The board of directors is ultimately responsible for ensuring that the financial institution has an effective anti-money laundering program that complies with the applicable laws and regulations. If the institution receives a regulatory enforcement action, the board should take prompt and corrective actions to address the deficiencies and mitigate the risks of further violations or penalties. One of the most important actions is to instruct the compliance officer to develop a plan to remediate the institution's anti-money laundering program, which should include a root cause analysis, a gap assessment, a timeline, and a budget. The board should also monitor the implementation and progress of the remediation plan, and communicate with the regulators on a regular basis.
The other options are not appropriate actions for the board of directors to take in response to a regulatory enforcement action. Terminating the compliance officer and staff may not solve the underlying issues of the anti-money laundering program, and may create more disruption and instability. Purchasing and installing a new suspicious activity monitoring system may not be necessary or sufficient to address the deficiencies, and may entail additional costs and challenges. Hiring an attorney to protest the enforcement action may not be in the best interest of the institution, and may antagonize the regulators and escalate the situation.
References:
CAMS Certification Package - 6th Edition | ACAMS, Chapter 5: Risk Management, Section 5.2:
Regulatory Examinations and Enforcement Actions, pp. 171-174.
CAMS Certifications: How to Get CAMS Certified | ACAMS, CAMS Examination Preparation Guide, Section 3: Regulatory Compliance, pp. 23-24.

The compliance officer should perform the first step of reviewing the institution's risk assessment before implementing any changes to the customer onboarding program. The risk assessment is a key component of the AML compliance program, as it identifies and measures the institution's exposure to money laundering and terrorist financing risks. The risk assessment should be updated regularly and reflect the institution's products, services, customers, geographic locations, and delivery channels. By reviewing the risk assessment, the compliance officer can determine the adequacy and effectiveness of the current customer onboarding program and identify any gaps or weaknesses that need to be addressed. The compliance officer can also benchmark the institution's risk assessment against the regulatory expectations and best practices in the industry.
The other steps are also important, but they should be performed after the risk assessment review. Revising training materials for frontline staff, conducting enhanced due diligence on high risk customers, and resolving substantive discrepancies in customer verification are all part of the customer onboarding program, but they depend on the risk assessment to provide the appropriate level of controls and procedures. For example, the training materials should reflect the risk assessment results and the revised customer onboarding policies. The enhanced due diligence should be applied to customers who pose a higher risk according to the risk assessment criteria. The customer verification should be consistent with the risk assessment and the customer identification program.
References:
* AML KYC Onboarding Lifecycle Process Flow | Guide - AdvisoryHQ
* New EBA AML Guidelines on the use of Remote Customer Onboarding Solutions - Bird & Bird
* KYC Onboarding Process 2023 - AML requirements - Sumsub
Review of any AML/CFT program begins with the Risk Based Approached. It should first check the internal system to identify risk factors and design program accordingly.

The auditor should include the regulatory violation in the audit report and report it to the board of directors.
This is because the auditor has the responsibility to report any findings of non-compliance or material weaknesses in the institution's internal controls, policies, and procedures. The auditor should also provide recommendations for corrective actions and follow-up on their implementation. The board of directors has the ultimate oversight and accountability for the institution's compliance program and should be informed of any significant issues or risks that may affect the institution's reputation, operations, or regulatory status12.
References:
1: CAMS Certification Package - 6th Edition | ACAMS, Chapter 6: Developing an Effective Anti-Money Laundering Program, p. 125-126 2: The Wolfsberg Group, The Wolfsberg Anti-Money Laundering Principles for Correspondent Banking, October 2014, p. 7,
https://www.wolfsberg-principles.com/sites/default/files/wb/pdfs/Wolfsberg-Correspondent-Banking-Principles-