Definition
Three Lines of Defence
The governance model separating risk ownership (first line, the business), risk oversight (second line, compliance and risk management), and independent assurance (third line, internal audit).
By Bart Mierzejewski · Founder, FinCrime Desk · Reviewed Sep 19, 2026
Why it matters
Almost every job description in this field positions itself by line. Knowing which line a role sits in tells you what the work is, who you report to, and what your career ladder looks like — and asking which line a role sits in is one of the better questions a candidate can put to an interviewer.
In practice
First-line financial crime roles sit inside operations and own the controls day to day. Second-line roles set policy, provide challenge, and monitor. Third-line roles test independently. The BSA requires independent testing, which is why the third line cannot report to the compliance function it tests.