Quick Answer
FINRA requires every member firm to run a written AML compliance program with five parts: policies and procedures, an AML compliance officer, employee training, independent testing, and customer due diligence. The program must include a Customer Identification Program under the USA PATRIOT Act and get approval from senior management.
With the stages of money laundering in mind, let's look at exactly what broker-dealers must do to combat it. FINRA sets the Anti-Money Laundering (AML) compliance program requirements every member firm must follow.
AML Compliance Program Requirements
FINRA requires every member firm to establish and implement a written AML compliance program that includes these components:
| # | Requirement | Details |
|---|---|---|
| 1 | Policies and procedures | Reasonably designed to detect and cause the reporting of suspicious activity |
| 2 | AML Compliance Officer (AMLCO) | A designated individual responsible for implementing and monitoring the program day-to-day |
| 3 | Ongoing employee training | All relevant personnel must be trained on AML procedures |
| 4 | Independent testing (audit) | Conducted by qualified independent personnel or an outside party each calendar year; every two calendar years only if the firm does not execute customer transactions, hold customer accounts, or act as an introducing broker for customer accounts |
| 5 | Customer due diligence (CDD) | Understand the nature and purpose of each customer relationship, identify beneficial owners of legal-entity customers, and monitor the relationship on an ongoing basis |
Additional requirements:
- The AML program must be approved by senior management
- The anti-money laundering compliance officer (AMLCO) must be identified to FINRA, and the firm must promptly notify FINRA of any changes
- Independent testing occurs each calendar year. The two-calendar-year exception requires all three absences: no customer transactions, no customer accounts, and no introducing-broker activity for customer accounts
- The program must include a Customer Identification Program (CIP) as required by the USA PATRIOT Act
Exam Tip: Gotchas
- There are five core components of an AML program: policies/procedures, compliance officer, training, independent testing, and customer due diligence. The exam may list these in different order or try to substitute a fake requirement. Remember all five.
- The AML compliance officer does not have to be senior management, but the program must be approved by senior management.
- Independent testing can be done internally (by audit staff) OR externally (by a qualified outside party); both are acceptable. The "independence" in independent testing means the testers must be separate from those who administer the AML program, not necessarily external to the firm. Internal audit staff who have no role in running the AML program satisfy the independence requirement.
Customer Identification Program (CIP)
The Customer Identification Program (CIP) is a required component of every AML program, mandated by the USA PATRIOT Act. It ensures broker-dealers know who their customers are.
What CIP Requires
The firm generally must collect these identifying items before opening an account, then verify identity within a reasonable time before or after opening:
| Information | Notes |
|---|---|
| Name | Full legal name |
| Date of birth | For individual customers |
| Address | Residential or business address |
| Identification number | Taxpayer identification number for U.S. persons; permitted alternatives such as passport number and country of issuance for non-U.S. persons |
Additional CIP Obligations
- Record retention: Maintain records of the information used to verify identity
- Government list screening: Check customer names against government lists of known or suspected terrorists
- Customer notice: Provide adequate notice to customers that the firm is requesting information to verify their identity
- Verification can use documentary methods (driver's license, passport), non-documentary methods (credit reports, databases), or both; a photo ID is not universally required
- A CIP may permit a pending taxpayer identification number if the firm confirms the application was filed before opening and obtains the number within a reasonable period afterward
Exam Tip: Gotchas
- CIP requires four pieces of identifying information: name, date of birth, address, and identification number. The exam may try to add extra items or leave one out. Remember all four.
- CIP applies to ALL new accounts; there is no exception for existing customers opening additional accounts.
How CIP and AML Work Together
The relationship between CIP and the broader AML program:
- CIP addresses identity at onboarding; verification may continue within a reasonable time after opening
- AML monitoring is ongoing; it watches for suspicious activity after the account is open
- Reporting (Suspicious Activity Reports/SARs, Currency Transaction Reports/CTRs) is the response; when something suspicious is detected, the firm must report it
Think of it this way: CIP builds the customer's identity file. Ongoing monitoring watches what happens in the account. Verification of that identity file can still be underway while monitoring has begun.
CIP onboarding → Ongoing Monitoring → Suspicious Activity Detected → Evaluation and Required Reporting
Exam Tip: Gotchas
- Collection and verification are separate checkpoints. Required identifying information generally comes before opening; verification may occur within a reasonable time before or after. Ongoing monitoring then helps the firm detect activity that may require a Suspicious Activity Report to the Financial Crimes Enforcement Network (FinCEN).
What Should You Check on Exam Day?
- Can you name the five core components of an AML compliance program?
- Do you know that the AML program must be approved by senior management, even though the compliance officer does not have to be senior management?
- Can you explain what "independent testing" means, and how often it must occur?
- Do you know the four pieces of information CIP requires for every new account?
- Can you state which law requires the Customer Identification Program?