The AML compliance officer: what the role owns in a cross-border payment business

Every AML programme has one person whose name is on it. In the United States that is not a convention, it is a rule. 31 CFR 1022.210 requires a money services business to designate a person to assure day to day compliance, and 31 CFR 1020.210 requires the same of a bank. The AML compliance officer is that person. The title is common and the role is badly understood. Many firms treat it as a senior analyst with a longer job description. An examiner treats it as the control that makes every other control real.

This article sets out what the role owns in a cross-border payment business, what authority and independence mean in practice, what a stablecoin settlement leg adds to the job, and the evidence a reviewer asks for. It is general information, not legal advice.

What does the AML compliance officer requirement actually say?

The requirement is short, and often read too lightly. In the United States the AML programme rule sets out four elements for banks and for money services businesses alike: internal controls, independent testing, training, and the designation of an individual responsible for coordinating and monitoring day to day compliance. 31 CFR 1020.210 carries that for banks and 31 CFR 1022.210 for money services businesses. For federally insured credit unions, the NCUA rule at 12 CFR 748.2 requires the same programme.

Canada frames it as five elements rather than four. FINTRAC compliance programme guidance requires a reporting entity to appoint a compliance officer, keep written policies and procedures, carry out a risk assessment, run a training programme, and review the whole programme for effectiveness, which the regulations set at least every two years. The appointment comes first in that list because the other four need an owner.

The interpretive note to FATF Recommendation 18 requires compliance management arrangements that include the appointment of a compliance officer at the management level. Management level is the operative phrase. A designation that sits below the level where decisions are made does not meet it.

Who can hold the role, and what does independence mean?

The rules do not list qualifications. The examination manuals fill that gap. The FFIEC BSA/AML Examination Manual expects a qualified individual with sufficient authority, independence and resources, designated deliberately by the board or senior management rather than by default. Three things follow.

First, authority has to be real. The officer must be able to stop a payment, refuse an onboarding, and raise an item with the board without asking the business line that loses the revenue. If the officer can only recommend, the firm has a committee, not a designated person.

Second, independence is about incentives, not the org chart. An officer who also carries a sales target, or who personally releases payments, is compromised in the one moment that matters. Small firms cannot always avoid that. Where the role is combined, record the conflict, set out what the officer may not approve alone, and widen the scope of the independent review.

Third, delegation is allowed and transfer of the duty is not. The officer can hand screening, filings and training delivery to a team. The duty stays with the named person. In a firm with offices in more than one country that usually means one designated officer, local deputies, and a written split of who decides what.

What does day to day compliance mean in a cross-border payment business?

The phrase in the rule is day to day compliance, so the role is operational and not advisory. In a cross-border payment business the work divides into decisions, governance and reporting.

The decisions are the part that cannot be passed sideways. Approving a high risk customer. Approving enhanced due diligence before a relationship goes live. Holding or releasing a payment that a screening alert touched. Deciding whether a suspicious activity report is filed, and signing the narrative. Deciding when a counterparty or a whole corridor is closed.

The governance is slower and easier to let slip. The officer owns the enterprise risk assessment, the policies that answer to it, the screening and monitoring configuration, the training plan, the record retention schedule, and the response to regulatory change. Each of those carries a review date. The officer is the one who has to notice when a date passes.

The reporting closes the loop. Senior management and the board need a periodic report they can act on: alert and case volumes, filings made, overdue reviews, screening performance, open audit findings, and the risks the officer cannot fix alone. A report that says only that the programme is operating as expected tells the board nothing and protects nobody.

The test of the role is not whether the compliance officer wrote the policy. It is whether a payment can leave the building, against that policy, without their decision.

What changes when the settlement leg runs in stablecoins?

The obligations do not change. The surface the officer has to govern does. Settling in a regulated stablecoin on a public blockchain adds decisions that have no analogue in a correspondent banking flow, and they are compliance decisions rather than engineering ones.

Five of them sit with the officer. Which chains and which assets the firm will settle in, with the written basis for each. The wallet screening standard applied to incoming value and to payout addresses, including the exposure level at which a payment is held. The Travel Rule arrangements with each counterparty, and what happens in the gap where a counterparty cannot receive the data. The verification of a payout address with the same care as a bank account number, because a changed address is the same fraud as a changed payee. The right to halt settlement during a depeg, a chain halt or an issuer freeze, and who exercises it.

Key governance needs the officer sign off too, even though custody sits with treasury or operations. Who can sign a transfer, how many approvals a payout needs, and how those approvals are evidenced are AML programme questions, because they are the controls that stop value leaving without a decision.

One part of the job gets easier. The settlement record is permanent, timestamped and open to independent checking, so the trail behind a payment is stronger than a chain of correspondent messages. The officer should be able to read that record, or should have named someone who can.

How do you build the role so it survives an examination?

Examiners test a designation the same way every time. They ask who the officer is, what authority that person holds, what they decided, and what evidence exists. The sequence below produces that evidence as a by-product of doing the work.

• Make the designation formally. A board or senior management resolution naming the individual, the date, the reporting line and the authority granted, filed with the programme documents.
• Write the role down. A description that lists the decisions the officer owns, the ones that are delegated, and the ones that need a second approver.
• Size the resources against the risk assessment. Headcount, systems and budget should trace to the volumes and risks the assessment describes, and any shortfall should be reported.
• Give the officer direct access to the board. A standing reporting line, a recorded periodic report, and the ability to raise an item without the business line agreeing first.
• Keep a decision log. Every approval, hold, release, escalation and filing decision, with a date, a reason and the evidence relied on.
• Name a deputy and test the handover. An absent officer is a gap, and a review will find it in the dates where nothing was decided.
• Track findings to closure. Audit and review findings assigned to named owners with due dates, followed up by the officer rather than by the auditor.

What personal liability does an AML compliance officer carry?

The entity carries most of the enforcement risk, but not all of it. FinCEN has assessed a penalty against an individual compliance officer: its 2017 settlement with the former chief compliance officer of MoneyGram resolved a $1 million assessment for $250,000 and a three year bar from compliance work at a financial institution.

The exposure was not a failure to prevent fraud outright. It was that specific evidence about agents was known and the programme did not act on it. Documented decisions are the defence. An officer who recommended a closure in writing, and was overruled above them, stands in a very different place from one who left no record.

Canada works mainly through administrative monetary penalties on the entity, which FINTRAC publishes. The appointment record and the effectiveness review are among the first things a reviewer asks for, so the designation is also the first place a programme is shown to be real or shown to be paper.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross-border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Settlement runs in regulated stablecoins such as USDC and USDT on public blockchains and completes in minutes with on-chain auditability, and because the platform is ISO 20022 native, with pacs.008 customer credit transfers, pacs.009 interbank legs, pacs.002 status reports and pacs.004 returns tracked end to end by UETR, the decisions a compliance officer owns sit next to the payments they govern rather than in a separate system. KYB and KYC onboarding, KYT, sanctions and PEP screening, FATF Travel Rule data in IVMS101 form, a compliance workbench and a tamper-evident audit trail give the officer one place to approve, hold and record, and one record to hand a reviewer afterwards.