A central compliance function should own the policy translation process, with local legal or compliance input where jurisdictional nuance is required. That structure keeps the enterprise aligned on minimum standards while preventing uncontrolled regional drift. Accountability should sit with a named governance owner, not with whichever team last interpreted the regulation.
Who should own AML policy changes when regulations differ by country?
The ownership model matters because AML is not just a local legal interpretation exercise. When regulation varies by jurisdiction, the right owner is the function that can keep the enterprise policy coherent while incorporating country-specific requirements. That usually means a central compliance or financial-crime policy team, with local legal or compliance review for jurisdictional nuances and a clearly named governance owner for final accountability.
Why central ownership is usually the right operating model
AML policy needs a single control point because the enterprise has to translate multiple legal regimes into one workable standard. If each country team rewrites policy independently, the organisation creates drift in thresholds, escalation paths, monitoring expectations, and exception handling. Central ownership helps preserve consistency, while local input ensures the policy reflects local law rather than a generic global approximation.
That distinction matters most when the business operates across regions with different suspicious activity reporting rules, customer due diligence expectations, beneficial ownership requirements, sanctions adjacency, or recordkeeping obligations. A central policy owner can decide what becomes global minimum standard and what must remain a jurisdictional addendum. Local teams should inform the rule, but not own the enterprise interpretation unless the business is intentionally federated by design.
Where cross-border obligations are involved, the practical question is not “who has the best legal opinion,” but “who can prevent contradictory standards from being enforced in parallel.” That is why the owner should be the function accountable for policy architecture, version control, and approval, not the team closest to the latest local update.
How to structure decision rights across global and local teams
Ownership works best when the central function owns the base policy, the interpretation log, and the change process, while country counsel or local compliance reviews only the clauses that vary by jurisdiction. This lets the enterprise distinguish between a true legal requirement and an operational preference. It also makes it easier to show auditors and regulators why a policy differs in one country without fragmenting the whole control environment.
- Central compliance owns the master AML policy and the approved global baseline.
- Local legal or compliance provides jurisdiction-specific review where law or regulator expectations differ.
- The governance owner approves final wording, exceptions, and rollout timing.
- Business teams implement the policy but do not reinterpret it independently.
For multinational institutions, this is especially important where AML obligations intersect with FATF Recommendations, the AML and KYC framework. FATF sets the common international reference point, but it does not remove country-by-country legal variance. In the US, the policy owner also has to account for FinCEN expectations, while EU institutions often need to align with EBA AML/CFT guidance alongside local law.
What good ownership looks like in practice
Good ownership is visible in the change process. Every AML policy update should have one accountable owner, one approval path, and a documented reason for any country-specific deviation. The governance model should also define who can request changes, who validates regulatory interpretation, and who signs off on the enterprise baseline before implementation begins.
The most useful test is whether a reviewer can answer three questions without ambiguity: which rule is global, which rule is local, and who can overrule a local interpretation if it conflicts with enterprise standards. If those answers are unclear, the organisation has delegation without accountability. That is usually where inconsistent controls, audit findings, and policy exceptions begin to accumulate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 and NIS2 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | AML policy ownership depends on enterprise context across jurisdictions. |
| GV.RM-01 — Risk Management Strategy | Cross-country AML differences require a consistent risk strategy and governance model. | |
| Recommendation — Define the enterprise AML policy owner and align it to the organisation's operating context. Set a global AML risk strategy that local teams implement within approved bounds. | ||
| ISO/IEC 27001:2022 | A.5.1 — Policies for information security | AML policy changes need controlled policy ownership and approval discipline. |
| A.5.36 — Compliance with policies, rules and standards for information security | Jurisdictional AML differences require policy compliance and controlled exceptions. | |
| Recommendation — Maintain centrally approved policies with controlled, documented changes. Track local deviations and verify they remain compliant with applicable rules. | ||
| NIS2 | Article 21 — Cybersecurity risk-management measures | Shows governance and accountability expectations for managed controls, relevant by analogy to cross-border control ownership. |
| Recommendation — Assign accountable ownership for control updates and approval paths. | ||
Practitioner Guidance
What to prioritise: Assign ownership to the central compliance or financial-crime policy function first, then add jurisdictional review only where the law or regulator materially differs. Do not let local offices own the whole policy unless the enterprise has explicitly chosen a federated compliance model.
What to verify: Confirm that the policy owner controls versioning, approval, and exception handling, and that local reviewers are limited to jurisdiction-specific input. If a local team can change the policy unilaterally, the control model is already blurred.
Common mistake: Treating “local interpretation” as equivalent to “local ownership.” Interpretation can be distributed; accountability should not be.
Practitioner takeaway: The safest model is central accountability with local legal nuance, because AML policy fails when regional adaptation becomes independent regional policy.
Related resources from NHI Mgmt Group
- Who should own tenant-specific permission changes in a policy-driven model?
- Who should own help-desk verification policy when account changes affect IAM and PAM?
- Who should own the decision when automation changes security policy in critical environments?
- Who should own policy changes when workload access and network segmentation overlap?