Culture of Compliance and Tone from the Top

Why This Topic Matters

Every anti-financial crime (AFC) program on paper looks roughly the same: policies, procedures, customer due diligence, transaction monitoring, suspicious activity reporting, training and independent testing. Yet some institutions catch money laundering and others become the headline in a billion-dollar enforcement action. The difference is almost never the written program. It is the culture that surrounds it and the tone set by the people at the top of the organisation.

Regulators learned this the hard way. The HSBC (2012), Standard Chartered, Danske Bank, Westpac, Rabobank and U.S. Bancorp cases all had compliance departments, written policies and monitoring systems. What they lacked was leadership that genuinely prioritised compliance over revenue, resources that matched the risk, and an environment in which staff felt able to escalate concerns. In response, the U.S. Financial Crimes Enforcement Network (FinCEN) issued its landmark 2014 Advisory on Promoting a Culture of Compliance (FIN-2014-A007), and the Basel Committee, the Wolfsberg Group and the FATF have all embedded governance and culture expectations into their standards.

For the CAMS exam, this topic sits inside the domain on AFC Program Governance and Risk Management. It is heavily tested through scenario-based questions, because the exam is designed to assess judgement, not just recall. If you understand what a strong culture looks like, what weak culture looks like, and who is responsible for what, you will be able to reason your way through questions you have never seen before.

What Is a Culture of Compliance?

A culture of compliance is the shared set of values, attitudes and behaviours within an institution that cause employees at every level to treat anti-money laundering (AML), counter-terrorist financing (CTF) and sanctions obligations as a core part of doing business rather than as an obstacle to it. It is sometimes summarised as 'what people do when no one is watching.'

Key features of a strong compliance culture include:

• Compliance is everyone's job. Front-line staff, relationship managers, operations teams and senior executives all understand that they own financial crime risk, not just the compliance department.
• Ethics over profit. Decisions about onboarding, retaining or exiting customers are made on the basis of risk, not solely on the revenue the customer brings.
• Open escalation. Employees feel safe raising concerns, reporting unusual activity and challenging senior people without fear of retaliation.
• Accountability. Breaches of policy have consequences regardless of seniority or commercial value.
• Adequate resources. Compliance has sufficient staff, technology, training and budget relative to the institution's risk profile.
• Information sharing. Data from the business, operations, fraud, legal and audit flows to compliance so that risk can be assessed holistically.

What Is Tone from the Top?

Tone from the top (sometimes written as 'tone at the top') refers to the ethical climate and priorities communicated by the board of directors and senior management through their words, their decisions and, above all, their actions. It is the single most powerful driver of culture, because employees take their cues about what really matters from what leaders reward, tolerate and punish.

A genuine tone from the top is demonstrated when:

• The board approves the AML/CTF program and receives regular, meaningful reporting on risks, metrics, audit findings and regulatory developments.
• Senior management visibly supports the compliance function, including backing difficult decisions such as exiting a profitable but high-risk client.
• The chief compliance officer or BSA/AML officer holds appropriate seniority, has direct access to the board or a board committee, and cannot be overruled by business-line heads on matters of compliance.
• Compensation and promotion criteria include compliance behaviour, and misconduct carries real consequences for executives, not only junior staff.
• Leaders themselves complete training and speak about financial crime risk in business meetings, town halls and strategy discussions.

Practitioners often extend the concept to 'tone at the top, mood in the middle, and buzz at the bottom.' This phrase captures the point that leadership messages must be reinforced by middle managers (who control day-to-day priorities) and reflected in the attitudes of front-line staff. A board can say all the right things, but if a branch manager tells tellers to stop filing so many unusual activity reports because it slows down service, the real culture is the branch manager's.

The FinCEN 2014 Advisory: Six Pillars of a Culture of Compliance

The CAMS exam frequently draws on FinCEN's Advisory FIN-2014-A007. You should be able to recognise and apply its six elements:

1. Leadership actively supports and understands compliance efforts. Boards and executives must understand the institution's AML risks and the purpose of the program, not merely rubber-stamp it.
2. Efforts to manage and mitigate deficiencies are not compromised by revenue interests. Compliance decisions must not be overridden or diluted because a customer or product is lucrative.
3. Relevant information from across the institution is shared with compliance staff. Siloed information prevents compliance from seeing the whole picture.
4. The institution devotes adequate resources to compliance. Staffing, expertise, technology and budget must be commensurate with the risk profile.
5. The compliance program is effective and tested by an independent and competent party. Independent audit or testing, free from conflicts of interest, is essential.
6. Leadership and staff understand how suspicious activity reports and other BSA reporting are used. Employees who understand that their reports help law enforcement are more motivated to produce quality work.

Memorise these six points. Exam questions often describe a weakness and ask which element is deficient, or present several options and ask which one best reflects a culture of compliance.

International Standards Reinforcing the Concept

• Basel Committee on Banking Supervision – Sound Management of Risks Related to Money Laundering and Financing of Terrorism (2014, updated). Requires the board to approve and oversee AML/CTF policies, and emphasises that senior management is responsible for implementing them and for establishing the three lines of defence.
• Wolfsberg Group – Guidance on AML program governance stresses senior management accountability, an empowered and independent compliance function, and a risk-based approach supported from the top.
• FATF Recommendations – Recommendation 18 requires financial institutions to implement programs including internal policies, compliance management arrangements (including appointing a compliance officer at the management level), screening, training and an independent audit function.
• U.S. Anti-Money Laundering Act of 2020 – Expanded whistleblower protections and rewards, strengthening the incentive for institutions to foster open-reporting cultures.
• UK Senior Managers and Certification Regime (SM&CR) and similar individual accountability regimes in other jurisdictions make named executives personally responsible for specific risk areas, directly operationalising tone from the top.

How It Works in Practice: The Governance Framework

1. Board of Directors. The board holds ultimate responsibility for the AML/CTF program. It approves the program, sets risk appetite, ensures the compliance officer has sufficient authority and resources, reviews audit and regulatory findings, and holds management accountable. The board may delegate oversight to a committee (audit, risk or compliance committee) but cannot delegate its accountability.

2. Senior Management. Executives implement the board-approved program, embed compliance into business strategy, allocate budget and ensure that business-line leaders are held to compliance standards. They must escalate significant issues to the board.

3. The Compliance Officer. The designated AML/BSA/MLRO officer must have the stature, independence, expertise and resources to carry out the role. Independence means not reporting into a revenue-generating line and having an unfiltered channel to the board. Exam questions often test whether a reporting structure compromises independence (for example, a compliance officer who reports to the head of private banking and whose bonus depends on private banking revenue).

4. The Three Lines of Defence.
• First line: business units and front-line staff who own and manage risk day to day (know your customer, identifying red flags).
• Second line: compliance and risk management functions that set policy, advise, monitor and challenge the first line.
• Third line: internal audit, which provides independent assurance to the board that the first and second lines are effective.
A culture of compliance requires all three lines to function. Weak tone from the top typically shows up as a first line that ignores the second, or a third line that is under-resourced or whose findings are not acted upon.

5. Incentives and Consequences. Culture is shaped by what gets rewarded. Compensation plans that reward only sales volume, with no clawback or compliance scorecard, create pressure to onboard risky customers and discourage escalation. Strong institutions tie a portion of variable pay to conduct and compliance outcomes and apply disciplinary action consistently across all levels.

6. Communication and Training. Leaders must communicate expectations repeatedly and in plain language, and training must be tailored to roles. Training delivered only as a tick-box exercise signals that compliance is a formality.

7. Escalation and Whistleblowing Channels. Confidential, non-retaliatory channels for reporting concerns, with visible follow-up, are a hallmark of healthy culture. Institutions should track whistleblowing volumes and outcomes as a culture metric.

8. Measuring Culture. Boards increasingly use indicators such as: staff survey results on willingness to speak up; compliance staffing and turnover; volume and timeliness of internal escalations; alert backlogs; number of policy exceptions granted to high-revenue clients; audit issue ageing; and regulatory findings. A rising backlog or a pattern of overridden compliance recommendations is a red flag.

Red Flags of a Weak Culture of Compliance

Be ready to recognise these in scenario questions:

• Revenue-generating executives overriding or pressuring compliance to approve high-risk relationships.
• Arbitrary caps on the number of transaction monitoring alerts or SARs to manage workload or costs (a central issue in the U.S. Bancorp 2018 enforcement action).
• Chronic understaffing of compliance relative to business growth, or high turnover of compliance staff.
• Compliance officer reporting to a business head or lacking access to the board.
• Audit findings repeatedly left open or downgraded without remediation.
• Employees who fear retaliation for escalating concerns, or evidence that whistleblowers have been punished.
• Training completed late, generically, or not at all by senior management.
• Compensation tied solely to sales or revenue targets.
• The board receiving only summary or 'good news' reporting with no discussion of risk.
• A pattern of waivers and exceptions granted to politically connected or highly profitable customers.

Illustrative Enforcement Lessons

• HSBC (2012, US$1.9 billion) – Regulators cited a culture in which compliance was understaffed, business lines resisted compliance, and known deficiencies went unaddressed for years. Leadership tone was a central criticism.
• U.S. Bancorp (2018, US$613 million) – The bank capped the number of alerts generated by its monitoring system based on staffing levels rather than risk, and concealed this from regulators. A clear failure of the FinCEN principle that resources must match risk and that revenue or cost interests must not compromise the program.
• Danske Bank Estonia – Massive non-resident flows continued despite internal warnings, illustrating the danger when local revenue incentives override group-level controls and escalations are not acted upon.
• Westpac (2020) – Australian regulator AUSTRAC pointed to inadequate board oversight and resourcing as root causes of millions of reporting failures.
These cases consistently show that the root cause was culture and governance, not the absence of a written program.

Exam Tips: Answering Questions on Culture of Compliance and Tone from the Top

Tip 1 – Know who is ultimately responsible. If a question asks who bears ultimate responsibility for the AML program, the answer is the board of directors. Senior management is responsible for implementation; the compliance officer is responsible for day-to-day administration. Do not confuse delegation with accountability.

Tip 2 – Revenue never trumps compliance. When a scenario involves a business head pressuring compliance to onboard or retain a profitable client, the correct answer will involve applying the risk-based process objectively, documenting the decision, and escalating to senior management or the board if the disagreement persists. Any answer that involves quietly accepting the client, lowering the risk rating to accommodate the business, or 'finding a workaround' is wrong.

Tip 3 – Look for independence. Questions about reporting lines test whether the compliance function is independent. The best answers give the compliance officer direct access to the board or a board committee, keep compliance out of revenue-based compensation, and ensure independent testing is performed by people who do not perform the functions being tested.

Tip 4 – Resources must match risk. If an institution is growing rapidly, entering new markets or launching new products, the correct response involves reassessing risk and increasing compliance resources accordingly. Answers that cap alerts, reduce monitoring, or defer hiring to protect margins indicate a weak culture.

Tip 5 – Map scenarios to the six FinCEN elements. Many questions describe a deficiency and ask what it reveals. Ask yourself: is this about leadership understanding, revenue interference, information silos, resources, independent testing, or understanding the purpose of reporting? Identifying the element quickly narrows the options.

Tip 6 – 'Best' versus 'first' versus 'most effective'. Read the stem carefully. If asked for the best indicator of tone from the top, prefer concrete actions (board approval and oversight, resourcing, consequences for misconduct, executive participation in training) over mere statements (a code of conduct exists, a memo was sent). If asked what to do first, the answer is usually to gather facts, assess and escalate through proper channels rather than to take drastic unilateral action.

Tip 7 – Watch for 'paper compliance' distractors. Options that describe having a policy, having a manual, or completing an annual training module are frequently distractors. The exam rewards answers that demonstrate the program is effective and lived, not merely documented.

Tip 8 – Understand the three lines of defence. Be able to classify roles correctly. Relationship managers performing CDD are first line; the compliance department monitoring and advising is second line; internal audit testing the program is third line. Questions may describe a control failure and ask which line failed.

Tip 9 – Whistleblowing and non-retaliation are always positive. Answers that strengthen confidential escalation channels, protect those who raise concerns and ensure follow-up reflect strong culture. Any option involving discouraging reports or disciplining an employee for filing an internal unusual activity report is wrong.

Tip 10 – Think like a regulator. When in doubt, ask: 'What would an examiner want to see?' Examiners want evidence that the board understands risk, that compliance is empowered and resourced, that findings are remediated, and that commercial pressure does not override controls. Choose the answer that provides that evidence.

Tip 11 – Eliminate extremes. Resigning immediately, reporting straight to law enforcement without internal escalation, or refusing all business with a sector are rarely the best first answers in governance scenarios. The exam generally favours structured, documented escalation within the institution's governance framework, reserving external reporting for situations where internal channels have failed or where legal obligations (such as filing a SAR) are directly triggered.

Quick Revision Summary

• Culture of compliance = shared values and behaviours that make AFC compliance part of how business is done.
• Tone from the top = the board and senior management demonstrating, through actions and decisions, that compliance is a priority.
• FinCEN 2014 six elements: leadership support; no revenue interference; information sharing; adequate resources; independent testing; understanding the purpose of reporting.
• Board = ultimate responsibility; senior management = implementation; compliance officer = day-to-day administration with independence and board access.
• Three lines of defence: business, compliance/risk, internal audit.
• Red flags: alert caps, overridden compliance decisions, understaffing, retaliation, revenue-only incentives, unremediated audit findings.
• On the exam: escalate, document, apply the risk-based approach, protect independence, match resources to risk, and never let revenue override compliance.

Master these principles and you will be equipped not only to answer CAMS questions on this topic but to recognise and strengthen compliance culture in real-world practice.