Governance, Ethics, Compliance and Financial Crime

Introduction

Financial institutions perform functions that make them central to economic stability: they accept deposits, allocate credit, operate payment systems, manage investments, provide insurance, and safeguard customer assets. Their failure can therefore impose costs on depositors, investors, taxpayers and the wider economy. Governance, ethics, compliance and financial-crime controls are not peripheral administrative activities. They are mechanisms through which an institution preserves trust, protects its licence to operate and manages risks that cannot be reduced through capital or liquidity alone.

Governance concerns the allocation and exercise of authority. Ethics concerns the standards used when rules are incomplete, incentives conflict or conduct is technically lawful but harmful. Compliance translates legal and regulatory obligations into operating requirements. Financial-crime controls address money laundering, terrorist financing, proliferation financing, fraud, bribery, corruption, market abuse, sanctions evasion and related threats. These disciplines overlap but are not identical: a compliant action may still be unethical, while effective ethical culture requires more than written policies.

For a Chartered Finance Manager, the strategic question is not merely whether controls exist. It is whether the institution’s governance system produces reliable decisions, timely challenge, accountable ownership, proportionate controls and fair outcomes for customers and society.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the purpose and architecture of governance in financial institutions.
2. Distinguish the responsibilities of the board, senior management, control functions and internal audit.
3. Apply fiduciary-duty, agency, stakeholder and three-lines perspectives to governance problems.
4. Analyse conflicts of interest, misconduct and failures of accountability.
5. Design risk-based AML/CFT, sanctions and fraud-control arrangements.
6. Evaluate responsible customer treatment, whistleblowing and conduct-risk systems.
7. Assess the effects of technology, artificial intelligence and data quality on compliance.
8. Recommend improvements in an institution’s assurance and financial-crime framework.

1. Governance as an Accountability System

Corporate governance is the system by which an organisation is directed, controlled and held accountable. In a financial institution, governance must address at least five questions:

• Who has authority to make a decision?
• What information must that person receive?
• What challenge is required before the decision is taken?
• Who monitors the outcome?
• What happens when performance or conduct falls below expectation?

A sound governance system links strategy, risk appetite, capital, remuneration, controls and reporting. It does not eliminate risk. Rather, it ensures that risk-taking is intentional, understood and consistent with the institution’s capacity and obligations.

1.1 The board and senior management

The board is collectively responsible for direction, oversight and stewardship. It normally approves strategy, risk appetite, major policies, financial statements, executive appointments, remuneration principles and the internal-control framework. It should also ensure that the institution has adequate resources and expertise to identify and manage material risks.

The board should not manage day-to-day operations. That responsibility belongs to the chief executive and senior management. The distinction is important: a board that becomes operational may weaken management accountability, while a passive board may fail in its oversight duty.

Board effectiveness depends on independence, competence, diversity of experience, constructive challenge and access to reliable information. Independence is not only a formal status. A director may be legally independent yet psychologically or financially dependent on management. Boards should therefore examine relationships, tenure, incentives, social pressures and the quality of challenge.

Typical board committees include:

Committee structures do not transfer the board’s ultimate responsibility. Committees support informed oversight; they do not create islands of accountability.

1.2 The three-lines model

The three-lines model clarifies responsibilities rather than creating three independent bureaucracies.

First line: business and operations. These functions own risks arising from products, customers, transactions and processes. They must identify risks, operate controls and correct deficiencies.

Second line: risk and compliance. These functions set frameworks, advise, monitor, test and escalate. They should have sufficient authority, expertise and access to the board. They should not become substitutes for first-line ownership.

Third line: internal audit. Internal audit provides independent, risk-based assurance on governance, risk management and controls. It should have unrestricted access to records and report functionally to the audit committee.

External audit, regulators, supervisors and independent specialists provide additional assurance, but they do not replace management’s responsibility for controls.

2. Theoretical Foundations

2.1 Agency theory

Agency theory examines the relationship between principals, such as shareholders, and agents, such as executives. Because agents may possess more information and have different incentives, monitoring and incentive mechanisms are required. In banking, the relationship is more complex because depositors, policyholders, borrowers, employees, taxpayers and communities may also bear consequences.

Agency risks include excessive growth, manipulation of performance measures, inappropriate sales practices and concealment of losses. Remuneration linked only to short-term revenue can encourage conduct that appears successful until later losses emerge. Deferral, risk adjustment, malus and clawback can align rewards more closely with sustainable performance.

2.2 Stakeholder and public-interest perspectives

A stakeholder perspective holds that governance should consider parties affected by the institution, not only equity investors. This is especially relevant to financial institutions because customers often lack equivalent expertise and because institutional failure can create systemic effects.

The public-interest dimension explains why prudential and conduct regulation is extensive. A bank may be privately owned, but its deposit-taking, payment and credit functions generate public consequences. Responsible governance therefore includes financial resilience, fair treatment, privacy, accessibility and prevention of criminal misuse.

2.3 Fiduciary duties and the duty of care

Directors and senior officers are generally expected to act honestly, in good faith, for proper purposes, with reasonable care and in the organisation’s interests as defined by applicable law. They must avoid unauthorised conflicts, protect confidential information and exercise informed judgement.

The duty of care is not a requirement that every decision be successful. It is a requirement that decision-makers use appropriate information, competence, deliberation and challenge. A board may approve a risky strategy without breaching its duty if the risk is understood, lawful, within appetite and supported by a rational process. Conversely, a profitable outcome does not excuse a reckless or conflicted process.

3. Ethics, Culture and Conduct Risk

Ethics becomes most important where rules are incomplete. A culture is revealed by what the institution rewards, tolerates and ignores. Statements of values have little effect if promotion depends exclusively on sales, if whistleblowers suffer retaliation or if senior employees are exempt from consequences.

A practical ethical framework asks:

1. Is the action lawful and consistent with regulation?
2. Is it consistent with the institution’s stated values?
3. Would it be acceptable if disclosed to customers, regulators and the public?
4. Who bears the benefit and who bears the risk?
5. Does it produce fair and sustainable outcomes?

Conduct risk is the risk that the institution harms customers, markets or integrity through inappropriate behaviour. Examples include unsuitable advice, misleading disclosures, unauthorised fees, aggressive collections, discrimination, misuse of confidential information and failure to investigate complaints.

Culture cannot be measured by a single survey. Useful indicators include complaint patterns, employee turnover, policy exceptions, control overrides, speak-up activity, sales-adjustment rates, disciplinary outcomes, customer vulnerability outcomes and repeated audit findings. These indicators require interpretation: a rise in whistleblowing may signal worsening conduct, but it may also indicate greater trust in reporting channels.

Conflicts of interest

A conflict exists where personal, financial or institutional interests could improperly influence judgement. Conflicts may be actual, potential or perceived. Common examples include:

• lending decisions involving connected parties;
• investment research affected by underwriting relationships;
• gifts, hospitality or inducements;
• personal trading by employees;
• compensation arrangements favouring particular products;
• dual roles involving incompatible duties; and
• procurement decisions involving relatives or former employers.

A robust conflict framework requires identification, disclosure, assessment, mitigation, recording and monitoring. Disclosure alone is insufficient where the conflict is material. Possible controls include recusal, independent review, information barriers, rotation, prohibition, approval by an uninvolved committee and customer disclosure.

4. Internal Control and Assurance

Internal control is a process designed to provide reasonable—not absolute—assurance that objectives relating to operations, reporting and compliance will be achieved. Controls may be preventive, detective or corrective; manual or automated; entity-level or transaction-level.

A control is effective only when it is suitably designed and operates consistently. A policy without ownership, evidence and follow-up is not an effective control.

4.1 Control components

A useful control architecture contains:

• a control environment, including tone, authority and accountability;
• risk assessment and risk identification;
• control activities, such as approvals, segregation and reconciliations;
• information and communication; and
• monitoring, remediation and escalation.

Segregation of duties reduces the possibility that one person can initiate, approve, execute and conceal a transaction. Where segregation is impractical, compensating controls such as independent review, system restrictions and enhanced monitoring are required.

4.2 Risk-based assurance

Assurance resources should be directed toward material risks rather than distributed equally across all activities. A simple prioritisation concept is:

Here, Impact represents the potential severity of harm, Likelihood represents the probability of occurrence, and Control Weakness represents the extent to which existing controls fail to prevent or detect the event. This is a management-ranking tool, not a universal regulatory formula. The scales must be defined consistently, and the result should not be treated as an objective probability unless supported by appropriate data.

Internal audit should assess both design effectiveness and operating effectiveness. Design effectiveness asks whether the control could address the risk if performed properly. Operating effectiveness asks whether it actually operated as intended over the relevant period. Findings should identify root causes, accountable owners, due dates, risk acceptance and validation evidence.

5. Compliance Management

Compliance management converts external obligations into internal behaviour. It normally includes legal interpretation, regulatory inventory, policy development, training, advice, monitoring, testing, breach management, reporting and regulatory engagement.

A mature compliance function maintains an obligations register linking each obligation to an accountable owner, process, control, evidence source, monitoring activity and escalation route. It also distinguishes between a policy breach, a control failure, a reportable event, customer harm and a suspected crime. These categories may overlap but should not be confused.

Effective compliance reporting is decision-useful. A board report should explain material changes, root causes, customer impact, overdue remediation, emerging risks and management actions—not merely count training completions.

6. AML/CFT and Proliferation-Financing Controls

Anti-money-laundering and counter-terrorist-financing systems seek to prevent the financial system from being used to disguise criminal proceeds, move funds for terrorism or support prohibited proliferation activities. The precise legal obligations differ by jurisdiction, but internationally recognised principles generally include risk assessment, customer due diligence, beneficial-ownership identification, enhanced measures, record keeping, transaction monitoring, suspicious-activity reporting and staff training.

6.1 Risk-based approach

A risk-based approach does not mean ignoring low-risk customers or applying identical controls to every customer. It means allocating resources according to relevant risk factors, including:

• customer type and ownership complexity;
• product and service characteristics;
• delivery channel;
• geography and jurisdictional exposure;
• transaction behaviour; and
• indicators of criminal, sanctions or corruption risk.

Risk scoring should support judgement rather than replace it. A low numerical score should not override a serious red flag, and a high score should not automatically prove criminality.

6.2 Customer due diligence

Customer due diligence generally involves identifying and verifying the customer, understanding the purpose and intended nature of the relationship, identifying beneficial owners, understanding control structures and conducting ongoing monitoring. Beneficial ownership is particularly difficult in layered corporate structures, trusts, nominee arrangements and cross-border chains.

Enhanced due diligence may be appropriate for politically exposed persons, high-risk jurisdictions, complex ownership, unusual products, adverse media or unexplained activity. Enhanced due diligence is not a declaration that a customer is criminal; it is a proportionate response to increased uncertainty or exposure.

6.3 Transaction monitoring and suspicious activity

Monitoring systems may use rules, thresholds, behavioural analytics, network analysis and investigator judgement. A transaction alert is not equivalent to a suspicious-activity conclusion. Investigators should examine context, customer profile, source of funds, counterparties, explanations and linked activity.

Overreliance on thresholds creates evasion opportunities and excessive false positives. Under-reporting threatens the integrity of the system; indiscriminate reporting can overwhelm authorities and unfairly harm customers. Institutions should document investigative reasoning and protect confidentiality around suspicious-activity reports, subject to applicable law.

7. Sanctions and Fraud Risk

Sanctions regimes may restrict dealings with designated persons, entities, vessels, territories, goods or services. Obligations can differ by jurisdiction and may apply to direct and indirect transactions. Screening should cover customers, beneficial owners, counterparties, payments and relevant trade information, with controls for name variation, transliteration, false positives, list updates and payment release.

A sanctions alert should be investigated under a documented escalation process. Staff should not resolve alerts solely by matching or dismissing a name without considering identifiers, ownership, geography and transaction context.

Fraud is intentional deception for gain or to cause loss. The fraud triangle identifies three commonly interacting conditions: pressure or incentive, opportunity and rationalisation. The framework is useful for risk assessment but is not a complete causal theory. Fraud risk management includes prevention, detection, investigation, recovery and disciplinary action.

Important controls include access management, dual approvals, reconciliations, anomaly detection, vendor due diligence, employee-activity monitoring subject to law, secure reporting channels and post-incident lessons. Fraud controls should address both external fraud and insider abuse. Seniority must not create uncontrolled access or exemption from review.

8. Responsible Customer Treatment

Responsible treatment requires clear information, suitable products, fair pricing, accessible service, privacy protection, effective complaints handling and appropriate support for vulnerable customers. Vulnerability may arise from disability, illness, age, bereavement, financial distress, language barriers, coercion or limited digital access.

A product may be legally disclosed yet unsuitable for a particular customer. Institutions should assess product governance across the lifecycle: design, testing, approval, marketing, distribution, monitoring and withdrawal. Outcomes should be examined rather than inferred from process completion.

Complaints are a control signal. Institutions should identify systemic issues, provide remedies where harm occurred and avoid treating complaints solely as reputational threats. Collection practices should be proportionate and respectful, particularly where customers face hardship.

9. Whistleblowing, Accountability and Enforcement

Whistleblowing systems should permit confidential or anonymous reporting where lawful, provide multiple channels, protect reporters from retaliation and ensure independent investigation. The board should receive aggregated information about themes, timeliness, substantiation and remediation.

Accountability requires more than imposing fines on the institution. Responsibilities should be allocated clearly through role descriptions, approval records, committee minutes, delegated authorities and performance objectives. Enforcement should be consistent, evidence-based and proportionate. It should address both the immediate breach and the conditions that allowed it.

Remuneration is a major accountability mechanism. Balanced scorecards may include risk, conduct, customer and control objectives. Deferred compensation, malus and clawback provisions can reduce incentives for short-term misconduct, although recovery may be legally difficult and should not be assumed to solve cultural problems.

10. Technology, Data and Artificial Intelligence

Technology can improve screening, monitoring and case prioritisation, but it introduces model, data, cyber, privacy and explainability risks. A machine-learning system may identify unusual networks that rules miss, yet it may also reproduce biased historical decisions or generate opaque alerts.

Good practice includes clear use-case approval, data lineage, documented model purpose, validation, threshold governance, human review, performance monitoring, access controls and an appeal or correction mechanism. AI should support—not eliminate—professional judgement in high-impact decisions. Institutions should be able to explain why an alert was generated, what evidence was considered and who made the final decision.

Data quality is a governance issue. Incomplete beneficial-owner data, inconsistent customer identifiers and delayed updates weaken every downstream control. The board should treat critical compliance data as an enterprise asset with accountable ownership.

11. Illustrative Case: Meridian Bank

Background. Meridian Bank expanded rapidly through digital onboarding and offered instant small-business accounts. Its board received monthly reports showing high customer growth and low onboarding costs. Compliance alerts increased, but management reduced investigation queues by raising automated thresholds.

Problem. A later review found that several companies shared addresses, directors and payment beneficiaries. Some accounts were linked to fraud proceeds. The bank had performed formal identity checks but had not adequately understood beneficial ownership or connected activity. Staff had also been rewarded heavily for account openings, while compliance performance was not included in incentives.

Analysis. The failure was not caused by one employee. It reflected weak governance: the board focused on growth metrics, the first line treated AML as a compliance department responsibility, the second line lacked authority to challenge threshold changes, and internal audit had not reviewed the new onboarding model. Data from customer records, payments and fraud investigations were not integrated.

Approach. Meridian established a board-level remediation committee; restored risk-based alert thresholds; introduced network analysis; required enhanced review for shared ownership and beneficiary patterns; appointed accountable executives; revised sales incentives; strengthened quality assurance; and commissioned an independent review. It also created customer-remediation procedures for accounts wrongly delayed or closed.

Outcome. The bank reduced the investigation backlog, improved beneficial-owner completeness and identified a broader fraud network. Some legitimate customers experienced additional verification delays, so the bank added service standards, human escalation and transparent explanations. The case demonstrates that stronger financial-crime controls must be balanced with fair customer treatment.

Learning points. Growth metrics can conceal control deterioration. Formal identification is not the same as understanding risk. Threshold changes require governance and validation. Effective remediation addresses incentives, data, accountability and customer impact together.

12. Contemporary Challenges and Best Practices

Financial institutions face increasingly complex threats: instant payments, synthetic identities, cyber-enabled fraud, cryptoasset exposure, correspondent-banking opacity, geopolitical sanctions, deepfakes and cross-border data restrictions. Criminals exploit speed and fragmented information, while institutions must manage privacy and proportionality.

Best practices include:

• board expertise matched to the institution’s risk profile;
• a clearly articulated risk appetite and escalation thresholds;
• independent and adequately resourced control functions;
• integrated customer, payments, fraud and sanctions data;
• outcome-based conduct metrics;
• tested business continuity and incident response;
• documented model governance for automated tools;
• timely root-cause remediation;
• protected whistleblowing channels; and
• regular independent assurance of high-risk activities.

No framework is permanent. Governance should be reviewed after major incidents, acquisitions, product launches, regulatory change, technology implementation and material shifts in the external threat environment.

Chapter Summary

Governance in financial institutions is an accountability system linking strategy, risk appetite, authority, information, incentives and assurance. The board oversees; management operates; the first line owns risk; the second line challenges and monitors; and internal audit provides independent assurance. Agency theory explains incentive and information problems, while stakeholder and public-interest perspectives explain why financial institutions have responsibilities beyond shareholders.

Ethical culture is expressed through decisions, incentives and responses to misconduct. Conflicts require identification, disclosure, mitigation and monitoring. Internal controls provide reasonable assurance but depend on ownership, evidence and follow-up. Compliance systems translate legal obligations into processes, reporting and accountability.

AML/CFT, sanctions and fraud controls should be risk-based, intelligence-led and proportionate. Customer due diligence, beneficial-owner analysis, transaction monitoring, screening, investigation and reporting must be supported by reliable data. Responsible customer treatment requires attention to suitability, vulnerability, complaints and remediation. Technology and AI can enhance controls, but they require governance, validation, human judgement and privacy safeguards. Ultimately, sound governance is demonstrated not by the volume of policies but by whether the institution makes responsible decisions and corrects failures before they become systemic harm.

Key Terms

Accountability: The obligation to explain decisions, accept responsibility and face consequences.

Agency theory: A theory concerning conflicts between principals and agents arising from different interests and information.

Beneficial owner: The natural person who ultimately owns or controls a customer or arrangement.

Board independence: The capacity to exercise objective judgement without inappropriate influence.

Conduct risk: The risk of harm to customers, markets or integrity caused by inappropriate behaviour.

Conflict of interest: A situation in which competing interests may improperly influence judgement.

Control environment: The governance, values, structure and accountability context in which controls operate.

Customer due diligence: Processes for identifying customers, understanding relationships and monitoring activity.

Fiduciary duty: A duty to act loyally, honestly and for proper purposes in the interests required by law.

Financial crime: Criminal activity involving financial gain, financial systems or financial resources.

Fraud triangle: Pressure or incentive, opportunity and rationalisation as interacting fraud conditions.

Internal audit: An independent assurance function evaluating governance, risk management and controls.

Malus: Reduction or cancellation of deferred remuneration before it vests.

Money laundering: Processes used to conceal or disguise criminal proceeds.

Politically exposed person: A person entrusted with a prominent public function, with associated risk considerations.

Risk appetite: The amount and type of risk an institution is willing to accept in pursuing objectives.

Sanctions: Legal restrictions imposed on persons, entities, activities, goods or jurisdictions.

Three-lines model: A framework distinguishing operational ownership, oversight functions and independent assurance.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Review Questions

5 Short Answer Questions

1. What is the difference between board oversight and senior-management responsibility?
2. Why is disclosure alone often insufficient to manage a material conflict of interest?
3. Distinguish design effectiveness from operating effectiveness in internal control.
4. What is the purpose of beneficial-owner identification?
5. Why should customer complaints be treated as a control signal?

5 Long Answer Questions

1. Explain how agency theory, stakeholder theory and the public-interest perspective contribute to the governance of financial institutions.
2. Describe the three-lines model and evaluate the risks of allowing the second line to assume first-line responsibilities.
3. Design a risk-based AML/CFT framework for a digital financial institution operating across several jurisdictions.
4. Discuss how remuneration, culture and whistleblowing arrangements influence misconduct risk.
5. Evaluate the opportunities and limitations of artificial intelligence in sanctions and transaction monitoring.

3 Analytical / Application Questions

1. A bank’s growth has doubled in two years, but control exceptions, complaints and overdue audit actions have also increased. Analyse the governance weaknesses and recommend board-level interventions.
2. An automated sanctions tool generates many false positives and investigators begin closing alerts without documented reasoning. Assess the risks and propose a remediation plan.
3. A vulnerable customer was sold an unsuitable product after completing all formal disclosure steps. Analyse whether the institution can claim responsible treatment and identify the evidence required to reach a conclusion.

Multiple Choice Questions with Answers

Question 1

Which function has primary responsibility for operating controls and owning risks arising from business activities?

A. The first line, consisting of business and operations

B. The external auditor

C. The board risk committee alone

D. The regulator

Correct Answer: A. The first line, consisting of business and operations

Question 2

What does operating effectiveness of a control assess?

A. Whether the control is described in a policy

B. Whether the control actually operated as intended during the relevant period

C. Whether the control has been approved by the board

D. Whether the control eliminates all possible risk

Correct Answer: B. Whether the control actually operated as intended during the relevant period

Question 3

Which response is generally most appropriate for a material conflict of interest?

A. Ignoring it if the transaction is profitable

B. Disclosing it only after the transaction is complete

C. Considering recusal, independent review or prohibition

D. Allowing the conflicted employee to make the final decision

Correct Answer: C. Considering recusal, independent review or prohibition

Question 4

What is the principal purpose of identifying a beneficial owner?

A. To determine the customer’s marketing preferences

B. To identify the natural person ultimately owning or controlling the relationship

C. To calculate the institution’s tax expense

D. To replace all transaction monitoring

Correct Answer: B. To identify the natural person ultimately owning or controlling the relationship

Question 5

Which statement best describes a risk-based AML/CFT approach?

A. Every customer must receive identical controls

B. Only high-value transactions require monitoring

C. Resources and controls are proportionate to relevant risks

D. Low-risk customers may never be reviewed again

Correct Answer: C. Resources and controls are proportionate to relevant risks

Question 6

Which combination is associated with the fraud triangle?

A. Capital, liquidity and solvency

B. Pressure or incentive, opportunity and rationalisation

C. Strategy, budgeting and forecasting

D. Identification, verification and disclosure

Correct Answer: B. Pressure or incentive, opportunity and rationalisation

Question 7

Why is a transaction-monitoring alert not automatically proof of suspicious activity?

A. Alerts are always legally irrelevant

B. An alert requires contextual investigation and professional judgement

C. Only customers can determine whether activity is suspicious

D. Monitoring systems cannot detect any financial crime

Correct Answer: B. An alert requires contextual investigation and professional judgement

Question 8

What is the primary assurance role of internal audit?

A. To operate daily business controls

B. To approve every customer transaction

C. To provide independent, risk-based assurance on governance, risk and controls

D. To replace the board

Correct Answer: C. To provide independent, risk-based assurance on governance, risk and controls

Question 9

Which practice best supports responsible customer treatment?

A. Measuring only the number of products sold

B. Assessing suitability, vulnerability, complaints and customer outcomes

C. Avoiding all customers who require additional support

D. Treating formal disclosure as proof of suitability in every case

Correct Answer: B. Assessing suitability, vulnerability, complaints and customer outcomes

Question 10

What is a major governance requirement when using AI for compliance monitoring?

A. Removing all human review

B. Avoiding model validation because the system is automated

C. Ensuring data quality, validation, explainability and accountable human oversight

D. Allowing the model to change thresholds without approval

Correct Answer: C. Ensuring data quality, validation, explainability and accountable human oversight