However, minor the task of sanction screening or name filtering sounds it contributes to a significant amount of false positives and is a time consuming task that leaves less time for other AML patients.
And in today’s environment of tighter AML regulations, constantly evolving instant payment initiatives, open banking (i.e. API) and mobile wallets, as the complexity increases so do the false positives.
While this presents major opportunities it puts a lot of pressure on the risk and compliance systems at financial institutions, which need to detect and flag actual threats in real-time. And this new reality has arisen, let us not forget, at a time when regulators are imposing ever-increasing responsibility on those people who are tasked with keeping a financial institution from being compromised for money laundering and terrorist financing.
Therefore, screening individuals and entities is a key task as well as a legal requirement of any compliance program.
“A financial institution discovered, after employees returned from the weekend, hundreds of SWIFT payments had not gone out, because the system had falsely identified the beneficiaries as a sanctioned name or entity”
The Challenges of Name Screening
Sanctions lists
Sanctions lists can be found in all formats and sizes. Some are country-based, often following United Nations resolutions to promote world peace and human rights; they prohibit certain if not all transactions. Other sanctions are motivated by politics and foreign policy at a national level, as is the case with the United States’ economic embargo against Cuba. A third category imposes targeted sanctions (e.g. the freezing of assets, travel bans and arms embargos) against specific persons, groups, undertakings and entities, as is the case with any terrorist group such as the ISIL (Da’esh) and Al-Qaida sanctions lists.
Many of the national sanctions lists are based on sanctions imposed under UN resolutions, so many of the names appearing on the UN lists also appear on supranational lists such as those issued by the European Union, as well as national sanctions lists such as the USA’s OFAC and the UK’s HMT lists.
Sanctions lists are fairly straightforward. The course of action regarding persons and entities on sanctions lists is clear – they are a no-go for most financial institutions and when confirmed a Suspicious Activity/ Transaction Report (SAR/STR) must be submitted to the local financial investigation unit (FIU) authority. Complication is manifested when a company is not on any official sanctions list, but a shareholder is, therefore you are required to treat it as a sanctioned entity.
Watch lists
Watch lists serve the purpose of assessing a client’s potential risk and includes (among others) PEPs. A politically exposed person (PEP) is someone who has been entrusted with a prominent public function and therefore presents a higher risk for potential involvement in bribery and corruption by virtue of their position and influence. The Financial Action Task Force on Money Laundering (FATF) issued its latest definition of PEPs in 2012:
Foreign PEPs: individuals who are or have been entrusted with prominent public functions by a foreign country, for example Heads of state or Heads of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, important political party officials.
Domestic PEPs: individuals who are or have been entrusted domestically with prominent public functions, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, important political party officials.
This distinction is important for a risk-based approach. Also it’s important to note that there are still countries who do not subscribe to the notion of domestic PEPs being a risk at all.
In addition, persons who are not politically active but who have been entrusted with a prominent function by a state-owned enterprise or an international organization, for example members of senior management, directors, deputy directors and members of the board or equivalent functions may also appear on watch lists.
Being on a PEP or other watch list obviously does not mean that a person is corrupt, but that person presents increased risks owing to the possibility that an individual holding such a position will have far greater opportunity to misuse power and influence for personal gain, or may be open to malign influence by a third party. A point that is often overlooked, but really important as bribery convictions reach all-time highs, is the risk that business partners may pose if they qualify as “public officials” based on their company’s ownership structure if fully or partially state-owned.
Law enforcement agencies, security authorities, national and regional agencies also disseminate various lists. These lists (e.g. Interpol’s Red Notices, the FBI’s Crime Alert List, Europe’s Most Wanted, Singapore Investors Alert and IOSCO consumer protection) can help financial institutions and other organizations avoid doing business with a wrong party and from being drawn into a fraudulent scheme or unwanted scandal.
Adverse media lists
Adverse media comes from a range of local, national and even global sources as well as online social platforms. Adverse media can support a financial institution or a corporate company’s decision to engage or not to engage in a business relationship based on the risk associated with the client from negative news. Adverse media can reveal potential involvement in money laundering, terrorism, various criminal activity and other potential crimes that could have a reputational backlash for a firm.
Lists in general
Although, many lists are publicly available, there are technical challenges because these sources have different ways of presenting information. Some offer well-structured information in downloadable XML files, others in CSV or delimited text files, while others can be drawn from social feeds, blogs, web posts and many are unstructured, and still other sources have online lists across multiple web pages, and some are even in PDF format only.
Not to mention the URLs are constantly being moved, without notice. Therefore, a firm’s name screening might not be including an important source, because the URL changed without notice.
Despite the apparent simplicity and straightforwardness of list screening, selecting the lists that will benefit all areas of your financial crime prevention program can therefore be a daunting task. Here are a few factors to consider:
The geographical jurisdiction(s) in which you operate
The requirements of local and foreign regulators in the area you operate
Your organization’s risk assessment – this must be consulted as a guideline
Is an appropriate data structure provided?
Does the list provider deploy technology that enables more cost-effective means of data deployment (e.g. through the cloud or interfacing via API)?
What formats are data files available in?
How up-to-date and “clean” is the data? The lists can hold millions of entries. How well does it manage duplications, expired records etc.?
An appropriate update schedule and updating by delta files are a “must have”
If an online search function is provided, what techniques are being used to match names?
Data
In many cases and for many reasons an institution’s data will have gaps and inconsistencies following the old data processing axiom of garbage in garbage out (GIGO). On the other hand, we’re trying to match against hundreds of lists that have different ways of presenting the information.
Inconsistency in basic things like abbreviations (Sr./Senior, Inc./Incorporated, AG/Aktien Gesellschaft, nicknames, etc.) and translations of words that have the same meaning but are spelled different e.g. Germany (EN), Allemagne (FR), Deutschland (DE) can all impact screening results.
Transliteration
A majority of the relevant lists published are in a Latin character set, while many of the names on them originate from countries that do not use the Latin alphabet. Therefore, names that are Chinese, Greek, Islamic, Russian and Thai, etc. must be transliterated from their home language to a Latin one. However, the complication does not end there. For example, in the Arabian Peninsula, Jamal is pronounced Jamal, in Egypt Gamal, and in Algeria Djamal. These are all the same Arabic word, but one that is spelled (transliterated) in various regional ways when written in English.
A further example of transliteration is the voiceless uvular plosive used in Arabic and other languages. It is pronounced approximately like English [k], it’s pronunciation varies between different languages and different dialects of the same language. The consonant is sometimes transliterated into “g”, sometimes “k”, and sometimes “q” in English.
For example, the former Libyan leader’s name can be spelled in various ways:
Gaddafi
Qadhafi
Kaddafi
Gadhafi
Ghathafi
Qaddafi
Ghadafi
Beneficial owners
Opaque ownership structures present a real challenge for KYC as criminals, and politically exposed persons (PEPs), etc. hide behind corporate structures.
A company might not be on an official sanctions list, but according to an Office of Foreign Assets Control (OFAC) rule it can be blocked if stakeholders who are on lists have ownership equal to or above 50 percent (this is known as the 50 Percent Rule); thus there is a good chance that the company in question will itself be treated as a sanctioned entity. To put it simply, if company X is blocked and it owns 50 percent of company Y, company Y is also considered blocked, even if that entity doesn’t appear on the OFAC Specially Designated Nationals (SDN) list.
For this reason, it is imperative that corporate ownerships are verified when dealing with certain countries and corporate structures to ensure that none of the beneficial owners are prohibited persons under OFAC regulations.
Practical Actions to take Now
Given the various points raised above, here are some practical steps you should take if you wish to make efficient use of lists and increase the effectiveness of sanction and Pep filtering:
Data Integrity. Get your data in order. A database built on the principles of good data, properly spelled names, sound data structure, and format will go a long way to improving the identity matching process.
Automated Data Collection at every point of customer engagement
Do not simply perform risk assessment, “live it”. This is critical in leveraging the understanding of how these risk exposures impact technological decisions and operational areas of the institution.
Test, test, test – perform random checks to ensure that technology and operational processes are working appropriately and are being consistently applied. Review reports to understand when and why changes are necessary.
Check AML data providers for company credibility, data accuracy,
well-structure data, depth of content, customer service/support, data quality verified by third party, etc
Apply Innovative Technology
Artificial Intelligence
True, there is a lot of hype about Artificial Intelligence (AI) and most AI examples that you hear about today – from Google Assistant, Alexa, Siri, or Bixby, to self-driving cars – rely heavily on deep learning and natural language processing. Using these technologies, computers can be trained to accomplish specific tasks by processing large amounts of data and recognizing patterns in the data
Therefore, if you are serious about sanction screening and tackling money laundering with an acceptable return on your efforts and investment, you need to acquaint yourself with artificial intelligence (AI) and machine learning (ML).
Artificial Intelligence and Machine learning uses two types of techniques: Supervised, models are trained on data with known inputs and outputs (also known as categorized data) to identify potentially suspicious transactions. while Unsupervised, models are exposed to raw data to find hidden patterns or intrinsic structures that might signal money laundering or other financial crimes.
The importance of this is demonstrated with the use of supervised learning in sanctions screening where every payment transaction must be screened to check if any beneficiaries are on a sanction or watch list.
However, screening systems produce a lot of false positives that must be dispositioned by a human reviewer, before the transaction can leave the gateway or employees which are greeted by thousands of false positives after an overnight batch screening.
Hopefully, AI can be trained, well enough, to eventually takeover much of the task of reviewing these false positives. There can’t be enough said to the urgency of experimenting with artificial intelligence (AI) now as these models and algorithms need to be constructed, systems set up and then trained, tested, trained, tested and trained until these technologies are taught to address the repeatable high-volume of false positives.
That said, AI is not in itself a “silver bullet” and the process of getting these models up and running can be laborious, therefore, banks should consider cloud-based multi-tenant solutions that share out the cost burden and a can improve time to deployment.
Blockchain Technology
Other technological advances, such as distributed ledger (e.g. blockchain) technology, will help to improve banks’ ability to monitor complex, multi-part transactions. These “smart contracts” with advance algorithms, will allow financial institutions to securely parse data through an AML engine on the blockchain,” in this way banks can store and share data, thus eliminating excessive complex bureaucracy involved in information sharing.
Paul Allen Hamilton
I can be contacted on LinkedIn @ https://www.linkedin.com/in/paulhamilton2/
Hardly a day goes by without a news item concerning the use of cryptocurrencies for money laundering. In June the Financial Action Task Force (FATF) told countries to tighten oversight of cryptocurrency exchanges amid growing concern among international law enforcement agencies that cryptocurrencies are being used to launder the proceeds of crime. Countries will now be required to register and supervise cryptocurrency-related firms such as exchanges and custodians, which will have to carry out detailed checks on customers and report suspicious transactions. Many governments are already acting on this; for example, on 5 August the Thai government announced that it would bring cryptocurrencies under existing financial regulations, monitored by its anti-money laundering office, AMLO. In a statement to the Thai press, Police Major General Preecha, secretary-general of the Anti-Money Laundering Office (Amlo), neatly summarized the current lack of visibility over the issue, saying, “We may not find any clue, but that doesn’t mean the wrongdoing does not occur.” Elsewhere, there have been successes. Earlier this year, Europol broke up a Spanish drugs cartel that laundered cash using two crypto ATMs, machines that issue cryptocurrencies for cash. The concern is that cryptocurrencies can be used to transfer money across borders, break down large criminal money transfers into smaller amounts that are harder to detect, and to make payments on the dark web. And while some of this money laundering activity is still conducted using well-known cryptocurrencies, notably bitcoin, criminals are increasingly switching to more anonymized cryptocurrencies. Yet, while cryptocurrencies are further complicating the AML landscape, it has been argued that the very technology supporting them – blockchain – may contribute massively to reducing the costs and the challenge of know your customer and anti-money laundering (KYC/AML) through what has already been dubbed the KYC blockchain.
The cost of KYC
As is well known, Know Your Customer (KYC) is hideously expensive for banks. The cost of conducting KYC due diligence investigations of a company or individual can run into tens of thousands. KYC processes provide the backbone of financial institutions’ efforts to combat the financing of terrorism and to detect and prevent criminal behaviours around the world, such as trade-based money laundering (TBML). According to recent estimates, in excess of US$25 billion is spent each year on financial crime risk management in the banking sector, the majority of which is due to KYC. The reason for the high cost is simple: KYC at many financial institutions is extremely inefficient, involving labour-intensive manual processes, duplication of effort and a high risk of error. Up to 80 percent of the effort associated with KYC is dedicated to information gathering and processing, and only 20 percent to assessing and monitoring that information for critical insights. It can take weeks or even months to identify a beneficial owner by locating and validating the relevant physical and computer records. Moreover, the work is typically done many times over, even for the same customer. Each Line of Business (LoB) within a bank performs its own customer checks. The legal entity – be it an individual or an organization – typically provides KYC documents each time it requires services from different LoBs within the same institution. It is difficult or impossible for LoBs to share the information in a secure and easy manner while protecting confidentiality and privacy. Poor customer experience and high operational costs for the bank are not a good business model in a competitive environment. In other articles we have considered how machine learning – a subset of artificial intelligence – may help to address this challenge, but a key problem remains, which is that the trail of transactional records that is required to identify money laundering is typically spread across multiple LoBs, financial institutions and legal jurisdictions. And this is precisely where blockchain, the underlying technology for bitcoin and other cryptocurrencies, could reduce inefficiencies and duplication of effort in KYC information gathering between legal entities within a large financial institution or even between competing banks.
The Singapore trial
But how realistic is such an approach? A prototype tested in Singapore in 2017 involving OCBC Bank, HSBC, Mitsubishi UFJ Financial Group (MUFG) and the Infocomm Media Development Authority (IMDA) was the first KYC blockchain in South-east Asia and the most public trial to date. It was claimed that the prototype could solve the current practice of collecting and verifying personal information from customers repeatedly, reducing the costs by 25-50%, according to KPMG. Like cryptocurrencies, a KYC blockchain prototype operates on a distributed ledger technology and enables structured information to be recorded, accessed and shared across a distributed network using advanced cryptography. With the customer’s consent, LoBs can share information accurately and efficiently with a clear audit trail generated on the blockchain. With a KYC blockchain LoBs can securely search customer information, generate requests for KYC documents from other LoBs that have already verified customers, store validated customer documents and re-use them where required. The infrastructure can also be used for sharing customer profiles and alerts, which can trigger mitigation procedures when required in response to alerts. The Singapore prototype reportedly remained stable even with a high volume of information, was resistant to tampering and maintained data confidentiality. Some fintech companies have now built their own blockchain technology-based distributed ledger systems.
Self-sovereign identity systems
A further development of blockchain-based technology that may reduce KYC costs is “self-sovereign identity” (SSI) systems. Through the use of distributed ledger technology, SSI enables individuals to retain control over their data while at the same time being verifiable for banks and other relying parties through the public recording of verified claims. SSI could be the next step in identity management, combining traditional means of identification with new technology-based systems (such as asymmetric key, one-time password, biometrics) in a distributed system. Its relevance to KYC is that it adds a layer of security and flexibility allowing the identity holder to reveal only the necessary data for any given transaction or interaction. Under existing practice, a bank has to access highly centralized pools of data time and again in order to verify identity. This has a high degree of dependence on data sources that are vulnerable to hacking. Data vulnerability is potentially damaging to both the bank and the bank’s customers, whose identity may be stolen and either used to carry out fraudulent transactions or to provide that identity to another person, who can then use it for (among other things) for the purpose of money laundering. SSI could reduce the bank’s dependence on a centralized data pool and processes that were not designed for a decentralized, distributed and instantly connected world. An identity blockchain in which a bank has node status would provide a solution that resolves the conflicting demands of financial security and personal privacy. Such solutions for managing self- sovereign digital identities are already in a fairly advanced stage of development.
How much of this is hype?
While there are similarities between the technology behind bitcoin and the proposed systems to assist with anti-money laundering, we should be careful that we are not blinded by the hype. As Investopaedia recently reported: Compare that open, permissionless blockchain to the “private” or “permissioned” blockchains that established tech and financial services players, along with a gaggle of start-ups, are developing on their own or through consortia. Rather than a trustless network of thousands of strangers, they propose to build small networks of known, vetted actors – or in some cases, to keep the blockchain to themselves. The result makes compliance with [AML and KYC] laws easier … but at some point, these purported blockchains have little to do with the innovation that underpins bitcoin. The truth is that technological change tends to be incremental and evolutionary, building on earlier advances. In the case of blockchain, this “revolutionary” technology is based on the successful combination of several pre-existing technological approaches: primarily, decentralized networks, cryptography, and consensus models. Blockchain makes it possible to exchange values in a decentralized system. Cryptocurrencies and the proposed KYC blockchains have this in common, but the commonality ends there. The blockchain hype cycle has peaked and is now in what Gartner terms the “trough of disillusionment”. This is inevitable. No new technology has ever solved more than a small fraction of the problems faced by humankind (well, not since the wheel). Blockchain (we will increasingly see the terms distributed ledger systems or hyperledgers) will bring benefits in many areas of human endeavour, including AML and KYC, but it will be no “silver bullet”. Doubts remain about its scalability, and the competitive nature of the market, concerns about confidentiality etc. will set limits on its application. That said, there is no question that these technological developments are highly positive. The bottom line? A realistic assessment is that KYC blockchains and SSI-supported onboarding will not fundamentally transform due diligence processes but, especially if combined with other technologies, they could reduce the cost of KYC by something in the range 20%-30%. That will have a significant impact on banks’ ability to combat common forms of money laundering.
Any major financial institution would jump at that!
With international trade valued at
approximately US$ 16 trillion per annum, it provides ample scope for money
laundering. According to the International Narcotics Control Strategy Report
(INCSR) hundreds of billions of dollars are laundered annually by means of
trade-based money laundering (TBML). It is one of the most sophisticated
methods of cleaning dirty money. TBML red flags are among the hardest to
detect. For example: what is the value of a dress? Is it $3? Or $30? Or $300?
This simple uncertainty creates an environment that’s rife for abuse. TBML
accounts for hundreds of billions of dollars of illegal money flows annually.
According to a PWC report published in January 2015, 80 percent of illicit
financial flows from developing countries are accomplished through trade-based
money laundering.
Commonly used TBML techniques include over
or under-invoicing and multiple invoicing, all of which facilitate money
laundering through the creation of artificial profits or losses. Honest
exporters and importers can be unknowingly caught up in such schemes:
Over-invoicing. Company X ships
10 cars with a market value of $10,000 each to Company Y, but invoices Company
Y $20,000 per vehicle. Company Y has an apparently legitimate reason to
transfer $200,000 to Company X, half of which is “dirty money” to be laundered.
Company X thereby profits from the $100,000 excess over market value, which
represents the proceeds from criminal activity, but is now “clean”. Company X
could even apply for tax incentives when exporting certain categories of goods,
and it can evade capital controls by placing the excess funds in an offshore
account
Under-invoicing. In this
scenario Company X ships 10 cars with a market value of $10,000 each to Company
Y, but invoices Company Y for just $5,000 per vehicle. Company Y transfers
$50,000 to Company X, then sells the cars to a dealer for $100,000. In this way
Company X can transfer $50,000 of dirty money to Company Y. If asked, both companies
can plausibly argue that the transaction was legitimate. A more likely
scenario, however, is for the two companies to limit the under-invoicing to a
margin of 10% or less, making it even more difficult to prove that the
transaction was designed to conceal money laundering.
Multiple invoicing. Money
launderers may instead invoice the same shipment of goods more than once. In
order to obscure the true nature of this scheme, organizations will employ
multiple financial institutions to assist in financing. The price specified for
the goods or services does not have to be manipulated and it is not uncommon to
issue multiple payments in legitimate transactions due to amendments and
corrections, making this hard to detect.
An alternative is to over or under-ship the
goods themselves:
This is similar to over and
under-invoicing in that value is transferred to either the buyer or the seller.
In this case, however, the parties misrepresent the quantity rather than the
price. Company X charges Company Y $5 million, which reflects the value of the
goods on paper. Company X then proceeds to ship $10 million worth of product,
so Company Y receives an additional $5 million worth of goods.
Over-shipment can also be used
to avoid import duties.
In some extreme cases of under-shipment,
also known as phantom shipment, the seller will ship nothing at all – just an
empty container backed by documentation that appears to be fully in order.
A further common technique is the
fraudulent description of exported goods:
Exporters can falsely describe
the goods or services being transferred, either inflating or deflating their
true value in order to pay off or get paid off. This TBML scheme works best
with “invisible” services such as financial or legal advice, management consultancy
marketing research etc.
Alternatively, low-grade or
even scrap material can be valued at an inflated price and fraudulently sold as
high-grade or premium material.
This form of money laundering
may also be used in conjunction with other criminal activity, such as shipping
proscribed goods such as ivory or endangered woods on CITES lists or claiming
to ship goods that are eligible for tax incentives or subsidies.
Trade diversion is a common way of moving goods
between high-cost and low-cost (or “developing”) economies, taking advantage of
price differentiation between markets.
Company X sells expensive
pharmaceutical goods at low costs from a European Union country (e.g. the UK or
Ireland) to Company Y in a poor African country.
Company Y sells the same
pharmaceuticals back to Ireland at (or close to) Irish market pricing.
Red flags
Most TBML involves more than one of the
methods listed above (and possibly others) and more than one organization, in
more than one jurisdiction. This makes it exceptionally difficult for financial
institutions and regulatory authorities to identify red flags. The Financial
Action Task Force lists the following red flags that financial institutions
should look out for and investigate:
Discrepancies between the
description of the good or service and the invoice
Discrepancies between the
description of the good or service and the actual good or service
Discrepancies between the
reported value and the fair market value
When the underlying good or
service varies significantly from the exporter or importer’s typical shipment
When the size of the shipment
varies significantly from the exporter or importer’s typical shipment
When the good or service is
designated as “high risk”
When the jurisdiction is
designated as “high risk”
When multiple jurisdictions are
involved for no economic reason
When the transaction involves
shell companies
Red flag checks also target the illicit
shipment of dual-use goods – goods that can be used for both innocent purposes,
as well as sinister ones. These could include chemicals for making illegal
drugs, or that could be used for both civilian and military purposes. Ammonium
nitrate, for instance, is used as a fertilizer but can also be used in
explosives. In this case, understanding the context of the shipment, and
knowing the organizations involved is key.
What should banks do?
Regulatory bodies around the world are
stepping up scrutiny of TBML and banks are increasingly obliged to take more
stringent action to ensure they are not unwittingly facilitating illicit
transactions. The Monetary Authority of Singapore (MAS), the Hong Kong Monetary
Authority (HKMA) have taken the lead in issuing guidelines and red flag checks
around trade finance, based on advice from the International Chamber of
Commerce (ICC), Bankers Association for Finance and Trade (BAFT) and FATF. These red flag checks define the key
attributes in trade finance transactions that indicate a high risk for TBML and
are now seen as the global standard for due diligence for which financial
institutions must screen and monitor.
In particular, banks have a duty of care to
identify where goods are being shipped, what transportation is used and whether
goods can potentially be used for dual purposes. However, this is not just a
duty for banks; companies involved in exporting and importing must exercise due
diligence to ensure that they are not (wittingly or unwittingly) involved in
suspicious trade activity.
As is the case with other forms of money
laundering, failure to comply will not only result in huge fines, but also
significant reputational damage. Regulatory enforcement actions often feature
specific language indicating that banks aided and abetted terrorism, drug
trafficking, and human trafficking by failing to detect and report illicit
activity, upon which media outlets can be quick to capitalize.
Sanctions screening
Compliance with government sanctions lists
naturally forms a substantial part of the checks for trade finance that banks
are required to make. Red flag guidelines require banks to keep a sharp eye out
for customers conducting business in, or shipping items through, high-risk states,
or customers engaging in potentially high-risk activities, including the arms
trade or the export of dual-use goods.
Banks must verify all counterparties (corporations and banks) as part of
Know Your Customer (KYC) regulations and ensure that all parties to a
transaction undergo “sanctions screening” against official sanctions lists,
including those from the Office of Foreign Assets Control (OFAC), the European
Union (EU), and the United Nations (UN).
Why is compliance so difficult?
However, such compliance is no mean feat
because, as we have seen, there are many TBML techniques, which can be used in many combinations. Moreover, whereas
legitimate international trade assumes that there is only an advising bank and
an issuing bank, acting on behalf of both the importer and the exporter, the
reality of letter of credit (LC) processing, could be far more complicated with
many additional parties involved: one or more reimbursing banks, as well as the
banks of intermediaries, advisors, shipping and insurance agents, vessels,
forwarding agents, consignees, notifying parties … the list is virtually
endless. Multiple financial institutions and agents, multiple ways to move the
goods, etc., all add complexity upon complexity for the purpose of monitoring
for money laundering.
Thus, even though all of the TBML
techniques listed above are well known to investigators, there is no easy way
to identify this form of money laundering activity, at least not using
traditional methods. The data that is required to identify suspicious activity
typically resides in multiple sources, over which the individual investigator
at a bank or regulatory authority has limited visibility. Moreover, as is the
case with all forms of anti-money laundering investigation and sanctions list
monitoring, TBML throws up a large number of false positives, which reduce both
the investigator’s productivity and the likelihood that he will spot a true
positive.
Barriers to data integration
The principal reason for the high rate of false
positives is that the source data being used has not been subjected to data
normalization or data cleansing, and it resides in various legacy systems that are
not integrated and not shared by the various financial institutions involved. Typically,
there is no link between letter of credit data and associated data and a
financial institution’s watch list. Consequently, most investigations are
largely manual and carried out by individual investigators in individual banks.
There is a complete lack of transparency and visibility.
With multiple document formats and data
sources to monitor, banks are increasingly looking to artificial intelligence
technologies such as natural language processing (NLP) to meet their TBML
compliance obligations. To this end, unstructured data from the various
paper-based trade documents must first be scanned and put into machine-readable
text format. Once the data is in a format that can be processed and analyzed,
NLP can be used in combination with a rules-based engine to interpret the text,
understand the context and draw conclusions from it to identify red flag
indicators as well as true beneficial owners on sanctions lists.
By harnessing the capabilities of such
technologies, banks will be able to go monitor and detect money laundering
activities more rapidly and efficiently than in the past, throwing up fewer
false positives without the burden of having to employ large numbers of
investigators to tackle difficult compliance checks manually. Human
investigators will, instead, be able to focus on following up genuinely
suspicious activity.
While TBML remains widespread, red flag
guidelines and watch lists will continue to evolve and grow. It is only through
flexible, intelligent, automated AI-powered solutions that banks can keep up
with and adapt to heightened regulation required to tackle this growing
international crime.
That said, AI is not in itself a “silver
bullet” and the process of getting them up and running can be laborious if
undertaken by individual financial institutions. Models and algorithms need to
be constructed, systems set up and then trained and tested. This will involve
expert investigators working with data scientists to set up suspicious activity
scenarios based on all the key fields involved in a trade transaction. Banks
should therefore look to cloud-based multi-tenant solutions that share out the
cost burden.
When the system detects a potential red
flag based on the pre-programmed scenarios, an alert will be generated, giving
the investigator immediate access to the specific transaction. Investigators
will then need the ability to rapidly find transactions that exhibit similar
characteristics.
Other technological advances, such as
distributed ledger (e.g. blockchain) technology, will help to improve banks’
ability to monitor complex, multi-part transactions.
Nonetheless, greater international
cooperation is vitally important. Progress in combatting TBML will be greatly
accelerated if regulators across jurisdictions can formulate agreements for
better information sharing and improve the harmonization of data that is
scattered across multiple systems, borders and financial institutions.
The world of banking continues to evolve at a breathtaking pace and is becoming ever more competitive. Once a new technology has come to market, banks are faced with a dilemma: do we embrace it and run with it, or do we let our competitors gain a first-mover advantage? Delay implies a commercial risk. But the operational and compliance risks that you take on as a first mover may be even greater.
Given the harmonisation of national payment systems across regions, the focus has shifted to international payments and to improve the overall user experience like speed, cost, reliability and traceability. Therefore, payment processors today are seeing some major developments, with new tools appearing such as SWIFT’s gpi and SEPA’s instant payment. These instant cross border payment initiatives are a prime example of what will become the norm in payments.
The rapid pace of digitalisation of payments brought growing market pressure which have led cross-border payments to undergo significant infrastructure modernisation. The overall trend in digital transactions which are increasing at 6% per year alone in Europe. Total number of traceable transactions in Europe increased from 2013 to 2017: from 113B in 2013 to 144B in 2017 (+27,4%; CAGR +6%)
Number of Digital Payments: Global E-Payments increased from 28,6B in 2013 to 56,5B in 2017 (CAGR: 18,6%); Global M-Payments increased from 24,6B in 2013 to 70,4B in 2017 (CAGR: 30,1%)
Banks that offer this service will gain a competitive advantage over banks that don’t provide it. Clients want their payments to be processed quickly because for them it increases efficiency, transparency, convenience, and financial control. For small and medium-sized companies, this form of payment processing helps alleviate liquidity stress and counter party risk. And, in general, people have grown accustomed to things moving fast, so they have little patience and understanding when payment processing is slow.
Instant payment allows sellers and buyers to exchange money and purchase services in seconds. Funds are received in the payee bank account almost immediately, instead of requiring few business days. That can make a significant difference to a small business’s cash flow, in particular, and it means less time spent waiting for money to clear from the buyer’s point of view. Fast transactions are a common requirement in the new economy, especially with increased mobility: the current generations of customers (so-called millennials and beyond) want to be able to make payments anytime, anywhere, using their mobile devices.
So, what’s not to like about instant payment?
Well, quite a lot, actually. Instant payment processing makes it more difficult to detect financial crimes like money laundering and financial fraud. Criminals want to move money as quickly as possible through a number of accounts at different international banks to disguise the origin of funds. There is no faster way to do this than with instant payments. How can a bank possibly detect money laundering activity in a real time world when transaction monitoring is conducted in a batch process needless to mention the more complex criminal activity?
The Bangladesh Bank heist is a perfect illustration of the future complexity involved in monitoring instant payments.
From the $ 81 million stolen from the Bangladesh Bank in February 2016 only $ 15 million has been recovered and there is still no word on who was responsible. Cyber attackers illegally transferred US$ 81 million from the Central Bank of Bangladesh (CBB), to several fictitious bank accounts around the world, by subverting their SWIFT accounts. The hackers used the SWIFT credentials of the CBB to send dozens of fraudulent payments to fake accounts in the Philippines, and other Asian banks. This was without questioned a well-planned attack that used time differences and regional holidays brilliantly.
How will current anti-money laundering systems work in a world of instant payments?
Its difficult enough for financial institutions to monitor against money laundering violations when it takes three to five days for a transaction to be cleared, or at best overnight. With instant payment, the near-impossible becomes totally impossible using conventional methods as transactions clear in a matter of milliseconds. By conventional, we mean here rule-based approaches, where suspicious transactions are put in a queue and investigated in batch mode.
Even in a world operating in batch, traditional AML systems generate too many false positives (typically between two and 15% of all transactions) and therefore imposes a huge workload on banks and investigators.
Number of
Suspicious transactions reported to UIF: +51% (’12-16), from 67K in 2012 to
101K in 2016
With instant payment, this problem is greatly increased because banks are under pressure from customers and consumers to clear transactions as quickly as possible in order to meet the agreed level of service.
Transaction monitoring systems built on current technology and based on machine learning offers the only credible answer. By creating algorithms that learn from past results with the expertise and knowledge of AML compliance officers, the system learns to identify false positives, and compliance officers can focus on alerts where there is a higher probability that money laundering is actually occurring.
Another technology-based approach that has been developed recently, called visual mapping, provides insights into how instant payments are moved around. Suspicious payments can be tracked as they move between bank accounts, regardless of whether the payment amount is split between multiple accounts, or those accounts belong to the same or different financial institutions. The software creates a visual map of where and when money has moved, providing new insights and intelligence for fraud and compliance teams to take action.
By bringing together transactional data
from multiple financial institutions and running sophisticated algorithms, such
solutions can identify the so-called “mule accounts” that are used for money
laundering and other illegal activity. Many of these accounts are not set up
directly by the criminals themselves but via a number of scams including
phishing, spam email, instant messaging etc.
It is worth pointing out that while technology is a necessary condition for successful AML compliance in the new world of instant payment, it is not a sufficient condition. In addition, financial institutions will need to review their compliance procedures and their service offerings to strike the optimum balance between competitiveness and security.
What should be the upper threshold for an instant payment?
Should they give priority to VIP and profitable customers when reviewing suspicious transactions? What about social and political issues? (For example, Muhammad is the world’s most common name, and also appears a lot on sanctions list. But that also means a significantly large number of false positives, which could lead to claims of unfair profiling.) And finally, even with advanced technology and effective redesign of processes and procedures, banks may still need to increase their staffing in order to meet the challenge. They need to ensure that they have enough staff with sufficient knowledge and authority to be available to review transactions quickly.
Some banks have offshored or outsourced simple customer due diligence functions to keep pace. That said, the trend is definitely towards investment in more technology. As a recent article in The Economist put it, “Now, the biggest question for bank controllers is how many humans they can replace with bots without compromising compliance […] Banks are going into partnership with some of the hundreds of ‘Regtechs’ that have sprouted in recent years.” Technology must be a large part of the solution, but banks will just need to take care and seek expert independent advice in reviewing the new Regtech apps: the regulators and the markets will penalize them should their techno-experiments fail.[1]
The cost of money laundering and other forms of financial crime are critical to a bank’s future. Germany’s troubled Deutsche Bank faces fines, legal action and the possible prosecution of senior management because of its alleged role in a $20bn Russian money-laundering scheme, according to a recent report in The Guardian.
Money laundering scams included shell firms lending money to each other and then declaring themselves bankrupt. On top of the heavy fines that can be incurred, the damage to brand and reputation can be incalculable. Deutsche Bank has been dubbed the “Global Laundromat”, with the total funds involved estimated at around $80bn.
Now, there’s a big challenge for any PR company that’s up for it.
And yet the cost of being squeaky clean (at least, in the eyes of the regulator) is also eye-watering. In the US alone, the cost of AML compliance is estimated at $23.5 billion per year. European banks come close with $20 billion spent annually. And for what? The banks identify a measly one percent of all the money being laundered.
In Europe, that amounts to just $10 billion of the $1 trillion that is being laundered. Which is just half of what is being spent on compliance! Even more shocking, over the last decade, 90% of European banks have been fined for AML-related offences; globally, banks have been fined approximately $26 billion over the last 10 years.
So, what is the point of “compliance”? It has become an end in itself, a tick-the-box exercise that is imposed by governments and regulators and keeps thousands of compliance professionals in highly paid jobs, and tens of thousands of low-paid drudges doing soul-destroying menial work.
Anti-money laundering has always been, and remains, a largely manual exercise that involves chasing up cases of unusual or suspicious activity, which in the overwhelming majority of cases turns out to be a false positive.
At the root of the problem are the four Vs of Big Data: The accelerating rate of growth in the volume of financial data in circulation, its velocity of circulation, its variety and variability. According to the International Data Corporation (IDC), 44 Zettabytes of data will have been generated by 2020.
To put that in perspective, a zettabyte is one billion Gigabytes. A Zettabyte is equal to one sextillion, or 1021. The number of grains of sand on Earth is estimated to be a far smaller number, just 7.5 * 1018, or even quintillion, five hundred quadrillion grains.
Therefore, talk about needles in haystacks comes nowhere near to describing the challenge! Trying to find a single criminal transaction is more akin to finding one grain of sand across several continents. But with an additional complicating factor.
The number of grains of sand on Earth, though vast, is finite. Whereas we are constantly pumping out more financial data. By 2030 there will be some 50 billion electronic devices connected to the internet, most of them generating transactions in one form or another.
There is only one way to escape from this cul-de-sac, and that is through the application of technology.
Let’s consider some of the technologies involved. Specifically, technology that is powerful enough to trawl through those mind-bogglingly vast oceans of transactional data, detecting patterns that indicate criminal activity with a very reliable degree of probability.
True, there is a lot of IT hype out there but if you are serious about knowing your customer and tackling money laundering with an acceptable return on your efforts and investment, you need to acquaint yourself with artificial intelligence (AI).
Not a day passes without us hearing about artificial intelligence, and it all sounds amazing but do we really know what hides behind artificial intelligence?
The AI idea started at the beginning of the last century. More specifically, the first scientific paper written by Walter Pitts and Warren McCulloch on the subject influenced the important Dartmouth conference in 1956.
AI has a broad definition. It applies to any form of intelligence demonstrated by computers and similar devices. The Financial Stability Board defines AI as “the theory and development of computer systems able to perform tasks that traditionally have required human intelligence.”
Machine learning (ML): This is a key sub-field of AI and it is developments in machine learning that have powered many of the recent successes of AI in the finance sector. It refers to the science of algorithms and statistical models that computer systems use to perform specific tasks without using explicit instructions. Typically, the more historical data that a machine learning system has, the more it learns how to respond to new data.
Machine learning is categorized into two groups Supervised and Unsupervised learning:
Artificial Intelligence and Machine learning uses two types of techniques: Supervised, models are trained on data with known inputs and outputs (also known as categorized data) to identify potentially suspicious transactions. while Unsupervised, models are exposed to raw data to find hidden patterns or intrinsic structures that might signal money laundering or other financial crimes.
Everything is becoming “Smart” such as our cars, mobile phones, televisions, watches, even are cities. Nevertheless, we have not yet lived in the age of unsupervised AI. Its counterpart supervised AI already exist.
Applying AI and ML in the fight against financial crime
Two primary benefits for the banks engaged in combating financial crime: mainly the reduction of false positives and building more sophisticated risk profiles based on behaviour, rather than relying only on rules, will go a long way to increasing the efficiency in the AML process.
The methodology behind traditional transaction monitoring systems is essentially, rules, thresholds and risk profiles based on industry specifics such as product, geography, and transactional value and type.
As we have seen, this is not the most sophisticated nor the most efficient approach when trying to detect suspicious activity which has lead to a high-volume of false positives.
Therefore, the future of transaction monitoring means being able to dive deeper into transactional data in near real-time as opposed to only using a library of set rules based on industry specifics.
The importance of this is demonstrated with the use of supervised learning in sanctions screening where every payment transaction must be screened to check if any beneficiaries are on a sanction or pep list.
However, these screening systems produce a lot of false positives that must be dispositioned by a human reviewer, before the transaction can leave the gateway. Hopefully, AI can be trained, well enough, to eventually takeover much of the task of reviewing these false positives.
Artificial intelligence could not have came at a better time and you simply cannot afford not to experiment with it, especially for a under-resourced medium or small sized bank. AI and ML have game-changing potential through there ability to provide a means to scale and adapt to the modern threat of financial crime.
That said, artificial intelligence is not, and probably never can be, a substitute for human intelligence. In order to better explore and realize the potential of AI, banks must understand its limitations and risks as well as its capabilities. Essentially,
AI’s role is to support the non-automated and semi-automated tasks processing and investigating huge amounts of data that human beings simply cannot handle. In short, AI can and must help where there is lots of historical data, from which algorithms can learn, and the risk of making a mistake is small.
Risk Profiling
The current challenge is that these customer category do not consistently represent groups of entities with consistent transaction behaviour. As a result, when alerts are generated on good customers, financial institutions will need to decide on either tweaking the rule for the entire customer category or create a new customer sub-category. For this reason, many banks are working with over 200 sub-categories, literally losing the oversight.
Therefore, an area of promise for AI could be risk profiling and customer segmentation. AI analysed transactions, would place customers in more relevant risk segments based on their behaviour. For example, one customer segment could be entities that engage in large cross border wire credit transactions, have high-frequency counterparties, and a large number of unique originators.
If a customer executed transactions outside of the normal parameters for their segment, they would be subject to further analysis, including, potentially, investigations by humans. This would minimize the number of false positives while increasing the productivity and lowering the cost of compliance.
Humans on the other hand will need to step in where there is little information (or the information has already been sifted and condensed) but the risk of making a mistake is significant.
Here are the challenges to Artificial Intelligence and Machine Learning that nobody talks about:
Data access and labeling – ensure that you have access to robust data that is labeled properly to avoid “garbage in, garbage out,”
Explainability – regulators expect that you can describe how your ML model works. Otherwise, just a “black box”
IT infrastructure – needs to be able to maintain high availability in order to accommodate spikes in demand for the ML model.
Potential bias – the training data does not accurately represent the population or the training data is influenced by prejudice.
This means that while investigating how to deploy AI it is also vital to establish a system of governance and an ethical framework through which the development and use of AI can be governed. AI systems will need to be continuously assessed to determine the quality of their outcomes, and constantly improved if the financial services industry is to keep pace with the ever-changing nature of financial crime.
However, appealing that this technology might sound to the people watching the bottom-line. The reality is that AI systems require months of laborious training, as experts must feed vast quantities of well-structured data into the system for it to be able to draw meaningful conclusions and those conclusions are only based upon the data that it has been trained on.
In short, human learning is every bit as important as machine learning!
Maybe I am just getting old, but it came as a shock that Bitcoin has now been around for a decade. Yes, it was launched in January 2009. Early in its existence, financial authorities became concerned that, due to its semi-anonymous and decentralized nature, Bitcoin would become the currency of choice for money laundering and illegal weapons trade, financing of terrorism and drugs trafficking.
Yet it is only lately that governments and regulators have put in place systems and regulations to ensure that AML and KYC are applied to cryptocurrency accounts.
Try to get an answer to the question, “How many cryptocurrency users are there?” and you soon see why they have a problem on their hands. According to Bitcoin there are 7.1 million active bitcoin users. But a staggering 32 million bitcoin wallets had been set up by December 2018. Coinbase, the cryptocurrency exchange, has 13 million users. Last year, Ethereum claimed to have overtaken Bitcoin in terms of active users. And there are literally hundreds of other cryptocurrencies, with widely divergent business models. Moreover, users in emerging markets barely figure in the statistics and could run into millions.
The legal status of these currencies varies enormously from one regulatory regime to another, further confusing the issue.
Back in 2017 the European Union took limited measures requiring exchanges and wallet providers to carry out KYC and AML checks on customers and any beneficial owners, i.e. requiring them to collect, process and record personal data and to share these with public authorities. But the requirements only applied to exchanges that allow the exchange of cryptocurrencies against regular fiat currencies, effectively excluding many popular cryptocurrencies.
2018 then saw the release of the Fifth AML Directive in the EU, which created tougher regulatory obligations for crypto exchanges. The Financial Action Task Force (FATF) will also be releasing specific international AML standards for crypto companies later this year. Cryptocurrency companies will therefore need to become as serious about maintaining AML compliance as traditional banks.
Three camps
When it comes to regulatory compliance, the crypto world seems to fall into three camps.
It is inevitable that the more responsible crypto companies will welcome the regulatory embrace: they realize that regulations are necessary in order to keep expanding their market, and to protect reputation. These are the “must haves”.
At worst, criminal activity could bring the whole crypto market crashing down, so many other companies will understand that they cannot avoid regulations and will have to deal with them. This is the view of the “necessary evil” camp.
However, a significant number of crypto exchanges are doing everything in their power to avoid having to introduce KYC. Ethfinex’ Trustless DEX launched in September 2018 without KYC, insisting that it is impossible to obscure the source of a person’s funds: every transaction is visible and recorded forever on their blockchain. Hodl allows traders to swap cryptocurrencies without the need to undergo compliance. These companies form the “violation of privacy” camp.
And there is still a long way to go. A recent study by PAID discovered that even in the US and EU, two-thirds of cryptocurrency exchanges fail to comply with even the most basic KYC requirements. They ask for nothing more than an email address and a phone number, which means they know virtually nothing about their customers.
According to the most in-depth report so far, carried out by the Cambridge Centre for Alternative Finance in 2017, there is a huge divergence between the different types of wallet providers: “All wallets providing centralized national-to-cryptocurrency exchange services perform KYC and AML checks. The preferred KYC and AML methods are internal checks, which are in some cases complemented with traditional third-party KYC/AML service providers. Third-party blockchain analytics specialists are only used by 17% of wallets performing KYC/AML checks. All small wallets performing KYC/AML checks only do so internally.”
Cryptocurrencies will face similar challenges to banks
But for legal and regulatory reasons, crypto exchanges will be increasingly obliged to perform KYC, like it or not. In doing so they will soon run into the same problems and challenges faced by conventional financial institutions: long waits for clearance and an increasing number of time-consuming false positives.
Moving forward, if cryptocurrencies are to be adopted into the mainstream, both blockchain technology companies and crypto platforms will need to do a couple of things:
First, they must take a seat alongside the regulators in charge for a new solution.
Second, they need to get involved with multi-stakeholder use cases that examine the specific nature of anti-money laundering and other financial crime using cryptocurrencies. This will help build reputation and sideline the bad guys.
Third, they need to engage with consultants providing KYC/AML services and technology that meet their needs.
If they take these steps, the cryptocurrency exchanges can do a lot for their cause. The fact is, many traditional financial institutions use outdated technology to run their AML programmes, leading to high levels of false positives, which in turn causes friction during onboarding and payment processing and increases operational costs. The crypto exchanges can gain a competitive advantage by becoming early adopters of the latest automated technologies to transform their KYC and AML procedures.
Paul Hamilton
Go to the AML Knowledge Centre LinkedIn https://www.linkedin.com/groups/8196279/ to read more articles on AML and financial crime. Also, we look forward to your input!
We use cookies to optimize our website and our service.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
