Revitalizing an Underperforming AML Program: A Root Cause Analysis Approach

After receiving feedback from regulatory examiners and internal auditors, you’ve come to terms with the reality: your AML (Anti-Money Laundering) program is underperforming. Several factors can contribute to this underperformance, including:

• A lack of customer knowledge—you’re unaware of who your institution is banking, including high-risk customers such as PEPs (Politically Exposed Persons) or MSBs (Money Services Businesses).

• Inadequate beneficial ownership information collection by first-line staff.

• The failure to detect suspicious activity—examiners and auditors are identifying issues before your team does.

• Suspicious activity is being detected, but SARs (Suspicious Activity Reports) are not being filed within regulatory timeframes.

• CTRs (Currency Transaction Reports) are not being submitted on time, and exemptions have been improperly granted.

• The AML risk assessment is outdated—either it hasn’t been conducted in two or more years or it has missed significant risks.

• AML transaction monitoring thresholds and settings have remained unchanged for years, despite shifts in risk exposure.

• Policies and procedures are outdated—some haven’t been updated in over a year and fail to reflect current practices.

• AML training is misaligned with the institution’s risk profile.

• Internal reporting on AML department performance is inaccurate, misleading, or outdated.

Depending on the severity of these issues, regulatory examiners and auditors may provide verbal feedback, issue written findings, or escalate to MRAs (Matters Requiring Attention) and even enforcement actions. While your intention has always been to improve the AML program, knowing where to start can be daunting.

A structured root cause analysis can provide the roadmap you need. Specifically, using the Five Whys methodology—a deep dive that methodically uncovers the root causes of issues—can help drive meaningful improvements.

Using the Five Whys to Diagnose and Fix AML Weaknesses

Key Tips for an Effective Root Cause Analysis

• Be brutally honest. The Five Whys process may reveal uncomfortable truths. A genuine turnaround requires full transparency.

• Engage an independent consultant. External experts may ask critical questions that internal staff overlook.

• Categorize root causes. Issues will likely fall into one (or a combination) of three categories: people, process, or technology.

Below are real-world AML challenges analyzed through the Five Whys approach.

Example 1: Failure to Identify Suspicious Activity

Root Cause Analysis:

1. Why? Staff failed to identify suspicious activity.

2. Why? They lacked the necessary expertise.

3. Why? Their skills hadn’t kept pace with the institution’s evolving risk profile.

4. Why? Internal training programs and procedures were not updated accordingly.

5. Why? AML senior management was not consistently informed about new customer types and product offerings.

Key Insight: This issue stems from both people and process failures. The risk assessment, which should inform training and procedural updates, was not properly maintained.

Alternative Analysis:

• If the first "Why" was "the wrong staff were hired", the focus shifts to talent acquisition, job descriptions, and hiring practices.

• If the first "Why" was "the AML transaction monitoring system wasn’t ingesting all necessary data", the issue becomes one of technology and data integrity.

Example 2: Risk Assessment Hasn’t Been Performed in Two Years

Root Cause Analysis:

1. Why? The risk assessment has been ‘in process’ for over a year.

2. Why? The AML Officer has been unable to obtain the necessary data.

3. Why? Requests for reports and data were given low priority.

4. Why? Enterprise-wide awareness of the AML risk assessment’s importance is lacking.

5. Why? There is no oversight committee ensuring accountability.

Key Insight: This issue spans people, process, and governance. Without executive sponsorship and structured oversight, AML priorities are deprioritized, delaying critical risk assessments.

Once root causes are identified, the next steps include:

1. Mapping the root causes to performance gaps. Some root causes will impact multiple areas of AML underperformance.

2. Developing targeted corrective action plans. Some fixes, like improving training programs, are straightforward. Others—such as securing executive sponsorship for AML—are more complex.

3. Aligning with regulatory expectations. Examiners and auditors will expect a well-documented corrective action plan following any assessment that identifies weaknesses.

By systematically addressing people, process, and technology deficiencies through root cause analysis, AML leaders can drive sustainable improvements and build a more resilient compliance function.