The bank has adequate policies and processes, including robust risk-based customer due diligence and effective compliance functions, that promote high ethical and professional standards and prevent it being used, intentionally or not, for criminal activity, with monitoring, detection, prevention and reporting of suspected activity to the authorities; it reports suspicious activities and fraud material to its safety, soundness or reputation to the banking supervisor as well as the financial intelligence unit. Its documented CDD policies, communicated to staff and integrated into risk management, identify, assess, monitor and mitigate money laundering, terrorist financing and proliferation financing risks by customer, country, product, service, transaction and channel, and on a group-wide basis include a customer acceptance policy, ongoing identification, verification and due diligence including beneficial ownership and purpose of the relationship with risk-based refresh, ongoing transaction monitoring and screening against United Nations terrorism and proliferation sanctions, enhanced due diligence on high-risk accounts and on politically exposed persons and their family and associates with senior management approval, and record keeping of CDD and transactions for at least five years. Correspondent relationships get additional due diligence on the respondent's business, reputation, supervision and enforcement history, no relationships with shell banks or poorly controlled or unsupervised banks, and senior management approval. The bank has controls to prevent, identify and report abuse; independent evaluation by internal audit or external experts; a management-level financial crime compliance officer and a dedicated reporting officer; a resourced, independent compliance function; screening of staff, agents and outsourcers; ongoing training; reporting of staff criminality; clear internal escalation with management information to the board and officers; and group-wide programmes with information sharing.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.