According to the Basel Committee on Banking Supervision guidelines, the internal audit function should evaluate the adequacy and effectiveness of the bank's compliance function and its compliance risk management framework1. This includes assessing the compliance risk inherent in the bank's activities, products, services, and systems, as well as the compliance policies, procedures, controls, and reporting mechanisms2. The internal audit function should also review the transactions and records of the bank to ensure compliance with applicable laws, regulations, and internal standards3.
The other statements are incorrect because:
B: An internal audit program of adequacy of the bank's compliance function should be established, but should not include review of transactions. This statement is false because the internal audit function should review the transactions and records of the bank to ensure compliance, as mentioned above3.
C: The compliance function and internal audit function should be combined. This statement is false because the compliance function and the internal audit function should be separate and independent from each other, to avoid conflicts of interest and ensure objectivity and credibility.
D: The auditors should not discuss internal audit findings with compliance management to maintain independence. This statement is false because the internal audit function should communicate and coordinate with the compliance function on a regular basis, to share information, insights, and recommendations, and to avoid duplication of work. However, the internal audit function should maintain its independence and report directly to the board of directors or the audit committee.
References:
1: The internal audit function in banks, Principle 10, p. 9
2: The internal audit function in banks, Principle 10, p. 10
3: The internal audit function in banks, Principle 10, p. 11
4: The internal audit function in banks, Principle 2, p. 4
5: The internal audit function in banks, Principle 10, p. 11

One of the main challenges and risks for online banks is the verification of customer identity and the prevention of identity fraud. Online banks are more vulnerable to money laundering and terrorist financing because they do not have face-to-face contact with their customers and may rely on third-party sources or digital methods to verify customer information. Therefore, the most important recommendation for the anti-money laundering expert to make is that the online bank ensures that prospective new customers can be properly identified and that their identity documents and information are verified using reliable and independent sources. This is also in line with the international standards and best practices for anti-money laundering and counter-terrorist financing, such as the FATF Recommendations, the Basel Committee on Banking Supervision principles, and the EU's Fifth Anti-Money Laundering Directive123 The other options are less important or less effective than ensuring customer identification. Limiting the amount that can be processed per transaction may reduce the exposure to large-scale money laundering, but it does not prevent the use of multiple transactions or accounts to launder smaller amounts. Setting up automated programs to analyze transactions for money laundering activity may enhance the detection and reporting of suspicious transactions, but it does not address the root cause of money laundering, which is the concealment of the source and ownership of illicit funds. Ensuring that a firewall is set up to protect the transactions may improve the security and confidentiality of the online banking system, but it does not prevent the misuse of the system by money launderers who have legitimate access to the system123 References:
* 1: Anti-Money Laundering Guide for Digital Banks by sanctions.io, 2022
* 2: The fight against money laundering: Machine learning is a game changer by McKinsey, 2021
* 3: FATF Guidance on Digital Identity, 2020

Explanation/Reference: https://www.wolfsberg-principles.com/sites/default/files/wb/pdfs/faqs/17.%20Wolfsberg-Risk- Assessment-FAQs-2015.pdf (10)

A large cash deposit is a red flag for money laundering when it is inconsistent with the customer's profile, behavior, or business activity. A customer who has never conducted a transaction in cash before may be trying to avoid detection or conceal the source of the funds. A customer who transacts in segments smaller than the reporting thresholds at various times during the day may be engaging in structuring or smurfing, which are techniques to evade currency transaction reporting requirements. A customer who follows a large cash deposit with an immediate wire transfer to an offshore secrecy haven may be attempting to layer or move the funds to a jurisdiction with weak anti-money laundering controls or high confidentiality. These scenarios indicate a high risk of money laundering and warrant further investigation and reporting.
A customer who operates a cash-based business may have a legitimate reason to make a large cash deposit, depending on the nature and scale of the business. However, this does not mean that the customer is exempt from scrutiny or monitoring, as cash-based businesses are also vulnerable to money laundering abuse. The bank should verify the source and purpose of the funds, and compare the deposit with the customer's expected activity and turnover.
References:
* CAMS Certification Package - 6th Edition, Chapter 4: Conducting and Supporting the Investigation Process, pp. 97-98.
* Warning signs of money laundering | The Law Society, Section: Cash deposits and withdrawals.