The framework was the violation.

Sanctioned for the state of the system

Following on-site inspections in 2025, the Bank of Italy found deficiencies in Banco di Credito Paolo Azzoaglio’s organisation, procedures and internal controls relating to customer due diligence and active cooperation, and imposed a EUR 80,000 administrative sanction under Article 62 of Legislative Decree 231/2007.

The measure, dated 29 September 2026, is brief, and its brevity is the lesson.¹ It does not describe a laundered transaction. It does not name a suspicious operation that went unreported. It does not point to a customer who turned out to be a criminal. It identifies a category of failure that sits one level above any single incident: the way the bank had organised, written down, and controlled its anti-money-laundering work was not good enough. The regulator weighed the bank’s submissions and the remedial action it had already taken, and still concluded the framework fell short.¹

For any compliance team that measures success by the absence of incidents, this is the uncomfortable case. You can have no scandal, no loss, no headline, and still be sanctioned, because the obligation is not only to avoid bad outcomes. It is to build and run an adequate system for preventing them.

They fined the framework, not an outcome

Strip the measure to its core and the object of the penalty is unusual. It is not a transaction. It is not a report. It is the control architecture itself: the organisation that assigns responsibility, the procedures that tell staff what to do, and the internal controls that check the work is actually done.²

This is preventive supervision in its purest form. Anti-money-laundering rules exist to stop harm before it happens, so the regulator does not wait for harm to judge the system. It inspects the system directly and asks a design question: is this framework capable of doing its job, reliably, across every customer and every branch? When the answer is no, the gap is itself the breach, whether or not a criminal ever walked through it.

That is a higher and in some ways harder standard than it first appears. A firm cannot defend itself by pointing to a clean record, because a clean record may be luck rather than control. The question is not “did anything go wrong?” It is “would you have caught it if it had?” And that question is answered by looking at the design, not the outcome.

The duty you may not have a word for

One half of the finding concerns customer due diligence, a phrase every compliance professional knows: identify the customer, understand the relationship, keep that understanding current. The other half uses a term that English-speaking programs rarely name directly: active cooperation, in Italian collaborazione attiva.

Italian anti-money-laundering law draws a line between two postures. Passive cooperation is answering the authorities when they ask: producing records, responding to requests. Active cooperation is the affirmative duty that runs the other way: the obliged entity is expected to participate in the system on its own initiative, by applying due diligence, monitoring activity, forming suspicions, and reporting them, without being prompted.² It is the difference between a bank that waits to be asked and a bank that is always looking.

Naming it is useful even outside Italy, because it captures a posture that box-ticking compliance quietly abandons. A program can complete every mandatory field and still fail at active cooperation if it is not genuinely trying to see. The Bank of Italy’s finding is that the organisation, procedures and controls behind this duty were not adequately designed to support it.

Three layers, two duties, one gap

The measure repeats a precise triad: organisation, procedures, and internal controls. These are the three layers of any functioning compliance framework, and the finding is that both of the bank’s core AML duties were deficient across them.

Read the grid across and the structure of the failure is clear. It is not that one control broke. It is that the scaffolding holding the controls up, who is responsible, what they are told to do, and how anyone verifies they did it, was judged inadequate in both of the areas that matter most. A gap in organisation leaves work unowned. A gap in procedures leaves it undefined. A gap in internal controls leaves it unverified. Any one is a weakness. All three, across both duties, is a framework that cannot assure its own effectiveness.

Judged before the harm

It helps to see exactly what the regulator did and did not have to establish, because it inverts the intuition most people bring to enforcement.

The column on the right is the one firms instinctively defend against. We prepare to explain a bad transaction, to show a report was filed, to argue a loss was unforeseeable. None of it is responsive here, because none of it was the charge. The charge was about the left column: the condition of the system that is supposed to make the right column impossible. A regulator practising preventive supervision reserves the right to act on the left column alone, and the Bank of Italy did.

Your framework is graded on design, not luck

This series keeps finding the same truth in different disguises. A trading system judged by a catastrophic loss. A monitoring program judged by an eleven-year blind spot. A reporting process judged by a late filing. And now the quietest judgment of all: a framework judged by its design, with no bad outcome required at all.

For anyone standing up AI and automated controls, this is the supervisory posture to internalise early. As model risk management and AI governance mature, regulators increasingly assess the system of control around a model, the ownership, the documented procedures, the validation, the monitoring, and they assess it on whether it is adequately designed and operating, not on whether an incident has occurred yet. A clean incident log is not evidence of a sound system. It may just be evidence that the dice have not come up wrong.

The translation is blunt: you can run an AI system that has never visibly failed and still be found deficient, for the same reason this bank was. Supervision of a preventive control does not wait for the thing it prevents. It inspects the prevention.

Building a framework that survives inspection

An AML framework that holds up when a supervisor opens it has a recognisable shape across both duties the Bank of Italy examined. None of it is novel; all of it is about making ownership, procedure and verification real.³

• Named ownership, top to branch. A governance charter that assigns a board sponsor, a qualified AML officer, and a named owner for onboarding, CDD, monitoring, and reporting, with written escalation and deputy coverage, so no duty is unowned.
• A documented risk assessment that drives the controls. An enterprise view of money-laundering and terrorist-financing risk across customers, channels and geographies, linked to the proportionate CDD and monitoring each risk requires.
• CDD as a controlled procedure, not a habit. Version-controlled policy covering identification, verification, beneficial ownership, expected activity, risk rating, and periodic and event-driven refresh, mapped to the law and to system fields.
• Active cooperation, built as a pipeline. Risk-based monitoring, a documented suspicious-activity investigation and reporting workflow, and a confidential branch escalation channel, so a suspicion formed anywhere reaches the right desk.
• Verification that is independent. First-line quality assurance on CDD files, an issue register that tracks remediation to validated closure, and independent internal audit that tests whether the controls are designed and operating, not just present.
• Evidence that the framework runs. Management information and a board dashboard on CDD completion, overdue reviews, alert backlogs and remediation, so adequacy can be demonstrated, not just asserted.

Adequacy is the obligation

It is easy to file an EUR 80,000 sanction against a small bank under “minor.” That misreads what the Bank of Italy is saying, which is not minor at all. The regulator is asserting that the obligation is the framework, continuously, and that it will inspect and penalise the framework on its own terms, without waiting for it to fail in public. A clean record buys no credit. An adequate, owned, verified system is the thing being required.

For every firm racing to automate its controls, the posture to adopt is the one this small Italian bank learned in an inspection room. Do not build a framework to survive the day something goes wrong. Build it to survive the day a supervisor opens it when nothing has. That day is the real test, and it can come first.