Investor Due Diligence: A Two Way Street

Zopa: Scandal in the Boardroom

Last week, UK peer-to-peer lending firm Zopa found itself in the news when board member Kapil Wadhawan was forced to resign following his arrest in India over money laundering allegations.  Wadhawan, the chairman of Wadhawan Global Capital and the owner of a large property finance group in India, co-led a £32m investment in Zopa which secured him a seat on the company’s board.  He was arrested by the Enforcement Directorate, an Indian government agency responsible for policing financial crime, in late January in connection with a money laundering probe.

This incident highlights the importance of knowing who you’re doing business with - not only employees, partners, and vendors but also investors.  In the thrill of securing financing, it can be tempting not to scrutinise your potential backers too closely, but as the Zopa case shows this is a potentially risky area.  This is the start of a long term partnership, so both sides need confidence in who they’re dealing with. “Investor due diligence” should cut both ways, and target companies should be prepared to conduct “know your investor” research.  Investors with poor reputations can have a knock-on effect on portfolio companies’ credibility, and their ability to raise future funds. And in a worse case scenario, these companies could even find their investors or directors involved in criminal proceedings, as in the Zopa case, or discover that the investment consisted of illicit funds.  

Doing your Homework: Reputational and Integrity Due Diligence 

Reputational and integrity due diligence should form part of the wider due diligence process alongside financial, commercial and legal diligence, and is vital for understanding financial crime risks.  It can be relatively straightforward to ascertain the track record and reputation of well-established investors, but for more niche investors, those based overseas, or new figures in the market, this may not be so straightforward.   

The obvious questions for an investee to ask are whether the investors are well-established figures with a good track record and a logical interest in investing in the company in question.  How long has their firm been incorporated, has it made successful investments in the past, and does it have discernible experience in the sector? Does it seem to be in good financial standing?  Are there any indications the investors have been involved in any previous scandals or legal or regulatory issues? It’s also important to understand their modus operandi and if they have ever been involved in dubious or aggressive business practices, or disputes with partners, competitors or other investees.  This may involve determining if they are the subject of any inquiries by regulators or law enforcement agencies which haven’t yet reached the stage of formal proceedings.

In addition to the above, there are further issues to consider for investors from overseas jurisdictions with lower standards of transparency and higher levels of financial crime.  What is the source of funds - how did the investor initially make their money? In some countries, analysing this information may require understanding of the country and its history - for example, anyone who established their fortune in Russia and the former USSR in the privatisation programmes of the 1990s.  In many countries, it will be important to understand political patronage - whether your investors have political influence or connections, whether this could have helped them make money illegally or unethically or to avoid legal actions, and whether their position may be threatened by changes to the current political regime.  

Sources of Information 

In practical terms, where can investees find the answers to these questions?  They will likely start gathering information in-house through basic steps like online research - sources like the investor’s own website, news reports, and Google searches.  Speaking to others in the marketplace will help provide a sense of the investor’s track record and general reputation. To ensure consistency and transparency, investees can implement an ‘investor due diligence’ process (a project which FINTRAIL is ideally placed to facilitate), which in many ways mirrors a customer onboarding process.  It will allow the investee to make sound, defendable decisions by establishing a methodology to collect consistent information from defined sources, analyse it in line with clear criteria and parameters, and establish transparent escalation and decision-making processes.

In some cases, it will be advisable to seek expert help in conducting this due diligence research, especially if early red flags are identified or if there are discernible high-risk factors such as the investor’s main country of operations.  Expert due diligence research will look at the online sources mentioned above plus specialist media databases, local and overseas litigation and corporate records, regulatory watch lists, foreign language media reports, and cached online materials.  If required, researchers can also conduct enquiries with human sources operating in the relevant sector and country, to help explain the investor’s history, modus operandi, other business interests, perceived probity and general reputation. This is particularly useful in countries with undeveloped media landscapes, poor press freedom, or limited public records.  Appropriate sources may include founders or employees of existing portfolio companies, other investors or business figures operating in the sector, journalists, and former partners or employees. Conducting successful enquiries requires an excellent network of contacts, as well as understanding the specificities of the investor’s operations, in terms of the sector, type of business, and jurisdiction.  

FINTRAIL’s Experience

The FINTRAIL team has extensive experience in both designing due diligence processes and conducting reputational and integrity due diligence.  We have lately finished building and implementing an investor due diligence process for a UK-based FinTech. We have also recently worked with a client to conduct research on a potential investor, in a case which showed clearly how important it is for growing FinTechs to identify the right partners.  FINTRAIL investigated a venture capitalist from Russia looking to invest in a UK-based FinTech, using our expert country knowledge and language skills; searches in Russian, US and EU litigation and bankruptcy records, criminal records and regulatory agency checks; and adverse media research in English and Russian.  This uncovered concerns about the investor’s source of wealth and modus operandi including political connections to the Kremlin, business interests in opaque jurisdictions held through apparent shell companies, and UK corporate interests which bore similarities to those of the Hajiyev family, the subject of the UK’s first Unexplained Wealth Order (UWO).  These concerns ultimately led to the FinTech deciding not to accept the investment - a potential disappointment in the short term, but an important decision to head off major issues in the future. 

Get in Touch
If you are interested in speaking to the FINTRAIL team about due diligence or any other anti-financial crime topics in an increasingly digital FinTech world, please feel free to get in touch with one of our team or at contact@fintrail.co.uk

FINTRAIL's Fave Podcasts

Like everyone, the team at FINTRAIL are living for podcasts at the moment. Whether we are on our daily commute or grabbing a coffee we are tuning into our favourite shows. For those of you that are keen to explore some new FinTech/ FinCrime related podcasts - here are some of our recommendations:

---

FinTech Insider / Blockchain Insider

“I love the variety and quality of speakers and the relaxed, but informed style of both these podcasts which cover the most recent developments in the FinTech and Blockchain world. Living in Singapore, these shows provide me with the regular global update and industry expertise I need.”

---

Bribe, Swindle or Steal

This podcast by the anti-bribery business organisation TRACE International looks at examples of financial crime cases and typologies, and at what can be done to tackle them through interviews with experts in the field.  The topics covered are really varied - regulatory developments and best practice, diverse crime types such as doping in sport or wildlife poaching, and major international scandals such as the Luanda Leaks and the Volkswagen emissions scandal. Having this broad scope and including interviews with such diverse practitioners throws up interesting perspectives and shows how many forms financial crime can take.

---

Caliphate and Conflicted

I’m pursuing an extremism and terrorism financing theme at the moment.  Caliphate is a series following Rukmini Callimachi of the New York Times as she reports on the Islamic State and the fall of Mosul. You are hooked from the very beginning and the insights provided on the inner workings of ISIS are fascinating. And for even more incredible insider information, I recommend Conflicted by Aimen Dean, a former jihadist turned British double agent inside Al Qaeda. This podcast combines incredible first-hand insights with expert analysis, and breaks down the complexities of history, religion and politics of the Middle East and puts them in a global context.

---

The Missing Cryptoqueen by Jamie Bartlett

The pyra-ponzi scheme that shook the world. The ‘Bitcoin killer’ that through an elaborate social engineering scam destroyed thousands of families and swindled billions of dollars. We were extremely privileged to have Jamie Bartlett share his OneCoin investigation at FFECON19. And through the FFE community, it has been awesome to open doors for Jamie to take his investigation to the next level. Breaking News: there will be a Missing Crypto Queen TV series.  Can’t wait for Jamie to share his progress at FFECON20!

---

Financial crime matters with Kieran Beer from ACAMS

This is my go to for all the latest insights on trending Financial Crime topics.

---

Get in touch to let us know what your favourite podcasts are- we are always keen to add to our ever-growing list. Happy listening.

FINTRAIL on RUSI's: The Suspicious Transaction Report - Ep.10 Leaks, Links and Brexit

In this episode, host Isabella Chase is joined by guests to discuss the most recent money laundering leaks, UK-linked financial crime cases, and the impact that Brexit will have on the financial crime landscape. To discuss the latest news and headlines, Isabella is joined by our very own Gemma Rogers and Nick Parfitt from Acuris Risk Intelligence. In the deep dive, Isabella discusses the UK’s Economic Crime Plan with CFCS Associate Fellow, Helena Wood.

You can access the full podcast here: The Suspicious Transaction Report and also catch up on previous episodes.

If you would like to discuss the topics in the podcast, or if you want to know more about FINTRAIL, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

FINTRAIL's Focus for 2020

At FINTRAIL, like many of the clients we work with, we like to be as transparent as possible about our plans, successes and failures.  So with that in mind, Gemma and I wanted to write a quick summary of 2019 and give you a view on what we are planning for 2020.

Thanks to our amazing team, partners and clients we had a pretty awesome 2019! We worked with over 30+ different FinTech and financial institution clients across Europe, Asia, North America and Latin America. 

Amongst other things, the FINTRAIL team have helped our clients build compliant FinTech products, transform legacy financial crime infrastructure, conducted audits and worked with leading technology, people and process to change how modern financial service providers can address the threat of financial crime.

Additionally, we have continued to invest in and grow the global FinTech FinCrime Exchange (FFE), we now have over 170+ FinTech firms big and small that have joined the fight against financial crime across the US, Europe and Asia.

As we continue to grow as a firm, we are of course going to see some challenges.  Firstly, setting a cohesive international strategy is hard, especially as a small and very busy team. Bringing the US and Asia markets online brought significant challenges, some of which we had just not thought about. With so many ideas on what we could and can do, it can be difficult to curb our enthusiasm sometimes. I think it would be fair to say that 2019 was a year of learning on this topic but we have taken that onboard and are now accelerating in to 2020.

We built out our team significantly - clearly this is a brilliant problem to have - but we did have to think more carefully about the culture and structure of our team. Just throwing bodies at an opportunity is not the right answer but we really think we have made great progress in refining what the FINTRAIL organisation and culture looks like and this will continue to be a constant priority for us moving forward.

Finally, I think it would be fair to say that as co-founders, we learnt a lot about ourselves in 2019. We have put a lot of effort into FINTRAIL and it is sometimes hard to step back and empower your team to take that forward. We are super fortunate that we now have a team that believes in our mission and have the enthusiasm and capabilities to take that forward. As a team and individuals we are not going to get everything right the first time but we are committed to learning at every opportunity and we aim to make FINTRAIL one of the best places to work, doing super important work for the best clients in the world. 

However, this is all history and we cannot take our eye off the ball. So 2020 is going to be an even bigger year for FINTRAIL our clients and community we support and and this is how we are going to do it:

Continue to invest in our consulting teams to bring our clients the best and most relevant expertise and support. In 2019 we grew our global team and launched our businesses in the US and Asia; we have seen a rapid growth in demand for what we do. Without the right people, culture and infrastructure we simply cannot do what we do.

In Asia, led by our local Managing Director Payal Patel, we are already working with some of the largest regional players to ensure they build robust anti-financial crime provisions into their products and business plans. Payal will be building out our regional offering and scale her team across the region over the course of 2020.

In the US, led by our local lead Megan Millard, we have been working with established global players to transform their vision of compliance and anti-financial crime as well as working with new and highly innovative businesses to ensure they start their journey in a secure and compliant fashion. There will be a big focus on the US market in 2020 as we continue to grow the business there.

In Europe, led by our local Managing Director James Nurse, we have been supporting clients big and small through their compliance and anti-financial crime journey. This shows no sign of slowing down and we will be bringing our specialist skills to new markets in the region and continuing to grow the team out to cover the different European jurisdictions.

Data, Data, Data - there is no question that the fight against globally connected financial crime requires us to take a connected, community and data driven approach to have any meaningful impact. Over the last 3.5 years through the FFE we have seen the power of connecting people and sharing insight.

We have been exploring what FINTRAIL and our FFE community can bring to this challenge and we think we have a way forward.

We have now agreed a partnership with one of the leading global RegTech providers to start connecting our global community in that fight through the development of real-time threat data sharing. Gasps I hear, what about data privacy? Well this is not going to be some half-baked attempt to deliver data sharing. FINTRAIL and our partner are doing this properly - we have an existing community of motivated and technically savvy FFE members who are proactively asking for this, we can leverage our connections with global regulators, law enforcement and wider privacy community to get this right. Combine that with leading technology and world-class technical expertise and we have a solid combination.

Are we going to solve it overnight, absolutely not but It is going to be a key priority for us and the FFE community over 2020 and coming years. More specific details will follow on this topic in the coming weeks.

Continue to grow the community. The FFE is unique. It is the only global FinTech community dedicated to the fight against financial crime - and it is free. It is something that all of us at FINTRAIL are extremely proud of and we would not be able to make happen without the support of our partners at Regulatory Data Corps (RDC). We have big big plans for the FFE for 2020:

Meet-ups - in 2020 we will be hosting somewhere in the region of 20 meet-ups across the three regions and our aim is to make these even more relevant to the community. We will continue to strive to bring the global FinTech community together in a common cause and have a meaningful impact on the scourge of financial crime.

Podcast - yes, that’s right 2020 is the year we are launching our FFE podcast series and it looks like it will be a cracker. We are going to use this opportunity to dive into the topics that matter to members and learn more about the people and issues that impact our lives every day. The 12 part podcast series will feature all three FFE regions and we can't wait to see this mature for the FFE community and other interested parties that want to learn a bit more about it.

Expert Working Groups - we want the FFE to have a voice that has tangible impact. In 2020 we will be hosting a series of Expert Working Groups that will bring together Compliance and Anti-Financial Crime leaders from across the FinTech and financial services industry to dive deep into the key topics affecting the industry and come up with a common way forward. We will then use that platform to bring about change through our engagements with partners, regulators, law enforcement and customer communities. 

Engagement with global law enforcement - in 2019 our team spent a significant amount of time engaging with law enforcement and regulatory enforcement bodies from around the world. This was about spreading the word about the FFE and educating on FinTech, but also the opportunities to collaborate effectively. We have built amazing relationships with partners such as the Metropolitan Police, City of London Police, HMRC, National Crime Agency, Europol, Department of Homeland Security, Federal Bureau of Investigation and many many others around the globe. This will continue into 2020 with even more vigour. The private sector has a critical role to play in supporting law enforcement efforts against criminality in all its forms and the FFE community is at the front of that effort.

FFECON - we had a ball at FFECON19 and based on the feedback we had after the event from all involved it is something that will be back for November 2020 (block your diaries). Our goal for 2020 is not necessarily to make this bigger for the sake of it, but rather focus on the quality of this event for our community and that is what we will achieve. In addition, we will be taking FFECON on the road for 2020, in either Asia or US market (TBC, so stay tuned) with the aim to make this forum accessible to the growing community and interested parties globally.

So there you have it, a transparent roadmap of what to expect from FINTRAIL and the FFE in 2020. It is going to be a blast but seriously hard work and I know the team at FINTRAIL are super focused on making this another year to remember. We can’t wait and on behalf of the team at FINTRAIL we wish everyone all the best for 2020!

If you would like to discuss the topics in this post, or if you want to know more about FINTRAIL and our 2020 plans, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

Changes to the UK’s Money Laundering and Terrorist Financing Regime

Today, the UK is introducing changes to its anti-money laundering regime to implement the provisions of the EU’s Fifth Money Laundering Directive (“5MLD”).  The changes, introduced pursuant to the Money Laundering and Terrorist Financing (Amendment) Regulations 2019, are much less extensive than those introduced by the EU’s 4MLD.  They bring new business types within the scope of the regulations, and clarify obligations for existing regulated entities. The key changes are as follows:

New categories of regulated persons

The scope of “relevant persons” covered by the regulations has been expanded to cover crypto asset exchange providers, custodian wallet providers, art market participants where the value of the transaction exceeds €10,000 including traders, intermediaries and freeports storing works of art, and letting agents where the monthly rent exceeds €10,000.

Enhanced due diligence 

Relevant persons must perform enhanced due diligence (EDD) for business relationships with clients established in high-risk third countries or in relation to transactions where either party is established in a high-risk third country.  This means relevant persons must consider not only the location of their clients, but also those of their clients’ counterparties. The regulations also specify the EDD measures to be taken in such situations, derived from a new provision in 5MLD designed to ensure consistency across the EU, as interpretations of EDD previously provided on a national level was varied.  These measures include:

• Obtaining additional information on:

• The customer and the customer’s beneficial owner

• The intended nature of the business relationship

• The source of funds and source of wealth of the customer and beneficial owner

• The reasons for the transactions

• Obtaining senior management approval of the business relationship

• Conducting enhanced transaction monitoring through additional and more frequent controls

Ownership

The regulations explicitly require relevant persons to “take reasonable measures to understand the ownership and control structures” of their customers.  Electronic identification processes are permitted, under certain conditions.  

Relevant persons must confirm the beneficial ownership of relevant legal entities before commencing a business relationship, and must report any discrepancies between the information provided to them as part of the due diligence process and that in the register of Persons of Significant Control to their local company registry.  In the UK, Companies House issued its own ancillary guidance for obliged entities on 10 January.

Risk assessment

Relevant persons must take appropriate measures to assess and mitigate money laundering and terrorist financing risks before adopting any new products and business practices (including delivery mechanisms), as well as new technologies.  

Group policies

The new regulations explicitly state that parent entities must have group-wide policies to share information on customers, customer accounts and transactions, for the purposes of tackling money laundering/terrorist financing.

Prepaid cards

Recognising the potential use of pre-paid cards for financial crime, the new regulations reduce the limit at which customer due diligence must be conducted on holders of pre-paid cards from €250 to €150.

Conclusion

These legislative amendments oblige existing regulated entities to consider whether their programmes are still in line with the regulatory requirements, given the expanded obligations and clarifying details in the new legislation.  

However, the major impact of the legislation will be for companies which now classify as relevant persons for the first time, such as cryptocurrency firms, which must now take a more stringent approach to their financial crime risk management.  For FinTech firms, the most relevant changes may be the EDD requirements involving high-risk transactions and the need for group policies as they expand beyond their home markets. FINTRAIL has significant experience in designing and developing compliance programmes for a wide variety of companies, including market entrants or newly regulated firms, and can assist with defining risk appetite, building risk assessments, and developing proportionate and effective due diligence processes.

If you would like to discuss the issues in this post, or wider anti-financial crime topics, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

FINTRAIL 2019 - A year in data

FINTRAIL

FFE

FFECON

The Social Causes and Impact of Financial Crime - A Curve Talk

At this Curve Talks event hosted on 10 Sep 19, Gemma Rogers, co-founder of FINTRAIL, shared her knowledge about the socio-economic effects of financial crime. She tackled the individual-level impacts of crimes such as human trafficking and explore “why” this sits behind current anti-money laundering legislation.

Gemma has a passion for changing the terms of debate around financial crime risk management, debunking the lethargic tick-box concepts of old and focusing on intelligent, inclusive and business-focused solutions.

For more Curve Talks see https://www.eventbrite.co.uk/o/curve-19344651260

Slideshow

The Dangers around Data Quality: How Poor Data Quality Can Harm Your Ability to Fight Financial Crime

FinTechs and RegTechs are at the forefront of using data innovatively and efficiently to help facilitate everyday financial services. When managed correctly, this data can also help strengthen AML/CTF defences and help you pick out unusual or suspicious behaviour and customers. However, that doesn’t mean that FinTechs and RegTechs are immune to missteps when gathering, transporting and utilising data. When data quality goes wrong, the dangers can have a hugely damaging impact on the strength of anti-financial crime controls. Here are a few areas to take into consideration when evaluating how your data quality impacts your AML/CTF operation. 

What are the risks?

FinTechs tend to collect non-standard data on their customers. This not only covers the use of electronic ID verification, selfie matching and address verification technology, but also the collection of non-standard data points, such as IP address, geolocation and device ID. While this provides FinTechs with a number of benefits, including a more dynamic risk profile along with a more seamless user experience for customers, there can be major risks to meaningful financial crime prevention if the data collected isn’t robust. 

A FinTech could run into trouble if:

• Non-standard data becomes limited data

  • This is when collecting less information from your customer and more information about your customer crosses the line into not enough information on your customer at all. Not only is there a regulatory implication of this, but it could also hinder your ability to implement a number of key financial crime controls - from transaction monitoring based on customer behaviour to customer screening against PEPs, sanctions and adverse media databases. 

• The onboarding experience is over-prioritised 

  • One of the key benefits FinTechs offer is a more streamlined customer experience, so that customers can start using a product within a few minutes of signing up on the app or website. However, if too much priority is placed on having a seamless onboarding journey, it could lead to not enough information being collected on a customer to form a useful profile on their risk level and expected behaviour. FinTechs can consider limiting access to their product based on information collected or adding a few extra steps for customers deemed high risk in order to help combat this concern.

• Data isn’t refreshed 

  • Obligations to know your customer don’t stop with onboarding; it’s imperative to keep customer data accurate and up-to-date. Without refreshing customer data, it may be more difficult to truly understand whether a customer’s behaviour is unusual or suspicious, and it may likewise become difficult to fully understand the risk they pose. 

• Data is entered manually 

  • While most data a FinTech collects will be gathered automatically, some data requested from customers through in-app chats or help desks may require manual entry. Entering data manually, without robust four-eyes checks or routine assurance, can leave a FinTech open to problems from inaccurate data that can make it difficult to truly know who your customer is and their risk profile.

FinTechs can also run into trouble with gathering, analysing and responding to management information (MI). Especially when starting up and building out a compliance framework, MI collection, storage and analysis may not be their top priority. In the worst cases, important macro-level data on SAR volumes, customer breakdowns and risk types and TM alerts could go undervalued. Without regular MI collection, easy access to data and trend analysis, quality assurance on AML/CTF controls becomes more difficult. This has knock-on effects, making it harder to update your risk assessment and risk appetite and accurately reflect your product to the board and regulators. Poor MI can even prevent you from being able to advocate for the resources you need on a financial crime team.

What about RegTechs?

Given the digital and innovative nature of their products, FinTechs tend to rely heavily on RegTechs, especially at the point of onboarding. This means that it is incredibly important for FinTechs to understand how and what data RegTechs access, use and provide and consider how this can best support their AML/CTF operations. When considering the use of RegTechs there are some key risks that FinTechs should be aware of: 

• ID&V Providers

  • RegTechs have spearheaded major innovations in digitising the ID verification process, making it easier to reliably onboard customers in minutes and spot fraud indicators that the human eye struggles to detect. The main data quality risk we’ve seen with ID&V providers is potential inaccurate transposition. In this case, data that is automatically pulled from ID and proof of address documents into customer forms and profiles doesn’t match the actual data on the ID. When data pulled from an ID is incorrect, it can lead to poor records being kept on a customer that make future customer screening and  investigation of suspicious activity more cumbersome, weakening the wider AML/CTF controls infrastructure at the FinTech.

• Customer Screening Tools

  • The use of RegTechs for customer screening generally gives FinTech customers access to vast amounts of information that can be customised to the FinTech’s specific product offering and customer base. However, with the amount of quality data provided, there can still sometimes be gaps that need filling. Particularly with PEPs and their relatives and close associates (RCAs), we have seen databases missing key information, including dates of birth, photos, activity, nationality, citizenship and address. We have also seen the inclusion of deceased PEPs and RCAs and some PEPs and RCAs who haven’t been active for decades. When this information is screened against, it can be more difficult for an analyst to clear alerts and can generate large volumes of false positives that require clearance. 

Once again, MI is worth considering. When RegTech providers offer poor analytics on the services they are providing, that can be easily categorised and sorted, then their FinTech customers will have to rely on manual processes in order to gather and assess crucial information that informs risk and control frameworks. MI needs to be able to provide detail where required and show changes over time. Access is also critical; in our experience, certain RegTech providers’ systems are difficult to access, with support teams that take time to respond to requests for additional information. The best approach we see is when RegTechs and FinTechs work together dynamically in order to ensure information can be swiftly accessed.

Top Takeaways 

While many of the FinTechs and RegTechs we engage with are taking the needed steps to ensure the comprehensiveness and effective usage of their data, there are still some pitfalls that indicate the negative impact when things go wrong. There needs to be more awareness of how poor data quality can emerge and how it can affect our anti-financial crime operations. Ongoing quality assurance, testing and audit are essential to ensuring that we remain out in front of any potential data quality errors. 

So what should we do?

FinTechs:

• Take a risk-based approach to KYC and the gathering of customer data, gathering more data on higher risk customers to ensure you’re able to understand their behaviour and your ongoing risk exposure. 

• Perform regular KYC refreshes and take a risk-based approach to these as well, to ensure you have the highest quality, most accurate data on your customers.

• Implement robust assurance on manual processes, perform rigorous testing on RegTech providers, and ensure financial crime compliance has input into data storage practices.

• Collect MI on all key aspects of your anti-financial crime programme, including on customer risk, customer due diligence and screening, transactions, suspicious activities and exits for financial crime. This information should be regularly shared and easily accessible for the second and third lines of defence.

RegTechs:

• Consider a data quality review by a third party to get ahead of any potential complaints that clients may identify when it comes to the data you provide and transpose. 

• Internally review the transposition of data pulled from documents and other sources to ensure it is being accurately reflected. Consider implementing a human review element depending on the data quality risks.

• Devote research analysts to building out PEP profiles to encourage more efficient alert clearance, and build in filtering options so that firms can filter out deceased or inactive PEPs, RCAs and sanctions targets. 

• Build robust analytics and reporting functions with access that can easily be determined by clients to meet their specific needs. 

• Ensure requests from clients for additional information are responded to promptly and properly, and that this practice is expressed within agreed SLAs. 

If you or anyone on your team would like to discuss or explore how data quality concerns may affect your company and what steps you need to take to improve your approach, please feel free to get in touch contact@fintrail.co.uk.

Reflections on the Internet Organised Crime Threat Assessment 2019 (IOCTA) from EUROPOL

EUROPOL published the Internet Organised Crime Threat Assessment 2019 (IOCTA) earlier this month which highlights the key developments, threats and trends in cybercrime. A number of priorities were listed including cyber-dependent crimes, child sexual exploitation online, payment fraud, abuse of the dark web, terrorism and crossing-cutting factors such as social engineering, money mules and cryptocurrencies. Although they are all very interesting in their own right, today we are going to dive into the areas which we think are most relevant to FINTRAIL clients and share some tips on how to protect against these key risks. 

Supply Chain Attacks 

A growing concern that was raised from the private sector, was attacks directed at them through the supply chain, i.e. the use of compromised third-parties as a means to infiltrate their network. With companies becoming increasingly reliant on third parties that use the cloud, the risk that the whole supply chain can be infiltrated by hackers or ransomware attacks increases and even compromises further down the supply chain can have an impact on your company. The issue can also be seen through companies with lower cybersecurity maturity, such as the case in the Marriot International breach where they acquired a smaller company, and this was where the hackers managed to get into the system and steal the records of 339 million guests. 

With the increase in external e-KYC platforms, screening tools and monitoring systems for some companies, customer data is likely to be shared and stored across multiple providers which could see them being more vulnerable to these sorts of attacks. This is not saying that if you do everything in-house that you are not exposed, as your internal cybersecurity needs to be up to scratch to try and ward off these attacks. 

So what can you do? 

There is unfortunately no full-proof plan to mitigate this risk completely, however, there are steps that can be taken to help:

• When you are choosing vendors or third parties to work with, question and assess their cybersecurity policies and protocols to ensure they are sufficiently protected, as you cannot outsource the risk

• Conduct a regular review of the vendor/third party and agree an escalation and SLA process for any issues 

• Review the guidance provided by the FCA on outsourcing to third-party IT providers, titled ‘FG 16/5 Guidance for firms outsourcing to the ‘cloud’ and other third-party IT services’ 

• Review your own systems to ensure they are protected against cyber attacks

• Visit the National Cyber Security Centre website for guidance and advice on how to protect your business

• If you have acquired another company, bring their cybersecurity protocols in line with your own so there are no weak links within the group as soon as possible

Business email compromise (BEC)

More commonly known as CEO fraud, BEC is a scam in which victims, usually accounting, HR or payments staff are tricked into authorising a payment or release of information which they believe was from the instruction of a member of the C-suite or a senior colleague. We do not want to limit the definition to instructions only coming from the C-suite as it could come from anywhere in the organisation, however, it may be more plausible and in turn successful when coming from senior management.

Scammers are able to pose as members of staff as they obtain the means to do it via a number of ways including:

• Phishing emails - these are sent to large numbers of users in an attempt to “fish” sensitive information to either take control over their email address or obtain information to enable them to pose as the employee ;

• Spear phishing - these are more targeted phishing emails where the cybercriminal has studied the organisation to know who to target 

• Social engineering - manipulating someone to trick them into divulging confidential information or access to funds and this can be done, for example via social media sites, this can be combined with spear phishing to make it far more effective

• Gaining access via hacking a member of staffs email or creating a slightly different email domain to trick the employee into thinking it is an internal email

Once they have been able to gain the appropriate access to the system or information to impersonate a senior manager, the victim is then contacted and asked to authorise a payment outside of the usual process and as it has been seen, they agree due to the pressures of seemingly the CEO or their manager asking them to facilitate an “urgent” payment.

The IOCTA noted that the attacks are becoming more professional and convincing, therefore what can you do to protect yourselves from these attacks? 

• Provide staff with training on identifying and having a reporting procedure for phishing emails and send periodic test emails to assess the effectiveness of the training and identify if more is required

• Educate the staff so they are aware of the threat of social engineering techniques and to not reveal any sensitive or personal information 

• Ensure there is a formal policy and procedure for requesting and authorising internal payments so if a fraudster tries to get the employee to bypass the procedure that it is not done. If an exception process is needed, it requires additional verification via a different method to the original instruction, e.g. if the request came from email, then a phone call should be made to the individual to authorise it, or by another member of senior management

• Implement a strong cybersecurity programme to block the fraudsters from gaining access to the internal systems 

• Visit the National Cyber Security Centre website for guidance and advice at this website.

Deepfake technology 

Deepfake technology is an AI based technique that places images or videos over another image or video, which usually involves using individuals faces or bodies. In the IOCTA report, deepfake was mentioned in the context of it currently being used to place the faces of celebrities on existing pornographic videos. The impact of this could be the criminal potentially selling these online or to tabloids as if they are real videos or blackmailing the celebrity to pay up so it does not get released.

FinTechs need to consider  - with the development of this new technology  - when using selfies or videos in the onboarding process, that you are sure that the picture or video of your customer is actually real. Although, FinTechs might have ID image validation or video liveliness technology incorporated into your onboarding process, how confident can firms be that this technology picks up on deepfake techniques? 

So what can you do to protect yourself from this emerging technology?

• Being aware that the technology exists is a good start, as even if an image or video passes the verification checks, it does not mean it is legitimate 

• If you use external providers for ID/video verification, ask the question of what they are doing in relation to this developing threat and how they see it impacting their product

• If you use internal software, testing your own system is be necessary to see if deepfake images pass the verification process 

As we continue into an era with developing technological capabilities and with the rising use of social media, internet crime is an area that is likely to develop hugely with new techniques being used by criminals to exploit individuals or target companies for financial gain. With the ever-changing nature of how criminals are exploiting their victims, information sharing between organisations becomes more important so the methods and typologies can be shared to prevent other organisations from suffering the same fate.

If you would like to discuss the issues in this post, or wider anti-financial crime topics, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

FinTech and the New Frontier in the Fight Against Modern Slavery

On 31st January 1865 the US House of Representatives passed the 13th Amendment to the Constitution of the United States of America. Spearheaded by President Abraham Lincoln, it put an end to the most heinous blemish on the face of human history, and followed in the footsteps of such legislation as the 1833 British Slavery Abolition Act and the 1848 French second abolition act, abolishing slavery and involuntary servitude. Abolition in the USA represented the culmination of the career of one of the world’s most tenacious and revered leaders, and marked the final end to a bloody internecine conflict between North and South in the form of the US Civil War. To know that a modern reprise of slavery and human trafficking continues to blight vulnerable populations across the globe to this day, despite the practice being illegal in every country in the world, would likely have Honest Abe turning in his grave. To know that Southeast Asia and APAC more broadly represent a hotbed of such activities, a predicate money laundering offence, should leave readers in the region feeling somewhat discomfited. 

Source: ILO & Walk Free Foundation, 2017 and ILO, 2012.

The Liechtenstein Initiative for a Financial Sector Commission on Modern Slavery and Human Trafficking defines modern slavery as a “non-legal umbrella term, encompassing several forms of severe exploitation, including forced labour, forced marriage, servitude, debt bondage and human trafficking”. Human trafficking itself can be further defined as the recruitment, transfer, or obtaining of an individual through coercion, abduction, fraud, or force in order to exploit them. Exploitation can come in the form of anything from low-paid migrant workers to commercial sex work. The exploiter can be anyone, including strangers, neighbours, or even family members. In depth joint research by the International Labour Organisation and Walk Free foundation into global estimates of modern slavery indicate that over 40.3 million men, women, children experienced one or more forms of modern slavery exploitation in 2016; equivalent to one in every 185 people globally. Modern slavery is estimated to generate over $150 billion in profits every year and is on the rise. Between 2012 and 2016, global modern slavery increased by over 40%. This increase could possibly be attributed to increased awareness and as such increased reporting of the issue.  Asia accounted for $50 billion of this total, due in part to its high number of victims and high profits per victim.

Source: ILO & Walk Free Foundation, 2017 and ILO, 2012.

More than a third of the proceeds of modern slavery are generated in developed countries. The developed vs. undeveloped country split emanates as a result of the fact that slavery risks are broadly higher in poor and developing countries than in wealthier, developed countries. They are higher for marginalised and excluded groups, including women, girls, low-caste individuals, refugees, those displaced by disaster and conflict, and migrant workers. Risks are higher for low-skilled workers than skilled workers, for those with lower education levels, and the vulnerable unbanked; all prevalent factors in Asia.

Source: https://www.globalslaveryindex.org/2018/findings/regional-analysis/asia-and-the-pacific/

**Substantial gaps in data

Statistics compiled by Global Slavery Index (GSI) in 2016 estimate that modern slavery in Asia accounts for around 62% of the global total. The APAC region has the second highest prevalence of modern slavery in the world, with 6.1 per instances per 1000 people. GSI found that APAC had a high prevalence of forced labour (4.0 per 1000 people) and forced marriage (2.0 per 1000 people) compared with other regions. APAC also had the highest number of victims across all forms of modern slavery, accounting for 73% of victims of forced sexual exploitation, 68% of those forced to work by state authorities, 64% of those in forced labour exploitation, and 42% of all those in forced marriages. As highlighted in the above table, Southeast Asian countries feature high up on GSI’s rankings, with Cambodia in fourth place. Cambodia’s construction boom, fuelled largely by Western property firms funded by global banks, has seen a concurrent rise in the rates of debt-bonded labour in the country’s brick making industry. Myanmar sits at seventh in the rankings, Brunei Darussalam at eighth, and Laos, Thailand, and the Philippines in tenth, eleventh, and twelfth place respectively. Many will be surprised to see our own little red dot Singapore place 20th on GSI’s list.

Slavery is illegal in every country in the world, and by 2018 more than 170 countries had made firm public commitments to eradicating it, however only 122 had criminalised human trafficking in line with the UN Trafficking Protocol, and only 38 countries had criminalised forced marriage, according to GSI figures. In Singapore, the main legislation targeting modern day slavery is the Prevention of Human Trafficking Act 2014 (PHTA), which criminalises forced labour, and sex labour trafficking. In addition, it should be noted that human trafficking is a predicate crime of money laundering (a predicate offence is a crime that is a component of a more serious crime). Unlike other landmark global anti-slavery legislation such as the UK Modern Slavery Act 2015, and the Australian Modern Slavery Act (effective from 1st January 2019) however, Singapore’s PHTA does not contain a reporting requirement for corporates. Governmental and legislative pressure to report could be usefully applied in Singapore’s financial industry. The continued proliferation of modern slavery is irrevocably and inextricably correlated to the financial system and the ability to illegally launder proceeds through it. While the Financial Action Task Force (FATF) itself expressed the view that greater exposure to financial systems by both victim and perpetrator increases the opportunities for identifying money laundering as a result of modern slavery, unchecked and unbridled access, while reducing undetectable cash intensive transactions, may also facilitate rampant growth in modern slavery. 

In its first secretariat briefing paper the Liechtenstein Initiative highlights the role that financial innovation played in the abolition of slavery in the UK in the 1800s. Abolition was only possible because of an arrangement in 1834 comprising what was then the largest syndicated loan in history, to the British government, to finance compensation packages; regrettably not to slaves, but rather slave owners. The loan was equivalent to a staggering 40% of Britain’s national public expenditure at the time. The last interest on this loan was only finally repaid in 2015. Although the role of the private sector in combatting modern slavery will take a different, 21st century form, its clear that FinTechs can play a major part. 

We can draw striking parallels with British 19th century financial innovation in the abolition of chattel slavery with the role that financial innovation through FinTech must play in the fight against modern slavery in Asia. Not only because FinTechs such as e-payment firms and virtual banks represent today’s pioneering innovators, but also for reasons of financial inclusion. Major consumers of the FinTech revolution in Southeast Asia will be those populations of unbanked individuals in developing countries such as Cambodia and Laos. It is logical to suggest that those countries where modern slavery is prevalent are also those where financial inclusion rates are low because not having acess to the formal financial system limits formal emplpoyment opportunities. These populations are therefore those most at risk of falling victim to loan sharks and ultimately becoming victims of modern slavery as a result of debt-bonded labour. For the FinTech world to meaningfully lead the fight against modern slavery, firms must be aware of the financial crime risk faced by their enterprises, identify thematic risk typologies specific to the Southeast Asia region, and apply commensurate AML measures to their businesses. 

The onboarding process can play a critical role in flagging this typology. A close inspection of the ‘selfie’ can highlight victims of abuse and those being coerced. Whilst this typology is particularly difficult to monitor as it involves multiple people, varying operating schemes and geographical locations, there are a number of ‘red flags’:

• Victims' accounts - these tend to show lots of transactions from unrelated individuals in, and then the majority of funds moved out to a single point of the contact (essentially, the gang leader)

• Gang leader accounts - these accounts tend to show lots of transactions to travel companies.

• The funds are typically in the form of cash and therefore the methods used to launder the illegal proceeds often include cash deposits e.g. with structuring pattern. 

• Transactions may also appear to be related to loans or family support (usually victims will try to remit any funds to their families), which may be identified as significantly smaller cross-border transfers when compared to other migrant employees. 

• Alternatively, victims may send funds to criminals stating these are family remittances. 

• There might be multiple transactions on a criminal’s account related to accommodation, travels and the basic daily expenses of victims, appearing in transactions as details of unrelated individuals.

FATF have provided detailed guidance concerning financial crime risk typologies applicable to modern slavery. A key risk typology for Southeast Asia’s FinTechs to consider is sector and industry. Verité for example has developed a Forced Labor Commodity Atlas, which highlights commodities that are linked to human trafficking and modern slavery in global supply chains, such as cocoa, palm oil, sugar and cotton. Both palm oil (Indonesia, Malaysia, Thailand) and cotton (APAC is the largest producer of cotton in the world), are industries in relation to which FinTechs should exercise caution when considering modern slavery risk factors in the customer risk assessment. At an individual level, FATF guidance has suggested that no one indicator alone is likely to confirm money laundering from modern slavery and human trafficking. Wider contextual information may be the key to identifying both victims and perpetrators e.g. passport information, utility information (or lack of it), and non-traditional indicators such as financial data, social media activity, biometric information. Innovative means of meeting customer due diligence requirements could provide wider benefits for detection of modern slavery in this regard. 

Analysis at the individual level is important in the Southeast Asian financial crime context. As mentioned above, much of the region’s FinTech growth will come as a result of financial inclusion, bringing the most poor and vulnerable into the financial system. FATF’s Financial Flows from Human Trafficking report notes that the analysis to date has uncovered patterns primarily at the level of interaction between the sector (up until now typically banks) and victims, rather than at higher levels of trafficking organizations. Examples of such interactions might be: handling, and lending migrant workers money to pay improper recruitment fees; lending funds for visa purchases to people that, upon arrival in the new country on those visas, are forced into commercial sexual exploitation; operating credit cards, debit cards, and bank accounts in the name of victims of commercial sexual exploitation that are in fact controlled by recruiters and managers; facilitating transfers from illicit massage businesses to related businesses (restaurants, grocery stores, dry cleaners), which are used to launder the proceeds of crime; and operating the conversion of virtual currencies such as Bitcoin, used in illicit commercial sex businesses, to fiat currency.

The ability of FinTechs to effectively detect and manage modern slavery risks will also require cooperation from the region’s financial regulators who must understand the bigger picture at play. Over-zealous mass AML de-risking (terminating customer accounts) under regulatory pressure may actually increase the overall level of modern slavery in the region. As the Liechtenstein Initiative paper outlines, mass de-risking may push jettisoned business into informal illicit financing arrangements. It may also hinder financial inclusion, especially where financial institutions terminate correspondent banking relationships, which allow local banks to gain access to foreign financial markets and carry out cross-border transactions. Terminating these relationships may have a particularly negative impact on migrant worker remittances, pushing them out of the formal sector into the informal, cash intensive channels, where workers may be exposed to greater risks of exploitation.

Modern slavery not only exists but is on the rise. Asia remains a hotbed of modern slavery, particularly in Southeast Asia where higher risk commodities, an established commercial sex industry, a construction and development boom, and reliance on cheap migrant labour creates a macroenvironment conducive to nefarious actors. Despite slavery being illegal in every country in the world, human trafficking remains largely un-criminalised, and international legislation is either too recent to ascertain the success of its application (for example Australia’s 2019 Modern Slavery Act), or may be too limited in scope to facilitate meaningful change at a corporate level (e.g. Singapore’s PHTA). The role of the financial sector is therefore paramount – particularly FinTech. Although bringing more of the world’s population into the traditional financial system will as FATF suggests create more opportunity to detect both perpetrators and victims of modern slavery, this holds true only when effective AML measures are applied. Modern slavery will be best detected at the individual level and Southeast Asia’s FinTechs seeking to capitalise on regional financial inclusion of the most vulnerable will lead the charge in this regard. The region’s FinTechs will require cooperation from financial regulators, and the MAS in Singapore for example must give firms adequate breathing room to assess factors such as labour conditions in their corporate customers value chains, and familiarise themselves with Southeast Asia specific individual risk typologies, rather than knee jerk de-risking, which may serve to only exacerbate the problem.

Tackling Vulnerability: How to Increase Financial Inclusion While Also Championing Anti-Financial Crime

The Financial Inclusion/Financial Crime Nexus

Through our work in anti-financial crime (AFC), we’ve witnessed firsthand how FinTechs have been able to utilise new technologies in order to support traditionally underbanked customers - from international students to migrant workers. In this arena, FinTech leadership is absolutely necessary - nearly 2 million people in the UK are still considered financially excluded. And sadly, this isn’t the full picture; the under-banked, who don’t have access to the full range of financial resources and support, are also cause for greater efforts toward inclusivity. In the US, for example, where the unbanked population is around 6%, nearly another 20% is considered “underbanked,” indicating the scale of this problem. 

Reporting from the FCA directly connects the financial exclusion of the unbanked and underbanked to the wider issue of vulnerable customers. Nearly half of people in the UK display one or more characteristics of vulnerability, such as mental or physical health difficulties or financial debt or distress. Vulnerability clearly can harm an individual’s capacity to navigate financial services. Without financial knowledge and support, a backbreaking cycle may develop, where financial anxieties worsen existing vulnerabilities, increasing the likelihood that someone is pushed further and further from the traditional financial ecosystem.

In July, the FCA published guidance for consultation on the treatment of vulnerable customers. This guidance aims to help firms better understand vulnerable customers, ensure their staff have the skills to engage and support vulnerable customers and build their products, services and processes to be more inclusive. We at FINTRAIL are impressed with the steps the FCA is taking to tackle this issue head-on, by providing clearer expectations, recommendations and examples of best practice. 

With that said however, the guidance offers limited discussion around the intersection between vulnerability, financial inclusion and AFC efforts. This comes in spite of strengthening AFC efforts that, while designed to prevent criminals from exploiting and profiting off of victims, may unfortunately disadvantage some vulnerable individuals as well. For instance, customers who have had their identities stolen whose names have been added to fraud databases may struggle to get access to financial products - especially if they don’t know their identities have been stolen. Customers could also fall victims to common financial crime scams, such as romance fraud or authorised push payment fraud, or could be manipulated into becoming money mules - unaware that their actions are actually money laundering. Another example to consider comes from the 5th anti-money laundering directive (5MLD), which will reduce the threshold for applying simplified due diligence on prepaid card customers from €250 to €150 - making it more difficult for many financially excluded individuals to access one of the key financial products they rely on.  As we near the close of the FCA’s consultation period on October 4, here are a few of our impressions of how we can improve financial inclusion while also championing best practice in our AFC controls. 

KYC

For FinTechs onboarding a customer, we often see the use of electronic address verification and selfie + ID matching used to facilitate a smoother onboarding process. While selfie + ID matching can sometimes help firms identify vulnerable customers through visual indicators (e.g. evidence of coercion or injury), both tools can still struggle to identify or verify types of vulnerable people. For instance, someone fleeing domestic violence may not have access to their standard documentation or have proof of address. A recent immigrant to the UK may struggle due to poor language skills to understand the requirements for onboarding and again may not pass an electronic address check, by not being on the electoral roll. Young customers from financially disadvantaged backgrounds may not have a passport or a driving licence. A customer with mental or physical health disabilities may have someone assisting them in onboarding, such as helping them take a selfie, which could look suspicious. 

Aside from requesting additional pictures of ID or proof of address documents, small-to-medium sized FinTechs may not have a specific, codified response for how to deal with a customer who fails their initial attempt at onboarding, which can lead to genuine customers who lack ID for legitimate reasons being de-risked. JMLSG provides some useful information on how best to formulate your approach, to ensure you maintain a risk-based approach while also practicing financial inclusion. For instance, other documentary evidence could be beneficial - such as a social services letter, confirmation of studies letter or evidence of an asylum application. Many FinTechs already use data about their customer as well as data from their customer - and a mix of data on the customer’s online presence, email address and phone number can support decisions not only on a customer’s genuineness but also their vulnerability. Whether due to the additional steps needed to verify identity or due to overlapping factors between vulnerability and financial crime risk (e.g. high levels of debt), it may be useful to apply enhanced transaction monitoring controls to customers, even if you do onboard them. We’ve already seen FinTechs taking steps to this, such as with customers engaging in gambling, so it would be great to see these efforts pursued even further within the sector. 

Transaction Monitoring

FinTechs and other financial institutions typically engage in transaction monitoring tools that are designed to spot unusual customer behaviour. However, what could be unusual for a standard customer may be normal behaviour for a more vulnerable customer with non-standard needs. For example, vulnerable customers may be prone to sudden, impulsive purchases, unusual or large-value payments to legal firms or health suppliers, confusing financial patterns designed to repay debts or atypical rent agreements. Thus, it is important to consider vulnerable customers not only when evaluating alerts but also when designing rules. While no two customers are the same, transaction monitoring tools, especially those relying on machine learning, should be calibrated with an eye to avoiding false positives related to vulnerable customers. This may be difficult to fully achieve given the relatively small customer base of many FinTechs, but at least considering vulnerability indicators when working on rules and calibration is a good place to start. FinTechs may also want to consider allowing their customers to set their own behavioural flags, such as for gambling, binge drinking or shopping sprees. FinTech products like Toucan have been spearheading developments in this area. Within their platform, customers can link their bank accounts and set up personalised vulnerability rules and thresholds that can also trigger a general message to a “trusted ally,” who may be able to contact the vulnerable customer and check in on their overall health. 

One requirement under the FCA’s new guidance is for firms to take a ‘proactive approach to understand the nature and extent of vulnerability’ within existing customer bases. FinTechs could engage in best practice to abide by this expectation by designing rules tailored to specific patterns of behaviour indicating vulnerability, generating a ‘soft stop,’ or a flag that is retroactively reviewed. These flags could be assigned to a person or team responsible for identifying and understanding vulnerability, and the results of the exercise could then be used to help tailor and refine rules that better separate the vulnerable from the suspicious. Vulnerable customers who may have had their accounts taken over or who may be victims of authorised push payment fraud should still face ‘hard stop rules,’ however, to prevent money from being laundered.

Investigations

The FCA guidance provides strong recommendations on ensuring staff are trained in how to deal with potentially vulnerable customers. This is especially a concern when investigating or speaking to a customer who is suspected of financial crime. For a lot of FinTechs, there are two types of outreach to customers that can be used for financial crime-related investigations - automated messaging from robo-advisors and manual messaging from a live human. In the case of automated messaging, the FCA gives examples of how robo-advisors have been set up to help detect potential flags for vulnerability (e.g. detecting speed to type or respond); this can potentially be expanded into the financial crime investigation space to ensure customers demonstrating signs of vulnerability receive more tailored messages and where necessary, are escalated to a human.

For messaging done by a person, it is imperative that front-line customer relations and compliance staff receive training on how to handle vulnerable customers, as the FCA suggests. However, this training must be especially precise in the financial crime space, to prevent tipping off. Another concern that we have noticed is customers who are genuine fraudsters pretending to be vulnerable in order to play on the sympathies of front-line staff and financially benefit, such as through having their account unblocked. If you’re front-line staff, it is best to ensure you have a positive but firm stance when interacting with customers and be wary of how known or suspected criminals may try to influence you. 

Takeaways 

As much as we wish that it was easy to draw clear lines between vulnerable customers and  suspicious customers, the waters are undeniably murky. Only through robust efforts can we truly understand the nature of our customers and build meaningful solutions to support those who are vulnerable while preventing the exact sort of suspicious customer that causes vulnerability. Here are a few steps you can consider taking today to help manage financial inclusion going forward:

1. Consider defining more specific approaches regarding vulnerable or potentially vulnerable customers, particularly in relation to customer due diligence, customer interaction and transaction monitoring. This should be even more robust for FinTechs specifically targeting the financially excluded. A good approach should start with the identification and confirmation of the customer’s vulnerability - ask yourself,  is there a good reason they wouldn’t have the documents required for onboarding or would be transacting this way? 

2. Once vulnerability has been identified, there should be clear escalation channels,  training for front-line staff on engaging with vulnerable customers for KYC, as well as defined expectations around supplementary documents and enhanced monitoring where required.

3. Consider designing transaction monitoring rules with ‘soft stops’ to help identify patterns of behaviour for vulnerable customers, as part of your proactive approach to understanding vulnerability indicators on your platform and as part of your efforts to distinguish vulnerable from suspicious.

4. Tailor automated outreach messaging tools to detect signs of vulnerability and to escalate potential cases of vulnerability to trained human staff. Ensure all robo-advisor communication is friendly, respectful and easy to understand.

5. Ensure front-line staff training not only encompasses how to deal with vulnerable customers, but how to avoid tipping off and how to handle customers that may fake vulnerability to financially gain. 

The FCA consultation ends soon. Click here if you want to provide your opinion directly. Or if you want to discuss these issues more and work to make your AFC controls support financial inclusion, contact the team at: contact@fintrail.co.uk

Risk appetite: how hungry are you?

Anyone who has spent any time with the team at FINTRAIL will attest to the fact that we are passionate about anti-financial crime and how you balance effective controls with a great customer experience. To achieve this, we believe that setting a well considered financial crime risk appetite is critical. It is an often neglected area but something we think is vital for companies looking to scale their offering. In this piece we are going to explore what we mean by a financial crime risk appetite and how to use it.

What is it and why is it important?

A risk appetite sets out how much risk a firm is willing to take in a given area.  Ideally a risk appetite should align with the firm’s risk-based approach, and this is particularly pertinent  regarding financial crime. A risk appetite statement will allow firms to define boundaries at the early stages of a new business or product as it allows you to target your resources in line with your risk-based approach; it will also allow you to identify whether you are in or outside of the firm’s appetite, which is a key foundation to implementing a risk-based approach. If you would like more information on having a risk-based approach and how that is implemented into financial crime frameworks, have a look at our Risk Assessment blog post here.

A well defined risk appetite enables you to scale your financial crime operations effectively and removes some of the challenge that can be associated with subjective decision making. For example, what customer behaviours or industries are outside your business appetite? If this is clear, as you scale rapidly, you can operationalise controls to identify the activity and take prompt action to resolve it when it is outside of your risk appetite. Rather than spending time debating whether each individual customer or transaction it is or isn’t within your appetite, the decision has already been made at a firm/business level and therefore all operations have to do is execute the required action.

Risk Appetite Statement:

Firms take different approaches when writing their risk appetite statement. At FINTRAIL, we have found that a combination of a header statement of intent, aligned to quantified risk indicators from management information (MI) tends to prove most effective. We give a few examples of this below.

A risk appetite statement may look like:

“Bank ABC has a zero tolerance to financial crime and sanction breaches.”  

Although we would all like to see zero occurrences of financial crime, this statement is not realistic and will likely mean that the business is constantly operating outside of its risk appetite. The statement also does not provide any data or metrics useful in gauging success, or details about the financial crime risk that is seen within the business. For a more useful risk appetite statement, businesses could include the number of AML, fraud, tax evasion, corruption cases it will accept, the number of high risk customers/transactions processed or any industries it does not want to work with and any other relevant areas where MI is recorded.  

So for example this statement would be better written as:

'“Bank ABC has zero tolerance for sanction breaches”.

Bank ABC has a low tolerance for financial crime risk. Based on the risk assessment and risk-based approach, the group is operating within the risk appetite below:

Money laundering

Internal suspicious activity reports reviewed within 24 hours

Monthly total of funds subject to an external suspicious activity report not to exceed 3% of the total volume

Tax Evasion

Transactions to or from high risk tax jurisdictions not to exceed 20% of total transactions 

Corruption

No more than 10 staff over 30 days overdue for online anti-bribery and corruption training

Examples of financial crime risk indicators:
Internal and external suspicious activity or suspicious transaction reports are a great place to start. As shown above, if a business categorises their reports into the core financial crime threats of money laundering, terrorist financing, fraud, tax evasion, corruption and sanctions they will have good data points on their main financial crime risks. By using these risk indicators and assessing your exposure to these risks through your risk assessment and MI, you will be able to effectively see if you are operating outside of your risk appetite and should look to mitigate or accept the risk.

A more mature business may look to set a risk appetite for the percentage of high risk customers it accepts or how many high risk transactions it processes, although financial inclusion should be carefully considered here as limiting the number of customers in or transactions to certain jurisdictions could negatively impact particular customer groups. Customers may fall outside of a business’s risk appetite, be it through their behaviours or the cost of safely managing the risks and requirements posed by that customer type. For example, certain industries may be off-limits, and if a client refuses to provide information or documentation, the business relationship may be terminated. 

Backlogs can represent as big of a risk to financial crime exposure and suggests that a framework is either under resourced or not efficient. If a FinTech is continuously operating from a backlog that continues to grow, they will be unable to manage the operational processes that exist to help mitigate financial crime risks. If a business sets a risk appetite for outstanding processes such as sanctions screening, transaction monitoring alerts or SAR filing, they will know when any backlogs exceed their risk appetite. This will give the firm a clear indication that there is a need for better efficiency or further resource.

For new products or new business lines, a firm should consider setting an initial risk appetite to manage any new risks and monitor financial crime levels as they establish a control environment. This could include limits on transactions, such as cash deposits, or limits on the amount or type of customers onboarded. These appetite statements can and should evolve over time as the firm starts to understand where the major risks lie and what behaviours they are able to tolerate and manage, and which they are not.

Our Recommendations

• Set a risk appetite early in your journey, and if you are a mature business without a risk appetite, set one now, and use your data to determine whether you have been operating within it.

• Work with your senior management team to set your risk appetite limits.

• Link your risk appetite to your risk assessment.

• Quantify your risk appetite using reliable data points.

• Consider how you then practically implement your tolerance to risk into your wider financial crime framework

• Communicate your financial crime risk appetite so the business knows what is and what is not acceptable. 

• Assess and escalate scenarios or key risk indicators that fall outside your risk appetite with a view to reject, accept or control.

• Track deviations from the risk appetite as part of monthly MI

Get in Contact

If you would like to discuss the issues in this post, or wider anti-financial crime topics in an increasingly digital FinTech world, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

AI and FinTech: An intelligent choice or artificial hype?

The FFE and sponsor, the Regulatory DataCorp (RDC), have just released the FFE’s latest white paper on FinTechs’ use of Artificial Intelligence (AI).

In a survey of 18 members, the FFE found that 61% are currently either in the process of developing in house AI solutions or reviewing third party options for their fraud or AML programmes. 33% of surveyed FinTechs currently employ AI solutions developed in-house against 11% that use third party AI solutions.

Cost and data deficiencies, followed by human resources, were reported as the main barriers in implementing AI solutions by FinTechs. The lack of sufficient knowledge or understanding also appeared prominently as one of the top risks highlighted by respondents. 

FinTechs, who had managed to overcome the barriers and challenges, reported a number of benefits including better accuracy and fewer false positives, faster turnaround on onboarding and some improvements in fraud detection.

In the meantime, research and feedback from members suggests that the best approach to introducing AI tools appears to be to deploy them alongside traditional systems: monitor and audit both old and new tools until you are satisfied, and then you are able to rely on the new tool.

Clearly as outlined there are risks and challenges with AI, but anything that enhances the ability for the sector to combat financial crime should be explored for the overall positive benefits it will bring to the companies involved and the people it affects. As highlighted by the survey results, FinTechs are not only well placed but are actively seeking opportunities to integrate AI to enhance their AML framework.

To download the full paper click here

CTF Strategies: Combating Common Terrorist Financing Misconceptions

At the end of last year, the US Department of Treasury released its National Terrorist Financing Risk Assessment. Despite the multiple attacks perpetrated by domestic extremists in 2018 - including the Pittsburgh synagogue shooting, Jeffersontown Kroger shooting and US mail bombing attempts in October alone - the assessment made no mention of domestic or far-right-wing extremism. 

Another misconception? When thinking of terrorism in Europe, we often break it down between far-right-wing and Islamist groups, when in actuality, according to the just published EU Terrorism Situation and Trend Report (TE-SAT), nearly two-thirds of all attempted or completed terrorist attacks were instigated by separatist groups. Without an understanding of the nature of terrorist financing, it becomes harder for financial institutions to know what to look for and to implement impactful counter-terrorist financing controls.

These examples only showcase some of the assumptions that can negatively affect our ability to prevent and detect funds travelling to terrorist groups. Based on our experience in the FinTech space, we’ve broken down a few more common terrorist financing misconceptions:  

Misconception 1: Terrorist financing exists in a silo.

Terrorist financing is most simply thought of as an activity pursued by someone with strong ideological affiliations to a terrorist group or cause. While this is certainly true in some cases, only thinking about direct and ideologically driven terrorist financing has the danger of concealing the wider nexus between terrorist financing and other types of financial crime. While the use of drug trafficking to fund terrorist activity has been well-recorded, other intersections between terrorist financing and criminal activity can be overlooked. For instance, one source of funding for the Charlie Hebdo attacks included fraudsters selling counterfeit goods. And yet terrorist financing goes beyond just the perpetrators of financial crime. Given that terrorist financing is about the destination of the funds, those seeking to purchase illegal goods, whether counterfeits, weapons or drugs, could also engage in terrorist financing unwittingly, being unaware of where the funds for their purchase end up. 

The terrorist financing network expands beyond the sale of illegal goods. A convicted ISIS fundraiser had tried to raise funds through financial aid fraud, and foreign terrorist fighters have been known to engage in bank and credit card fraud to help fund their movement. The mass enslavement of the Yazidi by ISIS is the most prominent example of how terrorist groups have used human trafficking to raise funds, though other groups such as Boko Haram and al-Shabaab have engaged in the practice as well. In addition to the direct sale of individuals, terrorist groups like ISIS have also been known to use online and social media advertising in the trafficking of persons or in ransoming them back to their families and have also been reported to engage in organ trafficking. 

To best combat terrorist financing, our approach to suspicious activity shouldn’t stop with our first instinct, as even cases of other types of financial crime may have links to terrorism, and individuals with links to criminal activity may be indirectly engaging in terrorist financing both wittingly and unwittingly. 

Misconception 2: We’re looking for donations from ideological sympathisers.

While donations are certainly an important and desirable revenue stream if you are a terrorist group, and recently active networks such as the Liberation Tigers of Tamil Eelam relied on complicated networks of genuine, coerced and unwitting donors to fund nearly their entire operations, these sorts of donations don’t actually represent that much of the entire terrorist financing picture at present. Interpol in 2018 reported that only 3% of all terrorist financing was generated through overseas donations. While the latest TE-SAT still underlines the threats related to international donations, and while groups are constantly evolving in their use of revenue streams, focusing too heavily on international donations could lead us to ignore more prominent revenue streams.

So where should we be looking instead? Sources of terrorist financing are numerous and will vary greatly between groups and actors, and so what your high risk indicators are will depend greatly on your product offering and location. Though entities such as charities are often considered as a part of CTF efforts, limited companies receive less attention, despite their evidence of their usage in terrorist financing schemes. An area that certainly warrants more attention is environmental crime, and Interpol’s data indicates that 38% of all terrorist financing is generated through activities like illegal logging, wildlife trade, mining and fishing. Crafting more tailored monitoring rules for transactions with links to high-risk industries in high-risk jurisdictions for environmental crime and terrorism would help to detect this sort of activity.

Misconception 3: Geography is the most important factor.

During our work as anti-financial crime consultants, we have spoken to several Heads of Financial Crime who express frustration when a suspected terrorist financing case is risen to them primarily because of the customer’s nationality or geographic location, with no other specific evidence indicating that they may be linked to terrorism. Given the misconceptions we’ve already explored, there are serious dangers with jumping to the conclusion of terrorist financing. Terrorist financing is already difficult to spot, especially given that most recent attacks only require less than $10,000 in funds to complete. In fact, the 5 terrorist attacks that took place in the UK in 2017 in total cost just £5,000 to execute. Overly favouring geographic factors risks underestimating the presence of domestic terrorism. The intersections with other crime types and the more complicated channels where terrorist financing can manifest only add to the need to demonstrate a suspicion of terrorist financing more substantively.

What’s the risk though? While it’s important to be safe rather than sorry when it comes to terrorist financing, in reality, a too simplistic approach could lead to vulnerable individuals being de-risked. For example, individuals who do aim to donate to a terrorist cause tend to use the path of least resistance in moving the funds from their country of origin to the conflict zone. Unfortunately, these overlap heavily with channels used by genuine actors seeking to remit funds home or donate to overseas causes. Without additional evidence linking the customer to terrorism, you could end up unwittingly engaging in profiling in a way that is unfair to customers and inefficient in your anti-financial crime efforts. One positive step we’ve seen employed in the FinTech sector is a more holistic approach to customer risk, which takes into account a variety of evolving data points--from IP address to device ID to transaction patterns and speeds--which help paint a more nuanced picture of a customer, that isn’t overly reliant on nationality or country of residence. The best approach to identifying terrorist financing is one driven by a mix of customer data factors, suspicious transactional patterns and references and open source intelligence in order to pin down the nature of your suspicion. Even a quick Google or social media search can go a long way.

Final Takeaways

Ultimately we need to widen our understanding of the nuances and complexities of terrorist financing and challenge the industry to consider cases beyond the more stereotypical patterns. With that said, there are a few key takeaways that we should all consider when framing our approach to terrorist financing:

1. Dynamic Approach to Terrorist Financing - Broaden your understanding of how terrorist financing may manifest, and see beyond just geographic red flags. We need more than that to form a suspicion of terrorist financing, and this approach doesn’t reflect the reality of the risks we currently face. Taking a dynamic approach to customer risk as it extends to terrorist financing risk is critical, and utilising open source intelligence can contribute to this.

2. Data and Knowledge Sharing - Having a strong relationship with law enforcement not only will help when it comes to active cases, but can also help you learn about new and emerging typologies and gain actionable information that you can build into your transaction monitoring tools. Improved data and typology sharing not only through public-private partnerships, but also through private-private partnerships can help facilitate greater overall resilience against terrorist financing threats and help everyone stay on top of a landscape that is rapidly changing.

3. Training and Awareness - CTF training, whether by internal or external parties, needs to be consistently evolving and reflective of the major trends we see in funding patterns and that you see in your day to day operations. Training should be coordinated by terrorist group or actor type, as all groups favour different financing structures, which change depending on their success and failures. CTF training isn’t just about procedure, but about the wider geopolitical context shaping terrorism at home and overseas.

FINTRAIL believes that all companies, should have the opportunity to thrive, free from the threat of financial crime and in doing so reduces the opportunities for exploitation of the most vulnerable.

If you would like to discuss the issues in this post, or wider anti-financial crime topics in an increasingly digital FinTech world, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

The Vulnerable: Targets and Tools of Financial Crime

What FinTechs can do to fight financial crime & exclusion

Lured by the opportunity for employment, housing and travel, a Latvian Organised Crime Group facilitated the movement of people from Latvia to the UK. For those hoping to create a better life for their families, these were immediately crushed as once they arrived in the UK, they were told they were "in debt" to the gang. The gang forced the victims to open bank accounts in their own names, then hand over their bank accounts and bank cards to the group before being sent to work in various locations across the UK. The gang retained control over their earnings and any refusal to cooperate was met with threats of violence and assault (1). Unfortunately this is not an isolated incident with a global figure of 40.3 million vulnerable individuals estimated to be victims of modern slavery (2).

In the UK, serious and organised crime is the most deadly national security threat (3). It affects more UK citizens, more than any other national security threat and leads to more deaths in the UK each year than all other national security threats combined. Organised crime groups sexually exploit children and ruthlessly target the most vulnerable, ruining lives and blighting communities. The predicate offences that drive financial crime often generate illicit funds off the back of the hopes and fears of desperate individuals. Crimes like the one highlighted cost us in the UK at least £37 billion each year (4). Criminals are able to reap the benefits of their crimes and to fund lavish lifestyles while their victims are left to suffer the consequences.

The rise of new technology and financial innovation, often leads criminals to seek creative ways to exploit evolving financial developments to their advantage. This makes FinTechs and their customers a particular focus for the criminals, a problem which is heightened further when one considers that two of the largest under-banked groups, the young and migrant communities, are at a higher risk of vulnerability.

What can we do?

One of the simplest ways to identify and understand a customers potential vulnerability is through ‘face-to-face’ interaction. This is much harder for FinTechs to do; most interactions involve online onboarding, with little dialogue apart from email and instant messaging between the client and a customer service representative. Indeed, much of this kind of interaction is increasingly automated, which is part of the inherent attraction of the sector.

The best time for FinTechs to identify and protect a vulnerable individual is during the onboarding process, through Identification and Verification (IDV). One of the most concerning situations we have come across through our involvement with the FinTech FinCrime Exchange (FFE) have been reports of FinTech client applicants providing IDV selfies or undergoing an onboarding interview online who appear to be in the presence or possibly even under the control of another individual. Instances such as these need to be taken very seriously, and simply rejecting the new customer is not enough. Where suspicious activity of any kind is in evidence, FinTechs have a clear moral responsibility to report it (5).

FINTRAIL believes that all companies, should have the opportunity to thrive, free from the threat of financial crime and in doing so reduces the opportunities for exploitation of the most vulnerable.

If you would like to discuss the issues in this post, or wider anti-financial crime topics in an increasingly digital FinTech world, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

References

(1) https://www.bbc.co.uk/news/uk-scotland-edinburgh-east-fife-46441855

(2) International Labour Organization and Walk Free Foundation - Global Estimates of Modern Slavery - 2017

(3) Home Office - Serious and Organised Crime Strategy- November 2018

(4) Home Office - Serious and Organised Crime Strategy- November 2018

(5) NCA - Guidance on reporting routes relating to vulnerable persons - November 2016

Why do you work in Financial Crime Compliance?

Payal Patel, who leads our new office in Asia, tells us why she works in Financial Crime Compliance and how she initially found her way into the field.

Payal combines her legal education and extensive compliance experience to build 'best-in-class' anti-financial crime programmes for clients and is focused on enabling innovative business whilst balancing risk and regulatory demands. She brings over 14 years of experience in financial services across multiple regions, focusing recently on FinTech and crypto. She has led engagements with regulators on new business models and has worked with a wide range of organisations globally on international best practices.

---

‘Why do you work in Financial Crime Compliance...isn’t it boring?’

I’ve lost count of the number of times I’ve been asked this question in some form.

Truth be told, I never intended on pursuing a career in Financial Crime Compliance. After completing my LLB and my legal training, it became very clear that my legal career wasn’t going to be like an episode of Suits, and I decided to follow many of my friends into the world of banking. During my undergraduate degree, we had talks from practically every bank selling us the pre global financial crisis dream of trading and earning pots of money. But I wasn’t sure that world was for me. I hadn’t heard of compliance until a recruiter called me about an entry level role that preferred people from a legal background. I was particularly intrigued as soon as she started talking about fighting financial crime. As a further plus. the team seemed nice, and the work was new, so I took the opportunity.

14 years later, and despite many opportunities to move into other areas, I’ve chosen to continue working in this space - and here’s why.

It impacts us all

People often forget the social impact of money laundering and terrorist financing - it costs us all. Serious crime, from drugs and cybercrime to people trafficking, has huge negative  impacts on society and the people affected, as well as costing the economy billions each year. The trickle down effect of this is that taxes need to be raised to compensate not only for the financial loss but also the additional resource required to police the activity going forward.  The price of consumer services increase as businesses seek to cover the costs associated with the higher taxes. Incidents of corruption, violent crimes and job losses go up and all of this can ultimately destabilise companies, industries and even developing nations. For the victims of crimes enabled by laundered money, the effects can be devastating and lifelong, including great personal and family loss. I see my role as preventing the criminal activity at a crucial point – where criminals seek to convert and clean their money by concealing it within the financial system, essentially allowing their crime to pay off.

Business enabling

Further, I strongly believe that compliance done right is business enabling. Throughout my career, I have actively sought to work in partnership with Business Heads to fully understand their business and the bespoke nature of the financial crime risk it introduces, seeking ways to illuminate this, and show how combatting it will give the business not only the stability it needs to grow, but how fighting financial crime actively builds trust among its customers. This collaborative approach has allowed me to creatively think of new and innovative ways to manage risk whilst also allowing me to be an integral part of the product / service roll out.

The cost of getting it wrong

From an organisation’s perspective the cost of getting compliance wrong can also be devastating, not only financially but also reputationally. Whilst the value add of a robust compliance programme cannot be tagged directly to sales or revenue, the fines imposed for failures can be massive, and licenses revoked or not granted at all.

As I now turn my focus to the world of FinTech, I am more passionate than ever about my role. As technology evolves, so does criminal activity. I want to make crime, corruption and terrorism harder for perpetrators. I want to protect the reputation of the organisations I work for and help them establish and maintain relationships with legitimate customers. This seems far from boring to me.

The Money Mule Trap

by Ishima Roman (Analyst, FINTRAIL)

In mid-February 2019, the UK House of Commons Treasury Select Committee heard from UK financial services providers about the problem of ‘money mules,’ reported to be on an upwards trajectory(1). The term ‘money mule’ is very familiar to financial crime risk professionals, denoting an individual used by criminals, knowingly or not, to transport illegal funds. The term is of course fraught with value judgements; being ‘mules’, they are perceived at best naive and unwitting accomplices, and at worst willing and able conspirators. However, as those giving evidence noted, ‘mules’ although enabling financial crime, can often be victims too.

Money mules can present challenges for FinTechs, especially those offering account based services and payments, because their customer base often draws on groups targeted to become mules: the young, immigrants, the economically precarious. This post explores the mechanics and consequences of money muling, and asks what can be done to mitigate the problem. In part, we believe that the answer is robust financial crime risk management; but FinTechs can also play an important educational role in preventing the vulnerable falling into the ‘mule’ trap.

What is ‘Money Muling’?

Europol, the European Union’s (EU) law enforcement agency, defines money mules as ‘people who, often without knowing it, have been recruited as money laundering intermediaries for criminals and criminal organisations(2).’ The term is sometimes used interchangeably with ‘smurfers,’ although this latter term more precisely refers to those who deposit many small batches of illicit funds to avoid a threshold of regulatory interest.

The process of money muling usually comprises:

1. The recruitment of the mule by criminal sources;

2. The mule receives funds into their account;

3. The mule withdraws the funds; or

4. The mule wires the funds to another account(s) at the direction or request of criminals. This often includes cross-border transactions.

5. The mule receives a ‘commission’, either separately or as a cut of the funds sent to their account.

There are of course variations upon this modus operandi, and criminals have also been known to ask the mule to transfer electronically the funds to another account, without the withdrawal at stage (C). Like any money laundering typology, muling will evolve with the development of technology and institutional requirements.

Becoming a Money Mule

As noted above, criminals are often looking to target those who are in a financially vulnerable position, but can provide enough psychological ‘distance’ from criminality in the minds of financial services providers that they are less likely to generate interest. Criminals are known to use many avenues to attract or pressure individuals into money muling, but some of the most common include:

• Speculative/vague job profiles or money-making ‘opportunities’, advertised online or in local or free papers. This can often be presented as lucrative ‘home working’ and increasingly as an opportunity in a FinTech itself, often using a meaningless job title such as ‘Financial Transactions Analyst(3)’;

• Direct approaches over social media, such as Facebook and Instagram, and communications apps such as WhatsApp;

• Direct approaches in person.

Criminals will often pose as reputable organisations, in order to convince the target that what they are doing or proposing is legitimate and legal. Some may present themselves as representatives of an overseas firm whose details are difficult to verify. Other criminal gangs use techniques such as impersonation and role-playing, presenting themselves as an authority figure, such as police officer, government official or soldier, seeking help in some awkward personal circumstance, often requiring the transfer of funds overseas.

How Money Muling Works(4)

Vulnerability to Muling

The unemployed and new immigrants from developing to developed countries have been major targets for muling operations for some time; financial desperation provides a motivation in both cases, and in the second, there is likely to be a lack of cultural understanding that criminals can exploit. However, there is an increasing trend in Europe towards the exploitation of young people and students, driven by their high levels of aspiration and low incomes, perceived naïveté, and accessibility online.  According to a report in April 2018 from CIFAS, the UK-based not-for-profit fraud prevention group, 2017 saw:

• An 27% increase in the number of 14-24 year olds being used as money mules. Many of these young people were students, promised substantial payments for little effort.

• An 11% rise in the number of accounts believed to have been used by money mules (32,000 plus in total)(5).
  

In the UK, young people are also increasingly becoming the targets of identity fraud, leading to the misuse of their accounts by money launderers. At the Treasury Select Committee hearing, representatives from Santander noted that the young were particularly vulnerable to having their accounts being used for muling without their knowledge because so many of them take a lax approach to data security; according to Santander’s research, 85% of 18- to 25-year-olds had shared financial information online(6).

The Consequences of Muling

The consequences of becoming a money mule can be harsh, even if the mules are not aware of the ultimate rationale behind the transfers. Regardless of their level of knowledge, they will have played a crucial role in a financial crime, and as such are liable to criminal charges in most developed jurisdictions. In the UK, for instance, muling can lead to a prison sentence of up to fourteen years; in June 2018, the UK group Financial Fraud Action reported on a case of a 26 year old man sentenced by a London court to a year in prison for two mule transactions that totalled at £28,000(7).

Even if criminal charges don’t arise, there is still the risk of long-term financial exclusion and limitations on career prospects. In April 2018, the BBC reported on the case of an anonymous teenage girl, ‘Holly’, who had been targeted by online mule recruiters, or ‘Fraud Boys’ as they are known, on Instagram and Snapchat, but had been caught out by bank staff when depositing a large amount of cash into her account. According to the report, Holly has struggled to get a bank account since, and has had to ask her employers for payment by cheque, which can only be cashed - at substantial cost - in payday loan shops(8).

The Risk to FinTechs

Money mules are a problem for all financial services providers,. Research by Europol and Eurojust in 2016 suggests that 90% of money-mule transactions were linked to cybercrime. This included phishing and malware attacks, but also online shopping/e-commerce fraud and payment card fraud, typologies experienced by certain types of FinTech products largely due to the nature of their customer base(9):

Young people and students are attracted to products designed specifically to appeal to their needs, many FinTech products are seeing significant traction amongst this demographic. Other groups such as new immigrants or those seeking access to financial services might also be attracted to using online services which do not require lengthy verbal interactions with in-branch bank staff and offer products that are designed to address the imbalance of financial exclusion.

Criminals are aware of these developments, and it’s possible that they will focus increasingly on the recruitment of FinTech customers, particularly as other routes, via traditional institutions are closed off for them.  This highlights the increasing need for close collaboration and joint working between financial institutions of all types to combat this type of crime.

Detecting Mules

The first consideration is awareness of the issue, and factoring it into your risk assessment and appetite. If your firm is focused on building a client base in the vulnerable demographics, then you need to make sure you explicitly recognise the risks and have the right controls to manage the nuances.

Every firm and product is different, and there is no generic approach to this, but it is worth recognising that it is difficult to identify all mules at onboarding, especially as some will onboard legitimately, being recruited as mule later (if you’re offering a product aimed directly at improving financial inclusion for example). This can be made harder if ‘at risk’ groups are part of your target customer segments. However, gaining a thorough understanding of the client during the Know-Your-Customer (KYC) phase and building that customer profiling in to a tuned customer risk assessment is a key to detecting problems later on. Because it is in the context of their expected behaviours that we judge what is unusual.

Unlike legacy banks, FinTechs are not going to catch mules out ‘in branch,’ as happened to ‘Holly’, mentioned above. Transactions take place online, so it’s important to have monitoring tools in place that can alert you to deviations in normal behaviour, along with an appropriately trained team to investigate those alerts and report them through a Suspicious Activity Report (SAR) if necessary.

Utilising available data to identify and robustly investigate ‘at-risk’ accounts is a key control activity. Mule accounts are sometimes maintained through linked life-style payments to add an air of legitimacy so investigating account connections and leveraging data points such as common addresses (and others) can be a powerful way to proactively identify accounts for further review.

Additionally, building a suitable greylist or using industry databases such as CIFAS (or others) can provide a mechanism of detecting suspicious profiles at onboarding. Research suggests that accounts used during the later phases of mule activity in a network are more likely to be used by criminals more than once, presenting an opportunity to detect them via robust data sharing and blacklisting.

Increase Education and Prevent Mules

Prevention is often better than a cure so an important additional approach is to think about how FinTechs can help prevent the problem in the first instance. Reducing the pool of potential mules is a more cost effective ‘up-stream’ solution than tackling the effects of their activities. It also provides an opportunity for anti-financial crime professional to add something back to the community with clear positive social impact.

FinTechs have a unique advantage in the way they interact with their customer base and can play an important role in educating particularly vulnerable clients - especially young people - through explicit guidance during onboarding and throughout the customer lifecycle. Companies can engage in and support anti-muling campaigns, such as the EU’s European Money Mule Action (EMMA) imitative, or the ‘Don’t be Fooled’ campaign by the UK groups CIFAS and Financial Fraud Action (FFA)(10).

The young are especially in need guidance on what is ‘normal’ in the financial space, and arguably all financial providers have a duty of care in this regard. It does not take much to deliver simple key messages that reduce the risk to themselves and their clients: there is no legitimate reason to allow someone else to move their money via your account, however convincing they might be. There a three simple pieces of guidance FinTechs can give to their customers:

• If you get offered a job or income, research any potential employer

• Don’t respond to adverts offering large sums of money, for minimal input

• Don’t allow anyone to access your account or use you card/app

• And if it sounds too good to be true - it is. Walk away or ignore them.

Get in Contact

If you would like to discuss the issues in this post, or wider anti-financial crime topics in an increasingly digital FinTech world, please feel free to get in touch with one of our team or at contact@fintrail.co.uk.

1. https://www.theguardian.com/business/2019/feb/13/banks-close-thousands-of-money-mule-accounts-mps-told

2. https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/forgery-of-money-and-means-of-payment/money-muling

3. https://ftalphaville.ft.com/2018/01/12/2197610/fintech-as-a-gateway-for-criminal-enterprise/

4. https://www.europol.europa.eu/activities-services/public-awareness-and-prevention-guides/money-muling

5. https://www.telegraph.co.uk/personal-banking/current-accounts/fraudsters-target-cash-strapped-students-use-money-mules/

6. https://www.theguardian.com/business/2019/feb/13/banks-close-thousands-of-money-mule-accounts-mps-told

7. https://www.financialfraudaction.org.uk/news/2018/06/06/sentencing-of-26-year-old-money-mules-from-enfield-serves-as-stark-warning/

8. https://www.bbc.co.uk/news/business-43897614

9. https://www.europol.europa.eu/newsroom/news/europe-wide-action-targets-money-mule-schemes

10. https://www.moneymules.co.uk

Risk Assessment: Back to Basics

By Meredith Beeston (FINTRAIL Solutions) and Allison Spagnolo (FINTRAIL Solutions).

Adopting a risk-based approach is the foundation of best-in-class anti-financial crime practice. Your anti-financial crime (“AFC”) risk assessment should be one of the cornerstones of that practice.

While financial crime risk professionals are familiar with the AFC risk assessment, also known as the Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) risk assessment in the U.S., it can be easy to underestimate its true value in the risk management framework. Risk assessments often feel like a chore or little more than a check-the-box exercise to please your regulator. The AFC risk assessment, however, is one of the most powerful tools you have to reduce your exposure to financial criminals and should be designed to grow and evolve to match any new vulnerabilities. A properly-executed AFC risk assessment will close gaps in your compliance program and identify the appropriate policies, procedures and controls that should be implemented to protect your firm and your customers. To help you design a risk assessment of your own, we’ve gone “back to basics” and drawn on our experience with FinTechs to unpack the fundamentals of a modern and effective risk assessment . This post will explore features common to all AFC risk assessments and offer practical advice about how to design one for your company.

What is an AFC Risk Assessment?

In most jurisdictions, AFC risk assessments are indeed a regulatory requirement. The U.S. Bank Secrecy Act (“BSA”), the EU’s 4th Anti-Money Laundering Directive (“4MLD”), and the Financial Action Task Force (“FATF”) all require periodic internal risk assessments. Consider, though, that this particular regulatory requirement can also be an opportunity to meaningfully guide your entire AFC framework and not just a task to complete to avoid regulatory displeasure.

AFC risk assessments also serve as:

• A map of vulnerabilities: It is important to understand the ways in which a criminal might seek to misuse your product. It is much better to proactively identify and address potential vulnerabilities instead of discovering them as part of a “post-mortem.”

• A resource plan. Once you know where your vulnerabilities lie, you can consider the controls you need to tackle them, giving you the opportunity to better strategize how to divide up your company’s finite resources. For instance, which RegTech products are most worth the investment? What skills do you need in your next AML analyst? The answers to these questions will be resolved in the risk assessment.

• A development strategy. In the FinTech sector, growth and innovation are a daily feature of the business. Your AFC risk assessment can and should guide these efforts - helping you select which jurisdictions are best for expansion, which product features offer the most potential with the least risk, and which customer segments to market to next.

• A dialogue. Much like your company itself, your AFC risk assessment has to evolve. It should change to reflect insights and feedback from your senior management, auditors, consultants, banking partners and regulators. Each risk assessment - and its results - offers an opportunity to dialogue with relevant stakeholders about the future of the AFC risk assessment, resourcing and compliance program.

How do I Create an AFC Risk Assessment?

At their core, AFC risk assessments can be summarized in one essential formula:

INHERENT RISK - CONTROL EFFECTIVENESS = RESIDUAL RISK

Let’s break down each of these factors in a bit more detail.

Inherent Risk

Inherent risks are the financial crime risks you face before you apply any of your existing (or if you’re just starting off, planned) AML controls. At a high level, your inherent risks generally fall into three categories:

• Who your customers are

• What geographies you serve

• Your unique product and delivery features

Then, you will need to develop criteria or questions about the specific financial crime risks your company and customers are exposed to in each area. While it is important to initially consider the broad categories of financial crime risk (e.g., money laundering, terrorist financing, and fraud), you will likely want to generate more granular questions. For instance, if you offer a prepaid card targeting students, you will want to specifically address the risk of money mule activity occurring on your platform. In another example, if you offer a direct debit service, you will want to consider how vulnerable your product is to transaction laundering.

You should be able to analyze the data you gather across your company. While many FinTechs we deal with have a single office or product, over time, your approach to gathering data to establish inherent risk will need to evolve. For instance, for a FinTech with branches in Europe, the United States and Asia, instead of asking, “Are you aware of any high risk or medium-high risk-rated customers in a branch’s customer population?,”  the risk assessment should ask, “Provide the number of high-risk customers in each branch.”

Where appropriate and where the information is available, the risk assessment should also seek volumes (i.e. with respect to transaction data and SAR data). This will help to accurately reflect financial crime exposure.

Based on the responses in the inherent risk portion of the risk assessment, an inherent risk score is generated. It is typically along the “Low,” “Medium,” and “High” spectrum. There is no one-size-fits-all calculation of the inherent risk score, and some institutions will develop simple scoring while others will create complex weighting systems. The key is that your methodology is clearly explained and can be replicated when you update your risk assessment.

Control Effectiveness

Control effectiveness refers to the capacity of the specific processes and systems you have in place to mitigate each identified risk. As with inherent risk, granularity is important here. The control effectiveness portion of the risk assessment should be tailored, so that each relevant control is assessed against the corresponding risk, and impartial, so that controls are accurately represented in their effectiveness. For instance, if the control effectiveness topic is “Payment Alert Investigations” and the inherent risk is related to the processing of a sanctioned payment, you may want to consider: “Do the procedures covering alert handling address what documentation should be collected to support the investigation of sanctions screening payment alerts?”

As with inherent risk, you want to allow for as much impartiality as possible in assessing control effectiveness, and to rely on clear data when it is available (such as false positive rates, rates of false IDs that pass KYC, etc.).

It is important to have an understanding as to whether each control effectiveness topic has meaningfully addressed each inherent risk, both precisely and with a wider understanding of your overall control landscape. If you have multiple products or branches, you may want to be able to draw comparisons across your company. Like with inherent risk, there is no one way to measure control effectiveness; the key is that your methodology is clear, objective and justifiable.

Residual Risk

Residual risk is the risk that remains once all your controls are in place. In other words, it is what you are left with after identifying inherent risk and applying your mitigating control effectiveness. It is unlikely that residual risk will be “Low” across the board, but that is normal and expected. Your residual risk score will help shape the broader financial crime risk appetite of your business. Knowing this risk level gives you the opportunity to consider issues such as whether your company is comfortable with a “Medium” residual sanctions risk when expanding into certain jurisdictions.

Case Study

AFC risk assessments are designed to be complex and comprehensive, so it is not possible to provide an in-depth breakdown of an example here. However, even through the brief case study below, you can see why completing an AFC risk assessment provides a clear benefit to a FinTech:

Scenario

A FinTech planning to offer individuals an app-based foreign exchange service, loaded through debit cards and bank transfers, decides to conduct an AFC risk assessment prior to going live with its pilot.

Risks and Vulnerabilities

The FinTech discovers a range of inherent risks to which it is exposed, with particularly alarming scores linked to potential sanctions evasion, attempted payments to sanctioned individuals or companies, financing acts of international terrorism through purported charitable donations, and money laundering connected to narcotics or human trafficking.

Managing Risks

The FinTech uses the inherent risk analysis to shape its controls in order to obtain an acceptable level of residual risk. The controls are designed to go beyond comprehensive monitoring and screening and robust KYC and adverse media checks. The company also limits the geographic scope of its product to non-sanctioned countries with lower levels of money laundering/terrorist financing risk, and designs its expansion plan so that geographic risk is added only incrementally. This increases confidence in the product, which allows it to be signed off by all relevant stakeholders.

Things to Remember

Here are a few key lessons to take away:

1. AFC risk assessments are not “out of the box.” They should reflect the nature, size and scale of your business. If your business is just starting up, you can start with a simple risk assessment!

2. AFC risk assessments should make sense. There is no need for over-complicating the questions or the scoring. You want to be able to communicate it easily across your company.

3. AFC risk assessments evolve. While this is certainly true as it relates to your business growth, it is likewise true in relation to the evolving typologies that criminals try. If you learn about an emerging risk from a reliable source, consider adding it to your next risk assessment.

4. AFC risk assessments do not result in perfect scores. You will never have zero risks. Rather, it is more important to be aware of the risk levels you do have and develop a comfortable risk appetite in response.

5. AFC risk assessments are all about the details. Be sure the risk assessment is as useful to you as possible, keeping in mind all the ways it can add value beyond a simple regulatory requirement.

Help and Resources

If you have any other questions related to your AFC risk assessment or how to execute it, do not hesitate to reach out to FINTRAIL Solutions in the U.S. or FINTRAIL in the UK. If you are interested in further improving your risk assessment, here are a few key resources to consider:

• Financial Action Task Force Money laundering and terrorist financing risks: The resource provides a series of useful links to countries’ national AML/CTF risk assessments, as well as to narrower typologies identified by FATF. National risk assessments will give you an idea of the particular risks considered to be of most importance in a particular country.

• The Wolfsberg FAQs on Risk Assessments: These Frequently Asked Questions are in-depth responses to common risk assessment inquiries. Remember, though, the risk assessment format and methodology that will work best for you will depend on your company’s unique characteristics (e.g., size, scale, and overall offering).

• ACAMS’ Auditing and Updating an AML Risk Assessment: This white paper describes about how a risk assessment should be reviewed and revised within a major banking institution, though there are still plenty of lessons for the FinTech sector.

A Modern Curse - Fentanyl and FinCrime

Matthew Redhead (Senior Associate, FINTRAIL) & Krista Tongring (Managing Director, Guidepost)

Matthew Redhead is a financial crime risk and intelligence specialist, who has undertaken a range of senior operational, change management and leadership roles in financial services, consultancy and government. He works with FinTechs and challengers to build responsive and smart compliance frameworks that encourage innovation whilst minimising risk. 

Krista Tongring oversees a variety of compliance issues and investigations for clients including AML, trade compliance and anti-corruption matters. Previously, she had an accomplished career at the U.S. Department of Justice having most recently served as the Acting Section Chief at the Drug Enforcement Administration Office of Compliance. She led policy discussions and developed strategies to implement new and revised policies. She also worked to establish a more efficient policy review process. Ms. Tongring spent a significant portion of her career as a federal prosecutor where she investigated and prosecuted complex criminal matters, including racketeering, money laundering, abusive trust and other tax matters, international organized crime, criminal asset forfeiture, and violations of the Bank Secrecy Act.

As close partners of FINTRAIL Solutions are aware, we have been concerned about the impact of fentanyl - a powerful and highly addictive opioid used legally for the relief of extreme pain, but also produced and sold illegally - since early last year. The illegal use of the drug is at epidemic proportions in North America, and based on Canadian government warnings, we highlighted to clients and collaborators the potential financial crime risks that the burgeoning trade in the drug posed directly to FinTechs and their customers. 

As professionals in risk management, it is easy to look at issues like fentanyl and treat them as technical problems alone: risks to be identified and mitigate. However, the fentanyl epidemic highlights the underlying human tragedies that often drive the financial crime we seek to tackle. Overdoses of illegal fentanyl are reported to have killed the singers Prince and Tom Petty,[1] while the US Centers for Disease Control and Prevention (CDC) reported in December 2018 that fentanyl is now one of the main drugs involved in overdose deaths across the US.[2]

 This blog post is the first in a series which will look at the social causes and contexts of financial crime. The aim is to look at the problem in the round - its character, causes and impact - to help remind us why it is not only important to fight the financial crime the problem engenders, but also consider the reality for people who are caught up in these illegal trades - the mules, the users and the small time dealers, who, in truth, are victims too.

The Fentanyl Problem

Fentanyl is an opioid: a category of drug that suppresses feelings of pain in the brain, whilst also engendering states of relief and relaxation. In its legally manufactured form, it is usually prescribed for extreme, chronic pain, and is rated as being up to 100 times stronger than a sister opioid, morphine. Legitimate fentanyl is usually taken as a patch, lozenge or injection, but care has to be taken, as there is a very real risk of overdose and death.[3] Fentanyl can also be illegally sourced, either through the theft and diversion of legitimate supplies, or the purchase of synthetically produced illegal variations, usually coming as a white powder that can be ‘cooked’ and injected, snorted or ingested, either on its own, or in combination with other illegal drugs, especially cocaine and heroin.[4]

 Even in the legal variety of the drug is extremely dangerous, and is classified in the top category of most countries’ controlled substance schedules.[5] Indeed, the drug is so powerful that in August 2018 it was used in Nebraska to execute Carey Dean Moore by lethal injection,[6] and has allegedly been banned on some drug supplier websites on the darknet, according to a 2018 report by the UK paper The Guardian.[7]

The Market

 There is little doubt that the current epicentre of the fentanyl epidemic is North America. In the US, the drug has had a devastating effect; in a recently published report from December 2018, the US Centers for Disease Control and Prevention (CDC) stated that, as of 2016, fentanyl is now linked to 29 percent of all overdose deaths.[8] Overall, more US citizens were killed by all opioids - of which fentanyl is most prominent - than were killed by guns or car accidents.[9] This CDC chart of opioid related deaths in the US gives some indication of the dramatic rise of the problem, and fentanyl’s role within it.

Figure 1 - Synthetic Opioid Drug Poisoning Deaths, per 100,000 of US Population 2011-2016, (Source CDC)[10]

In Canada, the problem is equally significant. In June 2018, the Canadian authorities reported that over 4,000 Canadians had died from opioid overdoses in 2017, a new record, of which 72% were fentanyl or pseudo-fentanyl analogs.[11] Outside of North America, there has also been a reported rise in deaths by fentanyl in Australia,[12] New Zealand[13] and the UK[14] over recent years, although rates do not yet appear to have reached US levels. The EU Monitoring Centre for Drugs and Drug Addiction states on its website that fentanyl is a more marginal problem in the EU, affecting primarily Estonia, Germany, Belgium and Austria. However, EU statistics show that opioids as a class are becoming a greater problem in Ireland, France, Italy and Portugal.[15]

The Mechanics of the US Trade

The DEA and Department of Homeland Security (DHS) believe that the primary source of the illicit versions of the drug is China - one of the most popular terms for a range of fentanyl analogs is in fact ‘China White.’ Laboratories run by Chinese organised crime gangs produce high volumes of fentanyl, which are then marketed to other transnational traffickers, including the Mexican cartels, who move the drugs into North America. Fentanyl flows across the Pacific to Canada and Mexico via mail order services and smuggling, where it is often mixed with other drugs, and then smuggled into the US via the north eastern and south eastern borders.[16] The drug often comes in a powdered form, or disguised as the tablet forms of legal pharmaceuticals, such as oxycodone and hydrocodone.[17] 

The secondary source, and one of growing significance, is Mexico itself. In 2016, the DEA reported its suspicion that the Mexican cartels were ‘branching out’ into the production of fentanyl, using imported precursor chemicals from the US and China.[18] Over the last year this assessment has been confirmed by busts in Mexico, including one in December in the capital, that have revealed the existence of cartel-managed fentanyl labs.[19]

The mixture or ‘cutting’ of fentanyl with other drugs, such as cocaine or heroin, makes the combined hybrid drug even stronger and more addictive, and further help us understand why its market is so sustainable. First, selling fentanyl keeps the costs of the traffickers and pushers down, because a small amount, though dangerous and potentially toxic, is relatively easy to produce and ship, yet has extreme potency. Second, the potency of the drug, especially when combined with other narcotics, means that users become quickly and highly dependent, ensuring that the suppliers have a captive market. Some of the strongest markets for fentanyl are in US states that already have high rates of opioid addiction.  This is borne out by a DEA report indicating that many of the younger users of fentanyl turned to the drug once they could no longer obtain and/or afford illicit pharmaceutical opioids.[20]

The prospects of breaking this market in the short-term appear bleak. The problem has become so great that the US President, Donald Trump, has pressured his Chinese counterpart, Xi Jinping, to take action against the Asian end of the trade, most recently at the November/December 2018 G20 summit in Argentina. Although President Xi was supportive, it is likely to take some time before practical action occurs.[21] Moreover, recent Canadian requests to China for similar help have been less warmly met, largely because of ongoing disputes over the return of Chinese fugitives to Canada.[22] As long as the Canadian and Mexican gateways to the US remain open, the scourge of fentanyl in North America is likely to continue.

Fentanyl, FinCrime & FinTechs 

What role then for FinTechs?

 For the last five years, there has been media ‘hype’ about the roles that FinTech platforms might play in the purchase of illegal drugs. Payments providers have been put out of business because their platforms have allowed individuals to buy illegal items unimpeded. In 2013, for example, the US Department of Justice (DoJ) closed Liberty Reserve, a digital payment processor, for facilitating the sale of drugs and child pornography, while cryptocurrencies are of particular current concern. In June 2018 the US media reported a DoJ enforcement action named ‘Operation Dark Gold,’ to stop the darknet sales of drugs using Bitcoin and other cryptocurrencies. [23]

Our clients’ experience tends to be more prosaic than some of these more sensational media cases. As a recent FinTech FinCrime Exchange (FFE) survey of UK FinTechs demonstrated, most financial crime typologies experienced in the UK cryptocurrency sector were around varieties of customer fraud. Nonetheless, we still believe that FinTechs have a responsibility to take these issues seriously. There are potentially striking indicators that, in combination, should raise concern (see breakout box), and we would urge all FinTechs working in payments services, retail accounts, prepaid cards and crypto transmission and exchange providers to give them due attention in their financial crime investigations.

●      Unusual Chinese transactions: Customers buying items from China, especially where this does not fit with the customer transaction profile or nature of businesses, along with multiple unconnected payments to a single individual in China;

●      Unusual health products: Firms offering apparently pharmaceutical or health products who demonstrate other unusual indicators such as those listed here;

●      High use of currency exchanges: Multiple payments from global currency and cryptocurrency exchanges, usually in small amounts; and

●      Tags and nicknames: Payments including nicknames such as Apache, China Girl and China Town, or precursor references such as NPP or ANPP.

For more details, contact FINTRAIL Solutions at contact@fintrailsolutions.com

At the same time, the case of fentanyl drives home the need for FinTechs to take a longer term view too about the types of business they are doing. As regular readers of the FINTRAIL and FINTRAIL Solutions blogs will know, we recommend some basic prevention methods that include active risk assessment and defined risk appetite. We have found that its critical for FinTechs to take basic risk management seriously from the beginning - asking themselves questions about the vulnerabilities of their product and the risks that opens them up to. If you think your company is vulnerable, then take action. Get the basics right. Because it is in no one’s interest to facilitate the sale of a drug like fentanyl.

If you would like to know more about how FINTRAIL Solutions and how we can help you and our business better manage financial crime risks, please contact us at contact@fintrailsolutions.com.

[1] https://www.rollingstone.com/music/music-features/musics-fentanyl-crisis-inside-the-drug-that-killed-prince-and-tom-petty-666019/

[2] https://www.cdc.gov/nchs/data/nvsr/nvsr67/nvsr67_09-508.pdf

[3] https://bnf.nice.org.uk/drug/fentanyl.html; https://adf.org.au/drug-facts/fentanyl/

[4] https://adf.org.au/drug-facts/fentanyl/

[5] https://www.dea.gov/drug-scheduling; https://napra.ca/nds/fentanyl; https://www.gov.uk/government/publications/controlled-drugs-list--2/list-of-most-commonly-encountered-drugs-currently-controlled-under-the-misuse-of-drugs-legislation

[6] https://www.independent.co.uk/news/world/americas/carey-dean-moore-fentanyl-capital-punishment-death-penalty-nebraska-execute-a8491671.html

[7] https://www.theguardian.com/society/2018/dec/01/dark-web-dealers-voluntary-ban-deadly-fentanyl

[8] https://www.cdc.gov/nchs/data/nvsr/nvsr67/nvsr67_09-508.pdf, p.1

[9] https://www.centeronaddiction.org/the-buzz-blog/we-asked-you-answered-did-guns-car-crashes-or-drug-overdoses-kill-more-people-2017

[10] https://www.cdc.gov/nchs/data/nvsr/nvsr67/nvsr67_09-508.pdf, p.4

[11] https://globalnews.ca/news/4282699/canada-opioid-death-statistics-2017/

[12] https://www.theguardian.com/science/2018/may/13/he-was-gone-fentanyl-and-the-opioid-deaths-destroying-australian-families

[13] https://www.newsroom.co.nz/2018/09/03/220753/drug-cartels-dealing-illicit-prescription-drugs-eye-new-zealand

[14] https://www.theguardian.com/society/2018/aug/06/fentanyl-drug-deaths-rise-nearly-third-england-wales

[15] http://www.emcdda.europa.eu/html.cfm/indexEN.html

[16] https://www.hsdl.org/?view&did=797265, p.70

[17] http://facethefentanyl.ca/?page_id=15

[18] https://www.hsdl.org/?view&did=797265, p.65

[19] https://www.washingtonpost.com/world/the_americas/mexico-raids-lab-producing-fentanyl-in-capital/2018/12/12/fd21ee18-fe55-11e8-a17e-162b712e8fc2_story.html?noredirect=on&utm_term=.06db3fad0ad1

[20] https://www.dea.gov/sites/default/files/2018-10/PA%20Opioid%20Report%20Final%20FINAL.pdf, p.28

[21] https://edition.cnn.com/2018/12/01/politics/fentanyl-us-china-g20-talks/index.html

[22] https://globalnews.ca/news/4658188/fentanyl-china-canada-diplomatic-tensions/

[23] https://www.theverge.com/2018/6/27/17509444/dark-web-drug-market-money-laundering-hsi-dark-gold

2018 and 2019

As we head into 2019, here is a summary of 2018 in numbers.

---

We welcomed James and John-Paul into the FINTRAIL family.

John-Paul will be leading the FINTRAIL and FFE communities so that Fintechs can collaborate on best practices in financial crime risk management.

James joins us to provide industry expertise all of our projects across a wide range of subjects and specialisms.

---

We launched the FFE in the USA

As the FFE continues to grow and support its members in the UK and the Netherlands, we launched the FFE in the USA where we will be connecting the community to support the specific needs of American Fintechs.

---

We held our first FFE conference in London

Over 100 representatives from across the Fintech community spent a day discussing and sharing ideas on the theme of...
 

‘Disruptive Perspectives on Financial Crime’ 

Which was a huge success with over 100 Fintech experts meeting for a day of learning, sharing and networking.