The deadline for the consultation on the draft technical standards for AMLA’s central anti-money laundering and counter-terrorist financing database was 3 November. These are draft standards, rather than final rules. AMLA expressly states that the proposed rules impose no direct obligations on private-sector entities.
The database is intended to support information exchange between supervisors and risk-based supervision. Access would be confidential and limited to information necessary for the authorities’ tasks. AMLA consultation.
Completing an action and remedying a deficiency are different things
For example, a firm may respond to a finding about inadequate transaction monitoring by approving a new procedure. This proves that a document was adopted. Assessing whether the control actually works also requires evidence of how the new rules were implemented and what results they produced.
We recommend keeping the following information for each deficiency:
- The finding. What problem was identified and which processes were affected?
- The remedial measure. What changed, who was responsible and when was the change implemented?
- Evidence of effectiveness. Which checks, samples or system records demonstrate the results?
- The final assessment. Who assessed whether the measure was sufficient and which issues remain unresolved?
If a firm disagrees with a finding, it should distinguish the disputed conclusion, the status of the dispute and the measures nevertheless taken to reduce risk. Challenging a finding does not itself prove remediation; implementing a remedial measure should likewise not leave the records unnecessarily ambiguous.
Information provided to the management board and the supervisor should describe the same actual position. A “completed” status is useful only when the underlying evidence can be located and verified.