원클릭으로 Manus에서 모든 스킬 실행

design-aml-compliance-program

스타1

포크0

업데이트2026년 7월 20일 15:21

Use when a financial institution or money-services business needs an anti-money-laundering compliance program — building it around the specific pillars required under the Bank Secrecy Act (written policies, a designated compliance officer, ongoing training, independent testing, and customer due diligence), rather than a generic fraud-prevention policy with no BSA-specific structure.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

jeffreytse

jeffreytse/grimoire-core

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Design AML Compliance Program

Build an anti-money-laundering compliance program around the specific pillars required under the Bank Secrecy Act — written policies, a designated compliance officer, ongoing training, independent testing, and customer due diligence — rather than a generic fraud-prevention policy with no BSA-specific structure.

Why This Is Best Practice

Adopted by: The Bank Secrecy Act and its implementing regulations require covered financial institutions to maintain a compliance program built around specific defined pillars, and the Federal Financial Institutions Examination Council's BSA/AML Examination Manual is the reference standard examiners use to assess program adequacy across the US banking and financial services sector — making these specific pillars the universal structural baseline for AML programs at regulated institutions. Impact: FinCEN's 2016 Customer Due Diligence Rule specifically added a fifth required pillar (ongoing customer due diligence, including beneficial ownership identification) after examiners and enforcement actions documented that programs lacking structured, risk-based customer due diligence — relying only on account-opening identification with no ongoing monitoring — were failing to detect money laundering conducted through legitimate-looking accounts after onboarding. Why best: Money laundering typically doesn't announce itself at account opening — it emerges through transaction patterns and relationships that develop over time, which is exactly why the BSA's pillar structure requires ongoing due diligence and independent testing, not merely a one-time customer verification at onboarding; a program built around all five pillars is what actually catches this evolving risk, as opposed to a static, account-opening-only compliance check.

Sources: Bank Secrecy Act, 31 U.S.C. § 5311 et seq.; Financial Crimes Enforcement Network (FinCEN), "Customer Due Diligence Requirements for Financial Institutions," 31 CFR 1010.230 (2016); Federal Financial Institutions Examination Council (FFIEC), Bank Secrecy Act/Anti-Money Laundering Examination Manual

Steps

Step 1: Develop written policies and procedures covering the institution's specific risk profile

Develop written AML policies and procedures tailored to the institution's specific products, customer base, and geographic footprint — a generic template not calibrated to the institution's actual risk profile tends to under-address the institution's genuine highest-risk areas.

Step 2: Designate a compliance officer with sufficient authority and resources

Designate a specific BSA/AML compliance officer with clearly defined authority and adequate resources to administer the program day to day, since a designated-in-name-only compliance officer without genuine authority or resourcing undermines the program regardless of how well the written policies are drafted.

Step 3: Provide ongoing, role-calibrated employee training

Provide AML training to relevant employees on an ongoing basis, calibrated to their specific role's exposure to money laundering risk — frontline staff handling customer transactions require different, more operational training than back-office staff with no direct customer contact.

Step 4: Implement risk-based customer due diligence, including beneficial ownership identification

Implement customer due diligence at onboarding and on an ongoing basis, including identifying beneficial owners of legal entity customers per FinCEN's 2016 rule, and calibrate the depth of due diligence to each customer relationship's specific money-laundering risk profile.

Step 5: Conduct independent testing of the program on a regular cycle

Conduct independent testing of the AML program — by internal audit or an external party independent of the compliance function itself — on a regular cycle, verifying the program's actual operation matches its written design, since this fifth pillar specifically catches gaps between documented policy and actual practice that self-assessment by the compliance function alone might miss.

Rules

Build the program around all five BSA-required pillars (policies, designated officer, training, independent testing, customer due diligence) — not an ad hoc structure missing any of these specific components.
Calibrate written policies and customer due diligence depth to the institution's actual, specific risk profile — not a generic template applied uniformly.
Ensure the designated compliance officer has genuine authority and adequate resources, not a nominal designation alone.
Conduct customer due diligence on an ongoing basis, including beneficial ownership identification, not only at initial account opening.

Examples

Ongoing due diligence catching evolving risk: A customer's transaction pattern shifts significantly after account opening, developing characteristics consistent with potential structuring activity. The institution's ongoing (not just at-onboarding) due diligence process flags this pattern change for review — a risk a program relying solely on initial account-opening verification would have missed entirely.

Independent testing surfacing a training gap: An institution's periodic independent AML program testing reveals that frontline staff at several branches were not completing required training on schedule, despite the written policy specifying this requirement — a gap between documented policy and actual practice the independent testing pillar specifically exists to catch.

Common Mistakes

Building a compliance program missing one of the five required pillars — each pillar addresses a distinct failure mode, and omitting any one (most commonly, independent testing or ongoing due diligence) leaves a specific, documented gap.
Applying a generic AML policy template without calibrating it to the institution's actual customer base, products, and geography — this tends to under-address the institution's genuine highest-risk areas.
Limiting customer due diligence to account opening, with no ongoing monitoring — money laundering risk often emerges through post-onboarding transaction patterns, which is exactly what ongoing due diligence is designed to catch.
Designating a compliance officer without genuine authority or adequate resources — a nominal designation doesn't substitute for the actual capacity to administer the program effectively.

When NOT to Use

For an organization not covered by the Bank Secrecy Act's applicability (not a financial institution, money-services business, or other covered entity) — confirm actual BSA coverage before assuming this specific program structure applies.
As a substitute for the institution's separate sanctions compliance program — AML and sanctions compliance are related but distinct regulatory requirements, often addressed by complementary but separate program elements (see design-sanctions-compliance-program).
For determining whether specific past transaction activity actually constituted money laundering or a reportable suspicious activity — that determination requires case-specific analysis, not this program-design practice.

Finance disclaimer: This skill encodes professional best practices for educational purposes. It is not financial advice. Consult a licensed financial advisor before making investment decisions.

이 저장소의 다른 Skills

같은 저장소

design-family-business-governance

jeffreytse/grimoire-core

Use when a family-owned business needs governance structures addressing the specific tension between family dynamics and business decision-making — establishing a family council separate from the operating board, a written family charter or constitution, and defined succession criteria, rather than relying on informal family relationships to substitute for genuine governance structure.

2026-07-201

audit-governance-maturity

jeffreytse/grimoire-core

Use when an organization wants to assess how mature its overall governance practices are — decision rights, oversight bodies, policy management, accountability mechanisms — against a recognized international governance standard, producing a structured maturity assessment rather than an unstructured, subjective sense of "our governance seems fine."

2026-07-201

design-committee-charter-framework

jeffreytse/grimoire-core

Use when an organization is forming any standing committee — a risk committee, a compensation committee, an ethics committee, or any other recurring decision-making body — writing a formal charter that defines the committee's scope, authority, and reporting line before it begins operating, rather than letting the committee's mandate remain implicit and subject to later dispute.

2026-07-201

design-conflict-of-interest-policy

jeffreytse/grimoire-core

Use when an organization needs a standing policy for employees, officers, and board members to disclose personal, financial, or relational interests that could conflict with their organizational duties — requiring proactive, periodic disclosure and a defined recusal process, rather than relying on individuals to voluntarily raise conflicts only when they happen to think of it.

2026-07-201

design-crisis-management-governance-protocol

jeffreytse/grimoire-core

Use when an organization needs a defined governance chain of command for a major corporate crisis — a product safety failure, an executive scandal, a data breach, a natural disaster affecting operations — establishing who has decision authority at each severity level and when the board itself must be activated, rather than discovering the chain of command for the first time while the crisis is already unfolding.

2026-07-201

design-decision-rights-framework

jeffreytse/grimoire-core

Use when an organization repeatedly experiences slow or contested strategic and operational decisions because it's unclear who has actual authority to decide — explicitly mapping decision types to the specific role or body with final decision authority, distinct from who merely provides input, rather than leaving decision authority ambiguous and re-litigated each time a similar decision arises.

2026-07-201

name	design-aml-compliance-program
description	Use when a financial institution or money-services business needs an anti-money-laundering compliance program — building it around the specific pillars required under the Bank Secrecy Act (written policies, a designated compliance officer, ongoing training, independent testing, and customer due diligence), rather than a generic fraud-prevention policy with no BSA-specific structure.
source	Bank Secrecy Act (31 U.S.C. § 5311 et seq.); FinCEN, "Customer Due Diligence Requirements for Financial Institutions" (2016); FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual
tags	["finance","corporate","aml-compliance","bank-secrecy-act","customer-due-diligence","financial-crime"]
related	["design-sanctions-compliance-program","design-model-risk-management-framework","audit-related-party-transactions"]

Design AML Compliance Program

Why This Is Best Practice

Steps

Step 1: Develop written policies and procedures covering the institution's specific risk profile

Step 2: Designate a compliance officer with sufficient authority and resources

Step 3: Provide ongoing, role-calibrated employee training

Step 4: Implement risk-based customer due diligence, including beneficial ownership identification

Step 5: Conduct independent testing of the program on a regular cycle

Rules

Build the program around all five BSA-required pillars (policies, designated officer, training, independent testing, customer due diligence) — not an ad hoc structure missing any of these specific components.
Calibrate written policies and customer due diligence depth to the institution's actual, specific risk profile — not a generic template applied uniformly.
Ensure the designated compliance officer has genuine authority and adequate resources, not a nominal designation alone.
Conduct customer due diligence on an ongoing basis, including beneficial ownership identification, not only at initial account opening.

Examples

Common Mistakes

Building a compliance program missing one of the five required pillars — each pillar addresses a distinct failure mode, and omitting any one (most commonly, independent testing or ongoing due diligence) leaves a specific, documented gap.
Applying a generic AML policy template without calibrating it to the institution's actual customer base, products, and geography — this tends to under-address the institution's genuine highest-risk areas.
Limiting customer due diligence to account opening, with no ongoing monitoring — money laundering risk often emerges through post-onboarding transaction patterns, which is exactly what ongoing due diligence is designed to catch.
Designating a compliance officer without genuine authority or adequate resources — a nominal designation doesn't substitute for the actual capacity to administer the program effectively.

When NOT to Use

For an organization not covered by the Bank Secrecy Act's applicability (not a financial institution, money-services business, or other covered entity) — confirm actual BSA coverage before assuming this specific program structure applies.
As a substitute for the institution's separate sanctions compliance program — AML and sanctions compliance are related but distinct regulatory requirements, often addressed by complementary but separate program elements (see design-sanctions-compliance-program).
For determining whether specific past transaction activity actually constituted money laundering or a reportable suspicious activity — that determination requires case-specific analysis, not this program-design practice.

Finance disclaimer: This skill encodes professional best practices for educational purposes. It is not financial advice. Consult a licensed financial advisor before making investment decisions.