A regional bank follows the three lines of defense approach for managing its operational risk. The CRO of the bank is concerned that several competing banks have recently received regulatory fines resulting from poor management of risks related to money laundering and financing of terrorism (ML/FT), and wants to improve the bank's management of these risks. The CRO reviews the Basel Committee guidelines for the management of ML/FT risks and suggests that the bank adopt industry best practices for different business functions in each line of defense. Which of the following would be most appropriate for the CRO to recommend addressing ML/FT risks?