Applying the IIA Three Lines Model (2020, refreshed 2026) to transaction fraud: who owns, oversees and assures fraud risk, and where fraud, AML and compliance boundaries fall.
Core components
The model, briefly
The Institute of Internal Auditors (IIA) published the Three Lines Model in July 2020, replacing the 2013 "Three Lines of Defense" framing. It dropped "defense" to emphasize creating and protecting value, made the governing body explicit, and allowed first- and second-line roles to be blended or separated as fits the organization. On July 8, 2026 the IIA replaced the 2020 position paper with a revised Statement of Position (Assurance and Advice in Support of Effective Governance: Three Lines Model). The 2026 version keeps the model's core, principles-based structure. It treats independence as a continuum rather than isolation, emphasizes coordination and reliance across assurance providers, and adds guidance for organizations that aren't required to keep separate assurance functions.
Role
IIA framing
In a transaction fraud program
Board / governing body
Sets purpose and risk appetite; oversees
Approves fraud loss appetite; receives fraud risk reporting; oversees major incidents
First line
Owns and manages risk; designs and operates processes and controls
Product and business owners plus the fraud function: strategy, ops, rules, models, review, investigations
Second line
Expertise, support, monitoring and challenge on risk
Fraud risk oversight (in risk or compliance), model risk management, compliance testing, BSA/AML compliance
Third line
Independent assurance and advice; reports to the board
Detect and report money laundering and other suspicious activity; meet BSA obligations
Ensure adherence to laws, regulations and rules
Clock
Real-time to minutes
Days to weeks (SAR timelines)
Periodic
Main tools
Real-time scoring, rules, holds, step-up
Transaction monitoring, case investigation, SAR filing
Testing, policies, training, regulatory change
Overlap
Fraud is a predicate for SARs; mule detection serves both
Uses fraud findings for SARs
Covers Reg E, Nacha, card network, broker-dealer rules that fraud operates within
Handoff
Fraud refers suspicious activity to the BSA function
BSA officer decides on SAR filing (non-delegable accountability)
Compliance tests that fraud processes meet regulatory requirements
The recurring friction points:
Mules and scams. The same account may be a fraud case (customer victim) and an AML case (funds laundered). Agree on who leads and how the cases link. See Money Mules, BSA-AML and SAR Filing.
Reg E claims. Usually run by disputes or ops, decided using fraud evidence, and tested by compliance. See Regulation E and Unauthorized Transfers.
Model risk. Fraud models are built by the first line. Where MRM applies, they're validated by the second line. See Model Risk Management.
Account closures. Fraud may decide, but compliance and legal set the standards for notices, adverse action and record retention.
Regulatory obligations (Reg E, SAR referrals, Nacha)
Executes
Tests compliance
Audits
Reporting to board
Prepares
Provides independent view
Independent assurance
Sizing to your organization
Organization
Practical structure
Startup / early fintech
Fraud is the first line, with no dedicated second line. Safeguards include QA independent of ops leads, a fraud risk register reviewed by an executive outside fraud, and an annual external review.
Growth-stage fintech with a sponsor bank
First-line fraud team. Second-line compliance function covers fraud-adjacent regulation. The sponsor bank's oversight acts as an external check. Expect the bank to request evidence of rule governance, QA and incident handling.
Bank / broker-dealer
Full three lines. A second-line fraud risk oversight team, MRM, compliance testing. Internal audit runs periodic fraud program audits.
Marketplace / rewards app (non-bank)
First-line trust and safety or fraud. Second line may be a small risk and compliance team. Internal audit may be limited. Payment partners and networks provide external pressure.
What a good second line does for fraud
Sets fraud risk standards and methodology: assessment, taxonomy, appetite metrics
Challenges first-line risk ratings and residual-risk acceptance
Reviews material rule and model changes, and validates models where MRM applies
Runs thematic reviews, such as "are payout-destination change controls consistent across products?"
Monitors key risk indicators and appetite breaches
Reports an independent view to the risk committee and board
The second line should not make real-time fraud decisions, own rules or sit in the incident chain of command. Doing any of those makes it first line and removes its independence.
Coverage. Share of money paths with current risk assessments and named owners
Completeness
Pitfalls
Calling the fraud team "second line" because it sits in a risk org, while it runs real-time decisions. Regulators and auditors will see through it.
Second line as a bottleneck. Requiring second-line approval for every rule change kills response speed. Review material changes and sample the rest.
No line owns friction. Lines-of-defense thinking focuses on loss and compliance. Make sure someone owns the customer-cost side (see Friction and Customer Experience Tradeoffs).
AML and fraud not talking. Separate lines, systems and case tools for the same mule account produce duplicated work and missed SARs.
Ignoring third parties. Outsourced review teams, BPOs and vendors operate first-line controls. Bring them into the model with oversight and QA.