Written AML program and risk assessment
A dealer's program has four required parts. Its policies, procedures, and internal controls must rest on a risk assessment, and the program must be approved by senior management and available to FinCEN on request.
Risk-based controls
Built on an assessment of the products you sell; your customers, suppliers, and distribution channels; and the geographic locations involved. For purchases, we look at suppliers in higher-risk jurisdictions, unusual payment methods, and metal offered below market.
1027.210(b)(1)
Compliance officer
A designated person responsible for day-to-day compliance, with a written charter, authority, and escalation path.
1027.210(b)(2)
Ongoing training
Training for every employee whose role touches customers, transactions, or metal, sized to their roles.
1027.210(b)(3)
Independent testing
Testing by someone other than the compliance officer. The rule does not set a frequency; we recommend annually.
1027.210(b)(4)
We also write the operating procedures that sit under the program: Know Your Customer steps sized to a dealer (not a bank CIP), red-flag review, the escalation path, voluntary SAR decisions, and record retention.
You receive: a board- or management-ready program, a documented risk assessment, operating procedures, and the Regulatory Basis Addendum.