Three Lines of Defence Model

Why the Three Lines of Defence Model Matters

The Three Lines of Defence (3LoD) model is one of the most heavily examined governance concepts in the CAMS syllabus, and for good reason. It answers the single most important governance question in anti-financial crime (AFC): who is responsible for managing money laundering and terrorist financing risk, and who checks that they are doing it properly?

Regulators, including the Basel Committee on Banking Supervision in its guidance on the sound management of risks related to money laundering and financing of terrorism, and the Wolfsberg Group, expect financial institutions to organise their AFC programmes along these lines. When enforcement actions are published, a recurring theme is the breakdown of one or more lines: front-line staff who treated compliance as somebody else's job, compliance functions without authority or resources, or internal audit that never independently tested the AML programme. Understanding the model therefore helps you both pass the exam and understand real-world failures.

In the CAMS exam, the 3LoD model sits within the AFC Program Governance and Risk Management domain. Expect scenario-based questions that describe an activity or a person and ask you to identify which line of defence is involved, or that describe a governance weakness and ask what the appropriate fix is.

What the Three Lines of Defence Model Is

The model is a framework for allocating risk management and control responsibilities across an organisation. It separates three distinct roles:

1. First Line of Defence: Owning and managing risk. The business units and operational functions that generate risk and have direct contact with customers. They are responsible for identifying, assessing, controlling and mitigating risk in their day-to-day work.

2. Second Line of Defence: Oversight, monitoring and advice. The compliance function, the AML/CFT compliance officer (often called the MLRO or BSA Officer), and the risk management function. They design the framework, set policy, provide expertise and challenge, and monitor whether the first line is operating controls effectively.

3. Third Line of Defence: Independent assurance. Internal audit, which independently tests and evaluates the effectiveness of the first and second lines and reports its findings to the board or audit committee.

Sitting above all three lines are the board of directors and senior management, who have ultimate accountability for the AFC programme, set the tone from the top, approve the risk appetite and ensure each line is resourced and empowered. Outside the organisation sit external auditors and regulators, who provide additional assurance but are not formally part of the three internal lines.

How Each Line Works in an AFC Context

First Line of Defence: The Business
The first line includes relationship managers, branch and front-office staff, customer onboarding teams, operations and payments processing staff. Their AML responsibilities include:
- Performing customer identification and due diligence (CDD) and collecting KYC information at onboarding
- Identifying and escalating unusual or suspicious activity they observe
- Applying enhanced due diligence steps to higher-risk customers as required by policy
- Following the policies and procedures set by the second line
- Completing AML training and applying it in practice
- Owning the customer relationship and the risk that comes with it

A key exam point: the business owns the risk. A relationship manager who onboards a politically exposed person is responsible for gathering source-of-wealth information; compliance may review and approve, but it does not relieve the first line of its ownership. Many institutions also embed business-aligned control or quality assurance teams within the first line (sometimes called 1.5 or 1b); these still belong to the first line because they report into the business.

Second Line of Defence: Compliance and Risk Management
The AML compliance function is the heart of the second line. Its responsibilities include:
- Designing and maintaining the AML/CFT programme, policies and procedures
- Conducting or coordinating the enterprise-wide money laundering risk assessment
- Interpreting laws and regulations and advising the business on how to apply them
- Overseeing transaction monitoring, investigations and the filing of suspicious activity or transaction reports
- Sanctions screening oversight
- Developing and delivering AML training
- Monitoring and testing the first line's compliance with policy (compliance monitoring or compliance testing)
- Reporting to senior management and the board on the state of AML risk and the programme
- Liaising with regulators and law enforcement

The compliance officer must have sufficient authority, independence, seniority and resources, and should have direct access to the board or a board committee. The second line should not report to a business line head whose activities it oversees, because that would compromise its independence from the first line. Note, however, that the second line is not fully independent of the programme in the way internal audit is, because it designs and operates parts of the programme itself. This distinction is a frequent source of exam questions.

Third Line of Defence: Internal Audit
Internal audit provides independent, objective assurance that the AML/CFT programme is adequately designed and operating effectively. Its responsibilities include:
- Independently testing the AML programme, including CDD files, transaction monitoring, SAR/STR processes, sanctions screening, training and record keeping
- Evaluating whether the second line is effectively overseeing the first line
- Assessing the adequacy of the risk assessment and whether controls match the risk profile
- Reporting findings and recommendations to the audit committee or board
- Tracking remediation of findings to closure

Internal audit must be independent of both the business and the compliance function. Auditors should have sufficient AML expertise, and audits should be risk-based in frequency and depth. Where internal resources are lacking, the third line role can be outsourced to a qualified external party, but the institution retains responsibility for ensuring independent testing occurs.

The Role of the Board and Senior Management
Although not a line itself, governance from the top makes the model work. The board should approve the AML policy and risk appetite, receive regular reporting from the second and third lines, ensure the compliance officer and internal audit have adequate standing and resources, and hold the first line accountable. Failure of tone from the top is often the root cause when the three lines break down.

Common Weaknesses the Exam Tests

- Blurred lines: Compliance performing first-line tasks such as completing KYC forms on behalf of the business, which removes ownership from the first line and reduces compliance capacity for oversight.
- Lack of independence: The compliance officer reporting to the head of a revenue-generating business, or internal audit reporting to the compliance officer.
- Inadequate resources or expertise: An understaffed second line or an audit team with no AML knowledge.
- Missing third line: No independent testing, or testing performed by compliance itself and labelled as audit.
- Weak escalation: Findings that never reach the board, or remediation that is not tracked.
- Overlap and gaps: Each line assuming another line is responsible, leaving controls untested.

Note on the Updated IIA Three Lines Model

In 2020 the Institute of Internal Auditors refreshed the framework and renamed it the Three Lines Model, dropping the word defence to stress that the lines contribute to achieving objectives and creating value, not just defending against risk. The updated model emphasises the governing body's role, flexibility in how roles are structured, and collaboration between lines. For exam purposes the underlying allocation of responsibilities is unchanged: first line owns risk, second line oversees and advises, third line independently assures. If an exam question uses either name, treat them as the same concept.

Exam Tips: Answering Questions on the Three Lines of Defence Model

1. Ask who owns the customer. If the question describes an activity performed by someone with direct customer or transaction contact, such as onboarding, collecting identification, or noticing unusual behaviour, it is almost always the first line.

2. Look for the words policy, oversight, monitoring, advice and reporting. These signal the second line. Designing the programme, running the risk assessment, filing SARs/STRs, delivering training and reporting to the board are classic second-line functions.

3. Look for the words independent, testing, assurance and audit committee. These signal the third line. If the question involves evaluating whether the compliance programme itself is effective, the answer is internal audit, not compliance.

4. Distinguish compliance monitoring from internal audit. Compliance testing of the first line is second-line activity. Independent testing of the whole programme, including compliance, is third-line activity. Exam distractors often swap these.

5. Remember who is accountable at the top. When a question asks who has ultimate responsibility for the AML programme, the answer is the board of directors and senior management, not the compliance officer. The compliance officer is responsible for day-to-day management of the programme.

6. Independence questions have predictable answers. The compliance officer should not report to a business head they oversee and should have direct access to the board. Internal audit should not report to compliance. If an option proposes that compliance audits itself, it is wrong.

7. Spot the governance failure in scenarios. When a scenario describes a breakdown, identify which line failed. A relationship manager ignoring red flags is a first-line failure; compliance lacking authority to block a high-risk account is a second-line failure; no testing of the transaction monitoring system in years is a third-line failure.

8. Do not let compliance do the business's job. If an answer option suggests compliance should complete CDD or own customer risk ratings on behalf of the front office, it is generally the wrong choice because it undermines first-line ownership.

9. External parties are outside the three lines. Regulators and external auditors provide additional assurance but are not the third line. Do not select them when the question asks about the institution's internal lines of defence.

10. Read for the best answer, not just a correct one. CAMS questions often offer several plausible options. Choose the one that most precisely matches the role being described and preserves independence and accountability.

Quick Revision Summary

- First line: Business and operations; owns and manages risk; performs CDD, identifies and escalates suspicious activity; follows policy.
- Second line: Compliance and risk management; designs the programme, sets policy, monitors, advises, trains, files reports, reports to the board; must have authority and independence from the business.
- Third line: Internal audit; independent testing and assurance over both first and second lines; reports to the audit committee or board; may be outsourced but must remain independent.
- Board and senior management: Ultimate accountability, tone from the top, risk appetite, resourcing and oversight.
- Regulators and external auditors: External assurance, outside the three internal lines.

Master these distinctions and you will be able to answer almost any CAMS question on the Three Lines of Defence Model with confidence.