Risk-Based Approach – Guidance for Money Service Businesses

Risk-Based Approach – Guidance for Money Service Businesses - July 2009Chapter Three: Internal Controls138. In order for MSB to have effective risk-based approaches, the risk-based process must beimbedded within the internal controls of the institutions. Senior management is ultimately responsible forensuring that a MSB maintains an effective internal control structure, including suspicious activitymonitoring and reporting. Strong senior management leadership and engagement in AML is an importantaspect of the application of the risk-based approach. Senior management must create a culture ofcompliance, ensuring that staff adheres to the MSB‟s policies, procedures and processes designed to limitand control risks.139. In addition to other compliance internal controls, the nature and extent of AML/CFT controls willdepend upon a number of factors, including:The nature, scale and complexity of a MSB‟s business.The diversity of a MSB‟s operations, including geographical diversity.The MSB‟s customer, product and activity profile.The distribution channels used.The volume and size of the transactions.The degree of risk associated with each area of the MSB‟s operation.The integrity of the systems used.The extent to which the MSB is dealing directly with the customer or is dealing throughintermediaries, third parties, or in a non face-to-face setting.140. The framework of internal controls should:Provide increased focus on a MSB‟s operations (products, services, customers and geographiclocations) that are more vulnerable to abuse by money launderers, terrorist financiers, and othercriminals.Provide for regular review of the risk assessment and risk management processes, taking intoaccount the environment within which the MSB operates and the activity in its market place.Designate an individual or individuals at management level responsible for managing AML/CFTcompliance.Provide for an AML/CFT compliance function and review programme.Ensure that adequate controls are in place before new products are offered.Inform senior management of compliance initiatives, identified compliance deficiencies,corrective action taken, and suspicious activity reports filed.Provide for programme continuity despite changes in management or employee composition orstructure.42 - © 2009 FATF/OECD