Thethird line of defense (internal audit)providesindependent oversightof an institution'sAML/CFT compliance framework.
* Option B (Correct):The internal audit function should report to the board's audit committeeto maintainindependence and objectivity.
* Option A (Incorrect):While frequent audits are essential, AML audits should be risk-based rather than mandated at a strict 12-month interval.
* Option C (Incorrect):Internal audit must assess remediation plansto ensure they adequatelyaddress AML deficiencies.
* Option D (Incorrect):The third line of defense should not be involved in daily AML operationstoavoid conflicts of interest.
Three Lines of Defense in AML Risk Management:
A screenshot of a computer Description automatically generated

Best Practices for AML Audit Function:
* Ensure complete independence from AML operations.
* Conduct risk-based audits tailored to emerging threats.
* Report audit findings to the board for effective oversight.
Reference:
Basel Committee's "Sound Management of ML/TF Risks"
FATF Recommendation 18 (AML Internal Controls & Oversight)
Wolfsberg Group AML Audit Guidelines

Thelife insurance industryis vulnerable tomoney laundering and terrorist financing, especially when policies allowpayments to unknown third parties.
Option A (Correct):Allowing policyholders to transfer funds tounknown third partiesincreases therisk of money laundering. FATF andEU AML Directiveshighlight life insurance policies as high-risk products.
Option B (Incorrect):Completing KYC does not eliminate risk. Customers can use legitimate insurance products for illicit purposes.
Option C (Incorrect):While governance violations should be addressed, themain concern here is money laundering risk, not the compliance team's involvement in product development.
Option D (Incorrect):Fast-tracking approvalwithoutproper risk assessmentcreates regulatory and reputational risks.
Reference:FATF Report on ML/TF Risks in Life Insurance (2021), EU AMLD Directives, Wolfsberg Group Insurance Sector Guidelines.

The risk-based approach (RBA) is an essential foundation of the FATF Recommendations, as it allows countries, competent authorities and financial institutions to adopt a more flexible set of measures to target their resources more effectively and apply preventive measures that are commensurate to the nature of risks, in order to focus their efforts in the most effective way. The RBA is not optional, but a prerequisite for the effective implementation of the FATF Standards. The RBA requires the identification, assessment and understanding of the ML/TF risks to which the countries and FIs are exposed, and the implementation of AML
/CFT measures that are proportionate and tailored to those risks. The RBA is not a "zero failure" approach, but a way to mitigate the risks in the most efficient and effective manner.
FATF Recommendations, Introduction, page 11
FATF Guidance on the Risk-Based Approach to Combating Money Laundering and Terrorist Financing - High Level Principles and Procedures, page 3 Risk-based Approach (RBA), What is the Risk-based Approach (RBA)?

This is a red flag of money laundering or terrorist financing that involves the use of non-profit organizations (NPOs) as conduits for illicit funds. NPOs may be vulnerable to abuse by criminals who exploit their legitimate activities, reputation, and access to funds and resources. A transaction monitoring process that would alert a bank for this red flag activity is to analyze the source, destination, frequency, and purpose of the funds transferred to and from the charity account, and to compare them with the expected profile and activity of the NPO. If the bank detects any inconsistency, discrepancy, or deviation from the norm, it should raise an alert and conduct further investigation.
FATF Report: Risk of Terrorist Abuse in Non-Profit Organisations, page 9 Transaction Monitoring Processes for Red Flag Activity in Banking AML Red Flags - What are the Top 10 Indicators? - ComplyAdvantage, section "Red flags related to the nature of transactions"

Customer composition and product offerings are two important factors that affect the level of risk exposure for a financial institution (FI) in terms of money laundering and terrorist financing. Customer composition refers to the types of customers that the FI serves, such as individuals, businesses, non-profit organizations, or politically exposed persons (PEPs). Different customer segments may pose different levels of risk depending on their activities, sources of funds, geographic locations, and connections to other entities. For example, customers that are cash-intensive, have complex ownership structures, operate in high-risk jurisdictions, or are associated with PEPs may present higher risk indicators than customers that are transparent, regulated, and operate in low-risk jurisdictions12. Product offerings refer to the types of products, services, and transactions that the FI provides, such as deposits, loans, wire transfers, trade finance, or digital assets. Different products, services, and transactions may have different levels of vulnerability to money laundering and terrorist financing depending on their features, complexity, volume, and speed. For example, products that are anonymous, involve high-value or cross-border transfers, enable rapid movement of funds, or involve new or emerging technologies may present higher risk indicators than products that are identifiable, involve low- value or domestic transfers, require multiple verification steps, or involve established or traditional technologies12.
1: Risk Assessment: Risk Factors & Mitigating Measures2
2: Risk Assessment: Process, Examples, & Tools1