engage an AML adviser or outsourced service.

• How to assess an AML software provider

  Test AML software against your own procedures, customer cases and record needs before you buy it.

• Why buying AML software is not enough

  Software can support AML work. Your business still needs an approved program, assigned responsibilities and evidence that its procedures are used.

• Personnel due diligence for AML/CTF

  Personnel due diligence examines a person’s ability and integrity for an AML role, before and during relevant employment or engagement.

• AML training for each role

  AML training must suit the person’s work, risks and responsibilities. Australian rules require initial and ongoing training that the person can understand.

• Correcting an AML control failure

  An AML control failure needs a defined response: establish what happened, address affected work, correct the cause and examine the result.

• Information for AML oversight

  AML management information helps the governing body assess compliance and risk management. Reports need findings, evidence, unresolved matters and decisions.