FRM Part II · FRM Exam Part II · Sound Management of Risks Related to Money Laundering and Financing of Terrorism

A bank's business line staff argue that they should own customer acceptance decisions without compliance involvement, since they know the clients best. Under the three lines of defence model described in the Basel ML/FT guidelines, which allocation is most appropriate?

Business units are the first line, owning and managing ML/FT risk day to day; the AML compliance function is the second line providing oversight; internal audit is the independent third line testing both. Merging lines or making audit the first line would remove the intended separation.

1. ABusiness units own and manage ML/FT risk as the first line; the chief AML compliance officer and compliance function form the second line; internal audit independently tests as the third lineCorrect
2. BInternal audit is the first line because it detects the most weaknesses
3. CCompliance is the first line and business units are only responsible for sales
4. DBusiness units and compliance share one combined line, so no independent audit is needed