Office of Foreign Assets Control FSP Compliance Trends

Size: px

Start display at page:

Download "Office of Foreign Assets Control FSP Compliance Trends"

Clifford Ross
5 years ago
Views:

1 Markets, R. DeLotto Research Note 25 March 2003 Office of Foreign Assets Control FSP Compliance Trends In 3Q02, Gartner and GartnerG2 conducted a qualitative survey of U.S. financial services providers to determine compliance with OFAC regulations. Financial services managers must avoid compliance complacency. Core Topic Financial Services: Financial Services Drivers, Strategies, Direction and Vision Key Issue How can FSPs evaluate, measure and implement technologies and processes to ensure competitiveness and efficiency? Strategic Planning Assumption OFAC compliance features will be bundled into most business "core systems" by 2007 (0.7 probability). All U.S. citizens, permanent resident aliens and enterprises, regardless of industry or location, are subject to a set of commerce rules administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC; see Noncompliance seriously affects business operations, profitability and reputation, as well as incurs hefty personal fines and incarceration. These economic and trade sanctions based on U.S. foreign policy and national security goals regarding foreign countries, officials, organizations and criminals vary by country and circumstance, and are based on many pieces of legislation. OFAC regulations routinely are ignored outside of the financial services industry. However, all enterprises, regardless of industry or region of operations, should address them because criminal violations of the statutes can result in forfeiture of funds or other property involved in the violations, corporate and personal fines, and criminal and civil penalties. A previous lack of public, visible enforcement does not mean that they are not enforced at all. By 2004, the enforcement of OFAC regulations will rely heavily on stakeholder pressure and fear of negative publicity to prompt compliance by all but willful noncompliers (0.7 probability), which will greatly influence the way enterprises conduct business. Gartner began to discuss OFAC as an adjunct to our Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act coverage. We were surprised by how few enterprises were aware of OFAC regulations the "best estimate" of the installed base of OFAC compliance tools is less than 100,000 enterprises, out of 25 million affected. The state of the market was difficult to determine. Few, usually forthcoming, financial services providers (FSPs) were willing to share details of their compliance efforts. As well, anecdotal evidence from vendors and client inquiry led Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 us to believe that few enterprises outside of financial services knew that they were covered by the regulations. Software tools called "interdiction systems" that check names and other information against various governmental lists of restricted entities are relatively simple, reliable, inexpensive and, in some cases, built into other client data-handling systems. However, senior personnel often did not know that these tools existed. Various interdiction lists are freely available to download or by mail, so a level of compliance is possible via printed documentation. In 3Q02, we tested our "undercompliance" assumption by surveying FSPs regarding their awareness of OFAC regulations. Compliance officers from 126 FSPs comprising banks, insurance companies (insurers) and securities companies (securities) in near-equal parts completed the survey, which included a brief (approximately 10 minutes) telephone interview with 10 multiple-choice questions that focused on: How FSPs chose their compliance system (see Figure 1) If FSPs are satisfied with their choices FSPs overall spending plans for these tools Figure 1 Developing an OFAC Compliance System How did you develop your OFAC compliance system? 70% In-House Purchased Outside Service Slightly more than 46 percent of all respondents developed their OFAC solutions in-house 30 percent of banks, 61 percent of insurers and 48 percent of securities. Although only 39 percent of respondents stated that they purchased a solution, 60 percent of banks chose that option. Evidence from inquiry indicates that Bridger Systems, Thomson Financial and Prime Associates are most-often considered by Gartner clients. Finally, 24 percent of respondents said that they used an outside service. Checking against interdiction lists often can be done inexpensively and 25 March

3 efficiently as part of normal due diligence through third parties, such as credit bureaus. In theory, spending should have been flat (see Figure 2). With the possible exception of increased interdiction list publication, OFAC requirements did not substantively change in Figure 2 Spending for OFAC Compliance Overall, are you spending more than, same as or less than what you planned to spend for OFAC compliance this year? 70% More Than Same as Less Than Overall, slightly less than 33 percent of respondents spent more than planned on OFAC compliance. More than half of respondents 55 percent of banks, 57 percent of insurers and 61 percent of securities said that they are spending the same as what they had planned; 31 percent are spending more. Anecdotal evidence from Gartner clients indicates that many enterprises have expanded the number of interdiction lists to which they subscribe. Only 11 percent of respondents said they are spending less than what they had planned. Respondents were asked what selection criteria they used to choose a compliance tool (see Figure 3). Respondents could select multiple answers; therefore, percentages equal more than 100 percent. 25 March

4 Figure 3 Selecting an OFAC Compliance Tool What were the key criteria for selecting an OFAC compliance tool or vendor? Other Features Legacy Compatibility Price Vendor Reputation % Key features mentioned included the depth of information offered by the vendor (number and quality of lists), seamless integration into regular processes to the user and a low rate of false reports (positive or negative). The most-consistently mentioned "other" criterion was ease of use. Although 68 percent of banks and 59 percent of securities firms based the choice of their OFAC solutions on the reputation of the vendor, 46 percent of insurers based their choice on compatibility with existing systems. Forty-seven percent of respondents said that price/cost was a key criterion. In addition, 47 percent indicated that compatibility with systems was a key criterion. OFAC compliance features will be bundled into most business "core systems" by 2007 (0.7 probability). FSP managers should investigate whether their customer relationship management functionality or client management systems have this capability or will gain it in projected upgrades. Thirty-three percent of respondents mentioned "other" key criteria, including ability to develop the solution in-house, ease of use and low cost. Finally, 25 percent stated "features" as a key criterion, including user friendliness, ease of use and flexibility. Conclusions Price matters. Cost was the greatest concern of the securities industry. This is surprising because most interdiction systems are less than $10,000. The data is freely available, although tedious to collect, and can be sorted with simple spreadsheet programs. The only cost incurred is staff time for administration and searching. Money saved here, however, must be carefully 25 March

5 balanced against dollars possibly expended later to settle fines and penalties. Ease of use is important. OFAC compliance requires the flawless execution of a dull, routine task checking names, addresses and similar information, as well as variants, against a list. This is precisely the sort of task that automation is best, and personnel worst, at doing. Reliance on manual list examination and comparison likely will not remain an acceptable practice. Must play well with others. The need for seamless compatibility with systems and business processes was a recurrent theme in the verbatim survey comments and ongoing Gartner client inquiry. Awkward systems simply will not be used without constant, costly supervision. Customer bases must be checked against interdiction lists whenever issued, rather than at the convenience of personnel who are sequestering the information. Although the mechanics of OFAC compliance may seem trivial, simple managerial prudence should drive FSPs to take necessary steps to avert massive civil and criminal penalties, mitigate risks, and avoid being blamed for "trading with the enemy." Acronym Key FSP Financial services provider OFAC Office of Foreign Assets Control USA Uniting and Strengthening PATRIOT America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Bottom Line: Compliance with Office of Foreign Assets Control regulations is well-understood and widespread in the financial services industry, although managers must avoid compliance complacency. Interdiction rules change without warning or notice, requiring constant or, at least, closely scheduled and periodic, spot checking. Financial services providers should know the OFAC postures of their service providers and partners, whose compliance may be incomplete or nonexistent. Problems can be contagious. 25 March

Prison sentences of up to 30 years

Prison sentences of up to 30 years Select Q&A, R. DeLotto Research Note 5 January 2004 OFAC Enforcement Is More Than Just a 'Slap on the Wrist' The lessons learned from the first six months of published U.S. Office of Foreign Asset Control