Regulation, Compliance, Governance and Financial Crime

Introduction and Context

International banking depends on trust across borders. Banks accept deposits, create credit, settle payments, transfer capital and provide access to foreign markets. These activities also create vulnerabilities: excessive leverage, liquidity runs, money laundering, terrorist financing, sanctions evasion, tax concealment, cybercrime, corruption and conflicts of interest. Regulation and governance therefore perform an economic function as well as a legal one. They protect depositors, preserve financial stability, promote market integrity and reduce the probability that financial institutions become channels for illicit activity.

The global financial crisis demonstrated that a bank can satisfy apparently reasonable requirements while still being systemically vulnerable. Weak underwriting, inadequate capital, dependence on short-term wholesale funding, poor risk governance and opaque derivatives exposures can interact rapidly. Modern regulation consequently combines entity-level prudential supervision with conduct regulation, financial-crime controls, information-sharing and crisis-management arrangements.

This chapter examines the principal international frameworks and their practical application. It focuses on Basel capital and liquidity standards, supervisory methods, resolution and deposit protection, AML/CFT, KYC, sanctions, tax transparency, data protection and governance. Rules differ between jurisdictions, but the underlying supervisory principles are increasingly coordinated through international standard setters such as the Basel Committee on Banking Supervision, the Financial Action Task Force (FATF), the Financial Stability Board (FSB), the International Association of Deposit Insurers (IADI) and the Organisation for Economic Co-operation and Development (OECD).

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and structure of Basel capital and liquidity standards.
2. Calculate and interpret basic capital, leverage, LCR and NSFR measures.
3. Distinguish prudential supervision, conduct supervision and financial-crime compliance.
4. Explain resolution, recovery planning and deposit protection.
5. Apply risk-based AML/CFT, KYC, sanctions and tax-transparency principles.
6. Analyse governance responsibilities, accountability and the role of technology.
7. Evaluate tensions between regulatory objectives, commercial strategy, privacy and financial inclusion.

1. The Architecture of International Financial Regulation

International financial regulation is not a single worldwide law. It is a layered system:

• International standards: recommendations and minimum standards developed by bodies such as the Basel Committee and FATF.
• Regional rules: for example, legislation adopted by regional economic unions.
• National law: statutes, regulations, supervisory guidance and enforcement decisions.
• Institutional policy: internal risk appetite, procedures, controls and codes of conduct.
• Supervisory practice: examinations, reporting, stress tests, remediation orders and sanctions.

International standards often operate through national implementation. A Basel standard may therefore have different transition periods, scope or stricter national requirements in different countries. A bank operating internationally must comply with the law of each relevant jurisdiction and manage conflicts between legal regimes.

Three regulatory objectives should be distinguished:

These objectives overlap. For example, poor AML controls can produce fines, loss of correspondent relationships, liquidity pressure and reputational damage. Conversely, an overly rigid de-risking policy may exclude legitimate customers and undermine financial inclusion.

2. Basel Capital Standards

2.1 Why capital matters

Capital is the loss-absorbing funding supplied by shareholders and retained earnings, supplemented by instruments that meet regulatory criteria. It protects depositors and other creditors by absorbing unexpected losses before those creditors bear losses. Capital also limits leverage and gives supervisors time to intervene.

Basel III classifies regulatory capital into quality tiers:

• Common Equity Tier 1 (CET1): common shares, retained earnings and qualifying reserves, after regulatory deductions. It is the highest-quality going-concern capital.
• Additional Tier 1 (AT1): qualifying perpetual instruments capable of absorbing losses while the bank remains a going concern.
• Tier 2: qualifying subordinated instruments and other gone-concern capital, generally available to absorb losses when a bank fails or is resolved.
• Total regulatory capital: Tier 1 capital plus eligible Tier 2 capital.

Risk-weighted assets (RWA) convert exposures into risk-sensitive measures. A low-risk sovereign exposure may receive a lower risk weight than an unsecured corporate loan, although the precise treatment depends on the applicable framework and national implementation.

2.2 Core capital ratios

The principal ratios are:

Capital and RWA must be measured for the same reporting perimeter and date. Ratios are percentages, and capital and RWA must be expressed in the same currency units. These formulas describe ratios; they do not by themselves determine the applicable minimum, because minimum requirements may include regulatory buffers, surcharges and national add-ons.

Basel III also introduced a capital conservation buffer, generally composed of CET1 capital above minimum requirements. Banks that draw down buffers may face restrictions on distributions such as dividends and discretionary bonuses. Countercyclical buffers may be activated when authorities judge that excessive credit growth is creating systemic risk. Global systemically important banks may face additional loss-absorbency requirements.

2.3 Leverage ratio

Risk weights can understate risk if models are poorly designed or exposures are misclassified. The leverage ratio provides a non-risk-weighted backstop:

The leverage exposure measure generally includes on-balance-sheet exposures and specified off-balance-sheet items, subject to regulatory adjustments. The leverage ratio is less risk-sensitive than the risk-based capital ratios, so both perspectives are necessary.

Worked Example 1: Capital ratios

Assume a bank reports CET1 capital of 84 million, additional Tier 1 capital of 16 million, eligible Tier 2 capital of 25 million and RWA of 1,000 million. Its leverage exposure measure is 1,800 million.

CET1 capital = 84 million.

Tier 1 capital = 84 + 16 = 100 million.

Total capital = 84 + 16 + 25 = 125 million.

Therefore:

The bank may appear adequately capitalised, but a proper assessment must compare these results with the applicable minimums, buffers, supervisory add-ons, stress losses, concentration risks and the quality of capital. A ratio is not a substitute for analysis of capital adequacy.

3. Basel Liquidity Standards

Capital protects against insolvency; liquidity enables a bank to meet obligations when they fall due. A solvent bank can fail if it cannot obtain cash or sell assets without unacceptable loss. Liquidity risk is intensified by maturity transformation: banks commonly fund longer-term assets with shorter-term liabilities.

3.1 Liquidity Coverage Ratio

The Liquidity Coverage Ratio (LCR) is designed to ensure that a bank holds sufficient high-quality liquid assets (HQLA) to survive a specified short-term stress scenario, conventionally 30 calendar days under the Basel framework.

HQLA are assets that can be converted into cash quickly with limited loss under stress. Net cash outflows are stressed outflows minus eligible inflows, subject to regulatory caps and prescribed assumptions. The ratio is not simply all cash divided by all payments; classification, haircuts, eligibility and stress factors matter. A ratio of 100% means that the stock of eligible HQLA equals the calculated 30-day net stressed outflows.

3.2 Net Stable Funding Ratio

The Net Stable Funding Ratio (NSFR) addresses structural funding risk over a longer horizon:

Available stable funding (ASF) reflects the stability of funding sources, including qualifying capital and liabilities. Required stable funding (RSF) reflects the liquidity characteristics and maturity of assets and off-balance-sheet exposures. The standard is generally calibrated over a one-year horizon. A ratio of at least 100% indicates that available stable funding meets the regulatory amount required for the institution’s assets and commitments.

Worked Example 2: Liquidity

Suppose a bank has HQLA of 260 million and calculated 30-day net cash outflows of 220 million:

If its ASF is 900 million and RSF is 840 million:

These figures exceed 100%, but management should still examine deposit concentration, intraday liquidity, collateral calls, currency mismatches, market access and the possibility that customers behave differently from regulatory assumptions. Liquidity is also jurisdiction-specific: assets in one currency may not readily satisfy an obligation in another.

4. Prudential Supervision and Stress Testing

Prudential supervision combines rules with judgement. Supervisors evaluate a bank’s capital, liquidity, governance, risk management, business model, operational resilience and compliance culture. Common supervisory methods include:

• Off-site surveillance: analysis of regulatory returns, financial statements, risk indicators and emerging vulnerabilities.
• On-site examination: testing controls, files, models, data and decision-making.
• Supervisory review: assessment of whether minimum rules adequately reflect the institution’s individual risk profile.
• Stress testing: analysis of whether capital and liquidity remain adequate under adverse scenarios.
• Prompt corrective action: escalation, restrictions or remediation when weaknesses become material.

A stress test is not a forecast. It is a conditional analysis: “What would happen if specified assumptions occurred?” Scenarios may include recession, housing-price decline, exchange-rate shock, deposit run, interest-rate rise, cyber incident or sovereign default. Supervisors examine both numerical outcomes and management actions.

Effective supervision is risk-based. It allocates greater attention to institutions, activities and controls that pose greater potential harm. However, risk-based supervision is not permission to ignore low-probability events. Tail risks, model uncertainty and correlated exposures can be especially important.

5. Recovery, Resolution and Deposit Protection

5.1 Recovery and resolution

A recovery plan explains how a bank could restore viability through actions such as raising capital, selling assets, reducing lending, obtaining secured funding or changing its business structure. Recovery is led by the institution while it remains viable.

A resolution plan explains how authorities could manage failure without disorderly liquidation or reliance on taxpayer-funded bailouts. Resolution objectives typically include maintaining critical functions, protecting depositors, preserving financial stability and allocating losses to shareholders and creditors according to law.

Important resolution tools include:

• Bail-in: eligible liabilities are written down or converted into equity.
• Sale of business: critical operations are transferred to another institution.
• Bridge bank: essential functions are temporarily operated in a new entity.
• Asset separation: selected assets are transferred to an asset-management vehicle.

Resolvability requires operational continuity, legal-entity information, reliable data, accessible liquidity and sufficient loss-absorbing capacity. Cross-border resolution is difficult because insolvency laws, creditor hierarchies, deposit guarantees and recognition of foreign actions differ.

5.2 Deposit insurance

Deposit protection reduces the incentive for retail depositors to run at the first sign of weakness. A credible scheme defines eligible deposits, coverage limits, exclusions, funding arrangements and payout procedures. It must balance depositor protection with moral hazard: if all creditors believe they will always be protected, banks and depositors may take excessive risks.

Deposit insurance is most effective when combined with strong supervision, rapid payout capability, clear public communication and a credible resolution framework. Coverage should be understandable, and customers should know whether deposits held through branches, subsidiaries, currencies or different legal entities are protected.

6. AML/CFT and KYC

Money laundering is the process of disguising criminal proceeds so that they appear legitimate. A commonly used conceptual model contains three stages:

1. Placement: introducing illicit funds into the financial system.
2. Layering: conducting transactions to obscure origin and ownership.
3. Integration: using apparently legitimate funds or assets.

Terrorist financing differs because funds may originate from either legal or illegal sources; the concern is their intended use. Proliferation financing concerns support for the development or transfer of weapons of mass destruction and related materials.

FATF promotes a risk-based approach. Institutions should identify, assess and manage risks rather than apply identical controls to every customer. Risk factors may include customer type, ownership structure, product, delivery channel, geography, transaction pattern and adverse information.

Customer due diligence (CDD) normally involves:

• identifying and verifying the customer;
• identifying the beneficial owner;
• understanding the purpose and intended nature of the relationship;
• establishing a risk profile;
• conducting ongoing monitoring;
• keeping records and updating information.

A beneficial owner is the natural person who ultimately owns or controls a customer, even where companies, trusts or nominees appear in the legal ownership chain. Complex structures do not automatically prove wrongdoing, but unexplained complexity increases the need for clarification.

Enhanced due diligence (EDD) may be required for higher-risk relationships, including certain politically exposed persons (PEPs), opaque ownership structures, high-risk jurisdictions or unusual correspondent banking arrangements. EDD can involve senior approval, source-of-wealth and source-of-funds evidence, more frequent review and intensified transaction monitoring.

A suspicious transaction report (STR) or suspicious activity report (SAR) is made to the competent financial-intelligence authority where there is a legally reportable suspicion. The institution must avoid “tipping off” the customer where prohibited. Reporting is not a finding of guilt; it is a confidential communication supporting competent-authority analysis.

7. Sanctions Compliance

Sanctions may target countries, governments, entities, vessels, sectors, individuals, goods or activities. They can include asset freezes, prohibitions on making funds available, trade restrictions and financial-service restrictions. Sanctions regimes may be imposed by the jurisdiction where a bank is incorporated, operates, clears payments, uses a currency or has a relevant connection.

A sanctions programme should combine:

• current and authoritative screening lists;
• customer and beneficial-owner screening;
• payment and trade-finance screening;
• name-resolution controls that manage false positives;
• escalation and investigation procedures;
• blocking, rejecting or reporting where legally required;
• independent testing and audit;
• staff training and documented governance.

Sanctions screening is not identical to AML transaction monitoring. Screening often asks whether a party or transaction matches a restriction; AML monitoring looks for patterns and circumstances suggesting illicit finance. Both require reliable data, but the legal consequences of a confirmed match may be immediate and severe.

8. Tax Transparency and Information Exchange

International banks may have obligations under regimes designed to combat offshore tax evasion and improve beneficial-ownership transparency. The OECD Common Reporting Standard (CRS) uses due-diligence and reporting procedures for certain financial accounts. The United States Foreign Account Tax Compliance Act (FATCA) imposes separate reporting and withholding-related obligations on relevant institutions.

Tax transparency controls commonly require an institution to:

1. determine the customer’s tax residence;
2. classify the account holder and account;
3. collect tax-identification information where required;
4. identify controlling persons for relevant entities;
5. report prescribed information to the competent authority;
6. protect data and correct inaccurate reports.

Tax reporting does not authorise a bank to disclose information indiscriminately. Institutions must reconcile reporting obligations with confidentiality, data-protection law, professional secrecy and local restrictions on cross-border transfer.

9. Data Protection and Cross-Border Information Governance

Compliance requires extensive personal data: identity documents, beneficial ownership, transaction histories, risk scores, sanctions alerts and investigation records. Data-protection principles generally include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

A bank should distinguish:

• data necessary to perform a contract;
• data processed to comply with a legal obligation;
• data processed for legitimate interests, subject to applicable balancing requirements;
• highly sensitive data requiring additional safeguards.

Cross-border groups face conflicts over data localisation, regulator access, discovery, secrecy and customer rights. A sound framework defines who may access data, for what purpose, for how long and under which legal authority. Access should follow least privilege, with audit trails and segregation of investigation information.

Artificial intelligence can improve alert prioritisation, identity verification and network analysis, but it introduces model risk, bias, explainability and privacy concerns. An AI-generated risk score should not be treated as conclusive evidence. Human review, validation, outcome testing, documentation and appeal or correction mechanisms remain essential.

10. Corporate Governance and the Three Lines Model

The board is responsible for the institution’s strategy, risk appetite, culture and oversight. It should not manage every transaction, but it must ensure that management has effective systems and that incentives do not encourage excessive risk or misconduct.

The three-lines model is a useful allocation of responsibility:

1. First line: business and operational managers own risks and operate controls.
2. Second line: risk management and compliance provide challenge, policies, monitoring and advice.
3. Third line: internal audit provides independent assurance to the board or audit committee.

The model does not eliminate collective board responsibility. Important governance elements include fit-and-proper standards, independent challenge, clear committee mandates, documented escalation, whistleblowing protection, remuneration linked to prudent behaviour and accurate regulatory reporting.

A strong compliance culture is demonstrated by decisions, not slogans. Warning signs include excessive override of alerts, unexplained account closures, sales targets that conflict with customer interests, under-resourced compliance teams, repeated audit findings and retaliation against whistleblowers.

Illustrative Case: Meridian Cross-Border Bank

Background

Meridian Cross-Border Bank is a fictional mid-sized institution operating through subsidiaries in three countries. It provides trade finance, remittances and correspondent banking. Its rapid growth has been funded partly by short-term wholesale deposits. The group uses a central technology platform, but each subsidiary has separate customer files and local compliance teams.

Problem

A supervisory review identifies four weaknesses. First, the group calculates capital ratios correctly but excludes some operational-risk exposures from internal stress scenarios. Second, its LCR is above 100% in the reporting currency but falls below that level in a foreign currency during a stressed outflow scenario. Third, payment alerts are frequently closed as false positives without documented rationale. Fourth, beneficial-owner information is inconsistent between subsidiaries. The board receives highly aggregated compliance reports and does not receive a clear view of overdue remediation.

Analysis

The capital ratio alone does not demonstrate resilience. Operational losses, litigation, conduct penalties and remediation expenses may reduce capital. Liquidity must be assessed by currency, legal entity, collateral location and intraday timing. The alert-closure problem creates both AML and governance risk: a system with many false positives may encourage superficial processing, while poor documentation prevents independent review. Inconsistent ownership records create risks under AML, sanctions and tax-transparency regimes.

Approach and solution

Meridian establishes a group-wide risk taxonomy and minimum control standard while preserving local legal requirements. It introduces a currency-sensitive liquidity dashboard, reverse stress testing and limits on reliance on short-term wholesale funding. A central beneficial-ownership service reconciles records, identifies conflicts and assigns accountability for remediation.

The bank redesigns alert procedures using documented closure reasons, quality assurance sampling and escalation thresholds. It validates its transaction-monitoring model for different customer segments rather than assuming that one threshold works across all countries. The board risk committee receives a dashboard showing overdue actions, high-risk relationships, unresolved sanctions cases, liquidity by currency and exceptions to policy.

Outcome

After implementation, alert volumes decline because scenarios are better calibrated, but the bank identifies more genuinely high-risk cases. Liquidity buffers are reallocated across currencies, and contingency funding arrangements are tested. The supervisor accepts the remediation plan subject to continuing review. The bank also discovers that a commercial incentive encouraged onboarding speed without adequate ownership verification and changes the incentive scheme.

Learning points

1. Regulatory ratios are essential but incomplete indicators of resilience.
2. Group-wide standards must be adapted to local law and operational reality.
3. Data quality is a control issue, not merely a technology issue.
4. Governance requires useful escalation information, not large volumes of reports.
5. Compliance controls should be tested against outcomes, false positives and unintended exclusion.

11. Challenges, Limitations and Contemporary Developments

Regulation faces several persistent challenges. First, rules may lag behind financial innovation, including digital assets, instant payments, embedded finance and non-bank credit intermediation. Second, regulatory fragmentation increases cost and creates opportunities for regulatory arbitrage. Third, de-risking can remove correspondent banking relationships from vulnerable regions, increasing informal activity rather than reducing risk. Fourth, complex models may create false confidence when data are incomplete or historical relationships break down.

Supervisors increasingly emphasise operational resilience, third-party and cloud-service risk, cyber security, climate-related financial risks and recovery from technology failures. Banks must understand concentration risk where many institutions depend on the same vendor or payment infrastructure. Climate risks can affect creditworthiness, collateral values, insurance availability and market prices, although scenario analysis remains subject to significant uncertainty.

Best practice is therefore based on principles as well as checklists:

• maintain a board-approved risk appetite;
• link capital, liquidity and financial-crime risk to business strategy;
• use reliable, reconciled and timely data;
• apply proportional, documented risk-based controls;
• test controls through independent assurance and realistic scenarios;
• investigate root causes rather than only individual breaches;
• preserve clear records of judgement and escalation;
• coordinate legal, compliance, risk, technology and business functions;
• protect whistleblowers and challenge conflicts of interest;
• review controls when products, jurisdictions or technology change.

Chapter Summary

International banking regulation combines prudential, conduct and financial-crime objectives. Basel capital standards measure loss-absorbing capacity through CET1, Tier 1 and total capital ratios based on RWA, while the leverage ratio provides a non-risk-weighted backstop. Liquidity standards address both short-term stress through the LCR and structural funding through the NSFR. These ratios must be interpreted alongside buffers, stress tests, currency exposures, model risk and governance quality.

Prudential supervision uses reporting, examinations, stress testing and corrective action. Recovery plans prepare a viable bank to restore itself; resolution plans prepare authorities to manage failure while protecting critical functions. Deposit insurance supports confidence but must be combined with supervision and credible resolution to limit moral hazard.

AML/CFT and KYC require identification, beneficial-owner analysis, risk profiling, monitoring, record keeping and appropriate reporting. Sanctions compliance requires current data, screening, investigation and escalation. Tax transparency regimes require accurate tax-residence and controlling-person information, while data protection limits how compliance information may be collected, used, transferred and retained. Effective governance assigns ownership through the three-lines model, supports independent challenge and makes the board accountable for culture, risk appetite and remediation.

Key Terms

Capital: Loss-absorbing funding available to protect creditors and support continued operation.

CET1: The highest-quality form of regulatory capital, mainly common equity and retained earnings.

Risk-weighted assets: Regulatory measure that adjusts exposures according to prescribed or modelled risk.

Leverage ratio: Tier 1 capital divided by the regulatory leverage exposure measure.

LCR: Ratio of HQLA to stressed 30-day net cash outflows.

NSFR: Ratio of available stable funding to required stable funding.

HQLA: Assets that can be converted into cash quickly with limited loss under stress.

Prudential supervision: Oversight directed at safety, solvency, liquidity and financial stability.

Recovery plan: A bank’s plan for restoring viability before failure.

Resolution: Authorities’ process for managing a failing institution while preserving critical functions.

Deposit insurance: A scheme protecting eligible deposits up to specified limits.

Money laundering: Concealment or transformation of criminal proceeds to make them appear legitimate.

Terrorist financing: Provision or collection of funds for terrorist purposes, regardless of the funds’ original legality.

KYC: Processes for identifying, verifying and understanding customers.

Beneficial owner: Natural person who ultimately owns or controls a customer.

PEP: Politically exposed person who may require enhanced due diligence because of corruption-related risks.

Sanctions screening: Checking customers and transactions against applicable restrictive-measure lists.

Tax transparency: Processes for identifying and reporting relevant tax-residence and account information.

Three-lines model: Allocation of risk ownership, compliance challenge and independent internal audit.

Risk-based approach: Applying controls in proportion to assessed risk rather than identically to all cases.

Review Questions

Short Answer Questions

1. Why is CET1 regarded as higher-quality capital than Tier 2 capital?
2. What is the purpose of the LCR?
3. Distinguish a recovery plan from a resolution plan.
4. Who is a beneficial owner?
5. Why must sanctions screening and AML transaction monitoring be distinguished?

Long Answer Questions

1. Explain the structure of Basel capital requirements and discuss why risk-based ratios should be supplemented by a leverage ratio.
2. Compare the LCR and NSFR, including their time horizons, inputs and limitations.
3. Discuss how prudential supervision, deposit insurance and resolution policy interact to reduce systemic risk.
4. Explain the main components of a risk-based AML/CFT programme.
5. Analyse the responsibilities of the board, first line, second line and internal audit under the three-lines model.

Analytical / Application Questions

1. A bank has CET1 of 60 million, AT1 of 10 million, Tier 2 of 15 million and RWA of 700 million. Calculate its CET1 ratio, Tier 1 ratio and total capital ratio. Explain what additional information is needed before concluding that the bank is adequately capitalised.
2. A bank reports an LCR above 100% in its domestic currency but experiences large foreign-currency withdrawals. Analyse why its consolidated ratio may conceal vulnerability and recommend three controls.
3. A bank’s automated system generates many sanctions and AML alerts, most of which are closed without documented reasons. Evaluate the risks and design a proportionate remediation plan.

Multiple Choice Questions with Answers

Question 1

Which measure is the highest-quality form of Basel regulatory capital?

A. Common Equity Tier 1

B. Additional Tier 1

C. Tier 2

D. Short-term wholesale funding

Correct Answer: A. Common Equity Tier 1

Question 2

A bank has CET1 capital of 50 million and RWA of 500 million. What is its CET1 ratio?

A. 5%

B. 10%

C. 50%

D. 100%

Correct Answer: B. 10%

Question 3

What does the LCR primarily address?

A. Long-term profitability

B. Thirty-day stressed liquidity needs

C. Customer suitability

D. Tax residence

Correct Answer: B. Thirty-day stressed liquidity needs

Question 4

Which formula represents the NSFR?

A. CET1 ÷ RWA

B. HQLA ÷ net cash outflows

C. Available stable funding ÷ required stable funding

D. Net income ÷ total assets

Correct Answer: C. Available stable funding ÷ required stable funding

Question 5

What is the principal purpose of a resolution plan?

A. To increase sales commissions

B. To manage bank failure while preserving critical functions

C. To identify customer tax residence only

D. To replace all internal audits

Correct Answer: B. To manage bank failure while preserving critical functions

Question 6

Which person is the beneficial owner of a company?

A. Only the company’s external auditor

B. The natural person who ultimately owns or controls it

C. Any employee who processes payments

D. The bank’s relationship manager

Correct Answer: B. The natural person who ultimately owns or controls it

Question 7

Which action is generally associated with enhanced due diligence?

A. Reducing customer identification requirements

B. Obtaining additional information on source of wealth

C. Automatically approving all transactions

D. Removing ongoing monitoring

Correct Answer: B. Obtaining additional information on source of wealth

Question 8

What is the main distinction between AML monitoring and sanctions screening?

A. AML monitoring examines suspicious patterns, while sanctions screening checks restrictive lists

B. They are legally and operationally identical

C. Sanctions screening applies only to employees

D. AML monitoring never involves transactions

Correct Answer: A. AML monitoring examines suspicious patterns, while sanctions screening checks restrictive lists

Question 9

Under the three-lines model, which function provides independent assurance?

A. Sales management

B. Business operations

C. Compliance advice

D. Internal audit

Correct Answer: D. Internal audit

Question 10

Why is data protection important in financial-crime compliance?

A. Compliance data never contains personal information

B. It governs lawful, secure and proportionate use of customer information

C. It prohibits all regulatory reporting

D. It eliminates the need for record keeping

Correct Answer: B. It governs lawful, secure and proportionate use of customer information