What should be Al's first step when creating an AML compliance program for an insurance company under the USA Patriot Act?

• A. Access the money laundering risks associated with the insurance product, clients, distribution channels, and locations
• B. Expand sales coverage
• C. Hire external consultants
• D. File a SAR on day one

Answer: (A)

The essential step is conducting a risk assessment to map money laundering risk across the business. Under the USA PATRIOT Act, an AML program must be risk-based, so you first identify where ML risk lies—across insurance products, the types of clients, the distribution channels, and the geographic locations involved. This upfront review creates the foundation for everything that follows: the policies and procedures you implement, the level of due diligence required (CDD/EDD), the monitoring and escalation processes, and where to allocate resources.

By understanding which areas pose the greatest risk, you can design controls that address those specific risks and ensure ongoing oversight is proportionate to danger. Filing a SAR on day one would not make sense because there’s no identified suspicious activity yet. Similarly, expanding sales coverage or hiring external consultants aren’t the steps that establish the AML framework; they may support compliance later, but the first step is clearly evaluating and prioritizing risk.