The AML Challenge Arab Bankers Association 2 December 2014
The key components of an AML programme Governance Senior Management AML Risk Assessment Systems and Controls Outsourcing and Reliance Assurance Programme Customer Risk Assessment CDD / EDD Periodic / Event Driven Reviews Transaction Monitoring Suspicion Reporting Trend and threat analysis Management Information Risk-based decisions Staff Training Record Keeping 1
Senior Management engagement Implement appropriate controls and ensure effective operation. Full engagement in AML decision making. Take ownership of the risk-based approach (including establishing an AML risk appetite). Maintain awareness of firm s ML risk exposure and whether mitigation efforts are effective. Allocate overall responsibility for establishing and maintaining the firm s AML/CTF systems and controls to a director or senior manager (who may be the MLRO). Appoint an appropriately qualified and senior member of staff as the MLRO. Providing direction to and oversight of the firm s AML/CTF strategy. Determine depth and frequency of AML management information requirements. Due consideration of AML management information and timely action to rectify deficiencies. Devote adequate risk-based resources to counter ML risk. Adopt a formal policy in relation to anti-money laundering. Approved persons with AML responsibilities may be held to personal account for shortcomings in a firm s AML controls. 2
AML Challenges encountered by firms De-risking to avoid compliance costs Business Risk Assessments (inherent and residual) Design of Customer Risk Assessment models Ensuring sufficient risk-based due diligence and ongoing monitoring Overcoming the cultural challenge Use of evidence to establish and verify Source of Wealth and Source of Funds Handling relationships with corporate customers with PEP beneficial owners / controllers Ensuring that policies and procedures are kept up to date Pace and volume of regulatory change Establishing appropriate AML resource levels and identifying appropriate resource Evidencing effective AML oversight and governance by senior management Running an effective ongoing assurance programme 3
FCA activity on AML in 2014 Jan 2014 Standard Bank Decision Notice - fined 7.64m under the ML Regs. Key messages included: Importance of complying with own policies; degree of due diligence should be linked to customer risk rating; EDD should be completed prior to commencement of high-risk relationships; EDD and enhanced monitoring must be performed in high risk cases even if SDD is applicable. First case focussed on commercial banking. First case under new FCA penalty regime. July 2014 FCA published 2013/14 AML Annual Report: All firms subject to MLR classified into four risk bands. Thematic reviews and event-driven supervision to be used for all firms. Category 1 firms are additionally subject to SAMLP whilst Category 2 firms are subject to a new programme of 2/3 day visits (on a 24 month cycle). Since July 2013, approx 45 instances of event driven supervision regarding AML systems and controls. FCA described the findings from its AML work as disappointing. FCA expects improvements to take several years to implement (particularly at large banks). In response the FCA has: required specific improvement action; issued attestation requests; made two Enforcement referrals; secured voluntary undertakings from 6 banks (five small, one large). With increased focus on financial crime risk rather than size, smaller firms can expect to be subject to increased levels of FCA scrutiny. 4
FCA Smaller Banks AML and Sanctions Thematic Review (Nov 2014) FCA visited 21 smaller banks between October 2013 and June 2014. Five were visited as part of the FSA s 2011 AML review. The population included: eight wealth management/private banks, seven wholesale banks, and six retail banks. FCA disappointed to find continuing weaknesses in most small banks AML systems and controls. In particular: AML Governance and oversight weaknesses Inadequate resources / knowledge Inappropriate adoption of overseas Head Office policies and procedures Insufficiently articulated risk appetite Inadequate AML/Sanctions MI Absence of business risk assessments Absence of customer risk assessments Inadequate EDD (inc. SoW/SoF) Failure to identify/assess relevant adverse information Poor quality EDD on respondents Weaknesses in transaction monitoring Lack of periodic reviews Limited oversight of sanctions screening Ineffective training Slow responses to the 2011 AML Review Serious issues found at six banks. Four have voluntarily limited their business until control weaknesses resolved. Three banks are subject to s.166 skilled person reviews, three are working with external consultants. Two of the six are subject to Enforcement investigations. The FCA is consulting on updates to its Financial Crime Guide. 5
Key Point Reliance on third party due diligence The MLRs permit reliance on customer due diligence performed by third parties in certain circumstances. The FCA recognise reliance as a useful and cost-effective way for banks to meet CDD requirements. Relying firms retain responsibility for meeting the MLR obligations so must satisfy themselves that the third party due diligence is commensurate with the money laundering risk and fulfils the MLR requirements. However, the FCA s Thematic Review highlights that a number of banks relied on third party CDD (or EDD) without taking such steps. Third parties relied upon based in non-eea states (inc. intra-group entities see JMLSG Guidance 5.6.27) must be subject to requirements equivalent to 3MLD and subject to equivalent supervision. Where a non-eea state is not already recognised as equivalent (e.g. Australia, Singapore, USA, South Africa) firms are free to make their own equivalence assessment (this includes GCC member states). However, some firms rely on due diligence performed by parent companies / head office from non-equivalent states without undertaking such an assessment. 6
Key Point PEP Identification and Classification Establish a clear PEP definition and ensure it is clearly understood by all revenant employees. Use multiple sources of information to determine whether a person is a PEP (customer information, staff knowledge, open source research, PEP database). Existing customers can subsequently become PEPs. Where a non-personal customer has a PEP beneficial owner or controller, consider the impact on the risk of the relationship with the non-personal entity. Escalate any dubious cases (e.g. to the MLRO) and clearly record the rationale for decisions made on PEP status. Establish an approach to handling of PEP alerts and declassifying PEPs in order to manage volume there is no requirement to adopt a once a PEP, always a PEP approach. Note that former PEPs might still present a higher risk (e.g. if they maintain political connections, or are subject to credible adverse allegations). The PEP definition extends to the immediate family and known close associates of PEPs but care should be exercised when applying these definitions in order not to unnecessarily regard people as PEPs. 7
Key Point Establish (and verify) Source of Wealth (SoW) and Source of Funds (SoF) A legal requirement for PEPs (ML Reg 14). An aspect of EDD in other higher risk cases (FCA Financial Crime Guide and JMLSG). Objectives: 1) establish that Wealth and Funds are generated legitimately; 2) understand arising risk; 3) inform relationship acceptance; 4) determine nature of monitoring. Clearly define both SoW and SoF in policy and procedures and ensure staff understanding. Clearly distinguish between SoW (how the person has accrued their net assets over time) and SoF (how the funds to be subject of the relationship are generated). Determine when verification of SoW and/or SoF is appropriate. Consider whether difficulties in establishing/verifying SoW/SoF indicate increased risk. Build the story of how the person accrued their net worth and/or intends to fund their account. Statements such as inheritance or income from business do not sufficiently describe the actual origins of wealth or funds. Third party information relied upon should be credible and reliable. Customers/beneficial owners can be valuable sources of information. Meaningful assessment and analysis of information (and evidence) gathered, including plausibility. Record on file how any conflicting information is handled. Compliance (e.g. MLRO) sign-off (adequacy of information/evidence) and senior management signoff (to accept the arising risks). 8
KPMG Source of Wealth reports Questions our clients consider: How much verification of source of wealth ( SoW ) information is required for a bank s Higher Risk customers? Is SoW information and / or verification needed for a High Risk individual connected to a corporate entity? What SoW information and / or verification is required when a Politically Exposed Person ( PEP ) is a beneficial owner of the corporate account holder? How do you obtain SoW information and / or verification from an existing customer without causing a complaint? Is a different level of SoW information required for a PEP compared to any other high risk customer? Our approach: 150 files per week with capacity to scale up the team. 30,000+ public data sources and subscriptions Common errors: Failing to upgrade SoW information when an existing customer becomes a PEP. Gathering SoW information and filing it without assessing it in any meaningful way. Relying on relationship managers and Front Office staff to complete SoW requirements and only partial answers are obtained. Customer due diligence files which state inheritance or income from business in the SoW section. Failing to establish source of funds and income streams for corporate account holders which have connected PEPs. Firms should: Implement robust criteria obtaining due diligence with regards to customer source of wealth and funds Make maximum use of available public records sources Distinguish between PEP connections; beneficial owners and directors. Our dedicated team of analysts can: Deliver SoW reports based on information drawn from a comprehensive range of public sources; Highlight instances of relevant negative news information; and Produce recommendations based on our research and the account balance and turnover information provided by our clients. 300 source of wealth specific information sources Our team of analysts have successfully completed work for a number of large UK banks. The FCA has commented positively on the outcomes: We were informed that KPMG were appointed to complete a review of source of wealth (SOW) standards in WM last year. Our file reviews reflected positively on the SOW standards. 9
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation. 2014 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. The KPMG name, logo and cutting through complexity are registered trademarks or trademarks of KPMG International.