Topic starter
09/06/2026 11:58 pm
TL;DR: Risk-based AML programmes are increasingly pressured by fast payments, digital onboarding, complex products, and multi-geography operations, and Veriff argues that static, checklist-style compliance fails to control LD/FT in practice. That makes governance, EWRA calibration, perpetual CDD, and evidence-backed investigations the core operating model, not optional hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by Veriff: “Mejores prácticas del programa de cumplimiento de PLD”.
Key questions
Q: What breaks when AML programmes stay static while risk changes?
A: Static AML programmes start to satisfy documentation requirements without controlling live risk.
Q: Why do fast payments and digital onboarding increase AML governance risk?
A: They compress the time available to assess and react to risk, which means old review cycles and fixed thresholds become stale faster.
Q: How do teams know whether AML monitoring is actually effective?
A: They should test both alerted and non-alerted activity, then compare outcomes against the institution’s risk exposure and typologies.
Practitioner guidance
- Define clear AML accountability Assign ownership, supervision and escalation across the first, second and third lines so AML decisions cannot drift between teams or depend on informal handoffs.
- Use EWRA outputs to calibrate controls Link enterprise risk assessment results directly to monitoring scenarios, CDD depth, sanction screening intensity and investigation thresholds.
- Operationalise event-driven CDD triggers Trigger reviews when customer risk, transaction patterns, negative information or product use changes instead of waiting only for periodic review cycles.
Bottom line: Static AML programmes struggle because risk changes faster than calendar-based controls can absorb it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/06/2026 2:32 am
Static compliance has become the wrong operating model for AML. The article shows that modern LD/FT risk changes too quickly for checklist governance to keep pace. Fast payments, digital onboarding, complex products, and cross-border operations create a moving target that static policy cannot absorb. Practitioners should treat AML as a continuously calibrated control system, not a documentation exercise.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- That remediation lag matters because 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: What do organisations get wrong about transaction monitoring in AML?
A: They often treat monitoring as a volume problem rather than a calibration problem. The real issue is whether scenarios are aligned to the organisation's typologies and risk exposure, whether thresholds are set realistically, and whether investigators can explain decisions consistently when alerts are reviewed.
👉 Read our full editorial: Risk-based AML compliance programmes need stronger governance
11/06/2026 1:32 am
Static compliance has become the wrong operating model for AML. The article shows that modern LD/FT risk changes too quickly for checklist governance to keep pace. Fast payments, digital onboarding, complex products, and cross-border operations create a moving target that static policy cannot absorb. Practitioners should treat AML as a continuously calibrated control system, not a documentation exercise.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- That remediation lag matters because 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: What do organisations get wrong about transaction monitoring in AML?
A: They often treat monitoring as a volume problem rather than a calibration problem. The real issue is whether scenarios are aligned to the organisation's typologies and risk exposure, whether thresholds are set realistically, and whether investigators can explain decisions consistently when alerts are reviewed.
👉 Read our full editorial: Risk-based AML compliance programmes need stronger governance
12/06/2026 3:07 am
AML governance is the control layer that decides whether risk-based compliance is real or performative. The article shows that policies, screening tools and monitoring rules do not compensate for weak ownership, unclear accountability or poor escalation. When governance is thin, the programme may still produce records, but it will not reliably separate managed risk from unmanaged risk. Practitioners should treat governance as the operating system for every downstream AML control.
A question worth separating out:
Q: What is the difference between periodic KYC reviews and event-driven CDD?
A: Periodic KYC reviews occur on a schedule, while event-driven CDD is triggered by a material change in customer risk, activity or adverse information. The first manages time-based recertification, but the second catches risk changes that happen between calendar reviews, which is increasingly important in digital, fast-moving AML environments.
👉 Read our full editorial: Risk-based AML compliance programmes need stronger governance