Toward a Financial Integrity Risk Management Program

A Holistic Framework for AML, Sanctions Compliance, ABC, Anti-Fraud, and Export Control Compliance

📅 December 19, 2024

Most jurisdictions around the world require financial institutions to adopt anti-money laundering (AML) programs in line with well-established global standards. These programs consist of what collectively have commonly become known as the “pillars” of an effective AML program:

Governance, including designating a person in charge of the AML program;
A system of internal controls to ensure ongoing compliance;
Customer due diligence (CDD);
Role-based enterprise-wide training; and
Independent testing for compliance by bank personnel or an external party.

The pillars of an effective AML program overlap significantly with the key elements of sanctions compliance, anti-bribery and corruption (ABC), fraud risk management, and export control compliance programs. As detailed below, these commonalities exist despite the different origin, purpose, and evolution of each field.

The AML program pillars are based largely on global standards articulated by the Financial Action Task Force (FATF), the Basel Committee on Banking Supervision (BCBS), and U.S. and EU regulations. Supervisors in most jurisdictions require their adoption by covered entities, including financial institutions (FIs), designated non-financial businesses and professions (DNFBPs), and virtual asset service providers (VASPs), in accordance with FATF recommendations
The sanctions compliance program pillars are based on OFAC’s landmark 2019 guidance publication “A Framework for OFAC Compliance Commitments.” The guidance is followed by global financial institutions due in large part to the threat of U.S. enforcement actions, and increasingly by other banks seeking access to the international financial system and cross-border payments. Supervisors in many jurisdictions require covered institutions to implement UN and local targeted financial sanctions, in accordance with FATF recommendations.
The ABC program pillars are based largely on global standards and guidance articulated by the Wolfsberg Group, other international organizations, and anti-corruption agencies in the United States, EU, UK, and elsewhere. Such programs are broadly implemented by FIs and corporates globally in part because of the threat of enforcement actions and reputational risk.
The fraud risk management program pillars are based on global standards articulated by the Committee of Sponsoring Organizations (COSO) and guidance from financial regulators like the Office of the Comptroller of the Currency (OCC) in the United States and elsewhere. Such programs are broadly implemented globally by FIs and other firms in large part because of self-interest and the threat of enforcement actions.
The export control compliance program pillars are based on guidance from the U.S. Commerce Department’s Bureau of Industry and Security (BIS) and similar EU guidance in line with multi-lateral export control regimes. Such programs have been widely implemented by corporates involved in exporting controlled items and have increasingly become the focus of global financial institutions involved in financing trade transactions, especially considering the increased attention on trade controls imposed in response to Russia’s war in Ukraine.

Common Compliance Program Elements
So what exactly do AML, sanctions compliance, ABC, anti-fraud, and export control compliance programs have in common? How do they overlap, and how are they different? The chart below depicts the essential elements of each program as provided by standard-setting and regulatory bodies described above.””

AML Program Pillars	Sanctions Compliance Program Pillars	ABC Program Pillars	Fraud Risk Management Program Pillars	Export Compliance Program Pillars
Governance	Management Commitment	Governance	Control Environment	Management Commitment
Risk Assessment (under Internal Controls)	Risk Assessment	Risk Assessment (under Internal Controls)	Risk Assessment	Risk Assessment
Internal Controls • Aimed at identifying, assessing, and managing money laundering and other financial crime-related risks	Internal Controls • Aimed at identifying, assessing, and managing sanctions-related risks	Internal Controls • Aimed at identifying, assessing, and managing bribery and corruption risks • Policies and procedures called out as a standalone pillar	Fraud Control Activities • Aimed at deterring fraud and minimizing its likelihood • Fraud investigation, communica-tion, and corrective action	Control Activities • Aimed at minimizing risks of violating export controls • Handling violations and take corrective actions • Keeping records
Training	Training	Training and Communication	Training and Education (under control activities)	Training
Independent Testing	Testing and Auditing	Audit and Independent Testing	Fraud Monitoring	Conducting
CDD		Third-Party Risk Management

As shown in the chart, the various program types have several elements in common—governance, risk assessment, internal controls, training, independent testing, and customer due diligence—though in some cases they are referred to by different names and with varying degrees of emphasis.

All programs begin by describing governance as the first key pillar and highlight the importance of setting the right “tone from the top.” Sanctions and export control guidance call this element “Management Commitment” and fraud risk management program guidance calls it “Control Environment.”
All programs call for the development of a risk assessment as an essential element. Sanctions, export control, and anti-fraud guidance explicitly list “Risk Assessment” as one of the program pillars, while AML and ABC program guidance highlight the importance of risk assessments as part of the Internal Controls pillar.
Internal controls are a major part of every type of program to detect and prevent each form of illicit activity, with variations based on the type of risk. For example, internal fraud controls should identify and respond to insider threats.
Training is a key pillar for all programs. Although not explicitly listed as a pillar, fraud risk management program guidance includes training and education as part of preventative controls.
Independent testing is a key element of all programs, though some list it as “auditing” or “monitoring.”
Customer Due Diligence is explicitly identified as a key pillar of an AML program, and OFAC guidance calls out the importance of customer and transactional due diligence under other program elements.

Financial Integrity Risk Management Program: A Holistic Framework

Ultimately, AML, sanctions, ABC, fraud risk management, and export control compliance programs together help counter illicit finance activities and protect and advance the integrity of an enterprise and the financial system writ large. Given this unified purpose and the significant convergence in program elements, as described above, financial institutions and other firms should consider them to be part of one interconnected financial integrity risk management and compliance program. The simplified chart below presents such a framework.

A financial integrity risk management program begins with governance, referring to the “tone from the top,” and includes an institutional risk assessment, a training program, and an auditing function that holistically cover AML/CFT, sanctions compliance, ABC, fraud risk management, and export controls based on the risks faced by the institution.
Internal controls to include CDD are the cornerstone of the program, with different controls tailored identify, assess, and manage (“I.A.M.”) each risk type.

AML Program Pillars	Sanctions Compliance Program Pillars	ABC Program Pillars	Fraud Risk Management Program Pillars	Export Compliance Program Pillars
Governance	Governance	Governance	Governance	Governance
Risk Assessment	Risk Assessment	Risk Assessment	Risk Assessment	Risk Assessment
CDD	CDD	CDD	CDD	CDD
Internal Controls Controls • To I.A.M. money laundering and other financial crime-related risks	Controls • To I.A.M. sanctions-related risks • Emphasis on sanctions screening, blocking property, and prohibiting transactions	Controls • To I.A.M. bribery and corruption-related risks • Emphasis on policies & procedures (gifts/conflicts of interest) and third-party risk management	Controls • To I.A.M. fraud-related risks • Emphasis on not just clients but internal threats	Controls • To I.A.M. export control-related risks • Focused on trade-related transactions
Training	Training	Training	Training	Training
Auditing	Auditing	Auditing	Auditing	Auditing

As illicit actors and their activities intersect, or converge, and the actors use common methodologies to move and hide assets, institutions that adopt a comprehensive financial integrity risk management framework will be better situated to manage their real and regulatory risks.

Recorded Webinar

The Institute for Financial Integrity reviewed the most important counter-illicit finance developments of 2024 and discuss what’s on the horizon for 2025.

2024 was a busy year, with developments in sanctions, export controls, anti-money laundering, countering terrorism financing and other financial crimes.

Led by IFI’s senior experts, this webinar will review these developments, including the rollout of key assessments, strategies, regulations, guidance, and enforcement actions by global financial integrity stakeholders.

View Recording

Recommended Blogs

September 2026 Monthly Sanctions and Export Controls Report

October 6, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from September 2026.

The Data Behind the Payment

September 30, 2026

Two changes have raised the bar on what banks can expect to see in a payment. Explore how corporate banks can put ISO 20022 and FATF's revised Recommendation 16 to work in transaction monitoring.

Dirty Barrels

September 24, 2026

While oil and gas is one of the world's most valuable and strategically important industries, it is vulnerable to corruption. Explore how corruption risks can arise throughout the lifecycle of an oil and gas transaction.

Real Estate, Real Risks

September 17, 2026

The FATF has identified the global real estate sector as an area requiring heightened attention due to its vulnerabilities to money laundering, terrorism financing, sanctions evasion and other illicit activity. This article explores why property transactions attract financial crime.

Iran and the Sanctions Landscape

September 10, 2026

Iran has spent nearly five decades under some form of U.S. economic sanctions, and the network built to evade those sanctions is correspondingly mature. Since February 2025, that architecture has come under the most intensive and sustained pressure it has faced since the 2015 nuclear deal.

August Monthly Sanctions and Export Controls Report

September 2, 2026

Explore this month’s Sanctions and Export Controls Update, highlighting IFI’s take on key developments from August 2026.

The Judgment Gap in Market Abuse Compliance

August 25, 2026

While banks may know the set of rules outlined in the EU’s Market Abuse Regulation, exposure sits in the judgment calls related to delayed disclosure, information barriers, and market soundings. Dive into where the risk lies in each area.

The Illicit Oil Pipeline: How Criminal Networks Turn Crude into Clean Cash

August 19, 2026

Money laundering in the oil sector is a highly lucrative global pipeline where illicit networks exploit the massive volume, complex supply chains, and liquid nature of the market. Explore the lifecycle of oil laundering schemes as well as key red flags.

Beyond the Course Library

August 12, 2026

A comprehensive compliance course library doesn’t guarantee prepared staff. Here's how forward-looking teams are moving beyond static course libraries toward learning that keeps pace with risk.

Previous Next