The primary responsibility of the internal audit department in a bank's AML/CFT policies and procedures is to evaluate the effectiveness of risk management and controls. The internal audit department is considered the third line of defense in a bank's risk management structure. They are responsible for providing an independent and objective review of the bank's operations and controls, including those related to AML/CFT. They assess the adequacy and effectiveness of the bank's risk management system and internal controls, identify areas of risk and non-compliance, and recommend improvements. Their findings are reported to the board of directors' audit committee or a similar oversight body, which then takes appropriate action based on these findings.

Choice A is incorrect. Monitoring customer transactions is not the primary responsibility of the internal audit department. This task typically falls under the purview of the compliance or operations department, which has direct access to transaction data and can monitor for suspicious activity on a real-time basis.

Choice B is incorrect. Approving new customer accounts is also not a primary function of the internal audit department. This responsibility usually lies with the client relationship management or business development teams, who are in charge of onboarding new clients and ensuring they meet all necessary regulatory requirements.

Choice D is incorrect. Developing AML/CFT policies and procedures isn't primarily done by the internal audit department but rather by a specialized team within compliance or risk management departments that have expertise in regulatory requirements and best practices for AML/CFT governance.

Things to Remember

• AML (Anti-Money Laundering): AML refers to a set of procedures, laws, and regulations designed to stop the practice of generating income through illegal actions.