Why Anti-Financial Crime Training is a Non-Negotiable

Financial Crime Compliance doesn’t start with policies — it starts with people. And that means getting training right.

In today’s rapidly evolving financial landscape, the risks of financial crime are as dynamic as the technologies enabling them. Organisations must therefore develop proactive, resilient, anti-financial crime (AFC) strategies. At the heart of this lies one powerful enabler: effective AFC training. Organisations that invest in impactful AFC training don’t just meet their regulatory obligations, they strengthen controls, reinforce their culture of compliance, and are better equipped to manage emerging risks.

With significant fines, such as Monzo’s £21m sanction in July 2025 and Starling Bank’s £29m in October 2024, regulators are sending a clear message: weak controls will not be tolerated. If you're serious about fighting financial crime, effective, outcome-driven and relevant AFC training isn’t just a nice to have, it’s a non-negotiable.

Why AFC Training Is a Game-Changer

Training is a powerful, cost-effective way to reduce risk. It strengthens the link between policy and day-to-day practice, supports proactive risk management, and helps build a strong compliance culture. It can also help identify gaps before they become issues. Teams who are better trained are more likely to ask the right questions, challenge inconsistencies, and escalate concerns early.

1. Builds a Strong Compliance Culture

AFC training is foundational to developing a culture where everyone in the organisation understands their role in managing financial crime risks. It empowers teams to spot red flags early, apply controls consistently, and communicate effectively about risk. A culture of compliance isn’t built through policies alone; it’s built through shared understanding and informed behaviour.

2. Turns Policy into Practice

Policies, frameworks, and risk assessments can quickly become abstract without real-world context. Impactful AFC training brings these concepts to life through practical examples, case studies, and current typologies. Real-world scenarios bring regulations to life—helping teams understand how, when, and why controls matter. This not only enhances understanding but ensures that controls are implemented in a meaningful, operationally effective way. 

3. Supports a Risk-Based Approach

A well-trained team understands the importance of tailoring controls to risk. Whether it is customer onboarding, transaction monitoring, or fraud reviews, AFC training helps staff apply a risk-based mindset. It supports teams in understanding when to focus their attention and resources where the risks are highest, strengthening overall effectiveness and efficiency.

4. Regulators expect a well-trained workforce

The Financial Conduct Authority (FCA) and other global supervisors expect firms to:

• Embed a risk-based culture across the business

• Ensure first-line staff can detect and escalate issues

• Demonstrate ongoing training that reflects evolving threats

The FCA’s Dear CEO letter for Annex 1 firms in 2024 highlighted weak and inadequate training  as a common weakness and a critical area for firm.

“During our firm assessments we identified that some firms’ Financial Crime training has not been given the importance that it demands. We observed instances where employees were not provided with role-specific training, and some of the training failed to cover crucial topics, such as SAR reporting guidance.”

— FCA

5. Enables Cross-Functional Collaboration

Financial crime doesn’t operate in siloes and neither should AFC controls. Training enables cross-functional teams, including compliance, operations, product, and senior management, to speak the same language. This promotes collaboration, reduces control gaps, and embeds AFC thinking across the business lifecycle.

How FINTRAIL Makes Anti-Financial Crime Training Non-Negotiable

For firms without large in-house Learning & Development (L&D) teams, delivering high-quality, tailored training can be difficult—especially across multiple functions or jurisdictions. Common challenges we have observed at FINTRAIL can include:

• Reliance on generic, off-the-shelf content that doesn’t reflect the firm’s specific risks, policies, or regulatory obligations.

• Difficulty keeping materials up to date, especially when regulations, threats, or business operations evolve quickly.

• Inconsistency across teams or regions, where messaging varies depending on who’s delivering the training or where it's being rolled out.

• Time and resource constraints, meaning L&D, compliance or risk functions are often stretched thin, unable to dedicate capacity to training design and delivery.

That’s where external providers like FINTRAIL can support. FINTRAIL has helped numerous regulated firms secure buy-in and deliver impactful training. With years of experience supporting banks, fintechs, and regulated firms globally, FINTRAIL brings deep subject-matter expertise, hands-on delivery, and a commitment to measurable impact.

1. Training that speaks to your risks

FINTRAIL doesn’t believe in one-size-fits-all. Each training engagement is customised to reflect the firm’s risk profile, products, jurisdictions, and team structures. Whether you’re a start-up fintech or a multinational institution, the content is tailored to your financial crime ecosystem. This gives credibility to tell the board: “We’re training our teams on the risks we actually face.”

2. Delivered by industry experts

FINTRAIL’s trainers are AFC professionals who have worked inside financial institutions, regulators, and fintechs. They understand the real-world challenges faced by compliance teams and deliver training that is grounded, practical, and actionable.

3. Real-life scenarios and case studies

FINTRAIL training includes curated case studies, scenario-based exercises, and typology walkthroughs. This ensures that training goes beyond theoretical principles and gives staff the tools to recognise, escalate, and mitigate financial crime in practice.

4. Flexible, scalable delivery

Whether you need a half-day workshop for your board, ongoing virtual sessions for global teams, or one-off thematic content. FINTRAIL offers flexible options to meet your needs. Training can be delivered remotely or in-person and adapted to different roles and seniority levels.

Case Study: AFC Training for a UK Bank

A UK bank recently partnered with FINTRAIL to strengthen its AFC controls and improve knowledge across teams. The bank faced challenges in managing agent-related risks and required upskilling on transaction monitoring, PEP and sanctions screening, and onboarding practices.

FINTRAIL worked closely with the bank to:

• Review and enhance AFC policies and controls.
• Design and deliver tailored training across first and second-line teams.
• Build capability in recognising typologies relevant to the bank’s products and customer base.
• Integrate AFC risk understanding into the organisation’s decision-making and governance.

The outcome

A tailored anti-financial crime training programme covering:

• 3 e-learning modules
• 5 classroom-based sessions
• Supporting speaker notes, facilitator guides and assessment questions

AFC training is a strategic advantage

AFC training isn’t just a regulatory obligation, it’s a strategic advantage. Empowered, informed teams are your best defence against financial crime. With the right partner, training can move beyond box-ticking and deliver long-term risk reduction, cultural change, and business resilience.

FINTRAIL’s blend of technical expertise, practical insight, and flexible delivery can enhance your training programme. If you’re ready to future-proof your AFC defences, build internal capability, and create a strong compliance culture, get in touch with us today.

What the UK’s 2025 National Risk Assessment Means for Financial Crime Compliance

The UK’s 2025 National Risk Assessment of Money Laundering and Terrorist Financing has landed, and for regulated firms, this one’s hard to ignore.

More than just a refresh of previous assessments, this NRA signals a shift in how firms are expected to assess and respond to financial crime risk. With a sharper focus on sector-specific threats, emerging typologies like crypto laundering and AI misuse, and the introduction of System Prioritisation, the direction of travel is clear: firms must take a more dynamic, threat-informed approach to risk management.

At FINTRAIL, we’ve reviewed the assessment in full. Below, we’ve broken down the key changes, the sectors most affected, and what this all means for your financial crime compliance framework.

Whether you’re updating your firm-wide risk assessment or refining controls across specific products and services, this post is designed to help you get ahead of the curve — and stay there.

What Are the Key Financial Crime Threats in the 2025 NRA?

Money laundering threats

The UK continues to face a high level of money laundering (ML) risk, with the 2025 National Risk Assessment highlighting how ongoing geopolitical developments are influencing the threat landscape.

While traditional risks such as cash-based money laundering and the misuse of UK-incorporated companies remain prevalent, the rapid adoption of new financial technologies has introduced additional vulnerabilities. These include increased ML risks linked to Electronic Money Institutions (EMIs), Payment Service Providers (PSPs), cryptoassets, and the emerging use of Artificial Intelligence (AI) in financial services.

In the wake of Russia’s invasion of Ukraine, the NRA notes a growing convergence between money laundering, kleptocracy, and sanctions evasion.

All regions of the UK remain exposed to ML threats, with urban areas (particularly those with higher levels of organised criminal activity) more likely to experience elevated risk levels.

Terrorist financing threats

The 2025 National Risk Assessment highlights that terrorist financing (TF) is not always linked directly to attack planning. In many cases, some or all stages of terrorist financing may occur outside the UK, while still posing a threat to the UK.

The NRA breaks down TF-related financial flows into four key stages: generating, moving, storing, and spending funds. It identifies which regulated sectors are most likely to be exposed at each stage and provides examples of common methods used. These flows often vary depending on the type of terrorist organisation, particularly in relation to its size and whether its activities are domestic or international.

When funds are raised within the UK, they are most commonly sourced through legitimate means, such as salaries or personal loans, rather than criminal activities like fraud or drug trafficking. These funds may be used within the UK or transferred abroad to individuals, accounts, or wallets associated with a specific “cause” or organisation.

How Criminals Launder Money: Typologies and System Prioritisation

The 2025 National Risk Assessment outlines the most common money laundering (ML) techniques currently observed in the UK. Where possible, these typologies are linked to specific predicate offences and the regulated sectors most likely to be exposed.

• Cash – While the use of cash in legitimate transactions continues to decline, the number and total value of banknotes in circulation has increased. Cash remains a widely used tool for criminals. It is often pooled into larger sums before being introduced into the financial system via deposits into retail banks, the Post Office, gambling services, or the purchase of high-value goods.

• Informal Value Transfer Systems (IVTS) – Systems such as hawala and Chinese Underground Banking are frequently used for both money laundering and terrorist financing. Criminals perceive these systems to have weaker controls, and their structure — allowing access to value stores across multiple jurisdictions — makes them particularly useful for international laundering networks.

• Cryptoassets – The use of cryptoassets to launder proceeds of crime is rising. These assets are not only used to move illicit funds but are increasingly acquired through criminal means such as cybercrime, ransomware attacks, and crypto thefts. However, there is currently limited evidence that crypto use has displaced more traditional laundering methods.

• Trade-Based Money Laundering (TBML) – The UK’s position as a global trade hub exposes it to significant TBML risk. Criminals exploit international trade transactions to disguise the movement of illicit value, using false invoicing, misrepresentation of goods, or shell trading to legitimise the origin of funds.

• Property – Property remains an attractive method of laundering due to the large sums that can be moved and the perceived stability of the asset class. Criminals often use property as a final integration step, following other laundering stages, in order to distance illicit funds from their source and provide a sense of legitimacy.

• Companies and Trusts – The misuse of lawful corporate structures, including trusts, continues to be widespread. These vehicles may be directly controlled by criminals or involve third-party nominees and professional service providers to obscure beneficial ownership and facilitate complex layering.

• Professional Enablers – Criminals can exploit the skills and credibility of professionals to support laundering activity. This typically involves sectors such as legal services, accountancy, and trust and company service providers (TCSPs), where specialised knowledge can help conceal illicit wealth.

One of the most significant changes introduced alongside the NRA is its alignment with the UK’s Economic Crime Plan 2 (2023–2026) through the concept of System Prioritisation. This mechanism allows participating segments of the regulated sector to better allocate their internal resources on a cost-neutral basis, while still meeting their regulatory obligations.

Which Sectors Face Higher Risk in 2025?

Whilst ML/TF risk levels for different sectors regulated under the MLRs remain mostly unchanged, there are a couple of notable exceptions, particularly in relation to EMI/PSPs and crypto firms.

• Retail banking – The ML/TF risks for retail banking remain high. The sector continues to be persistently targeted by criminals, as integrating illicit funds into the legitimate financial system is often necessary to spend, store, and use criminal proceeds. The characteristics that make retail banking attractive to legitimate users — accessibility, ubiquity, and speed — also increase its vulnerability to exploitation for terrorist financing.

• EMI/PSPs – The ML/TF risks in the regulated EMI and PSP sector have increased from medium to high. Rapid scaling since 2020, increased complexity (e.g. virtual IBANs), and a diversification of services have contributed to the sector’s attractiveness for criminals, providing more options to manage and launder funds across borders.

• Crypto – The risk of money laundering through cryptoassets has increased from medium to high. This change is driven by both the rising criminal use of cryptoassets and the broader increase in licit public adoption, coupled with the speed at which funds can be moved. While the risk of registered cryptoasset firms being used to finance terrorism has increased, it remains rated as medium.

• MSBs – The ML/TF risks associated with Money Service Businesses (MSBs) remain high. Cash continues to be widely used by criminals, who exploit features of the MSB sector to move or convert illicit funds. The low cost of transferring funds and the ability to reach a wide range of high-risk jurisdictions continue to make MSBs an attractive and accessible means for terrorists to move small amounts of money quickly in and out of the UK.

• Other regulated sectors – Among other regulated sectors, the ML risk for casinos has increased from low to medium. In contrast, the ML risk for Art Market Participants and Letting Agency Businesses has decreased — from low to medium and medium to low, respectively. The TF risk for Wealth Management and Trust or Company Service Providers has risen from low to medium.

How to Use the 2025 NRA to Strengthen Your Risk-Based Approach

The 2025 National Risk Assessment offers valuable insights that can help regulated firms refine their risk assessments and control frameworks. Use the following prompts to evaluate your current approach:

• Is your regulated sector named in any ML typologies outlined by the NRA?
  Consider how these typologies could manifest within your firm and whether your existing controls are equipped to mitigate them.

• Is your regulated sector named in any TF mechanisms outlined by the NRA?
  Reflect on how your products or services could be involved in the generation, movement, storage, or spending of funds linked to terrorist financing.

• What is your firm’s exposure to high-risk jurisdictions?
  Review your cross-border activities in light of the jurisdictions flagged in the NRA as particularly relevant to ML and TF risks — both those faced by the UK and those it poses externally.

• Are you aligned with the UK’s System Priorities?
  The government has now published the first set of System Priorities, outlining the financial crime threats that regulated sectors should focus on. These priorities aim to support a more strategic, coordinated approach to financial crime prevention. Firms should review how their current frameworks align with these national priorities and be prepared to operationalise them as part of their ongoing risk-based approach.

Conclusion

The 2025 National Risk Assessment is a welcome step forward. For the first time, there is a sense that the UK is starting to take a genuinely threat- and risk-based approach to tackling financial crime. As our CEO, Robert Evans, put it:

“If we are honest with ourselves, to date the UK (and international) framework has been inherently ineffective and inefficient... So it is fantastic to see that this latest iteration is going to be complemented by annual typology and threat updates... This should mean that sectors covered by the MLRs can start to shift to a much more threat-informed approach to financial crime prevention in the UK.”

That shift won’t happen overnight. But with System Prioritisation, more granular typologies, and sector-specific risk guidance, firms now have a clearer direction of travel — and a stronger foundation to recalibrate their risk-based approach.

If you’re reviewing your firm-wide risk assessment in light of the new NRA or want support interpreting its implications for your business model, FINTRAIL can help. We work with fintechs, payments firms, and financial institutions to build risk assessments that are practical, defensible, and aligned with evolving regulatory expectations.

Get in touch if you'd like to have a conversation.

Extending Our Expertise: FINTRAIL’s New Regulatory Compliance Services

As regulatory expectations continue to evolve, regulated firms face increasing pressure to demonstrate that their frameworks are effective, scalable, and proportionate to their business models. To better support our clients, we’ve expanded our offering to include regulatory compliance services—delivered with the same practical, outcome-focused approach that defines our financial crime consultancy.

We sat down with Colin Darby, who is leading this new service line at FINTRAIL, to discuss what firms should be thinking about now, how our approach stands out, and why this expansion builds on rather than shifts away from our core strengths.

1. Meet Colin Darby: Leading the New Services Line

2. Market View: Challenges and Opportunities

3. FINTRAIL’s Approach to Regulatory Compliance

4. Values, Culture and Collaboration

5. Final Thoughts

What makes now the right time for FINTRAIL to expand into regulatory compliance?

We’re seeing increasing demand from our clients—particularly fintechs and other high-growth regulated firms—for practical support that goes beyond financial crime. This reflects that financial crime risk management is far from the only regulatory priority; matters such as resilience, customer treatment and innovation are high on regulatory agendas too. Expanding our services is a natural step, and one that allows us to help clients develop, operate and refine cohesive, proportionate, well-integrated and effective  non-financial risk frameworks.

Our approach remains rooted in deep subject matter expertise, pragmatism, and proportionate advice—just extended to cover a wider range of regulatory and risk topics. We’re not changing direction; we’re building on our existing model to offer clients more value across the board.

---

Meet Colin Darby: Leading the New Service Line

Tell us about your background and what brought you to FINTRAIL

Over the past 20 years, I’ve worked in financial services risk and compliance across the regulatory, government, consultancy, and industry roles—most recently, leading the risk and compliance function at a pan-European fintech. FINTRAIL’s reputation for specialism and high-quality advisory work really appealed to me, along with its mission to support financial innovators and the chance to join a team of industry experts.

How has your cross-sector experience shaped your view of compliance?

It’s shown me how important it is for firms to find the right solution for their business. There’s rarely one single way to meet a regulatory requirement, so it’s about tailoring risk management and compliance frameworks that fit the organisation and can scale with it. Compliance is not a one-time task — it needs to evolve as both the business and regulatory landscape change. Compliance is not for the sake of it; compliance frameworks and functions provide the parameters within which firms can develop new products, enter new markets and grow their customer bases. In addition, no financial services firm wants its business to be disrupted by regulatory intervention – compliance frameworks and functions equip firms to demonstrate to regulators that they are effectively managing their inherent risks and appropriately mitigating potential harm to customers and markets.

---

Market View: Challenges and Opportunities

What does the current regulatory environment look like for fintechs and other regulated firms?

We’re seeing positive developments—regulators like the FCA are offering more support to new entrants and there’s more clarity emerging around regulation of digital assets and consumer credit. There’s a shift toward smarter, less bureaucratic regulation. But that doesn’t mean expectations are easing. Firms still need to show they have robust, effective controls that deliver the right outcomes.

What are the biggest compliance challenges firms are facing today?

A few things stand out:

• Relying on tick-box approaches that don’t fit the business model

• Struggling to keep up with regulatory change at the pace it’s coming

• Difficulties in evidencing that systems and controls are operating as designed

• Internal perceptions of compliance requirements as a ‘blocker’ rather than seeing the compliance function as a  strategic partner

What should firms be preparing for?

Among other things:

• More data-led supervision from regulators

• Greater intelligence-gathering powers and more focused reviews

• An increasing emphasis on firms being able to explain and evidence their conduct and decision-making

---

FINTRAIL’s Approach to Regulatory Compliance

How does FINTRAIL’s compliance support differ from traditional consultancies?

It’s grounded in the same principles that have made our financial crime advisory services so effective. We deploy experienced professionals—people who’ve worked in-house, in consulting, and with regulators—to help clients design, implement and strengthen frameworks that are pragmatic, scalable, and regulator-ready.

We focus on proportionality, real-world application, and helping clients define and achieve meaningful outcomes, rather than just ticking the boxes.

What types of regulatory compliance projects can you support with?

Our core service areas include:

• Regulatory engagement and applications for approval

• Advice on interpreting existing and forthcoming regulatory requirements

• Design and deployment of non-financial risk and compliance frameworks

• Operational support, for example, interim resource, outsourced compliance monitoring, and training delivery

• Independent reviews and assurance engagements

How does this complement your anti-financial crime services?

It’s an expansion, not a shift. Many of our clients are trying to bring different elements of risk management together under a cohesive enterprise risk and governance framework. By offering support across financial crime and regulatory compliance, we can help them bridge silos and build stronger, more resilient frameworks.

It also recognises that, for some of our smaller clients, the same personnel and management members have broad responsibilities, not limited to a single risk domain and part of the compliance picture.

Can you share an example of how this joined-up approach creates value?

By working with clients on multiple topics, we can provide delivery efficiency due to familiarity with the business models, the key stakeholders and the client’s internal governance structures.

We also help firms tackle issues that cut across several areas of the regulatory framework. For example:

• Firms may look to preserve operational capital and strengthen financial stability by reducing headcount in financial crime operations teams—potentially risking backlogs and reduced control effectiveness as a result.

• It is commonplace for firms offering payment accounts to use account suspension as a risk mitigation measure, but this also impacts on the customer experience and outcomes delivered.

• Firms have to simultaneously recognise indicators of potential customer vulnerability and guard against their products and services being mis-used. Vulnerability and mis-use are not mutually exclusive as people with vulnerability indicators can also be at increased risk of being recruited (wittingly or unwittingly) as a money mule.

• New products should not be launched without a comprehensive product risk assessment being completed - new products can present financial crime risks but also bring new possibilities for customer harm.

• Keeping customer information up-to-date is important to understanding a customer’s risk profile, but can also be beneficial from a data protection perspective.

• Marketing is a key way for financial innovators to achieve their customer acquisition targets, but marketing material is also likely to constitute a financial promotion or a customer communication.

By recognising the bigger picture and focussing on outcomes, we can help clients devise and operate solutions which satisfy multiple requirements.

---

Values, Culture and Collaboration

How do FINTRAIL’s values apply to regulatory compliance?

Our values—customer centricity, excellence, accountability, ethical conduct—are as relevant here as they are to anti-financial crime. We hold ourselves to the same high standards we help our clients uphold. That’s the foundation for building trust, both with our clients and between our clients and their regulators.

How do you ensure compliance isn’t just a tick-box exercise?

By focusing on outcomes first. What is the framework meant to achieve? What good looks like will differ between firms—but we help define that, and then design solutions that are achievable and sustainable.

---

Final Thoughts

What’s one piece of advice you’d give to compliance leaders today?

Make sure you really know your compliance programme—where it’s strong, where it needs work, and be able to evidence all of it. That confidence is key to navigating regulatory change and scrutiny.

Where can people learn more?

Visit our Regulatory Compliance services page to find out how we can support you, sign up for our insights, or get in touch with us directly to start a conversation.

FFECON25 - The Art of Risk: Critical Takeaways

On 27 February 2025, over 450 financial crime and compliance professionals gathered in London for FFECON25: The Art of Risk. Organised by FINTRAIL, FFECON is an industry-leading conference that brings together fintechs, banks, regtechs, and industry experts to explore the evolving challenges in financial crime risk management and develop practical and implementable strategies to enhance compliance frameworks. Each year, FFECON adopts a unique theme to address the most pressing issues facing the industry, fostering collaboration and knowledge-sharing across the industry.

This year’s event focused on the complexities of managing financial crime risks in high-risk verticals while maintaining financial inclusion and business growth. Through expert-led panel discussions and special guest presentations, attendees gained insights into regulatory expectations, and the latest trends shaping the financial crime landscape. The conference also provided a valuable opportunity for professionals to network, exchange best practices, and engage in thought-provoking conversations about the future of financial crime compliance.

Below, we highlight key takeaways from the sessions and how firms can apply these insights to enhance their financial crime controls.

---

🎙️ Adults Only - Banking the Adult Entertainment Sector

Our closing panel for FFECON25 shone a spotlight on the challenges of banking the adult entertainment sector.

Financial institutions often lack awareness of how the adult entertainment industry operates and where the true risks lie. Despite being a legal, multi-billion-dollar industry, many financial institutions continue to apply blanket de-risking, often influenced by moral bias rather than evidence-based risk assessments.

📌 Key Takeaways

• The adult entertainment sector encompasses various sub-industries, each with distinct risk profiles that can inform a nuanced risk appetite.

• Effective, proportionate controls can enable safe and sustainable engagement with the sector. In fact, as a multi-billion dollar global industry, it offers significant growth opportunities for financial institutions if managed in the right way. 

• Regulatory oversight is evolving, with measures such as the UK Online Safety Act shaping compliance expectations.

💪 Enhancing Controls

Firms should develop evidence-based risk management frameworks that distinguish between different areas of the adult entertainment industry rather than applying blanket de-risking. A thorough understanding of the operational models, payment flows, and compliance risks within each sub-sector can help firms establish proportionate controls that support financial inclusion while mitigating financial crime risks.

This echoes what the consultancy team at FINTRAIL have been seeing while working with clients that are seeking to take advantage of the growth opportunities presented by this sector.

FINTRAIL has worked with financial institutions to refine their risk assessment methodologies, ensuring that policies and procedures are well-calibrated to manage risks without unnecessary exclusions. Our expertise in high-risk verticals enables firms to navigate these challenges with confidence.

---

🎙️ What Actually Happens When You’re Sanctioned?

Moderated by Emil Dall, Head of Sanctions at FINTRAIL, this session sought to provide unique insights into the experiences of sanctioned individuals.

With the expansion of sanctions following Russia’s invasion of Ukraine, the UK has seen an increase in sanctioned individuals with domestic ties. However, many firms remain unclear on the process of designation, asset freezing, and licensing conditions.

📌 Key Takeaways

• Sanctions compliance requires more than just screening; firms must understand how designations occur and how asset freezes are enforced.

• The recent OFSI Financial Services Threat Assessment highlighted common compliance failures, including mismanagement of frozen assets and misunderstanding of licence conditions.

• Firms need clear processes to identify when a licence is required and ensure they are compliant with UK sanctions regulations.

💪 Enhancing Controls

A well-rounded sanctions compliance programme should include clear internal guidance on designation processes, asset-freezing obligations, and licensing conditions. Regular staff training and scenario-based exercises can help firms stay prepared for real-world sanctions scenarios. In addition, firms should review their governance structures to ensure they have an effective escalation process in place for sanctions-related decisions.

FINTRAIL has helped firms strengthen their sanctions compliance frameworks through policy reviews, training, and independent assurance assessments. Our experience ensures financial institutions can manage complex sanctions requirements effectively—find out more.

---

🎙️ Fraud: Are We Losing the Battle?

The fight against fraud remains a moving target, with fraudsters continuously adapting their tactics. While some fraud types are declining, others—such as card fraud—are on the rise.

📌 Key Takeaways

• While it was a ‘sometimes’ to ‘Are we winning the battle on fraud’ - it’s clear the combined efforts across the industry need to continue with better adoption of technology, reduced barriers to data sharing, and more investment in educating consumers.

• A proactive fraud strategy must be informed by real-time data and the involvement of fraud and compliance teams early in the product design process.

• Optimising friction, rather than minimising it, can enhance customer trust and security.

• Data quality is critical—firms must learn how to extract meaningful insights while filtering out noise.

• The UK’s Economic Crime and Corporate Transparency Act introduces new corporate obligations, including the ‘failure to prevent fraud’ offence, reinforcing the need for robust fraud prevention measures.

💪 Enhancing Controls

Firms need to take a holistic approach to fraud prevention, integrating fraud risk management into product development from the outset. Deploying intelligent friction can improve security without compromising customer experience. Leveraging advanced analytics and machine learning models can also enhance fraud detection by reducing false positives while identifying emerging threats.

FINTRAIL has worked with fintechs and financial institutions to refine their fraud risk strategies by delivering bespoke fraud risk assessments, conducting independent fraud reviews, and providing targeted training. A holistic approach is key in the battle against fraud.

---

🎙️ Business in the Danger Zone: Banking Customers from High-Risk Countries

The aim of this session was to challenge conventional wisdom around how to understand and manage country risk, considering new approaches and delivering actionable recommendations for managing and assessing geographic risks.

We learned that many firms rely too heavily on country risk ratings, leading to unnecessary de-risking and financial exclusion. A more nuanced, dynamic approach to risk assessment is needed.

📌 Key Takeaways

• Risk should not be seen in binary terms—different aspects of country, customer, and transaction risks must be considered.

• Compliance professionals have a collective responsibility to ensure that their risk frameworks don't punish the majority because of a small percentage of bad actors. Compliance frameworks should leverage actual data, such as SAR trends, to assess customer risk rather than defaulting to static rules.

• Regulators and industry players must work together to refine risk assessment methodologies that balance financial inclusion and financial crime mitigation.

💪 Enhancing Controls

Firms should move beyond simplistic country risk models by adopting multi-dimensional risk assessments that incorporate transactional behaviours, business models, and historical trends. Enhancing due diligence processes with real-time monitoring and external intelligence sources can also help firms make informed decisions without resorting to unnecessary de-risking.

FINTRAIL has helped firms design dynamic risk assessment frameworks that enable compliance while supporting legitimate businesses. Our expertise in country risk and financial crime typologies ensures that firms can strike the right balance between risk mitigation and financial inclusion.

---

🎙️ Lawful but Awful: Navigating the Challenges of Combating Extremism Financing

Financial institutions have a role to play in combating extremism financing, but they must approach it in a systematic and informed way to avoid making ill-advised, ad-hoc decisions. The balance between proactive risk management and avoiding overreach is critical.

📌 Key Takeaways

• A strong compliance framework should incorporate a comprehensive risk assessment, clear policies, and a well-defined risk appetite statement. Without these foundational elements, controls can be misaligned or ineffective.

• Institutions need structured escalation and approval channels to ensure decisions are made with oversight and consistency, rather than on a case-by-case basis.

• Training is essential—without sufficient awareness, staff may struggle to identify or respond to risks appropriately.

💪 Enhancing Controls

Firms looking to strengthen their approach to extremism financing should prioritise training, clear escalation procedures, and regular risk assessments. Ensuring screening tools and transaction monitoring systems are calibrated to detect relevant risks without excessive false positives is also key.

FINTRAIL has delivered training sessions and workshops on terrorism and extremism financing, as well as conducted risk assessments and screening tool assurance reviews for various clients. Our expertise helps institutions build frameworks that are both effective and proportionate.

---

🎙️ Managing Financial Crime Risk in an Integrated Ecosystem – Are We All in the Same Boat?

The fintech sector prides itself on bringing unique products to market, but how do these innovations fit into the broader financial ecosystem? This session explored the challenges of managing financial crime risks in an interconnected environment where fintechs and banks must collaborate to tackle evolving threats.

📌 KEY TAKEAWAYS

• As fintechs mature, they face many of the same financial crime challenges as banks, including regulatory scrutiny and operational risks.

• Industry collaboration has improved, but maintaining trust and information-sharing remains an ongoing challenge.

• Managing a fintech customer base presents unique compliance nuances, requiring a tailored approach to risk assessment and monitoring.

• De-risking continues to be a debated issue—firms must balance risk management with financial inclusion.

• The rise of embedded finance adds new layers of complexity, requiring financial institutions to refine oversight mechanisms for third-party partnerships.

💪 Enhancing Controls

Firms operating within integrated financial ecosystems should prioritise strong governance frameworks, clear accountability for financial crime risks, and effective oversight of partnerships. Open communication between fintechs and banks, as well as engagement with regulators, is crucial to ensuring a cohesive approach to risk management.

FINTRAIL supports firms in navigating these challenges by helping them develop comprehensive financial crime risk management strategies that align with the realities of an interconnected financial landscape.

---

🎙️Turning Risk into Opportunity: Leveraging Crypto's Transparency for Enhanced Compliance

How can financial institutions turn crypto’s perceived risks into a compliance advantage? This was the central question explored in this panel. The session examined how crypto’s inherent transparency can enhance risk management and regulatory alignment. While often viewed as high-risk, crypto’s real-time, immutable blockchain data presents unique opportunities for financial crime prevention.

📌 Key Takeaways

• Crypto’s transparency can offer a compliance advantage, enabling real-time tracking and more precise transaction monitoring than traditional finance.

• A strong compliance foundation requires a thorough risk assessment, and clear understanding of product and customer exposure.

• Engagement with the Crypto sector is key for FIs to understand the unique risks and controls.

• The regulatory landscape is evolving, with increased scrutiny on privacy-enhancing tools and stricter KYC requirements for DeFi platforms.

• Public-private partnerships (PPPs) play a crucial role in shaping effective crypto compliance strategies.

💪 Enhancing Controls

To effectively manage financial crime risks in crypto, firms should start by building a strong compliance foundation. This may include designating a crypto SME within the organisation, conducting comprehensive risk assessments, and ensuring robust AML/KYC frameworks, sanctions screening, and cybersecurity controls. Compliance with the Travel Rule and regular independent audits are also key to regulatory alignment.

Blockchain analytics and AI-driven attribution tools can offer deeper insights into transaction flows, enabling firms to trace fund movements with greater precision. Leveraging these tools can enhance transaction monitoring, improve anomaly detection, and strengthen overall risk management. 

FINTRAIL has extensive experience supporting firms in the crypto sector, from conducting risk assessments to advising on compliance frameworks and regulatory best practices. Our team helps financial institutions navigate the complexities of crypto compliance, ensuring they leverage the transparency of blockchain to strengthen their financial crime controls. Learn more about our work in the crypto space here.

---

Conclusion

FFECON25: The Art of Risk successfully brought together industry leaders to address some of the most pressing financial crime challenges, and to push the narrative on these topics beyond the comfort zone. The discussions underscored the need for proportionate, data-driven approaches to risk management that balance compliance obligations with financial inclusion.

As we look ahead to next year’s FFECON, the conversation continues. At FINTRAIL, we remain committed to supporting financial institutions in strengthening their risk frameworks, adapting to regulatory changes, and making informed decisions about financial crime compliance.

Understanding the New Failure to Prevent Fraud Offence

After promises of a "Failure to Prevent Fraud" offence finally materialising within the Economic Crime and Corporate Transparency Act in 2023, the UK Home Office released long-awaited guidance in November last year on how firms should comply. The guidance covers several key areas:

1. Who is in scope – "Large organisations," defined as companies meeting two out of the following three criteria:
   a) More than 250 employees
   b) More than £36 million turnover
   c) More than £18 million in total assets

2. The implementation period – Organisations within scope have until 1st September 2025 to develop and implement their fraud prevention procedures.

3. An overview of the offence – This includes details on the types of fraud covered, territorial scope, investigations, penalties, and sanctions.

4. Reasonable fraud prevention procedures – The most important section, Chapter 3, outlines what constitutes an adequate defence in terms of controls and compliance measures.

Yes, we all thought we were "done" with fraud after the intense focus on APP scams in 2024. But with the implementation deadline looming on 1st September, the topic—albeit from a different perspective—is firmly back in the spotlight.

Read on for more insights into the new requirements and how we can support you in assessing your fraud prevention procedures.

What is the Failure to Prevent Fraud Offence?

The "Failure to Prevent Fraud" offence is a new legal measure within the UK, part of broader efforts to tackle corporate fraud and encourage ethical business practices. Under this offence, companies can be held liable if they fail to prevent specific fraud activities committed by employees or associated persons unless they can demonstrate that reasonable preventative procedures were in place.

The offence also extends to corporate liability, meaning that if an employee commits fraud as part of their role, the company could face penalties unless they can prove that robust fraud-prevention strategies were actively implemented. The high-level intent is to ensure firms take a proactive stance on fraud detection and deterrence, rather than relying solely on reactive measures.

While the title makes the scope sound bigger than it is, the offence certainly isn’t all encompassing when it comes to fraud; in fact, it only focusses on employees.

Why this legislation matters to financial services firms

For financial services firms, the implications of this offence are significant. Not only are the potential penalties substantial, but non-compliance could also damage a firm's reputation and shake customer trust. Financial crime is a top concern in the fintech and payments sectors, where rapid transactions and digital operations increase exposure to fraudulent activities. Fintechs and payment firms face unique fraud risks that may require more advanced prevention mechanisms than traditional financial institutions. As such, compliance teams must carefully assess how their current controls stack up against these new requirements and address any gaps.

In addition, many financial services firms operate across borders, subjecting them to varied regulatory standards. The "Failure to Prevent Fraud" legislation will likely influence expectations for fraud prevention in other jurisdictions.

What is a reasonable fraud prevention procedure?

An organisation has a defence against penalties and sanctions if they can demonstrate to a court they had reasonable fraud prevention procedures in place. What does that actually mean, though? Similar to the bribery or tax evasion offences, this can be informed by the six principles outlined in the guidance:

• Top level commitment  

• Risk assessment  

• Proportionate risk-based prevention procedures  

• Due diligence 

• Communication (including training)  

• Monitoring and review

On pages 20- 37 of the guidance, you can find an overview of each principle alongside detailed questions positioned at organisations to ask themselves.

Practically, what does this mean for an organisation?

So, what should you be practically considering against these principles? Here are some steps:

• Conduct an Anti-fraud Risk Assessment: Either enhance your existing business-wide risk assessment to include internal fraud or alternatively consider developing a standalone risk assessment which covers the corporate offence

• Implement Clear Anti-Fraud Policies: Establish or review fraud prevention policies, detailing specific procedures employees should follow to prevent fraud in their roles. These policies should be frequently reviewed and updated to align with regulatory changes or new types of fraud that may emerge.

• Schedule Regular Compliance Audits: Ensure your financial crime audits cover the failure to prevent as part of their scope and or conduct specific assurance reviews in the run up to the implementation date

• Customise Training to Address Specific Risks: Bespoke training tailored to a firm’s unique fraud exposure—such as training for customer-facing roles or high-risk departments—ensures that employees are well-prepared to address relevant risks. This approach goes beyond general training to provide practical, role-specific guidance for detecting and mitigating fraud.

By taking these steps, financial services firms can strengthen their defences and reduce the risk of falling afoul of the new "Failure to Prevent Fraud" offence.

How FINTRAIL can support your compliance efforts

FINTRAIL specialises in anti-financial crime consultancy and bespoke training services, providing financial services firms with the expertise and support needed to navigate evolving regulatory landscapes. Our team works closely with fintechs and payment firms to develop tailored fraud prevention strategies, enhance internal controls, and deliver training that meets the unique needs of each organisation. Whether you’re looking to audit your current fraud controls or train your team to spot and prevent financial crime, our fraud support services can help you implement effective, compliant strategies.

For firms uncertain about the adequacy of their fraud prevention measures, FINTRAIL offers comprehensive reviews to help identify potential gaps and reinforce their compliance frameworks. From building in-house training programmes to consulting on fraud detection technology, our experts are committed to helping firms adapt and thrive within this new regulatory environment.

To find out more about, get in touch with our team.

Frequently Asked Questions (FAQ) on the Failure to Prevent Fraud Offence

Q: What types of fraud does the "Failure to Prevent Fraud" offence cover?

The offence typically includes various types of corporate fraud, such as false accounting, misleading statements, and other specified fraudulent activities. The specific frauds covered are defined in the legislation, focusing on areas where corporate negligence could enable fraud.

Q: How can a firm demonstrate it has "reasonable preventative procedures"?

Reasonable preventative procedures are actions or policies that reduce the likelihood of fraud occurring, such as employee training, regular risk assessments, and an established whistleblowing policy. The procedures should be proportionate to the risk level and specific to the firm’s operational structure.

Q: What happens if a firm fails to comply?

Firms that fail to meet the requirements of the "Failure to Prevent Fraud" offence could face penalties, including fines and legal action. Compliance with this offence not only mitigates legal risks but also helps preserve the company’s reputation and customer trust.

Conclusion

The "Failure to Prevent Fraud" offence underscores the growing responsibility on businesses to prevent fraud within their operations. For financial services firms, this means implementing robust, proactive anti-fraud measures and ensuring that employees are equipped to handle the challenges of modern financial crime. Taking these steps now will not only safeguard firms from potential legal consequences but also reinforce trust with customers and stakeholders. If you’re ready to bolster your fraud prevention framework, consider how FINTRAIL’s expert fraud support services can help you stay ahead of the curve.

Audits: Your 2024 Wrapped

As 2024 came to a close, the FINTRAIL team took a deep dive into the anti-financial crime (AFC) audits we conducted during the year. In true ‘Spotify Wrapped’ style, we’re bringing you the key trends, recurring themes, and standout findings—our ‘most played’ compliance challenges of the year.

In 2024, we worked with firms of all sizes, from pre-launch fintechs to global financial institutions, spanning multiple jurisdictions and regulatory landscapes. As the industry grappled with shifting compliance expectations, emerging financial crime risks, and evolving fraud tactics, our audits provided valuable insights into how AFC programmes are adapting—and where gaps still exist.

While some firms made notable progress in strengthening their frameworks, others continued to face challenges in critical areas. From regulatory updates catching firms off guard to control weaknesses that appeared across multiple reviews, our analysis sheds light on the key themes that defined AFC compliance in 2024. Read on for the most pressing trends and takeaways from our audit work over the past year.

---

• In 2024, we conducted a total of 50+ audits and thematic reviews across a range of firm sizes varying from small pre-launch businesses to global well-established financial institutions; different types including Money Service Businesses (MSBs), Electronic Money Institutions (EMIs), Authorised Payment Institutions (APIs) and other; and multi-jurisdictional reviews including the UK, Netherlands, Canada, Ireland and Lithuania. Half of these audits included in-depth reviews of the clients fraud framework. 

• We found a total of 789 findings across our reports with 36 critical, 159 high priority, 316 medium priority and 278 low priority recommendations. 

• The highest number of findings related to the payment and customer screening control area (126 findings total). Closely after were policies and procedures with a total of 89 findings—followed by risk assessments with 87.

• When we split benchmarking data for 2024 between small (mostly small EMI or PI providing remittance services) and large firms, we can observe some interesting trends. On one hand, deficiencies in polices and procedures appear to be an outlier for small firms where we observed generic documents not tailored to firms’ business models and lacking regular updates. On the other hand, weakness in the transaction monitoring framework appears to be an outlier for large firms. We often observed that transaction monitoring systems and controls do not keep up with increased complexity of products and services offered by large firms, leading to gaps in coverage, or outdated or ineffective rule sets.

So, what did we see?

The majority of the critical findings in 2024 related to firms’ sanctions screening controls, particularly the overall documenting of risk based approach (RBA) applied by firms and frequency of ongoing customer screening. In some instances we saw firms were unable to demonstrate that ongoing customer screening was being performed. This was often a result of firms not understanding their third party tooling settings—or being unaware that their tools had this functionality, and as a result, they did not turn it on. In terms of documenting RBA to screening, we noted lack of sufficient assessment of associated sanctions risks, adequate justification and appropriate approval by senior management. Compliance with sanctions regimes has been high on regulatory agenda over the last couple of years; we believe that it was a driving force behind the reduction of findings in 2024, compared to 2023. 

The “most played” finding related to firms not updating their policies and procedures and subsequent processes with the latest regulatory updates on the treatment of domestic PEPs. Many firms are still applying default enhanced due diligence (EDD) for all PEPs. Additionally, we still frequently did not see reporting discrepancies in registers and proliferation financing covered by firms’ polices and procedures. 

Last year we saw an increase in findings related to customer risk assessment (CRA) and fraud. In terms of CRA, we observed some firms not applying any risk assessment to its customers at the onboarding or failing to update it regularly throughout business relationships. With the launch of the mandatory reimbursement for Approve Push Payment (APP) fraud last year, an increase in findings related to fraud should not come as a surprise. These included insufficient fraud risk assessments and  limited transaction monitoring coverage among others. 

Going forward

In 2024, we acknowledged the Wolfsberg factors  in our audit methodology. Going forward, FINTRAIL will be applying an updated audit methodology fully aligned with the Wolfsberg principles to ensure our reviews look for effectiveness of the programme and not just regulatory compliance.

How can FINTRAIL help?

At FINTRAIL we are passionate about combating financial crime. Our unique team of experts is drawn from the industries we support and has deep hands-on experience in developing and deploying risk management controls from leadership roles with leading banks, FinTechs, and other financial institutions. 

We have extensive experience assisting financial services businesses with audits and assurance processes. We have a proven track record of identifying areas where clients can enhance their compliance and make their programmes more effective. Our approach is:

• Tailored to the unique circumstances of each client

• Regulatory and technology driven

• Focused on providing excellent customer outcomes

We offer our clients pragmatic solutions to the most complex challenges and our goal is to ensure our clients can thrive, free from the negative impacts of financial crime.

If you wish to speak to our team about your requirements for an upcoming audit, please send us an email or get in touch via our website.

---

Hiring a New MLRO: How MLROs and Financial Institutions Can Find the Right Fit

As part of our commitment to supporting senior compliance leaders, FINTRAIL is publishing a series of articles based on interviews with current and former MLROs, designed to provide actionable advice to those holding the money laundering reporting function (SMF17).

We recently published a paper on best practice for managing regulatory enforcement actions, based on our own research and interviews with MLROs at UK payment firms. Our advice in that paper presupposes that a firm is genuinely committed to meeting its anti-financial crime obligations, wants to ensure its programme is fit for purpose, and has an MLRO who is up to the task. However, this may not always be the case, and the pressures for the MLRO will clearly be compounded if the firm is not interested in supporting them. Several interviewees stressed how important it is for MLROs to assess a company’s compliance culture before joining, to avoid falling subject to an avoidable enforcement action, or being in a toxic situation where they are left to shoulder the blame without adequate support.

Advice for would-be MLROs

For any regulated function with significant responsibilities, it’s vitally important applicants don’t get swept up in the recruitment process and take on a role without giving it serious thought.  Prospective MLROs should make the most of the recruitment process to ask the firm - and themselves - the right questions to ensure they don’t regret their decision in the long run.

Recognise this role isn’t for everyone. Be honest with yourself about whether you are ready for the responsibilities that come with being an MLRO.  There is clearly the risk of personal liability if things go badly wrong, but this can seem like an unlikely worst-case scenario.  What is more likely is that you will be personally responsible for facing off to the regulator to justify your firm’s programme and answer for any failings.  Are you happy to take on this responsibility?  Do you have the experience and knowledge to run a programme that successfully identifies and mitigates risk?  Especially if this role is a promotion or a significant step up that seems too good to be true, consider if it is and if you’re happy with what you’re taking on!

Interviews should be a two-way process.  Use them to ask meaningful questions about the firm’s compliance programme, resources, tone from the top, and compliance culture. If it doesn’t feel right, be prepared to walk away.

Do your due diligence. Where possible, look into the firm’s compliance history. Has there been significant turnover of MLROs and key compliance staff?  If so, ask about it during the interview process - there may be a reasonable explanation unrelated to the firm’s compliance performance or culture, but try to bottom this out.  Is senior management forthcoming and open about any previous regulatory engagement, or significant audit findings or self-identified gaps?  Do you know any former employees of the company or is there anyone in your network who can give you an off-the-record view?  As before, if you’re not comfortable with the answers you’re getting (or not getting) consider if you should walk away.

Advice for hiring firms

On the flip side, firms can avoid falling foul of the regulator by ensuring they have a suitable individual in the key position of MLRO, and that they offer them the support they need. A good MLRO can ensure the firm doesn’t come under regulatory pressure in the first place, or can self-identify and report issues to the regulator to ensure a less hostile process. In a worst case scenario, they can capably and successfully deal with difficult enforcement actions. 

Invest time and effort in finding the right person.  It can be very easy for early-stage companies in particular to underestimate the importance of the role of MLRO.  When resources and headcount are stretched, it’s tempting to focus on the business and engineering side, and try to secure relatively cheap compliance resources.  However, this is likely to be a false economy if you end up in hot water and have to devote significant time and money to remedial action and regulatory engagement later on.

Broaden your horizons.  Many firms, especially scale-up companies, look internally when they need to fill the role of MLRO, promoting someone from within the compliance team. This person will obviously have a good understanding of the business - and may be so happy with the promotion they’re not too demanding in terms of salary, or involvement in governance and senior level decision-making.  However, unless they worked very closely with the former incumbent and you have a clear plan for their personal development, they are unlikely to have the full range of skills and knowledge required of an MLRO.  Consider carefully whether such an individual will be the right fit, and how you will support and upskill them if you do fill the role internally.

Be honest. If you already know that your programme has issues, or you’re already subject to regulatory action, you need an MLRO who is comfortable managing this situation.  You may not be able to share specific details, but the more you can tell prospective MLROs about what they’re taking on, the more sure you can be that they're up for the challenge.  A small number of people even thrive on such situations - they essentially act as troubleshooters, repeatedly coming into firms in difficulty to overhaul the programme and get it back on an even keel.  Most candidates who have previously undergone a regulatory action will fall into two camps - either their experience will give them unrivaled insights and make them the ideal candidate, or they will be burnt out from their previous experience and have no desire to go through it again!  Don’t make assumptions - make sure they know what they would be taking on and find out how they would feel about it before offering them the role.

---

Financial Crime Training - More than a Tick Box Exercise

Staying on top of new regulations and emerging financial crime risks is a constant challenge for financial institutions. Firms must grapple with a steady stream of new sanctions designations, evolving fraud typologies and terrorist financing threats, and even entirely new regulatory regimes (looking at you, AMLA). This fast-evolving landscape is one reason why most regulators insist on ongoing training on financial crime.

One of the most common pitfalls for financial institutions is relying on an off-the-shelf training programme. There are a plethora of ready-made AML training courses available which tick the box for meeting basic regulatory requirements; however their generic nature means they barely scratch the surface of what you really need to understand. In order to turn training into a key tool in reducing your risk exposure and an opportunity to develop, firms are advised to consider more bespoke options.

FINTRAIL designs and delivers bespoke training sessions tailored to individual firms’ risk profiles, products, geographies and sectors.  Read on to find out why this matters…

The regulatory imperative

In many jurisdictions, financial service firms are obliged to provide financial crime training to their staff. In the UK, for instance, the Money Laundering Regulations set out specific requirements that regulated firms must meet:

• Firms must ensure relevant employees and agents are made aware of the law relating to money laundering and terrorist financing, and the requirements of data protection. 

• Employees must regularly be given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering, terrorist financing or proliferation financing.   

• Each firm must take account of the nature of its business, its size, and the nature and extent of the financial crime risks it faces.

Let’s take a look at what the regulations actually mean in terms of who needs what financial crime training and when.

One size does not fit all

The UK regulations define ‘relevant employees’ as anyone capable of contributing to the prevention or detection of money laundering, terrorist financing and proliferation finance or the identification or mitigation of the risk of these activities.  In other words, it’s not just the compliance team but also senior management and all sales teams, account managers and other customer-facing roles.  These different roles clearly face varying levels of exposure to financial crime risks and have different levels of existing knowledge.  As a result, financial crime training must be tailored to the specific needs of different employees’ roles and responsibilities.

• Company-wide training: Every employee, from administrative staff to the CEO, should have a basic understanding of financial crime risks. Company-wide training often covers general topics like definitions of anti-money laundering (AML), fraud prevention, and raising concerns. This level of training helps establish a culture of vigilance and ethical behavior across the organisation.

• Compliance teams: Those working in compliance or risk departments require in-depth training to ensure they can manage and monitor the firm’s anti-financial crime policies effectively. They need specialised knowledge of the firm’s obligations under applicable regulations, how to assess levels of risk exposure, how to fulfill KYC requirements and monitor customers’ behaviours, and how to report suspicious activity.

• Senior management and board members: Senior management has ultimate responsibility for the firm’s financial crime compliance framework. It is therefore critical they understand their role in governance and risk oversight, and are well-versed in how to design, implement, and review an effective financial crime risk management program. This level of training should focus on high-level decision-making, understanding risk assessments, and maintaining accountability.

By customising training based on an individual’s role, regulated firms can ensure that everyone has the knowledge and tools they need to meet regulatory obligations and protect the company from financial crime.

As well as company-wide AML training and advanced training for compliance teams, FINTRAIL has delivered bespoke training for senior management, project managers, embedded finance agents, and RegTech sales teams.

It’s not all about AML training

Good financial crime training covers a wide range of topics. The UK Money Laundering Regulations specifically call out money laundering, terrorist financing and proliferation finance, but it’s also vital to understand sanctions evasion, fraud, and bribery and corruption risks amongst others. The depth of coverage required for each topic will vary depending on the firm’s operations, size, and risk exposure - i.e. different firms will require different training content.

Many firms are increasingly choosing to go beyond the main topic areas above, to look at specific topics of relevance to their company or where they have identified particular knowledge gaps.  At FINTRAIL, we have produced and delivered bespoke financial crime training on:

• Financial crime risks for cryptocurrency

• Tax evasion

• Terrorist financing risks for FinTechs

• Tipping off

• Financial inclusion

• Far right extremism

• Building a compliant product

Financial crime training isn’t a one-time exercise 

Finally, the UK Money Laundering Regulations make it clear that it isn’t sufficient to provide training to new employees when they join a firm. Regulations change constantly, as do the financial crime threats a business faces, and the business’ activities and risk profile.  Staff therefore benefit from regular training - both to reinforce key messages and keep information fresh in their minds, and to keep them up-to-date with new regulations and risks.  For most firms, training takes place at onboarding, on an annual basis, and whenever there are significant changes to the regulatory environment or the company’s activities - e.g. if it expands into a new market or customer vertical, or begins offering a new product. Ad-hoc training can also be scheduled in response to identified knowledge gaps or areas of weakness.  

Hopefully this close review of the regulations shows the benefits of individualised financial crime training programmes over off-the-shelf courses. Firstly, a bespoke approach ensures that the training is relevant to your company’s specific needs, operations, and risk profile. A generic programme may not address the unique challenges your firm faces, leading to knowledge gaps that could expose you to regulatory and operational risks.

Secondly, bespoke training can lead to better engagement from staff. When training is tailored to their specific role and challenges, employees are more likely to find it valuable and retain the information. In turn, this can improve their ability to detect and report suspicious activities, strengthening your firm’s defenses against financial crime.

Lastly, bespoke training programmes demonstrate to regulators that your firm is taking its financial crime prevention responsibilities seriously. By designing a training programme that reflects your firm's unique risk profile and operational environment, you show a proactive commitment to regulatory compliance and ethical business practices.

If you would like to speak to FINTRAIL to learn more about how we can help you with your training requirements, please contact us.

Examples of our financial crime training projects

FINTRAIL was engaged by Finance Latvia, the industry association representing all major banks in Latvia, to deliver a financial crime training programme to CEOs and board members of Latvian banks. The training included a focus on balancing a risk-based approach with consumer duty obligations, and avoiding unnecessary de-risking.

FINTRAIL has worked with the Centre for Financial Crime and Security at RUSI on various financial crime training engagements, including terrorist financing and AML training throughout Europe. Most recently we have developed targeted training on Russia sanctions reporting requirements and detecting sanctions evasion for financial sector audiences in the Baltics, Denmark and the Netherlands.

FINTRAIL provided board-level senior management training for a banking services provider, designed to increase senior executives’ awareness of risks while scaling the business, and how to adopt a proportionate business-focused risk appetite.   It focused on financial crime risk assessments and risks related to downstream relationships, including an overview of controls and oversight of financial partners, as well as appropriate risk decisions.

FINTRAIL created and delivered three online AML training modules to staff of a European payments firm, focusing on suspicious activity reporting, transaction monitoring, and authorised push payment fraud controls. Each training module included exercises and case study examples to ensure engagement, and was bespoke to the client’s products and use cases.  FINTRAIL was subsequently asked to develop further training to their team in Q3 of 2024.

---

Reflecting on audit findings from H1 2024

While the first half of 2024 is still fresh in our minds, FINTRAIL has paused to reflect on our anti-financial crime (AFC) audits from H1 2024 to identify common findings and focus areas for regulated financial firms.

As always, the regulatory backdrop to these audits has continued to evolve. We have seen changes to the UK regulatory landscape with the introduction of new PEP requirements which came into force in January 2024 and the subsequent FCA consultation on its PEP guidance with updates to be released later this year. There has also been the implementation of the FCA’s 2024/2025 business plan including a commitment to reduce and prevent financial crime with a focus on consumer duty, fraud and financial inclusion. In Europe we have seen the introduction of the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) which aims to harmonise AML/CFT measures across the EU. The latter half of the year will also see some big changes with the UK Payment Systems Regulator (PSR) mandatory reimbursement requirements for victims of APP scams coming into force on 7 October 2024 and the introduction of the 6th AML Directive (AMLD) in Europe. 

Given the latest changes and pending updates, it is important for firms to stay up to date and continue to evolve and enhance their AFC frameworks. An external audit can help firms identify gaps or areas of weakness and ensure they stay on top of their regulatory requirements.

Key stats

• The majority of our critical findings related to customer and payment screening controls and anti-financial crime risk assessments.

• High-risk findings tended to relate to policies and procedures, and customer due diligence controls.

• The largest number of findings related to customer and payment screening controls.

Policies and procedures

The majority of our findings from the year so far relate to firms’ policies and procedures. In particular, we have repeatedly seen the use of generic policies and procedures that do not align to a firm’s specific product and services or its current systems and controls. For example, policies and procedures have not always been updated to reflect changes to third party systems used or new AML regulatory requirements, despite going through an annual review cycle. This mirrors the findings from the latest FCA ‘Dear CEO’ letter from March 2024 which identified a lack of detail in policies creating ambiguity around the actions staff should take to comply with their obligations under the Money Laundering Regulations. 

It is important for firms to ensure their policies and procedures are up-to-date and reflective of the controls and processes in place, particularly in instances where the documents are used for training new employees or are informing key control areas like internal SAR reporting.

Common gaps we have seen in firms' AML policies and procedures include: 

• No reference to proliferation financing

• Not reflecting the latest UK regulatory updates relating to the treatment of domestic PEPs

• No reference to Transfer of Funds regulations and the controls in place.

Governance 

In terms of governance, FINTRAIL has identified the following themes:

• Management information - In some instances firms have been unable to easily retrieve management information on their customers and key controls (e.g. number of customers, average number of transaction monitoring alerts, number of SARs, number of open customer screening alerts). It is important for firms to be able to pull this data for the purposes of reporting, tracking against the firm's risk appetite, and understanding key performance indicators (KPIs) and key risk indicators (KRIs) to help drive decisions across the firm.  

• Resourcing - We have seen many firms operating a lean AFC team structure, which is aligned to their business model, risks and stage of maturity. However, firms should consider or have in place a resource management plan which identifies the trigger points for hiring additional resources or reshuffling existing capacity. This ensures that resourcing is managed effectively as the firm scales and there is no last minute panicked hiring of resources. 

• Record keeping - FINTRAIL noted in many instances that the storage of KYC information was unorganised and inconsistent. This includes information saved in different folders which means there is no single view of customer information. Likewise, it was difficult to obtain closed screening or transaction monitoring alerts which meant there was no evidence of alert dispositioning. It is important for this information and any associated decision-making to be easily retrievable on the customer’s file in the event of a law enforcement enquiry, or regulator or auditor request.

Risk assessments

Another key focus area for the FCA this year is business-wide risk assessments (BWRA). The FCA review found that in some instances money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risk assessments had not been carried out at all, and in other instances firms had failed to document the steps undertaken to identify and assess the ML/TF/PF risks. 

Similarly, at FINTRAIL we have identified these common findings relating to firms’ BWRAs:

• Firms are not documenting their risk assessment methodology comprehensively, particularly in relation to how they calculate residual risk. Often this calculation appears very subjective and excludes a quantitative element. 

• Firms are grouping and amalgamating various financial crime risks into one within their risk assessments, not taking into account the differences between the TF, ML and PF risk exposure to the business. 

• Firms lack a control library and appear to be amalgamating controls for the purpose of the risk assessment, which is not always reflective of the control effectiveness or how effectively individual controls are mitigating the inherent risk. 

• Firms are not referencing the sources they use to conduct their risk assessment, taking into account internal data and external factors such as the UK National Risk Assessment.

In relation to customer risk assessments, FINTRAIL has identified the following common themes:

• It is not always clear what specific risk factor is being considered in the risk assessment. For example, we tend to see many firms capturing ‘geography’ as a risk factor but it is unclear what specifically this relates to, i.e. residency of UBO, country of incorporation, or transactional activity. The lack of granularity could influence the overall risk rating of the customer, meaning it is not reflective of the actual risk posed. 

• Firms tend to rate each risk factor equally, which does not always best reflect the customer's actual risk. This could lead to a skewered book of customer risk or an ineffective use of the manual override function. 

Additionally, we have seen multiple occasions where a firm's country risk rating list is not up to date (i.e. not updated with the latest high-risk third countries) and therefore feeds into other control areas incorrectly, such as customer risk assessments or transaction monitoring. This means country risk is not being monitored effectively, potentially exposing firms to countries with high financial crime risk exposure.

Customer due diligence

FINTRAIL observed that most firms are implementing effective customer due diligence controls at onboarding. Across most audits, there has been clear documentation for the customer due diligence process and clear instructions for the onboarding team to implement.

One area where we see firms struggle is the KYC refresh process where there are often backlogs due to both poor customer response time and operationally cumbersome processes which divert resources away from other priority areas. There are often no clearly defined timelines built into the KYC refresh process, or clearly defined outcomes and actions taken in the event of no response from the customer. These areas are critical to build out to ensure the customer is notified with ample time to respond, there are clear ‘request for information’ protocols and schedules of correspondence, and clear timelines and actions in the event of no response from the customer. This is to ensure firms are collecting KYC information in a timely manner and that customer information is up to date. 

Another area of focus relates to firms offering downstream services to other financial institutions or payment service providers. In particular we have seen that these firms have not clearly documented their reliance, oversight or outsourcing framework to ensure the effective oversight of these inherently higher risk relationships. Additionally, for these types of relationships we have seen that firms are not factoring in their clients’ AML/CTF control frameworks in the customer risk assessment.

Suspicious activity reporting

Mainly identified through file review sessions, FINTRAIL has noted that internal SARs and investigationsdo not always clearly reference reasons for suspicions. In many instances the team could verbally articulate the reasons for suspicion, but there was little documented evidence of this within the internal SAR and investigation notes. This could affect the quality of the external SARs submitted to authorities. The quality of external reporting has been a focus area for many firms in line with Principle 3 on ‘Providing highly useful information’ of the Wolfberg Group’s Principles of Effectiveness. 

Screening

The majority of our critical findings in H1 related to firms’ screening controls, particularly ongoing customer screening. In some instances we have seen firms not conducting ongoing customer screening or being unable to demonstrate this. This is often a result of firms not understanding their third party tooling settings or being unaware that their tools have this functionality. 

Fraud 

In light of the PSR’s policy changes coming into play later this year, we have seen many firms make an effort to get their APP fraud controls into shape ahead of the October enforcement date. With that said, while firms have made appropriate updates to their fraud frameworks, there is often little evidence of documentation of these controls. Additionally, fraud risks and anti-fraud controls do not appear to be documented within firms’ risk assessments. Given the FCA’s focus on consumer duty and fraud this year, this should be a focus area for many firms. 

Compliance monitoring

We have seen from our audits this year that compliance monitoring is last on many firms’ to-do lists. While some companies have a documented compliance monitoring plan, it is rarely implemented due to resourcing, time or priority constraints. This is particularly the case for smaller firms which lack dedicated assurance resources. 

How can FINTRAIL help?

At FINTRAIL we are passionate about combating financial crime. Our unique team of experts is drawn from the industries we support and has deep hands-on experience in developing and deploying risk management controls from leadership roles with leading banks, FinTechs, and other financial institutions. 

We have extensive experience assisting financial services businesses with audits and assurance processes. We have a proven track record of identifying areas where clients can enhance their compliance and make their programmes more effective. Our approach is tailored to the unique circumstances of each client, is regulatory and technology driven, and is focused on providing excellent customer outcomes. We offer our clients pragmatic solutions to the most complex challenges and our goal is to ensure our clients can thrive, free from the negative impacts of financial crime.

If you wish to speak to our team about your requirements for an upcoming audit, please get in touch.

---

Navigating New FCA Guidance on Politically Exposed Persons (PEPs)

The treatment of UK politicians within the financial services sector has sparked political debate and generated media headlines over the past year, particularly in the wake of the Nigel Farage-Coutts scandal (see ‘Timeline of events’ below).  In response, the UK regulator, the Financial Conduct Authority (FCA), has called on UK financial services firms to improve the treatment of Politically Exposed Persons (PEPs).  With financial institutions’ management of PEPs subject to heightened scrutiny and new regulatory requirements, FINTRAIL summarises the key takeaways from the FCA’s latest guidance.

1. Timeline of events
2. What is a Politically Exposed Person?
3. Summary of the FCA PEP Guidance
4. Recent changes to the UK Money Laundering Regulations
5. Findings from the ‘Treatment of PEPs’ review
6. Watch this space

---

Timeline of events

• July 2017 - The FCA releases its original guidance on PEPs (Finalised Guidance - FG 17/6 - The treatment of politically exposed persons for anti-money laundering purposes”) under regulation 48(1) of the Money Laundering Regulations., detailing how financial service firms should treat customers who are PEPs when meeting their AML obligations. 

• June 2023 - The UK private bank Coutts closes the account of British politician Nigel Farage. Farage claims the decision is politically motivated and files a Subject Access Request, which reveals the decision was made for reputational risk reasons and perceptions his views are ‘xenophobic and racist’.  The case causes a political and media debate, and Chancellor Jeremy Hunt contacts the FCA regarding an urgent investigation into whether politicians are being debanked or denied services because of their status.

• September 2023 - The FCA launches a multi-firm review on the treatment of PEPs, contacting 1,000 PEPs (from whom it receives 65 responses) and 15 financial service firms. 

• December 2023 - The UK government announces changes to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 in relation to the treatment of PEPs entrusted with prominent public functions in the UK (referred to as “domestic PEPs”).  These changes come into force on 10 January 2024. (See FINTRAIL’s post on “PEP Guidance Reflecting Recent UK Regulatory Changes”)

• July 2024 -The FCA publishes its final review, setting out its findings on how effectively firms are following the FCA guidance on PEPs. It also launches a guidance consultation (GC24/4) on proposed amendments to the FCA PEP guidance which is open for consultation until 18 October 2024.

---

What is a Politically Exposed Person?

Under the UK Money Laundering Regulations (‘MLRs’), firms are required to have appropriate risk management systems and procedures to determine whether a customer or the beneficial owner of a customer is a PEP (or a family member or known close associate of a PEP) and to manage the risks arising from this relationship. 

Most national definitions of a PEP stem from the Financial Action Task Force (FATF) recommendations on anti-money laundering which define PEPs as individuals entrusted with a prominent public function. The FCA guidance states that the definition of a ‘prominent public function’ will vary according to the nature of the function held by a person; but firms are expected to understand the nature of the position held and consider whether it gives rise to the risk of large-scale abuse of position. 

What is a prominent public function?

In line with the UK MLR’s Regulation 35(12)(a) PEPs are defined as individuals entrusted with prominent public functions, including:

• Heads of state, heads of government, ministers and deputy or assistant ministers

• Members of parliament or similar legislative bodies including regional governments in federalised systems and devolved administrations, including the Scottish Executive and Welsh Assembly, where such bodies have some form of executive decision-making powers. It does not include local government in the UK but it may, where higher risks are assessed, be appropriate to do so in other countries.

• Members of the governing bodies of political parties. The FCA considers this only applies to political parties who have some representation in a national or supranational parliament or similar legislative body. The extent of who should be considered a member of a governing body of a political party will vary according to the constitution of the parties, but will generally only apply to the national governing bodies where a member has significant executive power (e.g. over the selection of candidates or distribution of significant party funds). 

• Members of supreme courts, constitutional courts or any judicial body the decisions of which are not subject to further appeal except in exceptional circumstances - in the UK this means only judges of the Supreme Court. Firms should not treat any other member of the judiciary as a PEP and only apply EDD measures where they have assessed additional risks.

• Members of courts of auditors or of the boards of central banks

• Ambassadors, charges d’affaires and high-ranking officers in the armed forces. The FCA considers this is only necessary where those holding these offices on behalf of the UK government are at Permanent Secretary/Deputy Permanent Secretary level, or hold the equivalent military rank (e.g. Vice Admiral, Lieutenant General, Air Marshal or senior)

• Members of the administrative, management or supervisory bodies of state owned enterprises. The FCA considers this only applies to for-profit enterprises where the state owns 50% or more or where readily available information points to the state having control over the activities of such enterprises.

• Directors, deputy directors and members of the board or equivalent function of an international organisation. The FCA considers that such international organisations only include international public organisations such as the UN or NATO. This definition does not extend to international sporting federations.

What is not a prominent public function?

• The FCA guidance makes clear that public servants below Permanent or Deputy Permanent Secretary should not be assessed to have a prominent public function. 

• The definition excludes individuals who are ‘junior or mid ranking’. However, firms can assess whether middle ranking or more junior officials could act on behalf of a PEP and therefore pose an elevated risk.

The UK MLRs define family members of PEPs as: (1) spouse or civil partner of a PEP (2) children and their spouses or civil partners, and (3) parents.  NB: The FCA guidance also includes siblings in the definition of family members.  A proportionate risk-based approach should be used for family members falling outside the regulatory definitions (e.g. aunts and uncles); it may be appropriate to include a wider circle of family members in cases where the PEP poses a higher risk.

The MLRs define close associates as: (1) individuals known to have joint beneficial ownership of a legal entity or a legal arrangement or any other close business relations with a PEP, and (2) an individual who has sole beneficial ownership of a legal entity or a legal arrangement which is known to have been set up for the benefit of a PEP.

---

Summary of the FCA PEP Guidance

Due to the nature of politicians' roles, there is an increased risk that they or their family members and close associates may be involved in bribery and corruption. This should be managed through senior management oversight, risk management measures and enhanced due diligence (EDD) as follows:

1. The firm must have in place procedures to identify whether a customer or the beneficial owner of a customer is a PEP or a family member or a known close associate of a PEP. 

A useful starting point for firms is to clearly set out the definitions of PEPs, family members and RCAs which align to the definitions within the FCA PEP guidance. They should ensure these definitions are used to assess an individual's role and determine whether they are a true PEP at onboarding and if their status changes during the customer relationship. 

The firm should also define how long a customer is considered a PEP once they have left public office.  This should ideally be risk-based depending on the role and risk posed. There should be mechanisms in place to identify when an individual steps down from a public function to ensure they are not treated as a PEP for longer than necessary. 

Per the MLRs, individuals should be subject to risk-based EDD for at least 12 months after the date they cease to be entrusted with a public function. This does not include family members who should be treated as ordinary customers from the date the PEP leaves office.

2. The firm must have in place appropriate systems and procedures to assess the level of risk associated with PEP customers and the extent of EDD measures that need to be applied to manage the enhanced risks arising from the customer.

The firm should apply a risk-based approach to identifying PEPs and apply EDD where relevant. The customer risk assessment should consider all factors relevant to the customer risk and not just PEP status; this will provide an accurate representation of the risk posed by the PEP customer and make it clear what causes a PEP to be high risk.

3. Where a PEP (or a family member or a known close associate) relationship is identified, the firm must:

• Obtain senior management approval for establishing or continuing the business relationship with that person

• Take adequate measures to establish the source of wealth and source of funds which are involved in the proposed business relationship or transactions with that person

• Conduct enhanced ongoing monitoring of the business relationship with that person.

---

Recent changes to the UK Money Laundering Regulations

Since 10 January 2024, the MLRs have been amended to state that the starting point for the assessment of domestic PEPs should be lower risk than a non-domestic PEP, and EDD shall only be applied in the event that other higher risk factors are present. Some indicators of lower or higher risk factors are described below.

Lower risk factors

Product - The customer is seeking access to a product which poses a lower risk as defined by the firm’s risk assessment.

Geographical - The customer is entrusted with a prominent public function in the UK and is therefore considered a ‘domestic PEP’, or is a PEP in a country with similar lower levels of corruption and  misconduct, and similar political stability. If there are other risk factors present then the individual may be considered higher risk.

Personal and professional - The customer does not have executive decision-making responsibilities or is subject to rigorous disclosure requirements.

Higher risk factors

Product - The customer is seeking access to a product which poses higher money laundering risks and is capable of being misused to launder the proceeds of large-scale corruption.

Geographical - The customer is entrusted with a prominent public function in a country considered to have a higher risk of corruption or political instability and weak AML defences.

Personal and professional - The customer’s personal wealth or lifestyle is inconsistent with their known legitimate sources of income or wealth, there are credible allegations of financial misconduct, or the customer is in a position of responsibility or has greater ability to influence decisions.

The table below highlights measures that firms can take depending on the specific risks posed by the individual in question. A firm may decline a relationship with a PEP where it has concluded the risks posed by a customer are higher than they can effectively mitigate.

Measures to take in lower risk situations 
This could apply for domestic PEPs with no other high risk indicators

Source of wealth and source of funds - Less intrusive and exhaustive steps to establish source of wealth and source of funds (e.g. using publicly available information).

Adverse information - Standard adverse media screening or other checks in line with other lower risk customers.

Oversight and approval - At a level less senior than the board of directors (e.g. the  MLRO).

Ongoing monitoring - The business relationship is subject to less frequent formal review (e.g. in line with the regular KYC refresh cycle for updating customer information or when the customer requests a new service or product). 

Measures to take in higher risk situations 
This could apply to non-domestic PEPs or domestic PEPs with other high risk factors present

Source of wealth and source of funds - More intrusive and exhaustive steps to establish the source of wealth and source of funds, such as requesting detailed information and documentary proof from the customer.

Adverse information - More comprehensive adverse media checks (e.g. more thorough open source research as well as standard automated screening), or specially commissioned due diligence reports.

Oversight and approval - At a more senior level of management (e.g. the board of directors).

Ongoing monitoring - The business relationship is subject to more frequent and thorough formal review to determine whether it should be maintained (e.g. annual review).

---

Findings from the ‘Treatment of PEPs’ review

From September 2023 to July 2024, the FCA conducted a review of firms' approaches to PEP customers to assess whether they were correctly applying its PEP guidance. The findings included the following:

• Defining PEPs - some firms included definitions for PEPs and RCAs that were not in line with the regulations and the FCA guidance. 

• Conducting proportionate risk assessments - a small number of firms were not effectively considering the customer’s actual risk in the assessment and risk rating.

• Applying EDD and ongoing monitoring proportionately and in line with risk - some firms’ policies and procedures and customer file testing showed that they were regularly applying “excessive” EDD.

• Deciding to reject or close accounts for PEPs, family members and known close associates - firms were clear that they would not decline products or services to UK PEPs or their RCAs simply because of their PEP status. 

• Effectively communicating with PEP customers - some firms need to improve the clarity and detail of communications with PEP and RCA customers, especially providing more detail in their requests so that customers can understand what they are being asked to do and why. 

• Keeping PEP controls under review to ensure they remain appropriate - some firms need to ensure they update their policies to reflect the legislative developments and recent amendment to Regulation 35 of the UK MLRs.

---

Watch this space

The FCA is now consulting on proposed amendments to its PEP guidance, to follow up on its Treatment of PEP review. It is seeking feedback on three key areas:

1. Non-executive board members (NEBMs): NEBMs are appointed to government departments from the public, private and voluntary sectors. As their role is to provide advice and bring an external perspective, NEBMs do not have any executive authority. As such, the FCA is proposing to clarify in its guidance that these roles should not be considered as PEPs in the UK context.

2. Sign-off: Under the MLRs it is a requirement that all PEP relationships are signed off by senior management. The FCA guidance sets the expectation that all PEP relationships should be signed off by the MLRO at a minimum with higher risk relationships potentially signed off at a higher level. Industry feedback indicates this part of the guidance causes concerns about the MLRO’s independence. As such, the FCA is proposing to amend the guidance to allow for alternative approaches to sign-off provided the MLRO maintains oversight of all PEP relationships within the firm. 

3. Regulatory changes: The FCA proposes making targeted amendments to reflect the legislative change that firms should treat domestic PEPs as lower risk unless there are other apparent risk factors unrelated to their PEP status.

Important links

• FINTRAIL’s PEP guidance reflecting recent UK regulatory changes

• FINTRAIL’s PEP guidance checklist 

• The FCA’s multi-firm review on the treatment of Politically Exposed Persons

• Proposed amendments to the FCA PEP Guidance

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programme. We have extensive experience in creating robust policies and procedures, refining and testing systems and processes, and providing context-based training. Get in touch to find out how we can help you refine your enhanced due diligence measures and incorporate an effective risk strategy for PEPs.

Balancing compliance and compassion: Identifying and supporting vulnerable customers

Financial crime compliance is a complex mix of protecting financial institutions, their customers and society at large from involvement in criminal activity.  Within this wide scope, there is one group which requires particular attention: vulnerable customers. This blog will look at the regulatory meaning of this term, why it’s important to understand various types of vulnerability in the financial landscape, and what fincrime compliance officers need to think about.

Vulnerability can stem from a multitude of factors including age, mental or physical health, financial literacy, or life events such as divorce or bereavement. The 2020 Financial Lives Survey found that 46% of UK adults (that’s 24 million people!) showed one or more characteristics of vulnerability. According to a recent survey by NICE International, about 17% of customers in the UK self-identify as vulnerable, while as many as 67% of customers could potentially be classified as vulnerable when assessed against the Financial Conduct Authority’s (FCA) criteria.

According to the FCA, a vulnerable consumer is “someone who, due to their personal circumstances, is especially susceptible to detriment, particularly when a firm is not acting with appropriate levels of care”.

Understanding vulnerability

Below are the FCA’s four drivers of vulnerability along with their associated characteristics:

An elderly individual navigating complex investment schemes, a college graduate drowning in student debt, or a recently widowed single parent juggling bills with a meagre income. Any customer could require additional assistance, but certain situations increase the likelihood of this need. Vulnerable customers are not just statistics; they're real people facing real challenges.

According to a recent survey by the Vulnerable Registration Service, where vulnerability exists, exploitation often follows. Criminals capitalise on the weaknesses of vulnerable customers through fraud schemes, misleading lending practices, coercive tactics or embroilment in money muling - using deceptive or coercive tactics at a time when their victims’ defences are weakened.  It is an unfair situation where the most vulnerable people end up suffering the most.  And the repercussions of financial exploitation extend far beyond monetary loss, leading to a lack of trust in banks and severe emotional stress.

Consumer Duty: Safeguarding the vulnerable

The FCA stresses the importance of protecting vulnerable customers through its guidance and consumer duty principles. Financial institutions must ensure good outcomes for all consumers, especially those who are vulnerable. They need to identify vulnerable customers, understand their needs, and provide appropriate support including risk assessments and tailored assistance. The Consumer Duty requires senior management to embed these principles into their business practices and demonstrate how they put customer well-being at the heart of their decisions and business strategies.

This approach aims to protect consumers and build trust and confidence within the financial services sector. By adopting the Consumer Duty principles and focusing on transparency, accountability and fairness, firms can provide a positive experience for customers and achieve long-term success in a competitive market. This means carefully monitoring customer results, using feedback systems, and constantly updating practices to meet changing customer needs.

How to identify and support vulnerable customers

To identify vulnerable customers, both interactions with customers and more technological methods such as data analytics can be used. Signs of vulnerability can be detected through transaction analysis, including:

1. Erratic spending

2. Frequent late payments

3. Other patterns that deviate from the customer’s usual behaviour

This monitoring can supplement, and be supplemented by, the work of trained customer service teams who can learn to identify signs of vulnerability such as confusion, stress or difficulty understanding financial products through behaviour, communication patterns, and customer disclosures.

Once firms have identified vulnerable customers, creating dedicated support teams and performing regular account reviews are essential steps in preventing exploitation. When a customer is at particular risk of fraud, for instance, quick and decisive actions are crucial — this includes freezing suspicious transactions before money is lost. Throughout any subsequent investigations, firms must communicate clearly with the customer, and can consider offering financial education and guidance to help them avoid future attacks and rebuild their financial security.

Vulnerable customers may also struggle with firms’ standard procedure and controls. They may not have valid forms of identification, or may not be able to use automated identity verification solutions. In such cases, alternative documents and manual options such as submitting physical documents or using phone or video calls should be provided to ensure inclusivity. Good examples of using alternative identification processes are given in the FCA Handbook. Customer service representatives should be trained to guide customers through these processes and offer comprehensive support, ideally with a choice of phone, email, and live chat, as well as in person where possible.

James Nurse, Managing Director at FINTRAIL, recently shared his insights on BBC Radio 4's MoneyBox programme. He commented on the case of an elderly couple who had trouble meeting due diligence requirements. Despite their efforts, their account was closed because they were unable to provide an updated photo ID or passport. The story highlights the needs for clear guidance on the use of non-standard identity documentation to help vulnerable people who don't have the usual documents needed to access banking and financial services.

FCA evaluation

Currently, the FCA is engaged in an open evaluation concerning the treatment of vulnerable customers by financial firms. In May it issued a 40-part questionnaire asking for information on how financial services firms identify vulnerable customers, and how they design products and communications to meet client needs and measure outcomes. The assessment seeks to gauge the efficacy of current practices and policies, and will assess whether the outcomes experienced by vulnerable consumers are equitable compared to those of others.

By scrutinising firms' treatment of vulnerable customers, the FCA aims to identify any shortcomings or areas for improvement within the industry and to drive positive change that enhances the overall experience and outcomes for vulnerable individuals. The findings of this review, expected to be published by the end of 2024, will likely inform future regulatory guidance and initiatives aimed at promoting greater inclusivity and protection within the financial services sector while maintaining appropriate financial crime controls.

Conclusion

Financial services firms must understand the unique risks of money laundering and fraud vulnerable customers face, and how their fincrime controls may inadvertently discriminate against such customers. They need to evaluate the effectiveness of a range of control mechanisms, both traditional and innovative, to find a balanced solution. This requires strong risk management tailored to the specific needs of vulnerable individuals. By doing thorough assessments and implementing tailored controls, they can better protect the financial well-being and security of these customers while mitigating financial crime risks appropriately.

At FINTRAIL, we leverage our deep financial crime risk management expertise to support clients in treating vulnerable customers effectively. We help our clients:

• Create robust policies and procedures

• Refine and enhance their your systems and processes

• Reduce fraud exposure

• Engage in targeted training

Our approach includes identifying and mitigating risks relating to vulnerable customers, and ensuring their protection through flexible yet robust controls.

---

If you’d like to find out more about our services, please get in touch.

300 members and counting!

The FinTech FinCrime Exchange (FFE) is celebrating an important milestone - we’ve reached over 300 member firms! 🥳 The FFE was originally set up by FINTRAIL as a small roundtable, and has grown from strength-to-strength to become the leading compliance network for FinTech professionals. We’ve taken part in public-private partnerships with Europol, the National Economic Crime Centre and others; produced our own podcast (then again, who hasn’t?!); chaired round tables and written industry guidance papers; and put on one of the industry’s most popular conferences: FFECON! And we couldn’t have done it without all our amazing members. 🥰

What is the FinTech FinCrime Exchange?

The FFE is a global network of FinTechs brought together by FINTRAIL collaborating on best practices in financial crime risk management. Member firms cover the whole FinTech ecosystem - payments and retail banking, investment, lending, cryptocurrency, and banking-as-a-service. We currently have members from 43 different jurisdictions around the world. 🌍

Origins of the FFE

FINTRAIL began the FFE as an ad-hoc roundtable with just six companies back in January 2017.  FINTRAIL had noticed that several clients were experiencing the same financial crime typology, and wanted to create a way for them to share this information and ideas for effective counter-measures. The idea proved so popular that FINTRAIL then set up the FFE as a permanent community, with regular physical meet-ups in the UK, Singapore and the USA. These meet-ups naturally became virtual in 2020 due to the COVID pandemic, allowing more firms from other parts of the world to participate. We now blend in-person meetings and social events with virtual meet-ups and webinars to make the best of both worlds for all our members.

Why the FFE is special

One of FINTRAIL’s key motivators for establishing the FFE was the obvious need for a dedicated compliance organisation for FinTechs. FinTechs comprise a key part of the financial ecosystem but are often excluded from forums reserved for established, larger financial institutions (such as JMLIT in the UK). In addition, they often cannot afford the costs of involvement with professional bodies. So the FFE was founded to offer a unique, totally free network for digital-native, innovative firms to collaborate and share their insights and knowledge to fight financial crime together. 💪

Don’t just take our word for it - hear what our members have to say!

What we have planned next

We may have hit 300, but have no intention of stopping here!  We’re going to continue to grow the FFE membership, especially by expanding in particular subsectors and new geographies.  We also want to spread awareness of the power of the FFE within current member firms, to make sure all teams - financial crime, fraud, KYC operations etc. -  can make the most of their membership.

We are taking a pause on hosting FFECON this year, but have an exciting calendar of events lined up in its place. For instance, FINTRAL and the FFE are hosting a series of senior leaders round tables focusing on topics of keen interest to participants, such as consumer duty and APP fraud.  We’ll also be putting on social events to bring the whole London-based community together.  🎉

How to get involved

If you hold a financial crime compliance role at a FinTech and you’d like to get involved, you can apply to become a member today. Be sure to follow us on LinkedIn too to keep up-to-date with what’s going on. If you want to learn more about the community and our activities, check out the FFE’s website page or contact us at ffe_admin@fintrail.com.

You can also learn more about FINTRAIL and the people behind the initiative here. 

Anti-financial crime audit benchmarking

You asked: “How does our AFC audit compare to our peers?” and “What are the common themes you see in audits?”

We answered….

When conducting anti-financial crime (AFC) audits, our clients often look to understand how their results compare to peer firms across the industry. In fact, when we shared our common audit findings in our ‘Priorities for 2024’ webinar, we fielded a number of questions on what typical audit findings tend to uncover, to help firms understand if they are doing better or worse than average. To assist firms in understanding how their audit compares to other firms, FINTRAIL audit reports now include peer benchmarking for our larger audits.

While there are certainly no ‘one-size-fits-all’ audit results, having looked back over our audits for the past 12 months we have seen similar findings cropping up repeatedly across firms. And when you compare these to a summary of last year’s findings from the Financial Conduct Authority’s (FCA) Priorities for Payment Firms and the European Banking Association’s (EBA) Report on ML/TF risk associated with Payment Institutions, there are common themes from a regulatory perspective that align with what we see in practice when conducting audits.

The table below compares the feedback shared by the key regulatory bodies alongside common findings from FINTRAIL’s audits by thematic areas. Any firm subject to an AFC audit in 2024 should look at these findings against their control framework, assess if any of them could be relevant to their business and consider if they need to embark on any remedial work before their next audit.

When you compare the feedback from regulators with the analysis we have undertaken across the audits we have conducted, we see the same areas consistently appearing in our audit findings. Screening, CDD, governance, risk assessment and transaction monitoring are the control areas where we see the highest number and highest severity of findings. While this observation does not diminish the importance of findings in other areas - e.g. assurance or training - it does reflect that firms often still struggle with the effectiveness of core control areas.

FINTRAIL’s peer benchmarking can compare how your control areas map against peers in the industry and use an audit score reflecting the number of recommendations and the priority level to show where your firm sits in comparison to similar firms. The graph below is an example of how this is portrayed within our audit report. The blue columns represent the average number of findings weighted by priority level across all audits FINTRAIL has conducted over the last 18 months. The black dotted line represents where your firm sits. If your audit findings fall within the blue columns, your firm is in line with, or exceeding, industry standards. If they fall above this, this indicates areas that should be a key focus for your firm.

Whether it is used for your own personal insight, or to include in the audit report you provide to your board or banking partners, this snapshot of your firm compared to your peers can be a powerful indicator of the effectiveness of both the individual components of your control framework, and the framework as a whole.

With the FCA announcing that it will deploy “greater assertiveness in preventing those who can’t or won’t meet [their] standards entering into or remaining in the regulated sector”, the power of an audit in improving a financial crime framework, while also strengthening your position in future regulatory engagement, is immense.

---

At FINTRAIL, we conduct both enterprise-wide financial crime audits and targeted assessments of specific controls or risk areas. These reviews can cover the full gamut of financial crime risks, with particular focus on AML, terrorist financing, sanctions evasion, and fraud.

Anti-Financial Crime Developments and Priorities for 2024

There is never a dull year in anti-financial crime, and 2023 was certainly no exception. From the introduction of the UK’s Economic Crime Bill, to new crypto laws including the EU’s regulation on markets in crypto-assets (MiCA), a global raft of sanctions against Russia, and legislative attempts to rein in the global fraud pandemic, there’s been plenty to keep on top of. 

It’s early days, but there seems no reason to believe 2024 will be any different.  We are already aware of several pieces of legislation due to come into effect this year, and various regulators have clearly signposted their current areas of focus via guidance notices and consultations with the industry.  So let’s read the tea leaves and see what financial institutions can expect in 2024!

---

FINTRAIL held a webinar on financial crime trends for 2024, and asked the audience what their main areas of focus were for the year ahead. This is how they responded at the end of the session.

Poll: What are your priorities and main areas of focus for 2024? Please select all applicable answers.

---

Fraud

Fraud is big global news. In the UK, for example, criminals stole over half a billion pounds in the first six months of 2023 alone¹. Traditional methods of deception are as popular as ever, and are being complemented by increasingly sophisticated cyber-attacks and intricate social engineering schemes. 

While regulators everywhere are acutely aware of the issue, the UK is leading the way in terms of a regulatory response.  In 2023, the Payment Services Regulator (PSR) undertook a multi-pronged approach to reduce authorised push payment (APP) fraud within the Faster Payments System, which is due to continue into 2024.  Here’s what to look out for: 

• New mandatory reimbursement requirements, announced in June 2023, are due to come into effect in October 2024. These will require both sending and receiving payment institutions to reimburse all victims of APP fraud in full based on a 50/50 split, with limited exceptions for fraud or gross negligence. Read more in our blog here.

• In 2024 the PSR will be publishing “league tables” of performance on APP fraud in 2023.  Last year’s report on 2022 data called out inconsistent outcomes for victims, and highlighted that certain receiving institutions took in a disproportionate volume of funds derived from APP fraud.  Expect to see more scrutiny of these areas in the 2024 report. Read more in our blog here.

• The coverage of the Confirmation of Payee scheme will be extended in October 2024, with all financial institutions that participate in Faster Payments or CHAPS required to implement the tool.

In other fraud news:

• The UK government launched its national Fraud Strategy in May 2023, which aims to reduce fraud by 10% on 2019 levels by December 2024.  The various measures announced under the strategy - such as a new national fraud squad, replacing Action Fraud with a new reporting system, cracking down on abuse of the telephone network, and engaging the tech industry - are ongoing.  Separately, the Home Affairs Committee inquiry into fraud launched in September 2023 will publish its results sometime this year.

• The FCA issued several guidance documents² on fraud in 2023, which implicitly set out what firms will be judged against in 2024.  The guidance highlighted issues with detecting and preventing money mules due to poor onboarding controls, transaction monitoring, training and governance; poor complaint handling; and poor understanding and response to customer vulnerability.

• A new corporate failure to prevent fraud was introduced in 2023 as part of the Economic Crime and Corporate Transparency Act. The offence is expected to come into force once the government has published guidelines in Spring 2024.
  

Anti-fraud measures are also being taken in other jurisdictions, albeit not at the same scale as in the UK.

• In the EU, the introduction of PSD3 revisions forecast for late 2024 will extend IBAN/name matching verification to all credit transfers, introduce an obligation for payment service providers (PSPs) to increase awareness of payment fraud among customers and staff, and establish a legal basis for PSPs to share fraud-related information in full respect of GDPR via dedicated IT platforms.  

• In the US, federal requirements to report company ownership to FinCEN’s Beneficial Ownership Information Registry went live on 1 January 2024, pursuant to the 2021 Corporate Transparency Act.  It is hoped this will increase corporate transparency and help reduce fraud.

• While there is no proposal on the horizon in the US for an accountability model or a common reimbursement scheme, the biggest US banks decided to begin refunding Zelle scam victims last year, a trend towards collective action which we could see reflected elsewhere alongside a push for greater consumer protection.

Sanctions

The various geopolitical events of 2023 played themselves out in the sanctions world, with new legislation and designations issued in relation to Russia, Hamas, Sudan, Iran and others.  Human rights violations, narcotrafficking and crypto scams were also all in the spotlight. 

• OFSI’s annual report for the financial year 2022 to 2023, published in December 2023, revealed that despite imposing “the most severe sanctions the UK has ever imposed on any major economy”³ on Russia, recording 473 suspected breaches and opening 172 investigations by April 2023, there has so far been zero enforcement for post-February 2022 sanctions breaches in relation to Russia. We predict 2024 will be a more active year for enforcement, as some of those investigations bear fruit.  

• We also predict continuing cooperation between OFSI and the FCA, with the former focusing on enforcement and the latter on ensuring effectiveness. The FCA conducted a targeted assessment of firms’ sanctions controls in 2023 and shared the good and bad practices observed⁴, which will likely form a benchmark for regulatory reviews in 2024.

• In the EU, we predict a push towards standardised enforcement across member states in 2024.  We understand states with a “less mature” track record of sanctions enforcement are being given firm instructions to up their game, as well as training and guidance to help them do so.

• In the US, we predict more of the same from OFAC in terms of the nature of sanctions regulations and enforcement, with the upcoming presidential election likely to shape the strategic priorities. 

• In December 2023, OFAC issued an Executive Order expanding the US’s ability to target financial institutions outside of Russia that facilitate transactions involving Russia’s military-industrial base.  We should see in 2024 how the US intends to use this new measure and whether it will be a significant weapon in its sanctions arsenal, and which Russia-tolerant countries are in the crosshairs.

PEPs

In 2023 the concept of Politically Exposed Persons (PEPs) entered the public consciousness in the UK like never before, with the scandal surrounding the closure of Nigel Farage’s bank account at Coutts and a subsequent review by the FCA into whether PEPs are being routinely denied access to financial services.  

Meanwhile we saw corruption scandals involving PEPs continue to emerge around the world, including two former Latin American presidents censured by the US government over allegations of corruption, a procurement scandal in the Ukrainian Ministry of Defense, ongoing revelations about the UK government’s awarding of contracts during the Covid-19 pandemic, and many more!  

Here’s what’s new for 2024:

• In the UK, new legislation came into effect on 10 January 2024 amending the Money Laundering and Terrorist Financing Regulations and mandating that the starting point for assessing the risk posed by domestic PEP clients is lower than non-domestic PEPs. Read more in FINTRAIL’s blog here.

• The FCA’s review of how financial institutions manage PEP clients, launched in September 2023, is due to be published in June 2024. It will cover how PEPs are defined, how their risk levels are assessed, whether firms are carrying out risk-based and proportionate enhanced due diligence, and how firms take decisions to reject or close PEP-related accounts.

• In similar moves in the Netherlands, the Dutch Banking Association and the Dutch Central Bank have announced that Dutch banks are also now expected to focus on individual customers’ actual risk profile and to take less invasive due diligence measures for lower-risk PEP clients.

How we can help

At FINTRAIL we help banks, payments institutions, e-money institutions, virtual asset service providers (VASPs) and other regulated institutions around the world to reduce their exposure to financial crime and ensure regulatory compliance.  We do this through the provision of the highest quality consultancy services, based on deep sectoral experience and pragmatism.

We offer support through:

• Consultancy projects and advisory services

• Transformation services

• Audits and assurance

• Remediations and regulatory enforcement support

• Outsourcing and flexible resources

• Training services

If you would like to discuss any of the topics raised above, or need help enhancing your anti-financial crime programme or ensuring your team is ready for the year ahead, please do get in touch.

---

¹. UK Finance Half Year Fraud Update 2023
² FCA’s "Proceeds of fraud - Detecting and preventing money mules" and “Anti-fraud controls and complaint handling”
³ OFSI Annual Review 2022-2023, Strengthening Our Sanctions
⁴ FCA, Sanctions Systems and Controls

PEP Guidance Reflecting Recent UK Regulatory Changes

In December 2023, the UK government announced changes to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLRs”) in relation to the treatment of Politically Exposed Persons (“PEPs”) entrusted with prominent public functions in the UK (“domestic PEPs”).  These changes came into force on 10 January 2024.

The update means that under the MLRs, when dealing with domestic PEPs (or a family member or known close associate of a domestic PEP) the starting point for banks and other regulated firms is to treat them as inherently lower risk than non-domestic PEPs. This means that firms must apply a lower level of enhanced due diligence (“EDD”) to domestic PEPs compared to non-domestic PEPs, unless other higher risk factors are present (i.e. risk factors other than the PEP status itself).

With this move, the government is encouraging regulated firms to take a more proportionate and risk-based approach to the treatment of domestic PEPs.  This follows reports that a number of individuals that hold a prominent public position have encountered difficulties accessing financing services.  

The new requirements largely mirror guidance previously published by the Financial Crime Authority (FCA) on the treatment of PEPs, but now enter into law for the first time.  In parallel with this regulatory change, the FCA is undertaking a review of the treatment of domestic PEPs, with a report due to be issued in June.

However, the proposed changes have not been universally well received by industry experts, and have caused elements of confusion around how they should be implemented.  For example, practitioners have questioned when enhanced measures will be applied and how higher risk factors will be identified, given the initial level of EDD is now low (i.e. how will firms know if there are any higher risk factors if they are not carrying out robust EDD?). The regulation is not prescriptive in this regard; and as such the onus is on firms to determine what “higher risk factors” may be and how they are to be determined by lower levels of EDD. This has raised the question of whether a firm that does not perform full EDD (per the regulations) and misses something will be deemed wilfully blind or reckless? Will it run the risk of regulatory blowback or prosecution? The upcoming FCA report may provide more clarity, given the speed with which the changes have entered into law, regulated institutions must use their own judgment in the meantime.

Commentators have also expressed concerns that the UK MLRs now do not align with the Financial Action Task Force (“FATF”) recommendations, specifically Recommendations 12 and 22 which require firms to implement measures to prevent the misuse of the financial system by PEPs, and Recommendation 10, which requires firms to take additional measures beyond performing normal customer due diligence on PEP customers. 

Given the regulatory focus on this topic, FINTRAIL has designed a checklist of points to consider for PEP customers across the anti-financial crime framework.

Download the PEP Guidance Checklist

What areas does the checklist cover?

• Governance

• Policies and procedures

• Financial crime risk assessment

• Customer risk assessment

• Customer due diligence and enhanced due diligence

• Ongoing monitoring (including screening)

• Transaction monitoring and suspicious activity reporting

• Awareness and training

• Assurance

READ NEXT: Navigating New FCA PEP Guidance

---

The PSR publishes APP fraud performance data

As UK fraud watchers will be well aware, the UK’s Payment Systems Regulator (PSR) has embarked on a multi-pronged approach to reduce authorised push payment (APP) fraud within the Faster Payments System. As well as new mandatory reimbursement requirements due to come into effect in 2024, the PSR hopes to motivate regulated firms to improve their fraud controls by publishing performance data. This will show how much money connected to APP fraud is sent and received by each payment firm, and how firms perform when it comes to reimbursing victims.

The PSR has published the first ‘league tables’ today, showing data for 2022. The stats cover the UK’s 14 largest banking groups (‘directed firms’, which are obliged to report APP fraud data), plus nine other smaller firms that were among the top 20 highest receivers of fraud.

The performance tables will give firms that are successfully reducing APP fraud losses a competitive advantage, as they will enable customers to see how well individual banks perform in reducing fraud and how well they treat victims.

Recap: what is authorised push payment fraud?

APP fraud is a scam where fraudsters trick victims into sending them money. The account holder authorises the transaction, sending their money willingly but under false pretences.

Examples

Impersonation scams involve the fraudster pretending to be a trusted party like a bank employee or government official, for instance convincing the victim that their bank account is compromised and urging them to move their funds to a ‘trusted’ bank account which is actually under the fraudster’s control.

Romance scams, where a fraudster builds an online relationship with a victim and requests money for various reasons, such as bogus medical expenses or travel costs, supposedly to meet the victim.

Invoice scams, where victims are tricked into paying an invoice that seems to be sent by a legitimate supplier, normally via email. The invoice might be entirely fake, or fraudsters may have intercepted a real invoice and altered the bank details or changed the payment link.

Other examples of APP fraud include employment scams, rental scams, and charity donation scams — where money is sent under false pretences to secure employment, a rental apartment, or donate to a charitable cause respectively.

Key takeaways

1. There are inconsistent outcomes for customers reporting APP fraud. Some firms automatically reimburse victims nearly all of the time, others only make partial reimbursements, and others only consider claims in very narrow circumstances. This inconsistency should reduce with the introduction of mandatory reimbursement for all PSPs in 2024.

In terms of value reimbursed, the figures range from 91% (TSB) to 10% (Allied Irish Bank GB). In terms of volume, they range from 94% fully reimbursed plus 4% partially reimbursed (TBS), to 6% fully reimbursed plus 8% partially reimbursed (Monzo) and 12% fully reimbursed (Allied Irish Bank GB).

NB: PSRs are not currently required to reimburse victims of APP fraud. However, as of 2019, participants in the APP Contingent Reimbursement Model Voluntary Code (‘CRM Code’) have voluntarily agreed to reimburse fraud losses. To date there are nine firms signed up, representing the UK’s major banks with over 90% of the market in payment volumes. These firms would therefore be expected to have much higher reimbursement figures.
 

2. The data showing which firms receive the most money generated by APP fraud indicate a massive degree of variation, indicating fraudsters have identified which firms have weak controls and are actively exploiting them.  Newer and smaller PSPs typically have disproportionately higher rates of fraud than larger, more established firms.  The PSR notes these firms are in the much earlier stages of preventing fraud than major banks, and are not part of the voluntary CRM code. 

For non-directed PSPs (i.e. smaller firms), the rates of fraud-related funds received range from £10,355 per £1m received (Clear Junction) down to £334 (JP Morgan/Chase).  The figures were still widely discrepant but over a smaller range for directed PSPs, ranging from £696 per £1m received (Metro Bank) to just £44 (Santander).

Reasons for some firms having high rates of receiving fraud could include fewer, poor or delayed onboarding checks which would allow fraudsters to open and close accounts before being caught, or weaknesses in inbound transaction monitoring which prevent incoming fraudulent funds being identified and held.

NB: The PSR notes that some firms provide payment accounts to customers but do not manage the customer relationship themselves (e.g. banking-as-a-service providers).  The PSR states that irrespective of whether the firms manage the customer relationships themselves, they retain the regulatory responsibility and are expected to ensure their partners manage the risk of onboarding new customers, conducting identity checks, and monitoring transactions effectively.
 

3. Firms have started to address control gaps, and the PSR believes the situation may have improved over 2023 given greater levels of awareness and industry initiatives, but more still remains to be done.

Outcomes

While these figures date back to 2022, they conclusively show that there is a huge gulf in levels of exposure to APP fraud across the UK payment industry.  Many firms need to radically up their game to prevent themselves being used by fraudsters, and there is a clear imperative to do so given the incoming mandatory reimbursement requirements.  Put simply, unless the most exposed firms are able to reduce the value of fraudulent funds they receive, the resultant reimbursements could put them out of business.

The PSR has said it expects firms to start working “now” to implement the new requirements, beginning by allocating appropriate resources, moving towards adopting a stronger risk-based approach to payments, and making better decisions on when to intervene and hold or stop a payment. 

There are numerous anti-financial crime controls which play a role in reducing APP fraud exposure:

• Customer due diligence, including identity verification

• Customer risk assessments, including both customer as fraudsters (receiving funds) and victims (sending funds)

• Ongoing monitoring, including transaction and other activity monitoring

• Information sharing mechanisms and responsiveness to peer institutions and law enforcement

• Use of internal data and financial intelligence

• Robust assurance of fraud controls

• Staff training

How we can help

FINTRAIL is here to help PSPs adapt to the new requirements. Over the last five years we have worked with a range of institutions to successfully reduce their APP fraud exposure.

We offer a range of innovative, data-driven services to improve the effectiveness of your fraud controls and enable better identification of fraud risks. For firms considering where to start, we can conduct a thorough, data-driven risk assessment to identify current weaknesses in frameworks and controls and recommend practical enhancements that will reduce your potential liability exposure. This may include product and feature changes/enhancements, customer vulnerability assessments, new transaction monitoring scenarios, or enhancements to your customer risk assessment model. We can also conduct targeted audits of existing controls, or provide assurance and validation of programme changes being introduced to meet the new reimbursement requirements.

Get in touch with our team to learn more.

Sanctions Q&A: Growing sanctions compliance with the business

All firms, regardless of their size, are required to comply with sanctions. With the potential of significant fines, business restrictions and reputational damage, getting sanctions wrong can have significant consequences, and it is important that firms ensure the controls put in place on day one are still fit for purpose as the business grows, or when regulatory requirements change.

In this rapid fire Q&A with FINTRAIL Senior Consultant & Sanctions Lead Emil Dall, we will explore how sanctions compliance programmes can and should adapt over time.

Q1 - Why is it important to adapt sanctions compliance over time?

There is no one size fits all when it comes to sanctions compliance. For example, a FinTech operating only in the UK may initially find their sanctions risk sufficiently covered by deploying a simple name screening solution, and focusing exclusively on the UK sanctions list. However, as the company grows over time, their sanctions profile will change as well. This could include:

• An expanded product offering, which may be impacted by sectoral sanctions.

• A growth in customer base, leading to potentially more sanctions alerts and possible matches.

• Expanding to new markets, and introducing cross-border payments to and from jurisdictions that are at higher risk for sanctions.

FinTechs have unique product features and selling points to distinguish themselves from their competition, however this can also create novel sanctions risks. Firms should carefully consider what controls adequately address their sanctions risk. For example, while OFAC does not prescribe what specific controls firms must use, the agency expects firms “to employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance programme”.

Q2 - If my products or customers remain the same, can our sanctions compliance programme also stay the same?

No. Even if a firm’s products or customers do not change significantly over time, sanctions compliance cannot be left to its own devices. Sanctions risk is ever-changing, particularly since Russia’s invasion of Ukraine in 2022. The number of designated individuals and entities has increased exponentially, with the networks of those designated extending far beyond just Russia, and novel sectoral sanctions have been imposed prohibiting certain services, trades or activities connected with Russia. 

Staying up to date with regulatory requirements and how your products may be affected by specific prohibitions is key. In September 2023 the Financial Conduct Authority in the UK highlighted that when it comes to Russia sanctions, “firms that had taken advanced planning for possible sanctions before February 2022 were in a better position to implement [them]”. Staying on top of regulatory requirements and being prepared for what might come next is now expected by regulators.

Q3 - What are the key components of an effective sanctions compliance programme?

A sanctions compliance programme will look different in every firm, depending on its size and operations. Some components may be present from day one, and become more sophisticated over time, while other components will only be introduced as the firm grows. This includes:

• A sanctions risk assessment, perhaps initially conducted as part of a wider enterprise wide risk assessment, or later as a standalone sanctions risk assessment.

• Sanctions screening systems, which should be tested to ensure they work as intended and calibrated over time in line with the firm’s customer portfolio and sanctions risk. 

• Governance and oversight, including maintaining up-to-date policies, operating procedures, reporting obligations across all jurisdictions where the firm operates, and management information on sanctions trends.

Q4 - How can FINTRAIL help?

FINTRAIL can assist businesses that do not yet have a built-out sanctions compliance function, as well as those who are looking to enhance their existing sanctions policies and procedures. 

Regardless of where you are in your sanctions compliance journey, we assist clients of all sizes build and maintain an effective sanctions compliance programme that meets regulatory expectations - this includes development or enhancement of sanctions policies and procedures, sanctions risk assessments, sanctions screening and controls, and carrying out audits of sanctions compliance programmes. 

In addition, we are sanctions policy experts with experience working with governments across North America, Europe and Asia on sanctions design and implementation, and we can help firms be tuned into relevant changes in the fast-moving sanctions regulatory landscape.

---

---

Travel Rule: State of Play

Introduction

With deadlines looming in many jurisdictions to implement FATF Recommendation 16, also known as the “travel rule”, crypto has been front and centre of the anti-financial crime spotlight. While the travel rule was first adopted in 2019 by the Financial Action Task Force (FATF), a recent targeted update from June 2023 shows that member countries struggle to implement it. According to the update, over half of those surveyed have not taken any measures to implement the rule. While progress has been made since the survey, the topic of the travel rule and the associated ‘sunrise issue’, which refers to its uneven and phased worldwide adoption, continues to be significant. Delving deeper into this topic, FINTRAIL explores some common challenges firms face in implementing the crypto travel rule while unpacking the state of play in key jurisdictions.

A refresher: what is the travel rule? 💸

The travel rule, which comes under FATF’s Recommendation 16, “requires virtual asset service providers (VASPs) to obtain, hold, and transmit required originator and beneficiary information, immediately and securely, when conducting virtual asset (VA) transfers.” By doing so, VASPs and financial institutions can conduct effective sanction screening, detect suspicious transactions, and essentially bring crypto assets under the same regulatory umbrella as other types of financial transfers such as wires. The threshold amount is $1,000 or €1,000 - meaning that any transfer over this amount requires identifiable information to be shared on the originator and beneficiary.

The travel rule stipulates that transactions above $1,000 or €1,000 require the following information to be transmitted:

The originator VASP

• The originator’s name

• The originator’s wallet address

• The originator’s physical address, national identity number, customer identification number, or date and place of birth

The beneficiary VASP

• The beneficiary’s name

• The beneficiary’s wallet address

For transactions below the $1,000 or €1,000 threshold, the following information must still be transmitted:

The originator VASP 

• The originator’s name

• The originator’s VA wallet address or a unique transaction reference number for VA transfers

The beneficiary VASP 

• The beneficiary’s name 

• The beneficiary’s VA wallet address or a unique transaction reference number for VA transfers

As countries work to transpose the travel rule into their own regulatory frameworks at varying rates, here’s the current state of play for key jurisdictions:

The United Kingdom 🇬🇧

On 17th August the Financial Conduct Authority (FCA) published a statement outlining the expectations for UK businesses complying with the travel rule. Since the publication of the FATF Recommendation, the UK has amended its Anti-Money Laundering and Terrorist Financing regulations (MLRs) accordingly. The recent statement from the FCA highlights that firms must adhere to the travel rule from 1 September 2023.

In addition to full compliance with the rule, the expectations outlined by the FCA include taking reasonable steps and due diligence for compliance, regularly reviewing the implementation status of the rule in other jurisdictions to adapt business processes appropriately, and responsibility for compliance even when using third-party suppliers. 

When sending crypto asset transfers to a jurisdiction without the travel rule, the FCA specifies that firms take all reasonable steps to indicate that the firm can receive the required information. If the firm cannot, the UK firm must abide by the MLRs, collecting, storing, and verifying the information appropriately. Receiving crypto-asset transfers from a jurisdiction without the travel rule requires a risk-based assessment before making the funds available to the beneficiary. Decisions should consider the jurisdiction(s) in which the sending firm operates and the status of the travel rule in those countries.

The European Union 🇪🇺

In the EU, the Transfer of Funds Regulation will implement FATF’s travel rule and extend wire transfer requirements to crypto providers. The regulation will have no minimum, meaning all transactions will require identification information to be shared, regardless of the amount. The law also covers transactions above €1,000 from self-hosted wallets when interacting with hosted wallets managed by crypto-asset service providers.  

Explainer: What are self-hosted wallets?

Self-hosted wallets are digital wallets where the user has sole control over their private keys, permitting them to store, send, and receive crypto without needing a centralised platform or intermediary.

The regulation will apply from 30 December 2024.

The United States 🇺🇸

In May 2019, the Financial Crimes Enforcement Network (FinCEN) published clarifying guidance on applying existing regulations to convertible virtual currencies. The consolidating document clarifies the inclusion of virtual currencies in the travel rule initially created for fiat currencies. The threshold in the US is currently $3,000, though a proposed rule change was made to lower the threshold to $250 for international transfers, though this has not yet gone into effect.

Challenges to implementation

Among the notable challenges to the travel rule’s implementation, the ‘sunrise issue’ speaks to the staggered and nonuniform application of the rule across jurisdictions. For example, Singapore and Japan have already implemented the travel rule, on 28 January 2020 and 1 June 2023 respectively, whereas countries in the EU have until the end of 2024. These different timelines pose challenges as firms must send information to firms in countries that may not be mandated to receive or transmit data. Additionally, there may be jurisdictional variances as countries transpose the travel rule into their own national regulations differently. The United States, for example, currently has a threshold of $3,000 rather than FATF’s recommended $1,000. These differences mean VASPs are tasked with navigating cross-border variations. 

Recognising the uneven global application, the FATF noted that VASPs should consider additional control measures for countries with weak implementation, such as rigorous monitoring of transactions with VASPs based in higher risk countries, “placing amount restrictions on transactions, or intensive and frequent due diligence.” 

Another key practical challenge is technology requirements, as the rule requires firms to deploy complex technology solutions that were previously unavailable. In Australia, where the travel rule has yet to be transposed into national law, officials said in 2021 that there were insufficient technological capabilities to implement the rule adequately.  VASPs must exchange data with other VASPs through messaging protocols, and varying formats raise interoperability issues. Other concerns stem from navigating data privacy, data processing requirements, and security concerns. All these factors make the practical implementation of the travel rule a daunting task.

How FINTRAIL can help

FINTRAIL is experienced in working with VASPs, including cryptocurrency trading platforms and traditional firms with exposure to crypto-assets in the UK, Europe, APAC and globally. We help VASPs around the world ensure regulatory compliance and an effective implementation of the travel rule. Through the provision of the highest quality consultancy services, based on deep sectoral experience and pragmatism, we help firms reduce their exposure to financial crime.

---

Case study: Remediation for a cryptocurrency exchange [read now]

PEPs in Perspective: How to manage politically exposed clients

Introduction

Earlier this month, Chancellor Jeremy Hunt asked the UK’s Financial Conduct Authority (FCA) to investigate whether financial institutions are closing politicians' bank accounts on a widespread basis. Sparked by a controversy involving former Brexit Party leader Nigel Farage, who accused the private bank Coutts of closing his account because of his political views, the topic of politically exposed persons (PEPs) and debanking has come to the fore. The discussion arises against the backdrop of a significant increase in account closures because of anti-money laundering efforts over the last few years.

The FCA has now issued a data request to banks, specifically asking if accounts have been closed due to political opinions and has confirmed it aims to provide an initial assessment by mid-September - a phenomenally fast turnaround for a potentially tricky exercise. 

Payment account regulations in the UK state that everyone has a right to open a basic bank account. Financial service providers cannot discriminate on the basis of protected characteristics such as gender, religion, and race, as per non-discrimination legislation. However, outside of these protections, financial institutions are entitled to decide which customers they choose to bank in line with their risk appetite. For example, firms may turn away specific industries, such as adult entertainment, gambling, or manufacturers of firearms and ammunition, if they are deemed too risky.  While the Coutts case focuses more on political views and reputation rather than financial crime risk, a buzz has been created around PEPs and debanking in an anti-financial crime context.  

In response to this recent development, FINTRAIL has looked at some of the requirements and best practices for financial institutions when dealing with PEPs.

The basics

First, let’s visit the definition of what a PEP actually is. While each jurisdiction has its own specific meaning in line with its legal and regulatory framework, the Financial Action Task Force’s (FATF) influential definition is “an individual who is or has been entrusted with a prominent public function”. Family members and close associates of PEPs may also receive PEP designations.   PEPs can be further broken down into the following categories: 

• Foreign PEPs: individuals given significant public roles by a foreign country.

• Domestic PEPs: individuals given significant public roles within their own country.

• International organisation PEPs: senior management in international organisations such as UN bodies, including directors, deputy directors, board members, or those with similar responsibilities.

The reason financial institutions are required to identify PEPs is that they pose a heightened risk of bribery and corruption, due to the opportunities afforded to them by their political office

In the UK, a PEP, as defined by the Money Laundering, Terrorist Financing, and Transfer of Funds (Information of the Payer) Regulations 2017 is “an individual who is entrusted with prominent public functions, other than as a middle-ranking or more junior official.” The regulations include some helpful but non-exhaustive examples such as heads of state, ambassadors, and members of the supreme court. They state regulated institutions must be able to identify if a customer is either a PEP or “a family member or a known close associate of a PEP”.

PEP obligations for financial institutions

Each country differs in what it requires of financial institutions when it comes to PEPs. UK regulations state that financial institutions should place PEPs and their family members under enhanced due diligence. Similarly, in other jurisdictions like Singapore and Australia, regulators require financial institutions to apply enhanced due diligence to PEPs. While the exact nature of what constitutes enhanced due diligence has no prescriptive meaning and should form part of a risk-based approach, it commonly entails additional ongoing monitoring and screening measures such as adverse media screening. Some other examples of enhanced due diligence measures compiled by the FCA include establishing the source of wealth to ensure its legitimacy, commissioning external third party intelligence reports where necessary, and obtaining more robust verification of customer information from a reliable and independent source. 

In the United States, the term PEP refers to foreign individuals “who are or have been entrusted with a prominent public function, as well as their immediate family members and close associates.” There is no obligation to identify domestic PEPs.  While not expressly requiring PEPs to undergo any enhanced due diligence, firms must take the appropriate action in line with a risk-based approach and the client’s risk profile. Notably, recent developments with the Anti Money Laundering Act 2020 have increased scrutiny on PEPs, encouraging financial institutions to enhance their policies. 

Not all PEPs are created equal

In the last decade, PEPs have come into the spotlight for illicit activities and corruption revealed in investigations by organisations like the International Consortium of Investigative Journalists, such as the Panama Papers and Luanda Leaks. More recently, news has centred on Russian kleptocrats and the global sanction regimes targeting them, bringing the abuse of power of those politically connected to Vladimir Putin into public discourse. But are all PEPs automatically high-risk clients? 

While PEPs are generally considered at higher risk for bribery and corruption, this is contingent on a few factors. The FCA’s guidance outlines some of the indicators that make a PEP a higher-risk client for financial institutions, including involvement with a product “capable of being misused to launder the proceeds of large-scale corruption.” Another indicator centres on geographical considerations, like if a PEP is “entrusted with a prominent public function in a country that is considered to have a higher risk of corruption”, taking into account a range of factors like political instability, widespread organised criminality, human rights abuses and more.  Another consideration is the personal and professional nature of the PEP - if they have wealth inconsistent with known legitimate sources or are responsible for large public procurement exercises.  

So while there is a regulatory obligation in most countries to apply extra measures to all PEPs, not all genuinely pose a significant risk of bribery or corruption. It is also vital to note that conducting enhanced scrutiny of PEPs should never be done under the assumption that all politicians (or their families or close associates) are likely criminal actors. The overwhelming majority are not. In fact, a 2017 FCA guide explicitly states that firms are “required to recognise the lower risk” of UK PEPs, or PEPs from a country that has “similarly transparent anti-corruption regimes”. Depending on a holistic range of risk factors, some may be lower risk than others.  Firms should effectively identify and monitor PEPs to ensure that in the event suspicious activity does occur, you will flag it, investigate it, and report it. This approach is foundational to an effective anti-financial crime programme. 

Best practices

Firms should regularly revisit their policies concerning PEPs to ensure their alignment with their internal risk appetite and risk-based approach. 

Some areas of focus include:

• Having a clear risk appetite statement regarding PEPs, based on a nuanced understanding of the financial crime risk they pose whilst remembering simply banning PEPs is not appropriate.

• Fortifying enhanced due diligence measures and processes to ensure the risks associated with PEPs are truly understood and mitigation measures are appropriate.

• Regularly training staff on how to identify a PEP, the associated risks, and the processes to be followed once a PEP is identified.

• Designing clear onboarding processes and exit strategies for PEPs.

READ NEXT: Navigating New FCA PEP Guidance

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you refine your enhanced due diligence measures and incorporate an effective risk strategy for PEPs in a practical and efficient way. 

The Real (E)state of Money Laundering in Property

Introduction

Money laundering in real estate has been a hot topic of late, with explosive headlines from the UK to the UAE to Canada to Australia. Most glaringly, dirty money from Russia has attracted tremendous attention following last year’s unprecedented sanction regimes brought on by the Ukrainian invasion. In particular, the UK real estate market has received widespread criticism for serving as a haven for questionable funds from Russian oligarchs, giving popularity to the term ‘Londongrad’. Research by Transparency International has estimated £1.5 billion of UK property has been purchased by Russians accused of corruption or with links to the Kremlin. Such reports sparked outrage and even legislation requiring the beneficial owners of property to be disclosed in a new public register. 

In light of this crackdown in the UK, Russian cash is seemingly heading to places like Dubai instead. According to one source, since the Ukrainian invasion, the “Russian population in the UAE has risen fivefold to as many as 500,000”, propping up the luxury real estate market. But even before the war, Dubai was a popular refuge for criminals from all over the world looking to stash their ill-gotten gains. Last year the Dubai Uncovered property leak disclosed data from 2020 on criminals, officials, and sanctioned politicians with ties to the Dubai property market.  One of the people identified in the leak is a Czech politician named Libor Novák who is accused of corruption, listed as owning six apartments in the Dubai Marina worth nearly $2.7 million.

These instances are far from isolated. Reports in Australia (where it is thought that criminals linked to China laundered $1 billion through real estate in 2020), Canada, and the United States demonstrate the popularity of real estate as a medium to hide and launder illicit proceeds from bad actors worldwide.

But why is the real estate sector so attractive to criminals?

Real estate can be used at different stages of the money laundering process. At the placement stage, in some jurisdictions with poor money laundering frameworks properties can be bought with physical cash, with minimal or no checks on identity or source of funds. At the layering stage, property can be used to transfer and obfuscate illegal funds using complex ownership structures with shell companies or trusts obscuring the original source of funds. It’s very helpful for dealing with source of funds checks - financial institutions will often accept the explanation that funds derive from the sale of a property in a less well-regulated jurisdiction, without going further back and asking how you came to have the money to buy the property in the first place. Finally, real estate can also be used to legitimise illicit funds at the final investment or integration stage.

Other aspects of real estate’s appeal are the same features that appeal to regular investors.  Real estate is viewed as a stable investment and thus a safe place to invest, compared to speculative assets such as cryptocurrency or stocks.  In prime property markets where prices are high and generally increase over time, criminals can increase their wealth even further. And since housing prices are subjective and fluctuate over time, it is easy for them to be manipulated and over or undervalued.

A final advantage is that the high cost of property means criminals can launder large sums of money in a single transaction. As already noted, Dubai is a hot spot for luxury property transactions, being the “busiest market for $10mn-plus homes in the first quarter of 2023”, surpassing Hong Kong and New York. Reports state that the number of sales of homes in Dubai worth over $10 million has risen seventeen-fold in the last five years. For example, the average price of a villa in Dubai-Sea Mirror is around $20 million. 

While the real estate market is subject to money laundering regulations in most countries, this is seldom well enforced. In practice, anti-money laundering practices are often extremely lax or even non-existent. Even in jurisdictions with ‘respectable’ reputations, money laundering through real estate is rampant. Canadian cities Toronto and Vancouver are prime examples, being notorious for attracting nefarious actors who use the extortionate markets to absorb their funds. As public awareness of the problem increases, and housing crises caused by soaring prices continue, governments worldwide are taking steps to rectify the problem, including measures such as unexplained wealth orders and land and property ownership transparency registries.

Reasons why real estate is attractive to criminals:

• Real estate is a stable investment that generally increases in value.
• Pricing is subjective and overvalued houses are common, allowing real estate costs to be easily inflated.
• As the cost of property is extremely high, criminals can launder large amounts in a single transaction.
• Money laundering regulations for the real estate sector are seldom enforced and anti-money laundering practices are often very lax.
• The sale of property is a good way to satisfy source of funds checks.

Common methods for money laundering 💸

One common method used to launder money through the real estate sector is purchasing a property using family and non-family proxies to avoid detection. This was clearly demonstrated in an investigation by the Organised Crime and Corruption Reporting Project (OCCRP), which revealed a Russian national named Sergey Toni owned real estate worth over $59 million despite having no profitable businesses of visible profile. Segey Toni’s father, however, is a deputy managing director of one of the largest transportation companies in the world, the state-owned Russian Railways. Another example revealed by the OCCRP is Chen Runkai, a Chinese property developer linked to a military corruption scandal. Chen owns million-dollar properties in the same Vancouver neighbourhood as his daughter, who purchased a mansion mortgage-free for about CAD 14 million (approximately £8.1 million) at the age of 25 while listing her occupation as a ‘student’. 

Other common strategies include using anonymous front companies, especially in jurisdictions where anonymity is commonplace. This is particularly evident in the US, where certain states such as Delaware, Nevada and North Dakota allow for completely anonymous shell companies. While moves are underway in the US to create a database of beneficial ownership information, its effectiveness remains controversial. For more analysis on corporate transparency, check out FINTRAIL’s article here. The problem is widespread; anonymously held and corporate-owned real estate affects every jurisdiction with an international property market.  A recent Transparency International investigation from July 2023 revealed the scale of the problem in France, showing that “the vast majority of corporate-owned real estate in France is held anonymously”, and nearly a third of all companies have not disclosed who ultimately owns them, despite legally being required to do so. 

Criminals may also engage with third parties or trusts to be the legal owner of a property, further blurring true ownership.

What should financial institutions be doing?

For financial institutions looking to strengthen their anti-financial programmes against real estate money laundering, it’s vital to identify potential red flags and common typologies. Transactions involving real estate deals should be adequately scrutinised and the real estate industry as a whole should be considered higher-risk, potentially subject to enhanced due diligence measures. Compliance teams should focus on establishing original source of wealth and determining the ultimate beneficial owner of properties to identify nefarious actors or suspicious activity. 

Potential red flags:

• Multiple property purchases and sales made in a short period of time
• Over / undervaluation of property prices
• Complex loans or credit finance (repayment can be used to mix illicit and legitimate funds)
• Financing of property using offshore lenders
• Unusual income (e.g. no declared income or inconsistency between declared income and th standard / value of the property)
• Cash purchases
• Unknown source of funds for purchases (i.e. incoming foreign wire transfers where originator/beneficiary customers are the same)
• Ownership of property is the customer’s only link to the country where real estate is purchased
• Straw buyers or properties purchased using family members’ names
• Properties purchased through front companies, shell companies, trusts and complex company structures

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you fortify your controls in a practical and efficient way.