Are your financial crime controls working in practice?

A recent case in the US has put financial crime controls and due diligence back in the spotlight, raising questions about how firms monitor risk, oversee third parties and respond when concerns emerge. 

While the circumstances relate to the US, UK firms shouldn’t consider the wider issues as a problem elsewhere. In practice, this means looking beyond the design of financial crime frameworks and asking whether they deliver the level of protection and oversight a firm needs. 

What does effective financial crime due diligence look like?

Good due diligence doesn’t stop once the initial checks are complete. It’s important for firms to understand who they are dealing with and the financial crime risks involved, but they also need to keep that understanding up to date. Customers and relationships can change, all whilst new risks emerge. Therefore, keeping due diligence under review, testing whether controls remain effective and making sure concerns are picked up and escalated quickly is vital. Where third parties are involved, firms also need appropriate oversight of the activities being carried out on their behalf. Treating financial crime as primarily an onboarding exercise risks missing changes that could affect the level of risk a firm is exposed to. 

How can firms tell if their financial crime controls are working?

This is where firms need to look beyond their policies and procedures. A documented process can tell you what should happen, but it doesn’t necessarily tell you what is happening. Testing and assurance can help firms understand whether controls are applied consistently, whether monitoring identifies the risks it is intended to identify and whether concerns are dealt with appropriately when they arise. 

The evidence should give senior management an overarching view of where controls are operating as intended and where gaps or inconsistencies may require attention. It should also help distinguish between an isolated issue and a wider weakness in the control environment. Where a firm lacks the internal capacity or specialist expertise to carry out this work, targeted resourcing can add capability without weakening accountability. Clear ownership and oversight is still required from the firm, but experienced financial crime specialists can help test controls, support remediation and maintain momentum during periods of heightened demand. 

Where can gaps in financial crime controls emerge?

The effectiveness of a control can change over time. For instance, due diligence information may not be revisited as customer circumstances change, monitoring may no longer reflect the risks the firm faces, or higher-risk relationships may not receive the level of scrutiny the firm expects. 

Third-party arrangements also deserve close attention. Firms need sufficient oversight to understand whether activities undertaken on their behalf are being managed appropriately and whether issues are being identified and escalated when they should be. Management information (MI) has an important role here too. It needs to give senior leaders meaningful insight into how controls are performing, rather than simply demonstrating that a process has been followed. 

Together, these areas can create a gap between the financial crime framework a firm believes it has and what is actually happening in practice. 

How should firms test their financial crime controls?

Rather than waiting for a problem to expose a weakness, firms can use testing and assurance to understand how their controls are performing. That means looking across the business and checking whether what is happening matches what policies and procedures say should happen. Firms should understand whether due diligence is being carried out consistently, whether higher-risk customers receive the expected level of scrutiny and whether monitoring continues to reflect the risks the business faces. 

It also means looking at how concerns move through the business. Identifying an issue is only useful if it reaches the right people and leads to the appropriate action. The aim isn’t testing for testing’s sake. It is to give the business a clearer and more evidence-based view of whether its financial crime framework is doing what it is supposed to do. 

The right response will depend on the nature and scale of the gap. Some firms may need independent assurance, while others may need short-term specialist support to strengthen a team, clear a backlog or deliver a defined remediation programme. Used well, flexible resourcing should add expertise and delivery capacity while keeping governance and accountability firmly within the firm. 

What should boards know about financial crime control effectiveness?

For boards, this ultimately comes down to whether there is enough evidence to be confident that the firm’s financial crime framework is working as intended. Senior leaders need more than confirmation that policies exist or checks have been completed. They need information that helps them understand how controls are operating, where weaknesses are emerging and whether action is being taken where necessary. 

Every board should be able to answer one simple question, “can we evidence that our financial crime controls actually work?”. If the honest answer is “probably”, it’s time to take a closer look.  

That doesn’t necessarily mean redesigning the financial crime framework. It means testing the controls already in place, understanding whether they are delivering what they should and addressing the gaps the evidence identifies. 

How can TCC help

TCC can help you assess the effectiveness of your financial crime framework, test existing controls and understand where gaps or additional assurance may be needed. Where firms also need extra capacity or specialist expertise, we can provide experienced financial crime professionals to support defined reviews, remediation and periods of increased demand.