Delivery Channel Risk and Non-Face-to-Face Business

1. Why This Topic Matters

Delivery channel risk is one of the four classic pillars of an AML/CFT risk assessment, sitting alongside customer risk, product/service risk and geographic risk. The CAMS exam tests it heavily because the way a financial institution delivers its products determines how much it actually knows about the person on the other side of the transaction. When a customer walks into a branch, presents an original passport and speaks to a trained officer, the institution gains a rich set of verification signals. When a customer opens an account through a mobile app at 2 a.m. from an unknown device, or through an introducer in another jurisdiction, many of those signals disappear. Criminals understand this gap and deliberately choose channels that minimise scrutiny. Regulators, in turn, expect institutions to recognise the gap and compensate for it.

For the CAMS candidate, the topic is important for three reasons:
- It is explicitly referenced in FATF Recommendation 10 (Customer Due Diligence) as a higher-risk factor, and in the FATF Guidance on the Risk-Based Approach and on Digital Identity.
- It connects to many other syllabus areas: Customer Identification Programs (CIP), reliance on third parties, correspondent banking, prepaid cards, mobile money, virtual assets and FinTech.
- Exam questions frequently present a scenario involving online onboarding, an intermediary or an agent network and ask you to identify the risk or the correct mitigating control. If you cannot recognise a delivery channel issue when it is dressed up in a story, you will lose marks.

2. What Delivery Channel Risk Is

A delivery channel (sometimes called a distribution channel) is the medium through which an institution establishes a relationship with a customer, delivers products and services, and executes transactions. Common channels include:
- Physical branches and relationship managers (face-to-face).
- Internet banking and mobile banking apps.
- Telephone and call-centre banking.
- Automated teller machines (ATMs) and self-service kiosks.
- Agents, brokers, introducers and intermediaries (for example, mortgage brokers, independent financial advisers, insurance agents, lawyers or accountants acting as introducers).
- Correspondent banking relationships, where a bank provides services to another bank's customers it never meets.
- Payment processors, third-party payment providers and marketplace platforms.
- Remittance agent networks and money services businesses (MSBs).
- Prepaid card distributors and retail reload locations.
- Postal or mail-based account opening.

Delivery channel risk is the money laundering and terrorist financing risk that arises from the characteristics of the channel itself: the degree of anonymity it allows, the difficulty of verifying identity, the speed and volume of transactions it enables, the involvement of third parties between the institution and the customer, and the geographic reach it provides.

Non-face-to-face business is the subset of delivery channel risk that concerns relationships established or operated without the customer being physically present. FATF and most national regulators treat non-face-to-face relationships as a factor that may indicate higher risk, and require that institutions apply policies and procedures to address the specific risks involved. Note the careful wording: non-face-to-face is a risk indicator, not an automatic prohibition. Many legitimate, low-risk customers are onboarded remotely every day. The regulatory expectation is that the institution understands the heightened risk and applies proportionate controls.

3. The Specific Risks Non-Face-to-Face Business Creates

Identity fraud and impersonation. Without physical presence it is easier for a criminal to present stolen or forged documents, use a synthetic identity built from fragments of real data, or impersonate a real person. The institution cannot compare a face to a photograph or feel the security features of a document.

Anonymity and straw men. Remote channels make it easier for the true controller of an account to hide behind a nominee or money mule. The person who passed the onboarding checks may not be the person operating the account.

Layering through speed and volume. Online and mobile channels allow large numbers of transactions to be executed quickly, often across borders, which suits the layering stage of money laundering. Funds can be moved through multiple accounts before monitoring systems or staff react.

Reduced opportunity for behavioural observation. Branch staff can notice nervousness, coaching by a third party, inconsistent stories or a customer who does not understand their own business. These soft indicators are lost in remote channels.

Third-party dependence. When introducers, agents or correspondent banks perform customer due diligence (CDD) on the institution's behalf, the institution relies on the quality of someone else's work. If the third party is negligent, complicit or located in a weakly regulated jurisdiction, the institution inherits the deficiency but still bears the regulatory responsibility.

Jurisdictional reach. Remote channels allow customers from anywhere to apply, including from high-risk or sanctioned jurisdictions, and allow the use of VPNs or IP masking to disguise true location.

Account takeover and mule recruitment. Digital channels are vulnerable to credential theft, SIM swapping and social engineering, and criminals actively recruit account holders to receive and forward illicit funds.

Gaming of automated controls. Criminals test onboarding systems to learn thresholds and rules, then structure applications and transactions to stay beneath them.

4. How the Framework Works: Regulatory Expectations

FATF Recommendation 10 and Interpretive Note. The Interpretive Note lists examples of potentially higher-risk situations. Under delivery channel risk factors it names non-face-to-face business relationships or transactions, and payments received from unknown or unassociated third parties. The Note also lists reliance on introducers or intermediaries as a situation requiring attention. Where higher risk is identified, enhanced due diligence (EDD) is expected.

FATF Recommendation 15 (New Technologies). Institutions must identify and assess the ML/TF risks of new products, business practices and delivery mechanisms, and of new or developing technologies, before launch. This is directly relevant to digital onboarding, mobile wallets and app-based lending.

FATF Recommendation 17 (Reliance on Third Parties). Institutions may rely on third parties to perform elements of CDD, provided the relying institution: obtains the necessary CDD information immediately; is satisfied that copies of documentation will be made available without delay on request; is satisfied the third party is regulated, supervised and has AML measures in line with Recommendations 10 and 11; and considers country risk. Crucially, ultimate responsibility remains with the relying institution. This point is a favourite exam question.

FATF Guidance on Digital Identity (2020). This guidance changed the conversation by stating that non-face-to-face onboarding using reliable, independent digital ID systems with appropriate assurance levels may present a standard or even lower level of risk, not automatically a higher one. The key is the reliability of the digital ID system and the assurance level of identity proofing and authentication. Candidates should know this nuance: modern thinking is that non-face-to-face is not inherently high-risk if strong technology is used.

Basel Committee guidance on CDD. The Basel Committee has long required that institutions apply equally effective identification procedures and ongoing monitoring standards for non-face-to-face customers as for those available for interview, and highlights the need to address the risk of impersonation.

USA PATRIOT Act Section 326 and the CIP Rule. US institutions must have a Customer Identification Program that includes documentary and/or non-documentary verification methods. Non-documentary methods, such as contacting the customer, comparing information against consumer reporting agencies and public databases, or checking references with other institutions, are explicitly contemplated for situations where the customer does not appear in person. The CIP must also address circumstances in which the institution cannot verify identity and the actions to take, including not opening the account, closing it, or filing a Suspicious Activity Report (SAR).

European Union AML Directives. The EU directives list non-face-to-face relationships without safeguards such as electronic identification means under eIDAS as a factor of potentially higher risk in the annex of risk factors, and the Sixth Directive regime continues the emphasis on reliable remote identification.

Wolfsberg Group guidance. Wolfsberg publications on correspondent banking, payment transparency and digital customer lifecycle risk management reinforce that the degree of control over the customer relationship diminishes as intermediaries are added, and that institutions must compensate with information gathering and monitoring.

5. How Mitigation Works in Practice

The core principle is compensating controls: whatever the channel removes, the institution must replace with alternative safeguards until the residual risk is within appetite. Typical measures include:

Identity verification enhancements
- Requiring certified or notarised copies of identity documents where originals cannot be inspected.
- Independent electronic verification against credit bureaus, government registries, electoral rolls and utility records.
- Biometric checks such as facial recognition with liveness detection to match a selfie to the document photo and confirm a live human.
- Video identification with trained staff, which some jurisdictions treat as equivalent to face-to-face.
- Use of government-backed or regulated digital identity schemes with high assurance levels.
- Device fingerprinting, geolocation and IP analysis to detect VPN use, emulators or mismatches between claimed and actual location.
- Requiring the first payment to come from an account in the customer's own name at a regulated institution (sometimes called a 'first-funds' or 'linked account' control).

Relationship controls
- Transaction and balance limits for remotely onboarded customers until additional verification is completed.
- Restricting certain high-risk products (cash services, international wires, third-party payments) to customers who have completed enhanced verification.
- Multi-factor authentication for login and for high-value or new-payee transactions.
- Callbacks to independently verified telephone numbers for unusual instructions.

Third-party and intermediary controls
- Documented reliance agreements specifying which CDD elements the third party performs and the obligation to provide records on request.
- Due diligence on the intermediary itself: licensing, regulatory status, ownership, AML program quality, sample testing of its files.
- Periodic audits and site visits of agents and introducers.
- Monitoring introducer-level patterns, for example an introducer whose customers show disproportionate alerts or rapid account closures.
- For correspondent banking, applying the full set of Recommendation 13 measures: understanding the respondent's business, reputation and supervision; assessing its AML controls; obtaining senior management approval; documenting responsibilities; and addressing payable-through accounts and nested relationships.

Ongoing monitoring tuned to the channel
- Scenario rules specific to digital channels: rapid pass-through of funds, dormant accounts suddenly active, multiple accounts opened from one device or IP address, logins from inconsistent geographies, many accounts sharing a telephone number or address.
- Account takeover indicators: changed contact details followed immediately by new payees and outbound transfers.
- Mule indicators: young or low-income account holders receiving round-sum inbound payments that are promptly forwarded or withdrawn.

Governance
- Including delivery channel risk explicitly in the enterprise-wide risk assessment and in the customer risk rating methodology.
- New product approval processes that assess channel risk before launch, satisfying Recommendation 15.
- Training frontline digital teams and agents on red flags relevant to their channel.

6. Worked Illustrations

Illustration A. A neobank onboards customers entirely by app. Applicants upload a passport image and a selfie. A monitoring review finds forty accounts opened within two days using different names but the same device identifier, each receiving inbound transfers from e-commerce platforms and forwarding funds to a single overseas beneficiary. The delivery channel issue is the absence of physical presence, which enabled synthetic or stolen identities; the compensating control failures are the lack of device-level de-duplication at onboarding and weak liveness detection. Appropriate responses include freezing and reviewing the accounts, filing suspicious activity reports, and remediating onboarding controls.

Illustration B. A private bank accepts new clients introduced by a law firm in an offshore jurisdiction under a reliance arrangement. The law firm provides a summary letter stating that CDD has been performed but declines to share underlying documents, citing client confidentiality. Under Recommendation 17 the bank cannot properly rely on this third party because it cannot obtain documentation without delay on request, and the bank retains ultimate responsibility. The correct action is to perform its own CDD or decline the relationships.

Illustration C. An MSB operates through 300 retail agents. One agent's location processes outbound remittances to a high-risk corridor at ten times the network average, with many senders using sequential identity document numbers. The channel risk is the agent layer; the agent may be complicit or negligent. Controls include agent-level monitoring, unannounced inspections, retraining or termination, and reporting.

7. How to Answer Exam Questions on This Topic

CAMS questions are scenario-based and often ask for the best or most appropriate answer among several plausible options. Use the following approach:

Step 1: Identify the channel. Read the scenario and ask: how did this customer come to the institution, and how are transactions being executed? Branch, online, mobile, telephone, agent, introducer, correspondent or platform? Naming the channel in your mind immediately narrows the relevant risks.

Step 2: Identify what the channel removes. Physical document inspection? Behavioural observation? Direct knowledge of the customer? Control over who performs CDD? The answer that best restores the missing element is usually correct.

Step 3: Apply the risk-based approach, not absolutes. Answers that say an institution must never onboard non-face-to-face customers, or must always treat them as high-risk, are usually wrong. FATF treats non-face-to-face as a potentially higher-risk factor to be assessed and mitigated, and the Digital ID Guidance allows reliable digital identity to lower the risk.

Step 4: Remember who holds responsibility. If the question involves introducers, agents or third parties, the responsibility for CDD remains with the institution. Any answer that shifts ultimate accountability to the third party is incorrect.

Step 5: Sequence actions correctly. When asked what to do first, escalation and investigation generally precede customer contact. Do not choose an answer that involves tipping off the customer, and do not choose an answer that closes the account before any review when a suspicious activity report may be required.

Step 6: Match the control to the risk. If the risk is impersonation, the control is identity verification strength (biometrics, independent databases, certified documents). If the risk is velocity and layering, the control is monitoring and transaction limits. If the risk is intermediary quality, the control is due diligence and audit of the intermediary. Mismatched controls are common distractors.

Step 7: Watch for Recommendation 15 triggers. If the scenario involves launching a new app, a new payment method or a new agent model, the correct answer usually involves conducting a risk assessment before launch.

8. Exam Tips: Answering Questions on Delivery Channel Risk and Non-Face-to-Face Business

Tip 1: Know the four risk categories. Customer, product/service, geography and delivery channel. If a question asks which category a given fact belongs to, online account opening, use of intermediaries and correspondent relationships all fall under delivery channel.

Tip 2: Memorise the Recommendation 17 conditions. Immediate access to CDD information, documents available without delay on request, the third party is regulated and supervised with adequate AML measures, country risk considered, and ultimate responsibility retained. Expect at least one question built around a missing condition.

Tip 3: Distinguish reliance from outsourcing and from introduction. Reliance means the third party performs CDD and the institution relies on it under Recommendation 17. Outsourcing means a service provider acts as the institution's agent under contract and the institution remains fully in control. An introducer may simply refer business without any reliance arrangement, in which case the institution must perform full CDD itself.

Tip 4: Non-face-to-face is not automatically high-risk. The exam reflects updated FATF thinking. Where a scenario describes robust digital identity verification with high assurance, the correct risk rating may be standard. Where it describes weak or no verification, the rating should be elevated and EDD applied.

Tip 5: Look for the 'first payment' control. Requiring the initial funding to come from an account in the customer's own name at a regulated bank is a classic non-face-to-face mitigant and appears frequently as a correct answer.

Tip 6: Correspondent banking is a delivery channel issue. The correspondent is providing services to customers it does not meet. Questions about nested correspondents, payable-through accounts and shell banks test this concept; remember that relationships with shell banks are prohibited outright.

Tip 7: Recognise mule and account takeover red flags. Round-sum inbound payments quickly forwarded, changed contact details followed by new payees, multiple accounts sharing a device or address, and logins from locations inconsistent with the customer profile are all channel-related indicators the exam expects you to spot.

Tip 8: Eliminate absolutes and extremes. Options containing 'always', 'never', 'immediately close' or 'refuse all' are usually distractors unless the scenario describes a legally prohibited situation such as a shell bank or a sanctioned party.

Tip 9: Favour answers that gather information and document. Where the question is about the compliance officer's next step, options involving obtaining additional verification, reviewing the intermediary's controls, escalating internally or documenting the risk assessment are typically stronger than options involving customer confrontation or unilateral action.

Tip 10: Connect to new technology assessment. If a business unit wants to launch a new remote onboarding tool, agent network or payment product, the compliance answer is to assess the ML/TF risk and design controls before go-live, consistent with Recommendation 15. An answer that defers the assessment until after launch is wrong.

Tip 11: Keep the tipping-off rule in view. No matter how the channel question is framed, never select an answer in which the institution tells the customer or the introducer that a suspicious activity report has been or will be filed.

Tip 12: Read for the word 'ultimately'. When a question asks who is ultimately responsible for CDD in a reliance or agency arrangement, the answer is the financial institution that owns the customer relationship, not the agent, introducer or technology vendor.

9. Quick Revision Summary

- Delivery channel risk concerns how products reach customers and how much the institution truly knows about the person it serves.
- Non-face-to-face business is a potentially higher-risk factor under FATF Recommendation 10, not an automatic high-risk classification.
- Key risks: impersonation, synthetic identity, anonymity, speed and volume, loss of behavioural cues, third-party dependence, jurisdictional reach, account takeover and mule activity.
- Key controls: stronger and independent identity verification, biometrics and digital ID, first-payment rules, transaction limits, multi-factor authentication, intermediary due diligence and audit, channel-specific monitoring and pre-launch risk assessment.
- Reliance on third parties is permitted under Recommendation 17 only with strict conditions, and ultimate responsibility never transfers.
- In the exam, identify the channel, identify what it removes, choose the proportionate compensating control, avoid absolutes, protect against tipping off, and remember who is accountable.