Operational Risk, Fraud, AML and Business Continuity

Introduction and Context

Banking depends on trust, accuracy, availability and lawful conduct. A customer expects a payment to reach the correct beneficiary, account information to remain confidential, cash to be available when needed and suspicious transactions to be handled responsibly. Failures in any of these areas can create financial loss, regulatory penalties, customer harm and reputational damage.

Operational risk management addresses the possibility of loss arising from inadequate or failed internal processes, people and systems, or from external events. In banking, it is closely connected with fraud risk, money laundering and terrorist-financing risk, cybersecurity, technology resilience and business continuity. These subjects should not be treated as separate compliance activities. A weak access-control process, for example, may enable employee fraud; a cyberattack may interrupt payment services; and poor customer due diligence may allow criminal funds to enter the banking system.

This chapter presents a practical framework for identifying, assessing, controlling and reporting these risks. It is written for banking personnel who may work in branches, operations, customer service, payments, compliance, information technology or internal control.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain operational risk and distinguish process, people, system and external-event risks.
2. Identify common banking fraud schemes and warning indicators.
3. Explain customer due diligence, enhanced due diligence and the risk-based approach to AML.
4. Recognise suspicious activity and escalate it without alerting the customer.
5. Apply basic cybersecurity and incident-response practices.
6. Explain business continuity, disaster recovery, RTO and RPO.
7. Evaluate controls and communicate incidents accurately and ethically.

1. Operational Risk in Banking

Operational risk is commonly defined as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. This definition includes legal risk but generally excludes strategic and reputational risk, although operational failures can cause both.

Operational risk is present in routine activities such as opening accounts, authorising transactions, balancing cash, processing cheques, maintaining records, managing vendors and resolving complaints. It is not limited to dramatic events. A repeated data-entry error or an unauthorised override may create significant cumulative exposure.

Sources of operational risk

Risk event, cause and consequence

A useful analysis separates three elements:

• Cause: the underlying weakness, such as excessive user privileges.
• Risk event: what happens, such as an unauthorised transfer.
• Consequence: the result, such as financial loss, customer harm or regulatory action.

This distinction improves control design. Installing a second approval may reduce the likelihood of the transfer, while transaction insurance or a recovery plan may reduce its impact. Controls should address causes as well as symptoms.

Assessing risk

A simple qualitative assessment considers likelihood and impact. Where a numerical screening method is appropriate, expected loss can be expressed as:

Probability is expressed as a decimal between 0 and 1, and financial impact is measured in a stated currency. The calculation assumes that the probability estimate and impact estimate refer to the same period and that the estimate is meaningful despite uncertainty. It is not a prediction of the exact loss; it is a prioritisation tool.

For example, if an unauthorised-payment scenario has an estimated annual probability of 0.04 and an estimated impact of $50,000, the expected annual loss is:

A low-frequency event may still deserve urgent attention if its impact is severe. Qualitative categories such as low, medium, high and critical are therefore often used alongside numerical estimates.

The three lines of responsibility

A practical governance model assigns responsibilities as follows:

1. First line—business and operations: owns risks, follows procedures, performs controls and reports incidents.
2. Second line—risk and compliance: sets policies, advises, monitors and challenges the first line.
3. Third line—internal audit: independently evaluates governance, risk management and controls.

The board and senior management remain responsible for the institution’s risk culture and overall control environment. The model does not remove accountability from operational employees; it clarifies it.

2. The Operational Risk-Control Cycle

Effective control is a continuous cycle rather than a one-time checklist:

1. Identify activities and possible failure points.
2. Assess inherent risk before controls.
3. Select preventive, detective and corrective controls.
4. Record control ownership and evidence requirements.
5. Monitor indicators and incidents.
6. Test the control and report weaknesses.
7. Improve the process and reassess residual risk.

Preventive controls attempt to stop an event, for example segregation of duties, transaction limits and strong authentication. Detective controls identify an event after or while it occurs, such as reconciliations, exception reports and fraud monitoring. Corrective controls reduce continuing harm, such as account freezing, data restoration and customer remediation.

Important control principles include:

• Segregation of duties: no one person should initiate, approve and settle a high-risk transaction.
• Maker-checker authorisation: a second authorised person independently reviews a transaction.
• Least privilege: users receive only the access necessary for their duties.
• Dual control: two people are required for particularly sensitive actions, such as vault access or key management.
• Reconciliation: internal records are compared with an independent source and differences are investigated promptly.
• Exception management: unusual overrides and failed controls are recorded, explained and escalated.
• Audit trail: systems retain reliable records of who did what, when and under which authority.

A control that exists on paper but is routinely bypassed is not an effective control. Evidence, supervision and independent testing are essential.

3. Fraud Risk and Detection

Fraud is intentional deception or abuse of a position to obtain an unauthorised benefit or cause loss. It may be committed by customers, employees, agents, suppliers, organised criminal groups or combinations of these parties.

Common banking frauds

• Identity fraud: using stolen or fabricated identity information to open or access an account.
• Account takeover: gaining control of a legitimate customer’s credentials or device.
• Payment fraud: manipulating payment instructions, beneficiaries or approval processes.
• Card fraud: unauthorised use of card details, skimming or counterfeit cards.
• Cheque and document fraud: altering instruments, signatures or supporting documents.
• Loan fraud: submitting false income, collateral or employment information.
• Insider fraud: misuse of staff access, unauthorised overrides, concealment or collusion.
• Social engineering: persuading a customer or employee to disclose information or approve an action.
• Business email compromise: impersonating an executive, supplier or customer to redirect funds.

The fraud triangle identifies three conditions that commonly support fraud: pressure or incentive, opportunity, and rationalisation. The model is not a predictive law; it is a diagnostic framework. Strong access controls reduce opportunity, ethical leadership reduces rationalisation, and support mechanisms may reduce harmful pressure.

Warning indicators

No single indicator proves fraud. Indicators should be assessed in context and combined with customer history, transaction purpose and reliable evidence. Examples include:

• sudden changes in transaction volume or beneficiaries;
• urgent requests to bypass normal verification;
• activity inconsistent with the customer’s occupation or stated business;
• repeated failed login attempts or changes to contact details before a transfer;
• transactions just below approval or reporting thresholds;
• multiple accounts receiving and rapidly transferring funds;
• unexplained staff access to accounts outside assigned duties;
• documents containing inconsistent names, dates or formatting;
• pressure on staff to ignore exceptions or incomplete records.

Fraud response

An employee who suspects fraud should preserve evidence, avoid confrontation, follow the institution’s escalation route and record facts objectively. The employee should not promise confidentiality beyond institutional policy, investigate beyond authorised responsibilities or warn a suspected customer if doing so could compromise an investigation or AML reporting obligation.

A response commonly includes securing the account or transaction, notifying fraud operations and relevant managers, preserving logs and documents, contacting law enforcement where required, assessing customer harm and correcting control weaknesses. Customer protection must be balanced with legal requirements and evidence preservation.

4. Anti-Money Laundering and Countering Terrorist Financing

Money laundering is the process of disguising the criminal origin of property so that it appears legitimate. A traditional model describes three stages:

1. Placement: introducing illicit proceeds into the financial system.
2. Layering: conducting transactions to obscure the source or ownership.
3. Integration: reintroducing funds into the legitimate economy as apparently lawful wealth.

The stages may overlap, and not every case follows all three. Terrorist financing differs because funds may come from lawful or unlawful sources; the concern is their intended use to support terrorism.

Risk-based approach

A risk-based approach directs stronger controls toward higher-risk customers, products, channels, geographies and transactions. It does not mean that low-risk customers receive no controls. It means that controls are proportionate, documented and reviewed when circumstances change.

Relevant risk factors include:

• customer type and ownership structure;
• occupation, business activity and expected source of funds;
• geography and exposure to jurisdictions with elevated risk;
• products such as private banking, cash-intensive services or rapid international transfers;
• non-face-to-face onboarding and agent or intermediary channels;
• complex, opaque or unusual transaction patterns.

Customer due diligence

Customer due diligence (CDD) normally involves:

1. identifying and verifying the customer;
2. identifying beneficial owners and understanding ownership and control;
3. understanding the purpose and intended nature of the relationship;
4. establishing a customer risk profile;
5. conducting ongoing monitoring and keeping information current.

A beneficial owner is the natural person who ultimately owns or controls a customer or on whose behalf a transaction is conducted. The precise legal test varies by jurisdiction, so institutions must apply applicable law and regulatory guidance rather than relying on a single universal percentage.

Enhanced due diligence (EDD) is applied where risk is higher. It may include obtaining additional information about source of wealth and source of funds, obtaining senior approval, increasing monitoring and reviewing the relationship more frequently. Politically exposed persons, complex ownership structures and certain high-risk jurisdictions may require enhanced measures under local law and policy.

Suspicious activity indicators

Potential indicators include:

• transactions without an apparent lawful economic purpose;
• rapid movement of funds through several accounts;
• unexplained cash activity inconsistent with the customer profile;
• use of nominees, shell entities or unnecessarily complex structures;
• reluctance to provide CDD information or repeated changes in explanations;
• deposits followed quickly by international transfers;
• transactions involving sanctioned or high-risk parties;
• accounts acting as pass-through vehicles for unrelated persons.

An indicator is a reason to examine and escalate, not proof of criminal conduct. Staff must avoid discriminatory assumptions based on nationality, occupation or appearance. Decisions should rely on documented facts and lawful risk factors.

Suspicious transaction reporting

When suspicion reaches the threshold established by applicable law and institutional policy, the matter should be referred promptly to the designated AML or compliance function. That function determines whether a suspicious transaction or activity report must be submitted to the competent financial intelligence unit or other authority.

Staff should:

• record what was observed, when, by whom and why it appears unusual;
• provide relevant accounts, transactions, amounts, counterparties and documents;
• preserve confidentiality;
• continue normal service only as directed by authorised personnel;
• avoid tipping off the customer or another person about a report or investigation.

The reporting threshold is generally suspicion, not proof beyond reasonable doubt. Local law controls the exact threshold, deadlines, record-retention period and confidentiality rules.

5. Sanctions and Regulatory Compliance

Sanctions controls aim to prevent prohibited dealings with listed persons, entities, vessels, jurisdictions or activities. Screening may occur at onboarding, before transactions and during periodic rescreening. A possible name match is not automatically a confirmed match: identifiers such as date of birth, address, registration number and ownership must be assessed.

A possible match should be handled through the institution’s alert process. Staff should not independently release, reject or disclose sensitive information unless authorised. Sanctions, AML and fraud controls overlap but are not identical: sanctions may prohibit a transaction even when no money-laundering suspicion exists, while suspicious activity may involve parties who are not listed.

6. Cybersecurity and Information Protection

Cybersecurity protects confidentiality, integrity and availability:

• Confidentiality: information is accessible only to authorised persons.
• Integrity: information and transactions remain accurate and unaltered.
• Availability: services and information are accessible when required.

Core practices include strong and unique authentication, multi-factor authentication, timely patching, encryption, secure backups, endpoint protection, network segregation, vulnerability management and staff awareness. Access should be reviewed when employees change roles or leave. Sensitive information should not be sent through unauthorised channels or stored on personal devices.

Phishing remains a major threat. Warning signs include an unusual sender address, urgent or threatening language, unexpected attachments, requests for passwords or one-time codes, and links that do not match the claimed destination. Employees should use approved reporting tools and verify unusual payment requests through a separate trusted channel.

Artificial intelligence can assist with anomaly detection, alert prioritisation, document analysis and phishing detection. However, models can generate false positives, miss new patterns, reproduce biased data and be manipulated by attackers. Human review, explainability, access controls, validation and audit logs remain necessary. AI should support, not replace, accountable decisions in fraud and AML operations.

7. Incident Response

An incident is an event that may compromise information, services, assets, customers or compliance. A practical response lifecycle is:

1. Prepare: establish policies, contacts, authority and tested tools.
2. Identify: detect, validate, classify and prioritise the event.
3. Contain: limit spread or loss while preserving evidence.
4. Eradicate: remove the cause, such as malware or compromised credentials.
5. Recover: restore safe operations and monitor for recurrence.
6. Learn: perform a post-incident review and improve controls.

The first employee noticing an incident should report it through the approved channel, provide factual details and avoid deleting evidence or conducting unauthorised technical investigation. Incident severity may depend on customer impact, duration, data sensitivity, financial loss, regulatory significance and service criticality.

8. Business Continuity and Disaster Recovery

Business continuity management (BCM) enables critical functions to continue during disruption and to recover afterward. Disaster recovery (DR) focuses more specifically on restoring technology, systems and data. They are related but not identical: continuity also includes people, premises, suppliers, communications and manual workarounds.

A business impact analysis identifies critical services, dependencies, tolerable disruption and recovery priorities. It should consider people, facilities, applications, data, telecommunications, utilities and third parties.

Two important recovery measures are:

• Recovery Time Objective (RTO): the target maximum time within which a service or process should be restored after disruption.
• Recovery Point Objective (RPO): the maximum acceptable period of data loss, measured backward from the disruption.

For example, an RTO of four hours means the recovery target is four hours or less; an RPO of 30 minutes means the institution aims to lose no more than approximately 30 minutes of transaction data. These are targets, not guarantees, and must be supported by appropriate technology, staffing and testing.

Continuity strategies may include alternate sites, redundant systems, replicated data, reciprocal arrangements, emergency staffing, manual processing and alternate communication channels. Backups should be protected from alteration, tested through restoration and separated from the production environment. A backup that has never been restored cannot be assumed to be usable.

Plans should define activation authority, employee responsibilities, customer communication, regulatory notification, prioritised services, contact trees and return-to-normal procedures. Exercises may be discussion-based, simulation-based or technical failover tests. Lessons identified must be assigned to owners and tracked to completion.

Illustrative Case: The Unusual Supplier Payment

Background

A medium-sized bank’s commercial customer, Northbridge Supplies, had maintained a stable account for three years. Its normal payments were domestic transfers to known suppliers. One afternoon, an employee received an email apparently from the company’s finance director requesting an urgent payment to a new overseas beneficiary.

Problem

The email used a similar but not identical domain name and asked the employee to bypass the usual telephone confirmation because the director was travelling. Shortly afterward, the customer’s online contact details were changed and a second payment request was submitted. The amount was below the employee’s individual approval limit but exceeded the customer’s usual transaction range.

Analysis

The case contained indicators of business email compromise and possible account takeover: a new beneficiary, urgency, an unusual destination, a request to bypass verification, changed contact details and activity inconsistent with the profile. The amount being below an approval threshold did not make it safe; threshold-focused behaviour can itself be suspicious.

Approach and solution

The employee stopped processing, used the approved independent contact number and confirmed that the finance director had not issued the request. The matter was escalated to fraud operations and the AML/compliance function. Access credentials were secured, the beneficiary was reviewed, relevant logs and emails were preserved, and the customer was supported through account-security procedures. Compliance assessed whether a regulatory report was required. The bank also reviewed whether its email controls, beneficiary controls and staff training were adequate.

Outcome and learning points

The payment was prevented and no customer funds were lost. The bank strengthened out-of-band verification for new high-risk beneficiaries, introduced additional alerts for contact-detail changes before payments and conducted targeted staff training. The case illustrates that effective risk management combines people, process and technology. It also demonstrates why employees should escalate early rather than attempting to resolve suspicious activity privately.

Challenges, Ethics and Governance

Operational controls create trade-offs. Excessive friction can inconvenience legitimate customers, while weak controls expose customers and the institution to harm. Risk-based decisions should therefore be proportionate, explainable and consistently applied.

Privacy must be respected when collecting identity and transaction data. Information should be collected for legitimate purposes, accessed only by authorised persons, retained according to law and securely destroyed when no longer required. Confidentiality does not prevent lawful reporting to competent authorities.

A strong control culture depends on tone from the top, protected whistleblowing, fair treatment of staff who report concerns and consequences for deliberate bypassing of controls. Performance targets must not encourage employees to approve questionable transactions merely to meet sales or processing quotas.

Limitations also matter. No control eliminates all risk. Fraudsters adapt, detection systems produce false positives and business continuity plans may fail under unfamiliar conditions. Independent testing, scenario analysis, quality data and continuous improvement are therefore essential.

Contemporary Developments and Best Practices

Banking is becoming more digital, interconnected and dependent on third parties. Mobile banking, open banking interfaces, cloud services, instant payments and remote onboarding improve access but increase attack surface and speed of loss. Institutions should assess third-party resilience, application programming interfaces, digital identity controls and real-time payment fraud.

Good practice includes:

• maintaining an accurate risk and control inventory;
• using customer and transaction data lawfully and securely;
• reviewing access rights regularly;
• reconciling accounts promptly;
• testing fraud, AML and continuity controls rather than merely documenting them;
• training staff with realistic scenarios;
• documenting decisions and escalation paths;
• measuring incidents, losses, control failures, recovery performance and overdue remediation;
• coordinating operations, IT, security, fraud, AML, legal and communications teams;
• updating plans after regulatory, technological or business changes.

Chapter Summary

Operational risk arises from failed or inadequate processes, people and systems, and from external events. Its management requires identification of causes, events and consequences, followed by proportionate preventive, detective and corrective controls. Segregation of duties, least privilege, maker-checker approval, reconciliation and audit trails are foundational banking controls.

Fraud involves intentional deception and may be internal or external. The fraud triangle helps analyse pressure, opportunity and rationalisation, while transaction anomalies, social engineering and unusual access patterns provide practical warning signs. Suspected fraud should be escalated, evidence preserved and customer harm contained.

AML and counter-terrorist-financing controls use customer due diligence, beneficial-owner identification, ongoing monitoring and enhanced measures for higher-risk relationships. Suspicion must be reported through authorised channels, and tipping off is prohibited where applicable. Sanctions screening, cybersecurity and privacy controls complement but do not replace AML controls.

Incident response proceeds through preparation, identification, containment, eradication, recovery and learning. Business continuity and disaster recovery ensure that critical banking services and technology can withstand disruption. RTO defines the target restoration time, while RPO defines the acceptable data-loss interval. Effective resilience depends on tested plans, protected backups, trained personnel and accountable governance.

Key Terms

Operational risk: Risk of loss from failed processes, people, systems or external events.

Risk event: An occurrence that produces or could produce loss or disruption.

Residual risk: Risk remaining after controls are applied.

Segregation of duties: Division of responsibilities so one person cannot control an entire sensitive transaction.

Maker-checker control: Independent review and approval by a second authorised person.

Least privilege: Granting only the access necessary for assigned duties.

Fraud: Intentional deception or abuse for unauthorised benefit or loss.

Account takeover: Unauthorised control of a legitimate customer account.

Social engineering: Manipulation of people to obtain information or authorise an action.

Money laundering: Disguising the criminal origin of property.

Placement: Introducing illicit proceeds into the financial system.

Layering: Obscuring the source or ownership of funds through transactions.

Beneficial owner: Natural person who ultimately owns or controls a customer or transaction.

Customer due diligence: Identification, verification, risk assessment and ongoing monitoring of customers.

Enhanced due diligence: Additional controls applied to higher-risk relationships.

Suspicious activity report: Report made to a competent authority when legally defined suspicion exists.

Tipping off: Improperly alerting a person that a suspicious-activity report or investigation exists.

Recovery Time Objective: Target time for restoring a service after disruption.

Recovery Point Objective: Maximum acceptable period of data loss.

Business continuity: Capability to continue and recover critical operations during disruption.

Review Questions

Short Answer Questions

1. Define operational risk and identify its four principal sources.
2. What is the purpose of segregation of duties?
3. Distinguish customer due diligence from enhanced due diligence.
4. What is meant by tipping off in AML compliance?
5. Differentiate RTO from RPO.

Long Answer Questions

1. Explain the operational risk-control cycle and illustrate how preventive, detective and corrective controls work in a payment process.
2. Discuss the fraud triangle and explain how a bank can reduce pressure, opportunity and rationalisation.
3. Describe the stages of money laundering and explain how ongoing monitoring can identify suspicious activity.
4. Explain the incident-response lifecycle and the responsibilities of a frontline employee who discovers a cyber incident.
5. Discuss how a business impact analysis supports business continuity and disaster-recovery planning.

Analytical / Application Questions

1. A customer who normally makes local payroll payments suddenly changes contact details and requests several urgent transfers to new overseas beneficiaries. Identify the risk indicators, immediate controls and escalation steps.
2. A bank’s payment platform is unavailable for six hours, while its last usable backup is two hours old. Explain how RTO and RPO can be used to evaluate the disruption and identify weaknesses in the continuity plan.
3. A transaction-monitoring system generates many alerts for a low-risk customer segment, causing investigators to close alerts quickly. Analyse the governance, data-quality and customer-risk issues and recommend improvements.

Multiple Choice Questions with Answers

Question 1

Which situation is an example of operational risk arising primarily from a process failure?

A. A flood closes a branch

B. An incomplete account-opening checklist allows missing documents

C. A customer forgets a password

D. A change in interest rates reduces income

Correct Answer: B. An incomplete account-opening checklist allows missing documents

Question 2

What is the main purpose of segregation of duties?

A. To ensure one employee completes transactions faster

B. To prevent any employee from accessing banking systems

C. To reduce the chance that one person can complete and conceal an unauthorised transaction

D. To replace transaction reconciliation

Correct Answer: C. To reduce the chance that one person can complete and conceal an unauthorised transaction

Question 3

If the estimated probability of a loss is 0.02 and its financial impact is $100,000, what is the expected loss?

A. $200

B. $2,000

C. $20,000

D. $200,000

Correct Answer: B. $2,000

Question 4

Which combination represents the fraud triangle?

A. Profit, liquidity and solvency

B. Pressure, opportunity and rationalisation

C. Identity, encryption and availability

D. Placement, layering and integration

Correct Answer: B. Pressure, opportunity and rationalisation

Question 5

Which activity is part of customer due diligence?

A. Guaranteeing that a customer will never generate an alert

B. Identifying and verifying the customer and understanding the purpose of the relationship

C. Informing the customer whenever a suspicious report is filed

D. Ignoring beneficial ownership for corporate customers

Correct Answer: B. Identifying and verifying the customer and understanding the purpose of the relationship

Question 6

What should a frontline employee generally do when potential suspicious activity is identified?

A. Warn the customer immediately

B. Publish the concern in a staff chat

C. Escalate facts through the authorised AML or compliance channel

D. Conduct an unauthorised investigation and seize documents

Correct Answer: C. Escalate facts through the authorised AML or compliance channel

Question 7

What does an RPO measure?

A. The target time to restore a service

B. The maximum acceptable period of data loss

C. The number of employees required during recovery

D. The annual probability of a cyberattack

Correct Answer: B. The maximum acceptable period of data loss

Question 8

Which action belongs to the containment stage of incident response?

A. Limiting the spread of a compromised account or malware

B. Deleting all logs

C. Closing the post-incident review

D. Designing the original system architecture

Correct Answer: A. Limiting the spread of a compromised account or malware

Question 9

Which is the strongest example of business email compromise?

A. A customer changes a postal address in person with valid identification

B. A spoofed executive email requests an urgent payment to a new beneficiary

C. A bank performs a scheduled backup

D. A teller balances the cash drawer

Correct Answer: B. A spoofed executive email requests an urgent payment to a new beneficiary

Question 10

Why should an AI-based AML alerting system retain human oversight?

A. AI systems never process large datasets

B. Human oversight eliminates the need for data security

C. Models can produce false positives, miss patterns or reflect biased data

D. Regulations require every alert to be ignored by software

Correct Answer: C. Models can produce false positives, miss patterns or reflect biased data