AML/CFT compliance programme consulting for controls your supervisor can test and trust.

What it is

What is an AML/CFT compliance programme and what is it used for?

An AML/CFT compliance programme is the set of policies, procedures, controls, people and records a business uses to stop criminals moving illicit money through it, and to spot and report activity that may be linked to terrorist financing. It turns anti-money laundering law into daily practice: who the customer is, what normal looks like and what happens when something does not fit.

The global benchmark is set by the Financial Action Task Force, the inter-governmental body founded in 1989 that describes itself as the global money laundering and terrorist financing watchdog. Its Recommendations are addressed to countries, which write them into national law; supervisors then set the detailed rules for obligated firms. No two regimes are identical, so Sterling builds every programme to the client's own national law and supervisor's rules, working alongside the client's legal advisers. Nothing on this page is legal advice.

Current standard. The FATF Recommendations, 40 in all, were adopted in 2012 and have been amended many times since; the FATF states that it regularly updates and refines them as threats evolve. Countries are assessed on them through FATF mutual evaluations, which look at both the laws in place and whether they work in practice. There is no certificate for a firm; supervisors and banking partners look for a documented, risk-based programme that operates.

Who it is for

Who needs an AML/CFT compliance programme?

The FATF expects countries to require financial institutions, and designated businesses and professions such as casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, accountants and trust and company service providers, to apply these measures in defined circumstances. Your national law decides whether and when your business is covered. Organisations usually reach Sterling from one of four starting points:

• A banking or payment partner is asking questions. A correspondent bank or acquirer wants your policies, risk assessment and screening before it onboards or renews you.
• A licence, tender or investor requires it. Licence applications, funding rounds and contracts often expect a documented framework and an appointed compliance officer.
• Your supervisor is coming, or has already found gaps. An inspection is scheduled, or last visit's findings need closing with evidence that the fixes operate.
• A group needs one programme across its companies. The FATF expects financial groups to run group-wide programmes. Subsidiaries need one core standard with local rules on top.

The aim is a programme your people run every day. A policy nobody applies is exactly what an inspection is designed to find.

Requirements

What are the main AML/CFT programme requirements?

The FATF Recommendations are grouped in seven areas, from national policy to international cooperation. For a business, the preventive measures and the Recommendations on internal controls carry most of the weight. The list below maps the programme elements to the Recommendation titles as the FATF states them; your national law sets the precise duties, thresholds and timings, and we work to those.

• Risk assessment (Recommendation 1): identify, assess and document your own money laundering and terrorist financing risks, and scale controls to them.
• Customer due diligence (Recommendation 10): identify and verify customers and beneficial owners, understand the purpose of the relationship and keep due diligence current.
• Higher-risk relationships (Recommendations 12, 13 and 19): additional measures for politically exposed persons, correspondent banking and higher-risk countries.
• Targeted financial sanctions (Recommendations 6 and 7): screening and freezing procedures for the sanctions lists your country applies.
• New technologies and third parties (Recommendations 15 and 17): assess new products and delivery channels, and control any reliance on others for due diligence.
• Ongoing monitoring: scrutiny of transactions across the relationship, so unusual activity is detected and escalated.
• Suspicious transaction reporting (Recommendations 20 and 21): prompt reports to the financial intelligence unit, with tipping-off and confidentiality controls.
• Record-keeping (Recommendation 11): due diligence and transaction records kept for the period your law requires and retrievable on request.
• Internal controls (Recommendation 18): a compliance officer at management level, employee screening, ongoing training and an independent audit function.

Compliance process

How do you build an AML/CFT compliance programme?

Start from your obligations, then your risks, then your controls. Sterling designs and builds the programme with you; your compliance officer owns it, your legal advisers interpret the law, and your supervisor judges it. Keeping those roles separate is what makes the programme defensible.

1. 01
   Confirm the obligations that apply to you.With your legal advisers, establish which national law and supervisor's rules cover your activities, products and countries.
2. 02
   Gap analysis: compare today's controls with those rules.Review policies, onboarding, screening, monitoring, reporting and records, keep what works and agree owners and dates for the rest.
3. 03
   Assess the risks and design the programme.Complete the enterprise-wide risk assessment, then set customer risk scoring, due diligence levels, monitoring scenarios and escalation routes to match it.
4. 04
   Implement, train and test.Put the procedures into use, train staff by role, then run internal audit and the independent review, closing findings with evidence.
5. 05
   Operate, report to the board and stay current.Keep risk assessments, lists and scenarios up to date, report programme performance to management and be ready for supervisory inspection at any time.

Check the route before you sign. The FATF sets standards for countries and evaluates countries, not firms, so treat any offer of an "AML certificate" or "FATF certification" with caution. Ask any adviser to show how the programme maps to your national law and supervisor's guidance, confirm your legal advisers review the interpretations, and make sure your compliance officer remains the accountable owner.

Cost

How much does an AML/CFT compliance programme cost?

There is no standard price, because obligations and risk vary so much. A small single-country professional firm needs far less than a multi-country payment institution. We scope on the real drivers and fix the fee.

Timeline

How long does it take to build an AML/CFT programme?

A first programme typically takes three to six months, depending on how much exists today, how many customers need their files brought up to standard and how quickly decisions are made. Controls then need to run long enough to produce the records an inspector will sample. We plan backwards from any inspection or partner deadline.

If a supervisor has set a deadline, tell us on day one. We will say plainly what can be evidenced by then and what needs a remediation plan agreed with the supervisor.

Your engagement

What your AML/CFT engagement includes

Sterling OS™ runs the engagement. In Design™ we guide your team as it builds the programme; in Drive™ we manage the build and carry more of the work. They are alternative levels of support, not stages, and you choose one. Once the programme is live, Sustain™ keeps it current, and Automate™ is Effivity, where the programme runs.

• Obligations map, gap analysis and plan

  Built on your national rules with your legal advisers, with owners and dates agreed before work starts.

• Risk assessment and programme documents

  Enterprise-wide risk assessment, AML/CFT policy, due diligence, screening, monitoring and reporting procedures, on Sterling's own template sets.

• Effivity ISO & GRC software

  Registers, risk assessments, actions and records in Effivity from day one, included with the engagement at no additional cost.

• Training by role

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management reporting

  Programme testing conducted or facilitated as agreed, with findings closed with evidence and reported to management.

• Inspection readiness

  Case walk-throughs, evidence packs and support while you respond to supervisory requests.

There is no certificate: Sterling does not certify, attest or validate AML/CFT compliance, and the assessment of your programme rests with your national supervisor.

Often combined with

Standards organisations pair with AML / CFT programme (FATF)

• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.