Compliance programmes across the financial sector

← Course home  ·  Free lesson

Building blocks

1. Board-approved policy on AML/CFT/CPF, reviewed regularly and communicated to all staff. At NGO-MFIs the CEO also issues an annual commitment statement.
2. Governance: a compliance unit and an officer in charge.
3. Risk assessment of customers, products, areas and channels.
4. Customer due diligence, screening and monitoring.
5. Reporting of suspicion (STR/SAR) and, for banks, CTRs.
6. Training and employee screening.
7. Independent testing by internal and external audit.
8. Records for at least 5 years.

CAMLCO and the compliance unit

The Chief Anti-Money Laundering Compliance Officer (CAMLCO) is the senior officer in charge and BFIU's contact point. A deputy (DCAMLCO) may be named.

• Banks (Circular 26): a Central Compliance Committee of at least 7 members; the CAMLCO no more than two steps below the MD/CEO; the DCAMLCO heading the AML and CFT division at DGM/SVP level or above; BFIU must be informed when the CAMLCO changes.
• NGO-MFIs (Circular 33): a Central Compliance Unit at head office under the CEO, led by the CAMLCO who reports directly to the CEO. It meets quarterly and keeps minutes. Branch, zone, district or divisional AML officers hold quarterly meetings and send minutes to the CCU. The CAMLCO and DCAMLCO details are kept current on BFIU's Compliance Officer Portal.

The other sectors have their own circulars, listed below. This course does not summarise their detailed structures: read yours and apply the same building blocks.

Programme by sector

In every sector the same building blocks apply: a board-approved policy, a named senior officer, risk assessment, CDD and screening, reporting, training, audit and five-year records.

Microcredit and microfinance institutions (NGO-MFIs under MRA): BFIU Circular 33 (2026)

Every MFI licensed by the Microcredit Regulatory Authority is a reporting organisation. Circular 33 (30 September 2026) asks for:

1. Policy: a board-approved AML/CFT/CPF policy, reviewed regularly and shared with staff, plus an annual commitment statement from the CEO.
2. Central Compliance Unit (CCU) at head office under the CEO, led by the CAMLCO (BFIU's contact point, reporting directly to the CEO), with a DCAMLCO if named. Details are kept current on BFIU's Compliance Officer Portal. The CCU meets quarterly and keeps minutes.
3. Field structure: a branch, zone, district or divisional AML compliance officer holds quarterly meetings on client identification, STRs, sanctions lists, records and training, and sends minutes to the CCU.
4. Client acceptance: no anonymous, fictitious or number-only accounts; no service to UNSC-listed, government-listed or banned persons.
5. Identification: full details with documents for any beneficiary receiving more than Tk 20,000 in a year; full KYC with photograph, verified (including field visits), for clients with a loan sanctioned or a deposit balance of Tk 1,00,000 or more.
6. Banking channel: transactions of Tk 1,00,000 or more go through a bank unless management approves an exception. Foreign donations come into one bank account, with a written expenditure policy.
7. Donors and partners: partner due diligence, kept at least 5 years; EDD for small or unsupervised grantees and for FATF high-risk links. Foreign donations need authority clearance and an annual external audit by a CA firm.
8. Sanctions screening: keep UNSC and Bangladesh lists electronically and screen clients and transactions regularly. On a match, suspend and tell BFIU by the next working day.
9. Reporting: field officer, then branch AML officer in writing, then the CCU, then BFIU through goAML (annex forms if goAML is not possible). No CTR duty is set for NGO-MFIs.
10. People and records: screen staff before and after hiring; train at least senior management, finance, compliance and project officials; keep records at least 5 years.

The field staff role: field officers disburse and collect loans and savings in cash, meet clients at home or in the group, and see the real situation first. They apply the client acceptance and KYC rules, notice red flags, and report in writing to the branch AML officer without tipping off.

Training and staff screening

Staff must know the law, the red flags and the reporting route. Circular 33 expects training at least for senior management, finance, compliance and project officials, with training records kept. Employees are screened before and after hiring (for example National ID, passport and certificates).

Audit and assurance

Internal audit should test the programme: is the policy current, are KYC files complete, were quarterly meetings held, are sanctions lists screened, and were suspicious cases escalated? NGOs with foreign donations also need an annual external audit by a chartered accountancy firm under Circular 33.

Consequences of failure

A reporting organisation that breaches section 25 can be fined Tk 50,000 to Tk 25 lakh and may lose a licence or branch. BFIU can fine for breaching its instructions, and responsible owners, directors and staff can be personally fined (Tk 10,000 to Tk 5 lakh under section 23(8)).

Key takeaways

• A compliance programme combines policy, governance, risk assessment, CDD, reporting, training, audit and records.
• The CAMLCO is BFIU's contact point and should report high in the organisation.
• Each sector has its own BFIU circular: banks 26, NBFIs 28, insurers 27, capital market 31, MFS 20, NGO-MFIs 33.
• NGO-MFIs set up a Central Compliance Unit that meets quarterly.
• Failure to comply can bring fines, licence action and personal liability.

Based on the Money Laundering Prevention Act 2012 (as amended 2015), the Anti-Terrorism Act 2009 and BFIU circulars, as understood on 16 October 2026. Laws and circulars change: always check the latest text on bfiu.org.bd. This course is general education, not legal advice. Cases marked "illustrative" are fictional.