Is the MAS really tightening the rules?

The MAS last week moved the MAS Bill for first reading in parliament. Comments all around suggest that the rules are being tightened but is that really true on closer inspection? Let’s have a look.

First of all, MAS has up till now issued AML/CFT notices which are not primary legislation. The MAS Bill corrects that, but of course it will hardly make the life of the average FI more difficult.

Secondly the AML/CFT regime is extended to stored value facilities, non-bank card issuers and designated financial holding companies. So that’s not really a tightening of the regulations but more extending the reach.

The third element is about sharing more information with more external parties. This is mostly applicable to branches and subsidiaries of foreign FI’s and means that information can be shared with home financial and AML/CFT supervisors (if these are not the same).

Finally it sets out requirements for FI’s to perform CDD and retain CDD records, which is hardly anything new.

Time will tell. The MAS Bill will definitively have an impact but perhaps not as much as feared.

Rolf

TBML – a hopeless case?

RHT GRACE (http://www.rhtgrace.com/) organized another networking session yesterday; an interesting evening about Trade Based Money Laundering. The presentation and following discussions highlight the lack of definition and guidance from regulatory bodies, leaving financial institutions in the dark. Investing in systems is needed but at the same it’s hard to justify the benefits of dedicated TBML systems while lots of trade transactions don’t use traditional trade finance products like L/C’s. As a consequence financial institutions just see the bare transactions without any information on the underlying physical goods or values. What’s more is that something like tax evasion is a much sexier crime to attract focus and funding.

So where does that leave a financial institution? Can nothing be done? Well, it’s not easy but it’s not rocket science either and we at i-KYC actually have quite a bit of experience in this area.

First and foremost the organization needs to recognize that trade is different. It’s a separate, specialized part of a financial institution, with dedicated, often complicated products handled by specialists. That fact needs to be reflected in the AML program to start with and needs to lead to a dedicated section in the AML/CFT policy, a clear risk appetite statement and finally an implementation in the organization by means of procedures and training.

A key aspect in all this is of course that the organization truly knows its customers…. the phrase Know Your Customer should not be about just ticking the box but about genuinely understanding customers and their transactions.

If you want to know more about our dedicated TBML programs contact us.

Rolf

W:          www.i-kyc.com

E:            rolf@i-kyc.com

                 

Ticking the box or more?

In the work we do with financial institutions we use concepts that are familiar to most you. The 3 lines of defense model, taking a risk based approach, defining a risk appetite and assessing an organization against this are a few key examples of these.

That’s an approach that goes well with our fellow AML/CFT practitioners and compliance officers in general. If we talk to the first line of defense though – whether it be sales staff, relationship managers, the trade finance department, tellers, payment processing staff or support staff – we often find some skepticism when we take this approach.

In the front line there are 2 things we notice. First there is a clear and explicit desire to know ‘what is allowed’. As a specialist or advisor we’re asked to give direction and guidance on client onboarding, filtering treshholds, documentation requirements and more. Understandable but what is needed is that the organization takes an approach in line with its own policies and guidelines. An advisor can share best practices but every organization is different.

Secondly we notice that the majority of staff still believes that compliance costs money and that the organization should do the minimal and not more. Even though most management and staff are aware that non-compliance is expensive there’s little desire to do more than just ‘tick the box’.

Just curious if this is something that others see as well, we welcome your thoughts and reactions.

Rolf

E:  Rolf@i-KYC.com

W: www.i-kyc.com

Punishment

The FT – and many other media following – report the record $ 56bn in fines for the banking industry over 2014. To put it in perspective, the author mentions that this amount is “the equivalent of the gross domestic product of Croatia”. That sounds like a lot although Croatia makes up only 0.05% of the world population, so maybe $56bn is not that much.

At the same time fines are handed to a few big banks only – BNP was fined a substantial portion of this amount on its own. Banks from India, China, Japan or smaller banks have sofar hardly been fined, so does that mean that everything is in perfect shape?

In Malaysia earlier in the year in his opening address to a financial crime conference we could hear Roger Wilkins, the President of the FATF quote Machiavelli, stating that nothing draws attention as a dead body in the town square at lunch time…

Fines are handed (long) after the fact and they focus the attention of decision makers in financial institutions on money. Both aspects don’t help to prevent financial crime, to change the culture in organisations or increase awareness of staff and management alike.  

Maybe more fines are unavoidable but the industry would benefit from punishment in other than just monetary form – think of community service for offending bankers - and other measures to prevent finanical crime from recurring.

I wish everyone a good start of 2015.

Rolf

Plumbing

Some thoughts after reading an article in The Economist last week, about the pros and cons of using SWIFT in enforcing international sanctions (http://www.economist.com/news/international/21633830-blocking-rogue-states-access-worlds-financial-messaging-network-potent-measure).  An interesting article, basically highlighting the dangers in ‘cutting off’ whole states or nations from international payment infrastructures, under political pressure.

The article describes that polital pressure is exactly that: political. And what is politically correct for the US (isolating Russia for its intervention in the Ukraine) is not for others. The other way around: what’s politically correct for China (excluding Taiwan from SWIFT access) would not be for other countries. Targeting individual banks or financial institutions which have committed crimes is of course different, that’s directly related to terrorism prevention. Although even in that field there are differences of opinion, to just name 1 example: what is terrorism to Israel is a freedomfight for Hamas….

It points out as well that shutting out nations by using SWIFT in that way could lead to the creation of a rival. What the article doesn’t touch on is the fact a rival already exists…… it’s called bitcoin.

If bitcoin is here to stay, is left to be seen, but fact is that it has found a place in the international payments industry. Bitcoin is still used as an instrument of speculation by many, but focusing on that alone is ignoring the fact that actual transactions take place in bitcoin. Half of which are linked to China. No doubt that there will be legitimate transactions in bitcoin but it would have been worthwhile to understand more about the nature, beneficiaries etc. of (certain) bitcoin transactions.

Unfortunately, unlike SWIFT which can give legislators and enforcement agencies access to transaction details, bitcoin cannot. Creating that access would greatly help the standing and acceptability of bitcoin as a transaction currency.

My view: infrastructure is neutral and should stay that way. Don’t shut down the highway for all white cars just because OJ Simpson drove one…

AML/CFT Puzzle or Mystery

Reading the article “Open Secrets” by Malcolm Gladwell (published in 2007, but reprinted in his bestseller “What the dog saw”) about puzzles and mysteries makes me wonder if there are any analogies with the field of AML/CFT.

His basic line of thinking is that “a puzzle grows simpler with the addition of each new piece of information”. He uses a few historic cases like the Watergate scandal and the search for Osama bin Laden as classical examples of a puzzle. And he uses the Enron disaster as an example of a mystery. Enron used – amongst others – Special Purpose Vehicles to inflate revenues; they used thousands of them. But all information about these SPV’s was disclosed; the journalists starting the investigations had access to all data. The problem was not a lack of information, the problem was an overflow of information. Information that was not only overwhelming in quantity but also in complexity.

Relating this to CFT we’re often dealing with partial hits if we’re filtering transactions. In that case we need to solve a puzzle; we need more information to determine if we’re dealing with e.g. a black listed beneficiary.

In AML processes however we’re more often than not dealing with mysteries… We have lots of transaction information at our disposal but we cannot detect a pattern that indicates we’re dealing with a money launderer. We have all information about a PEP we can possibly think of, but we cannot properly assess the risk that this poses for our organization. We have risk information and corruption indices of all countries our clients operate in and yet we have difficulty to use that information to allocate an adequate risk rating to our client.

The key learning point is that dealing with a puzzle differs from dealing with mysteries. The approach needs to be different and the mindset of people needs to be different. A puzzle requires a black-or-white approach; hit or no-hit; the transaction is blocked or not. A mystery needs a risk based approach, an assessment of different bits and pieces of information and an investigative mind that can connect-the-dots and can think out of the box.

In our design of processes, allocation of tasks, segregation of duties and training approach we should remember the characteristics of the tasks at hand.

Regulatory risk at BNP

We all talk about regulatory risk often and regard it as something important. And it is. However, the following excerpt from an article from the Bloomberg Review on July 1, 2014 illustrates what happens if you limit your focus to regulatory risk. 

“But obviously BNP Paribas did not care about obeying U.S. sanctions against Sudan. It cared about not getting caught violating those sanctions, of course, and it is sad -- or whatever the bank equivalent of "sad" is, "less well capitalized" I guess -- that it did get caught. But the sanctions just had no moral bite with BNP Paribas. It did not occur to anyone there -- even in the compliance department -- that Cuban companies shouldn't be allowed to transfer money from one French bank to another French bank, because of U.S. law. That struck BNP's bankers as a dumb rule, to be avoided with dumb methods.”

Not getting caught is clearly aimed at reducing the regulatory risk, but the real issues are in an organisations' reputational risk and the core AML/CFT risks. In the case of BNP a violation of US law.

It is about – what Bloomberg calls – “moral bite”. Staff throughout the organisation need to understand why sanctions exist and why AML/CFT regulations are in place. All staff need to have an innate drive to strive for integrity and doing the right thing. 

Only then will a company be truly compliant. 

ROlf

e: rolf@i-kyc.com
w: www.i-kyc.com