Three Lines of Defense: Case Study

When establishing an organizational model to effectively manage financial crime risk and regulatory compliance, we need to enable cohesive action towards enterprise objectives while also providing segregation of responsibilities and avoiding conflicts of interest. The “three lines of defense” is one well-established model to achieve these goals.

What are the three lines and how do they work together? Let’s take a look at a real-life case study of the three lines of defense.

In our previous article we outlined the three lines model and the responsibilities of each team. To summarize it into a few lines, it can be helpful to consider the second line as defining what needs to be done and the first line as identifying how it should be done. We can illustrate this using an example of controls that may be implemented as part of a client due diligence (CDD) framework. For this example, we’ll start with the second line.

Second Line: “Standard Setters”

The second line of defense undertakes tasks including:

• Interpreting external regulatory requirement to perform due diligence on clients
• Identifying if any regulatory enforcement actions identified weaknesses in CDD in other firms and the “lessons learned”
• Identifying which of these requirements apply to their firm, taking into consideration its geographic operations, client base, products, and any other relevant considerations
• Documenting and communicating the policy and standards to ensure both regulatory and internal requirements are met

The second line of defense sets standards for compliance, including:

1. Client due diligence must be performed on all clients
2. Clients are to be risk-rated according to the following characteristics (note that these are examples only):

• Country of operations (e.g. countries identified as having weak AML/CFT measures are high risk)
• Client industry (e.g. defense and dual-use industries are high risk)
• Type of entity (e.g. publicly listed companies are low risk)
• Regulated status (e.g. regulated businesses are low risk)

3. Enhanced due diligence is required for clients identified as overall high risk
4. If the client is an entity, the beneficial owners and controllers are to be identified
5. All entities and individuals in the corporate structure are to be screened against watchlists to check for sanctions, AML/CFT risks, and political exposure
6. Some client types are completely prohibited (e.g. shell companies or businesses that do not have the required licenses in their jurisdiction)

First Line: “Gatekeepers”

The first line of defense takes action to implement the requirements set out by the second line.

For the sales team, this might include writing and communicating a sales checklist with questions to help identify if potential client is prohibited. The advantage of doing this early in the process is that resources will not be invested in due diligence for a client that cannot be accepted.

For the Know Your Client (KYC) team, the following are examples of elements that could be included in the process manual written to implement second line requirements:

• Templates to use when requesting CDD information from clients
• Instructions on how to risk rate clients and workflows on the due diligence processes depending on the overall risk rating
• Lists of corporate registries that can be used when identifying owners and controllers of an entity
• Step-by-step instructions on how to use watchlist screening tools to check sanctions, AML/CFT, and political exposure and how to document findings
• Escalation paths for any financial crime risks identified

Third Line: “Assurance”

In our CDD example above, the internal audit function would undertake tasks such as setting out an audit schedule for the sales, KYC, and compliance functions to evaluate the effective application of CDD controls. They would document their findings and ensure any required remediation is completed.

The Future of Three Lines

The three lines has been and continues to be an effective risk management model. However, in new and emerging areas like digital assets, in-demand skillsets may be scarce, evolving products and markets require novel and innovative solutions, and there may be a need to adapt quickly to regulatory changes. What adaptations need to be made to the three lines model? View our recorded webinar to find out more.