Risk-Based Approach in Anti-Money Laundering

Risk-based approach in anti-money laundering (AML) and combating the financing of terrorism (CFT) involves an understanding of geography and country risk, business and entity risk, and product (and linked distribution channel) and transaction risk.

Effective and efficent risk-based approach in anti-money laundering (AML) and combating the financing of terrorism (CFT) implies the adoption of a risk management process for dealing with money laundering and terrorist financing. This process encompasses recognising the existence of the risk(s), undertaking an assessment of the risk(s) and developing strategies to manage and mitigate the identified risks.



Risk Based Approach: Top Down Approach

1. Geography and Country Risk
2. Business and Entity Risk
3. Product and Transaction Risk

Financial institutions need to take a systematic approach to risk that covers all three bases rather than just one or the other. These risk models are then applied to due diligence activities at account opening and the ongoing monitoring process including enhanced due diligence (EDD).

1. Geography and Country Risk

Firms that have a significant proportion of their customer base located in countries without adequate AML strategies where;

1. Cash is the normal medium of exchange;
2. There is a politically unstable regime with high levels of public or private sector corruption; that are known to be drug producing or drug transit countries; or have been classified as countries with inadequacies in their AML strategies will need to consider what additional "know your customer" (KYC) and monitoring procedures might be necessary to manage the enhanced risks of moneylaundering.
3. In particular, additional monitoring of inward payments from countries without equivalent AML strategies should be considered.

2. Business and Entity Risk

The characteristics that make businesses high risk vary. Casinos, gaming, brokers-dealers for example, are popular money laundering targets because a mature AML culture is yet to develop in these businesses. Such businesses with a high volume of cash activity need to be watched carefully.

Offshore banks provide financial services that are conducted behind the shield of strict banking and corporate secrecy laws.

Professionals facilitate the creation of laundering vehicles and schemes including real estate linked.

Car, boat and airplane dealers, as well as jewel, gem and precious metal dealers, provide launderers access to 'big ticket items', which often can be purchased with little or no customer identification and later sold to provide a 'legitimate' source of cash proceeds.

Import and export companies provide cover for international money laundering operations through false trade pricing schemes.

Cash intensive businesses allow launderers to disguise cash derived from illegal activities in deposits containing cash derived from regular, legitimate business activity.

The above list is by no means comprehensive. Other sources of negative information include media searches and/or KYC databases such as IntegraScreen Online, World-Check etc.

3. Product and Transaction Risk

Products or services with the highest risk are those where unlimited third party funds can be
freely received, or where funds can regularly be paid to third parties, without evidence of identity of the third parties being taken.

The product or services could support high-speed movement of funds or along with a high volume of transactions, or both, and could conceal the source of those funds. It may facilitate a higher degree of anonymity, or involve the handling of high volumes of currency or currency equivalents. It could allow a customer to readily convert cash to a monetary instrument.

Some of the highest-risk products are those offering money transfer facilities though chequebooks, monetary instruments, drafts, telegraphic transfers, SWIFT, CHAPS, automated clearing house (ACH), deposits from third parties or other means, electronic cash (e.g., stored value and payroll cards), payable upon proper identification (PUPID) transactions, third-party payment processors, automated teller machines (ATMs), and electronic banking.

Corporate and private current accounts fall within this category because unlimited third party funds are continually received for credit to the account and it would be impractical to identity all providers of such funds. Private banking – both domestic and international - can be particularly vulnerable just as trust and asset management services, is.

Similarly, other products and services that constitute high-risk include:

1. Foreign correspondent accounts – pouch activity, payable through accounts, and money drafts.
2. International trade finance (letters of credit).
3. Special use or concentration accounts.
4. Lending activities, particularly loans to small and medium enterprises secured by
   cash collateral, marketable securities; and credit card lending.
5. Nondeposit account services (e.g., nondeposit investment products, insurance and safe deposit boxes).
6. Risks increase if the money launderer can hide behind corporate structures such as private limited companies, offshore trusts, special purpose vehicles and nominee arrangements that increase anonymity. Company formation agents offer nominee director, shareholder and authorized signatory services.
7. Offshore shell company ownership by another offshore bearer share company is a favourite.
8. Another favourite is where assets are conveyed to an offshore company 100% of whose shares are held by an offshore Asset Protection Trust which has as its sole beneficiary a second trust – this is called a Layered Trust structure. Hence, understanding the ownership and control structure for companies and trusts is critical.
9. When devising their internal procedures, firms should consider how their customer base and operational systems impact upon their staff's capacity to identify suspicious transactions.

Some of the lowest risk products are those where funds can only be received from a named investor by way of payment from an account held in the investor's name and where the funds can only be returned to the named investor. No third party funding or payments are possible and, therefore, the beneficial owner of the funds deposited or invested is always the same.

The FATF 2002 consultation report on the 40 principles, the Wolfsberg group of banks pointed out that certain transactions or activities have a minimal risk of money laundering or terrorist financing. They give some examples as follow:

1. Transactions where a financial is acting as a principal rather than on behalf of third parties
   (such as foreign exchange, derivatives, capital market transactions and some extensions of credit);
2. Accounts established for a specific purpose with funds received or disbursed under
   limited defined circumstances to identified third-parties, such as escrow, corporate trusts, paying agency and custody accounts;
3. Accounts for the investment of funds that are subject to a regulatory scheme, such as investment of funds of regulated pension or retirement plans; and
4. Accounts held by other financial institutions that are themselves subject to a robust AML
   regime.
5. Customer categories where the risk of money laundering or terrorist financing is lower.
6. Generally large public listed companies subject to regulatory disclosure requirements are regarded as lower risk than unlisted companies.
7. Government administrations or enterprises are also potentially lower risk.
8. Pooled accounts held by designated non-financial businesses or professions regulated to FATF standards may also be lower risk.

Bank staff should be well versed with the products and services that have been categorised as high-risk by the industry bodies or by the regulators.

Bank staff should question themselves whether the nature of the client's account or business justifies the products or services the client is asking for. It is important to consider all dimensions of money laundering risk when assessing an account opening or a transaction.

Case Study:

Mr B is the Managing Director of an offshore company incorporated in country A in June 2000. He seeks to open an account for moving his business from another bank that he claims is providing bad service. Mr B wants to set up a trade financing line to import microprocessors from the US for his computer business. He provides details of the Letter of Credit to be set-up that he says would be fully secured with cash assets.

1. Geography and Country:

• Country A is in the Caribbean, which is a hot-bed for laundering drug money coming out of the US both directly and indirectly.
• You are aware that the country A was removed from the FATF black list in June 2001 but your AML officer advises that regimes that are removed from the FATF black list may also be vulnerable for historical reasons.
• Furthermore, Country A was involved in recent high-profile corporate scams, increasing the discomfort.

2. Business and Entity:

• You are aware that import-export businesses are a key high-risk business for money laundering.
• You further do a search on your PEP commercial database that shows a match. Mr B is a distant relative of a key politician in a country known for corruption. Mr B concealed this fact.
• Mr B is unable to provide an introduction to facilitate account opening and can only provide identification documentation. Given the risks, you feel uncomfortable with this fact.

3. Product and Transaction:

• You know that over-valued imports are a mechanism for laundering money. From your Internet Research you note that the price is higher by 30 percent from various online quotes for the same quantity and brand.
• His offer of full security also raises discomfort for in your experience, customers do not do so easily.
• Also, why is he not using a local supplier for microprocessors? All the other computer assemblers who have accounts with your bank, source such parts locally as all the major manufacturers have local suppliers in the country.

RED FLAG LISTS: EXPORT TRANSACTIONS

Red Flag Indicators in Export Transactions  "When Exporting, You Must "Know Your Customer"

Use this as a check list to discover possible violations of the Export Administration Regulations. You may also wish to visit WEB page that provides "Know Your Customer Guidance".

13 Red Flag Indicators for Export Transactions as follows:

1. The customer or its address is similar to one of the parties found on the Commerce Department’s [BIS's] list of denied persons.
2. The customer or purchasing agent is reluctant to offer information about the end-use of the item.
3. The product's capabilities do not fit the buyer's line of business, such as an order for sophisticated computers for a small bakery.
4. The item ordered is incompatible with the technical level of the country to which it is being shipped, such as semiconductor manufacturing equipment being shipped to a country that has no electronics industry.
5. The customer is willing to pay cash for a very expensive item when the terms of sale would normally call for financing.
6. The customer has little or no business background.
7. The customer is unfamiliar with the product's performance characteristics but still wants the product.
8. Routine installation, training, or maintenance services are declined by the customer.
9. Delivery dates are vague, or deliveries are planned for out of the way destinations.
10. A freight forwarding firm is listed as the product's final destination.
11. The shipping route is abnormal for the product and destination.
12. Packaging is inconsistent with the stated method of shipment or destination.
13. When questioned, the buyer is evasive and especially unclear about whether the purchased product is for domestic use, for export, or for reexport.

Know Your Customer:

In assessing diversion risks, identifying potential export violations, verifying end-uses, and determining the suitability of end-users to receive commodities or technology; Laws and regulations require that exporting firms come to "know their customers" by exerting all reasonable efforts to ascertain the end-use, the end-user, the ultimate destination, and other facts relating to a transaction or activity.
Before engaging in a transaction or activity, an exporter must determine whether "red flag indicators" are present.

These "red flag indicators" are specifically intended to assist exporters in exploring whether abnormal circumstances exist such that the transaction or activity may be destined for an inappropriate end-use, end-user, or destination.

The "red flag indicators" were developed to illustrate the types of circumstances that should cause reasonable suspicion that a transaction or activity may violate laws and regulations.

10 Percent Inspiration and 90 Percent Perspiration: Compliance Processes and Training

Banks are victim of internal and external fraud

Fraud risk cannot be eliminated but it damages can be minimized...!

Knowing employees is as important as knowing customers.

To Minimize internal Fraud Risk;

1. Issue a statement of company integrity. This should provide a clear message from the boardroom about the organisation's legal and ethical values.
2. Develop an anti-fraud policy and culture which ensures that commercially prudent measures are taken. This should be determined by management, and be commensurate with operational activity.
3. Know your staff. Many frauds are committed in collusion with staff.
4. Check CVs and take up references. The more sensitive the holder's position, the more detailed your enquiry should be.
5. When staff move within an organisation, remember to change their computer and building access level.
6. Encourage a whistle-blowing philosophy within your company. Very often other employees know or suspect something but do nothing about it.
7. Have broadly-based and effective contingency and recovery plans. Have powers vested in managers to cancel or freeze transactions as soon as fraud is discovered. Undue delay often means that funds have been transferred beyond reach.
8. Take a hard line on culprits. Give a clear message that they will be caught, prosecuted and, where necessary, pursued through the civil courts to recover losses.

For Insiders;

The major cases involving identity theft, impersonation and the take-over of customer accounts have shown that many cases depend on the complicity of collusive employees.

Known as 'insiders', these employees are unlikely to be working independently and more often than not are part of a larger, organised group obtaining personal details from various sources.

If compromised within one business, they will often be re-positioned into similar employment with access to the same material and the same potential to inflict financial loss.

They are especially valuable to the criminal fraternity while working at bank counters, as they can serve the "foot soldiers"sent out to present stolen or counterfeit cheques or withdraw cash in fraudulent card transactions.

This instantly negates the need for detailed, credible identity documentation to be produced and other preventative systems can be over-ridden.

Knowing employees is as important as knowing customers.

As well as placing people within your organisation, be aware that criminals do also try to recruit existing employees.  They typically target specific workers and make their initial approaches in a social setting, such as in a pub. Often, employees inadvertantly give away a few pieces of seemingly harmless information in conversation and due to their worry that they have committed a crime can be coupled with threats of violence if your employees do not agree to provide the information which the criminals need.

Assess risk means: "Thinking Like A Fraudster" !

What information has value?
–Customer data
–Vendor data
–Employee data
–Data protected by patent/copy write
–Attorney/client data
–Competitive data

Preventive:
What you do to ensure that the right things happen; wrong things do no happen

Detective:
What you do to find the things that preventive control did not prevent
The following websites useful:

The British Bankers Association Website
The National Hi-Tech Crime Unit Website
the Bank Safe Online Website