Does the ‘perfect’ path to anti-money laundering (AML) exist?
The quest for the perfect plan can be traced back to criminals causing immeasurable damage for many economies through money laundering.
In response, governments are continuously trying to fight back, issuing a raft of rules and penalties for financial institution (FIs) – fines such as HSBC’s $1.9 billion or Commerzbank’s $1.45 billion are a sobering warning for compliance officers globally of just how important AML has become.
This in turn has triggered FIs to come up with various AML programmes to stay safe, or stay alive in some instances (some banks such as Latvia’s ABLV were completely shut down over AML issues).
Over the years, some AML programmes have proven to be effective, others, however, were so bad that they landed the bank in hot trouble with regulators – in such cases, banks were hit with the fines that their AML programmes were created to avoid.
With that in mind, it is very important to articulate a sound AML programme.
Here’s a ten step guide to achieving an effective AML programme, which could prove useful in staying compliant and warding off those petrifying fines.
The relationship of compliance and technology is not new; however, it is shifting gears as regulators are constantly enhancing their regulations with an increased focus on data and reporting. There are many RegTech solutions in the space of KYC/real-time AML screening, AI/ML-based fraud prevention, and real-time compliance monitoring which are customisable and can easily be integrated into a variety of existing environments.
For automated, real-time customer risk-profiling technology visit riskscreen.com
Regulators around the world have been supporting the adoption of RegTech as it helps financial institutions to not only streamline their reporting but also have better oversight of their data hence; it is high time FIs to choose an apt technology partner who can offer solutions that address regulatory challenges through innovation.
Each and every FI has to uniquely design its AML policy to address the money laundering risks it faces. Hence it is mandatory for FIs to conduct independent audits to assess their AML programmes against international standards such as the Bank Secrecy Act (BSA) and Financial Action Task Force (FATF) recommendations.
Independent auditors will look into issues such as:
The audit report should have sufficient information as well as a list of findings and recommendations to help the decision makers evaluate the programme effectively.
Back in 2007, FATF came up with the idea of a risk-based approach (RBA) and since then it has been a subject of confusion.
However, some FIs in have struggled to implement the RBA properly, leading to inadequate controls in place to manage and mitigate money laundering risk.
Steps have to be taken to implement the RBA approach and create more logical processes, the focus has to be laid on identifying money laundering risks that can cause damage to the FI and weave processes accordingly that can detect and deter such risks, this approach will automatically have FIs comply with the majority of AML regulations.
For more information on the risk-based approach read this article
The approach to KYC varies from customer to customer depending on the risk exposure and money laundering risks that they pose respectively and hence it is necessary to carry out the correct processes to ascertain if EDD is required.
When on-boarding high-risk customers EDD must be applied to mitigate the risks associated with the customer accordingly to protect the FI from a potential damage.
Some of the EDD processes include:
As a best practice, it is recommended to perform ongoing enhanced monitoring for higher risk situations to intercept suspicious activity.
FIs need to have their own internal risk assessments which are tailor-made to counter the money laundering risks they might potentially be exposed to.
There are multiple risk factors that a FI should access; the top three being:
If these risks are not applied diligently, they could lead to a bigger risk called regulatory risk, which would subject the FIs to reputational damage and forcing customers to lose trust in them.
We all talk about the increasing rates of false positives, and how we can reduce the occurrences, but we seldom talk about how to discount these false positives?
FIs should have proper policies in place to discount false positives; they should be discounted on real and not on fictitious grounds.
Below is a list of things that one can refer to discount any potential match:
It is of utmost importance that the identity verification data available with the FIs is up-to-date; stale documentation does not serve the purpose of an AML programme and hence documents have to be reviewed and updated at a regular time period, which is why regulators stress so much on performing periodic reviews
While collecting the fresh set of documents one might be able to capture any material change to the customer profile, this also allows FIs to keep an eye on the risk rating of the customer to make sure that the risk rating assigned to the customer is still appropriate.
Regulators perform regular audits for FIs to make sure that the all the internal compliance controls and policies and procedures are in place and implemented properly.
It is mandatory for FIs to have fully auditable records that are regulator-ready at the end of the day. This includes recording of all compliance decisions as well as the data, documentation and the back-up required to evidence the basis for these decisions.
Regulatory policies change and evolve every day and to stay compliant in such an environment can be challenging.
It is extremely important for FIs to keep themselves updated with the latest happenings around the world so that their internal policies can be in line with the current state of regulatory requirements. Resources should be deployed in place that can track and monitor all the new relevant developments and implement the same to improve their AML programme.
It is mandatory for all the employees to be aware of their obligations in an AML programme, and contribute actively. Relevant training is necessary to create a truly effective AML programme. They should be trained on all the relevant topics which are applicable to their functional roles.
As discussed in point five above every FI is exposed to different kinds of risks, and it would be best to train on how the risks look like and how to react to them , explaining via real-life examples is more preferable than hypothetical situations as it will help them to respond better.
The ultimate goal of training is not simply to tick off the list of things to do. It is to establish an effective AML programme and the training should be reviewed and updated at least every six months to include any latest happenings in the compliance space.
Last but not the least, KYC has no shortcuts. Ineffective processes can put the entire organisation at risk of significant fines and can also mean imprisonment for senior officials.
FIs should make sure that the process flows are streamlined and data is collected appropriately as per the entity type and ongoing efforts are implemented in place to detect any violation.
To conclude, an effective AML programme will not only help the FI to comply with regulations, but it can also help in spotting other potential weakness in the process. Most of the C-suite members see such a programme as a hefty cost however, they have to remember not having or having an inefficient programme can be even costlier and cause damage beyond control.
About the article author: Suresh Chavali is a subject matter specialist in the risk and compliance sector, focusing on know your customer (KYC), risk management, money laundering and terrorist financing schemes and trends. He has worked for various firms, including Barclays and Deutsche Bank.
This article is expressing personal opinions and is meant for information purposes only. The article does not intend to replace professional or legal advice. It is recommended that readers seek independent professional or legal advice, or speak to authorised persons/organisations.