Selecting controls and escalation

Once risk is assessed, 'perform enhanced due diligence' is not yet an operational control. A useful control names the risk driver, execution point, evidence produced, and owner of any exception. If the driver is uncertainty about who controls a company, a targeted step may be to obtain control agreements, identify the natural persons who ultimately control it, and obtain an independent review. If the driver is payment activity inconsistent with the declared purpose, the relevant step is to establish an expected activity baseline and investigate deviations. These controls differ because the questions differ. Another identity document does not resolve unexplained transactions; more transaction alerts do not fill a beneficial ownership gap.

Start with a causal sentence: 'We observed X; therefore we need Y; evidence Z will show whether Y occurred.' For remote onboarding, X might be weak assurance that the document image belongs to the applicant, Y an appropriate independent check, and Z a reviewed verification record. Do not name one technology as a universal legal requirement. The institution uses methods permitted by its local requirements and approved policy. If no approved method is available, raise the implementation gap instead of improvising one in a customer file. Distinguish a control that is required, a control that was performed, and a control that succeeded. A checked box is not an outcome.

Proportionality means that control intensity follows evidenced risk. Simplified measures in lower-risk cases need a sound assessment basis and do not remove core obligations established by the applicable local framework. Enhanced measures in higher-risk cases should address the particular cause, rather than add unread documents. A person with a documented, predictable monthly income differs from a company with several ownership layers and repeated transfers unexplained by its declared business. This distinction does not accuse the company of a crime. It supports gathering more relevant information and applying appropriate monitoring under policy. Neither case warrants automatic conclusions from social status or nationality without a documented basis and correct scope.

If a case deviates from procedure, create an exception record rather than a marginal note. Record the case number, policy step, unmet fact, reason the step cannot be completed, effect on risk, any authorised temporary control, decision owner, exception expiry date and condition for returning to the normal path. Silence or the passage of time is not approval. If policy does not identify an exception owner, that is a governance gap to escalate, not discretion for the analyst to invent. Reporting and sanctions rules vary across jurisdictions, so an exception record must not promise that a transaction is lawful. State what was checked and what remains unresolved.

Sometimes the case needs additional information, not an exception. A completion request seeks evidence to satisfy the normal rule before decision. An exception asks an authorised person to decide whether a rule can be waived or delayed under an established power. Calling every late document an exception empties risk approval of meaning. Calling a decision taken despite a mandatory missing condition 'completion in progress' hides a deviation. Keep time states clear: draft, awaiting evidence, awaiting approval, conditionally approved, declined or closed, using the institution's actual values. Do not leave a record marked both approved and pending without an explanation.

Test a control before general use. Apply it to two fictional cases, one with the stated driver and one without. If both lead to identical steps, the proposed control may not be sensitive to the risk it supposedly addresses. Check operational feasibility too. Who gathers evidence? Where is it stored? What happens during staff absence or system failure? Who reviews an overdue alert? A control without an owner or review trace is hard to demonstrate. The control objective may still be valid; its operating design is incomplete and needs the process owner's decision.

Escalation is neither punishment nor a substitute for analysis. Send specific facts and realistic options to the authorised owner: obtain missing information, continue with an approved documented control where permitted, or do not proceed under the applicable rules. Explain what supports each option and what remains unknown. Do not hide a gap under 'no issues noted'. If an independent suspicion indicator or a potential sanctions match calls for urgent containment, use its dedicated route promptly; it cannot wait for a routine exception cycle. Conversely, automatically freezing every incomplete file without authority or a defined threshold is also an error. The specialist identifies and refers the case in time.

/ Review