5.1 Risk Management Framework: Lines of Defence, Policies, Assurance, and the MLRO

CAFCA sub-topic 1.4 covers the risk management framework: lines of defence, policies and procedures, the principles of assurance and quality control, and the responsible party, such as the MLRO. The exam favours answers that keep ownership, challenge and independent assurance separate, even at a small FinTech where one person may hold several roles.

The three lines model

The Institute of Internal Auditors updated the familiar "three lines of defence" in 2020 as the Three Lines Model. The idea is the same: separate the people who run controls, the people who oversee them, and the people who independently assure them.

A common weakness at fast-growing FinTechs is a compliance team that runs operations. If compliance reviews every alert and also writes the policy, there is no independent challenge. Combining roles may be unavoidable early on. In that case, record it, compensate with external testing, and plan to separate the roles as the firm grows.

Policies, standards and procedures

• Policy: approved by the board or a board committee. Says what the firm commits to and why, for example "We will not onboard unlicensed money transmitters."
• Standards: minimum requirements that apply across products, such as required CDD data fields, review frequencies and escalation thresholds.
• Procedures and desk instructions: how staff carry out a task, step by step, with screenshots, decision trees and service levels.

Each document needs an owner, a version history, a review date and a link to the obligation it implements (Chapter 4). Product changes often outpace procedure updates. That is a classic examination finding, because staff end up following practices that no approved document describes.

Quality control versus assurance

US BSA programmes must include independent testing. The UK Money Laundering Regulations require an independent audit function where appropriate to the firm's size and nature. QC results are useful inputs to assurance, but QC is never a substitute for it.

The responsible party: MLRO, nominated officer and BSA officer

• UK: the nominated officer receives internal suspicion reports and decides whether to submit a SAR to the National Crime Agency. In most firms this is the MLRO. Firms must also appoint a board member or senior manager responsible for compliance with the Money Laundering Regulations, where appropriate to their size. In larger FSMA-authorised firms the MLRO role is a senior management function (SMF17) under the Senior Managers and Certification Regime.
• US: each programme designates a BSA/AML officer with the authority, independence and resources to manage the programme. The officer reports regularly to the board and senior management.
• EU: the AML Regulation, which applies from July 2027, requires a member of the management body to be responsible for AML compliance and a compliance manager to run the day-to-day programme.

Whatever the title, the responsible officer needs stature (able to challenge executives), independence (not reporting to a revenue owner whose pay depends on growth), resources (staff and systems in line with risk) and access to the board.

Escalation when the business pushes back

FinTech growth targets create pressure: "close these alerts before the funding round", "skip address checks to improve conversion". A defensible response is to:

1. Put the request and the objection in writing at the time it happens.
2. Explain the obligation, the risk and the options, such as a compensating control, a phased rollout or a restricted launch.
3. Escalate through the governance route, for example the risk committee or the board audit committee, if the issue is not resolved.
4. Never falsify records or certifications, and never suppress a required report.

Many jurisdictions protect whistleblowers. In the US, the Anti-Money Laundering Act of 2020 expanded the BSA whistleblower programme, and the 2022 Anti-Money Laundering Whistleblower Improvement Act set awards at 10% to 30% of monetary sanctions collected in actions above US$1 million, extended the programme to sanctions violations, and provides anti-retaliation remedies. In the UK, the Public Interest Disclosure Act protects workers who make protected disclosures.

Realistic exam scenario

A neobank's head of growth asks the alert operations lead to bulk-close 6,000 aged alerts before a partner-bank audit. The operations team sits in the first line and reports to the head of growth. The right answer is to refuse bulk closure and escalate to the MLRO. Then agree a risk-based backlog plan (prioritise by risk, add trained staff, report to the board) and inform the partner bank honestly. Bulk closure without review would breach the policy and create a false record.

Common exam traps

• QA is not audit. Second-line testing does not replace independent third-line assurance.
• The MLRO should not report to sales or growth.
• Outsourcing internal audit is acceptable; outsourcing accountability is not.
• Policies without procedures fail in practice. Examiners test what staff actually do.