Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the so-widgets-bundle domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/siorikco/public_html/wp-includes/functions.php on line 6170

Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the woocommerce domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/siorikco/public_html/wp-includes/functions.php on line 6170

Deprecated: Optional parameter $pattern declared before required parameter $function is implicitly treated as a required parameter in /home/siorikco/public_html/wp-content/plugins/wp-cerber-old/cerber-scanner.php on line 3450
Blog - Page 1730 of 1759 - Risk Management Never Been So Simplified
Home Blog Page 1730

Simplified Way of Understanding goAML: Problems in implementing goAML(part 2)

From the previous article, we have come to known that why different regulatory bodies want to implement goAML and why they are pushing different financial sectors to implement them. However, the problem occurs when the expectation of regulatory bodies does not match with the reality of financial institutions. We are going to share some problems that most financial institutions(FIs) may face at the time of implementing normal along with their solution.

  1. Gap Analysis:

In a simple sense, goAML is nothing more than reporting transactions online rather than manual reporting. The problem arises when organizations need to provide the information that they have never bother to collect from a customer or input into the core banking system. For instance, providing information about conductor details like name and phone number. That being said, your first objective here is to identify, what additional information is needed from the goAML perspective. In this sense, you need to first carry a gap analysis to identify what information you require for goAML.

2. Technical Feasibility

Now, let’s look at the second problem. To put it bluntly, we really don’t know how our Core Banking System(CBS) work. Most core banking systems are designed to carry out financial transactions only. However, many Fis try to customize CBS for KYC management, for which it was not built in the first place.

 CBS is a closed system and it should be a closed system. The vendor does not allow any customization in that system but they allow initially at the time of implementation even though, they know that it will bring complexities later. They do this because they need to sell their product.  CBS is a system that is composed of various modules where each module is responsible to handle various transactions and these modules are interrelated, therefore, if you make changes in the module it is going to affect others. Since, in the beginning, the organization is not carrying any transaction, so changes made will not have any significant effect, but later it might, hence, the vendor or your IT department may be reluctant for the change.

Therefore, a better method is to have a separate KYC system that is linked to CBS through API. There should be a separate database which will combine the information from both of these systems so that you can generate XML files for  GoAML reporting purpose.

3. Root Cause Analysis

Ok you have required fields in the CBS system will that be sufficient, well no, you need data, only then you will be able to succeed in goAML reporting. Again, who provides the data, customer of course but it should be inputted by your front line staff. If your front staff is not educated about this or unaware of the value of the data they will not be interested in putting data.

There are organizations that have large goAML screening teams of up to 20-30 staff whose main responsible to dump the goAML report from the system and check for incomplete and inconsistent data. This is a complete waste of time because you are not trying to fix the root problems. The main problem lies with your front line staff. If you are suffering from any instance of incomplete or inaccurate data then there is a problem with your front-line staff. It means either they are not educated or they don’t how to identify, collect, and input data from KYC documents or transaction vouchers into the system, and in some cases may be just negligent. Once you identify this problem, you need to solve these issues by providing them with rigorous training, developing different types of checklist regarding how to fill information in the system, or customizing the system itself to make it user friendly. Even after this, your staff makes mistakes then you need to set an example by taking disciplinary action, to give a message to other staff that you have adopted Zero Tolerance Policy for goAML.

4.Lack of clarity of scope.

Regarding goAML, there is always confusion regarding the scope of AML/CFT or Compliance department, Operation department, IT department.  From the GoAML perspective, you need to understand this clearly from the very beginning, as AML/CFT or Compliance department your role is to perform a gap analysis between the requirements of GoAML and  CBS to identify what additional information is required. You need to communicate these requirements to your IT  and Operation Department. IT department is solely responsible to handle technical parts like creating additional fields in the CBS or build separate systems if required. Now comes the role of the operation department, it needs to develop checklists, educate front line staff on how to carry out transactions, and inputting information in the system completely and accurately. AML/CFT or Compliance Department will play an oversight role to see if all the activities are being carried out to meet the GoAML goals if there is any deviation, corrective measures should be taken. Therefore, it is the utmost requirement that the AML/CFT or Compliance department will call meeting with these departments on a frequent basis to obtain the status of the progress.

However, this is a very ideal situation, the situation is aggravated when there is a lack of coordination exist between these departments and the blaming game starts. Every department has the excuse that they are unable to do so and so because other departments did not cooperate with them. Thus, although the individual department may win by playing this game, the whole organization will suffer.

[stextbox id=’alert’]ARE YOU PLANNING TO TAKE ANY PROFESSIONAL CERTIFICATION EXAM LIKE CAMS, CISA, CISSP, CER OR OTHERS, SOONER OR LATER. TO HELP YOU IN THIS JOURNEY, WE HAVE JUST A MOBILE APP FOR YOU, WITH TON OF FEATURES AND “ABSOLUTELY FREE”.ALSO, CHECKOUT OUR YOUTUBE VIDEO PRESENTATION FOR THIS APP WHICH ALSO INCLUDES GREAT TIPS ON PASSING THESE EXAMS. [/stextbox]

5. Lack of Top Management Commitment

This mostly happens when the vision of top management is myopic as some management are business motives so compliance may be of less priority. The goAML is usually carried as a national-level project by the government which is headed by the FIU of the country. FIU of the respective country usually forces compliance/AML-CFT staff of the organizations to carry out the goAML activities but if the top management is not motivated, they cannot do much. Therefore, FIUs should instead try to make top management aware of the consequences of not able to complete goAML project. It is of great importance that the tone from Top management should be set in such a way that, it must be clear throughout the organization that management is going to do whatever it takes to make the goAML project successful and any non-compliance will be severely dealt with.

if you are going to implement goAML in your organization, trust in this, it is going to be one hell of a ride. However, if you have gone through our article and training videos then we can assure you that your journey will be a comfortable one.

Thank you for your time. Please do like and share this article if you have found it useful.

ABOUT AUTHOR
Kiran Kumar Shah
https://learnwithsiorik.com/tutors/

AML/CFT Process Simplified:Understanding goAML(part 1)

If you are in the financial institution sector, you must have heard the term GoAML. This two-part article series will explain what is GoAML, why was it introduced, what are nuts and bolts behind it.

 What is goAML?

GoAML application is one of out of many solutions provided by UNODC to combat worldwide financial crime in the areas of money laundering and terrorism financing. It is the integrated database and highly intelligent system pioneered by Enterprise Application Center Vienna(EAC-VN).The Enterprise Application Center Vienna(EAC-VN) of the United Nations Office in Drugs and Crime(UNODC) specializes in the development, implementation and support of GoAML used by its Member states.The goAML application is available to Financial Intelligence Units of Member States as of March 2020, out of 111 Member FIUs, 49 have already deployed goAML.

FIU and goAML

As you all know that FIUs play vital role in preventing money laundering and terrorism financing. They do this by collecting, processing and analyzing suspicious activities report that they receive from financial institutions or other entities as per AML/CFT laws of the regime. GoAML will act as central repository to create database of reports on such SAR/STRs.Then after GoAML performs following functions

  1. Collection: It receives the SAR/STRs submitted by FIUs
  2. Analysis: FIU will then perform different types of analysis based on different scenario and carries out risk scoring and profiling.
  3. Data Sharing: The data is exchange between  FIU and regulatory bodies, intelligence agencies or international bodies on the basis of mutual agreement.

Demystifying goAML

The GoAML system has built in 14 separate functions into one software which includes data collection, data evaluation and clean up, ad-hoc queries and matching, statistical reporting on information/reports received and processed, structured analysis, account profiling, rule-based analysis, workflow management, task assignment and tracking, document management with full text search capacity, intelligence file development and management, data acquisition/integration from external sources, integrated charting and diagramming and an intelligence report writer tool.

Source; https://gocase.unodc.org/gocase/en/goaml.html

The goAML system is driven by a security model that specifies the kind of access rights each user has, and which provides an audit trail and log details for every transaction performed by all users. The goAML solution is well suited to both low and high data volume environments.

   GoAML stores following types of report received by FIU:

  1. Cash Transaction Reports (CTR).
  2. Suspicious Transaction Reports (STR).
  3. Unusual Transaction Reports (UTR): UTR relates to all unusual (cash) transactions that might be suspicious.
  4. International Funds Transfer (IFT): IFTs are the in which money is sent to from one country to another.
  5. Cross-Border Report: Transactions that involve sending or receiving money across borders.
  6. Additional Information File (AIF): AIFs are replies to requests for information when the analysts require more details on transactions, involved persons, accounts, or entities.

It also interesting to note that FIU of different countries has different level of maturity. The competency, availability of resources to one FIU may be different from other FIU in another country. FIU Information System Maturity Model (FISMM), developed by the Egmont Group of FIUs, is a comprehensive framework to enable FIUs of varied sizes and contexts to assess the maturity level of their processes and IT systems. Five types of FIUs (in terms of FIUs of sizes and contexts) have been identified:

  1. Small FIUs in fragile countries
  2. Small FIUs in stable countries
  3. Average FIUs
  4. Big Data FIUs
  5. FIUs supporting a distributed user community or distributed financial institutions

In line with this different architectures of GoAML has been develop to support different level of FIUs, they are also of five broad categories.

  1. goAML in the box for small FIUs in fragile states;
  2. goAML SE for small FIUs in stable countries;
  3. goAML SE – goINTEL for average FIUs;
  4. goAML EE for big data FIUs; and
  5. goAML D for FIUs with distributed user community and/or distributed financial institutions (with commercial/financial free zones)

The main purpose of GoAML is to:

  • Facilitate various countries in meeting international standards through creation of  effective Financial Intelligence Units (FIUs)
  • Develop standard global anti-money laundering platform
  • Create customize system to meet  needs of any type of FIU
  • Become User Friendly by providing standard graphical user interface
  • Develop more user base.
  • Promote good relationship with many international and regional institutions

Technicality:

So in simple words, goAML is online reporting of your regulatory reports mainly TTR and STR. This is done via XML file. You will have AML solution system which will generate transaction reports that are in the XML format and the same XML file will be uploaded. For those who are not aware of XML, let’s dig it little deeper.

XML is short form of eXtensible markup Language and it was designed to store and transport data. It does not do anything, it is information wrapped in the tags. For example:

<email>

<to> Mr.Bond</to>

<from>Dr.No</from>

<heading>Spectre</heading>

<body>No on Lives Twice!</body>

</email>

The above tags are not defined in the XML, they are invented by author(Dr.No in this case) to carry information from one system to another. These tags in XML file as a whole refers to element. These element can contain text, attributes, other elements. In this case<email> is element which contains text tags like <to>,<from>,<heading>,<body> and it contains text information.XML stores the data in plain text format so exchanging between different system is simplified.

XML Schema

For every XML file there should be XML schema, For the above XML file , the following is the XML schema.

  • <xs:element name=”email”> defines the element called “email”
  • <xs:complexType> the “email” element is a complex type because it includes other types of elements/text within its tag.
  • <xs:sequence> the complex type is a sequence of elements i.e different tags
  • <xs:element name=”to” type=”xs:string”> the element “to” is of type string (text)
  • <xs:element name=”from” type=”xs:string”> the element “from” is of type string
  • <xs:element name=”heading” type=”xs:string”> the element “heading” is of type string
  • <xs:element name=”body” type=”xs:string”> the element “body” is of type string

Therefore, XML schema is a syntax for XML file. For e.g, in <body> tag, if you supply numerical input, then your XML file will not be validated because <body> tag only accepts data in string/text format. So, if there are data error in your XML file then your XML file will not be validated because it will inconsistent with XML schema.

Validating XML file

  1. Regulator Site:

Most probably your regulator will have provided the site in which you can validate your XML file for any errors. You need to copy/paste your XML file and click on submit/validate button to check XML file for any errors.

2. Online Site:

There are various online sites that provide the same facility as your regulator site. Here, they have option to upload XML schema file in one section and copy paste XML file in another section. Then you can validate those files. However, caution is required here, since the you are trusting your confidential data to unrelated third party, so confidentiality of the data may not be guaranteed.

3. Plugins

If you are using Notepad++ or other software for editing XML files then you have option to install plugins to upload XML schema file for validating your XML files.

However, with all the above options, there is one flaw. These options are only suitable if you are trying to validate XML files one at a time. Remember, you may have hundred of XML files for TTR and STRs reports. It will be time consuming to validate each XML files one at a time. Therefore, you may need to contact Vendors who can provide you with bulk validation of XML files.

4. SIORIK goAML Bulk Validator:

We have also launched a product called SIORIK goAML bulk validator, the main feature of this product is that you upload the whole  folder of XML files and verify it against the XML schema. Further, if you are involved in Nepalese Banking and the financial institution, we have good news, with the purchase of this Bulk Validator, we will provide you with customized XML schema which is an improved version of XML schema provided by FIU. It detects inconsistencies like a missing source of fund, permanent address as well as whether the PAN is in numerical format or not. If you want, you can purchase this product by clicking here. The following video shows the demonstration of this product.

In the next article, series we will discuss, what problem do usually financial institutions face while implementing goAML in their organization.

Thank you for reading. Please like and share this article, if you have found this article useful.

[stextbox id=’alert’]ARE YOU PLANNING TO TAKE ANY PROFESSIONAL CERTIFICATION EXAM LIKE CAMS, CISA, CISSP, CER OR OTHERS, SOONER OR LATER. TO HELP YOU IN THIS JOURNEY, WE HAVE JUST A MOBILE APP FOR YOU, WITH TON OF FEATURES AND “ABSOLUTELY FREE”.ALSO, CHECKOUT OUR YOUTUBE VIDEO PRESENTATION FOR THIS APP WHICH ALSO INCLUDES GREAT TIPS ON PASSING THESE EXAMS. [/stextbox]

Next Article: Problems on Implementing goAML

AML/CFT Process Simplified: AML/CFT Procedures (Part 4)

If you are following my articles series , you must by now have  known the difference between the AML/CFT policy and AML/CFT procedures. If you have missed out any of them please go through them by following this link:

AML/CFT policy is brief introduction of all control measures that you are going to apply in your organization, let’s say, in the policy you give information about different types of customer due diligence: Standard and Enhanced, while in Manual  you are going to explain the detail procedures of Standard and Enhanced Customer Due Diligence. You will also draft the format/forms/checklists so that it will be easy for users to complete those Due Diligence to ensure uniform practice in whole organization.

The AML/CFT Manual shows the technique by which AML/CFT policy may be implemented. It’s detail explanation of the policy, that is why some organization may include AML/CFT policy and manual in the same documents, however doing so may lead to creation of bulky document and employees may feel reluctant to go through this document. Therefore, having separate documents as policy and manual means that it would be helpful for the staff who want to know about AML/CFT concepts, can refer the policy while for users who want to know about detail AML/CFT procedures, they can go through the manual.

The organization may want to incorporate the following clauses while drafting AML/CFT Manual/Procedures:

  • Customer Identification Procedures: Here you should provide detailed procedures for obtaining, verifying information submitted by the customers. This section may also include how risk profiling of the customer should be done.
  • Customer Acceptance: This section list types of the customers that is acceptable to the organization to do business and what type of customers should be avoided. For e.g., shell companies.
  • Verification Timing: This section includes situations regarding when the customer KYC information should be sought like before carrying out wire transfer and so on.
  • Procedure for Pending Accounts: If your organization allows to open pending accounts, you need to describe the conditions in which pending account should be opened and for how long. Does any approval need  to be taken, what exhibit should be prepared and so on.
  • Politically Exposed Persons, Beneficial Owner, Adverse Media: This section is important as well as challenging to write. You should have clear mechanism to state out how individual staff could identify PEP or Hidden Beneficial Owner. Do you have any automatic system placed for customer screening. What to do if customer is identified as PEP or Hidden Beneficial Owner. How should relationship be established with them. Should they be classified as High Risk? These questions should be clearly answered in this section.The next challenge is Adverse Media. Most of Screening System will show you the names matched in Adverse News, but to verify the customer with that name is challenge because of lack of information . There should be detail procedures to verify such names so that there is no confusion among staffs.

[stextbox id=’alert’]BOOK LIVE CLASS FOR PREPARING
CAMS EXAM. CLICK HERE TO
MAKE INQUIRY!!!
[/stextbox]

Transaction Monitoring: You need to explain whether you have manual or automatic system for transaction monitoring.

Customer Due Diligence: This section details out procedures for customer due diligence based on different risk profile of the customer. The universal practice is to perform standard due diligence for low risk and medium risk customer and enhanced due diligence for high risk customers. Standard Due Diligence may be limited to obtaining identification documents from customers. Meanwhile, Enhanced Customer Due Diligence will include additional information like obtaining identification details of relatives of customer, supporting document for the sources of income. This section may indicate checklists/forms developed to carry these CDD, whose formats are usually kept in Appendix part.

  • Reviewing of KYC: You need to include when should KYC of different risk profile of the customers should be updated. For high risk customer it may be annually while for others it may be longer. It should also include what type of information should be collected from customers at the time of review. (Note:You may not want to update permanent nature of documents like citizenship.)
  • Walk-In-Customers: You may want to include provision on how to deal with walk-in-customers like obtaining KYC documents when that customer wants to initiate a transaction beyond certain threshold.
  • Customer Screening:  Whether you have manual or automated system for customer screening, you need mention clear procedures for that.
  •  Reporting: In this section , you need to describe what type of reporting is being done to your regulatory bodies, it may be TTR , STR or other reports. But keep in mind to exclude the exact provisions/clause mentioned in AML/CFT Laws and Regulations as they are subject to change with changes in regulatory environment .  However, you may want to include the provisions that may remain same for longer period of time in like red flags to identify suspicious activities.
  • Wire Transfer: Here you should include what the information is required to transfer any wire messages, further what information should be verified at the time of accepting wire transfer. Also you need to mention, what should be done if any discrepancies were observed. If you have mechanism for monitoring wire transfer for the purpose of verification of source of fund and purpose of fund, that should be mentioned here.
  • Correspondent Banking: This section should included how organization is going to establish correspondent banking relationship, what information should it verify, who have authority to approve correspondent banking relationship.
  • Know Your Employee: This should include the detail procedure regarding what information should be collected for doing Due Diligence of employee before hiring them like performing background screening, checking with references.
  • Know Your Agent: Same as above you need to mention what are steps that organization should take before and after assigning task to a agent. Organization may hire agent for various purposes like for remittance, marketing, updating KYC and so on.
  • New Technology: As ML/FT risk may arise due to introduction of new product and services, therefore there should be a mechanism where introduction of any new product should be reviewed by the AML/CFT department for any ML/TF risk.
  • Miscellaneous: You may include other sections as you deem fit like Awareness and Training Program,  penalties, relationship with  other department’s policies and so on.
  • Annexes: This section includes the list for formats, checklist that you have developed for implementation AML/CFT policy and procedures.

These are component that may be included in AML/CFT Manual. Point to remember here is that, it is not by far exhaustive list but can be integral part of Manual.

4. AML/CFT Risk Assessment Framework:

If you are following me from my first article series, then you should already know that risk assessment is basis for the formulation of any kind of AML/CFT policies. Therefore, organization may want to formalize this risk based approach as a policy . The detail guideline for the risk assessment is given in following article, you can take the basis of this article to write you own risk assessment framework.

Policy and manual development life cycle can be divided into two parts:

  1. Policy and Manual Development
  2. Implementation of Policy and Manual

We have completed the 50% task of development of policy and manual, now in the next article series, we will discuss how we are going to implement them.

Next Article: On Developing AML/CFT Organization Structure

ABOUT AUTHOR
Kiran Kumar Shah
https://learnwithsiorik.com/tutors/

AML/CFT Process Simplified: Anti-Bribery Policy and AML/CFT Policy. (Part 3)

Welcome to part 3 of our article series which is all about creating policies and procedures regarding AML/CFT. Once you have done a risk assessment of your organization and identified the various risks that are present in your organization, it is time for risk mitigation that is to implement different control measures to reduce the risk.

If it is sounding quite confusing then you may want to revisit our previous articles by following the link given below.

Click here to go to the previous article.

The control measures are usually two types: Manual and Technical.

Manual Control:

The manual controls are the policies, procedures, checklists, forms that are mainly targeted to guide human behavior. They simply convey information regarding what employees are allowed to do and how should they do it to ensure consistent results are always achieved. For e.g, the KYC checklist ensures that the Customer Service Staff collects all the necessary information and documents at the time of customer on-boarding.

Technical Control:

The technical control is used when human intervention is not possible, for instance, it is difficult for the users to look at every transaction of all customers manually, to search for suspicious transactions. Therefore, we need some kind of automated solution for monitoring transactions on the basis of some scenarios. Another example is, there are lots of sanction lists published by different international and government bodies like the UN sanction list, EU, HMT, OFAC, US, and so on. It is difficult to screen customers by going through each list one by one. Hence, we need an automated solution that will combine these sanction lists and perform customer screening against them.

Whatever the controls may be, either technical or manual you need to include them in policies. We are going to talk about following policies and procedure that are related to AML/CFT area and what provisions should it include to ensure that various risk relating to AML/CFT is mitigated.

  1. Anti –Bribery and Corruption Policy
  2. AML/CFT Policy
  3. AML/CFT Guideline
  4. AML/CFT Risk Assessment Framework
  1. Anti-Bribery and Corruption(ABC) Policy:

Although this is not directly related to AML/CFT, if you look at overall banking practices all over the world, it usually comes under the domain of AML/CFT. It can also be seen from the fact that many corresponding bank questionnaires include question-related ABC practices in the organization. The main objective of ABC  is to prevent fraud and corruption from the employees within the organization but may be extended to external parties depending upon the nature of the organization as well as the legal framework in which the organization operates.

In general, ABC should include the following section, however, the main thing to remember here is, it is not in any way an exhaustive list, the content may be added or removed as per the organization’s need.

Major Highlights of Anti-Bribery and Corruption Policy.

  • Introduction/objective: This usually includes a statement like “To promote a culture of ethical business practices and compliance with ABC requirements of the organization by providing guidance to all employees to prevent bribery and corruption in the bank.”
  • Scope:  This section includes to whom this policy is applicable, what type of transactions it covers, is it a separate policy or an integral part of another policy.
  • Key Definitions: The major definition of terms like corruption, bribery, and others.
  • Duties and Responsibilities: of different parties who have a direct impact on this policy.
  • Mechanism of Bribery and corruption prevention: A risk-based approach should be applied to identify those areas in the organization which is susceptible to bribery corruption. They are usually following areas:
  1.  General Logistic: This is most vulnerable to bribery and corruption, as this department usually purchases in high volume or high priced goods for the organization. There are always chances that the vendor may try to influence organization officials with various kickbacks to sell their products.
  2. Books and Records: Usually Staff who may be involved in stealing organization assets may try to hide such an offense by manipulating books. Some time, top-level management try to window dressing their financial statements to show either good or bad result to pull the wool over regulators or shareholder eyes.
  3. Gifts and Business Hospitality: It may be a normal practice where employees receive gifts of some kind from different customers during various occasions especially during the festive season. However, the line should be drawn when that gift and hospitality become excess to influence the individual staff’s decision. The best practice is to determine the threshold of gifts, beyond which approval should be taken.
  4. Others if required.
  • Whistle Blowing: This section should list down the red flags regarding bribery and corruption which should be informed by staff to appropriate authority if observed. Whistleblowing is an important part of the anti-bribery corruption policy. This is because the major source of information for bribery and corruption happening in the organization is from the staff itself because bribery and corruption are intentional acts and perpetrators will go to great lengths to hide his/her criminal act. However, the perpetrator’s colleague will know him/her better than others and can detect anomalies in his/her behavior. Besides this, a whistleblower should be protected via anonymous reporting, identity should be made confidential. However, reporting should be made in good faith to protect the interest of the organization. There always seems to confusion between whistleblowing and breach of confidentiality. If the staff leak any confidential information of the organization in an unauthorized manner then that staff will be penalized under breach of confidentiality. Therefore, breach of confidentiality is a punishable offense while whistleblowing is encouraged.
  • Investigation: The responsible party to investigate bribery and corruption-related activities should be determined. This party will make on-site visits, collect documents, make queries, interview related parties, and prepare a report for submitting to the management. This party will only recommend what actions to be opt-in in this case. The final decision to take action will always rest with the management. Also, a mechanism should be developed so that fraud cases are reported to BOD.
  • Training: Enterprise-wide training should be conducted to ensure that every staff member is aware and has understood that policy. The further policy should be kept in the intranet, share drive where this policy can be easily accessed.
  • Monitoring: Audit Department or any other department should ensure whether the policy has been compiled within the organization or not. Further, they should also review the policy to identify any loopholes within that policy and suggest for improvement.

AML/CFT Policy:

Let us dig into the major factor that governs the AML/CFT regime of an organization that is AML/CFT policy. How effective is your AML/CFT regime depends upon how comprehensive is your AML/CFT policy. AML/CFT policy usually is prepared to include brief information regarding the control measures and they are not very long, merely about 20-40 pages. An organization willing to draft AML/CFT policy may want to include the following components.

  1. Key Concepts: Definition of key concepts or technical jargon that are frequently used in policy and manual which may be otherwise difficult to understand.
  2. Scope, Need, and Objectives: Every policy should have these components. The major objectives of the policy are to provide a guideline for the functioning of the AML/CFT Department, carry out AML/CFT program, defining the roles and responsibilities of every staff and department who have a stake in the AML/CFT interest of the organization.
  3. Concept of Money Laundering and Terrorism Financing: This section should give a brief introduction to money laundering and terrorism financing. What are the key differences between them including how these offenses are carried, also, general methods to prevent them?
  4. Legal and Regulatory Framework: In order for the policy to be valid, it should be made according to Anti-Money Laundering rules and regulations enacted by the country.
  5. Risk: This section should detail the various risks to the organization because of the inability to implement the policy. For e.g., the organization has to pay fines which is both legal and financial risk which may lead to reputation risk if it is widely publicized in the media.
  6. Risk-Based Approach: Every organization should have identified the areas that are more vulnerable to ML/FT. As per best practices, there are four risk factors, they are as follows:

[stextbox id=’alert’]BOOK LIVE CLASS FOR PREPARING CAMS EXAM. CLICK HERE TO MAKE INQUIRY!!! [/stextbox]

  • Product and services that any organization offer to its customers.
  • Geography location of any customer.
  • Different customer types that the organization provides services to.
  • Transaction and Delivery channels.
  1. Customer Acceptance, Customer Termination, Transaction Monitoring: Different subsections may be written to include procedures for Customer Acceptance, Customer Relationship Termination. Further, how should transaction monitoring be carried out? The brief introduction of process of transaction monitoring that may be either automatic or manual screening. In addition to this, the organization may give an introduction regarding what type of reporting that the organization needs to do to its regulators like TTR and STR.
  2. Trade-Related: Brief Introduction regarding Trade-based money laundering and wire transfer, correspondent relationships should be given that are susceptible to money laundering.
  3. Know your employee: This is another main section of the policy, as an organization put more effort into knowing their customer, they tend to forget to focus the devil within. If the organization hires corrupt staff then these staff may lead to loss which may be higher than loss due to customers, because staff usually enjoy various privileges and have access to different sensitive areas of the organization. Therefore, an organization should have a clear recruitment process with proper background checks, reference checking, and so on.
  4. Know your Agent: The organization may choose to outsource various functions like Remittance, marketing, to various third parties. Even though they have delegated their responsibility to these third parties, they still need to be accountable for their actions. Further, it is not necessary for the outsourcing agency will perform the same level of Customer Due Diligence as a bank. Therefore, the proper control of the agent is necessary.
  5. Tipping Off: There should be a separate section about tipping off, what does it mean and what actions will be taken against the staff who are involved in tipping off.
  6. Roles and Responsibilities: There may be a section to include the roles and responsibilities of different parties involved in AML/CFT like the roles of AML/CFT Head, Anti-Money Laundering Committee Unit, and other department heads.
  7. Training: There should be a section regarding training. It should include whom to train when to train, how to train.
  8. Penalty and Violation: No policy is complete with the Penalty and Violation Section that is, every staff should be made aware of what actions will be taken against him/her if there is a breach of that policy. Also, if there are regulatory sanctions, you need to mention it here. This can be a deterrent factor to ensure staff will comply with the policy.
  9. Other Miscellaneous matter

Thank you for reading. In the next lecture, I will talk in great detail about AML/CFT procedures/Manual.

Next: Developing AML/CFT procedures.

Citizenship trade inside the EU: Sovereignty rights need to be realigned

0

Small EU states regularly sell ‘golden passports’ to high net worth individuals, and these citizens thus earn the right to live and work anywhere in the EU. By imagining member states as private clubs and the EU as a meta-club, this column presents a model of…
Read More

PayPal thinks it has the answer for small business lending in Australia

0

PayPal has provided AU$500 million to 7,000 businesses in Australia since it launched a working capital offering less than five years ago alongside Citi.
“We can see that there is an ongoing demand for alternative finance solutions to support small businesse…
Read More

AML/CFT Process Simplified: Risk Assessment with Practical Example.(Part 2)

As mentioned in the previous article series, we are going to look at the practical example of the risk assessment through the application of Microsoft Power BI. We have also made a video tutorial for this that can be found at the end of this article. However, we suggest you go to this article first and then refer to the video tutorial.

Go to the previous article in this series

For this article,  we have taken a Bank as an example organization. However, please keep in mind that this risk assessment concept can be applied to any organization.

Risk Identification:

The first component of Risk management is risk identification where we need to identify different risk factors that are present within the bank along with its respective components. Further these components should be given appropriate risk grading along with their risk weights to perform quantitative risk analysis.

Let us first look at our data:

Power BI Risk Assessmen
Fig 1: Overall Data

In this table,  we have assumed that customer opts for only one product and services. The country to which customer belongs is mentioned here. Customer nature is also given. Finally, there are 3 types of transactions that each customer usually performs in his/her account. In this data, we have successfully incorporated 4 risk factors for the AML/CFT risk assessment purposes: Customer Nature, Geographical Location, Product and Services, and Delivery Channel/Transaction Delivery.

Following are tables representing each risk factors:

PowerBI 2 Risk Analysis
Fig 2: Identification of Risk Factors along with its components

You can see from the above figure, we have identified all the components included in each risk factor along with their risk grading and risk weight. The detailed theory of the risk assessment is given in my previous article.

The following figure shows the risk weight of each risk category: High, Medium and Low

Risk Assessment:

Power BI Risk Analysis
Fig 3: Graphical Presentation of Risk Factors

This is called the power view window in Microsoft Power BI. You can see that in the above figure, we have used Customer Number as metric for each risk factor and its individual components, “Count of Customer ID” column include the number of customers for each risk factor’s components. For e.g., there are 3 Casinos customers(Customer Nature), 192 customers are from India(Geography), 422 customer use Bank Guarantee product(Product and Services and 531 customer uses Internet Banking(Transaction Channel).

The main advantage of Power BI is that it shows the interlink between various components. In the pie chart at the lower corner of the figure, you can see that customer who are risk graded as “Medium” is substantial than others.

Power BI Risk Analysis
Fig 4: Position of Power View after clicking Medium Segment

If we click at the medium segment, the whole view of Power BI is altered. You compare this figure with the above to see the difference, for instance, you can see the number of medium customers is 3126 for all risk factors, as seen in the Total field. In the world map chart, you can see the location of medium risk customers

[stextbox id=’alert’]BOOK LIVE CLASS FOR PREPARING CAMS EXAM. CLICK HERE TO MAKE INQUIRY!!! [/stextbox]

 

You may be thinking that’s good, but maybe wondering, can all these risk factors can be combined into one so that I can see my overall risk of this organization. Yes, this can be done, please look at the below picture:

Power Bi Risk Analysis
Fig 5: Overall Risk Assessment

This is the next power view window where we have clicked on the high-risk segments (blue part in the chart). This will give you information about the high-risk profile in your organization. For e.g., In the highlighted section, it can be seen that bank is giving services to customers like Jewelry dealers, large taxpayers, money transfer agencies who are from IRAN which is the high-risk country to whom it is providing various high-risk products and services like bank guarantees, swift and these customers are carrying different types of transactions like issuing drafts, wire transfer which is the high-risk medium of doing transaction. All these components are high-risk components.

Now, it is time to perform risk calculations:

Power BI Risk Analysis
Fig 6: Risk Value of All Risk Factors

In the above figure, we can see each risk factor including its components with the number of customers by each component along with appropriate risk weight. Now, we need to perform Risk Calculation using various variables, so, we will leave Power BI, say hello to our old friend, Excel.

Risk Calculation

Risk Factors No of Customer Risk Score Total Risk Value
Customer Nature 4240 47           199,280
Geography 4240 50           212,000
Product and Services 4240 18             76,320
Transaction Delivery Channels 4240 13             55,120
                542,720

In the above table, the number of customers for each risk factor is the same which is when multiplied by their respective risk score gives the total risk value. As can be seen from the table, the risk value from the transaction delivery channel is low while the geography is high.

Risk Mitigation

In order for the risk mitigation we need to look at different control measures that are available in our organization to cope with risk.

Control Measures Implementation Status Mentioned in Policy Risk Factors Control Strength
New Products Review from the Compliance Department Not  done Yes Product 20%
Customer Screening Done Yes Geography/Customer Nature 90%
Wire Transfer Monitoring Not done Yes Geography 20%
Transaction Monitoring/STR Reporting Done Yes Transaction Delivery 80%
 KYC/CDD 40% still remains Yes Customer Nature 60%

Let us say, we have 5 types of controls in our organization, lets check their implementation status and their inclusion in our AML/CFT policy to determine their relative strength. For eg, for “New Products Review from Compliance” meaning that before all new products are launched by the organization, they need to be reviewed by the AML/CFT department for AML/CFT risk. However, even though this provision is mentioned in the policy, it is not actually implemented. But, there is still a possibility that it will be implemented in the future since, it is mentioned in the policy. Hence, control strength is 20%. Further, this control is directly applicable to mitigate product risk.

Similarly, the implementation status of KYC/CDD is 40% which means that KYC of 60% of customer accounts is only updated and it is directly applicable to mitigate risk from customer nature. In addition, customer nature risk also mitigated by customer screening, so we take the average of control strength of these two controls which brings to the value of 75%.

Residual Risk

Risk Factors No of Customer Risk Score Total Risk Value Control Strength Residual risk %=Residual risk/ Total risk
Customer Nature 4240 47           199,280 75%                49,820.00 9.18%
Geography 4240 50           212,000 55%                95,400.00 17.58%
Product and Services 4240 18             76,320 20%                61,056.00 11.25%
Transaction Delivery Channels 4240 13             55,120 80%                11,024.00 2.03%
                542,720      

The residual risk is derived after deducting control strength from total risk. From the above table, the risk from customer nature was 199,280, since the control strength is 75%, the residual risk will be 25%, hence, it is 49,820. Now, we can determine the residual risk rating based on the total risk of the organization. Please note that the residual risk rating is given by the following:

Residual Risk Rating(%) = Residual Risk/Total Risk

We have assumed the following  3 tier rating scale of Residual Risk  as follows:

Inherent Risks Controls Strength Residual Risks Residual Risk Rating
High 80%-100% Low 0%-20%
20%-80% Medium 20%-80%
0%-20 High 80%-100%
Medium 80%-100% Low 0%-20%
20%-80% Medium 20%-80%
0%-20 High 80%-100%
Low 80%-100% Low 0%-20%
20%-80% Medium 20%-80%
0%-20 High 80%-100%

Now, we can safely assume that after applying all the necessary controls, we have successfully brought down the AML/CFT risk to a low level.  However, there are still areas of improvement in the control measures. You still need to implement those controls which are merely mentioned in the policy  and new controls may need to be sought out with the changes in AML/CFT environment.

Final words,

Risk Assessment is not an exact science but both science and art. As you can see that we have made a lot of assumptions here. These assumptions are based on current and past trends, organization nature, size, and other factors.

Thank you for your time.

Further, if you have found this article useful, please do share and subscribe.

 

Next: Guidenline to Develop Anti-Bribery Corruption Policy and AML/CFT Policy

 

At USD 83.5 bn, India has 3rd highest trade-related illicit financial flow globally: Report

0

NEW DELHI: India has the third-highest trade-related illicit financial flow among over 135 countries with a whopping USD 83.5 billion escaping the government’s tax net owing to trade-based money laundering tactics, according to a report released on Tuesday by…
Read More

At $83.5 bn, India has 3rd highest trade-related illicit financial flow globally: Global Financial Integrity report

0

India has the third-highest trade-related illicit financial flow among over 135 countries with a whopping USD 83.5 billion escaping the government’s tax net owing to trade-based money laundering tactics, according to a report released by US-based think tank G…
Read More

At $84 bn, India has 3rd highest illicit financial flow after China, Mexico

0

India has the third-highest trade-related illicit financial flow among over 135 countries with a whopping $83.5 billion escaping the government’s tax net owing to trade-based money laundering tactics, according to a report released on Tuesday by US-based thin…
Read More