Designing an RMCP That Works in the Real World

Section 42 of the Financial Intelligence Centre Act requires every accountable institution to develop, document, maintain and implement a Risk Management and Compliance Programme. The word that matters is implement. The administrative sanctions the Centre and the supervisory bodies have published share one finding above all others: an RMCP that existed on paper and described a business that did not exist. This article is about designing an RMCP that the people in the business can actually run.

Start from the risk assessment, not the template

An RMCP is the output of a business risk assessment, not the input. Before a word of the programme is written, the institution assesses its inherent money laundering, terrorist financing and proliferation financing risk across four factors:

• Clients: natural persons, legal persons, trusts, non-residents, prominent influential persons, cash-intensive businesses.
• Products and services: which can move value, obscure ownership or be used to layer funds.
• Delivery channels: face to face, intermediated, fully remote.
• Geography: where clients, funds and counterparties are located, with reference to the FATF lists and the Centre's guidance.

Each factor is rated and the overall inherent risk recorded. The RMCP then sets controls proportionate to that risk. A small practice with local clients and no cash has a different programme from a dealer in high-value goods, and it should look different.

Client risk scoring that a front-line employee can apply

The client risk rating drives everything that follows: the level of due diligence, the approval required and the monitoring frequency. A scoring model works in practice when it has:

• a small number of factors, each with a clear answer (client type, residence, PIP status, product, channel, expected activity);
• hard rules that override the score: a sanctions match is prohibited; a foreign prominent public official is high risk; a client who refuses to provide information is a reporting consideration;
• three or four risk bands with the actions for each written on one page;
• a record of the score and its reasons on the client file.

The Centre's Guidance Note 7 sets out the approach to customer due diligence and the circumstances that call for enhanced measures. RCC's KYC Vault applies these rules in the sequence the guidance prescribes, so the rating and its reasons are recorded automatically.

Due diligence levels that match the band

The RMCP states, for each band, what is collected and verified: identity, address where required, beneficial ownership for legal persons and trusts, source of funds and source of wealth for high-risk clients, and the senior management approval that enhanced due diligence requires. It also says what happens when a client cannot be verified: the relationship is not established, the transaction is not concluded, and a report is considered.

Monitoring that fits the volume of the business

Transaction monitoring is scaled to what the institution actually sees. For most non-bank accountable institutions the monitoring rules are few and specific: cash at or above the threshold, payments from third parties, activity inconsistent with the stated purpose, structuring below thresholds, unusual urgency. The RMCP names the rules, who reviews the alerts and within what time, and how an alert becomes a section 29 report or is closed with reasons.

Escalation and reporting with names, not titles

An RMCP that says "the compliance function will consider" fails under inspection because no one can show who did. The programme names the compliance officer appointed under section 42A, the alternate, the senior managers who approve high-risk relationships, and the person who files reports on goAML. Each report type has a time limit: fifteen business days for suspicious and unusual transactions, the prescribed period for cash threshold reports, immediate for terrorist property. Those limits are written into the programme and tested.

The programme's own maintenance

Section 42 requires the RMCP to be reviewed. Set the cycle (annually, and on any change in products, clients, channels or law), minute the review and keep the superseded versions. Train the employees on the programme under section 43 and keep the attendance records. Test the programme in monitoring: sample client files against the due diligence rules, check that alerts were closed within the time limit, confirm that the registers on goAML are current.

Signs the RMCP is working

An inspector can tell within an hour. The compliance officer can explain the risk assessment without reading it. A front-line employee can say what they collect from a trust client and why. The client files have risk ratings with reasons. The reports register has entries. The training register has dates. None of that comes from a document. It comes from a programme designed for the business that has to run it, which is what RCC's FICA implementation service sets out to build.