Currency Controls

AML, CFT, KYP

What is anti-money laundering?

The fight against money laundering and terrorist financing serves global security, the integrity of the financial system and sustainable growth. AML and CFT laws exist to prevent the financial markets from being misused for either purpose.

The European Union and many other jurisdictions have adopted strong legislation against money laundering and terrorist financing, and competent authorities, working in networks, ensure that it is applied in practice.

IFB is licensed and supervised in the Union of the Comoros, Autonomous Island of Anjouan, by the Anjouan Offshore Finance Authority under licence L1149. Our AML/CFT programme is built on the FATF Forty Recommendations, the standard against which national regimes are themselves assessed.

Other frameworks apply where our counterparties sit. Correspondent relationships bring the requirements of the US Bank Secrecy Act indirectly into scope, and EU-facing activity engages the European framework. A programme built only to the local minimum does not survive correspondent banking diligence, which is why ours is not.

Our programme comprises:

  • written approval by a senior manager;
  • a risk-based customer identification programme sufficient to form a reasonable belief as to the true identity of each customer;
  • detection and reporting of suspicious activity;
  • independent testing of its implementation;
  • a named AML Compliance Officer with published contact details;
  • ongoing training of relevant personnel;
  • risk-based ongoing due diligence, including the beneficial ownership of legal-entity customers, understanding the nature and purpose of each relationship, and monitoring to keep customer information current.

The purpose of these rules is to detect and report suspicious activity, including the predicate offences to money laundering and terrorist financing, such as securities fraud and market manipulation.

The international framework

The Financial Action Task Force (FATF), created in 1989, sets the global framework for AML policy and assesses whether countries comply with it. National supervisors oversee the institutions in their jurisdiction, and the United Nations, the World Bank and the International Monetary Fund run AML programmes of their own.

AML puts best practice into the detection of suspicious activity. The easier it is for criminals to spend illicit money undetected, the more crime follows. AML regulation therefore requires “obliged entities” to know the red flags and to monitor their clients’ activity actively. Obliged entities are the institutions whose transactions money launderers could exploit: banks, payment processors, gaming and gambling businesses and others. In the EU, the European Banking Authority issues guidelines on supervision, and AML supervisors assess how effectively each institution performs its duties.

The European framework has changed shape. The directive-based architecture is being replaced by the 2024 AML package: Regulation (EU) 2024/1624, with directly applicable obligations; Directive (EU) 2024/1640, on supervision and financial intelligence units; and Regulation (EU) 2024/1620, establishing the Anti-Money Laundering Authority in Frankfurt.

In practice, obliged entities gain a single directly applicable rulebook in place of twenty-seven transpositions, an EU supervisor with direct competence over selected institutions, and a harmonised limit on cash payments. The package phases in, so confirm the applicable date of any specific obligation rather than assuming a single switchover.

How AML works in a bank

Banks sit at the foundation of the financial system and must spot suspicious behaviour early. Their AML policies follow the FATF framework; front-line staff are trained in AML techniques and are legally required to report suspicious activity. Dedicated AML compliance officers strengthen these practices, supported by three instruments: identity checks, settlement and release controls and transaction monitoring software.

Identity checks

Banks must follow know-your-customer (KYC) procedures to verify the identity of their clients. AML policy provides the framework, but each bank remains responsible for its own clients and for flagging high-risk transactions.

KYC requires banks to verify a client’s name, date of birth and address, and sometimes further information such as occupation. Clients usually prove their identity with official documents when opening an account, and banks increasingly use biometric identification, such as face or voice recognition and fingerprints.

Settlement and release controls

Incoming funds are released against cleared settlement, not against an advice of payment. Where a credit is unusual for the account, release may be held pending review. This is an internal control and a settlement-risk measure. It is not a regulatory holding period, and no AML framework prescribes one.

Transaction monitoring software

A bank handling large volumes of transactions cannot review each one by hand. Monitoring software checks transactions daily or in real time. It combines the account holder’s history, the risk assessment and the details of each transaction, such as the amount, the countries involved and the nature of the payment, across cash deposits, wire transfers and withdrawals. A transaction assessed as high risk is flagged as suspicious.

We follow the Wolfsberg Group Principles.

The Wolfsberg Group is an association of global banks that develops frameworks and guidance for managing financial crime risk, in particular KYC, AML and CFT policy. It first met in 2000 at the Château Wolfsberg in north-eastern Switzerland, with representatives of Transparency International, including Stanley Morris and Professor Mark Pieth of the University of Basel, to draft AML guidelines for private banking. The Wolfsberg AML Principles for Private Banking were published in October 2000 and revised in May 2002 and June 2012.

Transaction monitoring systems (TMS)

Transaction monitoring systems are the tools with which financial institutions and supervisors oversee transactions in the banking system. They identify activity that may indicate money laundering, terrorist financing or other financial crime. They work in seven steps:

  1. Data collection. The system gathers transaction data from across the bank: amount, date and time, parties and the nature of the transaction.
  2. Risk profiling. From these data it builds risk profiles of clients and transactions, based on the client’s history, usual transaction types and geography.
  3. Rule-based monitoring. Predefined rules are applied to every transaction, for example flagging amounts above a threshold or many transactions in a short period.
  4. Anomaly detection. Statistical models and machine learning identify transactions that depart markedly from the norm or from the client’s usual behaviour.
  5. Alerts. A flagged transaction generates an alert, which a compliance officer or investigation team reviews.
  6. Investigation and reporting. If the transaction remains suspicious after review, the bank investigates further and, depending on the outcome, files a suspicious activity report with the competent authority.
  7. Continuous learning. The results of investigations are used to refine the rules and models, so that detection becomes more accurate over time.

With a transaction monitoring system, a bank manages its risk better, meets its regulatory obligations and helps combat financial crime.

Countering the financing of terrorism (CFT)

IFB’s approach to countering the financing of terrorism rests on a layered framework of risk assessment, technology and cooperation with supervisors.

Foundations and the risk-based approach

Our CFT controls combine customer due diligence at onboarding, continuous transaction monitoring and escalation of flagged activity to human review. Models are reviewed and recalibrated on a defined cycle against internal outcomes and external typologies.

We publish no detection statistics. Figures of that kind are unverifiable by the reader and meaningless without the underlying methodology. What we will do is answer specific questions from correspondents and regulators, under the appropriate confidentiality.

Enhanced due diligence and surveillance

After initial screening, enhanced due diligence applies to higher-risk profiles:

  • Data analysis. Our algorithms analyse transaction data in real time and flag patterns and anomalies that depart from established norms.
  • Behavioural profiling. Historical data and predictive analysis form detailed behavioural profiles, so that red flags are identified early and passed for manual review.
  • Layered verification. Flagged transactions are verified by automated systems and by experienced staff together, so that intervention is both quick and considered.

Real-time monitoring and automated intervention

  • Machine learning. Our systems learn from changing transaction patterns and adapt to new threats; automated intervention follows when defined thresholds are exceeded.
  • Immediate escalation. A transaction identified as a potential risk is flagged at once and passed to secondary review, combining algorithmic precision with expert judgement.
  • Adaptive models. Our models are updated continuously on the basis of global intelligence and internal performance data, so that they keep pace with new typologies.

Cooperation

Terrorist financing does not stop at borders, and neither does our response. We work with national supervisors and international financial institutions to exchange insight and best practice:

  • Intelligence sharing. Participation in international forums and secure data exchange with partner institutions.
  • Joint task forces. Where a threat requires it, IFB contributes to joint task forces against terrorist financing.

Continuous improvement

Our CFT procedures are only as good as their last revision. We follow new trends in financial crime and integrate new methods into our procedures, so that we respond to emerging threats in close to real time.

Rigorous due diligence, sound technology and international cooperation together form a system that detects and deters the financing of terrorism and continues to develop. It protects the integrity of the international financial system and the security of our clients and partners.

Know your payee and verification of payee

IFB’s security framework combines know-your-payee (KYP) procedures, verification of payee (VoP) and our measures against the financing of terrorism (CFT) into a layered defence against fraud, money laundering and terrorist financing.

Know your payee (KYP)

Traditional controls look at the sender. KYP looks at the recipient, and ensures that the identity of every payee is established beyond doubt:

  • Identity validation. Every prospective beneficiary is checked against authoritative databases, using both static data and dynamic risk indicators.
  • Behavioural and transaction profiling. Algorithms analyse payment history and behaviour to build a risk profile and detect discrepancies that may indicate fraud.
  • Risk-based categorisation. Payees are classified by risk, and enhanced scrutiny applies where it is warranted, against money laundering and misdirected funds alike.

Verification of payee (VoP)

Verification of payee is not a courtesy. It is a legal obligation under Regulation (EU) 2024/886, the Instant Payments Regulation, which amends the SEPA Regulation (EU) No 260/2012.

Since 9 October 2025, every payment service provider in a euro-area member state that offers credit transfers must provide a VoP check to the payer before authorisation, free of charge. The obligation covers standard as well as instant SEPA credit transfers. Providers outside the euro area have until 9 July 2027.

How it works

  1. The payer’s provider submits the payee’s IBAN and name.
  2. The request is relayed to the payee’s provider through the SEPA scheme or a routing and verification mechanism.
  3. The payee’s provider checks its records and returns one of four results: match, close match, no match, or unable to verify.
  4. The payer receives the result and decides whether to proceed. The payment is not blocked automatically.

The point clients most often miss: where the payer authorises a transfer after being warned of a mismatch, the payer bears the liability for funds reaching an unintended recipient. The warning shifts the risk. Read it before you click through it.

The European Payments Council VoP Scheme Rulebook entered into force on 5 October 2025 and governs the mechanics between providers.

Countering the financing of terrorism

  • Customer due diligence. In line with strict KYC standards, every client is vetted from the outset.
  • Continuous transaction monitoring. Artificial intelligence and real-time analysis watch transaction flows and intercept signs of terrorist financing.
  • Adaptive risk assessment. Models refined continuously through machine learning provide risk scores that adapt to new threats.

One framework, several layers

  • Overall oversight. Beneficiary verification, analysis of payment instructions and continuous monitoring together leave no single point of failure.
  • Machines and people. Algorithms provide immediate detection; experienced staff provide in-depth review and context.
  • International cooperation. We work with supervisors and financial institutions worldwide, so that our measures follow current standards and threat intelligence.
  • Adaptability. Financial crime changes quickly, and our continued investment keeps our measures ahead of it.

Through KYP, VoP and CFT, every transaction at IFB is subject to rigorous scrutiny. The approach anticipates threats rather than waiting for them, and protects the integrity of the financial system.