Who Owns AML Judgment?
Risk-based AML/CFT programs in banking rely on judgment, but judgment is not the same as personal discretion. This chapter focuses on the people and institutions that make a bank’s risk choices credible: senior management, the board, the AML/CFT officer, business staff, compliance, independent testing, and supervisors. The practical test is whether those roles connect risk information to funded controls, challenge weak decisions, and update the program when experience shows that its assumptions no longer hold.
A risk assessment can identify an exposure and a customer profile can point to a monitoring response. Neither one acts on its own. People decide whether a new product should launch, whether a relationship can be understood well enough to continue, whether a monitoring system is working, and whether resources are sufficient for the bank’s risk profile. A risk-based program becomes reliable only when those decisions have clear owners and can be examined from more than one direction.
The bank must make judgment visible
FATF’s banking-sector guidance places responsibility first with senior management and the board. Successful implementation of a risk-based approach depends on leadership and oversight of its development and operation across the bank. That does not mean that directors or executives perform every customer review. It means they understand the ML/TF risks to which the bank is exposed, know how the control framework is meant to mitigate those risks, and receive objective information about whether it is working.
The distinction matters because risk appetite is a management decision, not a replacement for risk assessment. The bank’s assessment describes the exposures it faces. Its risk appetite expresses the level of residual risk—risk remaining after mitigation—that it is prepared to accept. Management should decide what measures are needed to reduce exposure and whether the remaining risk is consistent with the bank’s stated approach. A bank cannot make a serious risk acceptable simply by writing “accepted” beside it. It needs a reasonable basis for believing that the risk can be mitigated and a way to detect when that belief is no longer sound.
Senior leadership also controls the conditions under which judgment can be exercised. FATF says management should resource the AML/CFT unit, establish communication mechanisms linking the board, the AML/CFT officer, relevant committees, technology functions, and business areas, and receive regular information about both risk and control effectiveness. A program that expects more scrutiny of high-risk relationships but does not provide the people, information, systems, or time to perform it contains a resource contradiction. The stated priority and the operational capacity point in different directions.
The AML/CFT officer is the role that helps hold the system together. The title itself is less important than the position’s authority and access. FATF says responsibility for consistency and effectiveness should be clearly allocated to an individual with sufficient seniority, and that the compliance officer should have independence, authority, resources, expertise, and access to relevant information across lines of business and, where relevant, foreign branches and subsidiaries.