The CBN AML/CFT Compliance Handbook

Because the CBN isn't asking whether you own software anymore. It's asking whether the software actually works, end to end, with evidence you can show an examiner. A system that exists but isn't configured properly, or isn't watched closely, doesn't meet the standard either. Owning the tool and running it well are two different things, and the circular only cares about the second one.

You have more time, not less urgency. Twenty-four months sounds generous until you map out what actually needs to change in your onboarding, screening, and monitoring stack. Most of that work doesn't compress well into the final few months, so the extra time is for building it properly, not for waiting.

Passing an examination with policies that don't reflect how your systems really work. That gap doesn't stay hidden. It shows up the first time a real case moves through your process, and the audit trail doesn't hold together, or a sanctions hit in one system never reaches the team that needed to see it.

Because leaving the list proves the country can supervise effectively, and a regulator that just proved that doesn't want to test it again. Re-listing is a real risk the CBN is motivated to avoid, and that motivation lands on individual institutions as closer scrutiny, not less of it.

It's normal for most alerts to close as no action. It becomes a problem when the volume is so high that your team starts clearing the queue instead of actually reviewing it. If you can't say with confidence why a rule was tuned down, that's usually the sign the rate has crossed from acceptable into risky.

The system can't be the accountable party. The CBN still expects a designated MLRO with real authority and direct board access, because someone has to make judgment calls a rule engine can't make, like whether a report should be filed even when nothing technically fired. Technology handles the volume. A person still has to own the decision.