PART IV – AML Certifications and 231 Liability

by Cristina Rabazzi – Supreme Court Lawyer

______________________________________

We conclude our series of insights with the contribution of the lawyer. Cristina Rabazzi, dedicated to the connection between AML certifications and corporate liability pursuant to Legislative Decree 231/2001. After exploring ongoing training in the FATF Recommendations with Dr. Alfonsina Leo and with Maj. Lorenzo Savastano, the emerging risks associated with crypto-assets, this latest intervention addresses a crucial issue: how certifications can impact the effectiveness of 231 models and the legal protection of Boards of Directors.

Sergio Silvestri

______________________________________

AML Certifications and Corporate Responsibility under Legislative Decree 231/2001

Legislative Decree 231/2001 represented a turning point for the Italian legal system, introducing the administrative liability of entities for certain crimes committed in their interest or to their advantage by senior management or subordinates. Among these, the crimes of money laundering, self-laundering, and terrorist financing (Articles 648-bis, 648-ter, 648-ter.1 of the Criminal Code, and Article 25-octies of Legislative Decree 231/2001) deserve particular concern and attention, as they are closely linked to the global economic and financial context and the customer due diligence obligations imposed on organizations.

Organizational models and exemption from liability

An entity can avoid liability only if it demonstrates that it adopted and effectively implemented, prior to the commission of the crime, organizational and management models suitable for preventing the type of crimes that occurred (Article 6 of Legislative Decree 231/2001; ABI Guidelines on 231 Liability and Anti-Money Laundering, ABI). From this perspective, money laundering risk prevention constitutes a structural element in the design of preventive models for both obligated entities (banks, financial intermediaries, insurance companies, listed companies) and for a variety of other economic operators, reflecting the progressive regulatory harmonization between Italian and European standards.

The role of AML certifications in corporate compliance

In recent years, professional certifications in the AML field, such as CAMS (Certified Anti-Money Laundering Specialist), AMLACERT (Anti-Money Laundering Advanced Certification) and similar internationally recognized certifications, have become one of the most relevant and recognized tools to prove the technical-legal preparation of operators, not only in the banking sector but also in all those required to monitor money laundering risk and customer due diligence. These certifications attest to advanced knowledge of regulations, operating procedures, and international best practices and, at the same time, represent a significant competitive advantage for organizations (The Importance of Certifications AMLACERT® and CAMS of ACAMS in Corporate Governance, School of Banking, 2024).

Regulatory best practices and the system of international recommendations

The ABI guidelines and the main regulators of the sector (Bank of Italy – Eurosystem, Consob – National Commission for Companies and the Stock Exchange) reiterate that specific training - preferably attested by certifications - is a "concrete and documentable measure" required of institutions to demonstrate their organizational diligence (ABI Guidelines on 231 liability and anti-money laundering, ABI; Provisions on organization, procedures and internal controls for the prevention of money laundering, Bank of Italy). This focus has been consolidated within the framework of the FATF-GAFI Recommendations (Financial Action Task Force (FATF) – Groupe d'Action Financière), which represent the international standard for the prevention of money laundering, terrorist financing, and the proliferation of weapons of mass destruction (FATF Recommendations, Department of the Treasury 2012). Indeed, in its guidance for member countries, the FATF emphasizes the need for "continuous, qualified, and verifiable training" for all personnel involved in preventing financial crime, highlighting how certified professionalism is a qualifying element not only with respect to internal controls but also in terms of compliance with European directives (Update of the 40 FATF Recommendations published, School of Banking, 2023).

Dr. Leo, in an analysis of the FATF Recommendations, also emphasizes how the presence of qualified personnel has a direct impact on an organization's ability to effectively manage and mitigate risks arising from cross-border illicit activities (The FATF Approach to Continuing Education, A. Leo).

Substantive and evidentiary value of certifications

AML certifications have a dual significance:

• On a substantive levelThey qualify and certify the preparation of those responsible for managing AML procedures (customer due diligence, suspicious transaction reporting, financial flow management, ongoing internal training: Bank of Italy Provisions; OIC Guidelines 2022). The contribution of a certified AML manager has practical implications for all phases of the risk management cycle, increasing the effectiveness of control strategies and internal protocols (The Importance of AMLACERT and CAMS Certifications, School of Banking 2024).
• On the evidentiary level, the certifications represent a "documentary proof factor" with respect to organizational diligence both during inspections and judicial verifications, acting as a potential "defending factor" of liability when integrated into a model that is actually applied and updated (231 models and compliance certifications, F. Corapi, Diritto Penale Contemporaneo 2022).

AMLACERT & CAMS Certifications: The Highest Standard for FATF Compliance and Board of Directors Protection – Part IV

Financial institutions and companies most exposed to reputational risks are increasingly adopting certification standards such as ISO 37001/2016 for anti-corruption and UNI ISO 19601 for criminal compliance, often integrated with AML systems, to provide a unified framework of controls and consolidate the track record of training and management activities over time (ISO 37001 and anti-money laundering compliance in corporate governance, Consob Legal Papers 2023).

The role of supervisory authorities and the centrality of training

The Italian supervisory authorities, in particular the Bank of Italy – Eurosystem , Consob – National Commission for Companies and the Stock Exchange, attribute specific and substantial value to the "qualified and documented training of front-line operators and anti-money laundering managers", prescribing that it be organically integrated into the organizational model pursuant to Legislative Decree 231/2001, according to the principles of proportionality, adequacy, effectiveness and continuous updating (Consob/Bank of Italy summary note of 29 October 2024).

The Bank of Italy, in several of its provisions, emphasizes the need for ongoing training, complemented by refresher courses on new risks periodically identified at the national and international levels (The Bank of Italy. Functions and Objectives; Supervisory Functions of the Bank of Italy 2022). Consob, for its part, oversees the quality of information and transparency of processes, supervising the internal organization of listed companies, including with regard to AML compliance.

Jurisprudence and legal doctrine: the importance of certifications in judgments on the merits and in the supreme court

From a jurisprudential perspective, the ruling of the Supreme Court of Criminal Procedure, Section V, 25/6/2022, no. 23401, clarified that the adoption of formally suitable organizational models it is not enough in itself: constant verification and updating of the model is necessary, as well as demonstration of its effective operational application, including periodic and specific training of employees ("Update | Legislative Decree 231/2001: the Court of Cassation once again clarifies the criteria for establishing corporate liability", RPLT, May 2024; the Court of Cassation's ruling on the Impregilo case, Criminal System 2025). According to the Supreme Court, the assessment focuses not so much on the formal violation of a requirement, but on the "consistency between the theoretical model and corporate practice," taking into account the specific characteristics of the entity, its size, the type of activity, and the evolution of the risk over time (Cass. Pen. no. 23401/2022).

The Court specifies that the entity's liability can be excluded only in the case of fraudulent evasion of safeguards, or when the crime is committed by deceptively "circumventing" the procedures and controls implemented (Critical Analysis of Organizational Practices in the Field of Anti-Money Laundering, L. Garofoli, Il Sole 24 Ore, October 2023). AML certification, therefore, is considered a valuable but insufficient element: the system's true effectiveness must be demonstrated through concrete evidence of training, refresher courses, monitoring, and periodic audits (F. Corapi, Contemporary Criminal Law).

Quality management systems (UNI ISO 9001), anti-corruption (ISO 37001), and criminal law compliance are being progressively integrated, creating a multi-level compliance system that enhances certified skills and provides evidentiary strength to the organization's defense (ANTI-CORRUPTION Due Diligence in support of ISO 37001, Cheopeonline, 2019; ISO 37001:2025 and Legislative Decree 231/2001, Filodiritto 2021; anti-money laundering obligations, ATRIGNA-IELO 2018).

Organizational structures, dynamic training and risk culture

In the current context, the probative value of AML certification increases if inserted into a system of organic and "living" controls: continuous training programs, periodic audits, updating of protocols and timely reporting of anomalies (The importance of Certifications AMLACERT® and CAMS of ACAMS, School of Banking; Quaderni Giuridici Consob, 2023). ISO 37001:2025, for example, introduces innovative elements relating to corporate culture and the assessment of environmental risks associated with corruption and money laundering, encouraging multidisciplinarity within the compliance team and the involvement of different professions (ISO 37001:2025 and Legislative Decree 231/2001, Filodiritto 2021).

The most advanced practice suggests integrating AML certifications with other specialized qualifications (cybersecurity, internal audit, risk management) for cross-sector risk coverage (see, in this regard, Lorenzo Savastano's contribution to this publication). Synergies between internal supervisory bodies (Supervisory Body, OdV), compliance officers, and certified risk managers are also emphasized, thus increasing protections, supporting the development of a "virtuous model," and ensuring resilient governance (Certification of Model 231: Yet Another Stamp or Opportunity, RiskCompliance, 2023).

Critical issues, limitations and evolutionary perspectives

AML certifications, while central to the compliance system, never constitute an automatic exemption: administrative liability, according to established case law, is not excluded by the mere presence of "stamps" or qualifications, but rests on the actual suitability, concreteness, timeliness, and practical effectiveness of the organizational model. An "inactive" model, static or merely formal training, obsolete procedures, or undocumented audits can negatively impact the judge's assessment and lead to severe sanctions (Cass. Pen., Sez. V, 25/6/2022, no. 23401).

To ensure true effectiveness, it is essential to adopt continuous training programs supported by periodic, renewed and updated certifications and to constantly document activities, updates and audit initiatives (FATF, Recommendations 2012; FATF/FATF Recommendations, School of Banking 2023).

Conclusion

In conclusion, the AML – CAMS certifications, AMLACERT® and similar—are now an essential pillar of the current money laundering prevention and corporate compliance system. These are no longer "optional" certifications, but strategic tools that strengthen internal systems, provide evidentiary value, and contribute substantially to mitigating the risk of administrative liability and sanctions. However, certification alone does not guarantee exemption: it produces real effects only if incorporated into a dynamic organizational model, effectively implemented, updated, and monitored.

International certifications, when properly integrated into 231 models, represent a tool capable of strengthening the effectiveness of controls and providing a strong defense in the event of disputes. However, they cannot be considered "sufficient" in an absolute sense: they must be part of a system consistent with the organization's specific risks and constantly updated.

Only a living and truly implemented model, supported by high-level certified training courses, can transform a regulatory requirement into a true competitive advantage and solid protection for company management, significantly reducing the risk of sanctions and strengthening the company's overall reputation.

In this perspective, theInternational Executive Master AML/CFT Diploma – Including AMLACert and CAMS – which includes the certification paths AMLACERT® and CAMS of ACAMS – represents one of the most advanced tools for training professionals capable of integrating 231 models with up-to-date and globally recognized skills.

This article concludes the series dedicated to analyzing the importance of AML certifications. The next appointment will be in September, with the publication of the updated edition of our e-book.