Over the past few months, I have conducted several independent reviews of Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) programs for businesses across different industries.
One issue continues to stand out, and I believe it deserves the attention of Chief Executive Officers, business owners and directors.
Many organisations have invested in purchasing an AML/CTF program, but they are struggling to demonstrate that the program has actually been implemented.
When I request evidence during an independent review, I am often provided with a comprehensive AML/CTF manual, policies, procedures, forms and checklists.
These documents may be well written and include much of what the legislation requires.
However, when I ask for evidence that the procedures have been followed, the information provided is often limited.
This raises an important question.
Do you have an AML/CTF program, or do you have a collection of documents sitting on a shelf or computer?
Documentation is one thing. Evidence is another.
A documented procedure is different from demonstrating that the procedure is being followed.
For example:
- Your program says employees must receive AML/CTF training. Can you produce records showing who completed the training, when it occurred and whether they understood their responsibilities?
- Your program requires transaction monitoring. Can you show when transactions were reviewed and whether unusual activity was identified and what action was taken?
- Your program requires customer due diligence. Can you demonstrate that the appropriate checks were conducted and recorded for relevant customers?
- Your program requires management oversight. Can you produce reports, meeting minutes or decisions showing that management has reviewed the effectiveness of the program?
- Your program requires risk assessments to be maintained. Can you demonstrate when risks were last reviewed, who conducted the review and whether changes were required?
Having a form available is not evidence that the activity has occurred.
A blank checklist tells me what you intend to do. A completed checklist, supported by appropriate records, helps demonstrate what you have actually done.
Of course, completing forms simply to create paperwork is not the answer either. The records need to reflect genuine activities, checks and decisions.
The real challenge for small and medium businesses
I understand the challenges small and medium businesses face.
Many Chief Executive Officers and business owners manage staffing, financial pressures, customers, operational issues, and numerous other compliance responsibilities.
It is not unusual for the AML/CTF Compliance Officer to have several other responsibilities within the organisation.
Purchasing an AML/CTF program can therefore seem like an efficient solution.
The business receives a manual, a risk assessment template, policies and a collection of forms.
But then comes the difficult part.
Who is going to implement it?
Who will train the employees?
Who will complete the customer and business risk assessments?
Who will monitor transactions?
Who will review the reports?
Who will make sure the required records are maintained?
And most importantly, who will check that these activities are actually happening?
Without clear responsibilities, practical processes and time allocated to complete the work, even a well-developed compliance program can become ineffective.
The responsibility does not end when the invoice is paid
AML/CTF legislation places important obligations on reporting entities, including appropriate governance and oversight, risk assessment, policy implementation, and ongoing compliance.
Engaging a consultant or purchasing an externally developed compliance program can be a sensible business decision.
However, your organisation remains responsible for meeting its AML/CTF obligations.
Senior management must ensure the program is appropriate for the business, approved and supported with the resources needed to implement it.
Your Compliance Officer needs time, training, authority and management support to carry out their responsibilities.
Your employees also need to understand not only what the program says, but what they must actually do in their daily activities.
For registered clubs, this may involve identifying unusual gaming transactions, conducting required customer checks and escalating suspicious activity.
For real estate businesses, accountants and other regulated service providers, the activities may look different, but the principle remains the same.
Your program must reflect the risks your business faces and be implemented in the way your organisation operates.
What should a CEO or business owner be asking?
You do not need to personally complete every AML/CTF task.
However, you should be confident that the required activities are being completed and that appropriate evidence is maintained.
I encourage CEOs and business owners to ask their Compliance Officer five simple questions:
- Can you show me what AML/CTF activities we have completed over the past three months?
- Can you demonstrate that employees understand and follow our AML/CTF procedures?
- Can you show me evidence of our transaction monitoring, customer due diligence and other required checks?
- What compliance issues or gaps have we identified, and what are we doing to address them?
- If an independent evaluator or AUSTRAC requested our records tomorrow, could we readily produce them?
These questions should lead to practical discussions about what is working, what is not working and where additional support may be required.
An important point is that not every activity will identify a problem. For example, a monitoring review may find no unusual transactions requiring further action.
That does not mean the review was unnecessary.
A record showing that the monitoring occurred, what was checked and the outcome provides useful evidence of the process being followed.
Start with a simple implementation plan
My advice to organisations that have purchased an AML/CTF program but have not fully implemented it is to start with the basics.
Identify the activities your program requires and turn them into a manageable schedule.
For each activity, establish:
- What needs to be completed.
- Who is responsible.
- When it needs to occur.
- How it will be recorded.
- Who will review the results.
For example, your organisation might schedule regular reviews of transaction monitoring, employee training records, customer due diligence activities, and outstanding compliance actions.
The frequency and extent of these checks should reflect the risks and legal obligations applying to your business.
A simple, well-managed system that employees understand and use is far more valuable than an extensive manual that nobody follows.
Importantly, assess any implementation gaps promptly, prioritising activities needed to meet legal obligations and manage money laundering and terrorism financing risks.
My final message to business owners
An AML/CTF program is not meant to be a document completed once and forgotten.
It is a working system designed to help protect your organisation, employees, customers and the broader community from financial crime.
The purpose of an independent evaluation is not simply to confirm that a manual exists. It is also to assess whether the organisation’s risk management arrangements are appropriate and whether its policies and controls are being followed.
From my experience conducting independent reviews, I would encourage every CEO and business owner to look beyond the program itself.
Ask to see the evidence.
If that evidence is difficult to locate, incomplete or does not exist, it may be time to review how your program is being implemented.
Don’t wait until your next independent evaluation to discover that your organisation has a well-written program but limited evidence of compliance.
Purchasing the program is the beginning.
Implementing it, monitoring its effectiveness and maintaining the evidence is what makes it work.
At CHD Partners, we work with small and medium businesses, including registered clubs, to help turn AML/CTF documentation into practical processes that can be implemented, monitored and demonstrated.
If your organisation has purchased an AML/CTF program but is struggling to find the time or resources to implement it, please reach out.
Australian Regulatory References
#CHDPartners #CIRT #RTO #WHS #WorkHealthAndSafety #Training #RiskManagement #SecurityAndSafetyCompliance #SME #SmallBusiness #MichaelHuggett #AUSTRAC #AMLCTFAnnualComplianceReports #AMLCTFCompliance #AMLCTF #AntiMoneyLaundering