##s that the cost of implementing the customer due diligence under the risk - based approach may be high at the early stage of implementation but the establishment of robust risk framework that commensurate with the risks of your institutions will minimise the institutions ’ reputational risk and would also lower the overall costs in the long - run given the ability for reporting institutions to focus resources to the right area. governance and risk culture let ’ s now turn to governance and risk culture. governance refers to actions, process, traditions and institutions by which authority is exercised and decision are taken and implemented. a good governance is, therefore, a mixture of legislation, non - legislative codes, self - regulation and best practices, structure, culture and management and board competency. if we take a step back and reflect, we will notice that risk governance is woven through the risk management framework. many elements of requirements for the risk management framework contribute to risk governance. for instance, the requirement for effective board audit and risk committee, regular reviews of the effectiveness of the framework and its implementation and so on. the board plays a critical role in risk governance. the board sets standards and expectations that would influence the culture and management of the business, and ultimately, the quality of risk governance. common shortcoming occurs when board fails to serve as a sufficient “ check and balance ” on the activities of the senior management, causing the business to focus excessively on short - term growth at the expense of long term stakeholders ’ interest. for this reason, bank negara malaysia places greater expectation on the roles and responsibility of board and senior management. this expectation can be found in many policy documents issued by bank negara malaysia since the past several years and specifically provided for in the financial services act ( fsa ) and the islamic financial services act ( afsa ). for an institution ’ s risk governance to be effective, there must be a strong risk culture which is consistent with the institution ’ s espoused values and risk appetite. you may asked, how does board assess risk culture? there isn ’ t simple and straightforward answer to this question. some institutions undertake “ climate review ” among its management and staff to gauge the culture whilst another approach could involve focus group. ultimately, audit, compliance and risk management functions would have opportunities in the course of their work to observe the risk culture throughout the business. from the regulator ’ s perspective, bis central bankers ’ speeches risk culture could be inferred and gauged based on the effective implementation

and level of compliance by the risk takers and the frontline staff. to improve risk culture, board and management must review the incentives and penalties in place and ensure that it is effectively implemented. among the key questions that board and management should be asking are ; does the performance management and compensation system reward good behaviour and punish bad behaviour? and how are audit and supervisory issues handled? as you already know, a weak risk culture may lead to staff resorting to “ check the box ” compliance exercise whilst a strong risk culture will judge the wisdom and decision of looking beyond the profit number and be able to see the medium and long term sustainability. on this note, allow me to share some of the key observations made by bank negara malaysia during the recently completed aml / cft thematic reviews on banks and insurance companies. first, the good news. in general, we observed that there was greater awareness among board and senior management on ml / tf risks and its potential implication to their reputation. from the aml / cft policies and framework implemented, there was also shift towards risk - based approach. in most of the institutions reviewed, the management of aml / cft was no longer viewed solely as a “ compliance ” job but more aligned and integrated with the bank ’ s overall risk management function. in addition, it is also worth noting that in terms of management information system ( mis ), more investments were made to either upgrade or enhance their existing mis to facilitate effective monitoring of suspicious transactions. this is encouraging. now let me share the not so good news. implementation of aml / cft policies and procedures, although has shown improvement as compared to the last review, is still an area that needs to be strengthened particularly with regards to cdd and customer monitoring. while we acknowledged that in almost all cases, cdd were conducted, the extent of due diligence in some instances were inadequate and not reflective of the level of money laundering and terrorist financing risks posed by the customers and / or transactions. we believe that to address this issue, strong risk culture must be inculcated and the performance and reward system should reflect that culture. self - regulation institutions with strong wisdom in risk governance and culture do not solely depend on the regulator and supervisor to tell them what to do. self - regulation is important, particularly for financial institutions. in performing the intermediary functions, depositors and shareholders depend on the decision and practice of the financial institutions to balance the risks and rewards in their