Planning and scoping Risk-Based AML/CFt on-site examinations

the model used is often informed by the availability of supervisory resources, including specialized skills, as well as by the size and complexity of the sector. All models have advantages and disadvantages. However, in any model, clear objectives and a mandate, AML/CFt supervisory knowledge and expertise, a high degree of operational and financial independence, adequate supervisory resources, and effective enforcement powers are essential. Jurisdictions that have designated the AML/CFt supervisor outside of the sectoral supervisory authority and those that have created specialized AML/CFt supervisory units within the sectoral supervisory authority should pay attention to coordination between the two authorities or units. In jurisdictions with an integrated structure, equal attention should be paid to AML/CFt supervision, and adequately experienced staff should be available for AML/CFt oversight. the staffing of on-site examinations depends on several factors, including how the AML/CFt supervision function is organized within the supervisory authority. Irrespective of how AML/CFt supervision is organized, on-site examinations should be conducted by supervisors with a robust understanding of possible ML/tF risks and AML/CFt issues. they should also be knowledgeable about the AML/CFt legal framework and its interpretation.

PLANNING AND SCOPING RISK-BASED AML/CFT ON-SITE EXAMINATIONS

Examination Notification

supervisors generally notify management in advance of a proposed examination. this notification informs the institution of the scope and purpose of the examination, the dates of the examination, the documents and information that will be required, and the meetings that will be held with management and staff. Part of the notification will be a request for information, such as business-wide ML/tF risk assessments, AML/CFt policies and procedures, and compliance monitoring and audit reports for examiners to analyze before the on-site visit. the advantage of prior notification and the request for information is that the institution has time to prepare all of the necessary information in advance and to arrange for the appropriate staff to be available for the examiners to interview. this preparation facilitates the examination process.

An alternative approach is to conduct an unannounced inspection, in which examiners do not provide prior notice that an inspection will occur. this approach is generally used when there are indications of violations of AML/CFt obligations or reasonable grounds to suspect that the institution, including any of its managers and staff, is involved in illicit activities. In such cases, advance notice may not be appropriate because the supervisor wants to safeguard evidence. In this case, of course, the institution will not have prepared any information, and key staff may not be available immediately. surprise examinations are an important tool that should be at the supervisor’s disposal. Although prior notice is recommended in most cases, it should not be binding on the supervisors, and institutions should be aware that prior notice is at the discretion of the supervisory authority. In addition, while inspecting an institution, supervisors can always make surprise visits to its departments or branches and conduct surprise interviews with staff. surprise examinations can be more difficult to organize in the case of cross-border on-site visits, when home supervisors decide to inspect a branch in a host jurisdiction. In that case, the host supervisor may have a different practice in relation to examination notification.

When circumstances warrant, the information and meetings requirements can change during the examination. the institution should make physical arrangements, including providing adequate workspace and access to necessary information, systems, and staff.

Information Request

the following list is an example of the types of information that should be obtained and reviewed prior to the start of an on-site inspection. some information will be available within the supervisory authority, for instance, as part of the off-site process. other information will need to be obtained from the institution. the types of information include:

● the risk profile of the institution, which is developed as part of the off-site process, previous examination reports, supervisory recommendations, and corrective actions taken;

● the history of supervision and enforcement actions with respect to AML/CFt and other supervision topics;

● Where relevant, foreign supervisors’ reports, particularly for financial groups and cross-border operations;

● the most recent business-wide ML/tF risk assessment of the financial institution, including information on the institution’s risk appetite, which should at least address inherent risks and compliance measures;

● the corporate structure, including information on ownership and management;

● the current organizational chart, including information on positions of the audit and compliance functions;

● the latest AML/CFt compliance programs, including policies, procedures, work instructions on client due diligence and suspicious transactions reports (stRs), and the AML/CFt training program;

● Internal audit reports on AML/CFt issues and compliance reports, including the history of stRs;

● Actions taken with respect to the United nations and domestic sanctions (for example, assets frozen or number of potential vs. actual matches on sanctions lists);

● external audit reports and management’s responses to any previously identified AML/CFt issues;

● Information on the number of customers, refused businesses, and closed accounts;

● Lists of customers1 and alerts from the transaction-monitoring process to facilitate the selection of customers’ files and transactions to be tested during the examination; and

● Any information in relation to the loss or restriction—if any—of correspondent banking relationships.2

some information, such as qualitative and quantitative information on stRs and reporting behavior, might have to be obtained from other authorities. Depending on the focus of the inspection, the on-site inspection team may also meet with the FIU to discuss possible concerns about the institution (for example, issues concerning the number and quality of stRs). this information can provide useful insights into an institution’s monitoring, analysis, and reporting regime.