EBA/GL/2017/11 (Guidelines on internal governance) specify the internal governance, arrangements, processes and mechanisms foreseen under Article 74 of Directive 2013/36/EU (CRD), aimed at ensuring the sound management of risks across all three lines of defence and, in particular, set out detailed requirements for the second line of defence (the independent risk management and compliance function) and the third line of defence (the internal audit function).

With regards to ensuring compliance with AML regulatory requirements different functions of the institutions have different responsibilities. More particularly, the business lines, as the first line of defence, take risks and are responsible for their operational management directly and on a permanent basis. The compliance function as the second line of defence, including the head of compliance, should be independent of the business lines and internal units it controls and have sufficient authority, stature and resources.

According to paragraph 30 of the Background and Rationale section to the EBA/GL/2017/11 (Guidelines on internal governance) “the compliance function monitors compliance with legal and regulatory requirements and internal policies”. Moreover, paragraph 191 of the Guidelines sets out that banks should “set up a process to regularly assess changes in the law and regulations applicable to its activities” and it is the management body which has overall responsibility to “oversee the implementation of a well-documented compliance policy”.

Furthermore, paragraph 192 of the Guidelines sets out that “the compliance function should advise the management body on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards”. This means that the compliance function has an advisory role to the management body’s mandate to ensure the compliance with the laws, rules, regulations and standards The compliance function should ensure that compliance monitoring is carried out through a structured and well-defined compliance-monitoring programme and that the compliance policy is observed.

In light of the above, each different function/line of defence has a specific role to play in ensuring compliance with the AML regulatory requirements. In this context, the compliance function as the second line of defense should carry out its responsibilities as set above for the assessment of compliance with all laws, rules, regulations and standards including compliance with AML as foreseen under Article 8 of Directive (EU) 2015/849 (AMLD), data protection, tax laws, fraud prevention and any other laws applicable to bank activities. Additionally the internal audit function as the third line of defence may have a saying on the way that the compliance function exercises its role. Finally, it should be mentioned that the management body should have the final saying on the matters in hand.