Section 3

What is a compliance program?

An internal AML and ATF framework required under the PCMLTFA

Why is a compliance program important?

It helps detect prevent and manage money laundering and terrorist financing risks

Who must implement a compliance program?

Every reporting entity under the PCMLTFA

How many core elements are required in a compliance program?

Six

What are the six required elements of a compliance program?

Compliance Officer; Policies and Procedures; Training Program; Training Plan; Effectiveness Review; Risk Assessment and Risk Mitigation

Who is responsible for implementing and overseeing the compliance program?

The Compliance Officer

Who remains ultimately responsible for compliance?

The reporting entity

What authority should a Compliance Officer have?

Enough authority and resources to effectively perform their responsibilities

Who should the Compliance Officer report to?

Senior management; the board; the owner; or the chief operator

Can a Compliance Officer delegate responsibilities?

Yes; but accountability remains with the Compliance Officer

What is the primary role of the Compliance Officer?

Implement oversee and continuously improve the compliance program

What is the purpose of AML and ATF policies?

To establish the organization's compliance requirements and expectations

What is the purpose of AML and ATF procedures?

To describe how policies are carried out in practice

Why are both policies and procedures required?

Policies explain what must be done; procedures explain how it is done

Who must approve compliance policies and procedures?

A senior officer

Why should policies be tailored to the organization?

Every reporting entity has different products services clients and risks

Should generic compliance templates be adopted without modification?

No

What should compliance procedures clearly identify?

Who performs each task; what must be done; when it must occur; and how it is completed

What should policies include regarding client identification?

Identity verification; beneficial ownership; politically exposed persons; and ongoing monitoring

What should policies include regarding reporting?

All FINTRAC reporting obligations and reporting procedures

What is the purpose of a training program?

To ensure personnel understand and comply with AML and ATF obligations

What is a training plan?

A documented plan describing how AML and ATF training is delivered maintained and tracked

Who should receive AML and ATF training?

Anyone whose duties expose them to money laundering or terrorist financing risks

When should new employees receive AML and ATF training?

Before they deal with clients or conduct regulated activities

What should ongoing AML and ATF training include?

Legislative changes; policy updates; emerging risks; and reporting responsibilities

What should employees learn about suspicious transactions?

How to recognize and report suspicious activity

Can an employee disclose that an STR has been submitted?

No

Why is tipping off prohibited?

It could compromise an investigation or allow assets to be moved

Are employees protected when reporting suspicious transactions in good faith?

Yes

What evidence of AML and ATF training should be maintained?

Training records

How often must an effectiveness review be completed?

At least once every two years

Who should conduct an effectiveness review?

Someone independent from the day to day compliance function

What is the purpose of an effectiveness review?

To determine whether the compliance program is operating effectively

What should an effectiveness review examine?

Policies; procedures; training; risk assessment; and compliance controls

When must the results of an effectiveness review be reported to senior management?

Within 30 days of completing the review

Why are effectiveness reviews important?

They identify weaknesses and opportunities to improve the compliance program

What is a self assessment?

An internal evaluation of AML and ATF controls and compliance activities

How often is a self assessment recommended?

At least annually

What should a self assessment evaluate?

Risk assessment; policies; procedures; training; and internal controls

What is risk?

The combination of the likelihood that an event will occur and the impact if it does occur

What is a risk assessment?

The process of identifying analyzing and evaluating money laundering and terrorist financing risks

Why is a risk assessment important?

It helps reporting entities identify understand and manage money laundering and terrorist financing risks

What factors must be considered in a risk assessment?

Clients; Geography; Products and services; Delivery channels; Affiliates; Technology

What are the four primary AML risk categories?

Clients; Products and services; Delivery channels; Geography

What is client risk?

The money laundering and terrorist financing risk associated with a particular client or client type

What is geographic risk?

Risk associated with countries regions or jurisdictions where clients or transactions originate

Why can geography increase ML and TF risk?

Some jurisdictions have weak AML controls high corruption sanctions or significant criminal activity

What is product and service risk?

Risk created by the products or services offered by the reporting entity

What is delivery channel risk?

Risk created by the method through which products or services are delivered

Why are non face to face delivery channels generally higher risk?

They may increase anonymity and make identity verification more difficult

What is affiliate risk?

Risk introduced through relationships with affiliated companies or third parties

What is technology risk?

Risk arising from the use of new technologies automated systems or digital services

What is a risk based approach?

Applying controls that are proportionate to the level of identified ML and TF risk

What is inherent risk?

Risk before any controls or mitigation measures are applied

What is residual risk?

Risk remaining after controls have been implemented

What is risk appetite?

The amount of risk an organization is willing to accept

What is risk tolerance?

The amount of variation from acceptable risk levels that an organization is willing to allow

Who is responsible for determining risk appetite?

Senior management

Who is ultimately responsible for AML and ATF risk decisions?

Senior management

What is risk mitigation?

Implementing measures that reduce identified ML and TF risks

When should risk mitigation measures be applied?

When higher ML or TF risks have been identified

What are enhanced measures?

Additional controls applied to higher risk clients products or situations

How should politically exposed persons be treated?

As high risk clients requiring enhanced due diligence and increased monitoring

What should be done for high risk clients?

Apply enhanced due diligence and enhanced ongoing monitoring

What are the four risk treatment options?

Accept; Mitigate; Assign; Avoid

What is the objective of risk mitigation?

Reduce the likelihood or impact of identified risks

Name common risk mitigation measures.

Enhanced due diligence; Increased monitoring; Transaction limits; Senior management approval; Additional verification

Why are transaction limits an effective mitigation measure?

They reduce exposure to higher risk products or activities

Why is senior management approval used as a mitigation measure?

It provides additional oversight for higher risk situations

Why should customers be categorized by risk?

To ensure monitoring and controls are appropriate to their level of risk

What determines the nature of an organization's monitoring program?

The size nature complexity and ML or TF risk of the business

What are the three levels of monitoring?

Continuous; Regular; Selective

What is continuous monitoring?

Ongoing monitoring of client activity throughout the business relationship

What is regular monitoring?

Monitoring performed at scheduled intervals based on risk

What is selective monitoring?

Monitoring targeted toward specific higher risk clients products or activities

Why must AML and ATF programs be monitored continuously?

Risks laws products and criminal methods change over time

Why must risk assessments be updated?

Business operations products services and ML or TF risks change over time

Can a compliance program remain static over time?

No; it must evolve as risks and regulatory requirements change

Why should management support risk management?

Strong management commitment improves implementation oversight and compliance culture

What three organizational factors influence effective risk management?

Management commitment; Risk appetite; Risk management philosophy

What is risk management philosophy?

The organization's overall approach to identifying evaluating and responding to risk

What should a FINTRAC examination demonstrate?

The compliance program is documented implemented effective and current

What authority does FINTRAC have under the PCMLTFA?

To examine records inquire into business affairs and assess compliance

What types of FINTRAC examinations are conducted?

Desk based examinations; On site examinations

What can FINTRAC issue when non compliance is identified?

Administrative Monetary Penalties or refer matters for criminal prosecution

What does AMP stand for?

Administrative Monetary Penalty

What is the purpose of an Administrative Monetary Penalty?

To encourage compliance with the PCMLTFA

How are Administrative Monetary Penalties classified?

Minor; Serious; Very serious

What is a Ministerial Directive?

A legally binding directive issued under the PCMLTFA to address ML or TF risks

Can failing to comply with a Ministerial Directive result in penalties?

Yes

What is the maximum fine on indictment under the PCMLTFA?

Up to two million dollars

What is the maximum imprisonment on indictment under the PCMLTFA?

Up to five years