AML-CFT Program

AML/CFT Program The Elements of an AML/CFT Program Commonly referred to as the four pillars, the basic elements of an effective AML/CFT program are: • A system of internal policies, procedures, and controls (first line of defense) • A designated compliance function with a compliance officer (second line of defense) • An ongoing employee training program • An independent audit function to test the overall effectiveness of the AML program (third line of defense) Although CDD requirements have traditionally been encompassed in the system of internal controls, FATF focuses particular attention on CDD as a critical means of mitigating AML/CFT risk. Under a 2016 rule, FinCEN established a fifth pillar that requires appropriate, risk-based procedures for conducting ongoing CDD, raising the prominence of this critical aspect of AML/CFT programs to its own pillar. These procedures include: • Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile • Conducting ongoing monitoring to identify and report suspicious transactions • Maintaining and updating customer information The AML/CFT legislation in a number of countries identifies the mandatory elements of an AML/CFT program. Organizations should ensure that all such elements are addressed, based on the laws and regulations in the jurisdictions in which they operate. A System of Internal Policies, Procedures, and Controls The establishment and continual development of a financial organization’s policies, procedures, and controls are foundational to a successful AML/CFT program. Together, these three parts define and support the entire AML/CFT program. At the same time, they serve as a blueprint that outlines how an organization fulfills its regulatory requirements. All three parts should be designed to mitigate the identified AML/CFT risks and should take into account the applicable AML/CFT laws and regulations with which the financial organization must comply. They should clearly indicate the risk appetite of the business, that is, which risks the business is prepared to accept and which it is not. Although these controls are typically applied by the first line of defense (i.e., the employees who are responsible for onboarding customers), every employee throughout a financial organization, at all levels of the organization, must contribute to the creation, maintenance, and overall success of the AML/CFT program. In large financial organizations, there is a critical need to adopt an enterprisewide approach that allows for consistency in the manner in which the financial organization manages its ML/TF risk. However, there is also a need to accommodate regional and/or business line-specific requirements. For example, enterprise-wide ML/TF risk models in financial organizations that operate in multiple regions and/or countries need to reflect the local regulatory requirements. This can be achieved by having a different version of the AML/CFT program or by having country-specific addenda to the global AML/CFT program. Internal AML/CFT policies should be established and approved by executive management and the board of directors, which sets the tone for the organization. Although the organization’s policy may be a high-level statement of principles, it serves as the basis for procedures and controls that detail how lines of business will achieve compliance with laws, regulations, and the organization’s AML/CFT policies. The standard AML/CFT operating procedures should be drafted at the operational level in the financial organization. These procedures must be modified and updated, as needed, to reflect changes in laws and regulations, products, and the organization itself. These procedures are more detailed than the corresponding AML/CFT policies; they translate policy into acceptable and workable practices. The procedures also form the basis of an important component of AML/CFT training, and the compliance monitoring programs. In addition to policies and procedures, organizations need a process to support and facilitate effective implementation of procedures, which should be reviewed and updated regularly. Although policies and procedures provide important guidance, the AML/CFT program also relies on a variety of internal controls, including management reports and other built-in safeguards that keep the program working. These internal controls should enable the compliance department to recognize deviations from standard procedures and safety protocols. A matter as simple as requiring a corporate officer’s approval or two signatures for transactions that exceed a prescribed amount could be a critical internal control element that, if ignored, seriously weakens an organization’s AML/CFT program and attracts unwanted attention from supervisory authorities. Similarly, a second review and approval of actions considered to be departures from policy could be helpful when subsequent questions arise. Other effective controls use technology, such as account opening systems that force the entry of required information, aggregation systems that detect reportable currency transactions, and automated account monitoring programs. AML policies, procedures, and controls An AML/CFT compliance program should be in writing and include policies, procedures, and controls that are designed to prevent, detect, and deter money laundering and terrorist financing, including how the organization will: • Identify high-risk operations (products, services, delivery channels, customers, and geographic locations/jurisdictions). • Periodically update its risk profile and provide for an AML/CFT compliance program tailored to manage risks. • Inform the board of directors (or a committee of the board) and senior management of compliance initiatives, known compliance deficiencies, SARs filed, and corrective actions taken. • Develop and maintain a system of metrics reporting that provides accurate and timely information on the status of the AML/CFT program, including statistics on key elements of the program, such as the number of transactions monitored, alerts generated, cases created, and SARs filed. • Assign clear accountability to people for performance of duties under the AML/CFT program. • Provide for program continuity, despite changes in management, employee composition, or structure. • Meet all regulatory requirements and recommendations for AML/CFT compliance. • Provide for periodic review and timely updates to implement changes in regulations, at least on an annual basis. • Implement risk-based CDD policies, procedures, and processes. • Provide for dual controls and segregation of duties. • Comply with all recordkeeping requirements, including retention and retrieval of records. • Provide sufficient controls and monitoring systems for the timely detection and reporting of potentially suspicious activity and large transaction reporting. This should also include a procedure for recording the rationale for not reporting activity as a result of the findings of any investigation. • Establish clear accountability lines and responsibilities to ensure that there is appropriate and effective oversight of staff who engage in activities that might pose an AML/CFT risk. • Establish training requirements and standards to ensure that employers are made aware of and have a working understanding of the procedures to be followed and their relevance to mitigating AML/CFT risks in their departments or areas of responsibilities. • Clearly explain the importance of reporting suspicious activity, including describing how and to whom concerns should be raised, the role of the compliance officer, and what the “tipping off” restriction means in practice. • Incorporate into all job descriptions and performance review processes the requirement to comply at all times with AML policies and procedures. Noncompliance should be addressed in accordance with existing disciplinary processes. • Develop and implement screening programs to ensure high standards when hiring employees. Implement appropriate disciplinary actions for employees who consistently fail to perform in accordance with an AML/CFT framework. • Develop and implement quality assurance testing programs to assess the effectiveness of the AML/CFT program’s implementation and execution of its requirements. This is separate from the independent audit requirement, but it serves a similar purpose—to assess the ongoing effectiveness of the program. The level of sophistication a financial organization needs to maintain concerning its policies, procedures, and controls directly correlates to its size, structure, risk, and complexity of products, among other factors. Failure to establish, perform, follow, and maintain adequate policies, procedures, and controls can lead to severe enforcements against the organization or designated individuals involved. Highlights of and Differences between AML/CFT Policies, Procedures, and Controls Policies • Clear and simple high-level statements that are uniform across the entire organization (set the tone from the top) • Approved by executive management or the board of directors • Reflect the high-level responsibilities of the stakeholders throughout the organization Procedures • Translate the AML/CFT policies into an acceptable and workable practice, tasking the stakeholders with their respective responsibilities • The instructions for how an organization wants something done • Typically established at the operational (not executive) level of the financial institution Controls • Much more detailed than AML policies • Reviewed and updated regularly • The internal technology or tools the financial organization uses to ensure the AML/CFT program is functioning as intended and within predefined parameters • Alert compliance department to potential outliers and deviations from normal policy that may need to be reviewed • Includes management reports, automated review systems, and the utilization of multiple reviewers A system of internal policies, procedures, and controls (Case example: Lack of overall policy control and oversight) In October 2016, the Monetary Authority of Singapore (MAS) revoked the license of the Singapore branch of Falcon Bank Limited, due to AML/CTF failures. In 2015, an MAS investigation found that the bank’s AML/CTF failings had significantly worsened following a previous inspection. One particularly serious infraction involved an individual linked to the 1Malaysia Development Berhad (1MDB) scandal and was facilitated by the actions of a former member of senior management. MAS determined that the failings could not be rectified and ordered the closure of the branch. It also issued a fine of SGD 4.3 million, about US$3.2 million for 14 breaches of AML/CTF regulations. The Singapore branch manager was sentenced to 28 weeks in jail and personally fined SGD 128,000, about US$94,000. MAS had first identified AML/CFT failings with Falcon Bank following an inspection in 2013. At that time, it fined the bank and ordered it to correct its AML/CTF control deficiencies in client onboarding and transaction monitoring. When MAS conducted a follow-up inspection in 2015, it found that, instead of rectifying its deficiencies, the situation had deteriorated. Between 2012 and mid-2015, the bank’s managers approved US$3.8 billion (SGD 5.2 billion) of asset transfers linked to the 1MDB fund. Despite the identification of red flags in these payments, the transactions were processed at the urging of senior management who coerced them to process the unusually large payments. The Singapore branch manager was accused of failing to take action on more than SGD 1.3 billion or US$1 billion in payments linked to 1MDB. He was also accused of lying about his links to the alleged mastermind of the 1MDB money flows out of Malaysia. The court stated that his sentence was intended to be a deterrent to other bankers. This case illustrates the need for an effective second line of defense. Compliance staff must provide adequate and effective challenge to the business and senior management when their actions directly or indirectly facilitate money laundering. Regulators may impose fines and imprisonment upon staff who have willfully participated in money laundering activity. Key takeaways • Falcon Bank failed to remedy its AML/CTF control deficiencies, and regulators found the situation got progressively worse. • Senior management exerted influence to facilitate transactions that were flagged as suspicious and unusually large. • The sentencing of the Singapore branch manager was intended to be a deterrent to other bankers. A system of internal policies, procedures, and controls (Case example: PEP risks) In April 2017, the Hong Kong Monetary Authority (HKMA) fined the Hong Kong branch of Coutts & Co AG HKD 7 million. HKMA determined the bank failed to identify clients who were politically exposed persons (PEPs) due to a lack of effective policies and procedures. Contributing to the ineffective control framework were multiple systemic failings. These included only partial screening of customers, lack of action on screening alerts, delays in obtaining senior management approvals for customer relationships with PEPs, and undisclosed customer due diligence (CDD) failures. Following the fine, Coutts cooperated with HKMA and adopted remedial measures to address the deficiencies. HKMA determined that, between 2012 and 2015, Coutts failed to establish effective procedures for identifying PEPs in its customer base, including beneficial owners. This deficiency prevented PEPs from being identified by the bank, even when relevant information was publicly available. HKMA found that Coutts had subscribed to a commercially available PEP database that generated alerts during screening, but they were not promptly addressed. HKMA found four instances of PEPs who were not identified or classified as high-risk customers, despite publicly available information. Coutts also failed to establish effective procedures for ensuring follow-up on PEP alerts. It did not establish a management information system to oversee the approval process with senior management to continue relationships with PEPs. This violated HKMA regulatory requirements for PEP relationships to be approved. In one case, it took 34 months to obtain management approval for a PEP relationship. Coutts limited PEP screening to new customers. There was no ongoing screening for existing customers. In addition, HKMA found deficiencies in Coutts’ periodic and event-driven reviews. HKMA identified nine PEPs without management approvals, of which five had generated alerts that were not promptly addressed. Coutts cooperated fully with the HKMA investigation. Coutts independently hired a consultant to remediate the identified customer files and review the deficiencies in their policies and procedures. These actions reduced the penalty paid by an undisclosed amount. Key takeaways • Effective policies and procedures for PEPs require an effective control framework based on local regulations. • PEP screening should be conducted throughout the customer relationship. PEP policies and procedures need to explicitly and clearly direct when screening takes place. It should not be left open to interpretation. • Controls for screening alerts and management approvals need to be consistently followed. • Ineffective screening for PEPs and associated procedures can result in regulatory failings. The Compliance Function An organization’s compliance function is commonly referred to as the second line of defense. It is responsible for monitoring the controls of the business, which is the first line of defense. The compliance function cannot be designed with a “one size fits all” mentality. Regardless of the structure, however, the role of the second line of defense must be established in a manner that ensures it can fulfill its role effectively. The sophistication of the compliance function should be based on the organization’s nature, size, complexity, regulatory environment, and the specific risks associated with its products, services, and customers. No two organizations will have exactly the same compliance structure, because the risks facing each organization are different, as identified in their respective risk assessments. The Designation and Responsibilities of a Compliance Officer In most cases, the board of directors is responsible for appointing a qualified individual as the organization’s AML/CFT compliance officer. This individual is responsible for managing all aspects of the AML/CFT compliance program. This includes, but is not limited to, designing and implementing the program, making necessary changes and updates, disseminating information about the program’s successes and failures to key staff members, constructing AML/CFT-related content for staff training programs, and managing the organization’s adherence to applicable AML/CFT laws and regulations, including staying current on legal and regulatory developments in the field. Communication The ability of the compliance officer to communicate effectively, both in writing and verbally, is vital to the success of an organization’s AML/CFT program. The compliance officer must also have the means to communicate at all levels of the organization—from frontline associates up to the CEO and board of directors. It is critical for a compliance officer to be capable of articulating matters of importance to senior and executive management, particularly significant changes that could present risk to the organization, such as a sudden or substantial increase in SARs or currency transaction reports (CTRs). Other items of concern that should be escalated to management include changes to laws and regulations that might require immediate action. A compliance officer must have the skills necessary to be able to analyze and interpret these ongoing changes, determine what effect they may have on the organization, and recommend an action plan, when appropriate. In many countries, the AML/CFT officer must also have a direct reporting line to the board or equivalent body. This unfettered access to board members allows him or her to undertake this oversight role in an effective manner. Depending upon the country, different reporting lines may exist. Delegation of AML duties The specific delegation of tasks and responsibilities within an AML/CFT department varies among organizations. The department could potentially be organized into subgroups with, for example, one person responsible for strategic aspects of the program and another for its operational aspects, including suspected money laundering monitoring and reporting suspicious activity. Examples of AML/CFT subgroups include: • Program Management o Manages and coordinates regulatory examinations o Performs periodic reviews and updates of the program o Coordinates implementation activities with the lines of business and support groups to ensure that applicable business procedures are updated to incorporate program changes o Monitors regulatory environment for changes to the program o Helps prepare training materials and provides guidance and advice on complicated AML/CFT issues not addressed by the line of business support group • Know Your Customer o Assigns a risk code to all clients based on scoring of the CDD risk o Performs additional due diligence on medium- and high-risk customers assessment identified via the CDD process and customers seeking certain products and services from the financial organization o • Provides a first line of contact for line-of-business questions on AML/CFT matters Sanctions Screening o Manages sanctions screening software applications and processes o Monitors and reconciles the data being received from the source systems • • o Fine-tunes the filter thresholds according to changes in the risk profile o Reviews suspected matches and reports valid matches to the of the organization appropriate regulatory authorities Transaction Monitoring o Manages transaction monitoring software applications o Monitors and reconciles the data being received from the source o Fine-tunes the filter thresholds according to changes in the risk profile o Participates in the design of transaction monitoring typologies and systems of the organization maintains the extensive documentation required Financial Investigations o Monitors alerts generated on customer transactions, such as those o Investigates alerts and referrals o Files SARs with the appropriate FIU, as required from automated systems and referrals from line-of-business staff. In addition to these groups, other employees conduct AML/CFT tasks in the business lines wherever there is customer contact. For example, CDD forms are often completed by account officers and other staff members when a new account is opened, while branch personnel participate in periodic reviews of high-risk customers and might be required to provide additional information or explanation to support investigations into potentially suspicious activity. Sometimes, suspicious activity is reported to the corporate security group, which, upon determining that the activity might pose an AML/CFT risk, might refer the case to the financial investigations group. The compliance department might also direct AML/CFT-related compliance efforts as a result of instructions from a regulatory authority or research findings. The business and the compliance function might establish risk-based quality assurance reviews and monitoring and testing activities to ensure the functions are being performed appropriately. This could include reviewing the CDD collected to ensure completeness, monitoring reports of CDD completeness or defects to ensure the systems are working as expected and performing tests to assess whether the monitoring and the business performance are satisfactorily measuring and ensuring compliance. Compliance officer accountability Regardless of the way an organization delegates its various AML/CFT tasks, its designated compliance officer is responsible for executing the AML/CFT program (i.e., ultimate responsibility lies with the board of directors). More and more often, various regulators are seeking enforcement actions against not only the organization, its executive management team, and board of directors for AML/CFT violations, but the compliance officer as well. Compliance officer accountability (Case example: US bank) In March 2020, the Financial Crimes Enforcement Network (FinCEN) of the US Department of the Treasury imposed a US$450,000 civil money penalty against Michael LaFontaine, former chief operational risk officer (CRO) at US Bank National Association (US Bank). LaFontaine was fined for his shared responsibility in failing to prevent violations of US anti-money laundering (AML) laws and regulations that occurred during his tenure. LaFontaine held senior positions in US Bank's AML department from 2005 to 2014. According to FinCEN, his roles involved progressively more responsibility over time. Regulators are increasingly holding senior management personally accountable for their organizations’ violations of AML regulations and failure to act accordingly. In his position as US Bank’s CRO, LaFontaine reported directly to the bank’s chief executive officer and communicated directly with its board of directors. His primary responsibilities included overseeing US Bank's AML compliance department and supervising the bank’s chief compliance officer, AML officer, and AML staff. Due to his oversight responsibility, FinCEN determined that LaFontaine shared responsibility for US Bank's AML violations. He failed to: • Implement and maintain an adequate AML program • Adequately staff the compliance program with sufficient resources to execute their regulatory expectations • File suspicious activity reports (SARs) in a timely manner, including on transactions that potentially laundered the proceeds of crimes FinCEN concluded that LaFontaine knew US Bank’s inadequate policies, procedures, and controls would result in its failure to investigate and report suspicious and potentially illegal activity. In addition, it noted that LaFontaine failed to exercise the responsibilities for monitoring and reporting suspicious activity by: • Imposing upper limits on the number of alerts produced by the institution’s automated transaction monitoring system • Failing to subject Western Union money transfers to the monitoring system • Inadequately identifying and monitoring high-risk customers in compliance with the bank secrecy act According to FinCEN, LaFontaine was advised of the staffing issues and alert capping through internal memos. Staff claimed that significant increases in SAR volumes, law enforcement inquiries, and account closure recommendations created a situation in which AML staff resources were “stretched dangerously thin.” La Fontaine failed to investigate and address the deficiencies within the department. This case illustrates the dangers of willful blindness, or deliberately ignoring and refusing to address or escalate violations. Key takeaways • Compliance departments should be adequately staffed to meet regulatory requirements. • Compliance officers should escalate and act upon internal warnings and identified risks. • Compliance officers are increasingly held personally liable for wrongdoing and may be prosecuted. • Compliance officers should always act with integrity and do what is in the best interest of the organization. • Compliance officers must understand their legal obligations and act in the spirit and letter of the law. Compliance officer accountability (Case example: Personal liability) In October 2020, the US Financial Crimes Enforcement Network (FinCEN) assessed a $60 million civil penalty against Ohio resident Larry Dean Harmon. Harmon was the founder and primary operator of the convertible virtual currency businesses Helix and Coin Ninja. Because he failed to designate a compliance officer, Harmon was the de facto compliance officer and held accountable for the organizations’ compliance failures. From 2014 through 2017, Helix and Coin Ninja operated as unregistered money services businesses (MSBs), offering anonymous convertible currency exchange services for bitcoin holders. Their customers included narcotics traffickers, counterfeiters, fraudsters, and child exploitation websites. FinCEN determined that Harmon failed to register his businesses as MSBs, implement and maintain an effective AML program, and report suspicious activity. FinCEN determined that Harmon willfully violated Bank Secrecy Act (BSA) registration and reporting requirements. Helix and Coin Ninja provided “mixers” or “tumblers,” allowing customers, for a fee, to send bitcoin to designated recipients in a manner that was designed to conceal the source or owner of the bitcoin. Harmon knowingly obscured the nature and identity of customer transactions by: • Designing Helix to “break the blockchain” by taking bitcoin from the user’s wallet and giving the user new bitcoin from a different pool that could not be traced back to the user • Failing to collect and verify customers’ names, addresses, or identifiers on over 1.2 million transactions • Failing to collect customer or transaction due diligence information for over US$311 million in transactions • Deleting customer information after seven days and allowing customers to manually delete their logs FinCEN found that Harmon actively aided cybercriminals by concealing the nature, location, source, ownership, and control of the proceeds of online drug sales and other online illegal activities. MSBs are required to develop and maintain an AML program commensurate with the risks posed by its location, size, nature, and volume of transactions. Harmon failed to implement a system of internal controls, designate a compliance officer to oversee the BSA program, provide appropriate BSA training to personnel, and provide for an independent review of the BSA program. FinCEN identified at least 2,400 instances in which Harmon failed to file a SAR on suspicious Helix transactions. The US Department of Justice held Harmon accountable for unlawful money laundering practices. Harmon pled guilty to criminal charges for money laundering and agreed to the forfeiture of 4,400 bitcoin as part of his plea. He may be subject to imprisonment, fines, and other restrictions. Key takeaways • Providers of convertible virtual currency anonymizing services are considered money transmitters under FinCEN regulations and must register as MSBs. • MSBs are required to develop, implement, and maintain an effective AML program, including establishing a system of internal controls, designating a qualified compliance officer, implementing an appropriate training program, and providing an independent review for the program. • FinCEN can investigate and impose civil money penalties on current and former employees of MSBs that participate in willfully violating BSA regulations. • Individual compliance officers can be held criminally accountable for their actions, which may result in imprisonment and fines. AML/CFT Training Components of an effective training program Most AML/CFT laws and regulations require financial organizations to offer as part of their formalized AML/CFT compliance programs training for relevant employees. Training is one of the most important ways to emphasize the importance of AML/CFT efforts, as well as educating employees about what to do if they encounter potential money laundering. Training also serves as an important control in the mitigation of money laundering risks to which the financial organization might be exposed. An effective training program should not only explain the relevant AML/CFT laws and regulations, but also cover the organizations’ policies and procedures used to mitigate money laundering risks. In this section, the term training includes both formal training courses and ongoing communications that serve to educate employees and maintain their ongoing awareness about AML/CFT requirements, such as emails, newsletters, periodic team meetings, intranet sites, and other means of sharing information. Following is an explanation of who should receive AML/CFT training, the topics that should form the basis of that training, and how, when, and where that training should be delivered. Who to train The first step in designing an effective AML/CFT training program is to identify the target audience. Most areas of the financial organization should receive AML/CFT training. In particular, new staff members should receive training during employee orientation or shortly thereafter. In some countries, training programs must extend beyond full- or part-time employees to include contractors, consultants, students, apprentice placements, and secondees from other branches or subsidiaries. Each segment of the staff should be trained on AML/CFT topics and issues that are relevant to their activities. Example: Scope of Training • Customer-facing staff: This is the financial organization’s first line of defense; these employees need the deepest practical understanding of why AML/CFT efforts are important and what they need to do to be vigilant against money laundering. Although a general course will often be sufficient to address the importance of AML and provide some basics, additional training on specific unit procedures related to the products and services carried out by the business line is often needed. For example, loans, credit, and loan-operations staff need training on how money launderers might misuse credit products, how the staff can recognize potential money laundering, and what the staff must do if they see it. Cash handlers often need special training because many jurisdictions have imposed additional requirements to address the increased risk posed by cash. These employees need to know how to properly handle cash transactions, especially those that trigger reporting requirements, including when to escalate concerns when a customer attempts to structure a transaction to avoid the reporting requirements. Employees who establish loans and accounts for new customers need to know applicable regulatory requirements and the organization’s policies and procedures for identification and performing due diligence during the onboarding process. • Operations personnel: Non-customer-facing personnel within an organization’s lines of business are also included in the first line of defense and should not be overlooked in the delivery of specialized training. For example, cash vault, wire transfer, trade finance, loan underwriters, loan collections, and treasury management personnel are often in positions to recognize illegal, fraudulent, and unusual account activity. Specialized training for these individuals to recognize AML/CFT red flags and elevate unusual activity to compliance personnel should be considered. • AML/CFT compliance staff: Under the direction of a designated compliance officer, the compliance staff function coordinates and monitors the organization’s day-to-day AML/CFT compliance program. It is the second line of defense. Given this area’s responsibility for managing the organization’s adherence to AML/CFT regulations, more advanced ongoing training to stay abreast of requirements and emerging trends is important. Often, this requires attending conferences or AML/CFT-specific presentations that are more robust in nature. • Independent testing staff: Independent testing personnel are the organization’s third line of defense. Because this functional area independently assesses the adequacy of the AML/CFT compliance program, these employees should receive periodic training concerning regulatory requirements, changes in regulation, money laundering methods and enforcement, and their impact on the organization. • Senior management and board of directors: The board and senior management do not need the same degree of training as personnel in the first, second, and third lines of defense. Specialized training for the organization’s leadership should address the importance of AML/CFT regulatory requirements, regulatory changes that impact the organization, penalties for noncompliance, personal liability, and the organization’s unique risks. Without a general understanding of this information, senior management and the board cannot adequately provide for AML/CFT oversight, approve AML/CFT policies, and provide sufficient resources. Training topics Another factor in designing an effective AML/CFT training program is identifying the topics to be taught. This will vary according to the organization, specific products and services offered, and who is being trained. Several basic topics should be factored into AML/CFT training, including: • General background and history pertaining to money laundering controls, including the definitions of money laundering and terrorist financing, why criminals do it, and why stopping them is important • Legal framework on what AML/CFT laws apply to organizations and their employees • New and changing regulatory requirements that affect the organization • Penalties for AML/CFT violations, including criminal and civil penalties, fines, jail terms, as well as internal sanctions, such as disciplinary action up to and including termination of employment • Internal policies, such as customer identification and verification procedures and policies, including CDD, EDD, and ongoing due diligence • Review of the internal AML/CFT and sanctions risk assessments • Legal recordkeeping requirements • Suspicious transaction monitoring and reporting requirements • Currency transaction reporting requirements • How to react when faced with a suspicious client or transaction • How to respond to customers who want to circumvent reporting requirements • Duties and accountability of employees • How to maintain confidentiality with AML-related matters • AML trends and emerging issues related to criminal activity, terrorist financing, and regulatory requirements • Real-life money laundering schemes (preferably cases that have occurred at the organization or at similar organizations), including how the pattern of activity was first detected, its impact on the organization, and its ultimate resolution Parties responsible for designing the training must identify which of these topics relate to the target audience. The FCA published guidance to clarify expectations when significant AML weaknesses persist in small banks. The guidance was based on proposed examples of good practice from two thematic reviews that the FCA and its predecessor conducted. Among other issues, the FCA questioned the effectiveness of training programs, which often lacked specificity related to organizations’ unique risks. Training best practices published in the guidance included the following: • Appropriate training tailored to the individual’s specific roles. Roles lacking specific training included the following areas: offshore centers, mortgage lending, areas servicing PEPs and other high-risk clients, investment banks, and trade finance. Generic training is considered to be acceptable, provided it is supplemented with specific training with a practical application to the specific line of business or role within the organization. • Periodic refresher training—usually annually—is important for existing employees. • Banks should assess whether third parties and employees working in outsourced functions need to attend specific AML training. How to train Following are steps that trainers can take to ensure an effective AML/CFT training program: • Identify the issues that must be communicated and decide how best to disseminate the message. Sometimes a memo or email will accomplish what is needed without formal, in-person training. Sometimes, e-learning can efficiently communicate the information. Other times, classroom training is the best option. • Identify the audience by functional area and by level of employee/management. This can be accompanied by a brief “Why are they here?” assessment. New hires should receive training that is different from that given to veteran employees. • Determine the needs that should be addressed. There may be issues uncovered by audits or regulatory examinations, or created by changes to systems, products, or regulations. • Determine who can best develop and present the training program. • Determine if “Train the Trainer” sessions are necessary, when decentralized training is involved (e.g., across large branch networks). • Create a course abstract or curriculum that addresses course goals, objectives, and the desired results. Be sure to identify who the audience should be and how the material will be presented. • To the extent possible, establish a training calendar that identifies the topics and frequency of each course. • Consider whether to provide handouts. The purpose of most training handouts is to reinforce the message of the training and provide a reference tool after the training. • Tests should be considered as a way to evaluate how well the training is understood, with a mandatory passing score. Employee scores should be retained. Similarly, if a case example is used to illustrate a point, provide a detailed discussion of the preferred course of action. • Attention span is a factor to consider. Focus on small, easy-to-digest, and easy-to-categorize issues. • Track employee attendance. Ask attendees to sign in and issue reminders if make-up sessions are needed. Unexcused absences might warrant disciplinary action and notation in employee personnel files. When to train An organization’s training should be ongoing and on a regular schedule. Existing employees should at least attend an annual training session. New employees should receive appropriate training with respect to their job function and within a reasonable period after joining the organization or transferring to a new position. Situations may arise that demand an immediate session or enhanced training beyond the basic training program. For example, an emergency training session might be necessary right after an examination or audit that uncovers serious money laundering control deficiencies, a news story that names the organization, or recent regulatory action, such as a consent order, which might also prompt quick-response training. Changes in software, systems, procedures, and regulations are additional triggers for training sessions, as well as specific money laundering or other illicit financial activity risks that impact a specific business line or department. Where to train Some organizations have training centers that allow trainees to escape the distractions of daily work activity. Some types of training are more effective when conducted in small groups, such as the evaluation of a money laundering Case example. Role-playing exercises, which may be used to complement a prepared lecture or panel discussions, are also more effective in small groups. These training sessions can be held anywhere. Large groups can be trained using computer-based training courses, which can be designed to automatically record attendance and test attendees, with a required minimum score to demonstrate understanding of the material. AML/CFT training (Case example) On February 25, 2016, FinCEN and the Office of the Comptroller of the Currency (OCC) coordinated enforcement actions against Gibraltar Private Bank & Trust Company in Coral Gables, Florida, for willful AML compliance violations. The bank’s substantial AML program violations, which included failure to properly train compliance staff, led to a US$2.5 million civil money penalty assessed by the OCC and a US$4 million civil money penalty assessed by FinCEN. From 2009 to 2014, the bank’s implementation of AML training was inadequate and not tailored to the needs of specific positions, departments, board members, or other personnel. For example, in 2009, senior bank officials took a basic AML course specifically designed for bank tellers, which was not appropriate, considering their functional responsibilities. In May 2013, a training assessment was undertaken by management that identified the need for significant training to adequately implement the bank’s AML program. Over one year later, in 2014, regulatory authorities found that the bank had still not addressed any of the needs identified in its 2013 assessment. Key takeaways • It is critical that AML training be role-specific and focused on the duties and financial crime risk exposure of relevant staff. • Senior officials and board members do not need to be trained in carrying out business functions, but they do need to understand AML requirements, penalties for noncompliance, and how to interpret risk reporting. • Regulated firms can be heavily penalized for failing to implement adequate AML training, especially when known gaps are not addressed in a timely manner. Independent Audit Evaluating an AML/CFT program Establishing an AML/CFT compliance program is not enough. The program must be monitored and evaluated. Organizations should assess their AML/CFT programs regularly to ensure their effectiveness and look for new risk factors. The audit must be independent (i.e., performed by people not involved with the organization’s AML/CFT compliance staff), and individuals conducting the audit should report directly to the board of directors or to a designated board committee composed primarily or completely of outside directors. The individuals performing the audit must be sufficiently qualified to ensure that their findings and conclusions are reliable, including having knowledge and expertise of AML/CFT. Depending on the jurisdiction, an independent audit might also be referred to as an independent test or review. The independent audit should do the following: • Assess the overall integrity and effectiveness of the AML/CFT compliance program, including policies, procedures, and processes. • Assess the adequacy of the AML/CFT risk assessment. • Examine the adequacy of CDD policies, procedures, and processes, including whether they comply with regulatory requirements. • Determine personnel adherence to the organization’s AML/CFT policies, procedures, and processes. • Perform appropriate transaction testing, with particular emphasis on highrisk operations (products, services, customers and geographic locations/jurisdictions). • Assess training adequacy, including its comprehensiveness, accuracy of materials, training schedule, attendance tracking, and escalation procedures for lack of attendance. • Assess compliance with applicable laws and regulations based on the jurisdictions in which the organization does business. • Examine the integrity and accuracy of management information systems used in the AML/CFT compliance program. If applicable, this includes assessing the adequacy of the scope of any third-party independent system validations and the qualifications of parties engaged to perform such reviews. • Review all the aspects of any AML/CFT compliance functions that have been outsourced to third parties, including the qualifications of the personnel, contract, performance, and reputation of the company. • Evaluate the ability of transaction monitoring software application to identify unusual activity by: o Reviewing policies, procedures, and processes for suspicious activity o Reviewing the processes for ensuring the completeness, accuracy, and monitoring timeliness of the data supplied by the source transaction processing systems • o Evaluating the methodology for establishing and analyzing expected o Evaluating the appropriateness of the monitoring reports o Comparing the transaction monitoring typologies with the AML/CFT risk activity and filtering criteria assessment for reasonableness Review case management and SAR systems, including an evaluation of the research and referral of unusual transactions and a review of policies, procedures, and processes for referring unusual and suspicious activity from all business lines to the personnel responsible for investigating it. • Assess the effectiveness of the organization’s policy for reviewing accounts that generate multiple SAR filings, including account closure processes. • Assess the adequacy of recordkeeping and record-retention processes. • Track previously identified deficiencies and ensure management corrects them promptly. • In coordination with the board or designated board committee, ensure that overall audit coverage and frequency are appropriate to the risk profile of the organization. • Consider whether the board of directors was responsive to earlier audit findings. • Determine the adequacy of the following, as they relate to the training program and materials: o The importance the board and senior management place on ongoing o Employee accountability for ensuring AML/CFT compliance, including o Comprehensiveness of training, related to the risk assessment of each o Training of personnel from all applicable areas of the organization o Frequency of training, including the timeliness of training given to new o Coverage of internal policies, procedures, processes, and new rules and o Coverage of different forms of money laundering and terrorist o Disciplinary actions taken for noncompliance with internal policies and education, training, and compliance the employee performance management process individual business line and transferred employees regulations financing as they relate to identifying suspicious activity regulatory requirements An effective internal audit department develops and maintains an audit risk assessment to determine audit priorities. It also develops and maintains detailed audit testing programs for every area. All audit and regulatory recommendations for corrective action must include tracking, the target date for completion, and the personnel responsible. When a systemic violation is identified regarding a regulatory reporting requirement or other regulatory issues, the organization should perform a review back to the prior audit or examination to identify any additional issues that need to be rectified. Regular status reports on the audit and closure of findings should be provided to senior management and the board of directors. Supervisory authorities may request them. Failure to establish and maintain a reasonably designed BSA/AML compliance program or correct a previously reported problem could result in regulatory action, such as a cease-and-desist order against an organization. Other regulatory actions include written agreements, matters requiring attention, and matters requiring board attention. Independent audit (Case example: Apical Asset Management Pte. Ltd.) In July 2020, the Monetary Authority of Singapore (MAS) revoked the Capital Markets Services (CMS) license of Apical Asset Management Pte. Ltd. (AAMPL) for serious breaches of MAS’ AML/CFT requirements. In this case, MAS held the directors personally responsible. It reprimanded AAMPL’s CEO and directors for their failure to ensure that AAMPL complied with all laws and regulations governing its operations. The failures included the lack of both an enterprise-wide risk assessment and an independent audit. According to MAS, AAMPL committed serious breaches of MAS’ AML/CFT requirements from 2013 to 2018. Specifically, AAMPL: • Failed to conduct an enterprise-wide AML/CTF risk assessment, resulting in the failure to understand its overall vulnerability to financial crime risks and develop appropriate measures to address them • Failed to properly assess its customers for elevated financial crime risks • Had deficient ongoing monitoring controls and procedures • Failed to assess the effectiveness of its AML/CFT controls by conducting independent audits This case illustrates the need for a robust, holistic AML/CTF program that includes independent oversight to assess its effectiveness. A key component of a risk-based approach is conducting a risk assessment to identify and assess the financial crime risks an organization faces. This allows for implementation of robust controls to address these risks. MAS concluded that AAMPL did not have in place basic AML/CFT policies and procedures to manage their risks. AML/CFT programs also need to be independently reviewed. This allows the organization to identify gaps and deficiencies to ensure continuous development and improvement. Independent testing can be done by external auditors or an internal audit function with sufficient independence from the first and second lines of defense functions. Independent internal auditors should have sufficient skills and training to conduct AML audits. They report directly to the board. In the AAMPL case, an effective independent review would likely have identified any gaps in ongoing controls. The findings of the risk assessment would have provided the organization with the opportunity to address gaps and breaches. Instead, the regulator discovered them and revoked the company’s CMS license. Key takeaways • A robust, holistic AML/CTF program includes independent oversight and review. • An enterprise-wide risk assessment is needed to identify vulnerabilities and allow organizations to develop effective controls. • Entities must assess their customers for elevated financial crime risks. • AML/CFT policies must be in place to manage risks. Establishing a Culture of Compliance Embedding a culture of compliance into the overall structure of a financial organization is critical to the development and ongoing administration of an effective AML/CFT program. Typically, the ultimate responsibility for the AML/CFT compliance program rests with the organization’s board of directors. The board and senior management must set the tone from the top by openly voicing their commitment to the AML/CFT program, ensuring that their commitment flows through all service areas and lines of business, and holding responsible parties accountable for compliance. Although creating a culture of compliance may not resolve all current or future issues, an effective AML/CFT compliance program focused on identifying and controlling risks is critical to the overall success of an organization. Associates in all business units must clearly understand their commitment to supporting the compliance program by following the rules. Adopting a culture of compliance is the most effective way to prevent easily identified issues from becoming systemic problems. An effective AML/CFT program costs money that management might be reluctant to spend. The compliance officer’s challenge is to convince management that an AML/CFT program is an indispensable expense to protect the organization and prevent legal problems and reputational harm. As a result of FinCEN’s findings of numerous financial organizations with AML/CFT compliance deficiencies, including with the roles of boards and senior management, it released an advisory in August 2014. The advisory outlined six guidelines for strengthening AML/CFT compliance culture in financial organizations: 1. Leadership must actively support and understand compliance efforts. The board’s role in AML/CFT compliance consists of reviewing and approving the overall AML/CFT program and ensuring that there is ongoing oversight. Board members are not expected to become AML/CFT experts, nor are they responsible for day-to-day program management. Rather, they should be knowledgeable enough to formally approve an organization’s AML/CFT compliance program and make sure it is adequately implemented and maintained by staff. The board’s oversight role also extends to the supervisor’s examination process. Examiners routinely work with the board and management before and during on-site exams to gauge the board’s commitment to compliance, its understanding of the law, and its knowledge of how the organization operates. Once an exam by a supervisor or auditor is conducted, it is the board’s duty to ensure that any necessary corrective action is taken. Specific duties can be delegated, but the board is responsible if problems cited by the examiner or auditor are not corrected. Efforts to manage and mitigate AML/CFT deficiencies and risk must not be compromised by revenue interests. 2. Compliance staff should be empowered with sufficient authority to implement an organization’s AML/CFT policies. Revenue interests should not compromise or override compliance functions beyond the risk appetite of the organization. Essentially, profit should not be prioritized over compliance. Relevant information from the various departments within the organization must be shared with compliance staff to advance AML/CFT efforts. 3. Business units should not remain tethered within their own individual silos. Boundaries and barriers in communication should not exist within an organization. Relevant information should be shared with the AML/CFT compliance staff. The organization must devote adequate resources to its compliance function. 4. In addition to the requirement to designate an individual responsible for coordinating and monitoring day-to-day AML/CFT compliance under the law, leadership should provide for technology resources and appropriate AML/CFT support staff based on its risk profile. The compliance program must be effective. One way to ensure this is by using an independent and competent party to test the program. 5. To be effective, an AML/CFT program must include an ongoing, documented risk assessment and risk-based customer due diligence, and provide for testing by an independent, unbiased, and qualified party. 6. Leadership and staff must understand the purpose of its AML/CFT efforts and how its SAR reporting is used. Leadership and AML/CFT staff should understand the importance of filing regulatory reports. Per FinCEN, properly filed reports are used “to confront serious threats, including terrorist organizations, rough nations, weapons of mass destruction (WMD) proliferators, foreign corruption, and, increasingly, some cyber-related threats.” Further emphasizing the need for a culture of compliance, the New York State Department of Financial Services (DFS) issued Final Rule Part 504 on June 30, 2016, requiring regulated organizations to maintain transaction monitoring and filtering programs (TMPs) reasonably designed to: • Monitor transactions after their execution for compliance with the BSA and AML laws and regulations, including suspicious activity reporting requirements • Prevent unlawful transactions with targets of economic sanctions administered by OFAC The Final Rule, which went into effect on January 1, 2017, also requires boards of directors or senior officer(s) of regulated organizations to make annual certifications to the DFS, confirming that they have taken all steps necessary to comply with the TMP requirements. Although the law may seem specific to New York, numerous foreign banks are subject to the law because they operate in New York. Specifically, the law covers banks, trust companies, private bankers, savings banks and savings and loan associations chartered pursuant to the New York Banking Law, and all branches and agencies of foreign banking corporations licensed pursuant to the Banking Law to conduct banking operations in New York. The law also applies to nonbank financial institutions with a Banking Law license, such as check cashers and money transmitters. Penalties for noncompliance are consistent with those under the Banking Law. Importantly, the rule establishes eight minimum requirements for TMPs, in addition to specific core components of each program, which a financial organization must establish and maintain under the statute: 1. Identification of all data sources 2. Validation of the integrity, accuracy, and quality of data 3. Data extraction and loading processes to ensure a complete and accurate transfer of data 4. Governance and management oversight 5. Vendor selection process when a third-party vendor is used 6. Funding to design, implement, and maintain a program 7. Qualified personnel or outside consultant 8. Periodic training The key to maximizing the AML/CFT unit’s usefulness is to share valuable data with other areas of the organization, not just with law enforcement agencies, regulators, and senior management. As AML/CFT units build their CDD files, they might identify information other departments could use to sell products and expand profits. For example, marketing departments that better understand the activity of certain retail and business customers can more effectively identify opportunities to market additional products and deepen the overall customer relationship. Before releasing customer information, it is important to review applicable privacy laws (e.g., Europe’s General Data Protection Regulations [GDPR]) and the firm’s privacy policy to understand any limitations. In principle, AML laws and data privacy laws should not be mutually exclusive or contradictory. There are usually no regulatory limits on sharing customer information with other internal departments within the same legal entity; however, there might be limitations on sharing with other affiliated companies within a larger organization. Some organizations restrict the sharing of customer information outside the organization, and customers may opt-out of the right for the organization to provide their information to third-party companies. Compliance staff should be sufficiently independent of the lines of business they support so that potential conflicts of interest are minimized; they should not be provided incentives based on the profitability of those business lines. This does not mean that compliance staff should not receive bonuses; however, incentives should not be structured in a way that might create a conflict of interest. Although the compliance staff may be situated within the line of business and report to line management, they should have the ability to escalate issues without fear of recrimination to a compliance or risk-management function outside the line of business. A close working relationship of compliance staff with the line of business is crucial to a successful execution of the AML/CFT program. Ultimately, the compliance staff should be seen as trusted advisors so that the business line staff will come to the compliance staff when they have questions and will follow the advice provided. Culture of compliance (Case example: Poor management oversight) In July 2020, the Monetary Authority of Singapore (MAS) revoked the capital markets services license of Apical Asset Management (AAM). The MAS cited inadequate AML/CFT policies and procedures, deficient customer risk assessments, and severe deficiencies in the control framework. It also faulted senior management for not ensuring that asset managers followed relevant financial crime rules and regulations. The asset managers had also failed to undertake an enterprise-wide risk assessment (EWRA), despite an MAS requirement that the assessment be completed at least every two years. Additionally, there was no independent audit of AAM’s controls to test their effectiveness. In this case, the CEO and director of AAM were specifically reprimanded for their failings, given their ultimate responsibility for the organization’s compliance with MAS requirements. MAS identified several significant failings in AAM’s financial crime controls between 2013 and 2018. These deficiencies included the lack of basic AML/CFT controls, which put the organization at risk of receiving illicit funds. MAS determined that this risk had been exacerbated by the nature of AAM’s customer base, including multiple customers with complex ownership structures. AAM did not adequately assess its customers’ risks, and its ongoing monitoring controls were ineffective. In one instance, a fund related to a PEP was not subject to enhanced monitoring over an extended period of time. Increasing the risk, there was no independent audit of AAM’s control framework to test whether the financial crime controls were operating effectively. Senior management must set the overall tone and develop a culture of compliance throughout an organization. They must allocate sufficient resources to the compliance team to enable it to function as an effective second line of defense. Although senior managers do not need to review every aspect of the compliance program, they must exercise sufficient oversight of the compliance structure and processes. They also need to review key performance indicators of how well the control framework is functioning. AAM’s senior management did not exercise their oversight functions to ensure the organization complied with all applicable financial crime laws and regulations. They did not conduct an EWRA, which MAS considers essential for an entity to identify its financial crime risks and determine the appropriate controls to mitigate them. Key takeaways • AAM had inadequate AML/CFT policies and procedures and client risk assessments. • There were severe deficiencies in the control framework and no independent audit. • Accountability begins and ends with the senior management of an organization. • Failures by senior management to discharge their duties can result in systemic failings across an organization. • Failure to meet regulatory requirements can result in the loss of a business license.