Toward a Financial Integrity Risk Management Program

A Holistic Framework for AML, Sanctions Compliance, ABC, Anti-Fraud, and Export Control Compliance

📅 December 19, 2024

Most jurisdictions around the world require financial institutions to adopt anti-money laundering (AML) programs in line with well-established global standards. These programs consist of what collectively have commonly become known as the “pillars” of an effective AML program:

Governance, including designating a person in charge of the AML program;
A system of internal controls to ensure ongoing compliance;
Customer due diligence (CDD);
Role-based enterprise-wide training; and
Independent testing for compliance by bank personnel or an external party.

The pillars of an effective AML program overlap significantly with the key elements of sanctions compliance, anti-bribery and corruption (ABC), fraud risk management, and export control compliance programs. As detailed below, these commonalities exist despite the different origin, purpose, and evolution of each field.

The AML program pillars are based largely on global standards articulated by the Financial Action Task Force (FATF), the Basel Committee on Banking Supervision (BCBS), and U.S. and EU regulations. Supervisors in most jurisdictions require their adoption by covered entities, including financial institutions (FIs), designated non-financial businesses and professions (DNFBPs), and virtual asset service providers (VASPs), in accordance with FATF recommendations
The sanctions compliance program pillars are based on OFAC’s landmark 2019 guidance publication “A Framework for OFAC Compliance Commitments.” The guidance is followed by global financial institutions due in large part to the threat of U.S. enforcement actions, and increasingly by other banks seeking access to the international financial system and cross-border payments. Supervisors in many jurisdictions require covered institutions to implement UN and local targeted financial sanctions, in accordance with FATF recommendations.
The ABC program pillars are based largely on global standards and guidance articulated by the Wolfsberg Group, other international organizations, and anti-corruption agencies in the United States, EU, UK, and elsewhere. Such programs are broadly implemented by FIs and corporates globally in part because of the threat of enforcement actions and reputational risk.
The fraud risk management program pillars are based on global standards articulated by the Committee of Sponsoring Organizations (COSO) and guidance from financial regulators like the Office of the Comptroller of the Currency (OCC) in the United States and elsewhere. Such programs are broadly implemented globally by FIs and other firms in large part because of self-interest and the threat of enforcement actions.
The export control compliance program pillars are based on guidance from the U.S. Commerce Department’s Bureau of Industry and Security (BIS) and similar EU guidance in line with multi-lateral export control regimes. Such programs have been widely implemented by corporates involved in exporting controlled items and have increasingly become the focus of global financial institutions involved in financing trade transactions, especially considering the increased attention on trade controls imposed in response to Russia’s war in Ukraine.

Common Compliance Program Elements
So what exactly do AML, sanctions compliance, ABC, anti-fraud, and export control compliance programs have in common? How do they overlap, and how are they different? The chart below depicts the essential elements of each program as provided by standard-setting and regulatory bodies described above.

AML Program Pillars	Sanctions Compliance Program Pillars	ABC Program Pillars	Fraud Risk Management Program Pillars	Export Compliance Program Pillars
Governance	Management Commitment	Governance	Control Environment	Management Commitment
Risk Assessment (under Internal Controls)	Risk Assessment	Risk Assessment (under Internal Controls)	Risk Assessment	Risk Assessment
Internal Controls • Aimed at identifying, assessing, and managing money laundering and other financial crime-related risks	Internal Controls • Aimed at identifying, assessing, and managing sanctions-related risks	Internal Controls • Aimed at identifying, assessing, and managing bribery and corruption risks • Policies and procedures called out as a standalone pillar	Fraud Control Activities • Aimed at deterring fraud and minimizing its likelihood • Fraud investigation, communica-tion, and corrective action	Control Activities • Aimed at minimizing risks of violating export controls • Handling violations and take corrective actions • Keeping records
Training	Training	Training and Communication	Training and Education (under control activities)	Training
Independent Testing	Testing and Auditing	Audit and Independent Testing	Fraud Monitoring	Conducting
CDD		Third-Party Risk Management

As shown in the chart, the various program types have several elements in common—governance, risk assessment, internal controls, training, independent testing, and customer due diligence—though in some cases they are referred to by different names and with varying degrees of emphasis.

All programs begin by describing governance as the first key pillar and highlight the importance of setting the right “tone from the top.” Sanctions and export control guidance call this element “Management Commitment” and fraud risk management program guidance calls it “Control Environment.”
All programs call for the development of a risk assessment as an essential element. Sanctions, export control, and anti-fraud guidance explicitly list “Risk Assessment” as one of the program pillars, while AML and ABC program guidance highlight the importance of risk assessments as part of the Internal Controls pillar.
Internal controls are a major part of every type of program to detect and prevent each form of illicit activity, with variations based on the type of risk. For example, internal fraud controls should identify and respond to insider threats.
Training is a key pillar for all programs. Although not explicitly listed as a pillar, fraud risk management program guidance includes training and education as part of preventative controls.
Independent testing is a key element of all programs, though some list it as “auditing” or “monitoring.”
Customer Due Diligence is explicitly identified as a key pillar of an AML program, and OFAC guidance calls out the importance of customer and transactional due diligence under other program elements.

Financial Integrity Risk Management Program: A Holistic Framework

Ultimately, AML, sanctions, ABC, fraud risk management, and export control compliance programs together help counter illicit finance activities and protect and advance the integrity of an enterprise and the financial system writ large. Given this unified purpose and the significant convergence in program elements, as described above, financial institutions and other firms should consider them to be part of one interconnected financial integrity risk management and compliance program. The simplified chart below presents such a framework.

A financial integrity risk management program begins with governance, referring to the “tone from the top,” and includes an institutional risk assessment, a training program, and an auditing function that holistically cover AML/CFT, sanctions compliance, ABC, fraud risk management, and export controls based on the risks faced by the institution.
Internal controls to include CDD are the cornerstone of the program, with different controls tailored identify, assess, and manage (“I.A.M.”) each risk type.

AML Program Pillars	Sanctions Compliance Program Pillars	ABC Program Pillars	Fraud Risk Management Program Pillars	Export Compliance Program Pillars
Governance	Governance	Governance	Governance	Governance
Risk Assessment	Risk Assessment	Risk Assessment	Risk Assessment	Risk Assessment
CDD	CDD	CDD	CDD	CDD
Internal Controls Controls • To I.A.M. money laundering and other financial crime-related risks	Controls • To I.A.M. sanctions-related risks • Emphasis on sanctions screening, blocking property, and prohibiting transactions	Controls • To I.A.M. bribery and corruption-related risks • Emphasis on policies & procedures (gifts/conflicts of interest) and third-party risk management	Controls • To I.A.M. fraud-related risks • Emphasis on not just clients but internal threats	Controls • To I.A.M. export control-related risks • Focused on trade-related transactions
Training	Training	Training	Training	Training
Auditing	Auditing	Auditing	Auditing	Auditing

As illicit actors and their activities intersect, or converge, and the actors use common methodologies to move and hide assets, institutions that adopt a comprehensive financial integrity risk management framework will be better situated to manage their real and regulatory risks.

Upcoming Webinar

Join the Institute for Financial Integrity on January 15th as we review the most important counter-illicit finance developments of 2024 and discuss what’s on the horizon for 2025.

2024 was a busy year, with developments in sanctions, export controls, anti-money laundering, countering terrorism financing and other financial crimes.

Led by IFI’s senior experts, this webinar will review these developments, including the rollout of key assessments, strategies, regulations, guidance, and enforcement actions by global financial integrity stakeholders.

Explore the Agenda and Register

Recommended Blogs

Safeguarding Trust – How to Balance Innovation and Security in Gen AI-Powered Compliance

December 12, 2024

This article explores how privacy-first architecture, robust guardrails, and source transparency can build trust while ensuring responsible AI deployment in compliance solutions.

Webinar Recap – The Dos, Don’ts & Expert Insights on Beneficial Ownership

December 10, 2024

In our recent webinar, regulatory, investigative, and anticorruption policy experts discussed some of the nuances relating to the U.S. Corporate Transparency Act (CTA) and its Beneficial Ownership reporting requirement. Explore the highlights in this article.

A Tipping Point

December 5, 2024

Learn how gen-AI is reshaping the industry and how tools like AskFIN, IFI’s gen-AI-powered financial crime assistant, are leveraging authoritative resources and privacy-first architecture to drive meaningful innovation.

Cold Turkey

December 3, 2024

Consumer spending over the holiday season is expected to top $1.66 trillion this year in the U.S. alone. This article describes five holiday season frauds to be aware of along with associated red flags to avoid being scammed.

The Sanctions Evasion Threat

November 26, 2024

It’s more important than ever for compliance officers to understand and recognize sanctions evasion typologies. In this article, we explore six of the most common techniques illicit actors use to evade sanctions.

How to be a Digital Asset Detective

November 21, 2024

Step into the role of a digital asset investigator. From tracing complex ownership structures to leveraging blockchain transparency, discover the tools and techniques that bring clarity to a sector often seen as cryptic. Follow along with our investigation into a digital asset business and come away with a step-by-step guide for uncovering hidden risks.

Side Quest

November 19, 2024

“Side quests” are initiatives that align staff motivations, interests, and experience with discretionary projects. They provide solutions to enhance staff engagement, performance, and retention, and are particularly valuable where resource constraints may slow promotions or pay increases, or where compliance tasks involve repetitive work.

Calibrating the Crosshairs

November 13, 2024

This article outlines a practical six-step process financial institutions can follow to implement export control red flags within their compliance program. They are referenced as a key requirement in regulatory expectations of financial institutions, which continue to increase in response to recent geopolitical events.

Unverified and Unsure

November 7, 2024

The Commerce Department’s Bureau of Industry and Security maintains and administers several lists that involve goods, software, and technology, governed by the Export Administration Regulations. The Unverified List is just one of these. What is the Unverified List and what due diligence obligations do entities that transact with parties on the Unverified List have?