Authority and requirement hierarchy

An analyst opening a customer file or transaction alert often sees three kinds of text that use similar language: an international standard, a rule in the operating jurisdiction, and the institution's procedure. Confusing them changes the decision. FATF Recommendations set international standards that countries implement within their own systems. A specialist cannot cite a Recommendation as if it were a particular local legal provision without checking that provision, the competent authority and its effective date. Nor does an internal procedure prove that every detail is required by law. The operational question is what the institution should do for this case, on which authority, and who can make the next decision.

Imagine the file contains a standards page on risk assessment and customer due diligence, a dated local supervisory notice with an applicability statement, and a numbered institutional policy with a named process owner. Ask four questions before applying any instruction. Is the source authentic and accessible? Is this the current version for the date of the case? Does it cover this customer and product? Does it impose an obligation on the institution, or describe a step delegated to this particular role? The final question matters. Reporting suspicion to a financial intelligence unit may be an institutional duty, while the analyst's assigned task is to assemble the evidence and refer it to an authorised officer under local rules and policy.

Use a requirement matrix instead of an impressionistic note. Its columns are requirement, source and pinpoint, source class, date checked, triggering fact, action within the specialist's remit, and next decision owner. Include an explicit 'not yet verified' state. Missing information is neither permission nor prohibition. If two texts appear to conflict, do not resolve the issue by ranking the names of their publishers. Check scope, version and the date of the event, then refer the actual conflict to legal compliance or the policy owner. An internal policy may be stricter than a local minimum, but its approved version and exception authority still need to be established. The international standard explains the control objective; it does not replace the local rule.

Keep risk identification separate from an accusation of crime. FATF customer due diligence standards address identifying and verifying the customer, understanding the purpose of the relationship, and conducting ongoing monitoring with measures proportionate to risk. An unusual feature does not by itself prove money laundering. The specialist identifies the signal, requests relevant evidence, and preserves a traceable decision path. If a required document is absent, record what is missing, who requested it and when, and send any continuation or suspension decision to its authorised owner. If facts may call for a reporting route, limit circulation to those who need to know and use the confidential escalation channel. Do not tell the customer that a report may be made or offer an explanation that could compromise review. Reporting details, deadlines and retention duties depend on the applicable jurisdiction and must be checked against its current primary source before use.

The same hierarchy matters when a rule changes. If an internal policy cites an older recommendation, do not alter the customer record based on a news summary. Verify the current text, identify the changed passage, compare it with local requirements and policy, and raise a documented change request to the policy owner. The team follows the approved procedure unless the authorised owner directs otherwise. Two opposite mistakes are possible: continuing to use a copied passage superseded by a later version, or anticipating a change before it applies to the institution. A source log proves when a page was checked; it does not prove the case was understood. Write the operational effect of the change in plain terms.

Finally, test the matrix on two records. A routine relationship with complete evidence should lead to a routine step rather than needless escalation. A missing or conflicting requirement should expose the unknown fact and the boundary of the analyst's authority. If the matrix gives both records the same generic instruction, it is a slogan rather than a workflow. If it assigns the specialist a decision reserved for an authorised officer, correct the authority column. Another reviewer should be able to reconstruct the recommendation from the facts, source, version and scope without relying on the writer's reputation.