Explanation:

Under the three lines of defense approach to AML and ML/FT risk management, the third line of defense (internal audit) alongside external auditors is responsible for providing an independent evaluation of the bank’s risk management controls and ensuring regulatory compliance.

Option A is incorrect because daily monitoring and managing of risks within business lines is the responsibility of the first line of defense (the business units themselves), not the chief AML officer.
Option B is incorrect because the primary point of contact with financial intelligence units (FIUs) and regulators is typically the designated AML/BSA Officer (or Money Laundering Reporting Officer), not the CRO.
Option D is incorrect because employee screening is primarily a Human Resources function (which sits in the first line for these activities), rather than a responsibility of the corporate operational risk function (second line).

Question A regional bank follows the three lines of defense approach for managing its operational risk. The CRO of the bank is concerned that several competing banks have recently received regulatory fines resulting from poor management of risks related to money laundering and financing of terrorism (ML/FT), and wants to improve the bank’s management of these risks. The CRO reviews the Basel Committee guidelines for the management of ML/FT risks and suggests that the bank adopt industry best practices for different business functions in each line of defense. Which of the following would be most appropriate for the CRO to recommend addressing ML/FT risks?

Exam-Like

Community

UAnonymous

Last updated: July 5, 2026 at 07:29

The chief officer in charge of ML/FT risk should be responsible for monitoring and managing these risks within each of the business lines on a daily basis.

The CRO should serve as the primary point of contact with regulatory supervisors and financial intelligence units on any issues related to ML/FT risk.

Internal and external auditors should evaluate the bank’s risk controls to ensure that they are effective in managing ML/FT risk as well as compliant with regulations.

The corporate operational risk function should screen current and prospective employees as part of the second line of defense in managing ML/FT risk.

Financial Risk Manager Part 2

Get started today

Get started today

Comments (0)