Ethics, Governance, Regulation, and Consumer Protection

Introduction and Context

Bootstrapping and micro-financing expand access to capital for entrepreneurs who may lack collateral, credit history, or access to conventional banking. Bootstrapping relies on retained earnings, founder resources, customer prepayments, supplier credit, and disciplined cost control. Micro-financing uses small loans, savings products, payment services, insurance, or related financial products for underserved individuals and enterprises.

These mechanisms can promote inclusion, innovation, and livelihood creation. They can also expose borrowers and entrepreneurs to unfair pricing, coercive collection, excessive debt, privacy violations, discriminatory algorithms, fraud, and systemic operational risks. Ethical finance therefore cannot be reduced to legal compliance. Law establishes minimum obligations; governance creates decision rights, accountability, controls, and organizational culture; ethics asks whether conduct is fair, respectful, and socially defensible even where a practice is technically lawful.

For a micro-finance institution (MFI), fintech lender, crowdfunding platform, or entrepreneurial venture, responsible finance is simultaneously a consumer-protection issue and a strategic capability. Trust reduces customer-acquisition costs, complaints, reputational damage, and regulatory intervention. Conversely, rapid growth without controls can convert a promising enterprise into a source of consumer harm and institutional failure.

This chapter presents an integrated approach to transparency, fair lending, affordability, over-indebtedness, privacy, algorithmic accountability, cybersecurity, anti-money-laundering (AML) controls, and responsible collections. Specific legal requirements vary by jurisdiction and product. Managers must therefore consult applicable statutes, regulations, supervisory guidance, licensing conditions, and sector codes rather than treating this chapter as legal advice.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish ethics, governance, regulation, and consumer protection in entrepreneurial finance.
2. Design transparent and comprehensible disclosures for micro-finance products.
3. Evaluate fair-lending and affordability processes, including risks of over-indebtedness.
4. Establish governance controls for privacy, cybersecurity, algorithmic decision-making, and AML.
5. Assess responsible collection practices and remedial mechanisms.
6. Apply these principles to managerial decisions involving growth, technology, and inclusion.

1. The Governance Logic of Responsible Finance

1.1 Four complementary perspectives

Ethics concerns duties, rights, fairness, dignity, and consequences. A lender may ask not only “Can we charge this fee?” but also “Would a reasonable customer understand it, and is it proportionate to the service provided?”

Regulation consists of binding legal rules and supervisory expectations. It may address licensing, interest-rate disclosure, consumer credit, data protection, financial crime, outsourcing, complaints, and prudential safeguards.

Governance is the system by which an organization is directed and controlled. It includes the board, management, policies, risk appetite, delegated authority, internal controls, audit, incentives, reporting, and escalation.

Consumer protection seeks to reduce information asymmetry and power imbalance. Common principles include fair treatment, clear information, suitability or responsible lending, privacy, security, complaint handling, and access to redress.

These perspectives overlap but are not identical. A disclosure can satisfy a formal rule while remaining unreadable. A collection tactic can be legally permissible yet humiliating. A model can improve repayment prediction while embedding historical discrimination. Responsible management addresses both compliance and substantive fairness.

1.2 Governance as a control system

A useful governance architecture separates three functions:

The board or equivalent governing body approves strategy and risk appetite. Management implements policies and allocates resources. Compliance interprets obligations and monitors conduct. Internal audit independently tests design and operating effectiveness. In small ventures, one person may perform several tasks, but incompatible duties should still be separated where feasible. For example, the person approving loans should not be the sole person reconciling disbursement accounts.

A risk-based governance cycle is:

1. Identify legal, conduct, operational, technology, financial-crime, and reputational risks.
2. Assess likelihood, impact, affected stakeholders, and control maturity.
3. Select preventive, detective, and corrective controls.
4. Assign owners, deadlines, thresholds, and escalation routes.
5. Monitor indicators and investigate exceptions.
6. Report, remediate, learn, and revise the control environment.

1.3 Stakeholder accountability

A responsible-finance stakeholder map should include borrowers, prospective customers, guarantors, employees, agents, investors, payment providers, regulators, communities, and persons whose data are processed but who may not be customers. Governance should make explicit whose interests are represented in product approval and how conflicts are handled. Incentive systems deserve particular attention: commissions based solely on loan volume can encourage unsuitable lending, mis-selling, and aggressive collections.

2. Transparency and Fair Treatment

2.1 Meaningful transparency

Transparency is not merely publishing terms and conditions. It requires information that is timely, accurate, accessible, comprehensible, and sufficiently prominent to support an informed decision. A customer should be able to determine:

• the amount received and total amount payable;
• interest, fees, taxes, penalties, and the basis on which each is calculated;
• payment dates, frequency, and consequences of late payment;
• collateral, guarantees, set-off rights, and other obligations;
• whether data will be shared and with whom;
• how to complain, obtain assistance, and seek redress; and
• what happens if the product is refinanced, restructured, or terminated.

Digital interfaces create additional risks. “Dark patterns” include preselected consent, confusing buttons, hidden fees, countdown pressure, and repeated prompts that make refusal difficult. Plain-language summaries, local-language communication, accessible formats, and cooling-off or cancellation rights where applicable improve informed choice.

2.2 Pricing and effective cost

Nominal interest can conceal the economic cost of credit. A simple periodic cost approximation for a loan with principal P, total interest I, and mandatory fees F is:

Here, C_simple is a proportion over the stated loan period. It is useful for a basic comparison only when timing of payments and compounding are not material. It is not equivalent to an annual percentage rate (APR).

For an amortizing loan, the internal rate of return is conceptually the periodic rate r that equates the amount received to the present value of all scheduled payments and compulsory charges:

A_t is the payment or charge at period t, n is the number of periods, and r is the periodic rate. The periods must be equal and the cash-flow signs must be consistent: funds received by the borrower are positive from the borrower’s perspective and payments are negative. An annualized rate may be approximated as (1 + r)^m - 1, where m is the number of payment periods per year, but the legally required APR convention may differ. Managers should use the jurisdictionally prescribed method and disclose assumptions.

Illustrative example. A borrower receives $1,000 and repays $110 at the end of each month for 10 months, with no additional fee. Total repayment is $1,100 and the simple total cost is 10%. However, the periodic rate is not 1% merely because total interest is $100: the borrower reduces principal throughout the schedule. Solving the present-value equation gives a periodic rate of approximately 1.76%, which annualizes to approximately 23.3% under nominal compounding at 12 periods: 12 × 1.76% ≈ 21.1% as a nominal rate, or approximately 23.3% as an effective annual rate using (1.0176)¹2 − 1. This example demonstrates why timing matters. The figures are illustrative and not a substitute for a prescribed APR calculation.

2.3 Fair treatment and suitability

Fair treatment does not require identical treatment in every circumstance. It requires relevant, proportionate, and non-discriminatory distinctions. A lender may price for objectively evidenced risk, but it should test whether proxies reproduce prohibited discrimination. Customers should not be pressured into unsuitable loan sizes, unnecessary insurance, or repeated refinancing merely to meet sales targets.

A product-approval committee should document the target market, intended use, foreseeable risks, customer capability, distribution channels, pricing rationale, and exit or remediation options. Post-launch monitoring should examine complaints, default patterns, cancellations, repeat borrowing, vulnerable-customer outcomes, and differences across demographic or geographic groups.

3. Affordability and Over-Indebtedness

3.1 Responsible affordability assessment

Affordability asks whether a proposed obligation can be met from reasonably verifiable income and resources without forcing harmful deprivation or reliance on additional high-cost debt. Assessment should consider income stability, essential expenditure, existing obligations, dependants, seasonality, medical or climate shocks, and the purpose of borrowing.

A basic residual-income measure is:

Y is reliable periodic income, E essential living and business expenditure, D_existing existing debt service, D_new proposed debt service, and R residual income. All variables must refer to the same period and currency. The measure is informative, not a universal legal test. A positive residual does not prove affordability if income is volatile, expenses are understated, or the borrower is using undisclosed lenders.

A debt-service-to-income ratio can be stated as:

The numerator and denominator must use comparable periods. A lender should define a conservative threshold appropriate to its market, product, customer segment, and regulatory requirements, and should stress-test variable income or interest rates where relevant. Thresholds should not be applied mechanically: they are decision aids supported by judgment, verification, and exception governance.

3.2 Sources of over-indebtedness

Over-indebtedness may result from multiple borrowing, aggressive refinancing, inaccurate income data, emergency expenses, unstable employment, currency mismatch, group pressure, excessive fees, or lenders’ failure to share information. Digital instant-credit models can intensify the problem by making repeated borrowing frictionless.

Controls include credit-bureau or alternative-data checks where lawful, customer self-declarations with verification, exposure limits, cooling-off periods, warnings before repeat borrowing, repayment reminders, restructuring pathways, and portfolio monitoring. MFIs should distinguish temporary delinquency from structural inability to repay. Repeated rollovers may improve reported repayment rates while worsening customer welfare.

3.3 Financial inclusion and exclusion trade-offs

Strict controls can protect customers but may exclude people with irregular incomes. The answer is not necessarily to remove safeguards. It may involve smaller initial limits, graduated lending, savings-linked products, flexible repayment aligned with cash flows, human review, financial education, and carefully governed alternative data. Inclusion is meaningful only when access does not require unacceptable risk or loss of dignity.

4. Privacy, Data Governance, and Algorithmic Bias

4.1 Data lifecycle governance

A responsible data lifecycle includes collection, classification, use, sharing, retention, access, correction, deletion or anonymization, and secure disposal. Key principles are purpose limitation, data minimization, accuracy, lawful and transparent processing, security, accountability, and respect for applicable rights. Consent is not always the only legal basis, and consent must not be bundled deceptively with unrelated services.

A data inventory should identify what is collected, why it is needed, where it is stored, who can access it, how long it is retained, and what happens after a vendor processes it. Sensitive information requires stronger controls and, where appropriate, a privacy impact assessment before deployment.

4.2 Alternative data

Mobile-phone metadata, transaction histories, geolocation, social-network signals, device characteristics, and behavioral data may improve prediction but can intrude into private life or create hidden discrimination. Data collected for one purpose should not automatically be repurposed for credit decisions. Customers should receive meaningful explanations of material data use and have channels to challenge inaccurate or unfair outcomes.

4.3 Algorithmic fairness and accountability

A model can be statistically accurate and still unfair. Bias can enter through historical labels, unrepresentative samples, proxy variables, measurement error, selective enforcement, or feedback loops. Governance should include:

• documented purpose and prohibited uses;
• representative development and validation data;
• testing for disparate outcomes across legally protected or relevant groups;
• explainability proportionate to the decision’s impact;
• human review and appeal;
• drift monitoring after deployment;
• version control, audit trails, and independent validation; and
• a process to suspend or modify the model when harm is detected.

No single fairness metric resolves every ethical question. For example, equal approval rates, equal error rates, and equal predictive value may be difficult to achieve simultaneously when groups have different base rates. Management must make the normative choice explicit, consult applicable law, and document why the selected approach is defensible.

5. Cybersecurity and Operational Resilience

Financial ventures are attractive targets because they hold identity, payment, and financial information. Cybersecurity is therefore a consumer-protection obligation as well as an IT concern.

A proportionate control framework includes:

1. Govern: assign accountability, risk appetite, policies, supplier requirements, and incident authority.
2. Identify: map systems, data, dependencies, threats, and critical services.
3. Protect: use least privilege, strong authentication, encryption, secure development, patching, backups, staff training, and fraud controls.
4. Detect: monitor anomalous logins, transfers, privilege changes, malware, and data exfiltration.
5. Respond: contain incidents, preserve evidence, communicate accurately, and meet notification duties.
6. Recover: restore services, support affected customers, investigate root causes, and improve controls.

Multi-factor authentication, role-based access, separation of production and development environments, tested backups, vendor due diligence, and secure application programming interfaces are particularly important. Security should not be designed so rigidly that legitimate low-connectivity customers are abandoned; alternative authentication and assisted channels may be necessary.

A business-continuity plan should identify maximum tolerable downtime, critical processes, manual workarounds, recovery priorities, and communication responsibilities. Testing is essential because an untested plan is an assumption, not a capability.

6. Anti-Money-Laundering and Countering Financial Crime

AML and counter-terrorist-financing (CTF) controls protect the financial system and the institution. Core elements commonly include customer identification and verification, beneficial-ownership identification for legal entities, risk classification, sanctions screening where required, transaction monitoring, record keeping, suspicious-activity reporting, staff training, and independent testing. Requirements differ by jurisdiction and institution type.

A risk-based approach allocates stronger controls to higher-risk relationships rather than treating every customer identically. Relevant factors can include customer type, geography, product, delivery channel, transaction behavior, and exposure to public officials or sanctions risk. Simplified procedures must not become an excuse for ignoring legal requirements; nor should financial inclusion be used to justify indiscriminate de-risking.

The institution should control conflicts between privacy and AML obligations through lawful access, restricted disclosure, retention schedules, and clear role permissions. Staff must understand that “know your customer” is not merely document collection: it involves understanding the relationship, expected activity, and reasons for unusual behavior. Automated alerts require calibrated thresholds and human investigation; excessive false positives overwhelm compliance teams, while weak monitoring misses risk.

7. Responsible Collections and Redress

Collections should recover legitimate obligations without harassment, intimidation, deception, public shaming, discrimination, or disclosure of debt to unauthorized persons. Prohibited or high-risk practices may include contacting employers or relatives without lawful justification, repeated calls at unreasonable hours, threats of arrest where no such consequence exists, seizure beyond legal authority, and publishing borrower information.

A responsible collections policy should specify:

• approved communication channels and contact times;
• identity verification before discussing an account;
• respectful language and staff conduct;
• treatment of vulnerable customers;
• documentation of promises and disputes;
• hardship assessment, restructuring, and repayment plans;
• escalation and quality assurance; and
• third-party agency oversight.

Complaint systems should be accessible, free or low cost, impartial, and time-bound. Complaints must be recorded, categorized, investigated, answered with reasons, and used for root-cause analysis. Redress may include correction of data, reversal of an improper charge, compensation, restructuring, apology, or system change. A complaint is not merely a service inconvenience; it is evidence about product and control quality.

8. An Integrated Compliance and Conduct Framework

An entrepreneurial lender can use the following product-governance sequence:

Figure: A continuous product-governance cycle linking design, control, customer outcomes, and remediation.

Useful key risk indicators include complaint rates, repeat borrowing within short periods, rollovers, early delinquency, restructuring, collection contacts per account, privacy incidents, model overrides, approval-rate disparities, suspicious-activity alerts, cybersecurity incidents, and vendor failures. Indicators require interpretation. A low complaint rate may indicate satisfaction—or that customers cannot access the complaint channel.

9. Illustrative Case: Kijani Digital Credit

Background. Kijani, a fictional mobile lender serving informal retailers, offers small working-capital loans through a smartphone application. Its growth strategy rewards agents for disbursement volume and its algorithm uses mobile-wallet activity, device data, and repayment history.

Problem. After six months, regulators receive complaints about unexplained declines, repeated refinancing, calls to borrowers’ relatives, and fees that customers did not understand. Kijani’s default rate appears low, but many customers take a second loan before fully repaying the first. An internal review finds that the model performs less well for rural women because the training data contain fewer observations from that group. A vendor also stores identity documents outside the country without a clear retention or deletion process.

Analysis. The low default rate is an incomplete success measure. It may reflect aggressive collections and refinancing rather than affordability. Agent incentives create a conduct conflict. The model’s use of device and social signals raises privacy and proxy-discrimination concerns. Cross-border storage creates legal and operational questions. The organization lacks a board-level conduct owner and has no documented model-appeal process.

Approach. Kijani should pause automatic limit increases, conduct a portfolio and affordability review, and provide customers with clear cost summaries. It should redesign incentives to include complaint quality, sustained repayment, and customer-outcome measures. A human review channel should be created for declined applicants and disputed data. Model validation should test performance and error patterns across relevant groups; nonessential or intrusive variables should be removed. Vendor contracts should address security, access, breach notification, audit rights, location, retention, and deletion. Collections staff should follow approved contact rules, and affected customers should receive remediation where misconduct or erroneous charges occurred. The board should approve a conduct-risk policy, appoint accountable owners, and receive regular dashboards.

Outcome. In this illustrative case, short-term disbursement growth slows, but repeat borrowing falls, complaints are resolved more quickly, model disparities are reduced, and customer retention improves. Kijani’s cost of compliance increases initially; however, its risk of enforcement, reputational loss, and portfolio deterioration decreases.

Learning points. First, portfolio performance can conceal consumer harm. Second, responsible innovation requires governance before scale, not after a crisis. Third, algorithmic accountability includes data provenance, human recourse, and post-deployment monitoring. Fourth, incentives are a central control mechanism. Finally, privacy, AML, cybersecurity, affordability, and collections should be managed as connected risks rather than isolated checklists.

10. Contemporary Developments and Critical Limitations

Open banking, embedded finance, generative AI, biometric identity, blockchain-based records, and real-time payments can lower costs and widen access. They can also accelerate exclusion, automate error, increase surveillance, and create concentration in technology vendors. Generative AI should not independently make high-impact lending or collections decisions without strong validation, explainability, security, and human accountability. Synthetic or inferred data can still reveal sensitive attributes.

Regulatory technology can improve monitoring, but automation does not transfer responsibility to software suppliers. Senior managers remain accountable for selecting, testing, configuring, and supervising systems. Cross-border fintech also creates jurisdictional ambiguity: the location of the customer, lender, server, payment provider, and data processor may all differ.

A further limitation is the tension between universal principles and local context. A single disclosure format, affordability threshold, or fairness metric may not suit every market. Effective governance combines common minimum standards with local legal review, community engagement, language adaptation, and evidence-based adjustment.

Best-Practice Checklist for Entrepreneurs and Managers

Before launching or scaling a bootstrapped or micro-finance product, management should be able to answer “yes” to the following questions:

• Is the target customer and intended use clearly defined?
• Can a typical customer understand total cost, obligations, and consequences?
• Is affordability assessed using reliable, same-period information?
• Are repeat borrowing, refinancing, and hardship monitored?
• Are pricing and eligibility decisions tested for unfair disparate outcomes?
• Is data collection necessary, lawful, secure, and time-limited?
• Can customers correct data and challenge consequential decisions?
• Are cybersecurity, vendor, continuity, and incident-response controls tested?
• Are AML and sanctions obligations mapped to the business model?
• Are collections respectful, documented, and supervised?
• Are complaints accessible and linked to remediation?
• Do incentives reward sustainable customer outcomes rather than volume alone?
• Does the governing body receive timely, independent conduct-risk information?

Chapter Summary

Responsible bootstrapping and micro-financing require more than legal formality or financial performance. Ethics, regulation, governance, and consumer protection form a connected system for managing power, information, and risk. Transparency must enable real understanding of price and obligations. Fair lending requires relevant and proportionate decision criteria, while affordability assessment must address income volatility, existing debt, and the risk of over-indebtedness. Privacy governance limits unnecessary data use and provides accountability throughout the data lifecycle. Algorithmic systems require validation, fairness analysis, human review, and monitoring after deployment. Cybersecurity and operational resilience protect both institutional continuity and customer welfare. AML controls should be risk based and compatible with lawful privacy and inclusion. Responsible collections, complaint handling, and redress convert consumer protection from a policy statement into operational practice. Finally, effective governance aligns incentives, oversight, technology, and customer outcomes across the entire product lifecycle.

Key Terms

Affordability assessment: Evaluation of whether a customer can meet repayment obligations without harmful financial stress.

Algorithmic bias: Systematic distortion in automated decisions that produces unjustified differences in outcomes.

Alternative data: Nontraditional information used for assessment, such as transaction, device, or behavioral data.

Anti-money laundering (AML): Measures designed to prevent and detect the concealment or use of criminal proceeds.

Annual percentage rate (APR): A standardized measure of credit cost incorporating relevant interest and charges according to applicable rules.

Consumer protection: Laws, institutions, and practices that promote fair treatment and effective redress for customers.

Conduct risk: The risk that institutional behavior causes unfair customer outcomes or undermines market integrity.

Data minimization: Collecting and retaining only data necessary for a specified legitimate purpose.

Debt-service-to-income ratio: Debt service divided by relevant income over comparable periods.

Fair lending: Provision and pricing of credit without unlawful or unjustified discrimination or exploitation.

Governance: Structures and processes through which an organization is directed, controlled, and held accountable.

Internal audit: Independent assurance that evaluates governance, risk management, and control effectiveness.

Micro-finance: Financial services designed for underserved or low-income customers and microenterprises.

Over-indebtedness: A condition in which debt obligations exceed a borrower’s sustainable repayment capacity.

Purpose limitation: Restricting data use to specified, legitimate, and communicated purposes.

Responsible collections: Recovery practices that are lawful, respectful, proportionate, and sensitive to hardship.

Risk-based approach: Allocating control intensity according to assessed risk rather than applying identical controls everywhere.

Transparency: Provision of timely, accurate, accessible, and understandable information.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Review Questions

Short Answer Questions

1. Distinguish ethics, regulation, governance, and consumer protection.
2. Why can nominal interest fail to communicate the true cost of a micro-loan?
3. Identify three causes of over-indebtedness.
4. What is the purpose of human review in algorithmic lending?
5. Name four elements of responsible collections.

Long Answer Questions

1. Explain how a board and management can build a conduct-risk governance system in a small fintech lender.
2. Discuss the relationship between transparency, affordability assessment, and fair lending.
3. Evaluate the privacy and inclusion trade-offs associated with alternative data.
4. Describe a proportionate cybersecurity and operational-resilience framework for an MFI.
5. Explain how AML controls can be implemented without unjustified exclusion of underserved customers.

Analytical / Application Questions

1. A lender has low defaults but high refinancing and complaint rates. Analyze possible explanations and recommend a dashboard of corrective indicators.
2. Design an approval process for an AI-based micro-credit product that addresses bias, privacy, explainability, security, and appeal rights.
3. A collection agency contacts a borrower’s employer and threatens public disclosure of the debt. Assess the ethical and governance failures and propose remediation.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from regulation?

A. Governance is voluntary advertising, while regulation is customer service.

B. Governance concerns how an organization is directed and controlled, while regulation consists of binding external rules.

C. Governance applies only to banks, while regulation applies only to entrepreneurs.

D. Governance determines interest rates, while regulation eliminates all risk.

Correct Answer: B. Governance concerns how an organization is directed and controlled, while regulation consists of binding external rules.

Question 2

A borrower receives $1,000 and repays $1,100 in total. What is the simple total cost as a proportion of principal, ignoring payment timing?

A. 1%

B. 5%

C. 10%

D. 110%

Correct Answer: C. 10%

Question 3

Which practice most directly supports meaningful transparency?

A. Providing a long contract in technical language only

B. Hiding mandatory fees in a linked document

C. Showing total repayment, fees, timing, and consequences in clear language before commitment

D. Explaining costs only after the first missed payment

Correct Answer: C. Showing total repayment, fees, timing, and consequences in clear language before commitment

Question 4

Which measure compares debt service with income over comparable periods?

A. Return on assets

B. Debt-service-to-income ratio

C. Liquidity coverage ratio

D. Customer-acquisition cost

Correct Answer: B. Debt-service-to-income ratio

Question 5

Why can a low default rate fail to demonstrate responsible lending?

A. Defaults are unrelated to repayment behavior

B. It may reflect refinancing or coercive collections rather than genuine affordability

C. Low defaults always indicate discrimination

D. Default rates cannot be calculated for micro-loans

Correct Answer: B. It may reflect refinancing or coercive collections rather than genuine affordability

Question 6

Which is an example of data minimization?

A. Collecting every available social-media attribute

B. Retaining identity documents indefinitely

C. Collecting only information necessary for a specified lawful purpose

D. Selling customer data to unrelated advertisers by default

Correct Answer: C. Collecting only information necessary for a specified lawful purpose

Question 7

What is a core requirement for responsible algorithmic lending?

A. Permanent automation without human intervention

B. Testing, monitoring, documentation, and a channel to challenge consequential decisions

C. Using the largest possible number of variables

D. Avoiding all model validation to preserve speed

Correct Answer: B. Testing, monitoring, documentation, and a channel to challenge consequential decisions

Question 8

Which control is primarily preventive in cybersecurity?

A. Post-incident root-cause analysis

B. Public reporting of a breach

C. Multi-factor authentication and least-privilege access

D. Estimating losses after an outage

Correct Answer: C. Multi-factor authentication and least-privilege access

Question 9

Which practice is inconsistent with responsible collections?

A. Offering a documented hardship restructuring process

B. Verifying identity before discussing an account

C. Threatening unauthorized public disclosure of a borrower’s debt

D. Monitoring third-party collection agents

Correct Answer: C. Threatening unauthorized public disclosure of a borrower’s debt

Question 10

A risk-based AML approach means that an institution should:

A. Apply identical controls regardless of risk

B. Ignore low-value transactions completely

C. Allocate stronger controls and investigation to higher-risk relationships and activity

D. Replace all human investigation with automated alerts

Correct Answer: C. Allocate stronger controls and investigation to higher-risk relationships and activity