2018: The Year Ahead in AML Compliance

Transcription

1 2018: The Year Ahead in AML Compliance Q and A following Protiviti Webinar on January 11, 2018 Thanks to everyone who attended the Protiviti webinar, 2018: The Year Ahead in AML Compliance. The following is a compilation of our responses to the questions on our participants minds throughout the webinar covering such topics as FinCEN s Customer Due Diligence Rule, Sanctions Compliance, NYDFS s Part 504, and Regtech. On the topic of FinCEN s Customer Due Diligence Rule: 1. What is the industry's threshold for collecting the beneficiary ownership? Many institutions are using the 25% minimum standard in the final FinCEN rule, which is consistent with the threshold used in a number of other jurisdictions. However, based on the feedback we have received, institutions that had previously set a lower threshold, generally 10%, based on their own risk assessments will likely continue to use the lower level. 2. Do any of these proposed changes impact payment industry or only Financial Institutions? FinCEN s CDD Rule applies only to financial institutions that are required to have a Customer Identification Program (CIP). e.g., depository institutions, securities broker-dealers, mutual funds, futures commission merchants (FCMs) and introducing brokers (IBs). In August 2016, FinCEN issued a notice of proposed rulemaking (NPRM) Customer Identification Programs, Anti-Money Laundering Programs and Beneficial Ownership Requirements for Banks Lacking a Federal Functional Regulator that will expand the types of financial institutions subject to AML/CFT laws and regulations. The NPRM, which is still pending, would remove the exemption from AML/CFT requirements (e.g., Section 326 [CIP], Section 352 [AML Program]) for banks that lack a federal functional regulator. This would include, but not be limited to, the following: Private banks (e.g., owned by an individual or partnership) Non-federally insured credit unions Non-federally insured state banks and savings associations State-chartered non-depository trust companies International banking entities

2 3. As part of on-going monitoring of triggers and event-driven reviews, is it a requirement to perform identity verification and watch-list screening on new beneficial owners and /or changes to existing beneficial owners? For new accounts opened as of the effective date, it is a requirement that beneficial ownership is verified. If, upon an event-driven review, a new beneficial ownership is identified for either a new or existing account, the rule implies that the institution must update the customer information, including the information regarding the beneficial owner, and ensure identify is re-verified. Any beneficial owners identified should be screened against applicable watch-lists. 4. Also, if the new beneficial owner of an existing account does not pass identity verification or is a true OFAC match, is it recommended that the existing account be closed? Similar to existing CIP requirements, we would expect that a financial institution would take steps to terminate the account relationship; if it determined that the beneficial owner is a sanctioned party, then the account should be blocked consistent with OFAC requirements. 5. How are financial institutions handling the implementation of the CDD/beneficial ownership rule? How far along in the process are the FIs at this point, including system, process, and procedure changes? Since many financial institutions had adopted their own beneficial ownership standards prior to the finalization of the FinCEN rule, they are on-track to meet the minimum requirements of the rule from a process standpoint, i.e., policies and procedures, account opening forms, KYC documentation has been (or already was) updated to provide for identification of beneficial owners and employees have been trained on the requirements. Where some institutions continue to be challenged, though, is with the technology changes that are needed to link a beneficial owner who stands behind multiple accounts for transaction monitoring and CTR reporting purposes. 6. Beneficial ownership impacts in insurance industry? Insurance companies offering products subject to AML requirements are not required to maintain Customer Identification Programs; therefore, they would not be required by regulation to comply with the CDD/Beneficial Owner Rule. As a matter of prudent business, however, insurance companies may still want to collect beneficial ownership information. 7. What are we overlooking for beneficial ownership? Two possibilities come to mind: adequate technology support for the CDD/Beneficial Owner Program, not just for transaction monitoring and CTR filing as noted above, but also automation of KYC information, including customer profiles, so that this information is easily accessible and easy to update; and managing the customer experience, i.e., implementing and maintaining the program in a way that minimizes customer outreach in instances where you may need beneficial ownership information at different levels of ownership (such as the CDD/Beneficial Owner Rule and FACTA) and/or where multiple business lines or affiliates may need the same or similar information. To the extent permissible by law, financial institutions should look to share information across businesses and legal entitles.

3 8. How will CDD compliance be examined? Regulators are already looking at financial institution s preparations for ensuring compliance. The following are some of the areas we would expect to be on the regulators radar screen: whether the rule is being evenly applied to all new customers and within a reasonable timeframe; adequacy of updated policy and procedure documentation to align with new requirements and risk-based standards; sound, documented rationale of threshold change (if applicable); adequacy and performance of on-going monitoring and event-driven reviews; evidence of profile updates in the event new, relevant customer profile information is identified; sufficiency in capturing nature and purpose of the account; whether new rule requirements inform CTR aggregation protocols and SAR reporting; development and deployment of training on the new rule; and testing of the rule by the second line QA function and by Internal Audit. On the topic of Sanctions: 1. How detailed should sanctions procedures be? The level of detail will generally be dictated by the financial institution s sanction risk profile and the nature of its compliance program. Certain written procedures may be more detailed if risks by customer types, products/services, and geographies warrant additional clarifying procedures and measures to ensure compliance with sanctions compliance requirements. The level of detail may also vary based on the nature of the internal control to comply with sanctions requirements (e.g., automated versus manual controls, preventative versus detective) and the extent to which the management of the sanctions program is centralized or decentralized. 2. What is white list management? White list management is a term referring to policies, procedures and processes for managing "white lists" to ensure its ongoing usefulness and effectiveness. "White lists" are lists of names that have been flagged as potential OFAC matches, but subsequently cleared through investigation by the financial institution and are added to a white list (sometimes referred to as good list or false hit list ) that results in future hits being suppressed. This is done to improve the efficiency of sanctions screening by reducing the number of false positives. Financial institutions that use white lists should have documented procedures for managing white lists. In October 2015, The Department of Treasury issued False Hit List Guidance which outlines expected practices for the development and management of these lists. 3. What are the requirements for OFAC screening for RIAs?

4 Although AML program requirements do not currently apply to RIAs, U.S.-domiciled RIAs must comply with OFAC requirements since these apply to U.S. citizens and permanent resident aliens (regardless of where they are located in the world), all persons and entities within the U.S. and all U.S. incorporated entities and their foreign branches. On the topic of NYDFS Part 504: 1. Is there an expectation from DFS that firms establish a model validation team specific for AML/Sanctions? There is no stated expectation from DFS that a firm should establish a model validation team that is specific for AML/Sanctions. However, it is important that the team responsible for validating AML and/or sanctions models, whether a dedicated team or part of a larger model validations team, have the AML and/or sanctions experience and skills to identify and articulate test cases that provide effective challenge to the subject system. 2. Does the logic replication and output comparison have to be done annually? Not necessarily. Typically what we have seen is that a financial institutions will perform a baseline validation which comprises of logic replication, output comparison and threshold values validation. If the outcome of the baseline validation is in line with expectations then subsequent validations are much lighter with an understanding that a full (or "re-baseline") validation will be done every three to four years. To support this approach, however, a financial institution should on at least an annual basis document that there have been no changes to its business (e.g., new products/services, changes in volumes, etc.), no changes in regulatory requirements, or other material developments that would suggest the need for a full validation. 3. Doesn't OFAC's SDN list and consolidated list already consider fuzzy logic in its "strong alias" process in compiling the lists? Yes, to a certain extent, in the sense that list attempts to provide indicators around which an alias closely ties with the main entity. However, this does not mean that fuzzy logic employed by the screening system will be able to generate a match on the strong aliases. The fuzzy logic algorithm leveraged by the screening system may be completely different than the one used by OFAC. 4. Would you expect maturity and complexity of AML Programs to vary for non-bank financial institutions? Specifically, related to models used for transaction monitoring? This depends on the size of the institution, the type of products and services it offers and the geographic footprint the institution has. Some non-bank financial institutions have highly developed transaction monitoring programs.

5 On the topic of Regtech: 1. Which RegTechs will impact banking business first in 2018? Based on industry trends in the FS/Banking space, we predict that RegTech will go through a wide adoption in 2018, starting with the top 20 banks. Within RegTech, Robotics or Robotic Process Automation (RPA) will be the primary category of wide acceptance. This will help bring about much needed efficiencies in the AML Operations / FIU space. Along with Robotics, Data Visualization and enhanced reporting will be a fast follower. Machine Learning and Blockchain based applications are promising, but their adoption rate will be slower in Where are things heading in the payment space globally? We see three primary trends: Peer to Peer Payment solutions will continue to be on the rise. Wider adoption of payment solutions (mobile based) for the underbanked economies and consumers. Market consolidation, continuing a trend of large firms acquiring smaller firms (e.g., PayPal acquisition of Venmo and Xoom). Contacts Carol Beaumier Sr. Managing Director carol.beaumier@protiviti.com Chetan Shah Director chetan.shah@protiviti.com Shaun Creegan Managing Director shaun.creegan@protiviti.com Christine Bucy Associate Director christine.bucy@protiviti.com Vishal Ranjane Managing Director vishal.ranjane@protiviti.com Asa Sum Associate Director asa.sum@protiviti.com Protiviti is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to help leaders confidently face the future. Protiviti and our independently owned Member Firms provide consulting solutions in finance, technology, operations, data, analytics, governance, risk and internal audit to our clients through our network of more than 70 offices in over 20 countries. We have served more than 60 percent of Fortune 1000 and 35 percent of Fortune Global 500 companies. We also work with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. PRO Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.