THE UNDERESTIMATED RISK OF MONEY LAUNDERING IN MERCHANT ACQUISITION AND WHAT TO DO ABOUT IT

Transcription

1 THE UNDERESTIMATED RISK OF MONEY LAUNDERING IN MERCHANT ACQUISITION AND WHAT TO DO ABOUT IT

2 Visit to join oin MAC Benefits include: Protect and invest in your organization by receiving fraud alerts. Leverage professional development opportunities for you and your employees. Get the latest updates from card brands and government agencies. Discounts to MAC and partners events. Members include: Banks Card Brands Payment Facilitators Processors ISOs/Acquirers Vendors Cost: 2 Corporate memberships - $ for four individuals. $75 for each person thereafter. Vendor memberships - $ for four individuals. $100 for each person thereafter.

3 Presenters Jose Caldera Chief Products and Marketing Officer IdentityMind Global Jose Caldera has developed enterprise management products for the past 20 years. As IdentityMind s Chief Product and Marketing Officer, he has spent the past 7 years in payments and risk, developing the cutting-edge risk management and anti-fraud products required by acquiring banks, digital currency businesses, and emerging financial services. Prior to IdentityMind, Jose managed Securify s enterprise management products and McAfee Firewall s next generation management interface. He earned a Masters of Science in Information Networking from Carnegie Mellon University. 3 Caroline Hometh Founder and Managing Partner RPY Innovators A thirty-year payments veteran, Caroline started her career with a US ISO, managing one of the first large portfolios, managing several thousand agents. She worked with the engineers developing the first encrypted ecommerce payment transaction and later worked with a firm to deliver the first ecommerce cross-border purchases to retailers. She is recognized globally as an expert in international acquiring, settlement and alternative payments. Caroline has a deep understanding of the compliance, operational and technical requirements for a payments company to build their business domestically and internationally. Caroline regularly speaks at conferences and FinTech events.

4 Preface None of the content of this webinar or slides constitute proper legal advice, nor does it replace or constitutes a proper Anti-money laundering program, nor is meant to be a complete description of all the aspects of an AML program 4

5 Agenda Landscape of threats Regulatory Framework Available Technology Learnings from Practical Cases 5

6 Threats 6

7 The world of money laundering Perpetrators: organized crime, terrorist organizations, drug cartels, rogue nations, bribery/embezzlement, human and weapons trafficking, etc Estimated between 2% - 5% of global GDP roughly between $800B and $2T* Financial institutions in the US spend roughly $8B/year in AML operations o Anecdotally FIs spend more in reactive measures than proactive large human capital Fear of the unknown is preventing banks to operate in certain markets o Derisking policies. Chokepoint in etc AML operations will continue to expand in volume and scope o Payment transactions on the rise o Cross border payments on the rise o FinTech on the rise Already approx. 30% of FinCen s enforcement actions since 2014 have been against non-bank lenders and money transmitters **. 7 *Money laundering and Globalization. ** AITE s AML of Tomorrow. June 2018.

8 Transaction Laundering Simply put a merchant processes payment card transactions on behalf of another merchant o Front Companies legitimate businesses as covers o Pass-through companies allow processing of cards by giving access to processing rails o Funnel Accounts legal biz that processes for multiple other merchants Estimated sales of $159B in 2016 in the US of this $4.6B on illegal goods by an estimated 100,400 unregistered merchants. (unverified source *) Major cases: o Merchants Bank of California Processing for MSBs (FinCEN Feb $7M fine) o Access to online gaming disguising it as fabrics, DVD cases, maps, gift wrapping, etc... (Reuters, 2017**) 8 * **

9 New Account Fraud: Identity Fraud Since 2005 almost 11B of identity records have been made accessible with over 8,000 data breaches. (Privacy Rights) In 2017 in the US there were 16.7 million victims of identity theft accounting for $16.8B. Resulting in new account fraud and account takeovers (3x in 2017 when compared to 2016). (Javelin 2018 Identity Fraud) Synthetic Identities is the hottest identity fraud trend not new, but bolstered by data breaches and inadequate KYC processes. One of the largest identity fraud rings caught in the US used synthetic identities and stolen identities to issue fake credit cards and create fake merchants and ended up stealing over $200M from banks. Cool graphic o 9

10 Regulatory Framework AML Focused 10

11 Regulatory Fines Examples Enforcement actions are growing in volume, in frequency, and the reasoning is very diverse including civil actions against AML compliance officers. Entity Date Penalty (US$) Key Reasons Paypal March 2015 $7.6 million Sanctions screening failures Western Union Jan 2017 $586 million Failed to maintain effective AML program. Hundreds of millions sent to China evading BSA. Payments related to human smuggling. Deutsche Bank Jan 2017 $425 million Over $10B of Russian money laundering 11 Merchants Bank of California Feb 2017 $8 million Enabled money transmitters to transact without proper controls. Moneygram May 2017 $250,000 civil penalty against former CCO Failure to maintain proper AML program Rabobank Feb 2018 $368 Million Failed to perform proper CDD and to implement EDD among other failures Commonwealth Bank of Australia June 2018 $530 million Failure to properly report and failure to properly monitor transactions.

12 Bank Secrecy Act Requires that banks o Establish and implement an adequate AML program o Conduct required due diligence on its foreign correspondent accounts o Detect and report suspicious activity (Suspicious Activity Report) Examination manual mandates risk mitigation via authentication (KYC) of the processor s business operations and assess their risk level via: o Requiring a background check of the processor, its principal owners, and of the processor's underlying merchants o Determining whether the processor re-sells its services to a third party o Reviewing the processor s policies, procedures, and processes to determine the adequacy of its due diligence standards for new merchants. o Requiring the processor to identify its major customers o Reviewing corporate documentation o Ensuring that the processor and its owners and operators have not been subject to law 12 enforcement actions.

13 Additionally June th EU AML Directive o Emphasis on ultimate beneficial ownership and enhanced customer due diligence o Expanded definition of a politically exposed person to domestic PEPs May 2018 FinCen CDD Rule. o It requires covered financial institutions to establish and maintain written policies and procedures that are reasonably designed to: Identify and verify the identity of customers; Identify and verify the identity of the beneficial owners of companies opening accounts; Understand the nature and purpose of customer relationships to develop customer risk profiles; Conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. o Financial institutions will have to identify and verify the identity of any individual who owns 25 percent or more of a legal entity, and an individual who controls the legal entity. 13

14 Sanctions Screening All U.S. entities and persons must comply with US Department of the Treasury regulations which demand screening of assets and accounts for an OFAC (Office of Foreign Assets and Control) specified country, entity, or individual Violations expose Financial Institutions to enforcement authority and/or substantial penalties. 14

15 And what about the FTC? We are focusing on AML but don t forget about the FTC they will continue to pursue payment processors, ISOs and Acquirers. Most of what is discussed here helps with the FTC requirements. 15

16 Technology 16

17 KYC and KYB These processes are varied and can be as thorough as necessary. A risk-based approach is widely encouraged by regulators. Technology can help automate the onboarding process for individuals and merchants to certain extent. Automated or manual, the process has to be documented and followed. Available automated technologies for individuals include: o Data verification (name, address, phone, SSN) needed but unreliable given data breaches o Document verification: document is valid, and data can be verified involves friction and its success greatly depends on the quality of the images. o Sanctions and PEP screening: required (see slide on sanctions technology) o reputation, device info, social network, IP Geo location - Inform risk levels, but no necessarily identity proofing o Biometrics: good for authentication but need to establish identity first. Face match and liveness with doc verification is useful. 17 o Negative news: recommended for enhanced due diligence

18 KYC and KYB (cont) Available automated technologies include: o Data verification - name, address, dba, TIN o Legal entity identification (LEI) not widely adopted yet can provide structure assessment o Financial risk/credit risk o Sanctions Screening Required o Bank account validation microdeposits, account ownership some friction. o Additional risk assessment: website analysis, reputation scores, BBB, state registration and good standing, 18

19 Transaction Monitoring Look for suspicious activities and file Suspicious Activity Reports (SAR) more details later Identify transactions and movement of money based on reporting requirements ($10,000 for Currency transaction report CTR) Automated transaction monitoring systems evaluate transactions looking for suspicious activities, clients, etc. Most technologies available have the basic levels of monitoring along with case management capabilities, and SAR filing. Newer technology providers have advanced analytics based on machine learning and artificial intelligence Upcoming technologies include Robot Process Automation (RPA) and Natural Language Processing Advanced analytics can provide transaction monitoring capable of detecting some versions of transaction laundering 19

20 Sanctions Screening In the US the OFAC publishes several lists that are required for individuals and businesses. The OFAC website offers a free tool on their website to manually check entries against the list. o OFAC does not actually endorse their own tool, however regulators use it as a baseline but there is precedent on enforcement actions associated with entries that were considered to be in sanctions and were not identified by OFAC s website tool. PEP screening is usually included when referring to the sanctions screening process, however PEP lists are hard to maintain and should be accessed from a third party vendor that maintains them. Available technologies include several matching algorithms including fuzzy, phonetic, and provide enough filtering mechanisms to reduce false positives. o Best industry practices suggest below 1% of match against sanctions and PEP lists 20

21 Sanctions Screening (cont) Available solutions also include case management and an environment where compliance analysts can investigate and clear out matches. Some solutions integrate negative news searching as part of the investigative portfolio 21

22 About SAR filing REQUIRED by FinCEN. A Suspicious Activity Report (SAR) is a document that financial institutions must file with the Financial Crimes Enforcement Network (FinCEN) following a suspected incident of money laundering or fraud. These reports are required under the United States Bank Secrecy Act (BSA) of The SAR rules require that a SAR be electronically filed through the BSA E-Filing System no later than 30 calendar days from the date of the initial detection of facts that may constitute a basis for filing a SAR. If no suspect can be identified, the time period for filing a SAR is extended to 60 days It can be an expensive process if not managed properly, it should NOT be taken lightly. Most transaction monitoring solutions integrate SAR filing and reporting. 22

23 Learnings from Practical Cases 23

24 Learnings from Practical Cases Large, global public conglomerate o Executive team didn t want the Board of Directors to have to approve the AML Policy o Insisted on changing the name from an AML Policy to Sanctions Screening to Compliance Policy o Finally engaged, insisted on complete training for audit and compliance personnel o Struggle with communication from the Underwriting team to Compliance personnel Start-up technology company o Wanted to purchase an AML policy but not really implement it o Resented the intrusion into their business o Want to ask as few questions as possible of their sub merchants o Want to leverage technology to handle KYC, AML, TIN, MATCH o Slowly learning to accept their responsibilities ISO becoming a Payment Facilitator o Used to allowing their sponsoring member to handle AML o Want to control their own underwriting and the relationship with their merchant o Assume nothing will ever happen to them o Confused by how fraud monitoring is different from AML transaction monitoring 24

25 SAVE THE DATE MAC 2019 Annual Conference March 12-14, 2019 Park MGM - Las Vegas, NV Don t miss the premier payments industry risk conference. 25