Compliance Officers Playbook

This episode details the first week's homework assignment in a cybersecurity training series focusing on Governance, Risk, and Compliance (GRC). The assignment uses the NIST Cybersecurity Framework (CSF) to help students understand its five core functions—Identify, Protect, Detect, Respond, and Recover—by applying them to a practical scenario involving a small healthcare company securing patient d...

The UK fintech company Stenn collapsed after indirect involvement in a US money laundering case triggered investigations by its lenders, highlighting the significant risks of indirect exposure to financial crime. Stenn's previous auditor resigned due to concerns over transactions, and its founder's past involvement in other failed businesses raised further red flags. The case underscores the impor...

The SEC issued an $18 million penalty against LPL Financial for repeated violations of anti-money laundering (AML) regulations, specifically concerning its Customer Identification Program (CIP) and ongoing customer due diligence (CDD). LPL failed to properly verify accounts, timely close accounts failing CIP screening, and consistently comply with its own AML policies regarding prohibited accounts...

The episode explores the challenges of creating effective Operational Risk Management (ORM) frameworks. It highlights common pitfalls such as overcomplication, siloed responsibilities, and a reactive approach. The ideal framework, the text argues, should be simple, practical, and integrated into daily operations, fostering a proactive risk-aware culture. Examples of successful implementations in l...

A US court fined cryptocurrency exchange BitMEX $100 million for violating the Bank Secrecy Act between 2015 and 2020 due to insufficient anti-money laundering (AML) and know-your-customer (KYC) measures. This penalty, significantly lower than the initially sought $417 million, follows BitMEX's guilty plea and previous settlements. The exchange's founders also received individual fines and probati...

Europol’s Groundbreaking Operation to Seize Criminal Assets: Project A.S.S.E.T. 🔍 In a major step forward in the fight against organized crime, Europol has launched Project A.S.S.E.T. (Asset Search & Seize Enforcement Taskforce), bringing together over 80 financial experts from 43 law enforcement agencies across 28 countries. For the first time, global specialists joined forces to enhance the ide...

This podcast episode, "Brutal AML Truth: We’re WAYYY Too Slow to Adapt," argues that Anti-Money Laundering (AML) programs are too slow to counter evolving criminal tactics. It advocates for AML teams to adopt a startup mentality, emphasising speed, embracing uncertainty, questioning existing processes, and prioritising user needs. The episode suggests focusing on small, iterative improvements rath...

A data breach exposed the personal information of approximately 800,000 Volkswagen electric vehicle owners. The breach, initially reported by a German publication and confirmed by the ethical hacking group Chaos Computer Club, stemmed from a misconfigured Amazon cloud storage system managed by Volkswagen's subsidiary, Cariad. Sensitive data compromised included location details, email addresses, p...

This podcast episode outlines the crucial fieldwork and testing phases of a financial crime audit. It details key steps, including data collection (transaction records, customer information, and internal policies), interviews and observations, and various testing techniques like transaction testing and walkthroughs. The episode stresses the importance of thorough documentation for clear, accountab...

This podcast episode explains how to prepare a scoping document for a financial crime audit. It outlines the document's key components, including the audit's objectives, scope, timeline, resources, methodology, risk assessment, and deliverables. The episode stresses the importance of collaboration, clarity, and flexibility in creating this crucial roadmap for a successful and efficient audit. Best...

The Serious Fraud Office (SFO) in the UK successfully obtained its first Unexplained Wealth Order (UWO) to seize a £1.5 million property believed purchased with funds from a £100 million fraud. This legal tool, introduced in 2017, compels the owner, Claire Schools, to explain the property's origin within 28 days; failure to provide a legitimate explanation could result in the property's seizure. T...

The Digital Operational Resilience Act (DORA) came into effect on 17 January 2025, significantly altering ICT risk management and reporting for EU financial institutions. Key changes include a unified reporting system for ICT incidents and cyber threats via the CSSF's eDesk platform, replacing previous frameworks. DORA supersedes existing CSSF circulars on ICT risk, outsourcing, and incident repor...

This podcast episode clarifies the often-confused concepts of IT General Controls (ITGC) and IT Application Controls (ITAC) in IT auditing. ITGC provides the overall security and operational framework of an IT system, akin to a house's structure, while ITAC ensures the individual applications within that system function correctly, like the appliances in the house. The episode uses relatable analog...

This episode discusses a Europol report which examines how serious organised crime networks in the EU exploit legitimate businesses. It details the diverse ways criminal groups infiltrate or abuse legal business structures (LBS) across various sectors, facilitating diverse criminal activities from money laundering to drug trafficking. The report highlights the high percentage of threatening crimin...

The episode provides guidance on choosing relevant certifications within the Governance, Risk, and Compliance (GRC) field. It outlines five key specialisations – Payment Card Industry Compliance, IT Audit and Assurance, Risk Management, Cybersecurity Governance, and Privacy and Data Protection – detailing specific certifications beneficial for each. The text stresses a strategic approach, advocati...

This episode details a sophisticated money laundering scheme involving Chinese brokers, Mexican drug cartels, and cryptocurrency. Drug money is converted into cryptocurrency, then laundered through Chinese businesses, often funding purchases of high-value assets like real estate and luxury goods. The cycle is sustained by the cartels using the laundered funds to purchase fentanyl precursors from C...

President Biden's recent executive orders, imposing export controls on AI chips and directing the construction of large-scale data centres, suggest a significant US government push for AI dominance. This initiative mirrors predictions by Leopold Aschenbrenner, who foresaw a government-led project akin to the Manhattan Project to control superintelligence. The orders create a tiered system granting...

This episode explains why EU financial institutions must legally adhere to the European Commission's list of high-risk third countries for anti-money laundering (AML) and counter-terrorism financing (CFT) purposes, rather than the Financial Action Task Force (FATF) list. The EU's list incorporates broader criteria, including corruption and governance, exceeding the FATF's focus solely on AML/CFT s...

The episode comprises news articles and website content from AML Intelligence, focusing on financial crime and regulatory compliance. A key piece reports on a $45 million fine levied against Robinhood for anti-money laundering (AML) and securities violations stemming from inadequate staff training and delayed suspicious activity reporting. Further episodes cover other recent developments in financ...

INTERPOL has introduced a new Silver Notice system to track and recover criminal assets globally. This pilot programme, involving 52 countries until at least November 2025, allows member states to request information on assets linked to various crimes, such as fraud and drug trafficking. The initiative aims to improve international asset recovery, currently highly ineffective, by targeting the fin...

This podcast episode explains the importance of conducting comprehensive Full Fraud Risk Assessments (FRAs) for organisations. It details the steps involved in a FRA, from defining the scope and identifying risks to implementing and monitoring mitigation strategies. The episode also highlights best practices, such as stakeholder engagement and data analysis, and common pitfalls to avoid, like insu...

This podcast episode explains Thematic Fraud Risk Assessments (TFRAs), a crucial fraud prevention tool. TFRAs focus on specific areas within an organisation, unlike broader assessments, allowing for targeted risk identification and mitigation. The episode details the steps involved in conducting a TFRA, including identifying themes, engaging stakeholders, assessing risks, and implementing mitigati...

This podcast episode explains Initial Fraud Impact Assessments (IFIAs), a proactive risk management tool. IFIAs help organisations identify and mitigate potential fraud risks associated with new initiatives before implementation. The episode details a step-by-step process for conducting an IFIA, including defining the scope, identifying risks, evaluating impact and likelihood, developing mitigatio...

This episode discusses a practice note from the UK Government Counter Fraud Profession, providing guidance on conducting Enterprise Fraud Risk Assessments (EFRAs). EFRAs are high-level assessments designed to inform senior management about an organisation's susceptibility to fraud. The guide details the process of building an EFRA, including defining risks, threats, and drivers; assessing impact a...

The episode details the conviction of Mark Chikarovski, son of a former Australian political leader, for running a multi-million dollar dark web drug trafficking operation under the alias "AusCokeKing". Investigations by the International Consortium of Investigative Journalists (ICIJ) revealed Chikarovski's connection to an offshore company, Aquay Holdings Ltd, and a Cypriot bank account, facilita...