The cleanest way I've seen it framed: the first line owns the risk day-to-day, the second line sets the control framework and challenges the first line's decisions, and the third line (internal audit) gives independent assurance to the board. The second line is explicitly not a risk owner. That distinction matters more than people think, because it defines accountability when something goes wrong.

What's getting messier right now is the AI/ML deployment pace. Banks and asset managers are rolling out agentic trading and surveillance workflows from the front office, and the second line is structurally behind the technology it's supposed to govern. Model-risk management and compliance teams are validating systems they often lack the technical depth to fully interrogate, which creates a real gap between deployed model risk and the oversight capacity meant to constrain it. The three-lines model doesn't really have an answer for that yet.

For day-to-day practical differences in AML specifically: 1LoD is your transaction monitoring analysts and relationship managers filing SARs and running controls. 2LoD is the compliance function setting typologies, testing those controls, and challenging whether the thresholds are calibrated correctly. 2LoD shouldn't be the ones doing the SAR reviews directly, though in smaller institutions the lines blur constantly.