The first line executes controls, the second line designs and challenges them, and the third line independently tests whether they work. When those responsibilities blur, accountability gaps appear in escalation, documentation, and oversight, which is itself a governance failure.
How accountability is split across the three lines
AML governance failures are usually not owned by a single function. The first line owns execution and day-to-day control performance, the second line owns policy, oversight, and challenge, and the third line provides independent assurance. In practice, accountability sits with the board and senior management for the overall framework, while each line remains accountable for its own obligations inside that framework.
That distinction matters because the three lines are not three separate excuses. If controls fail, investigators should ask whether the issue was execution, design, challenge, or assurance, and then trace it back to the business owner, control owner, or governance body responsible for the missed decision.
The first line cannot delegate operational ownership just because compliance reviewed the process. Likewise, the second line cannot claim success if it wrote policy but did not escalate persistent control weakness, and the third line cannot be treated as a control owner because it found a problem after the fact.
Where accountability becomes blurred in AML governance
Accountability failures usually appear when roles are described in principle but not enforced in practice. Common pressure points are unclear escalation paths, weak issue ownership, poor evidence retention, and overlap between monitoring, challenge, and testing activities. The problem is not only who performed the task, but who was supposed to notice a failure, drive remediation, and confirm closure.
That is why AML governance should be read as a chain of responsibilities, not a reporting line diagram. If a suspicious activity review, customer due diligence exception, or sanctions-related control defect moves through the organisation without a named owner, the control environment is already weakened even before a breach or regulatory finding occurs.
In mature programmes, the three lines operate with distinct artefacts: the first line produces operational records, the second line sets standards and challenges exceptions, and the third line tests whether the framework actually works. When those artefacts overlap too much, accountability gaps become almost inevitable because no one can prove who accepted the risk, who approved the deviation, or who is accountable for remediation.
What “accountable” means when AML governance fails
Accountability in this context means the ability to explain, defend, and remediate a governance outcome. The first line is accountable for performing controls correctly, the second line for designing proportionate oversight and raising issues, and the third line for independent testing and reporting. The board and executive committee remain accountable for governance tone, resourcing, and escalation when the issues are systemic.
That structure aligns with FATF Recommendations, the AML and KYC framework, because effective AML programmes depend on clear controls, risk-based oversight, and demonstrable monitoring. It also matches FinCEN guidance on AML obligations and suspicious activity reporting, where failure to establish clear operational and governance ownership quickly becomes a regulatory problem.
For firms operating in the EU, EBA AML/CFT guidance reinforces the same point: governance must be demonstrable, risk-based, and auditable. The practical test is whether the organisation can show who owned the control, who challenged it, and who signed off on the residual risk when exceptions were accepted.
Risk and Threat Considerations
When accountability is blurred, AML control failures can persist undetected because each line assumes another function is handling escalation or review. That creates exposure not only to regulatory findings, but also to concealment of suspicious activity, repeated onboarding weaknesses, and weak remediation of known control defects.
Failure mechanism: The first line treats issues as compliance matters, the second line treats them as operational defects, and the third line reports them without forcing ownership, so remediation stalls and the same control weakness recurs.
Impact: The organisation loses traceability over who approved the risk, which weakens evidence, delays escalation, and can turn a local process lapse into a systemic governance failure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 and SOC 2 (AICPA) define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CA-2 — Control Assessments | Independent testing of AML controls maps to control assessment and assurance. |
| CA-7 — Continuous Monitoring | AML oversight depends on ongoing monitoring of control performance and exceptions. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | AML governance failures often hinge on whether issues are reviewed and escalated from logs and evidence. | |
| Recommendation — Assess AML controls periodically and document results, findings, and remediation. Continuously monitor AML controls and escalate persistent weaknesses. Review audit evidence for AML exceptions and report unresolved findings. | ||
| ISO/IEC 27001:2022 | A.5.35 — Independent review of information security | Third-line independence parallels the need for independent review of control effectiveness. |
| A.5.36 — Compliance with policies, rules and standards for information security | AML governance depends on demonstrable compliance with internal policy and standards. | |
| A.5.37 — Documented operating procedures | Clear AML accountability requires documented procedures and ownership for control execution. | |
| Recommendation — Separate independent review from control operation and issue ownership. Measure AML performance against policy and escalate non-compliance. Document AML procedures with explicit owners, escalation points, and evidence. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | AML governance failures often surface in incomplete logs and weak evidence trails. |
| Recommendation — Retain and review logs that prove AML control execution and escalation. | ||
| SOC 2 (AICPA) | CC4.1 — Separate Evaluation | The third line's independent testing matches separate evaluation of control design and operation. |
| Recommendation — Maintain independent evaluation of AML governance and remediation. | ||
Practitioner Guidance
What to verify: Check that every AML control has a named business owner, a challenge owner in the second line, and a testing owner in the third line. The key is not just that the roles exist, but that issue logs, committee papers, and remediation plans show distinct accountability at each stage.
Common mistake: Treating “independent review” as a substitute for ownership. Independence is valuable, but it does not remove the need for a first-line control owner to fix defects and a second-line owner to challenge overdue remediation.
Practitioner takeaway: AML governance fails most often when organisations confuse separation of duties with separation of accountability; the strongest programmes make ownership visible in records, escalation, and closure, not just in policy.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org