An Anti-Financial Crime (AFC) compliance program is built on a set of foundational pillars that, taken together, enable an institution to prevent, detect, and report money laundering, terrorist financing, sanctions evasion, fraud, and related crimes. In the CAMS framework for program governance and risk management, these pillars reflect regulatory expectations (e.g., U.S. Bank Secrecy Act, FATF Recommendations, EU AML Directives) and global best practice.

1. Internal Policies, Procedures, and Controls: Documented, board-approved policies that translate legal obligations into operational rules. Controls include customer identification, transaction monitoring, sanctions screening, record keeping, and escalation processes, all tailored to the institution's size, products, and geographies.

2. Designated Compliance Officer: A qualified individual (often the BSA/AML or MLRO) with sufficient authority, independence, and resources to oversee the program, report to senior management and the board, and serve as the liaison with regulators and law enforcement.

3. Ongoing Training: Role-specific, regularly updated training for employees, management, and the board so staff understand red flags, their responsibilities, and how to escalate concerns. Training records should be maintained as evidence.

4. Independent Testing (Audit): Periodic, independent review by internal audit or a qualified third party to assess program design, effectiveness, and compliance with regulations, with findings tracked to remediation.

5. Customer Due Diligence (CDD) and Risk-Based Approach: Often called the 'fifth pillar' (formalized in the U.S. FinCEN CDD Rule), this requires identifying and verifying customers and beneficial owners, understanding the nature and purpose of relationships, developing risk profiles, and applying enhanced due diligence to higher-risk customers, with ongoing monitoring.

Underpinning all pillars is an enterprise-wide AML/AFC risk assessment, which identifies inherent risks, evaluates control effectiveness, and determines residual risk, driving resource allocation. Strong governance—board oversight, a culture of compliance, clear accountability, and management information—ensures the pillars operate as a cohesive, sustainable program rather than isolated activities.

In the CAMS framework and AFC (Anti-Financial Crime) Program Governance and Risk Management, a 'Culture of Compliance' refers to the shared values, attitudes, and behaviors within an organization that prioritize adherence to AML/CFT laws, regulations, and ethical standards. It means compliance is not viewed merely as a cost center or a box-ticking exercise, but as an integral part of how business is conducted at every level. Regulators such as FinCEN (in its 2014 Advisory), the FATF, and the Wolfsberg Group emphasize that a strong compliance culture is a key indicator of an effective AFC program.

'Tone from the Top' is the foundation of that culture. It describes the visible, consistent commitment of the board of directors and senior management to financial crime prevention. Leadership sets the tone by: (1) actively engaging in and approving the AML/CFT program and risk appetite; (2) allocating adequate resources, staffing, and technology to the compliance function; (3) ensuring the Chief Compliance Officer or MLRO has sufficient authority, independence, and direct access to the board; (4) not allowing revenue or business interests to compromise compliance decisions; (5) holding individuals accountable for breaches regardless of seniority or profitability; and (6) communicating clearly and repeatedly that compliance is everyone's responsibility.

When tone from the top is weak, employees perceive compliance as optional, controls are circumvented, and suspicious activity may go unreported—leading to enforcement actions, fines, and reputational damage (e.g., major bank cases where senior leaders overrode compliance warnings). Conversely, a strong tone cascades into the 'tone in the middle,' where line managers reinforce expectations, and ultimately into frontline behavior.

Key indicators of a healthy culture include open escalation and whistleblowing channels, compliance metrics in performance evaluations and compensation, ongoing training, prompt remediation of audit findings, and board-level reporting on AML risks. For CAMS candidates, understanding that governance, culture, and leadership commitment underpin all other program pillars—policies, controls, training, independent testing, and the designated compliance officer—is essential.

The Three Lines of Defence Model is a governance framework widely referenced in CAMS and AFC (anti-financial crime) program design to clarify roles, responsibilities, and accountability for managing money laundering, terrorist financing, sanctions, and related risks. It ensures that risk ownership, oversight, and independent assurance are clearly separated yet coordinated.

First Line of Defence – Business Operations: The business units and front-line staff own and manage AFC risk directly. They are closest to customers and transactions, so they perform customer onboarding, Know Your Customer (KYC) and Customer Due Diligence (CDD), identify and escalate unusual activity, apply controls in day-to-day processes, and are accountable for the risks they create. Relationship managers, tellers, and operations teams form this line.

Second Line of Defence – Compliance and Risk Management: The AML/AFC compliance function, led by the Money Laundering Reporting Officer (MLRO) or BSA/AML Officer, sets policies and procedures, designs the control framework, provides training, conducts monitoring and testing, performs the enterprise-wide risk assessment, advises the first line, and reports to senior management and the board. This line oversees and challenges the first line but does not own the underlying business risk.

Third Line of Defence – Internal Audit: Internal audit provides independent, objective assurance to the board and audit committee that the first and second lines are operating effectively. It evaluates the design and operating effectiveness of the AFC program, tests compliance with regulatory requirements, identifies gaps, and tracks remediation. Its independence from management is critical, and it may be supplemented by external auditors or regulators.

In practice, senior management and the board sit above all three lines, setting the tone at the top, approving risk appetite, and ensuring adequate resources. Regulators, including FATF guidance and the Basel Committee, endorse this model because it prevents conflicts of interest, promotes escalation, and strengthens the overall effectiveness and resilience of the AFC program.

The BSA Officer (in the U.S. under the Bank Secrecy Act) and the Money Laundering Reporting Officer (MLRO, common in the UK, EU, and other jurisdictions) are the designated individuals accountable for an institution's anti-money laundering and counter-financing of terrorism (AML/CFT) compliance. Their role, authority, and independence are core pillars of AFC program governance, as emphasized in CAMS and regulatory guidance such as FinCEN, FFIEC, FCA SYSC, and FATF Recommendation 18.

Role: The BSA Officer/MLRO is responsible for designing, implementing, and overseeing the AML program, including risk assessments, policies and procedures, transaction monitoring, suspicious activity reporting (SARs/STRs), customer due diligence, training, record-keeping, and liaison with regulators and law enforcement. The MLRO is often personally accountable for deciding whether to file suspicious activity reports and serves as the central point of contact for internal escalations.

Authority: To be effective, the officer must have sufficient stature, resources, and decision-making power. This includes access to all relevant information, systems, and business lines; the ability to stop transactions, exit relationships, or escalate concerns; adequate staffing and technology budgets; and authority commensurate with the institution's size, complexity, and risk profile. Regulators expect the position to be formally designated by the board of directors with a clear mandate documented in governance charters.

Independence: The BSA Officer/MLRO should be free from undue influence by revenue-generating functions. Best practice calls for a direct reporting line to the board or a board committee (e.g., audit or risk committee), as well as to senior management, so compliance concerns cannot be suppressed. Conflicts of interest—such as compensation tied to business growth or dual roles in the first line of defense—should be avoided or mitigated. Independence is further reinforced by periodic independent testing (third line) of the officer's function.

Ultimately, the board remains accountable for AML compliance, but the empowered, independent BSA Officer/MLRO is the linchpin that translates governance into effective risk management.

A Risk Appetite Statement (RAS) is a formal, board-approved document that articulates the amount and type of money laundering, terrorist financing, sanctions, and related financial crime risk an institution is willing to accept in pursuit of its strategic and business objectives. Within AFC program governance and risk management, it serves as the bridge between the enterprise-wide risk assessment and the day-to-day controls, ensuring that business decisions remain aligned with the organization's tolerance for exposure.

Purpose: The RAS sets the 'tone from the top,' demonstrating senior management and board commitment to compliance. It provides a consistent framework for decision-making about which customers, products, geographies, and delivery channels the institution will or will not engage with. It guides resource allocation, helps calibrate control intensity (e.g., enhanced due diligence thresholds, monitoring scenarios), and supports regulators' expectations that risk-taking is deliberate, understood, and governed. It also establishes accountability by defining escalation triggers when risk exceeds approved limits.

Content: A robust RAS typically includes (1) a qualitative statement of overall AML/CFT risk philosophy (e.g., low or zero tolerance for facilitating sanctions evasion or dealing with shell banks); (2) prohibited or restricted customer types, industries, products, and jurisdictions; (3) quantitative limits and tolerances, such as maximum percentage of high-risk customers, exposure caps to high-risk countries, or acceptable alert backlog and SAR filing timeliness metrics; (4) key risk indicators and early-warning thresholds that trigger review or escalation; (5) roles and responsibilities across the three lines of defense for monitoring adherence; (6) governance processes for approving exceptions and for periodic review, generally at least annually or upon material business change; and (7) linkage to the risk assessment methodology and control framework.

An effective RAS is specific, measurable, communicated throughout the organization, embedded in policies and procedures, and regularly tested against actual risk profiles to confirm the institution operates within its stated appetite.

Communicating risk appetite and linking controls is a core pillar of AFC program governance, ensuring that a financial institution's stated tolerance for money laundering, terrorist financing, sanctions and fraud risk is translated into practical, measurable action across the enterprise.

Risk appetite is the amount and type of financial crime risk the board is willing to accept in pursuit of strategic objectives. It is formally documented in a Risk Appetite Statement (RAS), approved by the board, and typically expressed through qualitative statements (e.g., 'no tolerance for sanctions breaches') and quantitative metrics such as thresholds for high-risk customer concentrations, acceptable alert backlogs, or SAR filing timeliness.

Communication must flow in both directions. Top-down, the board and senior management cascade the RAS through policies, procedures, training, and performance objectives so that first-line staff in onboarding, operations and relationship management understand what risks are acceptable and what must be escalated or declined. Bottom-up, Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) are reported to committees and the board, highlighting breaches of appetite, emerging typologies and control weaknesses. Clear tone from the top reinforces accountability under the three lines of defense model.

Linking controls means mapping each inherent risk identified in the enterprise-wide risk assessment to specific preventive and detective controls—customer due diligence, enhanced due diligence, transaction monitoring, sanctions screening, and independent testing—and calibrating those controls to the appetite. Where residual risk exceeds appetite, management must strengthen controls, exit relationships, or formally accept the exception with documented rationale.

This linkage enables a risk-based approach consistent with FATF recommendations and regulatory expectations such as those from FinCEN, the FCA, and the Wolfsberg Group. Effective communication and alignment prevent gaps between policy and practice, support evidence-based resource allocation, and demonstrate to regulators and auditors that the institution understands, measures and actively manages its financial crime exposure within defined boundaries.

In AFC program governance and risk management, the enterprise-wide risk assessment (EWRA) is built on three interlinked concepts: inherent risk, control effectiveness and residual risk.

Inherent risk is the level of money laundering, terrorist financing and sanctions risk an institution faces before any mitigating controls are applied. It is driven by the organization's business model and is typically assessed across risk categories such as customer types (e.g., PEPs, cash-intensive businesses, correspondent banks), products and services (e.g., private banking, trade finance, cross-border wires, virtual assets), delivery channels (e.g., non-face-to-face onboarding, third-party intermediaries) and geographies (e.g., exposure to high-risk or sanctioned jurisdictions). Inherent risk is often quantified using volumes, values and exposure metrics and rated on a scale such as low, moderate or high.

Control effectiveness measures how well the institution's AML/CFT framework mitigates that inherent risk. Controls include governance and oversight, policies and procedures, KYC/CDD and EDD, transaction monitoring, sanctions screening, suspicious activity reporting, training, independent testing and record-keeping. Effectiveness is evaluated on both design (are controls appropriate for the risks?) and operating effectiveness (do they actually work in practice?), using evidence such as audit findings, QA results, regulatory examinations, system tuning and issue remediation status. Controls may be rated strong, satisfactory or weak.

Residual risk is the risk that remains after controls are applied: Inherent Risk minus Control Effectiveness equals Residual Risk. It reflects the institution's true exposure and is compared against the board-approved risk appetite. Where residual risk exceeds appetite, management must respond by strengthening controls, restricting or exiting high-risk relationships, or formally accepting the risk with documented justification.

For a CAMS professional, this framework provides a defensible, risk-based rationale for allocating compliance resources, prioritizing remediation and demonstrating to regulators and senior management that AFC risks are understood, measured and actively managed.

An Enterprise-Wide Risk Assessment (EWRA) is the foundational governance tool of an AML/CFT (AFC) program. It systematically identifies, measures, and documents the money laundering, terrorist financing, sanctions, and related financial crime risks to which an institution is exposed across all business lines, legal entities, and jurisdictions, and evaluates how effectively existing controls mitigate those risks. Regulators such as FinCEN, the FFIEC, the FCA, and FATF expect it to drive a risk-based approach.

The methodology typically follows a structured sequence. First, the institution defines scope and governance, setting the frequency (usually annual or upon material change), ownership (typically the AML Compliance Officer, with board and senior management oversight), and the risk appetite statement against which results are compared. Second, it identifies inherent risk, meaning the risk present before controls, across standard risk categories: customers (PEPs, cash-intensive businesses, shell companies), products and services (correspondent banking, private banking, trade finance, virtual assets), delivery channels (non-face-to-face onboarding, third-party agents), and geographies (high-risk or sanctioned jurisdictions). Quantitative data such as transaction volumes, customer counts, and SAR/STR filings are combined with qualitative judgment and external sources like FATF reports and national risk assessments. Third, each category is scored using a defined scale (for example low, medium, high) and weighted according to its significance.

Fourth, the control environment is assessed by evaluating the design and operating effectiveness of policies, KYC/CDD, transaction monitoring, sanctions screening, training, independent testing, and governance. Fifth, residual risk is calculated by applying control effectiveness against inherent risk. Sixth, gaps between residual risk and risk appetite are identified and documented, producing remediation action plans with owners and deadlines.

Finally, results are reported to the board and senior management and used to allocate resources, calibrate monitoring thresholds, prioritize audits, and update policies. Strong documentation, data integrity, consistent methodology, independent challenge, and periodic refresh ensure the EWRA remains a living, defensible document rather than a compliance formality.

The Risk-Based Approach (RBA) is the foundational principle of modern Anti-Financial Crime (AFC) program governance, endorsed by the FATF in Recommendation 1 and embedded in regulations such as the EU AML Directives, the US Bank Secrecy Act framework, and the UK Money Laundering Regulations. Rather than applying uniform, rules-based controls to every customer, product, and transaction, the RBA requires an institution to identify, assess, and understand its specific money laundering, terrorist financing, and sanctions risks, and then allocate compliance resources in proportion to those risks. For a CAMS professional, the RBA operates on two levels. First, at the enterprise level, the institution conducts a documented Enterprise-Wide Risk Assessment (EWRA), evaluating inherent risk across customer types, geographies, products and services, delivery channels, and transaction volumes, then measuring the effectiveness of existing controls to arrive at residual risk. This assessment drives board-level risk appetite statements, resourcing decisions, and policy design. Second, at the customer level, risk-rating methodologies determine the intensity of Customer Due Diligence: Simplified Due Diligence for low-risk relationships, standard CDD for the majority, and Enhanced Due Diligence for higher-risk cases such as Politically Exposed Persons, correspondent banking, complex ownership structures, or high-risk jurisdictions. Proportionate controls are the practical expression of the RBA. Controls—onboarding scrutiny, transaction monitoring thresholds and scenarios, periodic review frequency, screening sensitivity, and senior management approval requirements—should be calibrated so that higher-risk areas receive greater oversight while lower-risk areas are not burdened with unnecessary friction. Proportionality also protects against de-risking, where wholesale exit from entire customer categories undermines financial inclusion and simply displaces risk. Effective governance requires the RBA to be dynamic: risk assessments must be refreshed periodically and when triggers occur, such as new products, regulatory changes, or emerging typologies. Independent testing, clear documentation of risk rationale, and demonstrable linkage between assessed risk and applied controls are what regulators expect when evaluating whether an AFC program is both reasonable and defensible.

In an Anti-Financial Crime (AFC) program, policies, standards, and procedures form a layered governance hierarchy that translates regulatory obligations and board-level risk appetite into day-to-day operational practice. Each layer serves a distinct purpose and audience, and together they create a defensible, auditable framework that regulators, examiners, and independent testers expect to see.

At the top sits the AML/CFT Policy. Approved by the board of directors or a delegated senior committee, the policy articulates the institution's commitment to compliance, defines the scope of covered activities and entities, states the risk appetite, and assigns accountability (e.g., the designated AML Compliance Officer, three lines of defense). Policies are principle-based, relatively stable, and written in 'shall/must' language referencing applicable laws such as the BSA, FATF Recommendations, EU AML Directives, or local regulations. They answer the question 'what must we do and why.'

Beneath the policy are Standards. Standards set mandatory, measurable requirements that give the policy specificity: minimum customer due diligence (CDD) elements, enhanced due diligence (EDD) triggers for PEPs or high-risk jurisdictions, transaction monitoring thresholds, sanctions screening parameters, record-retention periods, and training frequency. Standards are typically owned by the compliance function and approved at the executive or committee level. They answer 'what level of control is required.'

At the operational base are Procedures. These are detailed, step-by-step instructions describing how staff execute the standards: how to onboard a customer, clear a sanctions alert, investigate and escalate unusual activity, file a SAR/STR within required timelines, and document decisions. Procedures are owned by business or operational units, updated frequently, and often supported by desk guides, checklists, and system workflows.

Effective governance requires traceability across the hierarchy: every procedure should map to a standard, and every standard to a policy requirement and underlying regulation. Documents need version control, defined owners, periodic review (at least annually or upon regulatory change), formal approval, and evidence of communication and training. Gaps or inconsistencies between layers are common examination findings and signal weak program governance.

Horizon scanning and regulatory change management are core governance capabilities within an Anti-Financial Crime (AFC) program, emphasized in the CAMS body of knowledge under program governance and risk management.

Horizon scanning is the systematic, forward-looking process of identifying, monitoring, and assessing emerging developments that could affect a financial institution's AML/CFT and sanctions obligations. Sources include FATF recommendations and mutual evaluations, FinCEN advisories, EU AML directives and the new AMLA framework, OFAC and UN sanctions designations, national regulator consultations, enforcement actions, court decisions, typology reports, and industry guidance such as the Wolfsberg Group. It also covers emerging risks like virtual assets, trade-based laundering, and new payment technologies. Effective horizon scanning assigns ownership (typically to the Compliance or MLRO function), uses structured tracking tools, and produces regular reporting to senior management and the board so the institution can anticipate rather than merely react.

Regulatory change management (RCM) is the governed end-to-end process that translates identified changes into action. Typical stages include: logging the change in a regulatory inventory; performing an applicability and impact assessment across business lines, jurisdictions, and products; conducting a gap analysis against existing policies, procedures, controls, systems, and training; assigning accountable owners and remediation plans with deadlines; updating the enterprise-wide risk assessment; implementing changes to policies, transaction monitoring rules, customer due diligence standards, and screening lists; delivering training; and validating implementation through testing, compliance monitoring, and internal audit.

Governance expectations include documented procedures, escalation paths for high-impact changes, management information on open items and overdue actions, board oversight, and audit trails demonstrating a defensible, timely response to regulators. Weak horizon scanning or RCM is a frequent root cause cited in enforcement actions, where institutions failed to update controls for new obligations. Together these processes keep the AFC program risk-based, current, and aligned with the three lines of defense model.

In AFC program governance, incorporating guidance and best practice into policies means translating external expectations—from regulators, standard-setters, and industry bodies—into the institution's internal rulebook so that controls remain current, defensible, and risk-based. For a CAMS professional, this is a core governance responsibility, because policies are the formal expression of senior management's risk appetite and the foundation on which procedures, systems, and training are built.

Key sources of guidance include the FATF Recommendations and typology reports, the Wolfsberg Group principles, the Basel Committee's AML/CFT risk management papers, the Egmont Group, national regulators (e.g., FinCEN advisories, FCA guidance, JMLSG), and FIU alerts. Enforcement actions and consent orders against peer institutions are also valuable: they reveal regulators' practical expectations and common control failures.

The incorporation process should be structured. First, establish a horizon-scanning function—often within Compliance—to monitor new publications and assess relevance. Second, perform a gap analysis comparing the guidance against existing policy, procedures, and the enterprise-wide risk assessment. Third, determine whether changes are mandatory (law or regulation) or advisory (best practice), and decide how far to adopt advisory items based on the institution's risk profile, products, customers, and geographies. Fourth, draft amendments, obtain approval through the proper governance route (e.g., Compliance Committee and Board), and document the rationale—including any decision not to adopt a recommendation, which auditors and examiners will scrutinize.

After approval, updated policies must flow down into operational procedures, system parameters (such as transaction monitoring scenarios and screening lists), and staff training. Communication, version control, and effective dates should be managed carefully. Finally, internal audit or independent testing should verify that the changes were implemented and are working as intended.

Done well, this cycle ensures the AFC program evolves with emerging risks and regulatory expectations, demonstrating to supervisors a culture of compliance and proactive risk management rather than a static, check-the-box approach.

In an Anti-Financial Crime (AFC) program, governance committees are the formal bodies through which the board and senior management exercise oversight, make risk-based decisions, and demonstrate accountability for anti-money laundering (AML), counter-terrorist financing (CTF), and sanctions compliance. The CAMS framework emphasizes that effective governance is a core pillar of a sound AFC program, and committees are the mechanism that connects strategy, risk appetite, and day-to-day operational controls. Typical structures include a board-level Risk or Audit Committee with ultimate oversight, an executive-level Financial Crime Compliance Committee chaired by the Chief Compliance Officer or Money Laundering Reporting Officer (MLRO), and operational sub-committees covering areas such as sanctions screening, transaction monitoring tuning, customer risk rating methodology, and high-risk client acceptance. These committees review management information (MI) such as alert volumes, suspicious activity report (SAR) filings, backlog metrics, regulatory findings, and the enterprise-wide risk assessment, and they approve policies, model changes, and remediation plans.

Terms of Reference (ToR) are the written charters that define how each committee operates. A robust ToR specifies the committee's purpose and mandate, its authority and decision-making powers (including what it may approve versus escalate), membership and required seniority, the chair and secretary roles, quorum requirements, meeting frequency, standing agenda items, reporting lines to higher governance bodies, and documentation standards such as minutes and action tracking. The ToR should also define escalation triggers, conflict-of-interest handling, and a periodic review cycle, typically annual. Well-drafted ToR are important for regulators and auditors because they evidence that oversight is deliberate, consistent, and traceable rather than ad hoc. They also support the three lines of defense model by clarifying the responsibilities of business, compliance, and internal audit representatives. Ultimately, governance committees and their Terms of Reference ensure that AFC risks are identified, discussed, decided upon, and documented at the appropriate level, creating a defensible audit trail and embedding a culture of compliance throughout the institution.

In the context of the Certified Anti-Money Laundering Specialist (CAMS) body of knowledge and Anti-Financial Crime (AFC) program governance, Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) are complementary metrics used by senior management, the board, and the compliance function to measure how well the AML/AFC program is operating and whether financial crime risk remains within the institution's risk appetite.

Key Performance Indicators (KPIs) measure the effectiveness and efficiency of the AFC program's processes and controls. They look backward and answer the question: 'Are we doing things well?' Typical AFC KPIs include the percentage of alerts cleared within target timeframes, the average age of open alerts and case backlogs, SAR/STR filing timeliness relative to regulatory deadlines, completion rates for mandatory AML training, percentage of customers with completed and current KYC/CDD refreshes, and the turnaround time for enhanced due diligence on high-risk clients. KPIs help the Money Laundering Reporting Officer (MLRO) or Chief Compliance Officer demonstrate operational performance, justify resourcing, and identify process bottlenecks.

Key Risk Indicators (KRIs) are forward-looking early-warning signals that indicate increasing exposure to money laundering, terrorist financing, sanctions, or fraud risk. They answer the question: 'Is our risk profile changing, and are we approaching the limits of our risk appetite?' Examples include growth in the number of high-risk or PEP customers, rising volumes of transactions with high-risk jurisdictions, increasing sanctions screening true-match rates, an upward trend in SAR filings for a particular product or business line, high staff turnover in compliance roles, overdue audit or regulatory findings, and system outages affecting transaction monitoring. KRIs are usually assigned thresholds (green/amber/red) that trigger escalation and remediation when breached.

Together, KPIs and KRIs feed the enterprise-wide risk assessment, support the three lines of defense, enable risk-based allocation of resources, and provide the board with evidence of effective oversight, as expected by regulators such as FinCEN, the FCA, and FATF-aligned supervisors.

Management Information (MI) and Board Reporting are foundational elements of AFC (Anti-Financial Crime) program governance, ensuring that senior management and the board of directors can fulfill their oversight responsibilities for money laundering, terrorist financing, sanctions, and related risks. Regulators such as FATF, the Wolfsberg Group, and national supervisors expect that those ultimately accountable for the institution receive accurate, timely, and decision-useful information about the effectiveness of AFC controls.

MI refers to the structured data and analysis produced by compliance, operations, and risk functions. Typical MI includes: transaction monitoring alert volumes, backlog and aging statistics; suspicious activity report (SAR/STR) filing numbers and trends; KYC/CDD completion rates and periodic review status; high-risk customer populations (e.g., PEPs, correspondent banking); sanctions screening true and false positive rates; staff training completion; audit and regulatory findings with remediation progress; and key risk indicators (KRIs) measured against defined risk appetite thresholds.

Board Reporting translates this MI into a concise narrative that highlights material risks, emerging threats, control weaknesses, resourcing gaps, and strategic decisions requiring board attention. Good reports use dashboards, trend analysis, and red-amber-green ratings, but also provide qualitative context so directors understand what the numbers mean. The MLRO or Chief Compliance Officer typically presents at least annually, often quarterly, and must have direct, unfiltered access to the board or a designated risk committee.

Effective MI and reporting support the 'tone from the top,' demonstrate a culture of compliance, and provide documentary evidence that governance bodies actively challenged and approved AFC strategy. Weaknesses in this area—such as incomplete data, overly technical reports, or failure to escalate issues—are frequently cited in enforcement actions as evidence of inadequate oversight. Therefore, CAMS professionals should ensure MI is relevant, reliable, risk-based, and acted upon, closing the feedback loop between operational findings and board-level decisions on risk appetite, resources, and remediation.

Suspicious Activity Reporting (SAR) obligations are a cornerstone of an effective Anti-Financial Crime (AFC) program and a key element of governance and risk management for CAMS professionals. A SAR (also called a Suspicious Transaction Report, STR, in many jurisdictions) is a confidential filing submitted by a regulated institution to its national Financial Intelligence Unit (FIU), such as FinCEN in the United States, when it knows, suspects, or has reasonable grounds to suspect that funds or activity are linked to money laundering, terrorist financing, fraud, or other predicate offenses. FATF Recommendation 20 establishes this as a global standard.

Key obligations include: (1) Detection – institutions must maintain transaction monitoring systems, employee referral channels, and KYC/CDD processes capable of identifying unusual activity; (2) Investigation – alerts must be reviewed and escalated by trained analysts who document their reasoning; (3) Decision-making – a designated AML/Compliance Officer determines whether a filing is warranted, and the rationale for filing or not filing must be documented; (4) Timeliness – most regimes impose strict deadlines (e.g., 30 days from initial detection in the US, extendable to 60 if no subject is identified); (5) Confidentiality – 'tipping off' the subject that a report has been filed is prohibited and criminally sanctioned; (6) Record retention – supporting documentation typically must be kept for at least five years; and (7) Continuing activity – ongoing suspicious behavior requires follow-up filings.

From a governance perspective, the board and senior management are accountable for ensuring adequate resources, independent testing, quality assurance, and metrics (such as alert-to-SAR conversion rates and filing timeliness) are in place. Regulators scrutinize SAR programs closely, and failures can result in significant penalties, consent orders, and personal liability. Ultimately, SARs provide law enforcement with critical intelligence, making robust reporting a legal duty and a public-interest responsibility.

Threshold and Currency Transaction Reporting is a core regulatory obligation within an AML/AFC program, designed to give authorities visibility into large cash movements that could indicate money laundering, tax evasion, or terrorist financing. Under the U.S. Bank Secrecy Act, financial institutions must file a Currency Transaction Report (CTR) with FinCEN for each cash transaction, or series of related transactions, exceeding $10,000 in a single business day. Many jurisdictions have comparable regimes, such as Australia's Threshold Transaction Reports (TTRs) under AUSTRAC and Canada's Large Cash Transaction Reports to FINTRAC, though thresholds and currency definitions vary. Key features include aggregation rules, which require institutions to combine multiple cash deposits or withdrawals by or on behalf of the same person across branches and channels; the requirement to verify and record customer identification; and strict filing deadlines, typically 15 days in the U.S. Unlike Suspicious Activity Reports, CTRs are objective and mechanical, triggered by the amount rather than by suspicion, and institutions may not notify the customer in a way that facilitates evasion. Structuring, deliberately breaking transactions into smaller amounts to stay below the threshold, is itself a crime and a red flag that should prompt a SAR, so monitoring systems must detect patterns just under reporting limits. Institutions may exempt certain customers, such as other banks, government agencies, listed companies, and eligible non-listed businesses, but must document and periodically review these exemptions. From a program governance and risk management perspective, senior management and the compliance function must ensure robust aggregation logic, data integrity, reconciliation between transaction systems and filings, quality assurance testing, staff training, and audit coverage. Failures, including late, inaccurate, or missed filings, expose institutions to civil and criminal penalties, consent orders, and reputational damage. Effective threshold reporting therefore depends on sound technology controls, clear policies, and accountable oversight embedded in the enterprise-wide AFC framework.

Within AFC (Anti-Financial Crime) Program Governance and Risk Management, 'Working with Other Risk Management Functions' refers to how the AML/CFT compliance function must integrate with, rather than operate in isolation from, the broader enterprise risk framework. CAMS candidates are expected to understand that money laundering, terrorist financing, sanctions, fraud, bribery, and tax evasion risks overlap heavily with other risk disciplines, so coordination is essential for an effective program.

Key partner functions include: (1) Operational Risk, which owns the firm-wide risk taxonomy and risk and control self-assessments (RCSAs); AFC findings should feed into these so money laundering risk is viewed alongside other operational exposures. (2) Fraud Risk, since fraud proceeds are frequently laundered and investigations often share data, typologies, and case management tools; many institutions converge fraud and AML (FRAML) to reduce duplication. (3) Credit and Market Risk, whose customer due diligence and counterparty analysis can surface red flags such as unexplained wealth or unusual trading. (4) Information Security and Cyber Risk, given the rise of cyber-enabled crime and the need to protect sensitive SAR/STR data. (5) Internal Audit, which provides independent third-line testing of AFC controls under the Three Lines of Defense model. (6) Legal and Regulatory Affairs, for interpreting obligations and managing regulatory relationships. (7) Human Resources, for employee screening and training.

Effective collaboration relies on shared governance committees, common risk appetite statements, consistent risk rating methodologies, integrated data and reporting, and clear escalation paths to senior management and the board. Benefits include a holistic view of enterprise risk, elimination of control gaps and redundancies, cost efficiency, faster detection of complex schemes, and stronger regulatory credibility. Challenges include siloed cultures, incompatible systems, confidentiality restrictions on SAR information, and unclear ownership. The AFC officer should therefore act as a bridge, ensuring financial crime risk is embedded in enterprise-wide risk management while preserving the independence and legal confidentiality obligations unique to the AML function.

Customer Life-Cycle Controls are the end-to-end set of anti-financial crime (AFC) measures applied from the moment a prospective customer approaches a financial institution until the relationship ends. Within AFC program governance and risk management, they ensure that risk is identified, measured, monitored, and controlled consistently across every stage of the relationship.

The life cycle typically begins with onboarding, where Customer Due Diligence (CDD) is performed: identity verification, beneficial ownership identification, screening against sanctions, PEP, and adverse media lists, and understanding the purpose and expected nature of the account. A risk rating is assigned, and higher-risk customers receive Enhanced Due Diligence (EDD), often with senior management approval.

During the active relationship, ongoing monitoring applies. Transaction monitoring systems compare activity to the expected profile, periodic reviews refresh KYC information on a risk-based schedule (e.g., annually for high risk), and trigger events—such as a change in ownership, a negative news hit, or unusual activity—prompt event-driven reviews. Risk ratings are dynamically updated, and escalation procedures ensure red flags reach compliance for investigation and potential Suspicious Activity Report (SAR) filing.

Exit decisions address the end of the life cycle. When a customer's risk exceeds the institution's risk appetite, when due diligence cannot be completed, or when suspicious activity persists, the institution may decide to restrict services or terminate the relationship (de-risking). Good governance requires that exit decisions be made through a documented, consistent process, often by a committee including compliance, business, and legal, to avoid arbitrary or discriminatory de-risking, manage legal and reputational risk, and consider tipping-off rules. Records of the rationale must be retained, regulators may need notification, and controls should prevent re-onboarding of exited customers.

Together, these controls demonstrate a risk-based approach, support regulatory expectations, and protect the institution from being exploited for money laundering or terrorist financing.

Keeping accounts open at the request of law enforcement is a recognized practice in anti-money laundering (AML) and anti-financial crime (AFC) program governance. Normally, when a financial institution identifies suspicious activity, its risk appetite may dictate exiting the relationship. However, closing an account can tip off the subject, destroy an evidentiary trail, and disrupt an ongoing investigation. Law enforcement agencies may therefore formally request that an institution keep a suspicious account open so they can monitor transactions, trace funds, and identify co-conspirators.

From a governance standpoint, several controls are essential. First, the request should be in writing, on official letterhead, from a named agency and authorized official, specifying the account(s) and the duration (often with renewal requirements, such as the FinCEN guidance that such requests be periodically reviewed and typically renewed every few months). Verbal requests should be documented and followed by written confirmation. Second, the decision to comply rests with the institution; the request does not transfer legal liability, so senior compliance management or the BSA/AML officer should approve and document the rationale. Third, the institution must continue filing Suspicious Activity Reports (SARs) on ongoing activity, with continuing-activity SARs filed on the required schedule, and must maintain strict confidentiality to avoid tipping off the customer. Fourth, the account should be placed under enhanced monitoring, with restricted staff access and clear escalation paths. Fifth, the institution should retain all correspondence as part of its audit trail and evaluate its own exposure, including sanctions risk, reputational risk, and the possibility that the request has lapsed.

For a CAMS professional, the key lesson is that cooperation with law enforcement must be balanced against the institution's independent regulatory obligations. Proper documentation, defined approval authority, time-limited commitments, continuing SAR filings, and board-level visibility through governance reporting ensure that keeping accounts open serves public interest without compromising the institution's compliance posture.

Know Your Customer (KYC) and Customer Identification are foundational pillars of an Anti-Financial Crime (AFC) program, central to the CAMS body of knowledge on program governance and risk management. KYC is the broader framework through which a financial institution gathers, verifies, and maintains information about its customers to understand who they are, the nature of their business or activity, the source of their funds and wealth, and the expected pattern of transactions. Its purpose is to prevent criminals from using the institution to launder money or finance terrorism, and to enable the institution to detect activity inconsistent with a customer's profile. Customer Identification, often formalized as a Customer Identification Program (CIP) under regulations such as the USA PATRIOT Act Section 326 and the FATF Recommendations (notably Recommendation 10), is the first step of KYC. It requires collecting minimum identifying data at onboarding—typically name, date of birth, address, and an identification number—and verifying that information through documentary means (passports, licenses, corporate registration documents) or non-documentary means (database checks, credit bureaus, public records). Institutions must also identify beneficial owners of legal entities, usually those holding 25 percent or more ownership or exercising control, to pierce corporate opacity. KYC then extends into Customer Due Diligence (CDD), which assigns a risk rating based on factors such as customer type, geography, products used, and delivery channels. Higher-risk customers—politically exposed persons, correspondent banks, cash-intensive businesses, or those in high-risk jurisdictions—trigger Enhanced Due Diligence (EDD), including senior management approval and deeper source-of-wealth inquiries. From a governance perspective, KYC must be risk-based, documented in board-approved policies, supported by adequate systems and training, subject to independent testing, and periodically refreshed throughout the customer lifecycle. Deficient KYC is a leading cause of regulatory enforcement actions, underscoring its role as the gateway control upon which transaction monitoring, sanctions screening, and suspicious activity reporting all depend.

Customer Due Diligence (CDD) is a foundational pillar of any Anti-Financial Crime (AFC) program and a core component of the risk-based approach emphasized throughout the CAMS body of knowledge. CDD refers to the processes a financial institution uses to identify and verify customers, understand the nature and purpose of the relationship, and develop a risk profile that drives ongoing monitoring. The FATF Recommendations (notably Recommendation 10) and jurisdictional rules such as the U.S. FinCEN CDD Rule and the EU Anti-Money Laundering Directives set the baseline expectations.

CDD typically has four elements: (1) identifying and verifying the customer's identity using reliable, independent documents or data; (2) identifying and verifying beneficial owners of legal entity customers; (3) understanding the purpose and intended nature of the relationship to build a customer risk profile; and (4) conducting ongoing monitoring, including scrutiny of transactions and keeping information current. Where risk is higher, for example with politically exposed persons, correspondent banking, or high-risk jurisdictions, Enhanced Due Diligence (EDD) is applied, involving source of wealth and funds inquiries and senior management approval. Simplified due diligence may be permitted for demonstrably low-risk scenarios.

Beneficial Ownership addresses the natural persons who ultimately own or control a customer or on whose behalf a transaction is conducted. Criminals frequently exploit shell companies, trusts, nominees, and layered corporate structures to hide their involvement, so regulators require institutions to look through legal entities. Common thresholds define ownership at 25% or more of equity, supplemented by a control prong capturing individuals with significant managerial authority, such as a CEO or managing member. Institutions must collect and verify this information, document the ownership chain, and refresh it when triggering events occur.

From a governance perspective, CDD and beneficial ownership controls must be embedded in policies, supported by training and technology, subject to quality assurance and independent testing, and overseen by the board and compliance leadership. Weaknesses here undermine suspicious activity detection, sanctions screening, and the institution's overall risk management framework.

Enhanced Due Diligence (EDD) is the heightened level of scrutiny applied to customers, relationships, and transactions that present elevated money laundering, terrorist financing, or sanctions risk, as determined by a risk-based approach. Within AFC program governance, EDD operationalizes the principle that controls must be proportionate to risk, and it is a core expectation of the FATF Recommendations, the EU AML Directives, the USA PATRIOT Act (Section 312), and the Wolfsberg Principles.

Common EDD triggers include: Politically Exposed Persons (PEPs), their family members and close associates; customers or counterparties connected to high-risk or sanctioned jurisdictions, including those on FATF grey or black lists; correspondent banking relationships, particularly with shell banks or institutions in weak AML regimes; private banking and high-net-worth clients; complex or opaque ownership structures such as layered trusts, nominee shareholders, and entities in secrecy havens; cash-intensive businesses, money service businesses, virtual asset service providers, and other high-risk industries; non-face-to-face onboarding; adverse media or negative news; unusual transaction patterns inconsistent with the customer profile; and internal red flags escalated through transaction monitoring or suspicious activity reporting.

EDD measures correspondingly go beyond standard CDD. They typically include: obtaining senior management approval to establish or continue the relationship; verifying ultimate beneficial ownership through independent, reliable sources; establishing and documenting source of wealth and source of funds; gathering detailed information on the purpose and intended nature of the relationship; conducting enhanced screening against sanctions, PEP, and adverse media databases; performing site visits or obtaining references; applying more frequent periodic reviews (for example annually rather than every three to five years); setting lower transaction monitoring thresholds and tailored scenarios; requiring enhanced documentation for individual transactions; and, for correspondent relationships, assessing the respondent's AML controls and regulatory standing.

From a governance perspective, EDD outcomes must be documented, defensible, and reviewed by the second line, with escalation and exit procedures when risk exceeds appetite. Effective EDD demonstrates to regulators that the institution understands and actively manages its highest-risk exposures.

Customer Risk Rating and Assessment is a cornerstone of an effective Anti-Financial Crime (AFC) program and a key expectation under the risk-based approach promoted by FATF, the Wolfsberg Group, and regulators worldwide. Its purpose is to systematically evaluate the money laundering, terrorist financing, sanctions, and related financial crime risk posed by each customer so that the institution can apply proportionate controls.

The assessment typically occurs at onboarding and is refreshed periodically or upon trigger events (e.g., adverse media, unusual activity, change of ownership). Institutions evaluate several risk dimensions: (1) Customer type and profile – individuals versus legal entities, complexity of ownership structures, presence of Politically Exposed Persons (PEPs), beneficial owners, and the nature of the customer's business or occupation; (2) Geographic risk – country of residence, incorporation, operations, and the jurisdictions involved in transactions, weighted against high-risk, sanctioned, or weak-AML jurisdictions; (3) Products and services – cash-intensive activity, private banking, correspondent banking, trade finance, or crypto exposure; (4) Delivery channel – face-to-face versus non-face-to-face or intermediary-introduced relationships; and (5) Expected transaction behavior – volume, value, frequency, and counterparties.

These factors are scored, often through a weighted model, producing a rating such as Low, Medium, or High. The rating drives downstream controls: standard, simplified, or Enhanced Due Diligence (EDD), frequency of periodic review, level of senior management approval, and intensity of transaction monitoring scenarios. High-risk customers require deeper source-of-wealth and source-of-funds verification, ongoing scrutiny, and sometimes exit decisions.

From a governance standpoint, the methodology must be documented, approved by senior management, tested for effectiveness, and validated independently. Overrides should be justified and logged. Data quality, model calibration, and alignment with the Enterprise-Wide Risk Assessment are critical. A well-designed customer risk rating enables efficient resource allocation, supports regulatory compliance, and demonstrates that the institution truly understands and manages the risks of its customer base.

Transaction Monitoring (TM) Program Design is a core pillar of an Anti-Financial Crime (AFC) program and a key focus area for CAMS practitioners working in governance and risk management. Its purpose is to detect unusual or suspicious activity that may indicate money laundering, terrorist financing, sanctions evasion, fraud, or other financial crimes, enabling timely investigation and regulatory reporting (e.g., SARs/STRs).

Effective design begins with a risk-based approach. The institution's enterprise-wide risk assessment (EWRA) identifies inherent risks across customers, products, services, geographies, and delivery channels. TM scenarios and typologies should map directly to these identified risks so that monitoring coverage is defensible and proportionate—higher-risk segments warrant more intensive or lower-threshold monitoring.

Key design components include: (1) Data governance—ensuring complete, accurate, and timely data feeds from source systems, with data lineage and reconciliation controls, since poor data quality undermines detection; (2) Scenario and rule development—selecting rules (e.g., structuring, rapid movement of funds, unusual cash activity, high-risk jurisdiction flows) and, increasingly, behavioral or machine-learning models, each supported by documented rationale; (3) Threshold setting and segmentation—calibrating parameters by customer segment to balance detection effectiveness against false positives, supported by statistical analysis such as above-the-line/below-the-line testing; (4) Alert management—defining workflows, prioritization, escalation paths, investigation standards, and documentation requirements; and (5) Model risk management—independent validation, periodic tuning, change management, and ongoing performance monitoring consistent with regulatory expectations such as OCC 2011-12/SR 11-7.

Governance is essential. Senior management and the board should approve the TM framework, receive management information (alert volumes, SAR conversion rates, backlogs, tuning outcomes), and ensure adequate staffing and technology. Policies and procedures must be documented, roles clearly assigned across the three lines of defense, and the program subjected to independent audit.

Ultimately, a well-designed TM program is dynamic—continuously refined in response to emerging typologies, regulatory feedback, business changes, and lessons learned—demonstrating to regulators that the institution understands and actively manages its financial crime risk.

In the CAMS framework for AFC Program Governance and Risk Management, risk assessment is the foundational process that drives a risk-based approach. There are several types: the enterprise-wide AML/CFT risk assessment, which evaluates money laundering, terrorist financing and sanctions exposure across the whole institution; business-line or product-specific assessments; customer risk assessments (performed at onboarding and periodically); jurisdictional or country risk assessments; and thematic assessments such as sanctions or bribery and corruption risk. Together these allow a firm to identify, measure and prioritize its financial crime exposure.

Inputs are the data and intelligence feeding the assessment. Key inputs include customer data (types, ownership structures, PEP status, occupation), products and services offered (e.g., private banking, correspondent banking, trade finance, cash-intensive accounts), delivery channels (face-to-face versus non-face-to-face, third-party intermediaries), geographic footprint (high-risk or sanctioned jurisdictions, FATF grey/black lists), transaction volumes and patterns, prior audit and regulatory findings, SAR/STR trends, typologies published by FATF, FinCEN or national FIUs, and the national risk assessment. Inputs also include an evaluation of existing controls: policies, KYC/CDD, transaction monitoring, screening, training and governance.

Outputs are the results that management and the board rely upon. These include an inherent risk rating (risk before controls), a control effectiveness rating, and a residual risk rating (risk remaining after controls). Outputs should be documented in a formal report with heat maps, risk scores by category and business line, identified control gaps, and a risk appetite comparison. These outputs are presented to senior management and the board and shared with regulators.

Mitigation translates findings into action. Where residual risk exceeds appetite, firms implement remediation plans: enhancing due diligence for high-risk customers, tightening transaction monitoring thresholds, exiting unacceptable relationships, strengthening sanctions screening, increasing training, adding staff or technology, and refining policies. Mitigation must be tracked, owned by accountable executives, and validated through independent testing. The assessment is then refreshed periodically or upon trigger events, closing the governance loop.