Governance Committees and Terms of Reference

1. Why This Topic Matters

Anti-financial crime (AFC) programs do not run themselves. Regulators across jurisdictions—FATF, the Wolfsberg Group, the US FFIEC, the UK FCA, the EBA, MAS and others—consistently emphasize that an effective AML/CFT/sanctions program depends on governance: clear ownership, documented accountability, escalation paths, and oversight by senior management and the board. Governance committees are the mechanism through which this happens. Enforcement actions repeatedly cite failures such as 'no committee had clear responsibility for AML risk', 'issues were discussed but never escalated', or 'the board was not informed of material compliance deficiencies'. For the CAMS exam, this topic sits within the domain on AFC program governance and risk management, and questions test whether you understand who is responsible for what, how decisions are documented, and how oversight flows from the operational level to the board.

2. What Governance Committees Are

A governance committee is a formally constituted body, made up of designated individuals (typically senior executives and control-function heads), that meets on a defined schedule to oversee, decide on, and escalate matters within a defined scope. In an AFC context, typical committees include:

• Board of Directors / Board Risk Committee – ultimate accountability for the institution's risk appetite and the adequacy of the AFC program; approves the AML policy and receives regular compliance reporting.
• Board Audit Committee – oversees independent testing (internal audit) of the AFC program and tracks remediation of findings.
• Executive / Enterprise Risk Management Committee – senior management forum that integrates financial crime risk with other enterprise risks.
• AML/Financial Crime Compliance Committee (sometimes called the Financial Crime Risk Committee) – the main management-level body for AFC matters: reviews the enterprise-wide risk assessment, monitors KPIs/KRIs, approves high-risk customer exits or retentions, reviews policy changes, oversees remediation and regulatory interactions.
• Sanctions Committee – decisions on sanctions escalations, screening thresholds, and true-match handling.
• Reputational Risk / Client Acceptance Committee – approves onboarding or retention of high-risk relationships such as PEPs, correspondent banks, or MSBs.
• Regional or business-line committees – replicate the structure for subsidiaries or branches, with escalation to the group-level committee.

These committees embody the three lines of defense model: first line (business) owns and manages risk, second line (Compliance/Risk) sets standards and oversees, and third line (Internal Audit) independently tests. Committees are where the three lines meet, challenge each other, and where senior management exercises informed oversight.

3. What Terms of Reference (ToR) Are

Terms of Reference (also called a committee charter or mandate) is the governing document that defines a committee's existence and operation. Without a ToR, a committee lacks legitimacy and auditability. A well-drafted ToR typically includes:

• Purpose and objectives – why the committee exists and what outcomes it is meant to achieve.
• Authority and scope – what the committee can decide itself, what it must recommend upward, and what is outside its remit; its position in the governance hierarchy (to whom it reports, who reports to it).
• Membership – named roles (e.g., Chief Compliance Officer, MLRO/BSA Officer, Head of Operations, General Counsel, Chief Risk Officer, business heads), who chairs, who deputizes, whether attendees without voting rights (e.g., Internal Audit as observer) are permitted.
• Quorum and voting – minimum attendance for valid decisions, how decisions are taken (consensus, majority, chair's casting vote), conflict-of-interest handling.
• Frequency of meetings – e.g., monthly or quarterly, plus provision for ad hoc meetings for urgent escalations.
• Standing agenda and management information (MI) – required reports such as SAR/STR statistics, alert backlogs, screening performance, training completion, audit and regulatory findings, risk assessment updates, emerging typologies.
• Escalation and reporting lines – how and when matters move to a higher committee or the board, and what the committee itself must report upward.
• Secretariat and record-keeping – who prepares agendas, circulates papers, takes minutes, tracks actions, and how long records are retained.
• Review cycle – ToR should be reviewed and re-approved periodically (commonly annually) and whenever the organization or regulatory environment changes materially.

4. How It Works in Practice

Step 1 – Establishment. Senior management or the board approves the ToR, appointing members and defining the committee's mandate. The ToR itself should be approved by the body to which the committee reports (e.g., the AML Committee's ToR approved by the Executive Risk Committee or board).

Step 2 – Preparation. The secretariat (often within Compliance) collects MI dashboards, issue logs, and papers requiring decision, circulating them in advance so members can prepare.

Step 3 – Meeting. The chair confirms quorum, reviews previous actions, and works through the agenda. Compliance presents metrics and emerging risks; business lines explain first-line controls; Audit reports findings. Decisions are taken on items such as approving a revised risk appetite statement, accepting or exiting a high-risk client, allocating budget for a monitoring system upgrade, or escalating a regulatory breach.

Step 4 – Documentation. Minutes record attendance, discussion, challenges raised, decisions, rationale, dissent, and action owners with deadlines. This creates the audit trail that regulators and auditors examine to assess whether oversight was genuine rather than a 'rubber stamp'.

Step 5 – Escalation and follow-up. Items beyond the committee's authority or thresholds (e.g., a material regulatory finding, a systemic monitoring failure) are escalated per the ToR. Actions are tracked to closure; overdue items are reported upward.

Step 6 – Review. The committee periodically evaluates its own effectiveness and updates the ToR to reflect new products, jurisdictions, regulations or organizational change.

Key principles to remember: the board retains ultimate accountability and cannot delegate it away (it delegates authority, not responsibility); the compliance officer must have sufficient stature, independence and direct access to the board; committees must have genuine decision-making authority and documented evidence of challenge; and governance should be proportionate to the institution's size, complexity and risk profile (risk-based approach).

5. Common Weaknesses Tested in Exams

• Committees with no written ToR or outdated ToR.
• No quorum rules, so decisions are taken by whoever happens to attend.
• Compliance officer lacks a voting seat or reports to a business head who sits on the committee (independence conflict).
• Minutes that record only decisions, with no evidence of discussion or challenge.
• No escalation path from management committees to the board; board unaware of material issues.
• Action items never tracked; the same audit findings reappear year after year.
• Overlapping committees with unclear boundaries, leading to gaps where nobody owns an issue.
• MI that is too voluminous or too operational for senior decision-makers, or too thin to allow informed oversight.

6. Exam Tips: Answering Questions on Governance Committees and Terms of Reference

Tip 1 – Always anchor on accountability. If a question asks who is ultimately responsible for the AFC program or for approving the AML policy, the answer is the board of directors (or equivalent senior governing body), not the compliance officer, not the committee. The compliance officer is responsible for day-to-day administration; the committee provides management oversight; the board holds ultimate accountability.

Tip 2 – Look for the 'documented and approved' answer. CAMS questions favor options involving formal, written, approved documentation. If a scenario describes a committee operating informally, the best remedial action is usually to establish written Terms of Reference approved by senior management/board, defining scope, membership, quorum, frequency and escalation.

Tip 3 – Spot independence conflicts. Scenarios where the compliance officer reports to the head of a revenue-generating business, or where a business head chairs the AML committee and can override compliance decisions, point to a governance flaw. The correct answer typically restores independence: direct reporting line to the board or a board committee, voting authority for Compliance, or escalation rights.

Tip 4 – Apply the three lines of defense. When asked which function should perform a role (owning controls, setting policy, independent testing), map it to the first, second or third line. Internal Audit should test, not design or operate controls; it typically attends committees as an observer rather than a decision-maker on operational AML matters.

Tip 5 – Escalation is the answer to 'what should happen next'. If a scenario describes a material issue (e.g., monitoring system failure, regulatory breach, inability to exit a high-risk client) discovered at committee level, the right action is to escalate to the next governance tier per the ToR and document it—not to wait for the next scheduled meeting or handle it informally.

Tip 6 – Minutes and audit trail matter. Questions on what evidences effective governance point to minutes showing attendance, discussion, challenge, decisions, rationale and tracked actions. 'Decisions only' minutes are a red flag.

Tip 7 – Remember the review cycle. ToR, risk appetite statements and committee structures must be reviewed periodically (commonly annually) and upon material change (merger, new product, new jurisdiction, new regulation). Answers suggesting 'set once and leave' are wrong.

Tip 8 – Proportionality. A small institution does not need the same committee architecture as a global bank. If a question stresses a small firm, choose the answer that establishes clear ownership and board oversight in a proportionate manner rather than creating multiple layered committees.

Tip 9 – Eliminate distractors. Wrong answers often: (a) place accountability on a junior or operational role, (b) suggest the compliance officer acts alone without oversight, (c) involve the business overriding compliance decisions on commercial grounds, or (d) propose delaying action until a regulator intervenes. Rule these out quickly.

Tip 10 – Read for the 'best' or 'most appropriate' qualifier. Several options may be partially right; choose the one that is most comprehensive, most formal, and most aligned with regulator expectations (documented ToR, senior membership, regular MI, escalation to the board, independent testing).

7. Quick Revision Summary

• Governance committees give structure to AFC oversight; the board is ultimately accountable.
• Terms of Reference define purpose, authority, membership, chair, quorum, frequency, MI, escalation, record-keeping and review.
• Effective governance requires independence of Compliance, genuine challenge, documented minutes, tracked actions, clear escalation, and periodic review.
• In exam questions, favor answers that are formal, documented, board-approved, independent, escalated, and proportionate to risk.