Monitoring and Screening

Monitoring and Screening Economic Sanctions Economic sanctions are a way to influence the behavior of a jurisdiction or group by financially isolating it as the “target.” Increasingly, countries are using economic sanctions instead of military force as an instrument of foreign policy. Sanctions can generally fall into one of the following categories: • Targeted sanctions: Aimed at specific, named individuals, such as key leaders in a country or territory; named terrorists; significant narcotics traffickers; and proliferators of WMD. These sanctions often include the freezing of assets and travel bans, when possible. • Sectoral sanctions: Aimed at key sectors of an economy to prohibit a very specific subset of financial dealings within those sectors to impede future growth • Comprehensive sanctions: Generally prohibit all direct and indirect import/export, trade brokering, financing, and facilitating of most goods, technology, and services. Comprehensive sanctions are often aimed at regimes that are responsible for gross human rights violations and nuclear proliferation. Governments impose economic sanctions on state and non-state actors for the purpose of altering the behavior that threatens the interests of the government or violates international norms of behavior. Most jurisdictions impose sanctions regimes, particularly to comply with sanctions imposed by the United Nations and, for members, the European Union. With similar goals in their application, there is expected overlap in the sanctions applied by these bodies. United Nations UN sanctions are managed by the UN Security Council committees. The UN Security Council can take actions to maintain and restore international peace and security under Chapter VII of the United Nations Charter. Sanctions measures, under Article 41, encompass a broad range of enforcement options that do not involve the use of armed force. Security Council sanctions take several different forms in pursuit of a variety of goals. The measures range from comprehensive economic and trade sanctions to more targeted measures, such as arms embargoes, travel bans, and financial or commodity restrictions. The Security Council applies sanctions to support peaceful transitions, deter nonconstitutional changes, constrain and deter terrorism, protect human rights, and promote nonproliferation. European Union Article 215 of the Treaty on the Functioning of the European Union provides a legal basis for the interruption or reduction, in part or completely, of the EU’s economic and financial relations with one or more third countries (i.e., countries outside the EU), when such restrictive measures are necessary to achieve the objectives of the Common Foreign and Security Policy. In general terms, the EU imposes its restrictive measures to bring about a change in policy or activity by the target country, part of a country, government, entities, or individuals. The measures are preventive, nonpunitive instruments that allow the EU to respond swiftly to political challenges and developments. The EU wields measures in support of human rights and democracy objectives in the absence of a United Nations mandate and has supplemented UN sanctions to stop nuclear proliferation in Iran and North Korea. United States One of the most widely known sanctions lists is OFAC’s Specially Designated Nationals and Blocked Persons (SDN) list. Updated often, the SDN list includes thousands of names of individuals and businesses, as well as aircraft and ships (vessels) from more than 150 countries, which the US government considers to be terrorists, international narcotics traffickers, and other criminals covered by US foreign policy and trade sanctions. Similar to the UN and EU, OFAC applies sanctions to deter nonconstitutional changes, constrain and deter terrorism, and protect human rights. Under sanctions programs administered by OFAC, all US citizens and companies, including foreign subsidiaries and affiliates owned or controlled by US companies, are prohibited from providing property, or an interest in property, to a sanctions target when a general or specific license has not been issued. This includes individuals, companies, property, countries (e.g., North Korea, Syria, Cuba, and Iran) that are subject to a sanctions program. Depending on the specific program, action might involve blocking (or freezing) a transaction or rejecting or returning a transaction. OFAC is not a supervisory agency, but it works closely with supervisory agencies at both the federal and state levels. During examinations of financial organizations, supervisory examiners review OFAC compliance efforts, including policies and procedures, training, testing, and tuning of screening systems, to determine a financial organization’s ability to effectively detect SDNs and entities that are sanctioned within all of OFAC’s programs—even entities that are not specially designated—and to comply with OFAC’s sanctions programs. If a financial organization is found to have weak OFAC controls, is engaged in activity with an entity identified on the SDN list, or is sanctioned under any OFAC sanctions program, federal and state examiners and OFAC may take actions, including, but not limited to, issuing monetary penalties, criminal penalties, and regulatory actions (e.g., Written Agreements and Matters Requiring Attention). The sanctions programs are governed by several laws and regulations and are subject to change; therefore, sanctions compliance requires a specialized skill set and constant attention to the changing nature of sanctions. Sanctions List Screening Before a financial organization starts doing business with a new customer or engages in certain transactions (e.g., international wire payments), it should review the various country sanctions program requirements, as well as published lists of known or suspected terrorists, narcotics traffickers, and other criminals, for potential matches. Organizations subject to sanctions compliance are required to screen customers and transaction records against periodically updated lists that include individuals and entities designated or identified by governmental bodies. Sanctions lists identify terrorists, terrorist organizations, and supporters of terrorism, as well as individuals and entities subject to targeted, sectoral, and comprehensive sanctions. Financial organizations must be alert to transactions that involve parties identified on a sanctions list. This can be difficult, particularly because it involves screening customer lists for people whose names are not originally in Roman characters, such as suspected terrorists from Middle Eastern countries and sanctions lists in Asian countries. For example, most of the names of designated terrorists on the OFAC SDN list also include numerous “also known as” alternatives. Although some names might be aliases, others are confusing because the naming conventions are not understood. An understanding of Arab naming conventions and protocols can help alleviate the confusion. Below are some helpful tips: • When Arabic names are written in another alphabet, the spelling might vary. For example, “Mohammed” might be written as “Mohamed” or “Mohamad.” • Arabic names are typically long. A person’s second name is the father’s name. A "bin" or "ibn" preceding the name indicates “son of.” If a family name is included at the end, it will sometimes be preceded by "al." • There is widespread use of certain names, such as Mohamed, Ahmed, Ali, and names with the prefix Abd- or Abdul, which means servant of, and is followed by one of 99 suffixes used to describe God. • Many Arabic names begin with the word "Abu." If it is a first name, it is probably not the person’s given name, because "Abu" means "father of." Abu followed by a noun means “freedom” or “struggle,” and it is used by both terrorists and legitimate political leaders. Only when Abu is a prefix of a surname should it be accepted as a given name. Politically Exposed Persons Screening Although financial organizations take measures to develop robust procedures and screening processes to comply with sanctions and other customer screening requirements, these controls sometimes fail to detect suspicious high-risk individuals and businesses that organizations should avoid. For example, intergovernmental bodies, such as FATF in its 40 Recommendations, explicitly reference PEPs, and government regulations, specifically the EU’s Fourth Directive, explicitly detail requirements related to PEPs. However, there is no simple way to identify PEPs and their associates. The problem is the lack of available and useful information about the identity of PEPs around the world. There are many private providers that offer PEP databases; however, the information contained in them and the ability to positively match customers with PEPs on a database can be challenging. In addition, as increased scrutiny continues to be placed on PEPs, they have become more creative in finding ways to avoid detection, such as opening accounts in the names of corporations (e.g., shell companies) in offshore jurisdictions instead of in their own names or the names of close family members. On the other hand, considering geographical issues, the size and nature of an account, and the purpose of an account might raise PEP-related issues. There are some publicly available sources of information that can be used to help identify PEPs and their associates. Transparency International, a global, nongovernmental organization devoted to combating corruption, publishes the Corruption Perceptions Index, which is useful in focusing on high-risk jurisdictions. Some government agencies, such as the US Central Intelligence Agency, publish lists of heads of state and cabinet members of foreign governments. However, these lists do not provide all relevant information related to PEPs that would assist in identifying them. For example, they do not include unique identifiers, such as date of birth or address, which poses significant operational constraints, particularly at large retail financial organizations. Accepting corruption proceeds from PEPs constitutes money laundering in the United States. Under some countries’ laws, it may be a violation of its sanctions rules. Because it is difficult to identify these parties, it is important to have strong CDD and monitoring controls. It is also important to continually review and update customer screening and sanctions programs. This includes updating procedures, tuning, and testing screening tools and training staff. Know Your Employee Financial organizations and businesses have learned at great expense that an insider can pose the same money laundering threat as a customer. It has become clear in the AML/CFT field that equivalent programs to know your customer and know your employee (including contractors and third-party vendors who support AML controls) are essential. A Know Your Employee (KYE) program ensures that an organization has the means to understand an employee’s background, conflicts of interest, and susceptibility to money laundering complicity. Policies, procedures, internal controls, job descriptions, levels of authority, compliance with personnel laws and regulations, accountability, monitoring, dual control, and other deterrents should be firmly in place. Additionally, codes of conduct and ethics should specify mandatory requirements to report suspicious activity to the MLRO and that failure to comply subjects an employee to disciplinary action and possible employment termination. Background screening of prospective and current employees and vendors, especially for criminal history and ties to negative media, is essential to prevent unwanted relationships and identify employees that should be terminated. The US Federal Deposit Insurance Corporation (FDIC) provides guidance on employee screening in its paper, Pre-Employment Background Screening: Guidance on Developing an Effective Pre-Employment Background Screening Process. Background screening can be an effective risk-management tool that provides management with some assurance that the information provided by the applicant is true and that the potential employee has no criminal record. Used effectively, pre-employment background checks can reduce turnover by verifying that the potential employee has the requisite skills, certification, license, or degree for the position; deter theft and embezzlement; and prevent litigation over hiring practices. An organization should also verify that contractors and vendors are subject to screening procedures similar to its own and include anti-corruption compliance clauses in agreements. Developing and implementing an effective screening process can be costly. However, without such a process, an organization might incur significant expenses in recruiting, hiring, training, and ultimately terminating unqualified individuals. Sometimes, regulations prohibit a person who has been convicted of a crime involving dishonesty or money laundering from becoming or continuing as an institution-affiliated party; owning or controlling, directly or indirectly, an institution; or otherwise participating, directly or indirectly, in the conduct of the affairs of an institution without the prior written consent of the regulator. Consultants who take part in the affairs of a financial organization could be subject to this requirement, too. Therefore, pre-employment background screening should be established by all financial organizations, which, at a minimum, reveals information regarding a job applicant’s criminal convictions. Sometimes, the level of screening should be increased. The sensitivity of the position and the access level of an individual employee might warrant additional background screening, which should include verification of references, experience, education and professional qualifications, according to the FDIC. The Monetary Authority of Singapore’s guidelines on employee hiring also include screening against ML/TF information sources, bankruptcy searches, and credit history checks. Just as management verifies the identity of customers, it should also verify the identity of job applicants. Once the person is hired, an ongoing approach to screening should be considered for specific positions, as circumstances change or as needed for a comprehensive review of departmental staff over a period of time. Management should also establish policies that address what to do when screening uncovers information contrary to what the applicant or employee provided. An organization can perform fingerprint checks periodically for employees in sensitive positions, and contract with a vendor to conduct extensive background checks when employees are being considered for promotion to high-level positions. Without such screening procedures in place, financial organizations risk violating the prohibition against employing statutorily disqualified individuals. The extent of the screening depends on the circumstances, with reasonableness being the standard. In the UK, the Centre for the Protection of National Infrastructure (CPNI) publishes informative guidelines regarding insider threat and risk management. It includes examples of how insider threats and data leakages can have devastating effects on an organization. Within financial organizations, this could include abuse of pre-market information only known by insiders. Many banks these days train their staff how to treat data in a transparent, customer-centric, and law-abiding manner. Regularly repeated training of employees regarding what is expected from them should be part of typical on-the-job training. With social media being an important day-to-day communication form for both private people and organizations, KYE programs might also require organizations to monitor what employees and other insiders mention and like on their social media accounts. Social media accounts and posts on these accounts can provide ample information regarding how a person might behave in an organization. KYE (Case example: Citigroup Global Markets Inc.) The Financial Industry Regulatory Authority (FINRA) regulates brokerage firms doing business with the public in the US. In July 2019, it fined Citigroup Global Markets Inc. (CGMI) US$1.25 million. FINRA found that CGMI failed to conduct timely and adequate background checks on more than 10,000 employees and may not have fingerprinted all required employees over a seven-year period. US federal securities laws require broker-dealers to perform background screening and to fingerprint certain employees. These “know your employee” requirements help determine if a person has a statutory disqualification that would prevent them from being associated with a FINRA member firm without explicit regulatory approval. The failure to implement these supervisory controls and procedures prior to employment meant that CGMI did not determine whether the individuals it hired were subject to statutory disqualification. In fact, FINRA found that CGMI employed or associated with three individuals who were subject to statutory disqualification due to previous criminal convictions. Background checks, or background screening, are an important part of an organization’s know –your employee (KYE program). The purpose of a KYE program is to ensure an institution does not compromise the financial system by employing or associating with individuals with disqualifying criminal or regulatory histories. Depending on the employer's risk appetite, screening is typically completed before employment, with other regulatory requirements completed before onboarding. Regulators expect organizations to serve as responsible gatekeepers that protect the financial system, themselves, their customers, and their investors from criminals. This case highlights the importance of regulatory expectations and requirements for institutions concerning employment practices. Your organizations need to know the requirements in your jurisdictions. Your organization needs to develop and implement risk-based KYE frameworks to ensure potential employees are properly screened and fingerprinted. These practices protect the institution, customers, investors, and the financial system. Key takeaways • Know your regulatory requirements for KYE. • Effective KYE require background checks and fingerprinting. • Use a risk-based approach to the timing of background checks and other pre-employment requirements. • KYE protects regulated companies, their customers and investors, and the financial system. Suspicious and Unusual Transaction Monitoring and Reporting Proper due diligence could require compliance personnel to gather further information regarding a customer or transaction before deeming it suspicious and filing an SAR. Although there are no hard and fast rules regarding what constitutes suspicious activity, employees of financial organizations should watch for activity that might be inconsistent with a customer’s source of income or regular business activities. Because financial organizations process thousands of transactions each day, their systems for monitoring and reporting suspicious activity should be riskbased and determined by factors such as the organization’s size, the nature of its business, its location, the frequency and size of transactions, and the types and geographical locations of its customers. Generally, the core operating system of a financial organization maintains significant customer data and can be utilized to generate specific internal reports that are useful for discovering possible money laundering and terrorist financing. Examples of these reports include: • Daily cash activity exceeding the country’s reporting threshold • Daily cash activity just below the country’s reporting threshold (to identify possible structuring) • Cash activity aggregated over a period of time (e.g., individual transactions over a certain amount or totaling more than a certain amount over a 30day period, to identify possible structuring); • Wire transfer reports/logs with filters using amounts and geographical factors • Monetary instrument logs/reports • Check kiting/drawing on uncollected funds with significant debit/credit flows • Significant change reports • New account activity reports Although reporting procedures vary from country to country, a typical suspicious or unusual transaction reporting process within a financial organization as part of its AML/CFT program includes: • Procedures to identify suspicious and unusual transactions and activity through various channels, including employee observations and identification, inquiries from law enforcement, and alerts generated by transaction monitoring systems • Formal evaluation of each instance and continuation of unusual transactions and activity • Documentation of the SAR reporting decision (i.e., whether or not a report was filed with authorities) • Procedures to periodically notify senior management or the board of directors of SAR filings • Employee training on detecting suspicious transactions and activity Most countries that require SAR reporting prohibit disclosing the filing to the subject of the report (i.e., tipping off). In the United States, a financial organization and its directors, officers, employees, and agents may not notify any person involved in the transaction that it has been reported. Most laws also grant immunity from civil liability (i.e., safe harbor) to the filing organization and its employees. The US has even made it illegal to reveal information that would lead to knowledge of the existence of a SAR. This includes not only a prohibition on divulging the SAR itself, but also the fact that a SAR was or was not filed. For example, if an employee of a financial organization were asked whether it had filed a SAR, a failure to answer could indirectly indicate that a SAR had been filed. The confidentiality of SARs is a critical aspect of the whole reporting program, because it protects financial organizations from being intimidated from filing reports. After all, the reports are meant to provide useful information to law enforcement, and the threat of lawsuits by criminals should not deter financial organizations from fulfilling this important duty. Strong recordkeeping procedures are key to managing any regulatory and legal implications of SAR filing. National laws and regulations usually dictate the length of time financial organizations and businesses must maintain records, the types of records that must be stored, and how they should be provided to regulatory and law enforcement personnel upon request. There is no international clearinghouse for keeping SARs, but FIUs in various countries often publish reports on how many SARs are filed each year, which areas are filing the most reports, and what the suspicious activity and typology trends are, as well as case studies. This information provides added guidance to financial organizations operating within their jurisdiction regarding their AML/CFT obligations. Automated AML/CFT Solutions The sheer number of people and the volume of regulations and data involved in complying with regulations make manual AML/CFT compliance difficult, if not impossible. Most organizations have designated technology systems to automate their compliance activities, and some still undertake their efforts manually. Appropriately functioning technology can equip financial organizations with improved defenses in the fight against financial crime by providing the following: • Automated customer verification: Using third-party databases to compare information provided by a customer with source data • Watch list filtering: Screening new accounts, existing customers, beneficiaries, and transaction counterparties against terrorist, criminal, and other blocked-persons sanctions and/or watch lists • Transaction monitoring: Scanning and analyzing transactional data for potential money laundering activity • Automation of regulatory reporting: Filing SARs, CTRs, and other regulatory reports with the government • Case management: Providing a dashboard feature to view customer KYC, transaction history, investigations undertaken, and regulatory filings filed on a customer • Audit trail: Documenting steps taken to demonstrate compliance efforts to auditors and supervisory authorities Automation is used for more than increased efficiency and control. It also can reflect a company’s commitment to meet or exceed compliance requirements. A byproduct of this commitment is that regulators can receive prompt, concise, and properly formatted information. Many software companies offer technology dedicated to combat laundering, and some organizations have internally generated electronic systems. Before designing an AML/CFT compliance program or purchasing new technology, financial organizations should review the feasibility, costs, and benefits to be derived from each course of action. Some financial organizations choose to hire a vendor to provide AML/CFT software packages. Many organizations use a Request for Proposal (RFP) method in which they issue RFPs to software providers that might be qualified to participate. An RFP lists project specifications and application procedures. The objective of the RFP is to select a system that will assist the organization in completing its responsibilities under applicable money laundering regulations. The system(s) can help identify potentially high-risk customers, accounts, and transactions; aid in conducting, managing, and documenting any resulting investigations; and streamline the completion and filing of required SARs. Most organizations seek a partner with a longstanding commitment to stay ahead of the rapidly changing regulatory landscape and experience that reflects flexibility, agility, and urgency in delivering features that improve its clients’ efficiency in monitoring the right transactions and investigating the right clients. Ideally, the system is flexible, fast, and efficient to deploy. It should allow the organization to navigate seamlessly around client relationships, accounts, and transactions across a variety of product lines and systems, including deposits, wires, transfers, loans, trust, brokerage, letters of credit, and check-imaging applications. A single view into customer relationships is of paramount importance in delivering efficient, reliable, and instant access to information. Each organization needs to identify the vendor that best meets its needs. During the RFP process, most organizations form evaluation teams comprising management staff from the compliance, operations, technology, and business departments. The team, facilitated by the project manager, is responsible for reviewing and scoring all responses to the RFP. Determining the most applicable system for a financial organization depends on its customer base, size, and products and services offered. In general, it should consider the following capabilities of the system during its assessment process: • Ability to monitor transactions and identify anomalies that might indicate suspicious activity • Ability to gather CDD information for new and existing customers, score customer responses, and store CDD data for subsequent use • Ability to conduct advanced evaluation and analysis of suspicious and unusual transactions identified by the monitoring system in the context of each customer’s risk profile and that of his peer group • Ability to view individual alerts within the broader context of the customer’s total activity at the organization • Workflow features, including the ability to create a case from an alert or series of alerts, collaborate (simultaneously or serially) among multiple interested parties to view and update information, and share AML/CFTrelated information across monitoring and investigating units and throughout the organization, as needed • Ability to use data from the organization’s core customer and transaction systems and databases to inform and update monitoring and casemanagement activities • Ability to store and recall at least 12 months of data for trend analysis • Ability to manage the assignment, routing, approval, and ongoing monitoring of suspicious activity investigations • Automated preparation and filing of SARs to FIUs • Standard and ad-hoc reporting on the nature and volume of suspicious activity investigations and investigator productivity for management and other audiences • Enhanced ability to plan, assign, and monitor the caseload per employee of AML-related investigations • Ability to provide comprehensive and accurate reporting of all aspects of AML compliance, including reporting to management, reporting to regulators, productivity reporting, and ad-hoc reporting • User-friendly updating of risk-parameter settings without the need for special technical computing skills • Tiered user-rights access for users, managers, and auditors In addition to the above features, financial organizations should evaluate the following aspects of automated systems: • Ease of use of the application, as well as the configuration of new and changed transaction monitoring rules • Ease of data integration, system implementation, and configuration • Scalability of application, i.e., the ability of the system to grow with the organization • Extent to which the system can be supported with internal resources • User satisfaction with hardware and software support • Price, including initial cost and ongoing costs to sustain the system or expand its capabilities, both in terms of what the vendor will charge and how much the organization will need to spend in terms of dollars, personnel, and technology capacity In addition to providing possible regulatory compliance solutions, automated tools can help an organization analyze how customers and other users are using its products and services. For marketing purposes, patterns of activity among types of customers and different business lines can be represented by graphs and statistical reports. Depending on an organization’s needs, a variety of software products can automate these tasks—from standard analytical systems to sophisticated artificial intelligence. Automated tools can also help with documentation management, which can be a significant burden for many financial organizations. Historically, imaging systems offered quick and paperless access to records. However, convenience is not enough. New systems can track and report the status of all documents, including those that are missing and expired. One-stop access systems can provide images, standardization, and control for documents that must be accounted for and produced for compliance purposes.