So what is different today? Given the changes in the enhanced regulatory landscape, it is no surprise that more cases against individual compliance officers are now being brought. Addressing the Senate Committee on Banking, Housing, and Urban Affairs in March 2013, Treasury Undersecretary David Cohen pledged that FinCEN would make greater use of its ability to impose penalties on individuals, noting that although “FinCEN has employed these tools only occasionally in the past, in the future FinCEN will look for more opportunities to impose these types of remedies in appropriate cases.”

The selection of high-profile former federal prosecutors to head financial regulatory agencies underscores the increased emphasis placed on robust enforcement. For example, the current chair of the Securities and Exchange Commission served as the U.S. Attorney for the Southern District of New York, and FinCEN's director was chief of the Asset Forfeiture and Money Laundering Section at the U.S. Department of Justice. Whereas regulators may naturally tend to focus on institutions, former prosecutors are at ease with the concept of individual liability for institutional failings.

In this charged atmosphere, how does an individual compliance officer protect him or herself? Because compliance officers are generally at the mercy of strategic decisions and budgetary constraints imposed by high-level executives and boards of directors, they are much less likely to be left holding the bag if they can involve those at the top in the decision-making process. Compliance officers do their job, and thus insulate themselves from liability, by making sure the C-suite is well-aware and oft-reminded of what the rules require, as well as the risks and consequences of not adequately addressing an AML concern. FinCEN made the former MoneyGram compliance officer's inaction when he knew of illicit activity at the center of its allegations. When compliance officers lack authority to make the necessary decisions, their job is to educate those who have that authority, including on the elements of an effective compliance program.

And this is exactly what regulators are looking for. Regulators are convinced that a true culture of compliance can only be achieved with buy-in from the top. Whether it involves improving internal controls, allocating additional funds or hiring more compliance staff, serious deficiencies are rarely addressed without high-level involvement. Similarly, getting the business to manage its risk appetite — regardless of whether that risk relates to a product, a customer or a service — can rarely be accomplished without senior management weighing in, imposing discipline and making decisions in the best interests of the entire organization. Such a process should be memorialized in written compliance plans, board resolutions and compliance committees made up of employees from various disciplines.

Lest one wonder if this is really the message being sent by regulators and prosecutors, witness the remarks of Thomas Curry, the Comptroller of the Currency, before the Association of Certified Anti-Money Laundering Specialists in March 2014: “There's a reason why I've addressed our concerns to senior executives, including the chief executive officers, of the banks and thrifts we supervise. The fact is, when we look at the issues underlying BSA infractions, they can almost always be traced back to decisions and actions of the institution's board and senior management.”

Those underlying issues, he explained, involve the organization's culture of compliance, the strength of its information technology and monitoring process, the resources the organization has allocated to BSA compliance and the quality of the organization's risk management.

“Those are all matters that require the attention of senior management, starting with the chief executive's office,” he said.

In short, although the heightened enforcement atmosphere means increased scrutiny, BSA/AML compliance officers have an opportunity and incentive to redouble the involvement of senior management in every aspect of the institution's compliance regime.