This is a common, fundamental misunderstanding of the dynamic and integral nature of Anti-Money Laundering and Office of Foreign Assets Control (OFAC) programs required by U.S. and global regulators. This outdated view of compliance is likely to result in inadequate training, monitoring, budget, staffing and observance – a recipe for disaster for all but perhaps the smallest financial institutions. 

Integrating AML and OFAC compliance into the organization's ecosystem is a critical, albeit daunting challenge.

A written AML compliance program does not achieve the creation of a dynamic risk profile for the lines of businesses, individually and severally, of the enterprise as a whole. That only comes with an Enterprise Risk Assessment (ERA).

The risk assessment is a critical tool for the board and executive management to understand the institution's risk profile, determine appropriate risk management processes and build and implement a robust growth strategy. The ERA provides an incomparable view into the strengths and weaknesses of the program, and is a critical component of the enterprises' overall risk management framework.

The assessment is used by examiners to scope and plan their AML and OFAC examinations. If an assessment appears not to be adequate for the size and complexity of the financial institution, the examiner is likely to assume that the compliance programs will not be commensurate with the institution's risk profile. Further, if an ERA is not in place, or appears inadequate on its face, the examiner is required by the FFIEC to to complete a risk assessment for the examination.

Often, the purpose and value of a "risk-based risk assessment" to the enterprise is misunderstood.

Risk assessments are important management tools and must be designed to conform to each institution's particular risk appetite, culture and overall operating framework. ERAs are intended to be bank-specific and bank-driven.

Regulators and examiners do not predetermine what risk factors should be weighed more heavily than others. But they expect to see that the financial institution has made that determination in a risk assessment.

If a financial institution's ERA identifies a series of risks but fails to grade the risks (which can be as simple a step as characterizing risks as "high," "medium" and "low"), there is no assurance that the highest risks will be the focus of appropriate management actions.

An ERA that is not risk-based demonstrates an inadequacy in an institution's risk management programs.  

ERAs should also be dynamic, updated periodically to reflect significant changes in an institution's risk profile. Events such as adding or deleting a line of business, mergers, acquisitions and geographic expansion should prompt an ERA update.   

While not every institution is large and complex enough to merit a dedicated compliance officer and staff, there must be adequate compliance authority, support and visibility to ensure proper functioning of the compliance program and delivery of meaningful reports to the board of directors. 

The board of directors, executive management and line-of-business senior managers share accountability for AML and OFAC compliance. But in most cases, a compliance officer is needed to monitor and manage the programs on a day-to-day basis. Compliance with these regulations is an integral part of a financial institution's daily operations. Potential infractions must be identified, dealt with and documented in real time.

An enterprise-wide organizational framework in support of compliance with assigned roles and responsibilities is important to achieving a meaningful and useful Enterprise Risk Assessment. 

Sophisticated monitoring and alert systems can lead to a false sense that strong risks are being contained.

Such tools are valuable in support of compliance but do not take the place of human risk management. Over-reliance on such systems can skew risk assessment data and result in a lower risk profile than actually exists.

As a result, its exposure to new risks that arise before the next ERA review are not documented, risk-rated or managed.The ERA is a critical risk management tool, not simply a process used by a financial institution to satisfy an examiner.   

A healthy, proactive compliance program relies on a dynamic risk assessment process. That means risk assessment is not just done annually. Events such as adding or dropping a line of business, launching new offerings and products, extending the geographic base or targeting a new class of customer can significantly change the financial institution's risk profile. The ERA should be modified to reflect such events when they occur.

An institution's recognition of, and attention to new risk exposures is a Best Practice. It demonstrates a commitment to risk management and at the same time earns the institution the respect of regulators.

Financial institutions often believe they can satisfy compliance requirements simply by having a written program in place, leaving it to examiners to identify problems and violations.

This reactive posture typically results in a remediation process that is more complex and costly than necessary and exposes the institution, senior management and board members to serious enforcement penalties, both civil and criminal. Insufficient attention to compliance fosters a breeding ground for offenses that can become significant. Failure to observe adequate risk management encourages stronger enforcement penalties.

It is preferable to design and implement a proactive and engaged compliance strategy rather to having one imposed by regulators under threat of a cease and desist order.

When this is the case, typically there are no merit incentives in place to encourage observance of AML and OFAC requirements, policies and procedures (assuming such standards, policies and procedures are even documented and disseminated).  Instead, products, services and behaviors that generate profit, but might violate the regulations, are richly rewarded. 

Whatever additional profit may be gained by pursuing products and services that might violate regulations can be quickly erased by enforcement penalties and the cost of remediation.

The  benefits of compliance should also be recognized and leveraged to help justify the needed investment of budget and attention and to enhance shareholder value.