FRM Exam Part II · Sound Management of Risks Related to Money Laundering and Financing of Terrorism

Group-wide AML Implementation, Information Sharing and Supervision

Updated 11 October 2026 · Fact-checked

Under the Basel Committee guidelines, a banking group must apply one consistent ML/FT policy across all branches and subsidiaries, using the stricter of home and host rules. The group shares customer and risk information across borders for risk management, keeps records, and answers to supervisors who inspect, cooperate and sanction.

Understand Group-wide Implementation, Information Sharing and Supervision

Money laundering and terrorist financing (ML/FT) do not stop at borders. A criminal who is refused at one branch will try another. So the Basel Committee guidelines on sound management of ML/FT risks expect a banking group to manage the risk as one group, not as a set of separate local units.

The core idea is group-wide implementation. The parent bank sets a group ML/FT policy and procedures. Every branch and subsidiary, at home and abroad, applies them. Where home and host country rules differ, the branch or subsidiary applies the higher standard to the extent host law permits. If host law blocks the home standard, the group must tell its home supervisor and take extra steps to manage the risk. These can include added controls or, in the end, closing the operation.

Information sharing makes this work. The group needs a group-wide view of customers and their risk. Group compliance, audit and AML functions should be able to get customer, account and transaction information from branches and subsidiaries when needed for ML/FT risk management. Branches should also receive information from the group when it is relevant to them. Safeguards on confidentiality and use of the information must be in place. Secrecy or data-protection laws can limit sharing, and this is a key issue to know.

Record keeping supports investigations. Banks keep customer identification and due diligence records and transaction records so that individual transactions can be reconstructed and authorities can get them quickly. FATF standards set a minimum retention period of at least five years, counted after the end of the business relationship for customer records and after the transaction for transaction records.

Supervisors check that banks meet these expectations. They assess risk assessments, governance, controls and group-wide implementation. They cooperate with foreign supervisors and with the financial intelligence unit and law enforcement. They can apply proportionate and dissuasive sanctions. The FATF Recommendations are the international standard that national laws and Basel guidance rest on.

Key formulas to remember

Group-wide standard rule: Standard applied abroad = stricter of (home standard, host standard), to the extent host law allows; If host law prevents the home standard, tell the home supervisor and add controls.
Record retention minimum (FATF): Retention ≥ 5 years after end of relationship (CDD records) or after transaction (transaction records); Local law may require longer. The five years is a minimum, not a maximum.
Information flow principle: Group functions ⇄ branches and subsidiaries: customer, account and transaction data for ML/FT risk management; Subject to confidentiality and data-use safeguards.
Supervisory toolkit: Assess → Cooperate → Sanction (proportionate and dissuasive); Sanctions can target the institution and, in some cases, directors and senior management.

How to solve Group-wide Implementation, Information Sharing and Supervision questions

Most questions give a short case about a bank group, a host-country rule or a supervisory finding. Use the same sequence each time.

1Identify who is acting: parent bank, branch, subsidiary, home supervisor or host supervisor.
2Name the issue: policy consistency, information sharing, record keeping, or supervision and enforcement.
3Recall the Basel or FATF principle that applies, such as the stricter standard or the five-year minimum.
4Check for a legal conflict, such as secrecy or data-protection law, and recall the required response: inform the home supervisor and add controls.
5Check who needs the information, such as group compliance or audit, and whether safeguards exist.
6Eliminate options that weaken the standard, such as applying only local rules or delegating responsibility away from the group.
7Pick the option that keeps group-wide control and escalates unresolved conflicts.

Quickest way: Stricter-standard and escalation check

When to use it: Use when the question describes a mismatch between home and host rules, or a block on sharing data.

Ask: can the group standard be applied locally?
If yes, apply the stricter rule.
If no, the answer almost always includes informing the home supervisor and adding mitigating controls.
For retention questions, pick at least five years from the correct start point.
Reject options that say local management alone decides.

Common mistakes in Group-wide Implementation, Information Sharing and Supervision

Applying the host-country standard when it is weaker than the group standard.
Students assume local law always overrides group policy.
Fix: Remember the group applies the stricter standard where host law permits.
Saying a bank can ignore group-wide sharing because of secrecy laws.
Confusing a legal limit with a release from duty.
Fix: The bank must inform its home supervisor and apply additional measures to manage the risk.
Counting the five-year retention from the wrong date.
Customer records and transaction records have different start points.
Fix: CDD records run from the end of the relationship; transaction records from the transaction.
Treating five years as a maximum.
Misreading a minimum as a limit.
Fix: It is a floor. National law may require longer.
Thinking supervisors only act after a violation.
Focusing on enforcement and forgetting ongoing oversight.
Fix: Supervision includes risk assessment, inspections and cooperation, not only sanctions.

Worked examples

Example 1

A European bank has a subsidiary in a country whose rules require less customer due diligence than the group policy. Host law does not prohibit the stricter group procedures. Which standard should the subsidiary apply?

Show the solution

The parent group sets one ML/FT policy for all units.
Home and host standards differ, with the group standard stricter.
Host law does not block the stricter standard.
So the subsidiary applies the stricter group standard.

Answer: The subsidiary applies the stricter group standard, not the weaker local minimum.

Example 2

A bank's branch abroad cannot share customer data with group compliance because host law forbids it. What should the group do?

Show the solution

Sharing for ML/FT risk management is expected, but host law blocks it.
The conflict cannot be ignored or hidden.
The group informs its home supervisor of the limitation.
It adds mitigating controls and, if the risk cannot be managed, considers closing the operation.

Answer: Inform the home supervisor and apply additional measures to manage the ML/FT risk, up to closing the operation if needed.

Exam tips

Questions are usually conceptual; learn the principle and the escalation step, not numbers.
The only number to know firmly is the five-year minimum retention under FATF.
Watch the words 'stricter', 'host law permits' and 'inform the home supervisor'.
Link this topic to correspondent banking and customer due diligence, which often appear in the same case.
Wrong options often delegate group duties to local management or cut information flows.

Practice questions from Sound Management of Risks Related to Money Laundering and Financing of Terrorism

Group-wide Implementation, Information Sharing and Supervision: frequently asked questions

What does group-wide implementation of AML mean?

It means the parent bank sets one ML/FT policy and every branch and subsidiary applies it. Where rules differ, the stricter standard applies as far as host law allows.

How long must banks keep AML records?

FATF standards set a minimum of at least five years. It runs from the end of the business relationship for due diligence records and from the transaction for transaction records. Local law can require longer.

What is the role of supervisors in ML/FT risk?

Supervisors assess whether banks identify and manage ML/FT risk, including at group level. They cooperate with other supervisors and authorities and can apply proportionate and dissuasive sanctions.

How do FATF Recommendations relate to Basel guidelines?

FATF sets the international AML/CFT standards that countries put into law. The Basel Committee guidelines show how banks should apply them within sound risk management.