Controls Reference Library

Before a customer can use the account, prove they are who they say they are using reliable, independent evidence, not just what they typed into the form.

For any company or trust customer, find out who really owns or controls it (the actual humans), and prove it, before letting them transact.

At sign-up, ask and record what normal looks like for this customer (how much, how often, to where) so monitoring can later spot when they behave nothing like that.

Score each new and existing customer for money-laundering risk from clear factors (who they are, what they do, where they are) so the firm spends most effort on the riskiest ones.

For the highest-risk customers, run a deeper, joined-up due diligence package (extra evidence, senior sign-off, closer monitoring) and make sure it actually happens before and during the relationship.

At sign-up the firm checks the applicant is a real, unique person using their genuine identity and device, blocking fake, stolen and bulk-created accounts before they open.

Flags when a customer pays in cash that does not fit their declared business or income, so unexplained cash can be reviewed before it disappears into the system.

Compares what a customer actually does on the account with what they told you they would do at sign-up, and flags when the two no longer match.

Catches people breaking one big payment into lots of smaller ones to stay under reporting or alerting limits, including when several accounts act together.

Spots money that arrives and leaves almost immediately, where the account is being used as a channel to move funds on rather than to hold or spend them.

Finds accounts being used by other people to receive and pass on dirty or stolen money, and links them together when they are part of the same ring.

Uses blockchain analytics to check where crypto sent or received by a customer has been, and flags links to mixers, illicit services or sanctioned addresses.

Checks that the firm's monitoring rules actually cover the risks the firm faces, so no major money-laundering pattern is left with no rule watching for it.

Regularly tests and adjusts monitoring rule settings so the firm catches real risk without drowning analysts in pointless alerts, with evidence for every change.

The firm spots when someone other than the real customer has gained control of an account, by watching for sudden changes in device, login and payment behaviour.

Checks every customer and payment against official sanctions lists before money moves, so the firm does not deal with a sanctioned person or entity.

Regularly tests the sanctions screening engine with known good and bad names to prove it actually catches what it should and is not silently letting hits through.

Flags customers who are senior public officials or their close associates so the firm applies extra checks before and during the relationship.

Searches news and public sources for negative stories about a customer (fraud, corruption, crime) so the firm spots risk that lists alone miss.

Checks the names, banks and countries on each payment message against sanctions lists in real time and holds anything that hits before the money leaves.

Adjusts how loosely or tightly the screening engine matches names so it keeps catching real hits while cutting the flood of false alarms.

Every customer's identity and risk information is refreshed on a fixed schedule so the firm never relies on stale onboarding data.

When something material changes about a customer, the firm reviews them straight away instead of waiting for the next scheduled review.

The customer's risk score is recalculated automatically from their real behaviour, so a customer who starts acting riskier is re-rated without waiting for a manual review.

The firm regularly proves that every account and every payment is actually being watched by its monitoring system, so nothing slips through an un-monitored gap.

A written, evidence-based picture of where the firm is most exposed to financial crime, kept current, so money and effort go to the riskiest areas first.

A clear, fast route for staff to raise a suspicion, for the MLRO to decide, and for a report to reach the authorities on time without tipping off the customer.

Regular, honest numbers and trends about financial crime risk put in front of senior leaders, so problems are seen and acted on instead of being buried.

A clear split of who owns risk, who oversees it, and who independently checks it, with named senior people accountable, so nothing falls through the gaps.

People independent of the day-to-day teams regularly test whether financial crime controls actually work, so weaknesses are found internally before a regulator finds them.

Make sure everyone, especially front-line and high-risk roles, knows how to spot financial crime and what to do about it, and prove they have understood it.

Stop financial crime alerts and cases piling up unworked by tracking how old they are, fixing the cause, and stepping in fast when the queue grows.

When financial crime work is outsourced or done by a partner, the firm still owns the risk, so it must check, oversee and be able to evidence the provider is doing the job.