Policies, Standards and Procedures: Hierarchy and Content

1. Why This Topic Matters

Every anti-financial crime (AFC) programme, whether it covers anti-money laundering (AML), counter-terrorist financing (CTF), sanctions, anti-bribery or fraud, rests on a written framework of policies, standards and procedures. Regulators, auditors and the CAMS exam all treat this documentation hierarchy as the backbone of programme governance for several reasons:

• Regulatory expectation. FATF Recommendation 18 requires financial institutions to implement programmes against money laundering and terrorist financing that include internal policies, procedures and controls. In the United States the first pillar of a Bank Secrecy Act (BSA) compliance programme is a system of internal controls, which must be documented. The EU Anti-Money Laundering Directives, the UK Money Laundering Regulations, MAS Notices in Singapore and virtually every other regime impose similar requirements.
• Evidence of a culture of compliance. A board-approved policy demonstrates tone from the top. Detailed procedures demonstrate that the tone has been translated into day-to-day behaviour.
• Consistency and defensibility. When an examiner asks why a customer was onboarded or why an alert was closed, the institution must point to a documented, approved standard that was followed. Without the hierarchy, decisions look arbitrary.
• Accountability. The hierarchy makes clear who owns what: the board approves policy, senior management owns standards, operational units own procedures.
• Risk-based approach. Policies articulate risk appetite; standards translate appetite into minimum controls; procedures ensure controls are executed. Weakness at any level undermines the risk-based approach that regulators now demand.

In the CAMS exam, this topic sits within the AFC Program Governance and Risk Management domain. Questions tend to test whether you understand the distinction between the three document types, the appropriate approval level for each, and what content belongs where.

2. What It Is: Defining the Three Tiers

Think of the hierarchy as a pyramid. At the top sit a small number of high-level policies; beneath them a larger set of standards; at the base a large body of detailed procedures. Each tier derives its authority from the tier above and must be consistent with it.

Policy – the WHAT and the WHY
A policy is a high-level statement of the institution's commitment, principles and risk appetite. It answers: What does the institution require, and why?
Key characteristics:
• Approved by the board of directors (or an equivalent governing body) and reviewed at least annually or when there is a material change in law, business or risk.
• Enterprise-wide in scope, applying to all business lines, legal entities and jurisdictions (with a mechanism to address stricter local law).
• Relatively short, stable and principle-based; it should not need rewriting every time a system changes.
• Establishes roles and responsibilities at a senior level: the board, senior management, the AML/BSA Compliance Officer (MLRO), the three lines of defence.
• Identifies the regulatory basis and the consequences of non-compliance.

Typical AFC policy content:
• Purpose, scope and applicability
• Statement of commitment and risk appetite (for example, prohibition on shell banks, prohibited customer types, prohibited jurisdictions)
• Governance structure and accountabilities
• Reference to the five core components: internal controls, designated compliance officer, training, independent testing, and customer due diligence (CDD)
• High-level requirements for risk assessment, CDD/EDD, monitoring, reporting of suspicious activity, record keeping, sanctions screening
• Escalation and whistleblowing commitment
• Review and approval cycle

Standards – the minimum requirements
Standards (sometimes called minimum standards, group standards or control standards) sit beneath policy and set out mandatory, measurable requirements that must be met across the organisation to comply with the policy. They answer: What specifically must be done to meet the policy?
Key characteristics:
• Approved by senior management or a senior compliance committee, often with the Chief Compliance Officer or MLRO as owner.
• More detailed than policy but still technology- and location-neutral where possible.
• Define the baseline below which no business unit or jurisdiction may fall; local units may apply stricter requirements where local law or risk requires.
• Create the measurable criteria against which audit and compliance testing can assess adherence.

Typical AFC standards content:
• Customer risk rating methodology and the factors that drive it (customer type, geography, product, channel)
• Minimum CDD data elements and documentation for each customer type
• Beneficial ownership threshold (for example 25 percent, or lower for higher-risk customers) and verification requirements
• Triggers for enhanced due diligence (PEPs, correspondent banking, high-risk jurisdictions, cash-intensive businesses)
• Frequency of periodic review by risk tier (for example high risk annually, medium every two years, low every three to five years)
• Transaction monitoring coverage expectations and alert disposition timeframes
• Suspicious activity reporting decision timelines and documentation requirements
• Sanctions screening scope (customers, counterparties, payments) and list requirements
• Record retention periods (typically five years minimum, longer where required)
• Training frequency and target audiences
• Quality assurance and management information requirements

Procedures – the HOW
Procedures are step-by-step operational instructions that tell staff exactly how to perform a task in compliance with the standards. They answer: How, by whom, using which system, and in what order?
Key characteristics:
• Approved by business or operational management, often with compliance sign-off, and owned by the function that performs the work.
• Highly detailed, system-specific and jurisdiction-specific; frequently updated as systems and processes change.
• Often accompanied by desk instructions, job aids, checklists, workflow diagrams and screenshots.
• Designed so that a new employee can perform the task consistently.

Typical AFC procedure content:
• Onboarding workflow: which screens to complete, which documents to collect for each entity type, how to perform and record screening, how to escalate a hit
• Alert investigation procedure: how to review an alert, what research to perform, how to document the rationale, timeframes for each stage, escalation paths for suspicious activity
• SAR/STR filing procedure: who drafts, who reviews, how the narrative is structured, filing mechanism, confidentiality controls
• Sanctions hit handling: how to clear a false positive, who can release a payment, how to block or reject
• Periodic review procedure and remediation of missing information
• Record retention and retrieval steps
• Exception and waiver request procedure

Guidelines and job aids
Some institutions add a fourth informal layer: guidelines, frequently asked questions, red-flag lists and typology guides. These are advisory rather than mandatory and help staff exercise judgement. In exam questions, if an option describes something as recommended but not required, it is describing a guideline, not a policy, standard or procedure.

3. How the Hierarchy Works in Practice

Cascading authority. The board sets policy. Senior management writes standards that operationalise policy. Business units write procedures that execute standards. Each lower document must cite and conform to the document above it. A procedure can be more restrictive than a standard but never more permissive. If a conflict arises, the higher-level document prevails and the lower one must be corrected.

Link to the enterprise-wide risk assessment. The AFC risk assessment identifies inherent risk, control effectiveness and residual risk across customers, products, geographies and channels. Policy sets the appetite for residual risk; standards are calibrated to bring risk within appetite; procedures implement the controls. When the risk assessment changes (for example, entry into a new market or product), the documentation hierarchy should be reviewed and updated.

Ownership and the three lines of defence.
• First line (business): owns and executes procedures, identifies gaps, requests changes.
• Second line (compliance/risk): owns policy drafting and standards, provides advice, challenges the first line, monitors adherence.
• Third line (internal audit): independently tests whether policy, standards and procedures exist, are approved, are adequate and are followed.

Document lifecycle controls. Mature programmes maintain:
• A central repository with version control, approval dates, owners and next review dates
• A formal change management process, including impact assessment and communication
• Annual review (or risk-triggered review) with evidence of board or senior management approval
• Mapping of regulatory obligations to policy clauses, standards and procedures so that regulatory change can be traced through the hierarchy
• Communication and training when documents change, with attestation where appropriate

Exceptions and waivers. A credible programme includes a process for exceptions. Exceptions to policy require the highest approval (often the board or a board committee). Exceptions to standards require senior management or the compliance officer. Exceptions should be time-limited, documented, risk-assessed and tracked.

Group versus local. Multinational institutions adopt a group policy and group minimum standards. Local entities apply the stricter of group standards or local law. Where local law prohibits implementation of group standards (for example data privacy restrictions on information sharing), FATF requires the group to apply additional measures and inform the home supervisor. Procedures are almost always local.

Common deficiencies cited by regulators.
• Policy exists but is not board-approved or has not been reviewed for years
• Standards are vague and not measurable, so adherence cannot be tested
• Procedures contradict standards or describe processes no longer in use
• Staff are unaware of documents or cannot locate them
• No link between the risk assessment and the controls described in the documents
• Exceptions granted informally without documentation
• Documents copied from a template without tailoring to the institution's actual risk profile

4. How to Answer Exam Questions on This Topic

CAMS questions are scenario-based and typically ask you to identify the best or most appropriate answer. On this topic they usually test one of the following:

(a) Classification questions. You are given a description and asked whether it belongs in a policy, standard or procedure. Use the verb test:
• If it states a commitment, principle, prohibition or appetite and is approved by the board, it is a policy.
• If it states a measurable minimum requirement that applies organisation-wide (thresholds, frequencies, mandatory data elements), it is a standard.
• If it describes steps, systems, screens, roles and sequence, it is a procedure.

(b) Approval-level questions. Who should approve a change? Board for policy; senior management or senior compliance committee for standards; business/operational management (with compliance review) for procedures. If an option has the board approving a system screenshot change, eliminate it. If an option has a line manager approving the enterprise risk appetite, eliminate it.

(c) Content-gap questions. A scenario describes an institution's documentation and asks what is missing or what the compliance officer should do first. Look for the absence of a core element (independent testing, designated officer, training, CDD, internal controls), the absence of board approval, the absence of a review cycle, or a mismatch between the risk assessment and the controls described.

(d) Conflict-resolution questions. A procedure permits something a policy prohibits. The correct answer is to apply the higher-level document and remediate the lower-level one, not to grant an informal exception.

(e) Role questions. Who writes, who challenges, who tests? Business writes procedures; compliance drafts policy and standards and advises; internal audit independently tests. Internal audit does not write policy because that would compromise independence.

(f) Risk-based approach questions. The best answer usually links documentation to the institution's own risk assessment rather than to a generic template or to the lowest common denominator across jurisdictions.

5. Exam Tips: Answering Questions on Policies, Standards and Procedures: Hierarchy and Content

Tip 1 – Memorise the three-word anchors. Policy = what and why (board). Standard = minimum requirement (senior management). Procedure = how (operations). Most questions can be resolved by matching the scenario to one anchor.

Tip 2 – Watch the approval level. The exam loves to put the right document with the wrong approver. The board approves policy; it does not approve desk procedures. Compliance officers do not unilaterally approve enterprise policy; they recommend it to the board.

Tip 3 – Specificity signals the tier. The more detailed and system-specific the content (screen names, thresholds for a particular branch, click-by-click steps), the lower in the hierarchy it belongs. The more principle-based and durable, the higher.

Tip 4 – Look for the word board-approved. When a question asks what demonstrates senior-level commitment, culture of compliance or tone from the top, the answer involving a board-approved policy is almost always correct.

Tip 5 – Higher document wins. In any conflict, the policy prevails over the standard, and the standard prevails over the procedure. The remedy is to update the lower-level document, never to ignore the policy.

Tip 6 – Stricter prevails. In group-versus-local questions, the correct answer applies the stricter of group standards and local law. If local law prevents compliance with group standards, inform the home regulator and apply additional mitigating measures.

Tip 7 – Independence of audit. If an option has internal audit writing or approving the AML policy, eliminate it. Audit tests; it does not design.

Tip 8 – Risk assessment comes first. When asked what should drive the content of policies, standards and procedures, choose the enterprise-wide risk assessment over regulatory templates, peer practice or past audit findings alone.

Tip 9 – Documented and reviewed. Watch for scenarios where documents exist but have not been reviewed in years, are not version-controlled, or are not communicated to staff. The best answer usually involves updating, re-approving and training, not merely redistributing.

Tip 10 – Measurability matters for standards. If a question asks why an auditor could not test adherence, the likely cause is that standards are vague and not measurable. Standards should state thresholds, frequencies and required data elements.

Tip 11 – Exceptions need formality. Any option describing a verbal or undocumented exception is wrong. Exceptions must be documented, approved at the appropriate level, time-limited and tracked.

Tip 12 – Eliminate the extremes. Options that say no policy is needed because procedures are detailed, or a single document can serve as policy, standard and procedure for a large multinational, are distractors. The exam rewards a structured, proportionate hierarchy.

Tip 13 – Read for the question stem. Distinguish between what should the compliance officer do first (usually assess, escalate or update the controlling document) and what is the most significant deficiency (usually the missing core element or missing board approval).

6. Worked Example

Scenario: A regional bank's AML policy, approved by the board three years ago, prohibits relationships with shell banks. A newly issued correspondent banking procedure, approved by the head of the payments department, allows account opening for respondent banks without verifying physical presence if the bank is licensed. Internal audit identifies the discrepancy. What should the compliance officer do?

Analysis: The procedure is more permissive than the policy. The policy, being the higher-level and board-approved document, prevails. The procedure was approved at an appropriate level for a procedure, but its content conflicts with policy, so compliance should have reviewed it before issuance. The correct action is to suspend or correct the procedure to require physical-presence verification, review any accounts opened under the defective procedure, and strengthen the change control process so compliance reviews procedures before release. Additionally, the policy's three-year-old approval indicates the annual review cycle has lapsed, which is a secondary deficiency to remediate.

Distractors to eliminate: seeking board approval to amend the policy to match the procedure (reverses the hierarchy and weakens controls), asking internal audit to rewrite the procedure (compromises independence), or continuing under the procedure until the next policy review (ignores the controlling document).

7. Quick Revision Summary

• Policy: board-approved, enterprise-wide, principle-based, states commitment, scope, governance, risk appetite and the core programme components.
• Standards: senior-management-approved, mandatory, measurable minimums covering risk rating, CDD/EDD, monitoring, reporting, screening, record keeping, training and review frequencies.
• Procedures: operationally approved, step-by-step, system- and location-specific instructions supported by job aids and checklists.
• Guidelines: advisory, support judgement, not mandatory.
• Lower documents must conform to higher ones; stricter of group and local law applies; conflicts are resolved upward.
• Second line drafts and advises, first line executes, third line tests.
• Everything must be documented, version-controlled, approved, periodically reviewed, communicated and trained.

Master these distinctions and you will be able to handle the majority of CAMS questions in this area with confidence.