Assessing AML-CFT Risk

Anti-Money Laundering/Countering the Financing of Terrorism Compliance Programs Assessing AML/CFT Risk An AML/CFT program is an essential component of a financial organization’s compliance regime. The primary goal of an AML/CFT program is to protect the organization against money laundering, terrorist financing, and other financial crimes, and to ensure that the organization is in full compliance with relevant laws and regulations. For that reason, designing, structuring, and implementing these programs should be high priorities for any financial organization. An AML/CFT program should be risk-based. Certain aspects of a financial organization’s business pose greater money laundering risks than others and therefore require additional controls to mitigate those risks. Other aspects of business present a minimal risk and do not need the same level of attention. Depending on the size of the organization, the AML function might be managed as a dedicated/standalone department, integrated into other corporate departments such as the legal department, or performed by people who have other compliance duties. Regardless of the size of the organization, the program should have an enterprise-wide view of AML/CFT efforts. The AML/CFT program should establish minimum standards for the enterprise that are reasonably designed to comply with all applicable laws and regulations. It can be supplemented with the policies and procedures of various lines of business or legal entities that address specific areas, such as private banking, trade finance, cash handling, institutional banking, wealth management, and investigations. Compliance programs should also include corporate governance and overall management of money laundering and terrorist financing risks. Before designing an AML/CFT program, it is imperative to understand what is required of a financial organization, its employees, and customers by the laws and regulations of all of the jurisdictions in which the organization does business and where its customers are located. The financial organization’s internal policies and risk-management standards related to the business must also be taken into consideration. Anyone needing advice on the complexities of AML/CFT legislation before developing an AML/CFT program should consult a competent advisor, even if it means seeking external assistance. This section explains what to consider when designing a compliance program; how to assess risk; how to identify, manage, document, and follow up on suspicious activities; how to know your customer and employee; how to audit your program effectively; and what you need to know about training and screening employees. Introduction Understanding what is legally required of an organization and its employees and customers is essential to a successful program. It is also important to understand the expectations of the relevant AML/CFT regulators and/or supervisory authorities. FATF and its numerous member countries, such as the UK and US, urge riskbased controls. Per FATF, there are circumstances when the risk of money laundering or terrorist financing is higher, and EDD measures have to be taken. A risk-based approach requires financial organizations to implement systems and controls that are commensurate with the specific risks of money laundering and terrorist financing they face. Therefore, assessing this risk is one of the most important steps in creating an effective AML/CFT compliance program. As money laundering risks increase, stronger controls are necessary. However, all categories of risk—whether low-, medium-, or highlevel—must be identified and mitigated by the application of controls, such as verification of customer identity, customer due diligence (CDD) policies, suspicious activity monitoring, and economic sanctions screening. The majority of governments around the world accept that the risk-based approach is preferable to a more prescriptive approach in the area of AML/CFT because it is more: • Flexible: Money laundering and terrorist financing risks vary over time and across jurisdictions, customers, products, and delivery channels. • Effective: Companies are better equipped than legislators to effectively assess and mitigate the specific money laundering and terrorist financing risks they face. • Proportionate: A risk-based approach promotes a more practical and intelligent approach to fighting money laundering and terrorist financing than a checklist-type approach. It also allows organizations to minimize the adverse impact of AML procedures on their low-risk customers. No financial organization can reasonably be expected to detect all wrongdoing by customers, including money laundering. But when an organization develops systems and procedures to detect, monitor, and report high-risk customers and transactions, it decreases the likelihood of being harmed by criminals and subjected to government sanctions and penalties. The risks a financial organization faces depend on many factors, including the geographical regions (i.e., jurisdictions) involved, customer types, and the products and services offered. When assessing risk, FATF recommends considering: • Customer risk factors, such as nonresident customers, cash-intensive businesses, complex ownership structures, and companies with bearer shares • Country or geographic/jurisdictional risks, such as countries with inadequate AML/CFT systems, countries subject to sanctions or embargos, countries involved with funding or supporting terrorist activities, and countries with significant levels of corruption • Product, service, transaction, and delivery channel risk factors, such as private banking, anonymous transactions, and payments received from unknown third parties Although it is not necessarily mandated by AML/CFT legislation in various jurisdictions, many organizations find it valuable to develop money laundering/terrorist financing (ML/TF) risk models that assess risk at the enterprise level, with the customer element providing for ML/TF risk assessments at the customer-type level (e.g., individual, company, or trust) and the specific customer level (i.e., an ML/TF risk assessment of the customer’s entire relationship with the organization). Moreover, some jurisdictions also seek a separate sanctions assessment for reporting entities. Maintaining an AML/CFT Risk Model A risk-based approach identifies, manages, and analyzes AML/CFT risk in order to design and effectively implement appropriate controls. As such, it is critical that risk ratings accurately reflect the risks present, provide meaningful assessments that lead to practical steps to mitigate the risks, are periodically reviewed, and, when necessary, are regularly updated. A risk-based analysis should include appropriate inherent and residual risks at the country, sectoral, legal entity, and business relationship level, among others. As a result of this analysis, the financial organization should develop a thorough understanding of the inherent risks in its customer base, products, delivery channels, services offered (including proposed new services), and the jurisdictions within which it and its customers do business. This understanding should be based on operational, transaction and other internal information collected by the organization, as well as external sources. In identifying all ML/TF risks, all relevant information must be taken into account. This usually requires expert input from the business lines, risk management, compliance, and legal units, together with advice from external experts, when necessary. In particular, new business products and services should be evaluated for money laundering and sanctions vulnerabilities, and appropriate controls should be implemented before launching them into the market. There is also a growing body of publicly available, helpful guidance on ML/TF risk assessments that should be taken into consideration. Such guidance is regularly published by FATF, FSRBs, regulatory agencies, other institutions such as the United Nations Office on Drugs and Crime, the IMF, the World Bank, and jurisdiction-specific information, guidance, and advisories. Risk is dynamic and needs to be continuously managed. It should also be noted that the environment in which each organization operates is subject to continual change. Externally, the political changes of a jurisdiction and whether economic sanctions are imposed or removed can affect a country’s risk rating. Internally, organizations respond to market and customer demands by merging or acquiring other companies, introducing new products and services, and implementing new delivery systems. The combination of these changes makes it critical that the ML/TF risk model is subject to regular review. In some countries, there is a legislative obligation for such reviews to be undertaken on a regular basis—usually annually or when new products, delivery channels, and customer types are introduced. Understanding AML/CFT Risk AML/CFT risk categories can be categorized by the following levels: • Prohibited: The organization will not tolerate any dealings of any kind, given the risk. This category could include transactions with countries subject to economic sanctions or designated as state sponsors of terrorism, such as those on the UN and OFAC lists. • High risk: The risks are significant, but they are not necessarily prohibited. To mitigate the heightened risk presented, the financial organization should apply more stringent controls to reduce the ML/FT risk, such as conducting EDD and more rigorous transaction monitoring. Countries that maintain a reputation for corruption or drug trafficking are generally considered high risk. High-risk customers could include PEPs and specific types of money services businesses or cash-intensive businesses. High-risk products and services could include correspondent banking, private banking, cash services (e.g., bulk currency shipments), and international wire transfers. • Medium Risk: Medium risks merit additional scrutiny, but they do not rise to the level of high risk, such as a retail business that accepts low to moderate levels of cash but is not considered cash-intensive. • Low Risk: This represents the baseline risk of money laundering. Typically, low risk indicates normal, expected activity. AML/CFT Risk AML/CFT Risk Scoring A risk-scoring model uses numeric values to determine the category of risk (geography, customer type, and products and services) and the overall customer risk. For example, each category could be given a score between 1 and 10, with 10 being the highest risk. The individual categories could be scored, with 1–3 being standard risk, 4–8 being medium risk, and 9–10 being high risk. Such a model is particularly helpful when analyzing product risk, because it helps determine appropriate controls for the products. The three categories are then combined to give a composite score. A simple model would just add the totals from the categories, which would yield a score between 3 and 30. The model can be made more complex by weighting each of the factors differently, such as putting more emphasis on the type of customer, as opposed to the product or country. The model can be made even more elaborate by, for example, creating combinations of factors that will determine the overall rating. The degree of complexity is up to the organization; the more complex, the more likely the rating will reflect the customer’s overall risk. In a simple three-element model like the first one described above, care must be taken to avoid inadvertently discounting any element that is an outlier from the other elements. For example, if each element has a risk score of 3, the composite or aggregate score will be 9. However, if two of the three elements have a score of 1 and the other has a score of 7, the composite risk score is also 9. In this case, there is a need to identify how and in what manner the element scoring 7 should be mitigated. This could mean implementing a more rigorous control or introducing restrictions. It is important to understand that, when the categories are combined, the customer’s risk profile becomes clearer. For example, when you combine a product with a customer type, the combination can radically change the level of risk. For example, you have a small, foreign, private company about which you do not have much information that wants to open a checking account with online wire transfer capabilities. That customer’s ability to rapidly transfer funds raises its risk level. The customer may also have higher risk ratings for geography, customer type, and products and services. Another example is a publicly listed domestic company listed on a major stock market that wants to establish an employee retirement plan. Public companies must provide extensive information to be listed on a major stock market. What is more, retirement plan accounts are not very vulnerable to money laundering. As a result, this customer and account will pose a much lower risk than the example of the foreign private company. The next step is to determine what thresholds to establish for each risk category. The organization should ensure that high-risk relationships do not represent too large a segment of the portfolio; this is not to say the scores should be adapted to fit the customer portfolio, rather, because high-risk customers do require more attention. In addition, if the portfolio is overly weighted toward high risk, the overall risk level in the organization could be too great to support. Assessing AML/CFT risk is an ongoing and evolving component of maintaining a compliant AML/CFT program. It is critical to evaluate the risk-scoring model and update the risk assessment to include changes in products, services, distribution channels, customers, and jurisdiction to ensure an accurate reflection of AML/CFT risk. Although there is generally no requirement to update a risk assessment on a continuous or specified periodic basis, risk assessments should be updated before the launch of a new product, an acquisition of another financial organization, and whenever there are significant risk environment changes. Periodically reassessing risk-rating criteria will reveal if the customers that are scored as higher risk are actually more likely to engage in potentially suspicious activity. If they are not, it may be appropriate to reassess the risk-scoring model. Assessing the Dynamic Risk of Customers Another critical component of a risk assessment is a process for reevaluating risks and determining when a customer risk rating should be raised or lowered. Identifying the key factors that should trigger such a reevaluation is essential to efficient allocation of limited resources. In addition to the initial assessment of the inherent risk of a customer, it is important to consider how a customer’s relationship—and risk—with the organization changes over time. Perhaps the most important consideration driving a customer’s risk rating is the actual activity that the customer conducts. For example, a student checking account may start out as low-risk. But if records show that it is involved in a high number and volume of wires to high-risk jurisdictions, indicating abnormal behavior for this customer type, the risk level for the account may need to be raised. Similarly, a potentially higher risk customer, such as an MSB or correspondent bank, might be engaging in exactly the type of activity it indicated it would conduct. This customer may not be as risky as one might think based solely on the inherent risk. As such, the low- or standard-risk student customer based solely on inherent risk might actually present more risk to the organization than the MSB, which presents a high inherent risk. As every financial organization develops transaction history with customers, it should consider modifying the risk rating of the customer, based on: • Unusual activity, such as alerts, cases, and SAR filings • Receipt of law enforcement inquiries, such as subpoenas • Transactions that violate economic sanctions programs • Other considerations, such as significant volumes of activity where it would not be expected, such as a domestic charity receiving multiple deposits (e.g., cash and electronic transfers) and then engaging in large international transactions, or businesses engaged in large volumes of cash when this would not typically be expected A financial organization’s knowledge of a customer based on its activity will better determine the actual risk presented by a customer. As noted elsewhere, higher risk customers, including those whose activity drives a higher risk rating, should be subject to EDD to mitigate the risk. This EDD might ultimately determine that the activity is not suspicious. If so, the customer record should be updated to reflect a change that explains its activity. AML/CFT Risk Identification The core of a risk-based approach includes the assessment of risk of a financial organization’s customers, geographical locations/jurisdictions, and products and services. Following is a more in-depth explanation of these three important risk factors. Risk types/factors Customer type A vital step in a risk assessment is the analysis of the users of the products and services that the organization offers. Customer types can include individuals, listed companies, private companies, joint ventures, partnerships, and financial institutions—basically anyone who wants to establish a relationship with the organization. Customers who have a history of involvement in criminal activities receive the highest ratings. Political figures and individuals involved in political organizations also score toward the top of the scale. Multinational public corporations tend to score lower than private companies, because there is much more publicly available information and due diligence conducted on a corporation listed on a major stock exchange. Risks are generally higher if a money launderer can hide behind corporate vehicles, such as trusts, charities, limited liability companies, and structures, for which it is difficult to identify the beneficial owners. The risk is even higher if corporations are based in countries with inadequate AML requirements or strict corporate secrecy protections. Supervisory authorities in various countries have identified some types of customers are inherently high risk for money laundering, including: • Banks • Casinos • Offshore corporations and banks located in tax/banking havens • Embassies • MSBs, including currency exchange houses, money remitters, and check cashers • Virtual currency exchanges • Car, boat, and airplane dealerships • Used car and truck dealers and machine parts manufacturers • Professional service providers (e.g., attorneys, accountants, investment brokers, and other third parties who act as financial liaisons for their clients) • Travel agencies • Broker-dealers in securities • Jewel, gem, and precious metals dealers • Import and export companies • Cash-intensive businesses (e.g., restaurants, retail stores, parking) The list above does not include all industries that could be considered high risk. It is important to note that industry alone does not determine risk. Many other types of businesses could be used to launder money, and many other factors need to be considered. Implementing a strong screening process when onboarding a customer and throughout the duration of the relationship are key components to identifying high-risk customer types. Geographic location/jurisdiction A crucial step in devising a risk-scoring model involves evaluating jurisdictional risk. In what countries or jurisdictions do your individual customers reside, and what are their countries of citizenship? Where are your corporate customers headquartered, and where do they conduct the majority of their business? There is no definitive independent system for assessing the money laundering risks of various territories and countries. Some organizations devise their own methods, while others use a vendor solution. Whichever method is chosen, it is essential that the risk-rating methodology be documented. In larger organizations, the overall risk-management strategy might require the outputs of the ML/TF risk model to be formally reviewed and endorsed by executive and senior management. When specifically evaluating money laundering risk, the terrorism and sanctions lists published by governments and international organizations can be a useful starting point. These include lists published by the United Kingdom’s Financial Conduct Authority (FCA), OFAC, FinCEN, the EU, the World Bank, the United Nations Security Council, and each local jurisdictions’ regulatory and law enforcement agencies, such as Indonesia’s National Counter Terrorism Agency. A risk management model should also take into account whether a country is a member of FATF or an FSRB and has AML/CFT requirements equivalent to international best practices. Organizations might also consider the overall reputation of the countries in question. In some, cash may be a standard medium of exchange. Other countries might have politically unstable regimes and high levels of public or private sector corruption. Some might have a reputation as bank secrecy havens. Still others might be widely known to have high levels of internal drug production or to be located in drug transit regions. How can an organization identify high-risk countries? • The US Department of State issues an annual International Narcotics Control Strategy Report, which rates more than 100 countries on their money laundering controls. • Transparency International publishes a yearly Corruption Perceptions Index, which rates more than 100 countries on perceived corruption. • FATF identifies jurisdictions with weak AML/CFT regimes and issues country-specific mutual evaluation reports. • In the US, certain domestic jurisdictions are evaluated based on whether they fall within government-identified higher risk geographic locations, such as high-intensity drug trafficking areas (HIDTAs) and high-intensity financial crime areas (HIFCAs). Monitoring major news media is also recommended, and care should be taken that all of the country lists are monitored on a regular basis for changes. Products and services An important element of assessing AML/CFT risk is to review new and existing products and services that the organization or business offers to determine how they could be used to launder money or finance terrorism. The compliance officer should be an active participant in project teams that identify appropriate control frameworks for new products and systems. What products and services does your institution offer that might be vulnerable to money laundering or terrorist financing? Internet accounts? Private banking? Money transmittal services? Stock brokerage services? Annuities? Insurance products? Offshore services? Money orders? Correspondent banking? This risk rating, based on the type of product the customer seeks, is calculated using several product-related factors. Most notably, it depends on the likelihood that the product requested might be used for money laundering or terrorist financing. Interest-rate swaps are not likely to be used to finance terror, but securities might be vulnerable. Product scoring is not universal, because different financial organizations face varying degrees of risk. When assessing the AML/CFT risks of products and services, consider whether they: • Enable significant volumes of transactions to occur rapidly • Allow the customer to engage in transactions with minimal oversight by the organization • Afford significant levels of anonymity to the users • Have an especially high transaction or investment value • Allow payments to third parties • Have unusual complexity • Require government verification of customer eligibility In addition, certain banking functions and products are considered high risk, including: • Private banking • Offshore international activity • Deposit-taking facilities • Wire transfer and cash-management functions • Transactions in which the primary beneficiary is undisclosed • Loan guarantee schemes • Travelers checks • Official bank checks • Money orders • Foreign exchange transactions • International remittances • Payment services such as payment processors, prepaid products, automatic clearing house • Remote deposit capture • Trade-financing transactions with unusual pricing features • Payable through accounts AML/CFT risk identification (Case example: Failure to identify high-risk activity) In September 2020, Westpac Banking Corporation agreed to a penalty of AUD$1.3 billion for over 23 million breaches of Australia’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act. The financial regulator Australian Transaction Reports and Analysis Centre (AUSTRAC) launched legal action against Westpac in November 2019, for failing to detect and report nearly 3,000 transactions that suggested activity linked to child exploitation. AUSTRAC accused Westpac of systemic financial crime control failures. In 2016, senior managers were alerted to the risk of suspicious payments using its low-value payment service, LitePay. Westpac did not implement controls to detect illicit activity using LitePay for two years. According to AUSTRAC, Westpac failed to monitor customers whose activities indicated child exploitation, did not identify typologies that were indicative of child exploitation, did not apply them to transaction monitoring systems, and did not carry out appropriate customer due diligence for suspicious transactions associated with possible child exploitation. By May 2016 Westpac had determined that the child exploitation risks relating to low-value payments to the Philippines were increasing. In response, it introduced a detection scenario to one of its payment channels that failed to detect any issues. The detection test was replaced by another in June 2018 that was an appropriate analytical tool but it was applied to only one payment channel, LitePay. Twelve customers were identified with links to the Philippines and Southeast Asia, which are high. Eleven of them had activity patterns of frequent, lowvalue transactions that were consistent with child exploitation typologies. One customer had a prior conviction for child sexual exploitation, which should have triggered EDD by the bank. Six of the individuals regularly traveled to the Philippines and Southeast Asia. AUSTRAC alleged that, if Westpac had conducted appropriate due diligence and in particular applied appropriate detection tools for child exploitation typologies, these customers would have been identified earlier. AUSTRAC found that Westpac had also failed to adequately assess high-risk correspondent banking risks. This failure led to relationships with other banks that held nested relationships with respondents in several sanctioned and high-risk countries, including the DRC, Iraq, Libya, and Zimbabwe. Key takeaways • Westpac did not apply the correct typologies or monitoring tools to detect payments linked to child exploitation, even when the risks had been identified. • Westpac did not have a consistent and clear understanding of its AML/CFT risk and how it should be managed and mitigated. • Westpac’s control failures extended to other high-risk areas such as correspondent banking.