Know Your Associates: The Need for Enhanced Due Diligence Investigations

FinTechs are used to conducting enhanced due diligence (EDD) on customers as a matter of course - to meet their KYC obligations and to identify red flags. But what about their own business operations? How confident are they that they know who they’re partnering with, where their money is coming from, and who’s getting involved in their business?

There are several scenarios in which FinTechs should seriously consider conducting EDD investigations into investors or business associates. These include:

Why are enhanced due diligence investigations important?

What do we mean by EDD investigations? The kind of research called for in these cases goes a long way beyond standard watchlist and adverse media screening. We have seen countless cases of subjects with chequered histories that raise serious red flags sail through screening. When managing high-risk customers, screening is generally the most appropriate option - you can’t conduct bespoke investigations on each customer. But when you are embarking on a one-off acquisition or conducting a funding round worth millions of pounds, there is the opportunity and the expectation to go further.

Cautionary Tales: The need for Enhanced Due Diligence

UK EMIs
Transparency International UK published a report in December 2021 which found that more than one in three UK registered electronic money institutions (EMIs) had money laundering red flags relating to their owners, directors or activities. These included:

• Individuals named in money laundering allegations and investigations
• Individuals with close links to high-risk firms in Russia and Ukraine
• Individuals with question marks over their suitability to run an FCA-authorised firm

Money Laundering Arrest
In 2020, UK peer-to-peer lender Zopa found itself in the news when board member Kapil Wadhawan was arrested as part of a $420m money laundering investigation. Wadhawan had co-led a £32m investment in Zopa which secured him a seat on the company’s board in 2017. He was arrested in January 2020 in connection with a money laundering probe in India, and subsequently had to resign his position at Zopa.

Kremlin Connections
Israeli-Russian billionaire Yuri Milner has invested in numerous FinTech companies in the US and UK, often through venture capital firm Digital Sky Technologies. In February 2020 he led a funding round worth tens of millions of pounds into the British start-up online mortgage broker Habito.

In 2017, media coverage of the so-called Paradise Papers reported that Milner’s investments in Facebook and Twitter used funds from two Kremlin-owned and now sanctioned Russian firms, VTB Bank and Gazprom. The origins of the money was reportedly obscured by shell companies.

Takeaway: In the thrill of securing financing, it can be tempting not to scrutinise potential backers too closely. However, as these case studies show, this is a potentially risky area and companies mustn’t be afraid to ask questions. Investors with poor reputations can affect portfolio companies’ credibility and their ability to raise capital in the future. And in the worst case scenario, target companies could even find their investors or directors are involved in criminal proceedings, or discover that an investment consisted of illicit funds.

What Does an Enhanced Due Diligence Investigation Include?

EDD investigations provide a full picture of a subject, allowing firms to really know their counterparties and to understand their backgrounds and source of funds.

• Background, track record, modus operandi and reputation of the counterparty

• Thorough review of corporate records, seeking to confirm information presented and even complex ownership structures, and to reveal any undisclosed beneficiaries or hidden interests.

• Details of civil or criminal litigation or other regulatory or legal proceedings, which are often publicly available but not discoverable through standard screening searches

• Details of any business disputes, or improper or illegal conduct

• Any political exposure or relations with government officials, beyond that captured in PEP screening lists

Download our EDD Services Summary Sheet to learn more

A full enhanced due diligence investigation involves in-depth research of both the surface and deep web (gated, subscription-only and database sources) ideally using a mix of advanced AI tools, including sophisticated natural language processing, and expert human analysis. It may require research in multiple languages, the manual retrieval of records in jurisdictions where these are not available online, or consultation with vetted human sources.

Unlike routine customer due diligence, such investigations should be bespoke and allowed to develop based on the findings - there is no one-size-fits-all approach, as the information required and the research conducted will be different in each case. This calls for experienced investigators who know how to appraise findings critically and when to follow a lead, pursue a hunch, discount information or revise a theory.

Case Study: High-risk Investor

FINTRAIL conducted a series of EDD investigations on potential investors on behalf of a UK-based FinTech. One of these investors was a businessman from Zimbabwe who had built his career in the high-risk telecoms sector. Moreover, he was a former associate of a high-profile African billionaire with top-level business and political connections.

FINTRAIL confirmed that the subject had a credible track record in the telecoms sector and was likely to have the funds for investment due to his previous career. We identified no noteworthy allegations of corruption or criminal behaviour. The subject’s companies had undergone financial failures and civil lawsuits, but we assessed these were the result of mismanagement and poor commercial decisions at an early stage in the subject’s career, as well as bad fortune with macro-level economic issues. We also investigated the subject’s current relationship with the billionaire and the latter’s political status, and confirmed that he had a remarkably sound and unblemished track record and reputation.

FINTRAIL contextualised the high-risk nature of the telecoms sector and the African jurisdictions in which the subject operated, and analysed the negative media reports around his companies. With this information, the FinTech was able to be confident there were no credible reputational issues or indications of criminal or unethical behaviour, and that the subject was within its risk appetite as a potential investor.

Case Study: Russia-Related Red Flags

FINTRAIL conducted open source analysis of a Russian venture capitalist looking to invest in a UK FinTech, focusing on his background and reputation, political connections, and links to known high-level scandals, including the Russian and Azeri Laundromats.

Our experts uncovered concerns about the subject’s source of wealth and modus operandi: he had political connections to the Kremlin, held business interests in opaque jurisdictions through apparent shell companies, and had unexplainable UK corporate interests. We used our in-depth expertise of Russia to contextualise the findings and profile the individual concerned, navigating the fact his media profile was limited as his political connections likely shielded him from overtly negative scrutiny in the Russian-language press.

While there was no evidence to show the subject was directly involved in criminal activities, the various red flags and reputational concerns convinced the FinTech to reject the investment - a disappointment in the short term, but likely a prudent decision in the long run.

Case Study: Sanctions Investigation

A UK-based financial institution asked FINTRAIL to conduct an investigation into a group of high-risk customers named in an OFAC sanctions investigation. They needed additional information beyond their standard EDD process, and an independent assessment of their existing controls.

Working closely with the client, FINTRAIL provided:

• in-depth information on the state of the sanctions investigation and the customers’ role in the underlying transactions
• a review of the client’s existing due diligence measures, and suggestions for enhancements and additional measures
• a view on whether the firm could be comfortable continuing to do business with the customers.

FINTRAIL confirmed there was no reason the firm should have deduced that the customers were involved in illicit activity, specifically any complicity in sanctions evasion. We opined that the firm was taking appropriate measures to limit and manage its risks, but that it may ultimately decide the customers were outside its risk appetite given the threat of future investigations and the reputational risk and operational costs associated with these relationships.

How FINTRAIL Can Help

At FINTRAIL, we combine deep experience in financial crime risk management with proven due diligence capabilities to provide clear, actionable, risk-focused intelligence using advanced analytical skills and data discovery tools. We contextualise all findings using in-depth knowledge of the countries and sectors concerned, including geopolitical context. We keep you updated of our findings throughout, and deliver comprehensive final reports with network diagrams and visuals where appropriate.

What makes us unique and sets us apart from other intelligence and due diligence providers is that our team is drawn from the industries we support, and has extensive experience of risk management processes within financial institutions. We provide intelligence by compliance officers for compliance officers. We understand your needs and operational considerations, and can supply you with the targeted, relevant information you need alongside informed recommendations and advice to produce actionable outcomes, guided by your own risk appetite and decision-making framework.

To learn more about how we can help with your requirements - whether it’s a one-off report or outsourcing complex casework - please get in touch with our team.

---

Read more: Investor Due Diligence - A Two Way Street

Review of the UK’s AML/CFT regulatory and supervisory regime

The UK government has issued its much anticipated response to the call for evidence on the UK’s AML/ CTF regulatory and supervisory regime. It’s well considered, detailed … and perhaps a little safe.

Does it provide ground breaking changes? No.

Is it moving us forward? Slowly.

But realistically, this was never going to offer speedy and simple solutions. What it does do is recognise the importance of the fight against economic crime, and the vulnerabilities that exist, both at board level and on the streets. The report mostly serves to tell readers to ‘watch this space’, as this is “only the start of [the] reform agenda”, with further legislative measures to come this year via the second Economic Crime Bill and Companies House reform.

The foreword by Economic Secretary to the Treasury John Glen, highlights the need to continue to enhance efforts at home while working with the international community to influence and shape global standards. The report also recognises that in order to make a difference globally, the UK needs to strengthen and “harness the capabilities, expertise and information of both public and private sectors”.

This review is seen as only one part of the UK’s efforts. Along with the Economic Crime Plan Part II and reforms to Companies House, the UK is seeking to go beyond tick box compliance and “build a thorough and dynamic system of controls which responds to the real risks we face”.

The review has been structured around 3 key themes:

1. Systematic Effectiveness – what effectiveness looks like and how to measure it

2. Regulatory Effectiveness – equipping firms with a strong risk understanding and effective risk-based controls targeting areas of highest risk

3. Supervisory Effectiveness – reform of the supervision regime

The report builds on the work under the parallel updates to the Money Laundering Regulations (MLRs) and sets out the intention to develop an improved range of metrics to measure and evaluate the effectiveness of the MLRs in future.

The highlights:

• The National Risk Assessment (NRA) and existing public-private dialogue will be used to assess emerging risks and potential future changes to the MLRs.

• Post-Brexit, some areas of regulatory changes to support a risk-based approach have been identified, but other areas such as Suspicious Activity Reporting (SARs) and gatekeeping show limited need for regulatory change.

• The use of new technology and improving the AML guidance regime are potential areas for the government to support the private sector. Incremental improvements in collaboration with partners is the favoured approach

• Possible reforms of supervisory structure are considered with the aim of ensuring effective and consistent supervision across all sectors.

So how does this translate into action and what are the next steps? Below we summarise some of the key aspects of the review.

Defining Effectiveness

a. Objectives of the MLRs

The government has decided to refine the objectives for the MLRs, linked to the FATF methodology, by amending the following areas:

• Explicitly including the ‘provision of valuable intelligence’, aligning with the principle that effective prevention is more than just technical compliance

• Clarification of supervision - monitoring and enforcing compliance as part of a risk-based approach

• Collation of accurate information on beneficial ownership is not a primary objective but a means to identify and report suspicious activity.

b. Measuring Effectiveness

Many respondents questioned whether the specific requirements in the MLRs are having a direct impact on the scale and nature of disrupting ML/TF. The government will set out ‘outcomes focused’ metrics as part of the Economic Crime Plan to provide direct and clear feedback on the effectiveness of the MLRs.

c. High/low impact activity

Unsurprisingly, the regulated sector is in favour of reducing the number of mandatory requirements in the MLRs. Themes raised included:

• ‘High impact’ activity - consistent compliance with due diligence requirements and good quality suspicious activity reporting

• A disproportionate burden on ‘low impact’ areas of routine due diligence and transaction monitoring driven by mandatory requirements, and the inability to move resource to ‘higher impact’ areas

The government view is that firms have some discretion when adopting a risk-based approach, but resources and policies must be in place to meet the objectives of the MLRs. While there is scope to “dial down” less impactful activity, there is “insufficient evidence” to overhaul the MLRs.

d. Strategic national priorities

The UK will not publish standalone National Priorities such as exist in the US - the focus will be on developing the upcoming Economic Crime Plan and NRA to provide more strategic direction.

Regulated firms demanded more granular sharing of public-private intelligence, including in response to live threats and emerging risks. The government will explore how law enforcement agencies can provide more coordinated and timely communications. The NRA will be the primary vehicle for assessing emerging risks and identifying changes needed to the MLRs going forward.

Driving Effectiveness

a. Risk-based approach

Respondents felt that the MLRs contain too many prescriptive requirements, which goes against the premise of a risk-based approach. The government will not fundamentally shift the balance of mandatory requirements, but will consider the following factors:

• Small / new firms: Supervisors and the Office for Professional Body Anti-Money Laundering Supervision (OPBAS) will assess the support that can be offered to these firms to fulfill their obligations under a risk-based approach

• Guidance / information sharing: Law enforcement and supervisors will assess how information is currently shared and enhancements that could be made

• Supervisory approach: Supervisors will review how to ensure a risk-based approach is incorporated into supervision

• Enhanced due diligence (EDD): There are no plans to amend the mandatory requirement to perform EDD as listed in Regulation 33. However further work will be done on assessing the risk profile of domestic PEPs, removing the list of required checks for high-risk third countries, changing the wording of ‘complex or unusually large transactions’, and evaluating the effectiveness of EDD.

• Simplified Due Diligence (SDD): respondents highlighted that the time and effort to conduct SDD is the same as standard CDD, thus it is not useful. However, the government does not plan to change the components or description of SDD, with the exception of Pooled Client Accounts, where the government will consult on options to allow easier application.

b. New technologies

The government believes that inefficiencies and resource-intensive compliance processes are partly driven by failures to maximise the use of technology. Three workstreams will be established to find solutions and explore more effective models of engagement. As the MLRs are intended to be technology neutral, no specific changes will be made except for digital identity products., where the government is considering amendments to ensure greater clarity on electronic identity processes.

c. Supervisors’ role in SARs regime

Focus in this area should be on improvements to SAR technology and IT, an increased feedback loop, and better information and intelligence sharing. With a number of initiatives already underway, the government will keep a watching brief.

d. Gatekeeping function

There was broad agreement about the effectiveness of the gatekeeping function of supervisors surrounding the ‘approvals’ and ‘fit and proper’ test, with some consensus about enhancing this in higher-risk sectors such as crypto assets. The government will uphold the status quo and consult on specific feedback.

e. Guidance

Sector specific feedback is crucial, but it is too long, complex and inconsistent. Striking the right balance is difficult - there needs to be room for a risk-based approach. The result is we won’t see radical overhauls, but reform along the lines of three key principles:

• Sector specific guidance drafted by experts, including industry

• Improved approval process to streamline and speed up updates

• Improved quality control to ensure consistency, clarity and conciseness

AML/CFT supervision

The UK has 25 supervisors: three statutory supervisors (the Financial Conduct Authority (FCA), HMRC and the Gambling Commission) and 22 legal and accountancy Professional Body Supervisors (PBSs) who supervise the legal and accountancy sectors. This section considered potential structural reforms.

a. Enforcement

Respondents highlighted inconsistencies across different sectors. They noted the level of fines brought against financial institutions is higher than other sectors, which has led to high levels of AML investment but has made banks risk-averse. There is a call for greater transparency and consistency of approach.

b. Supervisory gaps

Some supervisory gaps exist in the legal sector where practitioners are not members of one of the legal Professional Body Supervisors (PBSs) with a general consensus on creating a default supervisor for the sector.

c. Supervisory reform

With FATF identifying major deficiencies in the UK regime in its last evaluation report, it’s not surprising this is an area of focus. And it is still a work in progress. With some high-profile enforcement actions and steps taken to improve a risk-based approach, there is room for further reform.

The shortlisted options for reform include additional powers for OPBAS, consolidating and reducing the number of PBSs, or establishing a single supervisory body for professional services. A formal consultation will be issued to further understand the pros and cons of each.

So what next?

Well, the review has provided greater understanding on the barriers to effectiveness but some of the solutions are unclear, meaning further work and engagement is needed. The key areas of focus for the next phase of development of the MLRs and wider AML regime are:

• Potential supervisory reform

• Further evidence and understanding needed on MLRs

• New objectives to the MLRs with measurable metrics

• A focus through tools such as the NRA to improve risk understanding

• Further engagement on new technologies

• Case by case updates to guidance

So as we said at the start, watch this space - the second Economic Crime Plan is now the next much anticipated document!

---

At FINTRAIL, we combine deep financial crime risk management with regulatory expertise to help keep your anti-financial crime programmes and governance structures in step with the latest official guidance.

Please get in touch if you would like support with designing, reviewing or enhancing your anti-financial crime framework.

World Refugee Day: Reflections on Financial Inclusion

Today is World Refugee Day, an annual event organised by the UN to celebrate and honour refugees from around the world and to raise awareness of their plight and efforts to protect their human rights. In the past 12 months, the world has seen fresh flows of refugees from Afghanistan and Ukraine, adding to those continuing to flee from Syria, Venezuela, South Sudan and other conflict and crisis zones.

Access to financial services for refugees and asylum seekers is a well-recognised problem.  Most face barriers to opening accounts and accessing the products and services they need to find work and accommodation in order to rebuild their lives.  Some lack acceptable forms of identification or cannot provide documentation to prove their address or income.  In some countries in Europe, banks may even refuse to accept passports from certain refugee-producing countries, given the risk of fraud. There are also barriers which are not unique to refugees, such as language skills, the accessibility of branch locations, or familiarity with technology.  

Germany’s Passport Restrictions

Licensed banks in Germany are required to use a system run by the post office, Postbank, to check that potential clients meet KYC requirements. The Postbank has a list of nationalities for which it cannot process passports, including countries such as Syria, Afghanistan and Pakistan. This means that people from many of the top refugee-producing countries cannot access banking services with any licensed bank in Germany.  

This creates an odd situation for developing FinTechs, which may “outgrow” the refugee market.  EMIs without full banking licences can use alternative document-checking services which do not automatically preclude certain nationalities.  However, if they subsequently become a licensed bank they will have to use the Postbank system and decline high-risk passports.

The ongoing flux of refugees from Ukraine prompted the European Banking Authority (EBA) to instruct banks to make it easier for refugees to open accounts, and to state that both banks and supervisors must ensure refugees can access the EU’s financial system without having to zealously comply with AML rules.   (This follows a 2016 EBA paper in which it commented that a combination of country risk and uncertainty over ID documents means the ML/TF threat posed by refugees and asylum seekers is “unlikely to be low”, but that the risk could still be managed effectively.)

Some regulators have taken steps to address the problem. An EU regulation passed in 2015 requires banks to offer basic payment accounts to all customers legally residing in EU countries, including asylum seekers and refugees.    Banks need not insist on a passport or ID card, but should accept any official document containing a full name, nationality, date and place of birth and residence, such as a residency permit.  However, many EU national regulators have still not issued guidelines to implement this regulation. 

Provisions may also vary depending on refugees’ country of origin, with many institutions making exceptions for Ukrainian nationals.  A number of digital banks including Wise, Revolut, and bunq, are offering free accounts and simplified account opening processes for Ukrainians (or in the case of Revolut, anyone fleeing Ukraine whatever their nationality).  In the UK, HSBC was one of the first institutions to allow Ukrainian refugees to apply for an account, introducing a new account opening process in March.

Some examples of best practice:

Lloyds Bank and the Lloyds Foundation

Through the Lloyds Foundation, LLoyds Bank works with charities supporting refugees, homeless people and victims of domestic abuse to understand their needs and identify areas where the bank should change its processes to allow access to its services.  It is looking at how to support people who do not speak English, again by partnering with charities to share expertise.

The bank has launched a programme to allow refugees and other vulnerable groups to use alternative sources of ID to access its services, including biometric residence permits or letters of recommendation from charities verified by the foundation, confirming the identities of applicants.

BNP Paribas

BNP Paribas offers refugees and other frequently unbanked individuals easy access to financial services through its FinTech company Nickel, with no need for a fixed address.  Rather than working with partner organisations to verify individuals’ identities, thus limiting support to individuals already ‘in the system’ and receiving support, Nickel enables users to access services directly at their nearest tobacconist and to use the address of temporary migrant housing or nearby service providers such as a laundrette or post office.  BNP Paribas also offers training to refugees and migrants through a series of partnerships, and supports lending to early-stage refugee-led enterprises.

Interestingly, Nickel is not run as a charitable initiative - it charges €20 a year for its services and a 2% fee for each transaction.  BNP Paribas says this shows that social businesses with a for-good imperative can also make money, thus making them more sustainable and resilient.

HSBC

HSBC has introduced a new account opening process for Ukrainian refugees, following on from earlier programmes to provide services to vulnerable users including survivors of domestic abuse and the homeless.  It is not clear if it intends to extend these processes to all refugees and asylum seekers.

HSBC says it has already helped over 1,000 victims of modern slavery and human trafficking through its Survivor Bank service, which provides access to a basic bank account without the need for photo ID or proof of address.  It accepts applications from people who are supported by a caseworker from the Salvation Army or one of 18 other charities that can verify their identify.  

HSBC provides a similar service to those without a fixed address. In partnership with the housing charity Shelter, the bank’s No Fixed Address programme enables caseworkers to verify the identity of individuals who lack the necessary documentation.

Recommendations for financial institutions

• Consider how you can meet your regulatory requirements on KYC and customer due diligence while removing unnecessary hurdles for vulnerable users including asylum seekers.  There is clear support for this approach from regulators and industry bodies, and major banking groups such as HSBC have already started leading the way.

• Consider manual or in-person alternatives to your automated, digital onboarding process.  This will benefit both refugees and other marginalised groups (such as the elderly or others less familiar with technology, or people with certain disabilities).

• Review your customer risk assessment model.  Many models are heavily but often unhelpfully influenced by nationality.  The combination of nationality, refugee status, employment status, and thin credit files can all combine to make refugees high-risk customers.  This may place them outside a firm’s risk appetite and denied access products and services, or require them to undergo additional due diligence (which they may well fail), or may mean they are subject to additional ongoing scrutiny.  This in turn can result in payments being blocked or accounts being frozen pending investigation, which can have serious knock-on effects, unfairly disadvantaging refugees and other affected groups.

---

At FINTRAIL, we strive to improve diversity, equity and inclusion (DE&I) in all aspects of anti-financial crime. We co-created the FinCrime Principles of Inclusion as part of Tech Nation’s Finclusion 2021 to increase awareness of this important area and to provide practical, implementable guidance. Find out more and download the principles here.  

If you would like to discuss any of the topics raised in this article, or how FINTRAIL can assist you review your existing controls and procedures to ensure inclusion for refugees and other vulnerable groups, please email us at contact@fintrail.com. 

Making the Most of RegTech for Financial Crime Compliance

Some key takeaways from the IBF Singapore / FINTRAIL masterclass, 25 April 2022

What is Regulatory Technology (“RegTech”)?

RegTech is a subset of financial technology (“FinTech”) centred on technologies that effectively facilitate the delivery of regulatory requirements. There are many different types of RegTechs on the market that serve an expansive ecosystem of services, not limited to financial crime.

Risks involved in adopting RegTech

While there is no doubt adopting RegTech solutions can improve the efficiency and effectiveness of your financial crime-fighting functionalities, there are multiple risk factors to consider throughout the various phases of engagement:

• Technical risks including any technical issues from integration to BAU operations

• Business continuity risks including core risks that may impact your firm’s ability to operate

• Vendor management risks including any service level agreement issues, contractual risks, and obligations around change management…

FINTRAIL’s thoughts: The FCA review of challenger banks’ FinCrime programmes

The Financial Conduct Authority has conducted a review of “Financial crime controls at challenger banks”.  The basis of the review was a statement in the 2020 UK National Risk Assessments that criminals may be attracted to faster/streamlined onboarding processes.

The FINTRAIL team have been discussing the report and associated media coverage, and as you might expect, had a number of thoughts!

• Media coverage somewhat obscures the fact the FCA declares, “we remain of the view that there are limited differences in the inherent financial crime risks faced by challenger banks, compared with traditional retail banks.”  This is borne out by the fact the findings largely align with the topics raised in the FCA’s previous “Dear CEO Letter” to traditional retail banks, indicating there isn't a significant difference between challenger and traditional institutions.

• This chimes with assessments within the industry of the risks associated with challenger vs. incumbent banks, which some of our team have been involved.  They found that the way challenger banks were used by criminals differed to the way the same criminals used incumbent banks -  challenger banks were typically used for high volume low value movements, whereas incumbent banks were used for low volume, high value crimes.  In other words, neither type of financial institution was necessarily riskier than the other; it was how they were used by criminals that was the clear separator.

• The FCA criticises lenders for failing to take details of customers’ income and occupation.  Strong views on this one - there is absolutely no regulatory requirement to do so, and it’s questionable what value such self-declared, unverified information would provide.  This ‘failing’ has been highlighted in the media (e.g. the Financial Times), with no mention of the fact banks are not actually obliged to collect this information.

• The FCA cites a 'substantial' increase in the number of SARs filed last year, but this could either mean an increase in suspicious activity, OR that firms are getting better at identifying it, making it hard to draw conclusions from this statistic in isolation.

• Many of the areas of weakness are key components of a good financial crime programme, requiring a ‘back to basics’ review by banks:

  • Lack of / poor customer risk assessment frameworks

  • Inadequate resources to manage alerts

  • Inconsistent or undocumented enhanced due diligence (EDD) procedures, including for PEPs

  • Weakness management of FinCrime change programmes, meaning control frameworks are not keeping up with rapid levels of growth and changes to business models.

• The FCA is reportedly struggling with high levels of job vacancies.  This is a common theme across every organisation involved in fighting financial crime (and crime more broadly) - from Companies House to regulators and supervisory bodies and all branches of law enforcement.  This must be addressed at the government level - adequate resources must be given to institutions involved in the fight against financial crime.

Advisory Notice: Russian Asset Flight

Ongoing tensions between Russia and Ukraine mean that financial institutions (“FIs”) need to be adequately prepared for potential new sanctions measures. The uncertainty caused by the conflict has likely resulted in funds flowing out of Russia, which FIs should be actively monitoring. FINTRAIL has compiled the following overview of typologies and red flags to assist with identifying cases of asset flight from Russian state-owned enterprises, oligarchs, and senior officials

Fit and Proper: Football’s ‘See No Evil, Hear No Evil’ Approach to Investment

Football is not the national sport of Russia (that accolade goes to ‘bandy’, a form of ice hockey), but it is the most watched sport in that country. As such, it should come as no surprise that since the creation of the Premier League in 1992, and the huge TV and sponsorship deals that went hand in hand with it, club ownership has become an attractive proposition for those who can afford it, including Russian oligarchs.

In 2003, Roman Abramovich bought Chelsea Football Club from Ken Bates for a sum of £140m and, arguably, changed English football forever. In the 19 years since he took over, and under his patronage, he has seen Chelsea FC win multiple trophies, including five Premier League titles and two Champions League trophies (arguably the biggest competition in club football).  Nevertheless, success has come at a cost, with Abramovich reportedly having loaned the club around £1.5bn over the years.

However, Abramovich’s tenure in West London appears to have come to an abrupt end. With the conflict in Ukraine raging, Abramovich’s ties to the Russian state (he was elected to the State Duma in 1999, served as Governor of Chukotka between 2000 and 2008, and most crucially is said to have a very close personal relationship with Vladimir Putin) have seen him fall under worldwide scrutiny .  In particular, the UK Government announced on 10 March 2022 that it was imposing sanctions on Abramovich and freezing his UK assets, including Chelsea FC.  

Russian-Uzbek billionaire Alisher Usmanov, a close ally of Putin’s, who previously owned a 30% share in Arsenal FC (2007-2018) and now holds a financial interest in Everton FC, was also sanctioned by the UK government earlier this month. Everton FC announced that they have cut all ties with him.

Abramovich’s takeover in 2003 started an arms race of spending amongst clubs, with many consequently opening their doors to any ‘benevolent’ billionaire looking to invest. Technically, this should not have been a problem. The ‘fit-and-proper-person test’ or director's test, introduced into UK football in 2004 after Abramovich’s takeover, was supposed to prevent corrupt or untrustworthy people from becoming owners and directors of major British football clubs. It is safe to say its success has been limited.

Just Russian money?
Whilst the Russian invasion of Ukraine has crystallised the issue of foreign investment in football clubs, owning a football club is not just the preserve of oligarchs. 

In 2007, despite a history of human rights violations during the brutal drugs war in Thailand and allegations of corruption, Thai politician and businessman Thaksin Shinawatra was allowed to buy Manchester City FC. 

Similarly, Carson Yeung, who had been convicted of financial crimes in Hong Kong in 2004, was allowed to buy Birmingham City FC in 2009 after it was decided that the offences for which he had been convicted, namely 14 counts of failing to disclose shares he owned in a stock exchange-listed company, were not criminal offences in the UK. He was subsequently convicted of money laundering and sentenced to six years in prison in 2014. Some of the laundered funds were identified as having been used to purchase the club in 2009.

Most recently, the protracted takeover of Newcastle United FC by the Saudi Arabian Public Investment Fund (PIF), the national sovereign wealth fund, was finally completed in October 2021. Despite Newcastle United providing legally binding assurances that the Kingdom of Saudi Arabia will not control the club, the takeover has seen public condemnation due to the involvement of the controversial Mohammed bin Salman, who is the Crown Prince of Saudi Arabia and the chairman of PIF.

‘Sportswashing’
The purchase of Newcastle United led to many claims that the Saudi state was attempting to engage in ‘sportswashing’, effectively diverting attention away from its human rights record by association with a more positive brand.  Its image has been severely tarnished by its actions in the vicious civil war in Yemen since 2014, in which it has been accused of leading an indiscriminate bombing campaign targeting civilian areas, and by the murder of Saudi journalist Jamal Khashoggi in 2018.

Club ownership is not the only way for individuals to ‘launder’ their reputations. Ever since Germany hosted the 1936 Olympics, nation states have entertained ways to improve their global standing by sponsoring or hosting major sporting events. Gazprom, a Russian majority state owned energy company whose chairman is a close ally of Putin’s, has sponsored German club FC Schalke since 2007 and the UEFA Champions League since 2012 (both deals now having ended following the invasion of Ukraine).  

In 2010, Russia and Qatar were chosen to host the 2018 and 2022 football World Cups respectively. Russia’s winning bid followed the assassination of Alexander Litvinenko in 2006 and the invasion of Georgia in 2008, neither of which seemed to negatively influence the judges’ decision. In Qatar, neither a history of human rights abuses or the safety of LGBT fans or players appear to have been taken into consideration before awarding the tournament.

In 2010, Lord Triesman, the head of England’s bid to host the 2018 World Cup, resigned after being secretly recorded making allegations that rival countries had engaged in bribery attempts to secure the tournament. Lord Triesman specifically named Russia and Qatar.  Whilst the allegations were not proven, his predictions of which countries would be successful at the bidding process were accurate. 

Where does football go from here?
Football undoubtedly has a money problem. When Roman Abramovich walked into Chelsea in 2003, there were cries from many quarters - fans and journalists alike - that he ‘bought’ the club’s success and that his money had ruined the game. Whilst this is hugely simplistic (and rooted mostly in a classist ‘old v new money’ paradigm), it does beg the question of whether football is intrinsically greedy. Are the owners, directors, players and even the fans so enamoured with the thought of success that they are willing to turn a blind eye to the origins of the wealth?

Investor due diligence is a key tenet of anti-financial crime work. Identifying a potential investor’s source of wealth and funds is a prerequisite for running a regulatory compliant financial institution.  So why, for years, has football been given a free pass?  

The Premier League’s chief executive has said the organisation is reviewing the owners’ and directors’ test and looking at whether more tests need to be added and whether independent scrutiny needs to be included.  Some remain sceptical about how much will actually change, given Abramovich’s links to the Kremlin and the concerns around his source of wealth were clear to all from the start.  But ultimately, if this moment is to represent a turning point, momentum and change must come from the top.  It is unrealistic to expect clubs to apply too much scrutiny and turn away investment, thereby making themselves uncompetitive, when their peers are not and when no one is compelling them to do so. So the onus must be on the governing bodies to strengthen the regime and give it real teeth.

However, while recognising that it is likely naive to expect clubs to turn down money, the Chelsea saga does show how a permissive approach can backfire.  Like financial institutions, football clubs need to actively consider their risk appetite and what risks they are prepared to accept, and then carry out adequate due diligence to determine where funds are coming from and what the legal and reputational implications may be.  And financial institutions who bank football clubs, professional bodies and other related parties need to be aware of the sector’s vulnerabilities, and know how to interrogate and assess their clients so they can take a nuanced, risk-based approach and identify good and bad actors.

FINTRAIL Pioneer: FinCrime Guidance for Small Businesses and Start-Ups

FINTRAIL launched Pioneer in November last year to ensure all businesses, no matter how small, had access to the right support in the fight against financial crime.  Its aim is to focus on how to create a fincrime compliance programme from scratch, embed it in the company’s operations, and establish the right culture on a limited budget.  Also, it often isn’t appropriate to fixate on “best in class” or aspirational solutions if they are not achievable, proportionate or suitable.  So what do small businesses need to know about fincrime compliance, and how can they get it right from the start?

Advisory Notice: Russia-Ukraine Crisis Fundraising Scams

As the war in Ukraine captures the international community’s attention, opportunistic criminals are seizing the chance to take advantage of the crisis. In addition to navigating wide-ranging new sanctions against Russia, financial institutions (“FIs”) should familiarise themselves with the types of crimes that fraudsters are likely to commit. FINTRAIL has compiled the following typologies and red flags to assist with preparing and identifying fraudulent activity in light of the Russia-Ukraine crisis.

UK Government’s Commitment to Economic Crime Bill

After months of rising tensions, last week finally saw Russia take definitive action and begin its long-anticipated invasion of Ukraine.  The US, UK, EU and others have imposed targeted sanctions on Kremlin-affiliated individuals and banks, and cut off some Russian banks’ access to SWIFT, with more measures still to follow.  

Alongside the universal condemnation of Putin’s actions, we believe it is vitally important for the UK to look at its own relationship with Russia and consider how it enables the Kremlin.  Demands that this moment should mark a turning point have come from politicians on both sides of the aisle, media outlets of all persuasions, and anti-corruption campaigners.  But such  demands are not new.  The UK Parliament’s Intelligence and Security Committee published a damning report in July 2020 which accused successive governments of allowing dirty Russian funds to infiltrate the UK:  “The UK welcomed Russian money, and few questions – if any – were asked about the provenance of this considerable wealth.”  Chatham House has published a report entitled “The UK’s Kleptocracy Problem”, and Transparency International has revealed the volume of UK property owned by Russians accused of corruption or linked to the Kremlin (worth in excess of £1.5bn).  The US has also raised concerns: a spokesman for the Center for American Progress, a Biden-aligned think tank, has said “there is clear concern in the US government about the influence of Russian money in the UK”.

We welcome the British government’s announcement that it is bringing forward legislation to address Russian corruption by creating a register for the beneficiaries of overseas firms.  This will deliver on a government pledge made five years ago to end secret offshore ownership; draft legislation was drawn up in 2018, but has been put on hold ever since.  However, momentum must not be lost with the passing of the Bill; every effort must be made to implement its provisions as soon as possible (official sources have warned this could take up to a year). 

The government has also promised to make long-overdue reforms to the UK corporate registry Companies House, requiring anyone who owns, runs or controls a UK company to verify their identity.  Companies House will also be given new powers to challenge information. Again, this promise is welcome but pressure must be maintained to make sure that this additional economic crime bill is brought before parliament, and that the reform measures are implemented, as soon as possible. 

We support the calls of organisations such as Transparency International UK and anti-corruption figures such as Graham Barrow and Oliver Bullough, in calling for the UK government to take this moment to act.  It is not a question of uncertainty over how to tackle the problem - there is general consensus on what needs to be done.  What is lacking is adequate resourcing and political will.  The invasion of Ukraine must be a turning point for these long-demanded reforms.

Beyond the immediate measures promised by the government, the UK should also commit to making progress on the following fronts:

• Applying greater pressure to crown dependencies such as Jersey, Guernsey and the Isle of Man and to British oversees territories, such as the British Virgin Islands, to introduce much greater transparency and to introduce unrestricted public registers of company ownership.  Transparency International UK has identified 2,189 BVI entities used in 48 Russian money laundering and corruption cases involving more than £82 billion worth of funds diverted by rigged procurement, bribery, embezzlement and the unlawful acquisition of state assets. 

• Conducting a retrospective review of the 200 “golden visas” issued to Russian millionaires over the past seven years (following the closure of the scheme last week).

• Making greater use of Unexplained Wealth Orders, often cited by the government as a significant development in anti-kleptocracy efforts, despite the fact only four have been issued in four years (none under the current government, and none of which were brought against Russian nationals).

• Reviewing the number of agencies involved in investigating and prosecuting kleptocracy  cases following criticisms that too many agencies are involved (the National Crime Agency, the Serious Fraud Office, City of London police, and local forces).

Financial crime compliance professionals have long called for reforms in these areas, and have shown themselves willing to work with the authorities to achieve them.  We hope that the new Economic Crime Bill marks a genuine change in stance, and that all parties involved can work together for maximum effect.  We at FINTRAIL and the FinTech FinCrime Exchange are ready to do whatever we can to help support these efforts.  It is regrettable that these measures were not taken sooner, but hopefully a meaningful shift in political will can reduce the role the UK plays in enabling not just the Kremlin but corrupt and dangerous regimes the world over.  

Suisse Leaks: Swiss banking returns to the spotlight

Yesterday saw the announcement of yet another major financial leak, exposing details of the accounts and wealth of foreign clients of Credit Suisse, allegedly including “criminals, dictators, intelligence officials, sanctioned parties and political actors with outsized wealth”.  Credit Suisse has issued the usual rebuttals - that many of the cases are historic, or are isolated incidents not representative of the bank’s overall business.  And many believe Credit Suisse is unlikely to be an outlier, with the whole Swiss banking industry thrust into the spotlight.

Having worked in anti-financial crime for multinational banks with a significant presence in Switzerland, I’m acutely aware of the challenges of navigating its infamous secrecy laws, and the difficulties of implementing global financial crime programmes under these restrictions.  I’ve also worked with a large number of Swiss compliance staff and relationship managers, and know that most do care about financial crime, and are far from the sinister or negligent figures they are often portrayed to be.  Culture, governance and risk appetite obviously vary from bank to bank and can be very hard to assess from the outside, even with vast troves of leaked data.  So putting aside the specific allegations against Credit Suisse, what do we need to understand about Switzerland and its legal and regulatory framework to better understand this story?

Switzerland is notorious for its banking secrecy.  Its 1934 Federal Act on Banks and Savings Banks criminalises the disclosure of client banking information to any foreign authorities.  The first major roll-back of this provision occurred in 2018, when Switzerland started sharing information under the Common Reporting Standard for the automatic exchange of banking information.  (Side note: this development came about as the result of another whistleblowing incident, when a banker violated Swiss banking secrecy laws to tell US authorities how UBS Group was facilitating tax evasion by foreign customers.)

However, it is clearly wildly inaccurate to say (as some have done) that this was the end of Swiss banking secrecy.  For a start, it is still impossible for countries which are not signed up to the common reporting standard to receive any information from Switzerland.  It’s worth noting these are predominantly poorer nations, in many cases those most affected by the kleptocracy and capital flight Credit Suisse is accused of abetting.  Notwithstanding this one area of concession, the law remains in place and has been accused of effectively criminalising whistleblowing, preventing people reporting illegal behaviour to the relevant authorities.  It also restricts investigations by outside parties, with journalists inside Switzerland at risk of being prosecuted for publishing or even possessing private banking data. It also prohibits the sharing of information within financial groups, meaning Swiss subsidiaries of global banks cannot share any information with their parent bank, making holistic risk management impossible.  A telling indicator of the authorities’ overall attitude has to be a legal revision in 2018 (the same year Switzerland started sharing tax information) raising the maximum sentence for breaching the law from six months to three years.  

Many commentators believe that recriminations following this latest leak should be directed not just at Credit Suisse, but also the Swiss authorities for creating a lax regulatory environment and upholding laws that punish the exposure of illegal activities.  They believe the various leaks and scandals that have emerged over recent years indicate wider failings in banking supervision, with insufficiently rigorous monitoring and oversight.  The Swiss regulatory framework has also been criticised for being insufficiently robust.  Organisations like Transparency International and Public Eye have said the Anti-Money Laundering Act is too narrow in scope, as it does not apply to parties such as lawyers, fiduciaries, trustees, and other consultants.  This contravenes international best practice and the recommendations of the Financial Action Task Force (FATF). The number of SARs filed has also been criticised for being noticeably low given the overall volumes of funds flowing into the country, and the flows from overseas clients and high-risk jurisdictions.

Arguably, responsibility may even go beyond Switzerland itself - to international bodies and standard setters.  Like most financial centres in economically developed countries, Switzerland receives positive ratings and assessments in nearly all global financial crime indices, such as the Basel AML Index and Transparency International’s Corruption Perceptions Index.  In 2020, the OECD’s Global Forum rated Switzerland as “largely compliant” on issues relating to availability, access and exchange of ownership information on entities and bank accounts, even while contradictorily acknowledging that the availability of beneficial ownership information was not guaranteed.  The Global Forum also noted that Switzerland would seemingly not respond to foreign requests for banking information if the request was based on “stolen data” (i.e. a leak) or if the requesting authority “actively sought out” the information outside of an administrative assistance procedure.  

The aftermath of the 2007 whistleblowing case and the subsequent pressure by US authorities shows that outside parties can be effective in bringing about meaningful change.  There is clearly much more international bodies can do to apply pressure to Switzerland to address specific loopholes and to change the overall tenor of its banking laws.  Individual financial institutions can also consider how they treat Switzerland as a jurisdiction, and whether they are content to rely on international indices which do not call out issues around transparency and the availability of information.

---

FINTRAIL can help financial institutions to assess country risk using objective methodologies that go beyond the usual global risk tables. This can be aligned to custom designed risk-based CDD and ongoing monitoring controls. We also perform enhanced due diligence and investigations on customers, partner institutions and other third parties in jurisdictions where public information is hard to obtain. If you would like to speak to us about this or any other services, please do get in touch: contact@fintrail.com

FinCrime End of Year Report

On Wednesday, FINTRAIL delivered a webinar on our “FinCrime End of Year Report: Lessons learned in 2021 and development points for 2022”. For those who weren’t able to make the session, here are our key takeaways:

2021 Key Learnings

The FCA sent a Dear CEO letter to retail banks in May 2021, highlighting actions needed in response to common control failings identified in anti-money laundering frameworks.  It noted common weaknesses in key financial crime areas, including: 

• Governance and oversight including mature model with three lines of defence

• Risk assessments covering all financial crime types beyond money laundering and fraud, and dynamic and effective customer risk assessment model

• Due diligence including ongoing monitoring 

• Transaction monitoring including tailored rules and thresholds

We noted that these control areas should be considered holistically, as failings in one area will affect the whole programme.  For instance, if you do not collect adequate due diligence information you cannot conduct effective ongoing monitoring.  

While this letter was addressed to retail banks, the findings are also relevant to the digital financial sector, and align with FINTRAIL’s findings from audits and health checks of FinTechs conducted in 2021.  The areas we most frequently identified as areas for improvement were:

• Due diligence (including enhanced due diligence)

• Screening

• Audit, quality assurance and quality control

• Governance and oversight 

Transparency International UK published a report in December 2021 on the money laundering risks of e-payment firms, which said that the payments industry could become a “major gateway” for illicit funds.  In FINTRAIL’s view, many of the risks highlighted are not unique to e-payment firms, and are faced by the whole financial sector.  However, the report did highlight specific risks around the regulatory oversight of e-payment firms, and lack of due diligence on their owners and senior managers.  We discussed the importance of the ‘tone from the top’ and the right compliance culture, and how a firm with compromised or criminal owners could be used to facilitate financial crime schemes.  There is a clear need for the regulator to conduct suitable due diligence on owners and senior managers of firms applying for e-payment licences.  

Technology and automation remained a hot topic in 2021, both in terms of the growth of digital banking and in the financial crime space.  We reflected on the growth of the regulatory technology (RegTech) space, including greater adoption by conventional financial institutions, and the consolidation of the market through acquisitions.  We also discussed how regulators and international bodies recognise the potential benefits of technological adoption but are also highlighting the risks.  Firms must adhere to regulatory guidance, and must understand how their technology works and how to identify any gaps or weaknesses.  Additionally, the FCA published a paper in 2021 on Implementing Technology Change which considered the need for good governance around the use of technology and outsourcing, and the potential impact of failures on customers.  Firms must consider not just if but how to deploy technology, and how to fuse it successfully with human expertise.

2022 Focus Areas:

• Effectiveness: Industry bodies and regulators including the FCA and FinCEN have increasingly promoted the idea of focusing on the effectiveness of financial crime controls.  The Wolfsberg Group followed up its earlier Statement on Effectiveness with a paper on Demonstrating Effectiveness in June 2021.  This offered practical guidance on how firms should assess risk in defined priority areas and demonstrate the effectiveness of their AML programmes in tackling them.  While there is no regulatory obligation at this stage, measuring and demonstrating effectiveness is likely to be a focus area for regulators in 2022, and financial institutions should start considering how to articulate it.

  The European Banking Authority (EBA) has launched EuReCA, a central EU database containing information on material AML/CTF weaknesses identified in individual financial institutions.  This offers further encouragement for firms to ensure their controls are robust and effective, to avoid the ‘naughty list’.
  

• Financial inclusion and the effects of de-risking: The Financial Action Task Force (FATF) issued a paper on Mitigating the Unintended Consequences of the FATF Standards in October 2021, which focused on financial exclusion, de-risking, the undue targeting of non-profit organisations (NPOs), and curtailment of human rights.  There is a clear tension between reducing financial crime risks and ensuring equal access to financial products, affecting both individuals (e.g. migrants, those without a fixed address) and entire sectors.  The EBA also issued an opinion last year on the consequences of de-risking, clarifying that EU AML.CTF laws do not require firms to refuse or terminate business relationships with entire categories of customers they deem high risk.  The UK Treasury Committee’s Economic Crime Report, published on 2 February 2022, recommends the FCA reports annually on numbers of de-risking decisions and on progress to ensure that banks are not unfairly freezing bank accounts and de-risking customers.  
  
  Firms are not obliged to offer services to those they deem outside risk appetite, but should be aware of the implications of risk appetite decisions and make conscious decisions regarding inclusion and fair treatment.  We recommend firms think through their risk appetite carefully, rather than automatically avoiding high-risk customers, as  regulators may start asking them to fully justify de-risking decisions.  FINTRAIL has partnered with Tech Nation as part of FinClusion 2021 to issue the FinCrime Principles of Inclusion which provides valuable guidance for designing inclusive FinCrime controls.
  

• Humans versus machines: FATF published a paper on the ‘Opportunities and Challenges of New Technologies for AML/CTF’ in July 2021, which promoted the use of new technologies, but also urged firms to consider how to balance automation with human input and oversight.  It stressed that manual review and human input remain hugely important.  Regular audits and explainability is key, with firms able to explain how their technology works, and continuously confirming that it is operating as expected.

To stay up-to-date with regulatory developments, news and key reports, sign up to our newsletter and receive our monthly regulatory recap - the FINTRAIL RegCap (www.fintrail.com) 

To understand whether your FinCrime programme is developed and mature enough to meet the meets of your business and current regulatory expectations, please speak to us about our Maturity Matrix and audit/health check services.

And if you would like any other support, or to discuss any of the topics discussed, please do get in touch with us at contact@fintrail.com.  

Cryptocurrency in Conflict Zones: Risks and Opportunities

For the past two weeks, the world’s attention has been firmly fixed on Afghanistan. One critical challenge, both for those fleeing and those left behind, is access to money.  The banking system is on the verge of collapse, with many branches closed and those which are open quickly running out of cash. There are long-term concerns for what Taliban rule will mean for the economy and for people’s livelihoods. In the face of this uncertainty, a small but increasing number of Afghans are reportedly turning to cryptocurrency as a way to shore up their savings, evade Taliban oversight, and maintain international access.

There have been similar developments in other conflict zones and politically unstable countries. According to a Guardian article earlier this year, Libya, Palestine and Syria neared the top in online searches for bitcoin and other digital currencies, and there are reports of growing usage in troubled countries including Venezuela, Iran, Zimbabwe and Lebanon. Many of these countries have a substantial middle class with moderate levels of savings and financial literacy and high internet penetration rates - the ideal conditions for crypto adoption. The phenomenon has gained scholarly attention; Boston University convened a task force in 2015 to explore how cryptocurrencies could provide assistance in conflict zones. So how realistic is this idea?  And what financial crime challenges would wider adoption bring in its wake?

Unlike in developed markets, where crypto adoption was initially driven by ideology and later by speculation, in fragile states adoption is mostly driven by practical need. Virtual currencies can offer solutions to a number of critical problems:

• Inflation: despite the inherent instability of crypto assets themselves, they can be a good hedge in jurisdictions afflicted by severe currency depreciation. Both Venezuela and Iran have witnessed increasing crypto adoption in the face of dramatic inflation - in Venezuela’s case, peaking at 10,000,000% in 2019. Wealthier individuals in such countries have previously turned to stock markets and physical assets such as gold and property to protect their wealth, but crypto offers a more accessible option to those with smaller amounts to invest.

• Circumventing sanctions controls: crypto is sometimes the only solution for those in sanctioned countries who cannot move money abroad any other way. Many small businesses and freelancers in Iran, for instance, choose to be paid in crypto as they are not able to receive international bank transfers or use services like PayPal.  

• Avoiding currency controls in countries with restrictions on the amount of currency that can be moved abroad. For instance, during the Lebanese financial crisis which broke out in 2019, customers’ savings were effectively frozen by banks imposing informal capital controls and blocking transfers abroad. New regulations were introduced in May 2020 to permit foreign currency withdrawals, but these were limited to $50 to a few hundred dollars a month, with transfers abroad capped at $50,000 a year for “necessary matters” only. Growing numbers of Lebanese citizens are choosing to keep their savings in cryptocurrency to maintain control and prevent losing it to bank- or state-imposed restrictions. 

• Uncensored: while the lack of centralised control was originally a purely ideological plus point, in conflict zones this is often of practical importance. The censorship-resilient system reassures users who have lost faith in their national financial systems and want to keep their assets out of reach of the authorities, and safe from seizure, freezes or other restrictions. 

• Price and speed: Perhaps most obviously, crypto offers faster and cheaper overseas transfers. While this is a positive anywhere, it’s especially useful in unstable countries which have large diasporas and are heavily reliant on remittances (e.g. Somalia where remittances account for a huge 23% of GDP). It is also a key consideration in countries deemed to be high risk and “derisked” by global banks, where the local banking network is poorly connected internationally, resulting in higher fees, longer waits, and greater inconvenience.

Nevertheless, there are still clearly numerous barriers to more widespread adoption. Top of the list in most emerging markets is a lack of awareness, and unreliable access to the internet. In high-risk and fragile states, there are additional barriers in the form of access to the banking system. Crypto may seem like a good solution for the unbanked, but not being able to use a bank account or credit card to trade restricts the type of platforms available. Users may also lack the ID documents required to open accounts with the larger exchanges.

For this reason, crypto activity in fragile countries rarely takes place on international, centralised exchanges. It is mostly driven by decentralised P2P exchanges, which do not require KYC and allow users to buy and sell in cash - either through local crypto-to-cash brokers or in-person payments. Social media is also increasingly used to match local buyers and sellers. These platforms help customers avoid restrictions imposed by larger exchanges such as geoblocking; under pressure from their banking partners, a growing number of exchanges have banned users based in Iran, for instance. In other instances, users buy and sell crypto with the help of friends or family based abroad with fiat bank accounts and credit cards, who can purchase and hold crypto on the user’s behalf. In a creative blend of the old and the new, hawala dealers can also facilitate purchases, either by sending or receiving money from friends and family overseas, or by letting people cash out by selling their coins to the dealer in exchange for local currency.  

Conflict zones are inherently high-risk for financial crime including arms trafficking, sanctions evasion, corruption, and terrorist financing, and P2P activity on decentralised exchanges only exacerbates these risks. The absence of KYC controls and the use of cash are ideal for criminal actors as well as civilian users. Having associates or hawala dealers making purchases and holding crypto on behalf of a user in a fragile state clearly obscures the true owner and source of the funds. The use of P2P exchanges is also risky for users themselves, as they are more exposed to fraud and theft when making cash payments or using exchanges without escrow services.   

Unsurprisingly, governments in conflict-affected and fragile states are unlikely to be too concerned with developing the cryptocurrency regulatory environment. The onus therefore falls on financial institutions to find ways to monitor developments and address the risks posed.  One clear lesson is the need to understand the broader context, looking at political and security developments to predict and engage with peaks in demand.  Widespread adoption remains unlikely, given the numerous challenges around infrastructure, trust and education.  Nevertheless, it is clear that crypto will remain an appealing option for some, as long as the traditional financial system fails to offer a better alternative. Finding ways to reduce the risks and integrate these users into a regulated crypto ecosystem could provide new options for financial inclusion for the most vulnerable.

If you would like to speak to FINTRAIL about any of the issues raised in this article, please contact Maya Braine, Managing Director for the Middle East and Africa at maya.braine@fintrail.com. We work with FinTechs in Saudi Arabia and the wider Middle East region to build out their financial crime compliance controls, secure banking partnerships, select and integrate RegTech vendors, perform health checks and audits, provide interim compliance support, and run training.

Is FinTech Saudi Arabia’s new oil? Some financial crime considerations

Firstly, a quick summary. There has been a lot of buzz about Saudi Arabia embracing FinTech as “the new oil”, a key pillar of its ambitious economic reform programme designed to move away from a dependence on crude oil. It is competing with its neighbours, especially the UAE and Bahrain, to become a regional FinTech hub, encouraging the best talent and most promising start-ups to make Riyadh their home. The government has launched numerous initiatives including FinTech Saudi - a joint venture by the central bank (SAMA) and the Capital Markets Authority (CMA), a regulatory sandbox, and the CMA FinTech Lab among others. The government’s Vision 2030 sets a target for moving away from cash and increasing cashless payments to 70%.  Next year will see the launch of the FinTech Saudi Hub in the King Abdullah Financial District, and new regulations on FinTech activities. Most major Saudi banks have also initiated FinTech programmes and invested large sums in digital transformation to explore new opportunities and stave off the competition. 

But behind the positive headlines, is the regulatory environment and compliance culture in the Kingdom ready for such large-scale change? And how can Saudi Arabia embrace FinTechs and digitisation while guarding against financial crime threats?

Regulatory  Environment

There are many components to establishing a thriving FinTech ecosystem, not least a conducive regulatory environment. FinTechs have only been able to receive licenses in Saudi Arabia since January 2020, when SAMA issued its first licences to non-bank financial institutions (STCPay and Geidea). In the same month SAMA introduced the Payment Services Provider Regulations (updated in August 2020), and in February 2020 it issued guidelines for digital-only banks. These guidelines stated digital banks had to meet the requirements of existing regulation plus demonstrate compliance with AML/CTF regulations “in a fully digitised environment”.   

Despite the positive moves, there are still a number of grey areas where FinTechs need more clarification to understand their regulatory obligations. Interaction with the regulator is extremely useful, but is difficult for small start-ups who lack the communication channels and existing relationships of major banks. This is where initiatives like FinTech Saudi can play a really helpful role, acting as an aggregator for queries and serving as an intermediary for the whole FinTech community. 

RegTech

Like most markets, Saudi Arabia professes that it is keen to embrace RegTech as a way to improve efficiency and effectiveness in tackling financial crime. The digital banking guidelines published in 2020 describe banks operating “in a fully digitised environment”, which appears to open the way for using RegTech for processes like e-KYC. However, more details are needed around what is allowed in practice and how the regulations are to be interpreted. For instance, the use of facial biometric technology is still not permitted in financial services, which limits onboarding tools such as selfie and video verification (although banks are testing the water around biometrics - Riyad Bank has started using voice authentication, and Al Rajhi Bank has rolled out self-service terminals featuring fingerprint biometrics). Another complication is data storage; Saudi regulations place restrictions on the hosting, transfer and storing of customer data outside the Kingdom, restricting the use of many compliance platforms and tools.

Open Banking

Looking ahead, the next hot topic is open banking. SAMA has announced an open banking framework which is due to go live in the first half of 2022. This will compel financial institutions to allow third parties access to customer data (with the customer’s consent), resulting in greater competition and innovation. So far, Bahrain is the only Gulf state to have adopted open banking, although individual financial institutions in the UAE have introduced open banking APIs.

This development will supercharge the growth of the FinTech sector and create both challenges and possibilities in relation to financial crime. Saudi banks can learn from their international counterparts that have developed security measures to protect their open banking APIs from fraud, such as multifactor authentication (MFA), but opening up their systems to third parties does inevitably create new fraud risks. For money laundering, open banking can theoretically be a game changer; data can be shared across multiple providers, enabling each institution to form a more complete picture of customers and their transactions. However, this only works if they change their KYC and monitoring controls to capitalise on this possibility. 

FinTechs and other market entrants will also have to play catch-up to prevent an unequal playing field; banks have spent years developing rigorous controls under strict regulatory supervision, whereas new firms will have less experience in financial crime risk management, and regulators may struggle to effectively monitor the increasing number of small companies. Money launderers and fraudsters are extremely good at identifying and targeting weak links, so it’s important for the whole financial sector to apply the same high standards. Ultimately, regulators need to reconsider what data can be shared between institutions and how, to improve customer experiences and develop a holistic understanding of customers to improve financial crime detection.

Recruitment and hiring

A final challenge in both Saudi Arabia and the wider GCC is finding the right compliance talent for an increasingly digital world.  The ideal candidates would be people with experience in FinTechs and digital products, but given the lack of such expertise in Saudi Arabia, that would mean recruiting people from other markets like the UK who wouldn’t necessarily understand the regional context or local regulatory nuances. The next best thing, then, is people who thrive on change and are happy to challenge received wisdom and upend the traditional way of doing things. They want to engage with their peers and with the regulators to share insights, ask questions and develop guidelines that will help the sector grow responsibly.  For the right people, it’s a hugely exciting opportunity!

Final Thoughts

The next couple of years will be critical for the Saudi FinTech sector. One factor that will determine how quickly new firms can get up and running is if they can assure regulators and banking partners that their compliance programmes are sufficiently robust and that they can successfully balance customer experience with suitable risk controls. Saudi firms can look to international counterparts for guidance and ideas, although they should be aware that even these firms don’t have all the answers, and more developed markets still face real challenges around fraud and money laundering.  Nonetheless, benchmarking against international best practice will provide reassurance to regulators and partners, and show a level of sophistication beyond the baseline of meeting minimum regulatory requirements.

However, it is not just FinTechs themselves who need to be open-minded and ready to learn to get the sector off the ground. Regulators also need to be receptive to new ideas, technologies and ways of working, and should be prepared to seek expert advice in areas where they may lack experience, such as cryptocurrencies. The good news is that SAMA and other government bodies in Saudi Arabia genuinely seem prepared to do this, and to work collaboratively with the private sector to encourage growth and work through the details to ensure the regulatory environment permits FinTechs to thrive while successfully minimising financial crime risks.  

If you would like to speak to FINTRAIL about any of the issues raised in this article, please contact Maya Braine, Managing Director for the Middle East and Africa at maya.braine@fintrail.com. We work with FinTechs in Saudi Arabia and the wider Middle East region to build out their financial crime compliance controls, secure banking partnerships, select and integrate RegTech vendors, perform health checks and audits, provide interim compliance support, and run training.

Digitisation and FinTech FinCrime Compliance

As banks around the world embrace digital transformation, launching digital products and entering into FinTech partnerships, they face very specific FinCrime threats and challenges.

Find out how FINTRAIL can assist conventional financial institutions with designing tailored solutions and controls for digital offerings and partnerships to meaningfully reduce financial crime, satisfy regulatory requirements, and meet customers’ growing expectations.

If you are interested in speaking to the FINTRAIL team about this or any other financial crime topic please get in touch with the team at: contact@fintrail.com

A Year in Review: Financial Crime in the Middle East and Africa in 2020

2020 has clearly been a year like no other.  Both businesses and criminals have had to adapt to the abrupt and far-reaching impacts of the COVID-19 pandemic.  This has drastically accelerated the shift away from cash to digital payments, and encouraged both governments and global actors such as the Financial Action Task Force (FATF) to promote a shift towards digitisation.  The pandemic also provided ample opportunities for criminals to devise new schemes and take advantage of a rapidly changing, uncertain environment.  Many financial institutions in the Middle East, particularly the Gulf Cooperation Council (GCC) struggled with sluggish performance, but most still planned to grow their compliance teams and increase compliance spend over the course of the year, with a focus on technology.  

Below are some of the key financial crime stories and trends from the year across the MEA region:

Fraud and COVID-19

COVID-19 has created opportunities for organised criminals and fraudsters across the globe, and MEA is no exception.  The region has traditionally been dominated by cash payments, but the pandemic accelerated a huge shift to digital transactions (e.g. a PwC survey shows 53% of Middle East respondents making purchases online).  This change, coupled with public anxiety which left people vulnerable to scams, led to a massive increase in fraud including phishing, online shopping fraud, impersonation fraud, and fake charitable appeals. The UAE, for instance, saw a 250% increase last year in cyberattacks, including phishing and ransomware incidents.

Financial institutions need to respond by re-examining their fraud controls, conducting risk assessments to capture the latest threats, and educating their customers on new risks and typologies.  Informal collaboration or industry groups such as the regional charters of the FinTech FinCrime Exchange can be invaluable here.

Spotlight on digital onboarding and eKYC

Regulators in the Middle East and Africa were already moving towards greater digitisation and use of technology to fight financial crime, and this trend has only been accelerated by the COVID-19 pandemic.  In April 2020 the Arab Monetary Fund published a report on ‘Digital Identity and e-KYC Guidelines for the Arab Countries’ to further the debate on adopting digital onboarding tools.  Within the Middle East, the UAE and Bahrain have been the national frontrunners - Bahrain launched an eKYC project mandated by the Central Bank of Bahrain in 2019, to facilitate KYC data sharing amongst participating financial institutions which has continued to develop over the course of 2020, and the UAE introduced its own eKYC platform which went live in July last year.   

As more and more firms look to digitise their compliance processes, against this backdrop of growing official support, care must be taken to select technological solutions which allow firms to reduce any potential risk exposure, and that their use and integration is properly assessed and re-evaluated on an ongoing basis.

FATF Mutual Evaluation Report on the UAE

One major regional news story in 2020 was the publication of FATF’s critical Mutual Evaluation Report on the UAE’s money laundering and terrorist financing controls.  FATF stated the UAE needed to make “fundamental and major improvements” to its AML/CTF systems, and placed it under a year-long observation to ensure that it is properly implementing its recently adopted laws.

The UAE has faced other criticism last year.  It was the only GCC state included in a list of 82 major money laundering jurisdictions identified by the US State Department in March.  A report from the Carnegie Endowment in July on financial crime in Dubai highlighted a number of risk areas and stated that “Dubai’s prosperity is a steady stream of illicit proceeds borne from corruption and crime.”  The investigative and policy organisation The Sentry issued a report in November on how Dubai has become the main destination for illicit gold from Africa.

While the UAE government works to meet FATF requirements over the next 12 months, individual financial institutions need to ensure they have up-to-date risk assessments that reflect the financial crime threats relating to the country highlighted by these external sources, and then align their procedures and controls to address and mitigate the risks.

MEA regulators start to warm up to cryptocurrencies

The growth of cryptocurrency remained relatively low-scale but continued to show promise across both Africa and the Middle East.  Commentators believe the growing level of interest in Africa in particular, and compelling crypto use cases (the instability of fiat currencies and high remittance fees) will force regulators’ hands and encourage the issue of crypto-specific regulations in the near future.  2020 saw the issue of new regulations in Nigeria, South Africa and the UAE, with other jurisdictions such as Kenya and potentially Saudi Arabia likely to follow soon.  The UAE and Bahrain (which issued crypto regulations in early 2019) have both granted licenses to crypto exchanges under the relevant regulations, and currently have a number of crypto companies in their sandbox programmes.

The growing adoption and acceptance of cryptocurrencies in the MEA region will not only require crypto firms themselves to establish robust compliance programmes, but also other companies with potential exposure to them, such as conventional banks.  Crypto is perceived to be a high-risk sector but this does not mean it should be off-limits, and with greater knowledge and training on the associated risks and necessary controls, an increasing number of financial institutions are likely to engage with it in the coming years.

Slow steps towards greater transparency and access to data

Finally, 2020 has seen some positive developments relating to one of the region’s key issues in financial crime compliance, namely transparency and accessibility of data.  A small number of governments have made moves to align themselves with international standards, such as the UAE, Egypt and Kenya, which all introduced new requirements in 2020 for companies to declare their ultimate beneficial owners.  The onus is now on industry bodies to lobby to make all this information public, and on financial institutions to work out how best to integrate these new sources of information into their onboarding, customer risk assessment, and ongoing due diligence processes. Once again, technology is likely to play an increasing role here.

FINTRAIL in 2020

2020 was a key year for FINTRAIL’s coverage of the Middle East and Africa, with the appointment of Maya Braine as managing director, allowing for dedicated coverage and enhancing our understanding and expertise.  We completed several exciting projects with a focus on the region, including an ongoing assignment to provide training to compliance teams across Kenya, Nigeria and South Africa, and the launch of a digital product focusing on the African diaspora.  We also became a Venture Acceleration Partner  of Bahrain FinTech Bay, one of the world’s leading FinTech hubs.  We have ambitious plans for the region in 2021, so watch this space!

If you would like to contact us about any of the topics raised in this article, or about your financial crime compliance needs in the MEA region, please contact maya.braine@fintrail.co.uk. FINTRAIL can assist with performing risk assessments, providing training, implementing RegTech solutions, composing policies and procedures, and designing and reviewing FinCrime controls. For more details on our services, please visit our website.

Partners Against Crime: FinTech-Banking Partnerships in the GCC

With particular thanks to Banque Saudi Fransi, First Abu Dhabi Bank, Jingle Pay, Rise, Xpence, and Ziina.

Although the FinTech sector in the GCC has developed significantly in recent years, it is still relatively underdeveloped in global terms and has huge potential for future growth.  One major obstacle often cited by FinTech start-ups is the difficulty of establishing partnerships with incumbent banks.  These are essential since FinTechs generally operate under a bank’s licence rather than obtain their own, and rely on the banks’ payment rails.

However, banks in the GCC are often reluctant to onboard FinTech partners, for both commercial and compliance reasons.  Many are creating their own digital product offerings and see FinTechs as competition.  However, another major issue is the banks’ worry around the financial crime risks posed by customer-facing FinTechs.  In a region already recognised by external parties as high-risk, and facing numerous financial crime threats from money laundering and terrorist financing to sanctions evasion, many banks are reluctant to take on new high-risk business and consider FinTechs to be outside their risk appetite.  

While financial crime considerations are clearly relevant in every region, an additional complication in the GCC is the fact regional banks are concerned about their correspondent banking partnerships, which enable them to transact in foreign currencies.  Widespread derisking has caused many global banks to cut ties with their Middle Eastern counterparts, meaning regional banks can’t endanger their remaining partnerships by taking on new business their partners will deem high-risk.  Effectively, regional banks can’t define their own risk appetite and have to follow that of their international partners.

As well as correspondent banking partners, regional banks must also satisfy increasingly strict local regulators.  The introduction of more rigorous regulations and enforcement by GCC regulators to meet international expectations has resulted in significant de-risking within the GCC itself, with banks terminating relationships rather than accepting and managing the associated risks.  In this environment, signing up new, high-risk FinTech businesses is a tough sell.

However, there are clearly major benefits for both banks and FinTech start-ups to successfully form partnerships with the right counterparts.  The key is for the banks to be comfortable with the FinTechs’ compliance frameworks and controls, and to be able to convince their correspondent partners and local regulators that they have suitable systems in place for assessing and managing the risks associated with these partnerships.  

So in practical terms, what do regional banks and FinTechs need to do?  FINTRAIL has looked in a previous blog at FinTech-bank partnerships in the US, and some key ways the two parties can ensure a successful partnership by aligning risk appetites, expectations, and operating practices.  Many of the key takeaways, such as the need for clear roles and responsibilities, a documented escalation process, and regular communication, are clearly of global relevance and just as important for GCC firms as those elsewhere in the world.  

In addition, to address the specific challenges in the GCC, regional banks should ensure they can demonstrate the following:

1. A clearly defined risk appetite for FinTech partnerships and the type of business and levels of associated risks the bank is happy to accept

2. Tailored onboarding and customer risk assessment processes for FinTechs, to ensure the bank fully understands the risks of each relationship and manages them accordingly, with the appropriate level of due diligence

3. Special due diligence controls designed for FinTechs, such as nuanced AML questionnaires, onsite visits, and bespoke transaction monitoring, to give the bank insight into its partner’s compliance controls and activity

Regional banks should also seek to educate their correspondent partners on the local regulatory environment, such as FinTech licensing requirements and local KYC regulations, to help them better understand the true nature of the underlying customers.  This could help dispel misconceptions about the level of risk posed.

Ultimately, there is no doubting the potential of the FinTech sector in the GCC, and the opportunity for all parties to benefit.  Regional banks recognise that FinTechs are shaking up the industry and forcing innovation in terms of product offerings and customer service.  Digitising their own offerings will only go so far towards meeting this challenge, and partnering with the right start-ups will offer them the chance to benefit themselves from this innovation.  Especially given the current economic situation in the region, the prospect of new revenue streams is not easy to dismiss.  Banks who can think creatively about how to manage the compliance risks associated with FinTech partnerships and can demonstrate a rigorous programme to their own internal stakeholders and to external partners stand to make tremendous gains.

FINTRAIL has experience working on both sides of the table helping FinTechs and their partner banks manage financial crime risks. We can assist by helping banks determine their risk appetite and design robust onboarding and ongoing monitoring programmes for FinTech partners, and by performing assessments of FinTechs’ financial crime exposure and compliance programmes and controls.

If you’d like to learn more, please contact Maya Braine, MD for Middle East and Africa, or email us at: contact@fintrail.co.uk.

Case Study: Digitisation Support

Designing Financial Crime Compliance Programme for Africa-Focused Digital Product

A case study of how FINTRAIL helped an international banking group launch a new digital product, by designing an innovative, tech-focused financial crime compliance programme.

See how FINTRAIL designed bespoke policies and procedures, processes for customer onboarding and ongoing monitoring, to ensure full regulatory compliance, effective risk mitigation, and great customer experience.

If you are interested in speaking to the FINTRAIL team about this or any other financial crime topic please get in touch with the team at: contact@fintrail.co.uk