The Evolution of 3 Lines of Defence Ruth Hutchinson Head of Financial Crime Compliance

Learning Objectives Review the history of the 3 lines of defence model; what have we learned since it was introduced? Evaluate its current use in managing financial crime risk. Consider ways in which the model might be changing in response to the rapidly evolving risk environment.

History of 3LoD Where did it all begin? Military strategy! Financial scandals Economic crisis Financial crime The need for a flexible, adaptable model of risk management Application to financial crime prevention Discuss some of the drivers of needing a 3LOD model. Apply this to how 3LOD model helps to manage risk Discuss then how this relates to financial crime risk management

The Traditional Model 1st Line Business Units 2nd Line Customer facing First to detect any risk issues Apply risk management controls and mitigators Best informed about the firm’s exposure to risks 1st Line Business Units Subject matter experts Oversee and challenge risk management approach Horizon scanning Design risk management framework 2nd Line Risk and Compliance Independent oversight Objective review and testing Provide challenge 3rd Line Audit

Does it work? Benefits Challenges Clarifies risk management accountabilities Difficult to understand and apply Strengthens governance approach Lack of clarity of roles Supports embedding a strong culture Not consistently applied Encourages dialogue Siloed 2LOD Doesn’t take account of technologies Other points of discussion for negatives: Misaligned incentives for risk takers in 1LOD Lack of organisational independence for those in 2LOD Lack of skills and expertise in 2LOD, lack of business awareness Use examples appropriate to FC risk management to illustrate

What’s next? Evolution. Board/Audit Committee Regulatory supervisors Senior Management 1st line of defence. Functions that own and manage risk Risk Management Controls Risk ownership 2nd line of defence. Oversee controls Compliance SMEs Risk Financial Crime Policy & Advisory 3rd line of defence Independent assurance Audit External Audit Reference discussions currently being held in Europe post the Danske Bank Estonian branch scandal. Last week, the European commission put forward proposals to create the EU’s first genuine cross-border anti-money laundering force. The European Banking Authority will see its relevant investigations team increased from two people to 10, and the agency is to be handed the power to intervene where it believes national regulators are failing. But its mandate is limited to taking action against banks – it cannot prosecute their criminal customers. https://www.theguardian.com/business/2018/sep/12/european-commission-banking-authority-anti-money-laundering-powers 3 Lines of Defence 4th Line of Defence https://www.bis.org/fsi/fsipapers11.pdf

Thank you