The compliance officer should perform the first step of reviewing the institution's risk assessment before implementing any changes to the customer onboarding program. The risk assessment is a key component of the AML compliance program, as it identifies and measures the institution's exposure to money laundering and terrorist financing risks. The risk assessment should be updated regularly and reflect the institution's products, services, customers, geographic locations, and delivery channels. By reviewing the risk assessment, the compliance officer can determine the adequacy and effectiveness of the current customer onboarding program and identify any gaps or weaknesses that need to be addressed. The compliance officer can also benchmark the institution's risk assessment against the regulatory expectations and best practices in the industry.
The other steps are also important, but they should be performed after the risk assessment review. Revising training materials for frontline staff, conducting enhanced due diligence on high risk customers, and resolving substantive discrepancies in customer verification are all part of the customer onboarding program, but they depend on the risk assessment to provide the appropriate level of controls and procedures. For example, the training materials should reflect the risk assessment results and the revised customer onboarding policies. The enhanced due diligence should be applied to customers who pose a higher risk according to the risk assessment criteria. The customer verification should be consistent with the risk assessment and the customer identification program.
References:
AML KYC Onboarding Lifecycle Process Flow | Guide - AdvisoryHQ
New EBA AML Guidelines on the use of Remote Customer Onboarding Solutions - Bird & Bird KYC Onboarding Process 2023 - AML requirements - Sumsub Review of any AML/CFT program begins with the Risk Based Approached. It should first check the internal system to identify risk factors and design program accordingly.