Governance, Ethics, Compliance and Financial Crime

Introduction and context

Banking is built on confidence. Depositors, investors, borrowers, payment users, regulators and the wider economy depend on banks to safeguard assets, allocate capital, process transactions and manage risk. That confidence can be destroyed by weak governance, misconduct, regulatory breaches or financial crime. The resulting losses are not limited to fines. They may include liquidity pressure, litigation, loss of market access, criminal liability, reputational damage and systemic instability.

Governance, ethics and compliance are therefore not administrative functions operating at the edge of banking. They are part of the business model. A bank’s board determines its risk appetite and oversight arrangements; senior management converts that appetite into processes and incentives; control functions challenge decisions; and employees make daily judgements that determine whether rules are followed in practice.

This chapter examines the architecture through which a bank is directed, controlled and held accountable. It focuses on board and senior-management responsibilities, the three-lines model, internal control and audit, conduct and fiduciary duties, ethical dilemmas, and the prevention of money laundering, terrorist financing, sanctions violations and fraud.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship between corporate governance, risk management, ethics and compliance.
2. Evaluate the responsibilities of boards, senior management and control functions.
3. Apply the three-lines model to banking activities.
4. Distinguish internal control, compliance monitoring, internal audit and external audit.
5. Analyse conduct risk, fiduciary duties and ethical dilemmas.
6. Describe risk-based KYC and AML controls, sanctions compliance and fraud prevention.
7. Assess how technology, data and artificial intelligence improve—and may weaken—financial-crime controls.

1. Governance as the allocation of authority and accountability

Corporate governance is the system by which an organisation is directed, controlled and held accountable. In banking, governance must reconcile several interests: safety and soundness, shareholder returns, customer protection, legal compliance, financial inclusion and financial stability.

A sound governance system answers five questions:

• Who has authority to make a decision?
• What information must the decision-maker receive?
• What risks are acceptable?
• Who challenges or reviews the decision?
• What happens when performance or conduct falls below standard?

The board is ultimately responsible for the institution’s direction and oversight, although it cannot perform management’s operational role. Its responsibilities commonly include approving strategy, risk appetite, capital and liquidity planning, remuneration principles, succession arrangements and major policies. It should ensure that senior management is competent, that material risks are identified and that control functions have sufficient independence, resources and access to the board.

The chair leads the board and should promote constructive challenge. The chief executive officer is responsible for managing the bank within the authority delegated by the board. The chief risk officer, chief compliance officer and chief internal auditor have specialised responsibilities, but their existence does not transfer accountability away from the board or executive management.

A board is not effective merely because it meets frequently. Effectiveness depends on the quality of information, independence of judgement, relevant expertise, diversity of perspectives and willingness to question optimistic assumptions. A board that receives large volumes of dashboards but does not understand the underlying risks may possess information without exercising oversight.

Risk appetite and governance

Risk appetite is the level and types of risk a bank is willing to accept in pursuit of its objectives. It should be translated into measurable limits, escalation thresholds and delegated authorities. For example, a bank may set limits for credit concentration, market risk, liquidity outflows, operational losses, complaints, overdue remediation and high-risk customers.

Risk appetite is not a guarantee that losses will never occur. It is a disciplined statement of acceptable exposure and the actions required when exposure approaches or exceeds a limit. Effective governance links risk appetite to strategy, budgeting, product approval, remuneration and capital planning.

2. The three-lines model

The three-lines model clarifies responsibilities for managing risk. It is a framework for accountability, not a substitute for judgement or a rigid organisational chart.

The first line identifies and manages risks in daily activity. A lending officer is responsible for obtaining accurate customer information, following credit policy and escalating exceptions. A trading desk is responsible for operating within approved mandates and recording transactions correctly. First-line ownership cannot be outsourced to the compliance department.

The second line establishes frameworks, advises the business, monitors adherence and challenges risk-taking. Compliance may test customer-onboarding files, interpret regulatory requirements and escalate deficiencies. Risk management may assess credit models, stress testing and limit utilisation. The second line should be sufficiently independent from revenue generation, while remaining close enough to understand the business.

The third line, internal audit, provides independent and objective assurance on governance, risk management and controls. It should determine whether processes are designed appropriately and operate effectively. Internal audit does not own controls; doing so would compromise later assurance.

The board and executive management sit above the three lines as governing and accountable bodies. External audit, regulators and supervisors are outside the model but provide additional assurance or oversight. The model is often weakened by unclear ownership, duplicated testing, inadequate issue remediation or a culture in which business targets override control obligations.

3. Internal control, audit and accountability

Internal control is the set of policies, procedures, behaviours, systems and organisational arrangements designed to provide reasonable—not absolute—assurance that objectives will be achieved. Common objectives are effective operations, reliable reporting, protection of assets and compliance with laws and policies.

A useful control structure includes:

1. Control environment: integrity, competence, accountability, organisational structure and tone from the top.
2. Risk assessment: identification and evaluation of events that could prevent objectives being achieved.
3. Control activities: approvals, reconciliations, segregation of duties, access restrictions, limits and exception controls.
4. Information and communication: timely, accurate information reaching people who need it.
5. Monitoring: ongoing supervision and independent evaluations of whether controls remain effective.

Preventive controls operate before an error or misconduct occurs. Examples include maker-checker approval and system restrictions on unauthorised payments. Detective controls identify events after they occur, such as reconciliations, surveillance alerts and post-transaction reviews. Corrective controls address the cause and consequences, including recovery, disciplinary action and redesign of a process.

Segregation of duties reduces the risk that one person can initiate, approve, execute and conceal a transaction. Where staffing makes complete segregation impractical, compensating controls—such as independent review, restricted access and enhanced monitoring—are necessary.

Internal audit uses a risk-based audit plan. It evaluates the significance of risks, the quality of controls and the effectiveness of remediation. An audit finding should identify the condition, the applicable criterion, the cause, the consequence and an agreed corrective action with an accountable owner and due date. Repeated overdue findings are themselves evidence of governance weakness.

External audit primarily provides an opinion on specified financial statements or other assurance subject matter. It is not management, the regulator or the internal audit function. Confusing these roles can create an expectation gap and weaken accountability.

4. Conduct risk, fiduciary duties and ethical judgement

Conduct risk is the risk that an institution or its employees cause unfair outcomes for customers, markets or other stakeholders, or undermine market integrity. It includes mis-selling, manipulation, misleading disclosure, inappropriate incentives, conflicts of interest, poor complaints handling and misuse of confidential information.

A compliance breach may be technically identifiable, but ethical failure often begins before a rule is clearly broken. Ethical banking asks whether a decision is honest, fair, transparent, proportionate and consistent with the institution’s responsibilities.

Directors and senior officers commonly owe duties of care, loyalty, good faith and proper purpose, subject to the applicable legal system. They should act on an informed basis, manage conflicts, protect confidential information and avoid placing personal interests above those of the institution and its stakeholders. Fiduciary duties do not require directors to eliminate all risk; they require responsible decision-making within lawful authority and with appropriate care.

A conflict of interest occurs when personal, family, financial or organisational interests could influence professional judgement. Controls include declarations, recusals, independent approval, information barriers and records of decisions. A conflict may exist even when no improper act has yet occurred.

A practical ethical decision framework

When confronted with a difficult decision, a professional should:

1. Identify the stakeholders and the actual decision.
2. Determine the relevant law, regulation, policy and fiduciary duty.
3. Identify conflicts, incentives and information gaps.
4. Consider customer harm, market impact, fairness and long-term consequences.
5. Generate alternatives, including escalation or refusal.
6. Document the reasoning and seek independent advice where necessary.
7. Reassess the decision after new facts emerge.

A useful test is whether the decision could be explained honestly to a customer, regulator, board and informed public. This is not a substitute for legal analysis, but it is a valuable safeguard against narrow rule-based thinking.

5. KYC and customer due diligence

Know Your Customer (KYC) is the process through which a bank identifies and understands a customer and the expected nature of the relationship. Customer due diligence (CDD) supports risk-based decisions about onboarding, monitoring and exit.

Core CDD components generally include:

• identifying and verifying the customer;
• identifying beneficial owners and persons exercising control;
• understanding the purpose and intended nature of the relationship;
• assessing geographic, product, customer and delivery-channel risks;
• establishing expected transaction activity; and
• conducting continuing monitoring and periodic review.

Beneficial ownership is especially important for companies, trusts and layered structures. The person whose name appears on an account may not be the person who ultimately owns or controls the assets. A bank should not treat complex ownership as proof of criminality, but unexplained complexity, secrecy, inconsistent information and high-risk jurisdictions warrant enhanced scrutiny.

Enhanced due diligence (EDD) may include additional source-of-wealth and source-of-funds evidence, senior approval, more frequent review and closer transaction monitoring. Politically exposed persons (PEPs) require risk-sensitive controls because their public positions can create heightened bribery and corruption exposure; PEP status is not proof of wrongdoing.

KYC must be refreshed when there is a material change, suspicious activity, expired identification, ownership change or significant inconsistency in expected behaviour. Poor data quality makes both onboarding and monitoring unreliable.

6. AML and counter-terrorist financing

Money laundering is commonly described as the process of disguising proceeds of crime so that they appear legitimate. A conventional analytical model identifies three overlapping stages:

1. Placement: introducing illicit proceeds into the financial system.
2. Layering: moving funds through transactions or structures to obscure origin.
3. Integration: making funds appear to arise from legitimate wealth or business activity.

Terrorist financing may involve legally or illegally obtained funds and may concern the intended use of money rather than its origin. Consequently, AML and counter-terrorist-financing controls must examine both source and purpose.

A risk-based AML programme includes governance, enterprise risk assessment, CDD, transaction monitoring, investigation, suspicious transaction reporting, record retention, training, independent testing and enforcement of consequences. A transaction-monitoring alert is not a finding of criminal conduct. It is an indication requiring investigation according to documented procedures.

The quality of an AML programme should be assessed by more than the number of alerts or reports. Relevant questions include whether scenarios reflect actual risks, whether thresholds are periodically validated, whether investigators have sufficient context, whether backlogs are controlled, whether suspicious-activity decisions are documented and whether lessons feed back into customer risk ratings.

Banks must respect legal requirements concerning confidentiality and tipping-off. Staff should not disclose to a customer that a suspicious transaction report has been or may be filed where such disclosure is prohibited.

7. Sanctions compliance

Sanctions are legal restrictions imposed by governments or international bodies on countries, entities, sectors, vessels or individuals. They may prohibit dealings, freeze assets, restrict services or limit exports and financing. Sanctions regimes differ by jurisdiction, so a bank operating internationally must understand which laws apply to its activities, locations, customers, currencies and payment routes.

Sanctions controls typically include screening customers, beneficial owners, counterparties, payment messages and relevant vessels or goods; maintaining current lists; investigating potential matches; applying escalation and blocking procedures; and documenting decisions. Screening systems generate false positives because names can match legitimate customers. Poorly tuned systems create either excessive operational cost or dangerous false negatives.

A potential match should be resolved using identifiers such as date of birth, address, nationality, registration number and ownership information. A bank should never dismiss an alert solely because the name is common or because a business relationship is commercially important.

8. Fraud prevention and response

Fraud involves intentional deception or abuse of position for unlawful gain. Banking fraud may be internal or external and may include account takeover, payment diversion, card fraud, identity theft, loan fraud, procurement fraud, insider dealing and manipulation of records.

Fraud risk is often analysed through the fraud triangle: pressure or incentive, opportunity and rationalisation. Controls should therefore address both access and culture. Important measures include strong authentication, least-privilege access, transaction limits, segregation of duties, independent callbacks for payment changes, anomaly detection, staff rotation, whistleblowing channels and timely investigation.

A sound response process preserves evidence, contains loss, protects customers, assesses reporting obligations, investigates independently and addresses root causes. Management should avoid prematurely labelling an employee or customer as fraudulent. Fair investigation protects both the institution and the person accused.

9. Technology, data and artificial intelligence

Technology can improve financial-crime controls through network analysis, behavioural analytics, biometric verification, continuous screening and automated case management. Machine-learning models may identify relationships and patterns that rule-based systems miss.

However, technology creates risks. Poor data lineage, biased training data, opaque models, excessive automation, cyber compromise and model drift can produce unfair or unreliable outcomes. A model should be subject to documented purpose, validation, performance monitoring, explainability appropriate to the use, access controls, human review and change governance. Artificial intelligence should support—not replace—accountable judgement, especially when a decision may restrict a customer’s access to financial services.

Data minimisation, retention, privacy and cross-border transfer obligations must be reconciled with AML recordkeeping requirements. The relevant question is not whether a system is sophisticated, but whether it produces reliable, explainable and legally defensible decisions.

10. Illustrative case: correspondent banking and hidden ownership

Background

A fictional regional bank, Meridian Bank, provides correspondent services to a foreign commercial bank. A corporate customer of the respondent bank begins sending frequent payments through Meridian to commodity traders and newly formed companies. The payments are inconsistent with the customer’s stated business profile.

Problem

The customer’s direct owner is a holding company in a secrecy-sensitive jurisdiction. Several intermediary companies have similar directors, and one payment counterparty appears to resemble a sanctioned entity. The relationship manager argues that the customer is commercially valuable and that the respondent bank has already completed KYC.

Analysis

Meridian’s first-line business must identify the unusual activity and escalate it; it cannot rely blindly on the respondent bank. The second line should reassess customer and correspondent risk, establish beneficial ownership and source of funds, examine transaction purpose, resolve the sanctions alert and review relevant payment data. Internal audit should later test whether the framework operated effectively, but it should not conduct the investigation as management’s substitute.

The bank should consider enhanced due diligence, temporary restrictions where legally permitted, independent approval and a suspicious-activity determination. It should also assess whether the respondent bank’s controls are adequate. Commercial value is not a valid reason to suppress escalation.

Approach and outcome

Meridian obtains corporate records, identifies the ultimate controlling person, requests contracts and invoices, and conducts adverse-information checks. The sanctions resemblance is resolved as a false positive, but the transaction pattern cannot be explained and the respondent bank cannot provide reliable beneficial-ownership evidence. Meridian files the appropriate report where required, exits the relationship under documented policy and improves correspondent onboarding and transaction-monitoring scenarios.

Learning points

The case demonstrates that KYC is continuous, not a one-time form; correspondent relationships require oversight; sanctions screening requires investigation rather than automatic conclusions; and the three lines must preserve distinct responsibilities. It also illustrates how sales pressure can create conduct and financial-crime risk simultaneously.

11. Challenges and contemporary developments

Financial crime is increasingly cross-border, digital and networked. Instant payments reduce the time available for intervention. Criminals exploit synthetic identities, mule accounts, digital assets, professional intermediaries and social engineering. At the same time, banks face regulatory fragmentation, high alert volumes, privacy constraints and shortages of skilled investigators.

Effective programmes therefore require proportionality and continuous improvement. Institutions should share information lawfully, use typologies and intelligence rather than static checklists, measure outcomes, and test whether controls work for vulnerable customers as well as sophisticated clients. Boards should receive concise reporting on significant risks, emerging typologies, overdue remediation, customer harm and the quality—not merely the quantity—of alerts and reports.

Best practice includes a clear risk appetite; independent and empowered control functions; accurate customer data; documented decision rights; protected whistleblowing; fair remuneration; regular scenario testing; root-cause analysis; strong third-party oversight; and a culture in which raising concerns is rewarded rather than penalised.

Chapter Summary

Banking governance allocates authority, establishes accountability and protects confidence in the financial system. Boards set strategy, risk appetite and oversight expectations, while senior management executes strategy and maintains effective controls. The three-lines model assigns risk ownership to the business, monitoring and challenge to specialised control functions, and independent assurance to internal audit.

Internal controls provide reasonable assurance through a sound control environment, risk assessment, control activities, information and monitoring. Conduct risk and fiduciary duties require institutions to consider fairness, conflicts, customer outcomes and long-term consequences rather than relying solely on technical rule compliance.

KYC and CDD identify customers, beneficial owners, purpose and expected activity. AML and counter-terrorist-financing programmes use risk-based monitoring, investigation and reporting. Sanctions compliance requires accurate screening, careful alert resolution and jurisdictional awareness. Fraud prevention combines access controls, segregation, analytics, culture and fair investigation. Technology and AI can strengthen these processes, but require data governance, validation, explainability and human accountability.

Key Terms

Governance: The system for directing, controlling and holding an organisation accountable.

Risk appetite: The level and types of risk an institution is willing to accept.

Three-lines model: A framework distinguishing business risk ownership, control-function challenge and independent assurance.

Internal control: Policies and processes providing reasonable assurance over operations, reporting, assets and compliance.

Internal audit: An independent assurance function evaluating governance, risk management and controls.

Conduct risk: Risk of unfair customer, market or stakeholder outcomes.

Fiduciary duty: A duty to act loyally, carefully and in the proper interests of the organisation or beneficiary.

Conflict of interest: A situation in which competing interests may impair impartial judgement.

KYC: Processes for identifying and understanding customers.

Customer due diligence: Identification, verification, beneficial-ownership and relationship-risk assessment.

Beneficial owner: The natural person who ultimately owns or controls a customer or arrangement.

Enhanced due diligence: Additional scrutiny applied to higher-risk relationships.

PEP: A politically exposed person whose public position may create heightened corruption risk.

Money laundering: Disguising criminal proceeds as legitimate funds or wealth.

Placement: Introducing illicit proceeds into the financial system.

Layering: Obscuring funds’ origins through transactions or structures.

Sanctions: Legal restrictions imposed on specified persons, places, sectors or activities.

Fraud triangle: Pressure or incentive, opportunity and rationalisation as conditions associated with fraud.

Model risk: Risk of adverse consequences from incorrect or misused models.

Whistleblowing: Reporting suspected wrongdoing through protected channels.

Review Questions

5 Short Answer Questions

1. What are the principal responsibilities of a bank’s board?
2. Distinguish preventive, detective and corrective controls.
3. What is the purpose of beneficial-ownership identification?
4. Why is a sanctions alert not automatically proof of a sanctions violation?
5. Identify the three elements of the fraud triangle.

5 Long Answer Questions

1. Explain the three-lines model and evaluate how unclear responsibilities can weaken banking controls.
2. Discuss how risk appetite should influence strategy, remuneration and escalation.
3. Compare KYC, CDD and EDD, giving examples of circumstances requiring enhanced scrutiny.
4. Analyse the relationship between conduct risk, fiduciary duties and ethical decision-making.
5. Explain how a board should assess whether an AML programme is effective rather than merely active.

3 Analytical / Application Questions

1. A relationship manager wants to onboard a profitable company whose ownership structure contains several offshore entities and whose expected transactions are poorly documented. Design a proportionate decision and escalation process.
2. A machine-learning monitoring tool reduces alerts by 60% but has not been independently validated and cannot explain its decisions. Evaluate the governance, compliance and customer risks.
3. A payment is flagged as a possible sanctions match, while a senior executive pressures staff to release it immediately. Apply the three-lines model, ethical decision framework and sanctions-control principles to determine the appropriate response.

Multiple Choice Questions with Answers

Question 1

Which function primarily owns and manages risk in the three-lines model?

A. The first line, consisting of business and operational activities

B. The second line, consisting of compliance and risk functions

C. The third line, consisting of internal audit

D. The external auditor

Correct Answer: A. The first line, consisting of business and operational activities

Question 2

What is the principal purpose of a risk appetite statement?

A. To eliminate all losses

B. To define acceptable types and levels of risk and related escalation

C. To replace internal controls

D. To determine the external audit opinion

Correct Answer: B. To define acceptable types and levels of risk and related escalation

Question 3

Which activity is most directly associated with identifying the beneficial owner?

A. Calculating the bank’s liquidity ratio

B. Determining the natural person who ultimately owns or controls the customer

C. Approving employee leave

D. Setting an interest rate benchmark

Correct Answer: B. Determining the natural person who ultimately owns or controls the customer

Question 4

Which stage of money laundering involves obscuring the origin of funds through transactions?

A. Placement

B. Layering

C. Integration

D. Recovery

Correct Answer: B. Layering

Question 5

A politically exposed person should generally be treated as:

A. Automatically guilty of corruption

B. A customer who can never be accepted

C. A relationship potentially requiring risk-sensitive enhanced due diligence

D. Exempt from transaction monitoring

Correct Answer: C. A relationship potentially requiring risk-sensitive enhanced due diligence

Question 6

Which is an example of a detective control?

A. A system blocking payments above an authorised limit

B. A maker-checker approval before account opening

C. A reconciliation identifying an unauthorised transaction after processing

D. A policy describing segregation of duties

Correct Answer: C. A reconciliation identifying an unauthorised transaction after processing

Question 7

What is the central assurance role of internal audit?

A. To own business controls

B. To provide independent and objective assurance on governance, risk and controls

C. To approve every customer transaction

D. To set the bank’s commercial strategy

Correct Answer: B. To provide independent and objective assurance on governance, risk and controls

Question 8

Which combination represents the fraud triangle?

A. Capital, liquidity and solvency

B. Pressure or incentive, opportunity and rationalisation

C. Placement, layering and integration

D. Strategy, budget and dividends

Correct Answer: B. Pressure or incentive, opportunity and rationalisation

Question 9

Why can automated sanctions screening generate false positives?

A. All customers are sanctioned

B. Names and identifiers may resemble those on sanctions lists even when parties differ

C. Screening systems do not use customer data

D. Sanctions lists contain only financial information

Correct Answer: B. Names and identifiers may resemble those on sanctions lists even when parties differ

Question 10

Which principle is most appropriate when using AI for financial-crime monitoring?

A. Automation removes the need for accountability

B. A model should be used without validation if it reduces alerts

C. Models require governance, validation, monitoring and appropriate human oversight

D. Explainability is never relevant to customer-impacting decisions

Correct Answer: C. Models require governance, validation, monitoring and appropriate human oversight