Incorporating Guidance and Best Practice into Policies

1. Why This Topic Matters

An anti-financial crime (AFC) program is only as strong as the written framework that governs it. Laws and regulations set the legal minimum, but regulators, international standard-setters and industry bodies constantly publish guidance (interpretive material explaining how obligations should be met) and best practice (approaches recognised by the industry as effective, even where not mandated). Institutions that fail to absorb this material into their policies, procedures and controls fall behind evolving expectations, miss emerging typologies, and expose themselves to enforcement action, reputational damage and ineffective risk mitigation.

For the CAMS exam, this topic sits inside the AFC Program Governance and Risk Management domain. Examiners want to know that you understand (a) the difference between binding law, supervisory guidance and voluntary best practice, (b) the sources of that guidance, (c) how a compliance function translates external material into internal documents through a risk-based, governed process, and (d) the role of the board, senior management, the compliance officer and the three lines of defence in approving and maintaining those documents.

2. What It Is: Key Definitions

Policy - A high-level statement of the institution's position, appetite and commitment (for example, 'We do not maintain relationships with shell banks'). Policies are approved by the board of directors or a board-delegated committee and are written in a way that is stable over time.

Standard - A mandatory minimum requirement that gives more detail than a policy (for example, enhanced due diligence must be refreshed at least annually for high-risk customers).

Procedure - Step-by-step operational instructions describing how staff carry out the policy (for example, which screens to complete during onboarding, who approves exceptions, what evidence to retain).

Control - A specific activity, system or check that ensures the procedure is followed and the risk is mitigated (for example, automated sanctions screening at onboarding, dual approval of PEP relationships).

Law / Regulation - Legally binding obligations imposed by legislatures and regulators. Non-compliance carries legal penalties.

Guidance - Material issued by regulators, FIUs, supervisors or international bodies explaining how obligations should be interpreted and applied. It is usually not legally binding in itself, but supervisors expect institutions to consider it, and departures normally require a documented, risk-based justification.

Best Practice - Industry-accepted approaches that exceed or supplement regulatory requirements. Adoption is voluntary, but doing so demonstrates a mature, effective program and is often the yardstick used by examiners and correspondents.

3. Principal Sources of Guidance and Best Practice

International standard-setters:
- FATF - The 40 Recommendations, Interpretive Notes, the Methodology (technical compliance and effectiveness), risk-based approach guidance for specific sectors (banking, securities, virtual assets, legal professionals, money or value transfer services), typology and mutual evaluation reports, and the lists of high-risk and monitored jurisdictions (black and grey lists). FATF standards bind countries, not institutions directly, but they shape every national AML/CFT regime and institutions are expected to be aware of them.
- Basel Committee on Banking Supervision - Guidelines on the sound management of risks related to money laundering and financing of terrorism, customer due diligence for banks, and correspondent banking (including the annex on account opening and KYC risk management).
- Wolfsberg Group - Private-sector principles on correspondent banking, PEPs, private banking, trade finance, sanctions screening, payment transparency, the Correspondent Banking Due Diligence Questionnaire (CBDDQ) and the Financial Crime Compliance Questionnaire (FCCQ). Wolfsberg is the classic example of industry best practice.
- Egmont Group - Principles for FIU information exchange and operational guidance for FIUs.
- IMF, World Bank, UN, OECD - Assessments, conventions and technical assistance that influence national regimes.

National and regional regulators and FIUs:
- US: FinCEN advisories and guidance, the FFIEC BSA/AML Examination Manual, OFAC's Framework for Compliance Commitments, interagency statements.
- UK: JMLSG Guidance Notes (court-recognised guidance), FCA Financial Crime Guide, NCA alerts.
- EU: EBA Guidelines (for example on ML/TF risk factors), AML Directives and the AML Regulation, AMLA output.
- Other examples include MAS, HKMA, AUSTRAC, FINTRAC and similar bodies issuing circulars, risk assessments and typology reports.

Other inputs: National risk assessments, enforcement actions and consent orders (which reveal supervisory expectations), industry working groups and associations, peer benchmarking, internal audit findings, external consultant reviews and the institution's own lessons learned.

4. How It Works: Translating Guidance into Policy

A mature institution does not react to each publication in an ad hoc way. It runs a structured regulatory change management process, typically owned by the compliance function (second line of defence) and overseen by senior management and the board. The cycle looks like this:

Step 1 - Horizon scanning and identification. Compliance monitors regulator websites, FATF plenary outcomes, FIU advisories, industry bodies and enforcement actions. Many institutions maintain a regulatory inventory or obligations register and subscribe to alert services.

Step 2 - Applicability and impact assessment. Each item is assessed: Does it apply to our jurisdictions, products, customers and channels? Is it binding law, supervisory guidance or voluntary best practice? What is the effective date? Which business units and documents are affected? What is the risk if we do not adopt it?

Step 3 - Gap analysis. Current policies, procedures, controls and systems are compared with the new guidance to identify gaps. This step is almost always the correct first action in exam scenarios once a new piece of guidance has been identified as relevant.

Step 4 - Risk-based tailoring. Guidance is adapted to the institution's own enterprise-wide risk assessment, size, complexity, customer base and risk appetite. Copying another institution's policy or adopting every suggestion wholesale is not best practice. Where the institution decides not to follow a particular element of non-binding guidance, the rationale must be documented and approved.

Step 5 - Drafting and consultation. Compliance drafts or revises the policy, standard or procedure, consulting first-line business owners (who must operate the controls), legal, operations, technology and, where relevant, internal audit. The hierarchy must stay coherent: procedures should trace back to standards, and standards to board-approved policy.

Step 6 - Governance and approval. Policies are approved by the board or a designated board committee; standards and procedures may be approved at senior management or committee level according to a documented delegation framework. Approval is recorded in minutes with version control, effective dates and an owner for each document.

Step 7 - Implementation. Systems are configured, scenarios tuned, forms updated, and resources allocated. Changes are communicated to affected staff and incorporated into role-based training. Interim controls may be needed if system changes lag the effective date.

Step 8 - Monitoring, testing and review. Compliance performs quality assurance and testing; internal audit (third line) independently tests design and operating effectiveness. Policies are reviewed at least annually or sooner when triggered by new guidance, new products, material risk events, audit findings or regulatory feedback. Metrics and exceptions are reported to senior management and the board.

5. Guiding Principles the Exam Expects You to Apply

- Hierarchy of authority: Law and regulation always prevail. Guidance explains law and sets supervisory expectation. Best practice supplements both. When guidance conflicts with local law, local law is followed and the conflict is documented and escalated.
- Risk-based approach: FATF Recommendation 1 requires resources to be allocated according to risk. Guidance must be proportionate to the institution's own assessed risks, not applied mechanically.
- Board accountability: The board sets the tone at the top, approves AML/CFT policy, and must be informed of significant changes in regulatory expectations. Senior management is accountable for implementation. The compliance officer should have sufficient authority, independence and resources.
- Documentation: Regulators judge an institution on what it can evidence. Decisions, rationale for deviations, approvals, versions and training records must all be retained.
- Consistency across the group: Multinational institutions should apply group-wide policies that meet the higher of home or host standards, with documented local variations where law requires.
- Living documents: Policies are not written once. Outdated policies that do not reflect current guidance or current business are a frequent finding in enforcement actions.
- Three lines of defence: First line owns and operates controls, second line (compliance and risk) designs policy and oversees, third line (internal audit) independently tests. Policy incorporation involves all three.

6. Common Weaknesses Cited by Regulators

- Policies that restate the law but contain no institution-specific procedures.
- Procedures that are not aligned with the policy or with actual practice.
- Failure to update policies after new typologies, advisories or sanctions programs were published.
- No documented rationale for deviating from published guidance.
- Policies approved by management rather than the board, or approvals not minuted.
- Staff untrained on changes, so updated documents have no effect on behaviour.
- Group policies applied without regard to local legal requirements, or local branches ignoring group minimums.

7. Worked Examples

Example A: FinCEN issues an advisory describing red flags for trade-based money laundering. The correct institutional response is to assess relevance to the institution's trade finance exposure, map the red flags against existing monitoring scenarios and procedures, update the red-flag list and training, and document the review - not to simply forward the advisory by email.

Example B: The Wolfsberg Group updates its correspondent banking principles. A bank with respondent relationships should compare its due diligence questionnaire and risk rating approach against the revised principles, identify gaps, and present proposed policy changes to the appropriate committee. Because Wolfsberg is voluntary, the bank may tailor its adoption, but should record why any element is not adopted.

Example C: FATF adds a country to its list of jurisdictions under increased monitoring. The institution should check whether its country risk methodology and policy automatically capture FATF listings, update country risk ratings and apply any required enhanced due diligence, and confirm whether the national regulator has issued related instructions that make certain measures mandatory.

8. Exam Tips: Answering Questions on Incorporating Guidance and Best Practice into Policies

Tip 1 - Classify the source first. Ask yourself whether the item in the question is law, supervisory guidance or voluntary best practice. Answers that treat FATF Recommendations or Wolfsberg Principles as directly legally binding on an institution are usually wrong; answers that say they can be ignored because they are non-binding are also wrong. The correct stance is: consider, tailor, document.

Tip 2 - Look for the 'first step' trap. When a question asks what the compliance officer should do first or initially after new guidance is released, the best answer is normally to assess applicability and perform a gap analysis against existing policies and controls. Drafting new procedures, training staff or informing the board are later steps.

Tip 3 - The board approves policy. If an answer option has the compliance officer, the business line or the audit function approving the AML policy, it is likely a distractor. Senior management implements; the board (or its committee) approves and oversees.

Tip 4 - Reject copy-and-paste solutions. Options such as adopting a peer bank's policy, implementing every recommendation without assessment, or applying a one-size-fits-all approach contradict the risk-based approach and are almost never correct.

Tip 5 - Documentation and rationale. If the scenario involves deciding not to follow part of a guidance document, the best answer will include documenting the risk-based rationale and obtaining appropriate approval.

Tip 6 - Distinguish policy from procedure. Questions may test whether you know that a high-level commitment belongs in a policy while detailed steps belong in procedures. Mismatched placement is a common wrong-answer pattern.

Tip 7 - Home versus host. For multinational scenarios, the expected answer is usually to apply the stricter standard where legally permitted and to document and escalate conflicts where local law prevents compliance with group policy.

Tip 8 - Close the loop. Answers that end with 'update the policy' are incomplete if the scenario emphasises effectiveness. The strongest answer includes communication, training, control implementation and independent testing.

Tip 9 - Watch for timing cues. Phrases such as 'recently published', 'effective in six months' or 'the regulator has issued' signal a regulatory change management question. Phrases such as 'the audit found that procedures do not reflect' signal a governance and maintenance question where the answer involves root cause, remediation and ownership.

Tip 10 - Choose the most complete, governance-aligned option. CAMS questions frequently offer several partially correct answers. Select the one that reflects a structured, risk-based, documented and board-overseen process rather than an isolated action.

9. Quick Revision Summary

- Law is mandatory; guidance sets expectations; best practice is voluntary but demonstrates maturity.
- Key sources: FATF, Basel Committee, Wolfsberg Group, Egmont Group, national regulators and FIUs (FinCEN, FFIEC, OFAC, JMLSG, EBA, MAS and others), enforcement actions and national risk assessments.
- Process: scan, assess applicability, gap analysis, risk-based tailoring, draft with stakeholders, obtain approval, implement, train, test, review.
- Governance: board approves policy and sets tone; senior management implements; compliance designs and monitors; audit independently tests.
- Documents must be version-controlled, owned, reviewed at least annually and updated on trigger events.
- Always document the rationale for deviations from guidance.

Master these principles and you will be well prepared for any CAMS question that tests how an institution incorporates external guidance and industry best practice into a living, effective AFC policy framework.