Regulatory Examinations and Supervisory Cooperation

Why This Topic Matters

Anti-money laundering (AML) and counter-terrorist financing (CFT) laws are only as effective as the mechanisms that enforce them. Regulatory examinations are the primary way supervisors verify that financial institutions actually implement the controls the law requires, while supervisory cooperation ensures that criminals cannot exploit gaps between jurisdictions or between regulators of different sectors. For the CAMS exam, this topic sits inside the domain on International AFC Standards and Authorities and connects directly to the FATF Recommendations (notably Recommendations 26, 27, 34, and 40), the Basel Committee's guidance on sound AML/CFT risk management, and the practical realities a compliance officer faces when examiners arrive. Candidates who understand both the purpose and the mechanics of examinations and cooperation are well positioned to answer scenario-based questions that test judgment rather than memorization.

What Is a Regulatory Examination?

A regulatory examination (sometimes called an inspection, audit, or supervisory review) is a formal assessment conducted by a competent authority to determine whether a regulated entity complies with applicable AML/CFT laws, regulations, and supervisory expectations. Examiners evaluate the institution's AML program against legal requirements and against the institution's own risk profile.

Key characteristics of a regulatory examination include:

1. Legal authority. Supervisors derive their examination powers from statute. FATF Recommendation 27 requires that supervisors have adequate powers to monitor and ensure compliance, including the power to conduct inspections, compel production of information, and impose sanctions.

2. Risk-based scope. Under FATF Recommendation 26, supervisors should apply a risk-based approach to supervision, meaning the frequency and intensity of examinations are calibrated to the money laundering and terrorist financing risks posed by the institution, its products, customers, and geographies.

3. Focus on the five pillars. In the United States and in many other jurisdictions, examiners test the core program elements: internal policies, procedures, and controls; a designated compliance officer; ongoing training; independent testing; and customer due diligence (CDD) including beneficial ownership. Many jurisdictions frame these differently, but the substance is similar.

4. Outcomes. Examinations result in findings, which may range from minor observations to Matters Requiring Attention (MRAs), formal enforcement actions, consent orders, civil money penalties, or in extreme cases license revocation.

Who Conducts Examinations?

The identity of the examining authority depends on the jurisdiction and the type of institution. Examples include:

- Prudential bank regulators (for example, the OCC, Federal Reserve, and FDIC in the United States; the PRA and FCA in the United Kingdom; BaFin in Germany; the ECB for significant eurozone banks under the Single Supervisory Mechanism).
- Securities regulators (for example, the SEC and FINRA in the United States).
- Financial Intelligence Units (FIUs) in some jurisdictions that also hold supervisory powers, such as FinCEN's authority over certain non-bank financial institutions, or AUSTRAC in Australia which combines FIU and supervisory roles.
- Self-regulatory bodies for designated non-financial businesses and professions (DNFBPs), such as bar associations or accounting bodies, as contemplated by FATF Recommendation 28.
- Gaming commissions, insurance regulators, and money services business (MSB) licensing authorities.

The exam frequently tests whether a candidate understands that different types of institutions answer to different supervisors and that supervision of DNFBPs is a specific FATF expectation.

How a Regulatory Examination Works

Although details vary, most AML examinations follow a recognizable lifecycle:

1. Pre-examination planning. The supervisor reviews prior examination reports, the institution's risk assessment, suspicious activity reporting statistics, any self-reported issues, and public information. A first-day letter or document request list is issued, typically asking for the AML risk assessment, policies and procedures, board minutes, training records, independent audit reports, transaction monitoring documentation, and samples of customer files.

2. Scoping. Examiners decide which areas receive the most scrutiny based on risk. A bank with large correspondent banking relationships or significant exposure to high-risk jurisdictions will face deeper review of those areas.

3. Fieldwork. Examiners conduct interviews with the compliance officer, business line leaders, and sometimes board members. They perform transaction testing, review alert dispositions and suspicious activity report (SAR or STR) decisions, test CDD and enhanced due diligence (EDD) files, and assess the adequacy of staffing and technology. They evaluate whether the institution's actual practices match its written policies.

4. Evaluation of program effectiveness. Modern supervisors look beyond technical compliance to effectiveness: Is the program reasonably designed to detect and report suspicious activity given the institution's risk profile? Is governance adequate? Does the board receive meaningful information? Is there a culture of compliance?

5. Exit meeting and report. Preliminary findings are communicated, management has an opportunity to respond, and a written report of examination is issued. Findings are typically categorized by severity.

6. Remediation and follow-up. The institution submits a corrective action plan with deadlines. Supervisors track remediation and may conduct targeted follow-up examinations. Failure to remediate often escalates to formal enforcement.

Common Examination Findings

Candidates should recognize the typical deficiencies that examiners cite, because exam questions often describe a scenario and ask what the most significant weakness is:

- Inadequate or outdated AML risk assessment.
- Transaction monitoring systems with poorly calibrated thresholds or untested scenarios.
- Backlogs of unreviewed alerts.
- Weak CDD and beneficial ownership verification.
- Insufficient EDD on high-risk customers such as politically exposed persons (PEPs), correspondent banks, or cash-intensive businesses.
- Late or poor-quality suspicious activity reports.
- Lack of independence or depth in the independent testing function.
- Insufficient resources or compliance staff lacking authority.
- Inadequate board and senior management oversight.
- Failure to remediate prior findings (repeat findings are treated very seriously).

What Is Supervisory Cooperation?

Supervisory cooperation refers to the exchange of information and coordinated action among competent authorities, both domestically and across borders. Money laundering is inherently transnational and frequently crosses sectoral boundaries, so no single supervisor can see the full picture. Cooperation is addressed primarily in FATF Recommendations 2 (national cooperation and coordination) and 40 (other forms of international cooperation), supported by the Basel Committee's work on home-host supervision and the Egmont Group's framework for FIU-to-FIU exchange.

Supervisory cooperation takes several forms:

1. Domestic cooperation. Within a country, banking supervisors, securities regulators, FIUs, law enforcement, and policymakers must coordinate. FATF Recommendation 2 calls for national AML/CFT policies informed by identified risks and for mechanisms that enable cooperation and coordination among authorities. Examples include interagency task forces, information-sharing memoranda, and joint examinations.

2. Home-host supervision. When a bank operates across borders, the home supervisor (where the parent is headquartered) is responsible for consolidated supervision of the group, while host supervisors oversee branches and subsidiaries in their territories. The Basel Committee's Core Principles and its guidance on sound AML/CFT risk management emphasize that home and host supervisors should share information about group-wide AML programs, significant findings, and risks. Supervisory colleges bring together multiple regulators of a single large international bank.

3. Cross-border exchange between supervisors. FATF Recommendation 40 requires countries to ensure that their competent authorities can rapidly, constructively, and effectively provide the widest range of international cooperation. This includes exchanging information for supervisory purposes, conducting inquiries on behalf of foreign counterparts, and in some cases permitting foreign supervisors to conduct on-site visits of foreign branches. Memoranda of Understanding (MOUs) are the typical legal instrument.

4. FIU cooperation. Through the Egmont Group, FIUs exchange financial intelligence under principles of confidentiality and reciprocity. While FIU cooperation is distinct from supervisory cooperation, the two intersect, especially where the FIU also has supervisory powers.

5. Multilateral assessments. FATF and FATF-style regional bodies (FSRBs) conduct mutual evaluations that assess both technical compliance and effectiveness of a country's AML/CFT regime, including the quality of its supervision and its cooperation with other countries. Poor results can lead to a country being listed as a jurisdiction under increased monitoring or as a high-risk jurisdiction subject to a call for action.

Principles Governing Supervisory Cooperation

Several principles recur in FATF guidance and in exam questions:

- Confidentiality. Information exchanged must be protected and used only for the purpose for which it was requested, subject to prior consent for onward dissemination.
- No unduly restrictive conditions. Countries should not refuse cooperation on the sole grounds that the request involves fiscal matters, that secrecy or confidentiality laws apply to financial institutions, or that an inquiry is ongoing in the requested country.
- Dual criminality should be applied flexibly. Where dual criminality is required, it should be deemed satisfied if both countries criminalize the underlying conduct regardless of how the offense is named.
- Reciprocity and spontaneous exchange. Authorities should be able to exchange information both upon request and spontaneously.
- Clear channels and timeliness. Authorities should have clear processes for prioritizing and executing requests promptly.

Why Cooperation Matters to a Compliance Officer

Although cooperation is primarily an activity of authorities, it shapes the compliance environment. A global institution may receive information requests originating from a foreign supervisor through its home regulator. Group-wide programs must be designed so that information can flow to the parent for consolidated risk management, consistent with FATF Recommendation 18, while respecting local data protection and secrecy laws. When local law prevents implementation of group standards, the institution must apply appropriate additional measures and inform the home supervisor. Scenario questions on the exam often test this tension between group-wide consistency and local legal constraints.

Exam Tips: Answering Questions on Regulatory Examinations and Supervisory Cooperation

Tip 1: Anchor your answer in the risk-based approach. When a question asks how a supervisor should allocate examination resources or how often an institution should be examined, the correct answer almost always ties frequency and intensity to the institution's assessed risk, not to a fixed schedule or to institution size alone.

Tip 2: Know which FATF Recommendations govern the topic. Recommendation 26 covers regulation and supervision of financial institutions, Recommendation 27 covers powers of supervisors, Recommendation 28 covers DNFBPs, Recommendation 2 covers national cooperation, Recommendation 34 covers guidance and feedback to institutions, and Recommendation 40 covers international cooperation. You rarely need to cite numbers in an answer, but recognizing the concepts helps eliminate distractors.

Tip 3: Distinguish supervisors from FIUs and law enforcement. Exam questions sometimes present a scenario and ask who has authority. Remember that supervisors examine compliance programs and impose regulatory sanctions, FIUs receive and analyze suspicious transaction reports, and law enforcement investigates and prosecutes. Some authorities combine roles, but the question will usually make the distinction relevant.

Tip 4: In home-host scenarios, identify the responsibilities correctly. The home supervisor is responsible for consolidated group supervision; the host supervisor is responsible for the local entity's compliance with local law. Both should share information. If an answer choice suggests one supervisor has no role, it is likely incorrect.

Tip 5: Look for the most serious deficiency. When a scenario lists several weaknesses found during an examination, the exam often asks which is the greatest concern. Weaknesses in governance, repeat findings, failure to file suspicious activity reports, and systemic monitoring failures generally outrank isolated documentation lapses.

Tip 6: Prefer answers that reflect cooperation without violating confidentiality. If a question involves sharing information with a foreign authority, the correct answer typically involves using established channels (MOUs, home-host arrangements, Egmont channels) and respecting confidentiality and purpose limitations. Answers that involve informal, undocumented, or unrestricted sharing are usually wrong, as are answers that refuse cooperation solely because of bank secrecy laws.

Tip 7: Remember that remediation is tracked. Questions about what happens after an examination should reflect that institutions must submit corrective action plans, that supervisors verify remediation, and that unresolved findings escalate. An answer suggesting that a finding is closed once management acknowledges it is incomplete.

Tip 8: Recognize the compliance officer's role during an exam. Best practice includes preparing documentation in advance, designating a single point of contact for examiners, responding promptly and accurately to requests, being transparent about known weaknesses and remediation underway, and never obstructing or misleading examiners. Obstruction or providing false information to a supervisor is itself a serious violation and may be criminal.

Tip 9: Understand group-wide program expectations. If a scenario describes a foreign branch that cannot apply the parent's standards due to local law, the correct response is to apply additional measures to manage the risk and notify the home supervisor, not to simply exempt the branch or to ignore local law.

Tip 10: Read for the word that changes the answer. Terms such as most, first, best, primary, and least signal that several options may be partially correct. Prioritize based on risk, legal obligation, and the sequence in which a reasonable compliance professional would act.

Quick Review Summary

- Regulatory examinations verify that institutions comply with AML/CFT requirements and that their programs are effective relative to their risks.
- Supervisors must have adequate powers to inspect, compel information, and sanction, and they should apply a risk-based approach to the frequency and depth of supervision.
- Examinations follow a lifecycle: planning, scoping, fieldwork, evaluation, reporting, remediation, and follow-up.
- Common findings involve risk assessments, transaction monitoring, CDD and EDD, suspicious activity reporting, independent testing, resources, and governance.
- Supervisory cooperation occurs domestically and internationally, through home-host arrangements, supervisory colleges, MOUs, FIU networks such as Egmont, and multilateral mutual evaluations by FATF and FSRBs.
- Cooperation should be rapid, constructive, and effective, protected by confidentiality, and not refused on grounds of bank secrecy or fiscal character.
- For the exam, think like a risk-based supervisor and a transparent compliance officer, identify the most serious issue, and favor answers that use established, confidential, lawful channels of cooperation.