An exclusive article by Fred Kahn

The Target Operating Model (TOM) is one of the most important but least understood components of an anti-money laundering (AML) framework. At its simplest, it is the blueprint of how an institution intends to run its AML program. At its fullest, it is the living system that links policy to practice, clarifies responsibilities across governance layers, and ensures that people, processes, technology, and data operate in harmony to identify, manage, and report financial crime.

Without a clearly defined TOM, even the best policy manuals or the most advanced monitoring platforms will produce inconsistent results. Gaps in accountability lead to missed red flags, inefficiencies slow down investigations, and regulators lose confidence in the institution’s ability to control its risks. With a well-designed TOM, financial institutions achieve much more than compliance. They gain operational efficiency, resilience to evolving risks, and credibility when supervisors scrutinize their frameworks.

A TOM is crucial because AML is no longer a checklist exercise. Regulators expect firms to demonstrate a risk-based approach — one that reflects the actual risks of their business model, assigns responsibilities transparently, and adapts as threats change. The TOM is how an institution explains, both internally and to supervisors, exactly how it intends to live up to that expectation.

AML Target Operating Model and the Three Lines of Defense

At its core, the AML Target Operating Model is the architecture that connects vision to execution. It provides the structure for how strategy, governance, and operations interact. It covers multiple dimensions: governance and oversight, policies and procedures, risk taxonomies, customer lifecycle processes, monitoring workflows, supporting technology, quality of data, and the people who operate within the system.

A TOM is not static. It must evolve with the institution’s overall business strategy, with changes in regulation, and with emerging patterns of financial crime. A design that works today may be outdated within two years if it does not anticipate how risks will evolve.

A central feature of every TOM is how it defines the three lines of defense:

• First line of defense: The business. This includes relationship managers, operations staff, and product teams. They are responsible for identifying and managing financial crime risks in their daily activities, from onboarding customers and performing due diligence to executing and monitoring transactions. If the first line does not actively own AML risks, the entire framework becomes reactive rather than preventative.
• Second line of defense: Compliance and risk oversight. The compliance function provides the rules and monitoring. It designs the AML program, sets the policies, and challenges the business where weaknesses appear. It must be sufficiently independent to enforce accountability but also integrated enough to understand operational realities.
• Third line of defense: Internal audit. Internal audit offers independent assurance that the first and second lines are working as intended. It tests the effectiveness of the TOM, evaluates whether policies and processes are embedded in practice, and reports directly to senior management and the board.

A well-defined TOM ensures that these boundaries are explicit. When overlaps occur, duplication and wasted effort follow. When gaps exist, risks go unmanaged. Regulators increasingly view clarity across the three lines not as a best practice, but as a minimum expectation.

Challenges in Defining the AML Target Operating Model

Designing a TOM is notoriously complex because it requires institutions to balance multiple, often conflicting, demands. Among the most pressing challenges are:

• Translating policy into practice. Many policies look robust on paper but remain vague at the operational level. For example, a policy may state that enhanced due diligence is required for high-risk customers. The TOM must specify who performs this task, what information is collected, which systems support it, and how escalations are triggered. Without this level of detail, policies remain aspirational rather than actionable.
• Reconciling competing stakeholder interests. Compliance leaders want frameworks that minimize regulatory exposure, IT teams push for stability and cost efficiency, and front-office staff focus on customer experience. The TOM must satisfy all three perspectives, which often conflict. Designing without structured governance can result in a model that favors efficiency over defensibility, or one that slows business processes unnecessarily.
• Complexity of risk models. Customers, products, geographies, and delivery channels are rarely uniform across a large institution. A bank operating in both Europe and Asia may face different local expectations for how risk scores are assigned. The TOM must harmonize these models enough to show consistency to regulators while preserving flexibility for local adaptation.
• Technology constraints. A TOM that assumes seamless data integration may falter if the institution still relies on siloed legacy platforms. Poor data quality adds further difficulty, as inaccurate or incomplete data limits the effectiveness of even the most advanced monitoring tools.
• Regulatory scrutiny. Supervisors no longer accept broad assurances. They expect institutions to demonstrate the rationale for their TOM, including why resources are allocated as they are and how processes reflect the principle of proportionality. This requires documentation, audit trails, and evidence that the TOM is not just conceptual but operational.
• Cultural resistance. Staff frequently view AML as a cost rather than a value-adding activity. Embedding new workflows, especially those that increase workload or demand new skills, often meets resistance. Without strong change management, the TOM may exist in design but fail in execution.
• Future-proofing. Financial crime evolves quickly. A TOM built only for traditional laundering patterns may be obsolete when faced with crypto-related risks or cyber-enabled fraud. TOMs must be designed with adaptability in mind, allowing for modular updates rather than requiring complete redesign.

Key Elements of a Robust Target Operating Model

Despite these challenges, successful institutions focus on ensuring their TOMs include certain fundamental characteristics:

• Policy alignment. Every policy requirement must connect directly to a control or process. Generic statements are insufficient; the TOM must show exactly how compliance obligations are operationalized.
• Strong governance. Clear escalation routes, decision-making bodies, and reporting lines prevent confusion and delay.
• Defined roles. Responsibilities across the three lines of defense must be specific and documented, with no duplication or gaps.
• Risk-based approach. Risk models should reflect the true profile of the institution rather than simply regulatory minimums. Calibration must be ongoing, not one-off.
• Integrated technology. Systems should support end-to-end AML processes, from customer onboarding and screening to transaction monitoring, investigations, and regulatory reporting.
• High-quality data. Data is the fuel of AML. The TOM must establish ownership of data quality, accuracy, and completeness across the organization.
• Change management and culture. Embedding the TOM requires investment in staff training, communication campaigns, and incentives for ownership of AML responsibilities.
• Scalability. The TOM must be modular enough to adapt to emerging risks and flexible enough to integrate new technologies.

Consequences of Weak or Absent Target Operating Models

Institutions that neglect to define or maintain their TOM face significant consequences:

• Regulatory penalties. Increasingly, fines are imposed not just for failures in transaction monitoring or reporting, but for weaknesses in governance and frameworks.
• Operational inefficiency. Ambiguity in roles or processes leads to duplication, manual rework, and delays in investigations. Costs rise while effectiveness falls.
• Reputational harm. Failures in AML frameworks are highly publicized, damaging trust with clients, investors, and regulators.
• Strategic missteps. Without a TOM guiding technology choices, institutions risk over-investing in systems that do not match their needs, locking themselves into costly and ineffective solutions.

---

Related Links

• FATF – Financial Action Task Force
• European Banking Authority (EBA) AML Guidelines
• Financial Conduct Authority (FCA) Financial Crime Guide
• Financial Crimes Enforcement Network (FinCEN)

Other FinCrime Article About Key Market Practice

• What Financial Institutions Look For in an AML Training Provider
• Summer Series #23: The High-Stakes Required Evolution Of Sanctions Screening Controls
• Summer Series #21: Strengthening Defenses as AML in Trade Finance Evolves

Some of FinCrime Central’s articles may have been enriched or edited with the help of AI tools. It may contain unintentional errors.

Want to promote your brand with us or need some help selecting the right solution or the right advisory firm? Email us at info@fincrimecentral.com; we probably have the right contact for you.