A defensible AML/CTF program is one that operates effectively in practice and can be evidenced.
This means:
- risks are clearly identified
- controls are appropriate and applied
- decisions are documented
- governance is active
A program is not defensible because it exists. It is defensible because it works and can be demonstrated.