FATF Recommendation 1 Board Approval: Three Questions to Ask

FATF Recommendation 1 board approval is often treated as a formality. A risk assessment arrives in the board pack, management confirms it follows the standard, and the program is approved. The harder question is whether the assessment actually contains the scenarios that matter most to your institution. This article gives directors and chief executives three components to challenge and a scenario-testing method to run before the program goes live.

Recommendation 1 of the Financial Action Task Force (FATF) expects institutions and countries to identify, assess and understand their money laundering and terrorist financing risks, and to apply controls in proportion to those risks. In the Kingdom, SAMA sets the expectations for banks, fintechs and money-services businesses it supervises. An assessment that looks complete on paper but does not reflect how your customers really behave will not stand up in a mutual evaluation or a supervisory review.

Why boards approve what they have not tested

Risk assessments are long, technical and usually presented as finished work. Directors are asked to approve a conclusion, not to examine the reasoning behind it. Three habits follow from that:

• Approval is given on the strength of the document's structure rather than its content.
• High-risk scenarios are assumed to be covered because the headings mention them.
• Residual risk is accepted as a rating without anyone asking who decided it was acceptable.

None of this requires technical expertise to correct. It requires the right questions.

Challenge 1: Inherent risk factors

Inherent risk is the exposure your institution carries before any control is applied. It is usually built from customer types, products, delivery channels and geographies.

Ask management:

1. Which customer segments, products, channels and countries were scored, and who supplied the data?
2. Does the data come from actual customer and transaction records, or from generic templates?
3. Which risks were considered and then removed, and why?
4. When was each factor last updated, and what would trigger an earlier update?

How to read the answers: a sound assessment can name specific segments in your portfolio and explain why each was rated as it was. If the answers sound like the standard list of risk factors with no reference to your own book of business, the assessment describes the industry, not your institution.

Challenge 2: Control effectiveness

Controls reduce inherent risk only if they work. Many assessments record that a control exists and treat existence as effectiveness.

Ask management:

1. How was each control's effectiveness tested, and by whom?
2. Was the testing independent of the team that runs the control?
3. What evidence supports the rating: sample testing, data quality checks, quality assurance results?
4. Where controls were rated weak, what is the funded remediation plan and its owner?

How to read the answers: look for a difference between "the control is in place" and "the control was tested and performed as intended." Transaction monitoring and name screening are common examples. A rule can exist and still miss the behavior it was written to catch because of poor data or badly set thresholds. Independent validation of monitoring scenarios and screening tools, including their coverage of the risk assessment, is one way to produce that evidence.

Challenge 3: Residual risk tolerance

Residual risk is what remains after controls are applied. The board's job is to decide whether it is acceptable. That decision belongs to directors, not to the compliance function alone.

Ask management:

1. What residual risk level has the board been asked to accept, and for which segments?
2. Is there a written risk appetite statement that defines what is tolerable?
3. What happens when residual risk in a segment exceeds that tolerance: who is informed, and what is the deadline to act?
4. Are any high residual ratings being accepted because remediation is unfunded?

How to read the answers: a tolerance that has never been exceeded is either very well managed or not meaningful. Ask to see a case where the tolerance triggered action. If none exists, the threshold may be set too loosely to guide decisions.

The scenario-testing method

The three challenges test the logic of the assessment. Scenario testing checks whether it reaches the places where risk is most likely to sit. It can be run in a single working session with the head of compliance, the business lines and the risk function.

1. Choose the scenarios. Write three short, realistic cases: a correspondent banking relationship with a respondent in a higher-risk jurisdiction; a cash-intensive business such as a retailer or trader depositing large volumes; and a relationship involving a politically exposed person (PEP) or a close associate.
2. Trace each case through the assessment. For each scenario, ask where it appears as an inherent risk factor, what score it received, and which data informed the score.
3. Trace it through the controls. Identify the due diligence step, the monitoring scenario and the screening check that would apply, and who owns each.
4. Look for the break. Note any point where the case has no matching factor, no control, no owner or no evidence of testing.
5. Record and rank the gaps. Each gap should have an owner, a deadline and a funding decision before the program is approved.

A useful discipline is to ask the business lines, not only compliance, to describe the scenarios. People who serve these customers every day often know of patterns the methodology has never captured.

What to fund and what to measure

Gaps found through scenario testing usually point to a small set of investments: better customer and transaction data, independent testing of controls, and people who understand the risks they are expected to detect. Boards can track progress with a few measures:

• Number of high-risk scenarios traced end to end, and how many showed gaps.
• Gaps closed against the agreed deadline.
• Controls independently tested in the last cycle, as a share of those rated effective.
• Instances where residual risk exceeded tolerance and the time taken to respond.

Ask for these figures at each board meeting rather than once a year.

Directors need to understand the risks too

A board cannot challenge what it does not understand. Directors who have never seen how a correspondent banking exposure or a PEP relationship turns into a real case will struggle to judge whether the assessment captures it. Front-line and operations staff face the same issue from the other side: if they cannot recognize the red flags, the data feeding the assessment is weaker than it appears.

Next step

Financial Crime Awareness Training is role-based AML/CTF, sanctions and fraud training for the board, front line, operations and compliance teams, with completion evidence for regulators. It includes a board and senior management briefing, and front-line red flags and case studies. Sessions run in person or virtually with assessments, and each audience takes one to three days. The training materials are provided in Arabic and English, together with attendance and assessment records and an annual training plan. If your board is preparing to approve an AML program, a briefing built around your own scenarios is a practical place to begin.