Ticking a box or managing financial crime?

Is solely complying with regulations really managing financial crime risk? FinTech and start-ups have the opportunity to carve a new path in risk management strategy

Over the years the term and structural title of Compliance has become associated with a perception of a tick box nature, obeying the rules or guidelines of regulation with little room for dynamism and flexibility.

Is that what the industry and regulators want? What does it conjure in your mind when you think of the word Compliance?  This is what the dictionary says:

“The state or fact of according with or meeting rules or standards”

It is not exactly inspirational and equally, in the rapidly evolving world of financial crime risk management it is not particularly accurate or effective. Do you want to meet rules or standards or do you want to manage risk? Do criminals operate within a framework of regulatory guidelines? No. They are far more agile in their ability to exploit vulnerabilities.

Adopting a tick box mentality can be hugely detrimental to the success of an organisation to manage and adapt to rapidly changing financial crime typologies. You need to be using innovation and working collaboratively across teams to hit the desired effect. Yes, the lines of defence model is there for a reason and you absolutely must comply with regulations as they apply to you but more importantly you must understand why you are applying them and how you may need to adapt the concepts and even go beyond in a dynamic way. As the situation dictates you may need to go beyond the regulatory guidelines in order to meet the risks head on. It is a dichotomy that large financial organisations have been battling for years.

Would it not be refreshing to hear more about the financial crime and regulatory professions empowering business strategy, on the front foot, going beyond the norms of regulation to add maximum value to the business they support.

We think part of the problem is in the title – Compliance.  Let’s talk about risk management strategy instead.

Guilt By Association; Reputational risk for FinTech and the changing dynamics of terrorist financing

Are FinTech firms and new payments providers doing enough to manage the financial crime and reputational risks associated with terrorist financing?

Lots has been written about the changing dynamic in terrorist funding in recent months after the revelations that a $28,500 loan may have been used by Syed Farooq and his wife in preparations for the San Bernadino attack, which took place on 02DEC15 and resulted in 14 killed and 22 seriously wounded. Pre-paid or value stored cards were reportedly used by the Paris attackers to fund preparations for their attack on 13NOV15 that resulted in 130 killed and 368 wounded.  Indeed in October 2015 weeks before the Paris attacks the Financial Action Task Force (FATF) released a paper ‘Emerging Terrorist Financing Risks’where they analysed some of the evolving typologies being reported by global contributors to the study.  Of particular interest under section B & C is the assessment of fundraising via social media and new payment products and services. The horrific incidents in Paris and San Bernadino are a sign of changing landscape but are not isolated in nature as the FATF report highlights. The abuse of product offerings by FInTech firms is likely to continue as terrorists and illicit actors continually seek new ways to transfer money globally to fund their activities.  Below, we examine the detail around the San Bernadino attack to highlight some of the areas FinTech firms need to be aware of when managing their financial crime risk, and the concomitant reputational risk appropriately.  We’ve sourced our findings from the likes of the FTAlphaville, Wall Street Journal and LA Times.

To simplify the overall picture, Prosper Marketplace facilitated a loan to Syed Farooq via WebBank (the actual provider) and the packaged loan products were purchased by Citigroup for securitisation. We are not commenting here as to whether any of the organisations named in these articles did anything but complied with the applicable regulations, but even so the association is in itself likely to have an immediate or longer term reputational impact. The Google Trend analysis below clearly shows the spike of negative internet activity associated with WebBank and Prosper as a result of the San Bernadino shooting.

In fact the Wall Street Journal article suggests that Prosper Marketplace purchased the specific Farooq loan back from Citi not long after news broke of this issue, signifying the seriousness of the scenario and perceived reputational impact felt by both parties.  The FT Alphaville ‘ugly duckling’ blog post also paints a picture of WebBank as an organisation with a legacy of negative compliance findings but albeit a positive commercial outlook at the time of the San Bernadino attack.

Could or should more have been done in this specific scenario is a question we will not try and answer here and is best answered by the investigators close to the enquiry but it is a natural question that starts to pervade the commentary. One thing that is clear is that for those entrepreneurs, businesses, investors venturing into the exciting and rapidly evolving fintech, payments and online loan space it will always pay to take a long term view on how you manage these risks.  Is complying with regulation enough or when the chips are down can you or should you do more?

Photo credit: http://www.flickr.com/photos/21508313@N06/3210361238_not trying to be political via http://photopin.com