According to the Anti-Money Laundering Specialist (the 6th edition) by ACAMS, an institution's anti-money laundering program should be reassessed at least annually to ensure that it is current, effective, and compliant with the applicable laws and regulations. The reassessment should include a review of the institution's risk assessment, policies and procedures, internal controls, training, and independent testing. The reassessment should also consider any changes in the institution's products, services, customers, geographic locations, or business environment that may affect its exposure to money laundering and terrorist financing risks1.
The other options are not consistent with the best practices of maintaining an up-to-date anti-money laundering program. For example:
The program should be evaluated and updated at least every six months by the Board of Directors.
While the Board of Directors has the ultimate responsibility for overseeing the institution's anti-money laundering program, it is not required to evaluate and update the program every six months. This may be too frequent and impractical, especially for large and complex institutions. The Board of Directors should, however, approve the program and any significant changes, and ensure that senior management implements and enforces the program effectively1.
The program should be reviewed by a federal law enforcement officer for gaps in controls. While federal law enforcement agencies may conduct investigations or examinations of the institution's anti-money laundering program, they are not responsible for reviewing the program for gaps in controls. This is the role of the institution's internal audit function or an external independent party, who should conduct periodic testing of the program's adequacy and effectiveness1.
The program should be sent to the institution's government regulator on a periodic basis. While the institution's government regulator may request or review the institution's anti-money laundering program as part of its supervisory or enforcement activities, the institution is not obligated to send the program to the regulator on a periodic basis. The institution should, however, report any suspicious or unusual transactions or activities to the relevant authorities, such as the Financial Crimes Enforcement Network (FinCEN) or the Office of Foreign Assets Control (OFAC)1.
References:
Anti-Money Laundering Specialist (the 6th edition) by ACAMS

A financial institution located in a Financial Action Task Force (FATF) member country should address the following issues in its anti-money laundering program when dealing with customers located in countries/jurisdictions that are not members of FATF:
The requirement to identify the beneficial owners of accounts: Beneficial owners are the natural persons who ultimately own or control a customer or a legal entity. Identifying the beneficial owners of accounts is a key component of customer due diligence (CDD) and helps the financial institution to assess the risk profile of the customer, prevent the misuse of legal entities for money laundering or terrorist financing, and comply with the FATF Recommendations12.
The requirement for customer identification for the opening of new accounts: Customer identification is the process of verifying the identity of a customer using reliable and independent sources of information or documents. Customer identification is another essential element of CDD and helps the financial institution to establish a business relationship with the customer, prevent identity fraud, and comply with the FATF Recommendations13.
The financial institution's obligation to report suspicious transactions: Suspicious transactions are transactions that have no apparent economic or lawful purpose, or are inconsistent with the customer's known profile or business activities, or indicate involvement in money laundering or terrorist financing. Reporting suspicious transactions to the competent authorities is a core obligation of the financial institution under the FATF Recommendations14 and helps to detect and deter illicit activities and support law enforcement investigations.
The obligation to freeze funds involved in suspicious transactions is not an issue that should be addressed in the anti-money laundering program, as it is not a requirement under the FATF Recommendations. The FATF Recommendations require the financial institution to freeze funds or other assets of designated persons and entities that are subject to targeted financial sanctions related to terrorism, proliferation of weapons of mass destruction, or other threats to the international financial system1 . However, the financial institution is not obliged to freeze funds involved in suspicious transactions, unless it receives a specific order from the competent authorities or the courts.
References:
The FATF Recommendations, as amended November 2023
Interpretive Note to Recommendation 10 (Customer Due Diligence), paragraphs 5(b) and 6 Recommendation 10 (Customer Due Diligence), paragraph 1 Recommendation 20 (Reporting of Suspicious Transactions) Recommendation 6 (Targeted Financial Sanctions Related to Terrorism and Terrorist Financing), Recommendation 7 (Targeted Financial Sanctions Related to Proliferation), and Recommendation 8 (Non-Profit Organisations)

Explanation
Senior management bears the ultimate responsibility for approving a financial institution's relationship with a politically exposed person (PEP). The institution must ensure that appropriate measures are taken to manage the risks associated with a PEP, including conducting enhanced due diligence and applying appropriate mitigating measures. The relationship manager and the OKYC analyst may identify the risks associated with the PEP and recommend mitigating measures, but it is ultimately the responsibility of senior management to approve the relationship and ensure that the appropriate measures are taken. The enhanced due diligence compliance officer is responsible for ensuring that all due diligence requirements are met.

Explanation
The following high-level principles apply for both FATF and FSRBs.* Role: FSRBs play an essential role in identifying and addressing AML/CFT technical assistance needs for their individual members. In those FSRBs that carry out this coordination work, technical assistance necessarily complements mutual evaluation and follow-up processes by helping jurisdictions to implement FATF standards.

According to the FATF Recommendation 10, financial institutions should conduct ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the institution's knowledge of the customer, their business and risk profile, including, where necessary, the source of funds. This is one of the core measures of customer due diligence (CDD) that aim to prevent and detect money laundering and terrorist financing risks.
References: = The main reference for this question is the document titled "International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations" published by the FATF in February 2018. You can access it by clicking here. You can also find more information about the CDD measures and the risk-based approach on the FATF website, the CFATF website, the Central Bank of Ireland website, and the Medium blog.