300 members and counting!

The FinTech FinCrime Exchange (FFE) is celebrating an important milestone - we’ve reached over 300 member firms! 🥳 The FFE was originally set up by FINTRAIL as a small roundtable, and has grown from strength-to-strength to become the leading compliance network for FinTech professionals. We’ve taken part in public-private partnerships with Europol, the National Economic Crime Centre and others; produced our own podcast (then again, who hasn’t?!); chaired round tables and written industry guidance papers; and put on one of the industry’s most popular conferences: FFECON! And we couldn’t have done it without all our amazing members. 🥰

What is the FinTech FinCrime Exchange?

The FFE is a global network of FinTechs brought together by FINTRAIL collaborating on best practices in financial crime risk management. Member firms cover the whole FinTech ecosystem - payments and retail banking, investment, lending, cryptocurrency, and banking-as-a-service. We currently have members from 43 different jurisdictions around the world. 🌍

Origins of the FFE

FINTRAIL began the FFE as an ad-hoc roundtable with just six companies back in January 2017.  FINTRAIL had noticed that several clients were experiencing the same financial crime typology, and wanted to create a way for them to share this information and ideas for effective counter-measures. The idea proved so popular that FINTRAIL then set up the FFE as a permanent community, with regular physical meet-ups in the UK, Singapore and the USA. These meet-ups naturally became virtual in 2020 due to the COVID pandemic, allowing more firms from other parts of the world to participate. We now blend in-person meetings and social events with virtual meet-ups and webinars to make the best of both worlds for all our members.

Why the FFE is special

One of FINTRAIL’s key motivators for establishing the FFE was the obvious need for a dedicated compliance organisation for FinTechs. FinTechs comprise a key part of the financial ecosystem but are often excluded from forums reserved for established, larger financial institutions (such as JMLIT in the UK). In addition, they often cannot afford the costs of involvement with professional bodies. So the FFE was founded to offer a unique, totally free network for digital-native, innovative firms to collaborate and share their insights and knowledge to fight financial crime together. 💪

Don’t just take our word for it - hear what our members have to say!

What we have planned next

We may have hit 300, but have no intention of stopping here!  We’re going to continue to grow the FFE membership, especially by expanding in particular subsectors and new geographies.  We also want to spread awareness of the power of the FFE within current member firms, to make sure all teams - financial crime, fraud, KYC operations etc. -  can make the most of their membership.

We are taking a pause on hosting FFECON this year, but have an exciting calendar of events lined up in its place. For instance, FINTRAL and the FFE are hosting a series of senior leaders round tables focusing on topics of keen interest to participants, such as consumer duty and APP fraud.  We’ll also be putting on social events to bring the whole London-based community together.  🎉

How to get involved

If you hold a financial crime compliance role at a FinTech and you’d like to get involved, you can apply to become a member today. Be sure to follow us on LinkedIn too to keep up-to-date with what’s going on. If you want to learn more about the community and our activities, check out the FFE’s website page or contact us at ffe_admin@fintrail.com.

You can also learn more about FINTRAIL and the people behind the initiative here. 

Anti-financial crime audit benchmarking

You asked: “How does our AFC audit compare to our peers?” and “What are the common themes you see in audits?”

We answered….

When conducting anti-financial crime (AFC) audits, our clients often look to understand how their results compare to peer firms across the industry. In fact, when we shared our common audit findings in our ‘Priorities for 2024’ webinar, we fielded a number of questions on what typical audit findings tend to uncover, to help firms understand if they are doing better or worse than average. To assist firms in understanding how their audit compares to other firms, FINTRAIL audit reports now include peer benchmarking for our larger audits.

While there are certainly no ‘one-size-fits-all’ audit results, having looked back over our audits for the past 12 months we have seen similar findings cropping up repeatedly across firms. And when you compare these to a summary of last year’s findings from the Financial Conduct Authority’s (FCA) Priorities for Payment Firms and the European Banking Association’s (EBA) Report on ML/TF risk associated with Payment Institutions, there are common themes from a regulatory perspective that align with what we see in practice when conducting audits.

The table below compares the feedback shared by the key regulatory bodies alongside common findings from FINTRAIL’s audits by thematic areas. Any firm subject to an AFC audit in 2024 should look at these findings against their control framework, assess if any of them could be relevant to their business and consider if they need to embark on any remedial work before their next audit.

When you compare the feedback from regulators with the analysis we have undertaken across the audits we have conducted, we see the same areas consistently appearing in our audit findings. Screening, CDD, governance, risk assessment and transaction monitoring are the control areas where we see the highest number and highest severity of findings. While this observation does not diminish the importance of findings in other areas - e.g. assurance or training - it does reflect that firms often still struggle with the effectiveness of core control areas.

FINTRAIL’s peer benchmarking can compare how your control areas map against peers in the industry and use an audit score reflecting the number of recommendations and the priority level to show where your firm sits in comparison to similar firms. The graph below is an example of how this is portrayed within our audit report. The blue columns represent the average number of findings weighted by priority level across all audits FINTRAIL has conducted over the last 18 months. The black dotted line represents where your firm sits. If your audit findings fall within the blue columns, your firm is in line with, or exceeding, industry standards. If they fall above this, this indicates areas that should be a key focus for your firm.

Whether it is used for your own personal insight, or to include in the audit report you provide to your board or banking partners, this snapshot of your firm compared to your peers can be a powerful indicator of the effectiveness of both the individual components of your control framework, and the framework as a whole.

With the FCA announcing that it will deploy “greater assertiveness in preventing those who can’t or won’t meet [their] standards entering into or remaining in the regulated sector”, the power of an audit in improving a financial crime framework, while also strengthening your position in future regulatory engagement, is immense.

---

At FINTRAIL, we conduct both enterprise-wide financial crime audits and targeted assessments of specific controls or risk areas. These reviews can cover the full gamut of financial crime risks, with particular focus on AML, terrorist financing, sanctions evasion, and fraud.

Anti-Financial Crime Developments and Priorities for 2024

There is never a dull year in anti-financial crime, and 2023 was certainly no exception. From the introduction of the UK’s Economic Crime Bill, to new crypto laws including the EU’s regulation on markets in crypto-assets (MiCA), a global raft of sanctions against Russia, and legislative attempts to rein in the global fraud pandemic, there’s been plenty to keep on top of. 

It’s early days, but there seems no reason to believe 2024 will be any different.  We are already aware of several pieces of legislation due to come into effect this year, and various regulators have clearly signposted their current areas of focus via guidance notices and consultations with the industry.  So let’s read the tea leaves and see what financial institutions can expect in 2024!

---

FINTRAIL held a webinar on financial crime trends for 2024, and asked the audience what their main areas of focus were for the year ahead. This is how they responded at the end of the session.

Poll: What are your priorities and main areas of focus for 2024? Please select all applicable answers.

---

Fraud

Fraud is big global news. In the UK, for example, criminals stole over half a billion pounds in the first six months of 2023 alone¹. Traditional methods of deception are as popular as ever, and are being complemented by increasingly sophisticated cyber-attacks and intricate social engineering schemes. 

While regulators everywhere are acutely aware of the issue, the UK is leading the way in terms of a regulatory response.  In 2023, the Payment Services Regulator (PSR) undertook a multi-pronged approach to reduce authorised push payment (APP) fraud within the Faster Payments System, which is due to continue into 2024.  Here’s what to look out for: 

• New mandatory reimbursement requirements, announced in June 2023, are due to come into effect in October 2024. These will require both sending and receiving payment institutions to reimburse all victims of APP fraud in full based on a 50/50 split, with limited exceptions for fraud or gross negligence. Read more in our blog here.

• In 2024 the PSR will be publishing “league tables” of performance on APP fraud in 2023.  Last year’s report on 2022 data called out inconsistent outcomes for victims, and highlighted that certain receiving institutions took in a disproportionate volume of funds derived from APP fraud.  Expect to see more scrutiny of these areas in the 2024 report. Read more in our blog here.

• The coverage of the Confirmation of Payee scheme will be extended in October 2024, with all financial institutions that participate in Faster Payments or CHAPS required to implement the tool.

In other fraud news:

• The UK government launched its national Fraud Strategy in May 2023, which aims to reduce fraud by 10% on 2019 levels by December 2024.  The various measures announced under the strategy - such as a new national fraud squad, replacing Action Fraud with a new reporting system, cracking down on abuse of the telephone network, and engaging the tech industry - are ongoing.  Separately, the Home Affairs Committee inquiry into fraud launched in September 2023 will publish its results sometime this year.

• The FCA issued several guidance documents² on fraud in 2023, which implicitly set out what firms will be judged against in 2024.  The guidance highlighted issues with detecting and preventing money mules due to poor onboarding controls, transaction monitoring, training and governance; poor complaint handling; and poor understanding and response to customer vulnerability.

• A new corporate failure to prevent fraud was introduced in 2023 as part of the Economic Crime and Corporate Transparency Act. The offence is expected to come into force once the government has published guidelines in Spring 2024.
  

Anti-fraud measures are also being taken in other jurisdictions, albeit not at the same scale as in the UK.

• In the EU, the introduction of PSD3 revisions forecast for late 2024 will extend IBAN/name matching verification to all credit transfers, introduce an obligation for payment service providers (PSPs) to increase awareness of payment fraud among customers and staff, and establish a legal basis for PSPs to share fraud-related information in full respect of GDPR via dedicated IT platforms.  

• In the US, federal requirements to report company ownership to FinCEN’s Beneficial Ownership Information Registry went live on 1 January 2024, pursuant to the 2021 Corporate Transparency Act.  It is hoped this will increase corporate transparency and help reduce fraud.

• While there is no proposal on the horizon in the US for an accountability model or a common reimbursement scheme, the biggest US banks decided to begin refunding Zelle scam victims last year, a trend towards collective action which we could see reflected elsewhere alongside a push for greater consumer protection.

Sanctions

The various geopolitical events of 2023 played themselves out in the sanctions world, with new legislation and designations issued in relation to Russia, Hamas, Sudan, Iran and others.  Human rights violations, narcotrafficking and crypto scams were also all in the spotlight. 

• OFSI’s annual report for the financial year 2022 to 2023, published in December 2023, revealed that despite imposing “the most severe sanctions the UK has ever imposed on any major economy”³ on Russia, recording 473 suspected breaches and opening 172 investigations by April 2023, there has so far been zero enforcement for post-February 2022 sanctions breaches in relation to Russia. We predict 2024 will be a more active year for enforcement, as some of those investigations bear fruit.  

• We also predict continuing cooperation between OFSI and the FCA, with the former focusing on enforcement and the latter on ensuring effectiveness. The FCA conducted a targeted assessment of firms’ sanctions controls in 2023 and shared the good and bad practices observed⁴, which will likely form a benchmark for regulatory reviews in 2024.

• In the EU, we predict a push towards standardised enforcement across member states in 2024.  We understand states with a “less mature” track record of sanctions enforcement are being given firm instructions to up their game, as well as training and guidance to help them do so.

• In the US, we predict more of the same from OFAC in terms of the nature of sanctions regulations and enforcement, with the upcoming presidential election likely to shape the strategic priorities. 

• In December 2023, OFAC issued an Executive Order expanding the US’s ability to target financial institutions outside of Russia that facilitate transactions involving Russia’s military-industrial base.  We should see in 2024 how the US intends to use this new measure and whether it will be a significant weapon in its sanctions arsenal, and which Russia-tolerant countries are in the crosshairs.

PEPs

In 2023 the concept of Politically Exposed Persons (PEPs) entered the public consciousness in the UK like never before, with the scandal surrounding the closure of Nigel Farage’s bank account at Coutts and a subsequent review by the FCA into whether PEPs are being routinely denied access to financial services.  

Meanwhile we saw corruption scandals involving PEPs continue to emerge around the world, including two former Latin American presidents censured by the US government over allegations of corruption, a procurement scandal in the Ukrainian Ministry of Defense, ongoing revelations about the UK government’s awarding of contracts during the Covid-19 pandemic, and many more!  

Here’s what’s new for 2024:

• In the UK, new legislation came into effect on 10 January 2024 amending the Money Laundering and Terrorist Financing Regulations and mandating that the starting point for assessing the risk posed by domestic PEP clients is lower than non-domestic PEPs. Read more in FINTRAIL’s blog here.

• The FCA’s review of how financial institutions manage PEP clients, launched in September 2023, is due to be published in June 2024. It will cover how PEPs are defined, how their risk levels are assessed, whether firms are carrying out risk-based and proportionate enhanced due diligence, and how firms take decisions to reject or close PEP-related accounts.

• In similar moves in the Netherlands, the Dutch Banking Association and the Dutch Central Bank have announced that Dutch banks are also now expected to focus on individual customers’ actual risk profile and to take less invasive due diligence measures for lower-risk PEP clients.

How we can help

At FINTRAIL we help banks, payments institutions, e-money institutions, virtual asset service providers (VASPs) and other regulated institutions around the world to reduce their exposure to financial crime and ensure regulatory compliance.  We do this through the provision of the highest quality consultancy services, based on deep sectoral experience and pragmatism.

We offer support through:

• Consultancy projects and advisory services

• Transformation services

• Audits and assurance

• Remediations and regulatory enforcement support

• Outsourcing and flexible resources

• Training services

If you would like to discuss any of the topics raised above, or need help enhancing your anti-financial crime programme or ensuring your team is ready for the year ahead, please do get in touch.

---

¹. UK Finance Half Year Fraud Update 2023
² FCA’s "Proceeds of fraud - Detecting and preventing money mules" and “Anti-fraud controls and complaint handling”
³ OFSI Annual Review 2022-2023, Strengthening Our Sanctions
⁴ FCA, Sanctions Systems and Controls

PEP Guidance Reflecting Recent UK Regulatory Changes

In December 2023, the UK government announced changes to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLRs”) in relation to the treatment of Politically Exposed Persons (“PEPs”) entrusted with prominent public functions in the UK (“domestic PEPs”).  These changes came into force on 10 January 2024.

The update means that under the MLRs, when dealing with domestic PEPs (or a family member or known close associate of a domestic PEP) the starting point for banks and other regulated firms is to treat them as inherently lower risk than non-domestic PEPs. This means that firms must apply a lower level of enhanced due diligence (“EDD”) to domestic PEPs compared to non-domestic PEPs, unless other higher risk factors are present (i.e. risk factors other than the PEP status itself).

With this move, the government is encouraging regulated firms to take a more proportionate and risk-based approach to the treatment of domestic PEPs.  This follows reports that a number of individuals that hold a prominent public position have encountered difficulties accessing financing services.  

The new requirements largely mirror guidance previously published by the Financial Crime Authority (FCA) on the treatment of PEPs, but now enter into law for the first time.  In parallel with this regulatory change, the FCA is undertaking a review of the treatment of domestic PEPs, with a report due to be issued in June.

However, the proposed changes have not been universally well received by industry experts, and have caused elements of confusion around how they should be implemented.  For example, practitioners have questioned when enhanced measures will be applied and how higher risk factors will be identified, given the initial level of EDD is now low (i.e. how will firms know if there are any higher risk factors if they are not carrying out robust EDD?). The regulation is not prescriptive in this regard; and as such the onus is on firms to determine what “higher risk factors” may be and how they are to be determined by lower levels of EDD. This has raised the question of whether a firm that does not perform full EDD (per the regulations) and misses something will be deemed wilfully blind or reckless? Will it run the risk of regulatory blowback or prosecution? The upcoming FCA report may provide more clarity, given the speed with which the changes have entered into law, regulated institutions must use their own judgment in the meantime.

Commentators have also expressed concerns that the UK MLRs now do not align with the Financial Action Task Force (“FATF”) recommendations, specifically Recommendations 12 and 22 which require firms to implement measures to prevent the misuse of the financial system by PEPs, and Recommendation 10, which requires firms to take additional measures beyond performing normal customer due diligence on PEP customers. 

Given the regulatory focus on this topic, FINTRAIL has designed a checklist of points to consider for PEP customers across the anti-financial crime framework.

Download the PEP Guidance Checklist

What areas does the checklist cover?

• Governance

• Policies and procedures

• Financial crime risk assessment

• Customer risk assessment

• Customer due diligence and enhanced due diligence

• Ongoing monitoring (including screening)

• Transaction monitoring and suspicious activity reporting

• Awareness and training

• Assurance

---

The PSR publishes APP fraud performance data

As UK fraud watchers will be well aware, the UK’s Payment Systems Regulator (PSR) has embarked on a multi-pronged approach to reduce authorised push payment (APP) fraud within the Faster Payments System. As well as new mandatory reimbursement requirements due to come into effect in 2024, the PSR hopes to motivate regulated firms to improve their fraud controls by publishing performance data. This will show how much money connected to APP fraud is sent and received by each payment firm, and how firms perform when it comes to reimbursing victims.

The PSR has published the first ‘league tables’ today, showing data for 2022. The stats cover the UK’s 14 largest banking groups (‘directed firms’, which are obliged to report APP fraud data), plus nine other smaller firms that were among the top 20 highest receivers of fraud.

The performance tables will give firms that are successfully reducing APP fraud losses a competitive advantage, as they will enable customers to see how well individual banks perform in reducing fraud and how well they treat victims.

Recap: what is authorised push payment fraud?

APP fraud is a scam where fraudsters trick victims into sending them money. The account holder authorises the transaction, sending their money willingly but under false pretences.

Examples

Impersonation scams involve the fraudster pretending to be a trusted party like a bank employee or government official, for instance convincing the victim that their bank account is compromised and urging them to move their funds to a ‘trusted’ bank account which is actually under the fraudster’s control.

Romance scams, where a fraudster builds an online relationship with a victim and requests money for various reasons, such as bogus medical expenses or travel costs, supposedly to meet the victim.

Invoice scams, where victims are tricked into paying an invoice that seems to be sent by a legitimate supplier, normally via email. The invoice might be entirely fake, or fraudsters may have intercepted a real invoice and altered the bank details or changed the payment link.

Other examples of APP fraud include employment scams, rental scams, and charity donation scams — where money is sent under false pretences to secure employment, a rental apartment, or donate to a charitable cause respectively.

Key takeaways

1. There are inconsistent outcomes for customers reporting APP fraud. Some firms automatically reimburse victims nearly all of the time, others only make partial reimbursements, and others only consider claims in very narrow circumstances. This inconsistency should reduce with the introduction of mandatory reimbursement for all PSPs in 2024.

In terms of value reimbursed, the figures range from 91% (TSB) to 10% (Allied Irish Bank GB). In terms of volume, they range from 94% fully reimbursed plus 4% partially reimbursed (TBS), to 6% fully reimbursed plus 8% partially reimbursed (Monzo) and 12% fully reimbursed (Allied Irish Bank GB).

NB: PSRs are not currently required to reimburse victims of APP fraud. However, as of 2019, participants in the APP Contingent Reimbursement Model Voluntary Code (‘CRM Code’) have voluntarily agreed to reimburse fraud losses. To date there are nine firms signed up, representing the UK’s major banks with over 90% of the market in payment volumes. These firms would therefore be expected to have much higher reimbursement figures.
 

2. The data showing which firms receive the most money generated by APP fraud indicate a massive degree of variation, indicating fraudsters have identified which firms have weak controls and are actively exploiting them.  Newer and smaller PSPs typically have disproportionately higher rates of fraud than larger, more established firms.  The PSR notes these firms are in the much earlier stages of preventing fraud than major banks, and are not part of the voluntary CRM code. 

For non-directed PSPs (i.e. smaller firms), the rates of fraud-related funds received range from £10,355 per £1m received (Clear Junction) down to £334 (JP Morgan/Chase).  The figures were still widely discrepant but over a smaller range for directed PSPs, ranging from £696 per £1m received (Metro Bank) to just £44 (Santander).

Reasons for some firms having high rates of receiving fraud could include fewer, poor or delayed onboarding checks which would allow fraudsters to open and close accounts before being caught, or weaknesses in inbound transaction monitoring which prevent incoming fraudulent funds being identified and held.

NB: The PSR notes that some firms provide payment accounts to customers but do not manage the customer relationship themselves (e.g. banking-as-a-service providers).  The PSR states that irrespective of whether the firms manage the customer relationships themselves, they retain the regulatory responsibility and are expected to ensure their partners manage the risk of onboarding new customers, conducting identity checks, and monitoring transactions effectively.
 

3. Firms have started to address control gaps, and the PSR believes the situation may have improved over 2023 given greater levels of awareness and industry initiatives, but more still remains to be done.

Outcomes

While these figures date back to 2022, they conclusively show that there is a huge gulf in levels of exposure to APP fraud across the UK payment industry.  Many firms need to radically up their game to prevent themselves being used by fraudsters, and there is a clear imperative to do so given the incoming mandatory reimbursement requirements.  Put simply, unless the most exposed firms are able to reduce the value of fraudulent funds they receive, the resultant reimbursements could put them out of business.

The PSR has said it expects firms to start working “now” to implement the new requirements, beginning by allocating appropriate resources, moving towards adopting a stronger risk-based approach to payments, and making better decisions on when to intervene and hold or stop a payment. 

There are numerous anti-financial crime controls which play a role in reducing APP fraud exposure:

• Customer due diligence, including identity verification

• Customer risk assessments, including both customer as fraudsters (receiving funds) and victims (sending funds)

• Ongoing monitoring, including transaction and other activity monitoring

• Information sharing mechanisms and responsiveness to peer institutions and law enforcement

• Use of internal data and financial intelligence

• Robust assurance of fraud controls

• Staff training

How we can help

FINTRAIL is here to help PSPs adapt to the new requirements. Over the last five years we have worked with a range of institutions to successfully reduce their APP fraud exposure.

We offer a range of innovative, data-driven services to improve the effectiveness of your fraud controls and enable better identification of fraud risks. For firms considering where to start, we can conduct a thorough, data-driven risk assessment to identify current weaknesses in frameworks and controls and recommend practical enhancements that will reduce your potential liability exposure. This may include product and feature changes/enhancements, customer vulnerability assessments, new transaction monitoring scenarios, or enhancements to your customer risk assessment model. We can also conduct targeted audits of existing controls, or provide assurance and validation of programme changes being introduced to meet the new reimbursement requirements.

Get in touch with our team to learn more.

Sanctions Q&A: Growing sanctions compliance with the business

All firms, regardless of their size, are required to comply with sanctions. With the potential of significant fines, business restrictions and reputational damage, getting sanctions wrong can have significant consequences, and it is important that firms ensure the controls put in place on day one are still fit for purpose as the business grows, or when regulatory requirements change.

In this rapid fire Q&A with FINTRAIL Senior Consultant & Sanctions Lead Emil Dall, we will explore how sanctions compliance programmes can and should adapt over time.

Q1 - Why is it important to adapt sanctions compliance over time?

There is no one size fits all when it comes to sanctions compliance. For example, a FinTech operating only in the UK may initially find their sanctions risk sufficiently covered by deploying a simple name screening solution, and focusing exclusively on the UK sanctions list. However, as the company grows over time, their sanctions profile will change as well. This could include:

• An expanded product offering, which may be impacted by sectoral sanctions.

• A growth in customer base, leading to potentially more sanctions alerts and possible matches.

• Expanding to new markets, and introducing cross-border payments to and from jurisdictions that are at higher risk for sanctions.

FinTechs have unique product features and selling points to distinguish themselves from their competition, however this can also create novel sanctions risks. Firms should carefully consider what controls adequately address their sanctions risk. For example, while OFAC does not prescribe what specific controls firms must use, the agency expects firms “to employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance programme”.

Q2 - If my products or customers remain the same, can our sanctions compliance programme also stay the same?

No. Even if a firm’s products or customers do not change significantly over time, sanctions compliance cannot be left to its own devices. Sanctions risk is ever-changing, particularly since Russia’s invasion of Ukraine in 2022. The number of designated individuals and entities has increased exponentially, with the networks of those designated extending far beyond just Russia, and novel sectoral sanctions have been imposed prohibiting certain services, trades or activities connected with Russia. 

Staying up to date with regulatory requirements and how your products may be affected by specific prohibitions is key. In September 2023 the Financial Conduct Authority in the UK highlighted that when it comes to Russia sanctions, “firms that had taken advanced planning for possible sanctions before February 2022 were in a better position to implement [them]”. Staying on top of regulatory requirements and being prepared for what might come next is now expected by regulators.

Q3 - What are the key components of an effective sanctions compliance programme?

A sanctions compliance programme will look different in every firm, depending on its size and operations. Some components may be present from day one, and become more sophisticated over time, while other components will only be introduced as the firm grows. This includes:

• A sanctions risk assessment, perhaps initially conducted as part of a wider enterprise wide risk assessment, or later as a standalone sanctions risk assessment.

• Sanctions screening systems, which should be tested to ensure they work as intended and calibrated over time in line with the firm’s customer portfolio and sanctions risk. 

• Governance and oversight, including maintaining up-to-date policies, operating procedures, reporting obligations across all jurisdictions where the firm operates, and management information on sanctions trends.

Q4 - How can FINTRAIL help?

FINTRAIL can assist businesses that do not yet have a built-out sanctions compliance function, as well as those who are looking to enhance their existing sanctions policies and procedures. 

Regardless of where you are in your sanctions compliance journey, we assist clients of all sizes build and maintain an effective sanctions compliance programme that meets regulatory expectations - this includes development or enhancement of sanctions policies and procedures, sanctions risk assessments, sanctions screening and controls, and carrying out audits of sanctions compliance programmes. 

In addition, we are sanctions policy experts with experience working with governments across North America, Europe and Asia on sanctions design and implementation, and we can help firms be tuned into relevant changes in the fast-moving sanctions regulatory landscape.

Travel Rule: State of Play

Introduction

With deadlines looming in many jurisdictions to implement FATF Recommendation 16, also known as the “travel rule”, crypto has been front and centre of the anti-financial crime spotlight. While the travel rule was first adopted in 2019 by the Financial Action Task Force (FATF), a recent targeted update from June 2023 shows that member countries struggle to implement it. According to the update, over half of those surveyed have not taken any measures to implement the rule. While progress has been made since the survey, the topic of the travel rule and the associated ‘sunrise issue’, which refers to its uneven and phased worldwide adoption, continues to be significant. Delving deeper into this topic, FINTRAIL explores some common challenges firms face in implementing the crypto travel rule while unpacking the state of play in key jurisdictions.

A refresher: what is the travel rule? 💸

The travel rule, which comes under FATF’s Recommendation 16, “requires virtual asset service providers (VASPs) to obtain, hold, and transmit required originator and beneficiary information, immediately and securely, when conducting virtual asset (VA) transfers.” By doing so, VASPs and financial institutions can conduct effective sanction screening, detect suspicious transactions, and essentially bring crypto assets under the same regulatory umbrella as other types of financial transfers such as wires. The threshold amount is $1,000 or €1,000 - meaning that any transfer over this amount requires identifiable information to be shared on the originator and beneficiary.

The travel rule stipulates that transactions above $1,000 or €1,000 require the following information to be transmitted:

The originator VASP

• The originator’s name

• The originator’s wallet address

• The originator’s physical address, national identity number, customer identification number, or date and place of birth

The beneficiary VASP

• The beneficiary’s name

• The beneficiary’s wallet address

For transactions below the $1,000 or €1,000 threshold, the following information must still be transmitted:

The originator VASP 

• The originator’s name

• The originator’s VA wallet address or a unique transaction reference number for VA transfers

The beneficiary VASP 

• The beneficiary’s name 

• The beneficiary’s VA wallet address or a unique transaction reference number for VA transfers

As countries work to transpose the travel rule into their own regulatory frameworks at varying rates, here’s the current state of play for key jurisdictions:

The United Kingdom 🇬🇧

On 17th August the Financial Conduct Authority (FCA) published a statement outlining the expectations for UK businesses complying with the travel rule. Since the publication of the FATF Recommendation, the UK has amended its Anti-Money Laundering and Terrorist Financing regulations (MLRs) accordingly. The recent statement from the FCA highlights that firms must adhere to the travel rule from 1 September 2023.

In addition to full compliance with the rule, the expectations outlined by the FCA include taking reasonable steps and due diligence for compliance, regularly reviewing the implementation status of the rule in other jurisdictions to adapt business processes appropriately, and responsibility for compliance even when using third-party suppliers. 

When sending crypto asset transfers to a jurisdiction without the travel rule, the FCA specifies that firms take all reasonable steps to indicate that the firm can receive the required information. If the firm cannot, the UK firm must abide by the MLRs, collecting, storing, and verifying the information appropriately. Receiving crypto-asset transfers from a jurisdiction without the travel rule requires a risk-based assessment before making the funds available to the beneficiary. Decisions should consider the jurisdiction(s) in which the sending firm operates and the status of the travel rule in those countries.

The European Union 🇪🇺

In the EU, the Transfer of Funds Regulation will implement FATF’s travel rule and extend wire transfer requirements to crypto providers. The regulation will have no minimum, meaning all transactions will require identification information to be shared, regardless of the amount. The law also covers transactions above €1,000 from self-hosted wallets when interacting with hosted wallets managed by crypto-asset service providers.  

Explainer: What are self-hosted wallets?

Self-hosted wallets are digital wallets where the user has sole control over their private keys, permitting them to store, send, and receive crypto without needing a centralised platform or intermediary.

The regulation will apply from 30 December 2024.

The United States 🇺🇸

In May 2019, the Financial Crimes Enforcement Network (FinCEN) published clarifying guidance on applying existing regulations to convertible virtual currencies. The consolidating document clarifies the inclusion of virtual currencies in the travel rule initially created for fiat currencies. The threshold in the US is currently $3,000, though a proposed rule change was made to lower the threshold to $250 for international transfers, though this has not yet gone into effect.

Challenges to implementation

Among the notable challenges to the travel rule’s implementation, the ‘sunrise issue’ speaks to the staggered and nonuniform application of the rule across jurisdictions. For example, Singapore and Japan have already implemented the travel rule, on 28 January 2020 and 1 June 2023 respectively, whereas countries in the EU have until the end of 2024. These different timelines pose challenges as firms must send information to firms in countries that may not be mandated to receive or transmit data. Additionally, there may be jurisdictional variances as countries transpose the travel rule into their own national regulations differently. The United States, for example, currently has a threshold of $3,000 rather than FATF’s recommended $1,000. These differences mean VASPs are tasked with navigating cross-border variations. 

Recognising the uneven global application, the FATF noted that VASPs should consider additional control measures for countries with weak implementation, such as rigorous monitoring of transactions with VASPs based in higher risk countries, “placing amount restrictions on transactions, or intensive and frequent due diligence.” 

Another key practical challenge is technology requirements, as the rule requires firms to deploy complex technology solutions that were previously unavailable. In Australia, where the travel rule has yet to be transposed into national law, officials said in 2021 that there were insufficient technological capabilities to implement the rule adequately.  VASPs must exchange data with other VASPs through messaging protocols, and varying formats raise interoperability issues. Other concerns stem from navigating data privacy, data processing requirements, and security concerns. All these factors make the practical implementation of the travel rule a daunting task.

How FINTRAIL can help

FINTRAIL is experienced in working with VASPs, including cryptocurrency trading platforms and traditional firms with exposure to crypto-assets in the UK, Europe, APAC and globally. We help VASPs around the world ensure regulatory compliance and an effective implementation of the travel rule. Through the provision of the highest quality consultancy services, based on deep sectoral experience and pragmatism, we help firms reduce their exposure to financial crime.

---

Case study: Remediation for a cryptocurrency exchange [read now]

PEPs in Perspective: How to manage politically exposed clients

Introduction

Earlier this month, Chancellor Jeremy Hunt asked the UK’s Financial Conduct Authority (FCA) to investigate whether financial institutions are closing politicians' bank accounts on a widespread basis. Sparked by a controversy involving former Brexit Party leader Nigel Farage, who accused the private bank Coutts of closing his account because of his political views, the topic of politically exposed persons (PEPs) and debanking has come to the fore. The discussion arises against the backdrop of a significant increase in account closures because of anti-money laundering efforts over the last few years.

The FCA has now issued a data request to banks, specifically asking if accounts have been closed due to political opinions and has confirmed it aims to provide an initial assessment by mid-September - a phenomenally fast turnaround for a potentially tricky exercise. 

Payment account regulations in the UK state that everyone has a right to open a basic bank account. Financial service providers cannot discriminate on the basis of protected characteristics such as gender, religion, and race, as per non-discrimination legislation. However, outside of these protections, financial institutions are entitled to decide which customers they choose to bank in line with their risk appetite. For example, firms may turn away specific industries, such as adult entertainment, gambling, or manufacturers of firearms and ammunition, if they are deemed too risky.  While the Coutts case focuses more on political views and reputation rather than financial crime risk, a buzz has been created around PEPs and debanking in an anti-financial crime context.  

In response to this recent development, FINTRAIL has looked at some of the requirements and best practices for financial institutions when dealing with PEPs.

The basics

First, let’s visit the definition of what a PEP actually is. While each jurisdiction has its own specific meaning in line with its legal and regulatory framework, the Financial Action Task Force’s (FATF) influential definition is “an individual who is or has been entrusted with a prominent public function”. Family members and close associates of PEPs may also receive PEP designations.   PEPs can be further broken down into the following categories: 

• Foreign PEPs: individuals given significant public roles by a foreign country.

• Domestic PEPs: individuals given significant public roles within their own country.

• International organisation PEPs: senior management in international organisations such as UN bodies, including directors, deputy directors, board members, or those with similar responsibilities.

The reason financial institutions are required to identify PEPs is that they pose a heightened risk of bribery and corruption, due to the opportunities afforded to them by their political office

In the UK, a PEP, as defined by the Money Laundering, Terrorist Financing, and Transfer of Funds (Information of the Payer) Regulations 2017 is “an individual who is entrusted with prominent public functions, other than as a middle-ranking or more junior official.” The regulations include some helpful but non-exhaustive examples such as heads of state, ambassadors, and members of the supreme court. They state regulated institutions must be able to identify if a customer is either a PEP or “a family member or a known close associate of a PEP”.

PEP obligations for financial institutions

Each country differs in what it requires of financial institutions when it comes to PEPs. UK regulations state that financial institutions should place PEPs and their family members under enhanced due diligence. Similarly, in other jurisdictions like Singapore and Australia, regulators require financial institutions to apply enhanced due diligence to PEPs. While the exact nature of what constitutes enhanced due diligence has no prescriptive meaning and should form part of a risk-based approach, it commonly entails additional ongoing monitoring and screening measures such as adverse media screening. Some other examples of enhanced due diligence measures compiled by the FCA include establishing the source of wealth to ensure its legitimacy, commissioning external third party intelligence reports where necessary, and obtaining more robust verification of customer information from a reliable and independent source. 

In the United States, the term PEP refers to foreign individuals “who are or have been entrusted with a prominent public function, as well as their immediate family members and close associates.” There is no obligation to identify domestic PEPs.  While not expressly requiring PEPs to undergo any enhanced due diligence, firms must take the appropriate action in line with a risk-based approach and the client’s risk profile. Notably, recent developments with the Anti Money Laundering Act 2020 have increased scrutiny on PEPs, encouraging financial institutions to enhance their policies. 

Not all PEPs are created equal

In the last decade, PEPs have come into the spotlight for illicit activities and corruption revealed in investigations by organisations like the International Consortium of Investigative Journalists, such as the Panama Papers and Luanda Leaks. More recently, news has centred on Russian kleptocrats and the global sanction regimes targeting them, bringing the abuse of power of those politically connected to Vladimir Putin into public discourse. But are all PEPs automatically high-risk clients? 

While PEPs are generally considered at higher risk for bribery and corruption, this is contingent on a few factors. The FCA’s guidance outlines some of the indicators that make a PEP a higher-risk client for financial institutions, including involvement with a product “capable of being misused to launder the proceeds of large-scale corruption.” Another indicator centres on geographical considerations, like if a PEP is “entrusted with a prominent public function in a country that is considered to have a higher risk of corruption”, taking into account a range of factors like political instability, widespread organised criminality, human rights abuses and more.  Another consideration is the personal and professional nature of the PEP - if they have wealth inconsistent with known legitimate sources or are responsible for large public procurement exercises.  

So while there is a regulatory obligation in most countries to apply extra measures to all PEPs, not all genuinely pose a significant risk of bribery or corruption. It is also vital to note that conducting enhanced scrutiny of PEPs should never be done under the assumption that all politicians (or their families or close associates) are likely criminal actors. The overwhelming majority are not. In fact, a 2017 FCA guide explicitly states that firms are “required to recognise the lower risk” of UK PEPs, or PEPs from a country that has “similarly transparent anti-corruption regimes”. Depending on a holistic range of risk factors, some may be lower risk than others.  Firms should effectively identify and monitor PEPs to ensure that in the event suspicious activity does occur, you will flag it, investigate it, and report it. This approach is foundational to an effective anti-financial crime programme. 

Best practices

Firms should regularly revisit their policies concerning PEPs to ensure their alignment with their internal risk appetite and risk-based approach. 

Some areas of focus include:

• Having a clear risk appetite statement regarding PEPs, based on a nuanced understanding of the financial crime risk they pose whilst remembering simply banning PEPs is not appropriate.

• Fortifying enhanced due diligence measures and processes to ensure the risks associated with PEPs are truly understood and mitigation measures are appropriate.

• Regularly training staff on how to identify a PEP, the associated risks, and the processes to be followed once a PEP is identified.

• Designing clear onboarding processes and exit strategies for PEPs.

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you refine your enhanced due diligence measures and incorporate an effective risk strategy for PEPs in a practical and efficient way. 

The Real (E)state of Money Laundering in Property

Introduction

Money laundering in real estate has been a hot topic of late, with explosive headlines from the UK to the UAE to Canada to Australia. Most glaringly, dirty money from Russia has attracted tremendous attention following last year’s unprecedented sanction regimes brought on by the Ukrainian invasion. In particular, the UK real estate market has received widespread criticism for serving as a haven for questionable funds from Russian oligarchs, giving popularity to the term ‘Londongrad’. Research by Transparency International has estimated £1.5 billion of UK property has been purchased by Russians accused of corruption or with links to the Kremlin. Such reports sparked outrage and even legislation requiring the beneficial owners of property to be disclosed in a new public register. 

In light of this crackdown in the UK, Russian cash is seemingly heading to places like Dubai instead. According to one source, since the Ukrainian invasion, the “Russian population in the UAE has risen fivefold to as many as 500,000”, propping up the luxury real estate market. But even before the war, Dubai was a popular refuge for criminals from all over the world looking to stash their ill-gotten gains. Last year the Dubai Uncovered property leak disclosed data from 2020 on criminals, officials, and sanctioned politicians with ties to the Dubai property market.  One of the people identified in the leak is a Czech politician named Libor Novák who is accused of corruption, listed as owning six apartments in the Dubai Marina worth nearly $2.7 million. Another illicit actor is the Estonian businessman Marko Taylor, a convicted fraudster listed as owning a villa and an apartment worth over $1 million. 

These instances are far from isolated. Reports in Australia (where it is thought that criminals linked to China laundered $1 billion through real estate in 2020), Canada, and the United States demonstrate the popularity of real estate as a medium to hide and launder illicit proceeds from bad actors worldwide.

But why is the real estate sector so attractive to criminals?

Real estate can be used at different stages of the money laundering process. At the placement stage, in some jurisdictions with poor money laundering frameworks properties can be bought with physical cash, with minimal or no checks on identity or source of funds. At the layering stage, property can be used to transfer and obfuscate illegal funds using complex ownership structures with shell companies or trusts obscuring the original source of funds. It’s very helpful for dealing with source of funds checks - financial institutions will often accept the explanation that funds derive from the sale of a property in a less well-regulated jurisdiction, without going further back and asking how you came to have the money to buy the property in the first place. Finally, real estate can also be used to legitimise illicit funds at the final investment or integration stage.

Other aspects of real estate’s appeal are the same features that appeal to regular investors.  Real estate is viewed as a stable investment and thus a safe place to invest, compared to speculative assets such as cryptocurrency or stocks.  In prime property markets where prices are high and generally increase over time, criminals can increase their wealth even further. And since housing prices are subjective and fluctuate over time, it is easy for them to be manipulated and over or undervalued.

A final advantage is that the high cost of property means criminals can launder large sums of money in a single transaction. As already noted, Dubai is a hot spot for luxury property transactions, being the “busiest market for $10mn-plus homes in the first quarter of 2023”, surpassing Hong Kong and New York. Reports state that the number of sales of homes in Dubai worth over $10 million has risen seventeen-fold in the last five years. For example, the average price of a villa in Dubai-Sea Mirror is around $20 million. 

While the real estate market is subject to money laundering regulations in most countries, this is seldom well enforced. In practice, anti-money laundering practices are often extremely lax or even non-existent. Even in jurisdictions with ‘respectable’ reputations, money laundering through real estate is rampant. Canadian cities Toronto and Vancouver are prime examples, being notorious for attracting nefarious actors who use the extortionate markets to absorb their funds. As public awareness of the problem increases, and housing crises caused by soaring prices continue, governments worldwide are taking steps to rectify the problem, including measures such as unexplained wealth orders and land and property ownership transparency registries.

Reasons why real estate is attractive to criminals:

• Real estate is a stable investment that generally increases in value.
• Pricing is subjective and overvalued houses are common, allowing real estate costs to be easily inflated.
• As the cost of property is extremely high, criminals can launder large amounts in a single transaction.
• Money laundering regulations for the real estate sector are seldom enforced and anti-money laundering practices are often very lax.
• The sale of property is a good way to satisfy source of funds checks.

Common methods for money laundering 💸

One common method used to launder money through the real estate sector is purchasing a property using family and non-family proxies to avoid detection. This was clearly demonstrated in an investigation by the Organised Crime and Corruption Reporting Project (OCCRP), which revealed a Russian national named Sergey Toni owned real estate worth over $59 million despite having no profitable businesses of visible profile. Segey Toni’s father, however, is a deputy managing director of one of the largest transportation companies in the world, the state-owned Russian Railways. Another example revealed by the OCCRP is Chen Runkai, a Chinese property developer linked to a military corruption scandal. Chen owns million-dollar properties in the same Vancouver neighbourhood as his daughter, who purchased a mansion mortgage-free for about CAD 14 million (approximately £8.1 million) at the age of 25 while listing her occupation as a ‘student’. 

Other common strategies include using anonymous front companies, especially in jurisdictions where anonymity is commonplace. This is particularly evident in the US, where certain states such as Delaware, Nevada and North Dakota allow for completely anonymous shell companies. While moves are underway in the US to create a database of beneficial ownership information, its effectiveness remains controversial. For more analysis on corporate transparency, check out FINTRAIL’s article here. The problem is widespread; anonymously held and corporate-owned real estate affects every jurisdiction with an international property market.  A recent Transparency International investigation from July 2023 revealed the scale of the problem in France, showing that “the vast majority of corporate-owned real estate in France is held anonymously”, and nearly a third of all companies have not disclosed who ultimately owns them, despite legally being required to do so. 

Criminals may also engage with third parties or trusts to be the legal owner of a property, further blurring true ownership.

What should financial institutions be doing?

For financial institutions looking to strengthen their anti-financial programmes against real estate money laundering, it’s vital to identify potential red flags and common typologies. Transactions involving real estate deals should be adequately scrutinised and the real estate industry as a whole should be considered higher-risk, potentially subject to enhanced due diligence measures. Compliance teams should focus on establishing original source of wealth and determining the ultimate beneficial owner of properties to identify nefarious actors or suspicious activity. 

Potential red flags:

• Multiple property purchases and sales made in a short period of time
• Over / undervaluation of property prices
• Complex loans or credit finance (repayment can be used to mix illicit and legitimate funds)
• Financing of property using offshore lenders
• Unusual income (e.g. no declared income or inconsistency between declared income and th standard / value of the property)
• Cash purchases
• Unknown source of funds for purchases (i.e. incoming foreign wire transfers where originator/beneficiary customers are the same)
• Ownership of property is the customer’s only link to the country where real estate is purchased
• Straw buyers or properties purchased using family members’ names
• Properties purchased through front companies, shell companies, trusts and complex company structures

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you fortify your controls in a practical and efficient way. 

Bridging the Gap: Integrating ESG Considerations with Anti-Financial Crime

Environmental, social and governance (ESG) considerations have become indispensable aspects of sustainable finance and responsible investing, generating a lot of attention and press coverage. Yet there is an important connection between ESG and financial crime which is seldom discussed.  Particularly, the harmful activities of environmental crime, such as illegal deforestation, wildlife trafficking, waste trafficking, and illegal mining, reap globally-felt negative consequences, which has prompted regulators and financial institutions to take action. Some estimates state that ESG regulations have increased by an astounding 155% over the past decade. The European Union, for example, has mandated corporate sustainability disclosures for large and listed companies since January 2023.  And in its most recent annual report, the European Banking Authority (EBA) highlighted the role of ESG risks in the prudential framework.

The three factors that comprise ESG are essential in assessing corporate reputation, investment risk, and sustainability. And both the undermining of ESG factors and the prevalence of financial crimes pose severe threats to firms and increase regulatory and financial risks. Additionally, as with all criminal activity, when ESG crimes occur, the proceeds must be laundered. This is where financial crime naturally overlaps with ESG.  A closer look at this intersection can provide valuable insight into how anti-financial crime compliance can further ESG objectives.

This article examines the relationship between ESG and anti-financial crime and the benefits of their integration, and takes a future view of how ESG will continue influencing anti-financial crime priorities and efforts.

E - Environmental 

As awareness and urgency to address climate change increase, harmful environmental practices have become more scrutinised. Climate action is no longer limited to individuals making voluntary eco-friendly choices but increasingly involves regulatory protections and legal requirements. 

Environmental crime threatens entire ecosystems, human health, and industries. It also reaps massive profits for criminals, being one of the most profitable crimes in the world. The latest figures estimate environmental crime generates $110-281 billion annually. Despite its profitability, environmental crime is perceived as a ‘low risk, high reward’ activity. A recent report on wildlife trafficking in Europe highlighted that because financial institutions lack knowledge of timber and wildlife trafficking typologies, suspicious financial transactions often go unnoticed. These unlawful activities are often linked to organised crime, corruption, and other illicit activities (e.g. environmental crimes such as illegal logging or waste trafficking reportedly fund non-state armed groups and militias, and have links to human trafficking and slave labour).

In case you missed it, check out FINTRAIL’s article on environmental crime, where we examine illegal waste trafficking, deforestation and logging. We explore how criminals typically launder the proceeds of these specific crimes and what financial institutions should do to respond.

Environmental crime has been a predicate offence in Europe since the EU’s Sixth AML Directive came into effect in 2020. In the past few years, the global authority on anti-money laundering and counter-terrorism financing (AML/CTF), the Financial Action Task Force (FATF), has published various guidance papers on money laundering from environmental crime and the illegal wildlife trade, marking it as a new area of awareness for financial institutions. In the reports, the FATF draws attention to links to terrorist financing and other areas of criminality.  National regulators have also released specific guidance, such as in Canada and the United States. And last year, for the first time, the Basel AML Index included environmental crime data in its methodology.

Along with a deeper analysis of environmental crime is the recognition that it undermines the sustainability goals set by the ESG framework. As illicit proceeds from environmental crime are laundered, financial institutions face reputational risk, regulatory risk, and financial risk — all of which directly concern ESG-focused investors and financial institutions.

S- Social

One of the key components of the ‘social’ pillar of ESG is human rights. Human trafficking, forced labour and modern slavery generate illicit revenue that finds its way into the legitimate financial system, directly impacting anti-financial crime programmes. Awareness of these crimes has gained significant traction in the past decade, with FATF guidance on topics such as migrant smuggling and money laundering, legislation such as the UK’s  Modern Slavery Act of 2015, and frameworks for human-rights centred sanctions programmes such as the UK’s Global Human Rights Sanctions Regulation 2020.  

ESG regulation relating to the ‘social’ pillar is also an important area of focus in the US, evidenced by the Uyghur Forced Labor Prevention Act, which prohibits the importation of goods that were produced by forced labour in the Xinjiang Uyghur Autonomous Region of China, and has serious implications on supply chains. While other jurisdictions have shied away from a total ban, there have been sanctions for human rights violations against the Uyghurs in places like the UK and Canada, with consequences for financial institutions’ screening programmes.

Such instances underscore the need for financial institutions to be alert to the regulatory and reputational risks associated with emerging social issues within ESG, emphasising the importance of understanding the risk a customer poses.

Case study: ESG ‘social’ pillar and anti-financial crime compliance

In 2020, the major Australian bank Westpac reached a settlement regarding more than 23 million breaches of AML laws, including failing to detect transfers involving child exploitation. The bank was fined AUD 1.3 billion ($922 million) by the regulator AUSTRAC - the biggest AML breach in Australia’s history. Among its failures, Westpac failed to implement adequate transaction monitoring scenarios to identify child exploitation risks, and to carry out appropriate monitoring and investigation of suspicious transactions.

G- Governance

Within the ESG framework, bribery and corruption are most clearly aligned with both the ‘governance’ pillar and anti-financial crime. Bribery and corruption have long been an area of focus for financial institutions in mitigating financial crime, evidenced by the need to employ special measures for managing politically exposed persons and treating them as higher risk customers. 

In updated guidance on anti-bribery and corruption (ABC) compliance programmes, the Wolfsberg Group stated that financial institutions should consider aligning their ABC programmes with “aspects of bribery and corruption risk which are connected to human rights or ESG concerns”. There have been recent reports of firms already including ESG factors within their ABC and financial crime risk rating systems and vetting clients, suppliers, and third party entities in vulnerable industries.

Integrating ESG principles with anti-financial crime strategies 

Overall, ESG is a high priority for regulators and will continue to gain significance with both official bodies and the general public.  This means that financial institutions should actively consider ESG risks as part of their risk-based approach and within their anti-financial crime programmes.

Concretely, this can mean:

• Conducting enhanced due diligence for individuals or businesses involved in industries with a higher ESG risk (e.g. forestry, animal-related businesses)

• Updating policies and risk appetite statements to account for ESG, and including ESG risk as part of business and customer risk assessments

• Including ESG risk triggers in adverse media screening

• Enhancing training on ESG risks for compliance staff, including exploring its connections to other areas of financial crime

Conclusion

Integrating ESG considerations into anti-financial crime strategies will become increasingly important as regulatory and industry bodies, like the FATF, focus on the financial aspect of environmental crimes, and as jurisdictions continue to legislate the ESG space. The connection between ESG principles and financial crime has critical implications in areas like risk assessments, screening, and due diligence. Recognising these ESG risks can mitigate financial risks, ensure regulatory compliance, and contribute to global sustainability goals. 

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you fortify your controls against ESG crimes and incorporate an ESG risk strategy in a practical and efficient way.

It’s not you, it’s me... Is it time to break up with your auditor?

Recent corporate scandals and collapses such as Wirecard, Carillion, BHS, and the infamous Enron case draw out one recurring theme - how to keep auditors accountable.  Conflicts of interest, poor quality and lack of independence have been the hallmarks of the recent scrutiny on audit firms across the UK and globally. As a response, reform is underway within the UK; HM Treasury has announced plans to reform the audit sector to promote quality and competition.

Whilst these reforms focus on corporate reporting, they also raise other questions - should regulated firms reflect on their financial crime audit process and is it time to shake things up?

The value of conducting a financial crime audit cannot be understated - simply put, it helps identify issues and deficiencies in your anti-financial crime (AFC) controls and systems and supports your regulatory compliance. It has long been a regulatory requirement; the Financial Conduct Authority’s Financial Crime Handbook highlights an independent audit (internal or external) to monitor effectiveness of your AFC controls as a best practice. The European Banking Authority’s Guidelines on the Roles and Responsibilities of a Compliance Officer set out a clear expectation for annual independent (internal or external) AML audits to assess the effectiveness of controls, with the findings reported to senior management.  Many partner banks also require to see financial crime audits from their account holders, with some having approved provider lists or set criteria.

With regulatory scrutiny only increasing, it is clear that a ‘check-the-box’ approach to AFC is no longer sufficient. Regulators not only expect firms to conduct an audit but are insisting audits are robust and are conducted by experienced and skilled AFC experts. This reinforces the importance of having a strong audit partner alongside strong internal controls and oversight.

---

---

We know that when you have built a strong relationship with your auditor over a number of years and they know your business well, this can be hard to walk away from. But this is often a key reason to make the leap.

Only the largest businesses in the UK are required to change auditors on a regular basis.  For most firms, there is no strict obligation and it’s up to the firms to realise when they may need a fresh look from a new objective partner.

Your needs and business relationships will shift with time and circumstances. And this means your auditing needs may change, too. Sometimes it’s quite clear you need - or want - a new auditor, other times less so. However, changing your auditor periodically can bring advantages to your firm, whether that be fresh insights, a new perspective, or deeper sectoral expertise. It can:

• Provide a new perspective - a new AFC audit firm may improve the robustness of your controls by asking different questions and taking a fresh look at your existing approach.  Having access to different industry leaders and tapping into their deep sectoral knowledge and experience may be a draw.

• Provide objectivity - if one audit firm has reviewed your controls and processes year-in year-out, it may be more difficult for them to be objective or proactive in identifying issues that have previously been overlooked.  Working with a new audit partner helps address this potential risk.

• Support the growth of your firm - as your firm grows you may start to offer new products or become more international, meaning that what was right for you in the past may not be right for you now. You may need an AFC audit firm with specific expertise in your current products, risks and markets.

• Improve the quality of your current engagement - how an AFC audit is delivered matters. Audits should not adopt a one-size-fits-all approach; the ability to customise them to your needs is key.  Rather than settling for your current audit partner for the sake of simplicity, consider if there are other firms that can offer you a better service.

• Increase value for money - price and service is often what this decision comes down too. A fair and competitive price from a firm equipped to respond to your needs quickly, with individuals willing to have open and frank discussions, will set a solid foundation for an effective and efficient audit. 

Overall, the considerations for finding the right AFC audit firm to support your needs are unique for each business. A high-value, quality audit partner will understand your type of business and its financial crime risks, know the industry well, and use that knowledge to translate information into valuable and actionable insights.  A firm that focuses on attention to detail, offers practical and implementable recommendations, provides a responsive service and establishes a trusted relationship will be the right firm for you - for a few years of course!

So what is FINTRAIL’s position?  While normally we are delighted when clients come back to us year after year, with audits we take a different view and practise what we preach!  In line with professional standards, we advise clients to rotate away from us after three years to allow for a fresh set of eyes to review their programme.  They can always come back to us down the line, but we know that rotating to another audit provider for at least a year or two will benefit them most in the long run.

About FINTRAIL

At FINTRAIL we are passionate about combating financial crime. We have extensive experience conducting audits and assurance processes for financial services businesses. Our approach focuses on both ensuring regulatory compliance, and making suggestions for how firms can improve their operational effectiveness.

We have conducted audits covering financial crime and regulatory compliance across multiple sectors including retail and personal finance, business banking, payments, forex, investment, banking-as-a-service, and crypto. We also have significant international experience, conducting multi-jurisdictional audits across Europe and APAC.

Our unique team of experts is drawn from the industries we support and has deep hands-on experience in leadership roles with leading banks, FinTechs, and other financial institutions. Our approach is tailored to the unique circumstances of each client, is regulatory and technology driven, and is focused on providing excellent customer outcomes. We offer our clients pragmatic solutions to the most complex challenges.

Our goal is to ensure our clients can thrive, free from the negative impacts of financial crime.

---

Unravelling the EBA Report on the Risk of Payment Institutions

Anti-money laundering and terrorist financing controls are less than 10% effective in reducing the financial crime risks of payment firms. That is according to EU anti-money laundering and counter-terrorist financing (AML/CTF) supervisors that gauged the sector’s inherent and residual risk levels.  In a recent report, the European Banking Authority (EBA) stated that payment firms are not doing enough to manage money laundering and terrorist financing (ML/TF) risk, and not all EU member states are doing enough to supervise the sector effectively either. Because of variance and uneven supervision across the EU, payment institutions can establish themselves in member states with less robust oversight and authorisation procedures and access the rest of the EU market through passporting. 

The report highlights some of the sector’s key risk areas, including a specific call out for remote onboarding without appropriate safeguards, cross-border activity and exposure to high risk geographies, and the risks associated with agent networks.

Key findings

• Despite a slight improvement in the quality of business-wide and individual risk assessments, there is a poor overall awareness of ML/TF risks.

• Remote onboarding often lacks appropriate safeguards, leading payment institutions to fail to identify high-risk customers, including politically exposed persons (PEPs).

• Many transaction monitoring systems are deficient or not in place at all. 

• “Emerging threats” include white labelling (i.e. where payment institutions make their licence available to independent agents that develop their own produce under the licence of the regulated financial institution) virtual IBANS, and third-party merchant acquiring.

• The report stresses the risks associated with the use of networks of intermediaries, including agents.  There is no common EU-wide approach to the supervision of agent networks by payment institutions, or of payment institutions with widespread agent networks by regulators.  Agents’ core business is not always linked to the financial services industry, and many serve one or more payment institutions at the same time, making oversight difficult.  The EBA believes the risk has “crystallised” and that there is a high probability that agents are being exploited by criminals or criminal networks.

Comparison with the FCA

The release of the EBA’s paper comes only months after the UK’s Financial Conduct Authority (FCA) published a ‘Dear CEO letter’ outlining risks and priorities for payment firms. 

While some issues are flagged by both supervisors, such as sanction screening and lack of governance for scaling firms, there are some variances. The one glaring difference is the EBA’s lack of focus on fraud. Fraud levels are endemically high In both the UK and mainland Europe and are unlikely to decline given the current economic backdrop.  As payment institutions are particularly vulnerable to this type of illicit activity, fraud’s absence in the EBA report is somewhat surprising. Additionally, the EBA’s explicit inclusion of remote onboarding as a risk suggests that certain EU institutions still struggle with this, despite comprehensive guidelines issued by the EBA and the endorsement of remote onboarding by multiple organisations including FATF.

Here are some comparative findings of common issues: 

What do payment firms need to do?

As outlined above, the FCA and EBA have both highlighted key problem areas for payment institutions.  While there are some differences in focus, it’s clear that both will require standards to be improved and risks to be better mitigated across the sector. 

As European supervisory authorities will likely increase scrutiny on the payment sector following the EBA’s report, payment firms can avoid expensive remediation and painful regulatory enforcement down the line by assessing their compliance programme and strengthening their controls now.

---

Contact our team for free expert advice

---

New Reimbursement Requirements for APP Fraud

On 7 June, the UK’s Payment Systems Regulator (PSR) published a policy statement outlining new requirements for reimbursing victims of authorised push payment (APP) fraud within the Faster Payments System.

What are the new requirements for APP fraud?

Once the regulations come into effect, currently slated for 2024, all payment service providers (PSPs) will be required to fully reimburse victims of APP fraud within five business days. There are exceptions for fraud or gross negligence by the payer, as well as an excess (value to be decided). The costs of reimbursement will be allocated equally between the sending and receiving PSPs, with a default 50:50 split. 

Why is this happening?

The need for a jolt to the system is clear; APP fraud has quickly become one of the most significant types of payment fraud globally.  The PSR reports that in 2022, there were around 207,000 reported cases on personal accounts with total losses of £485m (but notes this is likely an underestimate).

The authorities’ proposed solution as set out in this statement is also clear - shifting the onus for tackling APP fraud onto financial institutions and giving them a clear financial incentive to prevent it happening in the first place.   The PSR says that by adopting an outcome-based approach, it is giving the industry “the space to innovate and to choose how best to deliver the new reimbursement requirement” - i.e. moving away from tick-box compliance to focus on effectiveness. 

What does this mean for PSPs?

The implications for financial services firms are huge. For some, if they are not able to get their houses in order, the estimated costs could pose an existential threat large enough to put them out of business. We have spoken with industry contacts who have  told us that some institutions and EMI agents  are unlikely to survive under the new regime without significant changes, given how vulnerable they are to APP fraud. We know of estimated liability figures that are significant multiples above current fraud losses. Firms need to take meaningful, decisive action to protect themselves and their customers, to significantly improve how they identify inbound APP fraud related payments on their own books and identify and protect their customers as victims.

What does the PSR expect?

The PSR says it expects industry to start working “now” to implement the new requirements, beginning by allocating appropriate resources and understanding how they can meet the conditions. Specifically, firms should move towards adopting a stronger risk-based approach to payments, and make better decisions on when to intervene and hold or stop a payment. The PSR believes the requirements will lead firms to “innovate and develop effective, data-driven interventions to change customer behaviour” - a message that is music to FINTRAIL’s ears!

What can PSPs do?

So where should payment firms start?  There are numerous parts of an anti-financial crime framework which play a role in reducing APP Fraud exposure - all of which need to be assessed and enhanced:

• Customer due diligence, including identity verification

• Customers as victims; assessing vulnerability and improving awareness

• Customer risk assessments, considering payment sending and receiving exposure

• Ongoing monitoring, including transaction and other activity monitoring

• Operational enhancements to process monitoring interventions and reimbursement claims

• Responsiveness to peer institutions and law enforcement

• Use of internal data and financial intelligence

• Robust assurance of fraud controls

• Staff training

How can we help?

FINTRAIL is here to help PSPs adapt to the new requirements. Over the last five years we have worked with a range of institutions to successfully reduce their APP fraud exposure. With our proven track record we can offer a range of innovative, data-driven services to improve the effectiveness of your fraud controls and enable better identification of fraud risks.

For firms considering where to start, we can conduct a thorough, data-driven risk assessment to identify current weaknesses in frameworks and controls and recommend practical enhancements that will reduce your potential liability exposure. This may include product and feature changes/enhancements, customer vulnerability assessments, new transaction monitoring scenarios, or enhancements to your customer risk assessment model. We can also conduct targeted audits of existing controls, or provide assurance and validation of programme changes being introduced to meet the new reimbursement requirements.

Speak to our team to find out more

---

Auditing your Fraud Controls: Ensuring Confidence in your Anti-Fraud Programme

It’s no secret that fraud is one of the most pressing threats to financial institutions, exacerbated by stormy economic conditions. The most recent fraud report by UK Finance calls attention to post-pandemic unauthorised and authorised fraud trends, underlining the continuance of social engineering schemes which manipulate victims into forfeiting sensitive details or transferring funds. Overall, the report puts UK fraud losses at an outstanding £1.2 billion for 2022, which is equivalent to over £2,300 every minute.

These high fraud rates correlate with increasing regulatory expectations for firms to remedy weaknesses in their systems and controls. Most recently, the Financial Conduct Authority (FCA) emphasised fraud as a priority area in a Dear CEO letter outlining immediate actions for financial institutions to take.  These include the need to review risk appetite statements to ensure they adequately address the risk of fraud to customers, maintaining appropriate customer due diligence controls to prevent accounts from receiving proceeds of fraud, and regularly reviewing fraud prevention systems and controls to ensure effectiveness.

---

📢
To address recent regulatory guidance on fraud for financial institutions, FINTRAIL has increased the scope of our fraud assessments as part of our standard audit offering. To find out how we can support your audit process and associated fraud controls, get in touch with our team.

---

This priority area corresponds with the UK government’s express inclusion of fraud as part of the most recent Economic Crime Plan and the launch of its fraud strategy, which is one of the most progressive in the world. The focus on fraud is not isolated to the UK alone; the United State’s Financial Crimes Enforcement Network (FinCEN) has also made it clear that combating fraud is a top priority, with the Monetary Authority of Singapore (MAS) also funnelling resources into anti-fraud initiatives. In view of this, we can expect further regulatory attention and enforcement concerning fraud.

As fraud remains a huge and growing financial crime threat on a global scale, regulators will not only require firms to have robust fraud controls as part of an effective anti-financial programme but also increase their scrutiny of regulated entities in this area.  Having an appropriate fraud strategy and mitigation measures in place directly translates to effectiveness in anti-financial crime controls, meaning financial institutions should ensure and fortify their framework.

In light of this fraud threat landscape and the associated regulatory expectations, FINTRAIL has increased the scope of fraud assessment as part of our standard audit offering, and also created a fraud audit checklist to help ensure that your anti-financial crime framework is primed and prepared for the risks it faces.

---

Download your copy of our Fraud Controls Checklist:

What areas does the checklist cover?

• Risk Assessment and Risk Appetite

• Governance and Management Information

• Policies and Procedures

• Customer Due Diligence

• Enhanced Due Diligence

• Anti-Fraud Systems and Controls

• Customer Screening

• Transaction Monitoring

• Reporting and Information Sharing

• Training and awareness

• Assurance and Audit

• Horizon Scanning

---

Quality Control and Quality Assurance

In this post, we aim to take a close look at an often overlooked element of a good financial crime compliance programme - the process(es) of quality control (QC) and quality assurance (QA).   

It is one thing (a very good thing!) to have thorough policies and procedures and carefully designed controls, but it is another to understand if they are actually working properly. To this end, regulated institutions need to adopt frameworks to embed appropriate QC / QA practices. These activities are critical in ensuring the integrity of fincrime compliance processes, ensuring regulatory compliance, and safeguarding against illicit activities. In this article, we look at the significance of QC and QA and highlight their key components.

Definitions

First, let’s clear up a common area of confusion and clarify the difference between QC and QA. Both are crucial elements of a comprehensive compliance programme, but each serves a distinct purpose:

Quality control

A check to confirm that a process is being applied consistently and effectively, in line with documented processes or procedures.

QC  is a control mechanism that involves detecting, analysing and rectifying compliance issues in real time, to identify if analysts are adhering to policies and procedures, and to take remedial actions if not.  

QC can be characterised as a reactive or corrective process.  It happens in near real time, meaning errors or shortcomings can be corrected almost straightaway.

QC is traditionally owned by the first line of defence.  It can be done by the same team(s) which performs the task being assessed. For instance, a senior team member may review one in every five tasks completed by a more junior team member (a ‘four-eyes review’).

Quality assurance

An objective review of the outcome of a specific process or control.  QA ensures a process has been followed correctly and reviews the outcome to identify weaknesses or room for improvement in the future.

QA is a proactive measure designed to ensure controls and processes are working effectively and are compliant with regulations.  

QA is more retrospective than QC, as it involves looking back over actions taken in the past, meaning it is designed to improve controls and processes in the future rather than address errors as they occur.

QA is traditionally owned by the second line of defence, i.e. compliance. This ensures it is objective, as one team reviews the work of another.

A key component of QA is sample testing, i.e. checking and validating a sample of completed activity at set intervals to confirm if appropriate standards have been met and if relevant policies and procedures have been followed.

Considerations for Success

Quality Control

1. Ensure you map out all the processes which require QC.

2. Consider proportionality. How frequently should you perform QC?  What percentage of tasks are you performing QC on? 

3. Take a risk-based approach to QC. Increase the number / percentage of tasks checked for new joiners, poor performers or higher-risk scenarios.

4. Ensure you have sufficient resources to perform QC. 

5. Ensure you do something meaningful with the output, e.g. enhancing procedures or providing training.

Quality Assurance

1. Set out a QA monitoring programme for the year. You don’t need to do it all at once, and you may not need to cover everything in one year if you deem that appropriate.

2. Take a risk-based approach. Are there any areas that need an urgent deep dive? When was the last time particular controls received assurance? If you conducted QA on a process last year and the results were positive, maybe focus your time/resource somewhere else.

3. Be aware of regulatory changes and horizon scanning. 

4. Ensure you do something meaningful with the output, e.g. policy updates or system enhancements.  You should also feed the findings into your firm’s risk assessment to measure residual risks.

In conclusion, QC and QA are integral components of a robust financial crime compliance programme. By proactively implementing QA measures to improve processes and reacting swiftly to issues through QC practices, organisations can minimise the risk of illicit activities, safeguard their reputations, and comply with regulatory obligations.

---

Want to find out more about our services?

Rethinking Risk Assessments

Say “risk assessment” to a financial crime compliance professional, and you’re sure to invoke hesitation or even fear.  Though mandatory, risk assessments can be daunting, resource-intensive exercises. With new typologies and financial crime threats emerging all the time, how can firms practically rethink risk assessments for a better and more effective approach? 

In a conversation with VP of EverC Melissa Sutherland, FINTRAIL’s CEO Robert Evans and Managing Director Maya Braine unpacked some of the essential considerations for rethinking risk assessments. As risk assessments are the bedrock of your financial crime programme, getting it right is fundamental to your overall success.

Key definitions

Upholding a risk-based approach

A risk assessment is a key component of adopting a risk-based approach. Two-pronged, the exercise involves identifying your firm’s potential risks and then critically assessing them. Which risks are more likely to occur?  What is the severity of their impact? This assessment process will help dictate how you prioritise and distribute your resources. Because compliance resources are finite, moving efforts to a higher-priority risk area will mean less attention to lower-priority areas. While many firms are reluctant to shift resources away from a threat, this triaging is intrinsic to a risk-based approach. We must recognise that low risk is not the same as no risk. However, by prioritising the mitigation measures for highly-likely and high-impact threats, you are taking a risk-based approach which is, ultimately, what regulators expect. 

As new financial crime risks continue to emerge, simply adding them to a risk assessment can make it unmanageable and unsustainable. To counter this, risks should be checked and challenged. Look at the evidence and ask: is this risk still present and relevant?  If not, should it be deprioritised or removed from the assessment? It’s vital to be proportionate with your risk assessment and consider removing extinct threats as well as adding new ones.  Otherwise, the process will balloon to unmanageable proportions and your resources and effectiveness will become diluted.

Establishing cadence

Risk assessments are typically conducted once a year; however, a strictly annual approach is outdated. Ideally, and depending on the nature of the firm, risk assessments should be updated more regularly. As new financial crime risks emerge and more data is available to the compliance function, risk assessments should be re-examined. Especially for rapidly scaling firms, setting up a dynamic approach to risk assessments, which is intrinsic to how the business grows and scales, is vital.

“Six months is a long window in the life of a rapidly growing and scaling business. Things evolve very quickly, and a lot can change. What you did six months ago can become irrelevant very quickly.”

— Robert Evans, CEO and co-founder of FINTRAIL

Once a risk assessment is established, cross-reference it with output indicators, such as SARs filed. Are the real risks observed in line with those in the risk assessment? By having a lookback process, you can simultaneously address any assumptions, such as one particular jurisdiction or sector being high-risk, as well as capture changes.

---

---

Data, data, data!

One common problem with risk assessments is they can often be based on assumptions rather than factual information.  Both internal and external data sources can give you more factual indicators of where your risks truly lie.  For instance, your internal data may show you which industry types regularly see suspicious activity and feature in more investigations or SARs, which will likely be more accurate than generic “high risk industry lists” which are not tailored to your firm.  

As firms get better at capturing and utilising multiple data points, it’s important to make sure you utilise all relevant information while avoiding being overwhelmed. Risk assessments should balance using consistent data points and incorporating newer, evolving data points. Consistent and high-quality data points are important for benchmarking so a firm can track its compliance efforts and identify trends. When deciding which data points to use, consider your most significant threats. For example, if fraud is a top concern, concentrating on device ID information or biometrics might make the most sense. Allow your top-risk concerns to guide you on where to focus your efforts and which granular data points to include.

Garner insights from business teams

Suspicious activities are typically anomalous. Understanding risk and atypical behaviour requires identifying what is typical as well. Involving other stakeholders in your firm, such as customer-facing teams like relationship managers, can give meaningful insight into what regular activity looks like. As these teams have more exposure to standard day-to-day activity, they can help the compliance department create a better picture of risk factors. Without engagement between business teams, firms may have a skewed perspective of risk. For early-stage firms, having meaningful discussions with the CEO or key founders can help determine: who is the target customer base, and how would a typical user use the product? 

Document your decisions

Unsurprisingly, it’s vital to document decisions and actions when it comes to your risk assessment.  Have a clear and articulate methodology statement: what methodology are you applying, and how do the calculations work? Use data to support your decisions. For example, if there have been no SARs filed or transaction monitoring alerts raised for a particular typology, then document that as part of your justification for its removal or de-prioritisation.

“Do your risk assessment. Commit to it. Document it. If you’ve overcommitted, then adjust. Document the adjustment and continue forward.”

— Melissa Sutherland, VP of EverC

Best practices and tips

1. Use data to inform your risk assessment and create a lookback system to use your data to make sure your assessment is working as expected.

2. Be realistic with how often you can review and refresh your risk assessment, and what tools or methodologies will support it.

3. Ensure your risk assessment is proportionate to the risks your firm faces.

4. Have governance in place to make sure you use your risk assessment meaningfully.

5. Get support from expert sources - both within your business and external - to optimise your process and create practical, workable, data-driven systems.

---

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. With extensive experience assisting financial services businesses with building and conducting their enterprise and product risk assessments and customer risk assessments, we’re here to support you.

---

Earth, Wind and FinCrime: The Rise of Environmental Crime

While environmental issues are front and centre of public discourse, environmental crime often takes a backseat. Yet environmental crime impacts every country and is considered ‘low risk, high reward,’ meaning those who commit it face inadequate consequences despite reaping massive financial gains.

Environmental crime is one of the most profitable proceeds-generating crimes in the world, with the latest figures estimating it generates $110-281 billion annually, in line with the likes of drug trafficking and counterfeit goods. The repercussions of environmental crimes are far-reaching and potentially catastrophic, including climate change and ecological disasters, disease risk, food contamination, and negative impacts on human health including reduced life expectancy and death. And it’s not just the impact of the environmental crime itself - these nefarious activities fund non-state armed groups and militia, making up 38% of their income, and have links to human trafficking and slave labour.

Given its status as a growing threat, the European Union added environmental crime to its list of predicate offences in the Sixth AML Directive. However, it remains a difficult crime to identify due to its wide-reaching nature. This article looks at two areas in which organised crime groups (OCGs) have involved themselves, forestry crime and waste trafficking, and identifies ways for financial institutions to tackle the issue.

Illegal deforestation and logging 🌲🪵

Forestry crimes can generally be grouped into two camps: illegal logging and land clearing.

Illegal logging - When timber is harvested, processed, transported, bought, or sold in breach of laws and regulations
Illicit land clearing - The unlawful acquisition and clearing of land for farming, building or real estate speculation

Both of these types of green crime often involve deep-seated corruption, from illegally-obtained logging licences to illegal timber plantations. A recent investigation by the International Consortium of Journalists (ICIJ) exposes how unregulated the forestry industry is, with ‘green certifications’ being given to products linked to illegal clear-cutting and authoritarian regimes such as in Myanmar.

FINTRAIL highlights: Global Witness

Global Witness is an international NGO investigating the link between natural resources, conflict, and corruption worldwide. Watch our interview with Global Witness founder Patrick Alley, whose first campaign was exposing the illegal timber trade between Cambodia and Thailand, which was funding the Khmer Rouge guerillas.

Click ‘FFECON22 On-Demand’ for the interview.

Beyond the obvious destruction of wildlife and ecosystems, illegal logging destroys communities, causes human rights violations, and causes massive tax revenue losses for governments. Like in wildlife trafficking, intermediaries, exporters, and retailers stand to make the bulk of profits, with lower-level actors in the supply chain receiving only minimal amounts of the proceeds. As illegal logging is the most profitable natural resource crime in the world, bribery, fraud, and corruption are commonplace. Criminals have even resorted to hacking government websites to obtain permits. 

One difficulty with identifying illegal logging is the tendency for criminals to commingle goods, blending illegal wood with legally sourced timber. Illegal goods like tinder are challenging to differentiate from their legal counterparts, unlike narcotics which are easier to identify.

FINTRAIL highlights: Tree Thieves: Crime and Survival in North America’s Woods by Lyndsie Bourgon

In an investigation into illegal tree cutting, Lyndsie Bourgon looks at the black timber market in the Pacific Northwest. Following three timber poaching cases, Bourgon incorporates interviews with police, former loggers, Indigenous communities and international timber cartels to illustrate the complex environmental and social issue. To join FINTRAIL’s monthly FinCrime Book Club and discuss great books like Tree Thieves with like-minded fincrime enthusiasts, click here or get details of the next meeting here.

Waste trafficking  🗑

Garbage is big money and dirty business. A grossly under-discussed crime, waste trafficking is a lucrative business estimated to generate $10-12 billion annually. Illegal activities concerning waste trafficking involve trade that violates import or export bans (for example, the Basel Convention, which bans the movement of hazardous waste from OECD countries to developing countries) or the illegal and improper treatment of waste through disposal, incineration, or recycling. 

Both legitimate waste management businesses and criminal organisations can engage in illicit waste trafficking, with the latter often using legitimate waste management companies. With this strategy, criminals can easily blend illicit proceeds with legitimate funds, masking their nefarious origin. Criminals may also forge documents to mislabel waste as recycling or second-hand goods or to miscategorise hazardous waste as non-hazardous.

Illegal dumping

OCGs using waste management front companies employ sub-standard disposal or storage processes, sometimes engaging in illegal dumping. These practices have tremendous cleanup costs and pose a direct threat to public safety. One example that made headlines worldwide was the Camorra, an Italian mafia group centred around Naples, that burned toxic waste in the Italian countryside for decades, contributing to increased cancer rates. More recently, a 46-hectare site in Northern Ireland, known as the Mobuoy dump, was exposed as one of Europe’s largest illegal waste sites. As a result of Mobuoy, toxins have leached into the groundwater and river, causing serious health effects on communities and the ecosystem. Among the dangerous materials are asbestos and arsenic, with a cleanup cost estimated to be £100 million.

Sadly, because of the trajectory of global waste flows, most illicit waste ends up in the developing world. In its research, the Financial Action Task Force (FATF) identifies parts of Sub-Saharan Africa, Southeast Asia, and Central and South America as primary destinations. However, recent media reports have revealed Romania and Bulgaria as growing sites for illicit waste from Western Europe.

Aside from the environmental impacts, the waste industry has ties to human trafficking as a source of cheap labour. According to one non-profit organisation, two-thirds of modern slavery victims have worked within the waste industry in the UK. There is growing evidence that illicit waste trafficking is converging with other illegal goods, including instances of waste businesses used as a front for prostitution and drug trafficking. In one case, cocaine and other narcotics were hidden in garbage to avoid detection, before being shipped to Turkey.

Laundering the proceeds of environmental crime 💵

Money laundering methods for environmental crimes are similar to other predicate offences. Front companies and front persons are commonly used to commingle profits with varying degrees of sophistication, though experts have noted waste trafficking operations can be less complex than forestry crimes.

Like other transnational crimes, shell companies are frequently used to hide beneficial owners. In addition to intermediaries such as lawyers, accountants, trust and corporate service providers, freight forwarders and customs brokers play a notable role in facilitating the illicit trade. Trade-based money laundering techniques are also used, including forging import and export documents, under- or over-invoicing, issuing multiple invoices of goods, over-shipments and under-shipments, or the complete fabrication of transactions.

Case Study: Scrap iron

As reported by EuroJust, one OCG unlawfully acquired around 165,000 tonnes of scrap iron through iron recycling companies in Italy and abroad. The OCG declared the iron was imported from Germany, and reintroduced it directly into steel mills and the legal market.

A fake German business with connections to the OCG issued false invoices to acquire the scrap iron. The criminal network brought money into Italy, including €70 million in cash taken from German bank accounts. The funds were transferred between several fake companies managed by the OCG in Germany and other countries. The profits were invested either in the illicit trafficking of waste or laundered through legitimate activities such as the acquisition of a football team in Italy. Despite false documents, the scrap iron was never cleaned or recycled. The OCG also manipulated large quantities of special and hazardous waste, such as tar, obscuring its real nature with false certificates.

What should financial institutions be doing?

For financial institutions looking to strengthen their anti-financial crime programmes against environmental crime, assessing screening procedures is vital. Non-governmental organisations that focus on reporting and investigating environmental crimes can help firms identify bad actors, with links identified through adverse media screening. Additionally, financial institutions should consider putting customers involved in higher-risk industries such as forestry, wildlife, and waste management under enhanced due diligence measures.

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you fortify your controls against environmental crimes in a practical and efficient way.

---

Measuring the Maturity of Your FinCrime Compliance Programme

Through their recent communications, the Financial Conduct Authority (FCA) and Central Bank of Ireland (CBI) map out clear supervisory expectations of how financial services firms manage their growth and associated risk management framework and governance arrangements. Often it does not keep pace with the growth in business activities; with strategic ambitions outpacing frameworks and capacity.

Considering the rapidly changing environment and emerging risks that the industry faces, firms need to proactively manage the alignment of growth and compliance. To ensure the safety and soundness of firms and to protect their consumers, it is incumbent on firms to assess that their controls and governance model are fit for purpose and support the level of maturity of their operations.

FINTRAIL Maturity Model 

FINTRAIL uses a bespoke Maturity Model to assess maturity levels across different aspects of a firm’s anti-financial crime (AFC) programme. This enables firms to review their operational effectiveness and identify potential capabilities they need to develop or acquire. Firms can also use the model to systematically analyse and assess their progress over time.

Key areas for a financial institution to consider when conducting a maturity assessment of its AFC programme:

1. Control framework

2. Documentation and record retention

3. Governance framework

4. Staff expertise

5. Group-wide fincrime awareness

6. Second and Third Lines of Defence structure

Additional areas where a maturity assessment can be conducted:

1. Roles and responsibilities

2. Regulatory, AML and sanctions policy awareness

3. Audit and conformance structure

4. Whistleblowing

5. Learning and development

6. Systems and controls assessment

• Due diligence

• Screening

• List reviews

• Transaction monitoring

Below are the definitions that can be applied to measure the maturity levels of areas within the scope of the assessment:

1. Intelligent - The firm has adopted measures which are capable of meeting both interim and strategic requirements and are tailored to meet all kinds of scenarios. The firm has invested in good governance and has knowledgeable subject matter experts at the forefront of decision making. The firm conducts regular reviews of its policies and procedures, and its three lines of defence structure is well defined and fully functional.

2. Integrated - The firm has adequate levels of controls to meet regulatory expectations and has robust validation through second and third lines controls. It has an adequately resourced team of anti-financial crime experts supporting all its business teams, with a good understanding of commercial aspects of the business. It conducts regular validation of its three lines of defence structure. 

3. Defined - The firm has sufficient controls to meet the minimum regulatory requirements with a scope for review on a periodic basis. The firm has a formal approach to decision making and has a good awareness of the requirements for its anti-financial crime framework.  It has a relatively small team of financial crime experts who are not necessarily at the senior management or decision making level.

4. Fragmented - The firm has some of the required financial crime controls in place but needs to develop consistency around governance and decision making, and to expand and develop its processes to work beyond crisis management.  It also still needs to introduce assurance and quality validation by the second and third lines of defence. The firm requires more expert resources to support all the relevant operational disciplines.

5. Ad-hoc - The firm has basic levels of controls to combat financial crime. It has poor documentation and governance controls which require immediate review. The firm also lacks the required internal expertise and does not have a defined three lines of defence model.

Why use a maturity model

1. Current state assessment - A maturity assessment can help a firm to assess the current state of its framework, or a particular aspect of its products and services. It enables the firm to check if it is doing well enough to meet minimum regulatory requirements for fighting financial crime. It gives the firm an overview of its stress acceptance capability and can help prepare for adverse situations like disaster recovery.

2. Effectiveness: Senior management can identify redundant or ineffective controls, enabling them to redeploy resources to achieve efficiency gains and make the anti-financial crime programme more effective.

3. Overview of controls - The maturity model gives a bird’s-eye view of the firm’s controls and reveals if the framework is complete or if there are gaps.

4. Area for enhancements - The model identifies any areas that require attention and lets firms prioritise development areas and remediation exercises accordingly, in order to achieve higher maturity levels.

5. Better project management - The output from the maturity model can allow firms to apply ‘lessons learned’ and plan future projects in an effective and efficient manner. 

6. Assessing progress - The assessment provides an objective view of a firm’s process and framework, which enables it to measure its future progress according to objective, consistent evaluation factors.

Difference between a maturity model and a risk assessment

As part of AML regulations, firms are required to complete periodic risk assessments to identify their risks and review their control frameworks.  Per the Financial Conduct Authority (FCA) Handbook (SYSC 4.1.1), all entities are required to conduct a risk assessment which will help them to identify the financial crime risks to which they are exposed and to assess their controls.

A maturity model assessment is advised as part of the FCA IT Maturity Assessment under MiFID II general guidance. The output from a maturity assessment is designed to help conduct an enterprise wide risk assessment, by identifying areas of risk in advance.  It helps firms prioritise the areas of immediate concern, and integrates closely with other operational risk frameworks to remediate the issues.

Examples of a good and bad maturity model

FINTRAIL’s maturity assessment process

For our assessment process, FINTRAIL reviews the areas within the scope of the maturity model against the benchmark established by industry peers and minimum standards of operational effectiveness outlined in the relevant regulations.  The steps taken are as follows:

• Identification of scope and the areas for review

• Agreement of the factors to be used  to rate maturity levels

• Project initiation meeting

• Production of a draft Maturity Assessment report

• Review of the draft report and incorporation of feedback

• Submission of final Maturity Assessment report with red-amber-green (RAG) status for individual programme areas

Snapshot of Maturity Model 

CLICK TO VIEW

---

At FINTRAIL we are passionate about combating financial crime. Our unique and diverse team has extensive hands-on experience developing and deploying risk management controls and using real-life examples to bring best practices to life. We provide deep-dive, qualitative assessments of the maturity of financial crime programmes for FinTechs, banks, and other financial institutions. 

If you are interested in conducting a maturity assessment or would like to get a better understanding of the services provided by FINTRAIL, please get in touch.

Corporate Transparency: A Global Stocktake

The past few months have seen significant global developments around the key issue of corporate transparency.  Earlier this month, the Financial Action Task Force (FATF) issued guidance on its revised Recommendation 24 on beneficial ownership, introduced in March 2022.  The revised recommendation and the guidance make clear that states should adopt central, public beneficial ownership registries, although stop short of making this an explicit requirement.  They also call for a “multi-pronged approach”, i.e. a combination of different mechanisms to collect ownership information, and state that the information should be verified.

The FATF changes were positively received by industry figures and transparency campaigners, who say they significantly strengthen the international standard for transparency.  Beneficial ownership transparency is gaining momentum globally, with over 100 countries committed to implement reforms, and G20 and G7 leaders committing to implementing the FATF standards.  Yet while anti-financial crime professionals are clear on the value of corporate registries (when done right), politicians and lawmakers are not always aligned on how best to implement them.  A core divergence surrounds privacy and public access to information, coupled with longstanding issues on accuracy and reliability.

Against the backdrop of the new FATF guidelines, we explore the most recent developments in corporate transparency in key jurisdictions, and what they mean for the fight against money laundering and terrorism.

UK

In some respects, the UK has the potential to set the standard in corporate transparency. Its stipulated disclosure requirements and the accessibility of its records are amongst the most comprehensive of any major jurisdiction.  However, even a cursory look under the bonnet quickly reveals some significant weaknesses.

Corporate records are held by Companies House, the government-run UK registrar.  To strengthen its ownership information, Companies House introduced a register of People of Significant Control (PSC) in April 2016. Freely available to the public, who can search by looking up both legal entities and individuals, it became a key KYC tool for many UK financial institutions - one that does not exist in some other advanced countries (nod to the US here). That said, Companies House has repeatedly come under criticism for how its records are maintained.  Companies House lacks the power to check and query data provided by reporting companies, providing ample opportunity for criminals to submit false data in order to create seemingly legitimate companies.  The use of UK corporate structures in numerous money laundering scandals has been well-documented; most recently media outlets have reported how fake UK companies are increasingly used for fraud, including so-called ‘pig butchering’ cases. 

“Analysis has identified 168 UK companies accused of running fraudulent cryptocurrency or foreign exchange trading schemes, with around half of these likely to be linked to pig-butchering scams.”

— The Guardian

As a result, there have been vocal calls for reforms of UK corporate records across the public and private sectors.  Following the Russian invasion of Ukraine in February 2022, HM Treasury took swift (but in the eyes of many, long overdue) action to tackle dirty money in the UK and the abuse of the financial system by criminals. Part One of the Economic Crime Act 2022, fast-tracked into law in March 2022, created a Register of Overseas Entities (ROE) designed to crack down on foreign criminals using UK property to launder money. This law requires any foreign business holding property in the UK to register with Companies House as an ‘overseas entity’ and disclose who controls them. 

Reforms of Companies House featured heavily in Part Two of the Economic Crime Bill, heard in Parliament in October 2022. The Bill will equip the “data-house” registrar with new powers to act as an active gatekeeper upholding the accuracy and reliability of the data it collects.  The identity of all directors and PSCs will be verified, meaning there will finally be some checks confirming that anyone who sets up, owns or runs a company is actually who they say they are. Companies House will also have enhanced powers to remove companies from the register and proactively share information with law enforcement if there is evidence of anomalous filings or suspicious behaviour.

However, questions remain about whether the reforms go far enough. As of 31 January 2023, when all initial ROE disclosures should have been filed, research by Transparency International UK showed that 56% of all assets held by offshore firms in the UK were still held anonymously, while 12% claimed to have no beneficial owners! Whilst it is still early into its existence, the true test for this and wider Companies House reform will be the effectiveness of enforcement activity, the provision of additional resources, and actions taken to pursue those who abuse the system. Watch this space!

US

Across the pond we have seen a lot of debate over the US’s move to create a database of beneficial ownership information. The Corporate Transparency Act (ACT) of January 2021 introduced the notion of a requirement to report beneficial ownership information, implemented by a Reporting Rule issued in September 2022 and due to come into effect on 1 January 2024. The reporting requirements will apply to both domestic and foreign entities operating in the US. 

Initial reaction to the implementing Notice of Proposed Rulemaking (the “Access NPRM”), issued by FinCEN in December 2022, was muted and has since become more critical. The proposed rule aims to balance a useful database for authorised recipients against protecting sensitive information from unauthorised access. In practice this means there will be only a limited information retrieval process to protect unauthorised or inappropriate use of the register. Instead of open-ended access like the UK, US financial institutions will have to submit identifying information for a company to receive an electronic transcript with the beneficial ownership information. Furthermore, only some financial institutions would have access (cryptocurrencies firms, for instance, would not) and the company in question would have to consent to this access. Once information has been received it can only be shared with personnel in the US, limiting access within multinational institutions. With implementation looming in less than nine months, it seems the practical considerations of this are yet to be worked through, in terms of how consent is achieved, what this looks like for existing vs new customers, and if the burden of access outweighs the use of the database. 

Industry bodies have been highly critical of the proposals. The American Bankers Association’s (ABA) called the proposal “fatally flawed”, saying it will provide “limited, if any, value to banks” and asking FinCEN to withdraw it.  Other industry bodies such as the Institute of International Bankers have urged FinCEN to consider real-time access and automated bulk request processing, and to lift the restriction on using the database only under the scope of the CDD Rule rather than “all customer due diligence requirements under applicable law”. They claim the operational burden to maintain the information and restrict its use may disincentive firms from using the system.  The ABA argues the proposal will create “significant redundancies and inefficiencies within banks’ AML/CFT compliance programmes”.

“The proposal creates a framework in which banks’ access to the Registry will be so limited that it will effectively be useless, resulting in a dual reporting regime for both banks and small businesses.”

— The American Bankers Association

Adding fuel to the fire, the proposed beneficial ownership information form that companies must fill in, shared by FinCen on 17 January 2023, allows firms to report that their beneficial ownership is ‘unknown’, enabling them to opt out of sharing the very information the CTA requires. The Financial Accountability and Corporate Transparency Coalition’s response to the proposal aptly summarised this as “an absurd result that FinCEN must avoid in promulgating”.  

With the proposed limited and inefficient access, narrow scope of application, restrictions on sharing information, and ability to opt out of reporting information, many are asking whether the initiative has failed before it has even started. It certainly does not seem to meet the new FATF standard, which states information should be “adequate for identifying the beneficial owner” and publicly available. With FinCEN erring on the side of caution in prioritising privacy concerns, it is devaluing the value of the new registry at the expense of other important principles.

EU

In a surprising move, in November 2022 the Court of Justice of the European Union in Luxembourg ruled that the EU law-mandated beneficial ownership register regime was in fact unlawful. Making beneficial ownership information accessible to the public as required by EU money laundering directives was declared 'invalid'. The court found that the Fifth Anti Money-Laundering Directive requirements to create a beneficial ownership register regime accessible to all did not comply with Articles 7 (right to respect private life) and Article 8 (data protection) of the EU Charter on Fundamental Rights. The court found that the amendment is a “serious interference with the fundamental rights to respect for private life and to the protection of personal data”. Any person wishing to view the beneficial ownership data did not have to demonstrate a “legitimate interest” in doing so, creating a regime which allows for privacy intrusions.

Initial reactions to this ruling were strong. Many have seen it as a step back in corporate transparency.  As summarised by Transparency International, “At a time when the need to track down dirty money is so plainly apparent, the court’s decision takes us back years.” In addition to the general public, the ruling impacts a number of professional groups who access registers to support the valuable work they do in uncovering corruption and dirty money, including journalists, academics and foreign government bodies. Whilst the ruling did state that certain roles in the media and other sectors could have a ‘legitimate interest’ in accessing public registries, it is not yet clear how this could work in practice.

“At a time when the need to track down dirty money is so plainly apparent, the court’s decision takes us back years.”

— Transparency International

Some countries including Luxembourg, Belgium, Austria and the Netherlands reacted swiftly to the ruling, closing public registries to those without a legitimate interest.  Ireland’s online registry now displays the following message: “RBO [Register of Beneficial Ownership] has restricted access to search the register to Designated Persons and Competent Authorities only, with very limited information being available to other parties in accordance with the recent ruling of the Court of Justice of the European Union.” 

As we look forward, many are anticipating how the sixth money laundering directive will address this issue. Understanding how those with a legitimate interest in this information will maintain access, allowing them to continue promoting corporate transparency and conducting investigations to uncover illicit flows, is key. Prior to the ruling, the European Union had demonstrated clear movement in the right direction in terms of corporate transparency. What the ruling means in the long term is yet to be determined, however it is to be hoped the previous momentum continues and the commitment to pushing for corporate transparency remains.

At FINTRAIL, we use our regulatory expertise to help clients keep their anti-financial crime programmes and governance structures in step with the latest regulations and official guidance.

Please get in touch if you would like support with designing, reviewing or enhancing any aspects of your anti-financial crime framework.

---

Crossing Countries: Lessons Learned from Globetrotting FFE Members

Fighting financial crime has always taken an international perspective, requiring global anti-money laundering standards and cross-jurisdictional information-sharing. But what about the financial crime fighters who are instrumental in building firms’ defences and catching bad actors?

What lessons can be learned from working in a different country with foreign regulations and cultural nuances? And what value can FinCrime professionals get and give from working in different corners of the world?

As one of FINTRAIL’s international hires and someone who works from different countries frequently (thanks to FINTRAIL’s progressive digital nomad policy 🎉) — I connected with three members of the FinTech FinCrime Exchange (FFE) who have lived and worked in foreign countries to find out.

If you’re a FinCrime professional curious about moving to another country for work, read on for some peer-driven wisdom, insight, and invaluable advice.

🇦🇪 UAE

Shruti moved from the UK to work for a Dubai-based FinTech in September 2022. She describes her experience as “amazing” while noting the inherent challenges of working in a new environment with different rules. The UK, which is a major global financial centre with a structured financial services system and long-established, well-regarded regulators, is contrasted to the UAE. In this region the financial free zones such as the Dubai International Finance Centre and the Abu Dhabi Global Market have been set up more recently. As the country is relatively new, its legal system and regulatory landscape is extremely agile, rapidly changing and evolving.

While a lot of the payment services regulation for the Dubai Financial Services Authority is similar to that of the Financial Conduct Authority in the UK, the complexity in the region lies in practical differences like identification documents, proof of address, and business communication styles. Unlike in the UK, business communication often happens through informal non-traditional channels. Shruti describes working informally with third-party partners in a positive light:

“we will exchange voice notes on WhatsApp to discuss arrangements which is really useful. We continue to maintain an audit trail via official channels, but this almost informal communication helps you build relationships better.”

When asked what advice she would give to a FinCrime employee looking to cross countries, Shruti says,

“Keep an open mind as to how that individual country operates and its own complexities within its own regulatory landscape. I think I assumed at times that I could easily apply regulation that I was familiar with to various jurisdictions but this didn't take into account the nuances of each country and it's way of operating. There's a social, economic and political view to also consider. You need to get to the country to work out what they do, how they do it and why they choose to do it in a particular way. So make sure you don’t get lost in your previous experience and just be very open to different ways of working and educating yourself.”

🇦🇺 Australia

David moved to Australia from the UK to work for a FinTech remittance company. In addition to favourable weather and a different pace of life, he discovered many regulatory similarities between the two jurisdictions. On key differences, David notes,

“the main thing that was difficult to adjust to was how involved some of the transaction reporting or customer information reporting obligations are. That’s something we don’t have in the UK.”

Overall, the Australian Transaction Reports and Analysis Centre and the Australian Federal Police are highly engaged: “There’s a clear line of communication and transparency of communication about their intentions when they come and speak to regulated firms and the work on all the requested information around cases or financial crime investigations”. The involvement, transparency, and feedback around financial crime investigations was incredibly motivating, making David’s team “feel really engaged with the process of stopping financial crime”. Chalking it up to Australia’s regulatory culture he says,

“there are very clear lines of authority here whereas in other countries there’s a more nuanced approach. This clarity transfers into how Australia’s set up their infrastructure for fighting financial crime.”

Beyond solid engagement with the regulator and law enforcement, adjusting to regional financial crime risks was also vital. For example, in the case of Australia, this meant being mindful of the South Pacific drug shipment corridors where a lot of the risk management is focused.

When asked to share wisdom for FinCrime professionals headed abroad, David said, “Do some homework. Go read the regulations before you get there but don’t be scared if you don’t know them backwards. Look at the intention of the law. Secondly, in our current remote-first environment, spend time in the office because you’re going to want to get to know your team.”

🇸🇬 Singapore

Genevieve has lived and worked in Singapore for the last five years, having previously lived in the UK and Australia. Speaking fondly about her time in the culturally-diverse Wise office, she recounted some of the unique experiences and exchanges that make living abroad so special. From a FinCrime perspective, being in Singapore for a significant time allowed her to witness major regulatory developments, like the expansion from manual to technology identification verification. “When I first joined, there was a piece of work done to lobby the Singapore government around face-to-face verification,” she recalls. Seeing the progression and regulator’s acceptance of online verification and the use of technology has been “really cool”. Noting the regulator’s openness and eagerness to understand and engage, Genevieve points to newer collaborative developments, such as the efforts of the Singapore Police, the Monetary Authority of Singapore, and the FinTech community to discuss escalating scam rates. Being part of these collaborative experiences add to your toolkit as a financial crime fighter, no matter which country you work in.

When asked to provide advice to other FinCrime professionals considering moving countries, Genevieve shares,

“Go for it. Don’t wait. You become so much richer for moving to other markets and understanding the FinCrime priorities and how that translates into the local rules. It’s also a great opportunity to share your experience locally. So don’t wait; go for it.”

If you want to feel connected to the international FinTech community, see job postings, or share and learn about typologies —  join the FFE today.

For a practical and comprehensive overview of fincrime risks, regulatory risks, and operational issues in some key markets — check out our Know Your Market guides. 

---