Rethinking Risk Assessments

Say “risk assessment” to a financial crime compliance professional, and you’re sure to invoke hesitation or even fear.  Though mandatory, risk assessments can be daunting, resource-intensive exercises. With new typologies and financial crime threats emerging all the time, how can firms practically rethink risk assessments for a better and more effective approach? 

In a conversation with VP of EverC Melissa Sutherland, FINTRAIL’s CEO Robert Evans and Managing Director Maya Braine unpacked some of the essential considerations for rethinking risk assessments. As risk assessments are the bedrock of your financial crime programme, getting it right is fundamental to your overall success.

Key definitions

Upholding a risk-based approach

A risk assessment is a key component of adopting a risk-based approach. Two-pronged, the exercise involves identifying your firm’s potential risks and then critically assessing them. Which risks are more likely to occur?  What is the severity of their impact? This assessment process will help dictate how you prioritise and distribute your resources. Because compliance resources are finite, moving efforts to a higher-priority risk area will mean less attention to lower-priority areas. While many firms are reluctant to shift resources away from a threat, this triaging is intrinsic to a risk-based approach. We must recognise that low risk is not the same as no risk. However, by prioritising the mitigation measures for highly-likely and high-impact threats, you are taking a risk-based approach which is, ultimately, what regulators expect. 

As new financial crime risks continue to emerge, simply adding them to a risk assessment can make it unmanageable and unsustainable. To counter this, risks should be checked and challenged. Look at the evidence and ask: is this risk still present and relevant?  If not, should it be deprioritised or removed from the assessment? It’s vital to be proportionate with your risk assessment and consider removing extinct threats as well as adding new ones.  Otherwise, the process will balloon to unmanageable proportions and your resources and effectiveness will become diluted.

Establishing cadence

Risk assessments are typically conducted once a year; however, a strictly annual approach is outdated. Ideally, and depending on the nature of the firm, risk assessments should be updated more regularly. As new financial crime risks emerge and more data is available to the compliance function, risk assessments should be re-examined. Especially for rapidly scaling firms, setting up a dynamic approach to risk assessments, which is intrinsic to how the business grows and scales, is vital.

“Six months is a long window in the life of a rapidly growing and scaling business. Things evolve very quickly, and a lot can change. What you did six months ago can become irrelevant very quickly.”

— Robert Evans, CEO and co-founder of FINTRAIL

Once a risk assessment is established, cross-reference it with output indicators, such as SARs filed. Are the real risks observed in line with those in the risk assessment? By having a lookback process, you can simultaneously address any assumptions, such as one particular jurisdiction or sector being high-risk, as well as capture changes.

---

---

Data, data, data!

One common problem with risk assessments is they can often be based on assumptions rather than factual information.  Both internal and external data sources can give you more factual indicators of where your risks truly lie.  For instance, your internal data may show you which industry types regularly see suspicious activity and feature in more investigations or SARs, which will likely be more accurate than generic “high risk industry lists” which are not tailored to your firm.  

As firms get better at capturing and utilising multiple data points, it’s important to make sure you utilise all relevant information while avoiding being overwhelmed. Risk assessments should balance using consistent data points and incorporating newer, evolving data points. Consistent and high-quality data points are important for benchmarking so a firm can track its compliance efforts and identify trends. When deciding which data points to use, consider your most significant threats. For example, if fraud is a top concern, concentrating on device ID information or biometrics might make the most sense. Allow your top-risk concerns to guide you on where to focus your efforts and which granular data points to include.

Garner insights from business teams

Suspicious activities are typically anomalous. Understanding risk and atypical behaviour requires identifying what is typical as well. Involving other stakeholders in your firm, such as customer-facing teams like relationship managers, can give meaningful insight into what regular activity looks like. As these teams have more exposure to standard day-to-day activity, they can help the compliance department create a better picture of risk factors. Without engagement between business teams, firms may have a skewed perspective of risk. For early-stage firms, having meaningful discussions with the CEO or key founders can help determine: who is the target customer base, and how would a typical user use the product? 

Document your decisions

Unsurprisingly, it’s vital to document decisions and actions when it comes to your risk assessment.  Have a clear and articulate methodology statement: what methodology are you applying, and how do the calculations work? Use data to support your decisions. For example, if there have been no SARs filed or transaction monitoring alerts raised for a particular typology, then document that as part of your justification for its removal or de-prioritisation.

“Do your risk assessment. Commit to it. Document it. If you’ve overcommitted, then adjust. Document the adjustment and continue forward.”

— Melissa Sutherland, VP of EverC

Best practices and tips

1. Use data to inform your risk assessment and create a lookback system to use your data to make sure your assessment is working as expected.

2. Be realistic with how often you can review and refresh your risk assessment, and what tools or methodologies will support it.

3. Ensure your risk assessment is proportionate to the risks your firm faces.

4. Have governance in place to make sure you use your risk assessment meaningfully.

5. Get support from expert sources - both within your business and external - to optimise your process and create practical, workable, data-driven systems.

---

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. With extensive experience assisting financial services businesses with building and conducting their enterprise and product risk assessments and customer risk assessments, we’re here to support you.

---

Earth, Wind and FinCrime: The Rise of Environmental Crime

While environmental issues are front and centre of public discourse, environmental crime often takes a backseat. Yet environmental crime impacts every country and is considered ‘low risk, high reward,’ meaning those who commit it face inadequate consequences despite reaping massive financial gains.

Environmental crime is one of the most profitable proceeds-generating crimes in the world, with the latest figures estimating it generates $110-281 billion annually, in line with the likes of drug trafficking and counterfeit goods. The repercussions of environmental crimes are far-reaching and potentially catastrophic, including climate change and ecological disasters, disease risk, food contamination, and negative impacts on human health including reduced life expectancy and death. And it’s not just the impact of the environmental crime itself - these nefarious activities fund non-state armed groups and militia, making up 38% of their income, and have links to human trafficking and slave labour.

Given its status as a growing threat, the European Union added environmental crime to its list of predicate offences in the Sixth AML Directive. However, it remains a difficult crime to identify due to its wide-reaching nature. This article looks at two areas in which organised crime groups (OCGs) have involved themselves, forestry crime and waste trafficking, and identifies ways for financial institutions to tackle the issue.

Illegal deforestation and logging 🌲🪵

Forestry crimes can generally be grouped into two camps: illegal logging and land clearing.

Illegal logging - When timber is harvested, processed, transported, bought, or sold in breach of laws and regulations
Illicit land clearing - The unlawful acquisition and clearing of land for farming, building or real estate speculation

Both of these types of green crime often involve deep-seated corruption, from illegally-obtained logging licences to illegal timber plantations. A recent investigation by the International Consortium of Journalists (ICIJ) exposes how unregulated the forestry industry is, with ‘green certifications’ being given to products linked to illegal clear-cutting and authoritarian regimes such as in Myanmar.

FINTRAIL highlights: Global Witness

Global Witness is an international NGO investigating the link between natural resources, conflict, and corruption worldwide. Watch our interview with Global Witness founder Patrick Alley, whose first campaign was exposing the illegal timber trade between Cambodia and Thailand, which was funding the Khmer Rouge guerillas.

Click ‘FFECON22 On-Demand’ for the interview.

Beyond the obvious destruction of wildlife and ecosystems, illegal logging destroys communities, causes human rights violations, and causes massive tax revenue losses for governments. Like in wildlife trafficking, intermediaries, exporters, and retailers stand to make the bulk of profits, with lower-level actors in the supply chain receiving only minimal amounts of the proceeds. As illegal logging is the most profitable natural resource crime in the world, bribery, fraud, and corruption are commonplace. Criminals have even resorted to hacking government websites to obtain permits. 

One difficulty with identifying illegal logging is the tendency for criminals to commingle goods, blending illegal wood with legally sourced timber. Illegal goods like tinder are challenging to differentiate from their legal counterparts, unlike narcotics which are easier to identify.

FINTRAIL highlights: Tree Thieves: Crime and Survival in North America’s Woods by Lyndsie Bourgon

In an investigation into illegal tree cutting, Lyndsie Bourgon looks at the black timber market in the Pacific Northwest. Following three timber poaching cases, Bourgon incorporates interviews with police, former loggers, Indigenous communities and international timber cartels to illustrate the complex environmental and social issue. To join FINTRAIL’s monthly FinCrime Book Club and discuss great books like Tree Thieves with like-minded fincrime enthusiasts, click here or get details of the next meeting here.

Waste trafficking  🗑

Garbage is big money and dirty business. A grossly under-discussed crime, waste trafficking is a lucrative business estimated to generate $10-12 billion annually. Illegal activities concerning waste trafficking involve trade that violates import or export bans (for example, the Basel Convention, which bans the movement of hazardous waste from OECD countries to developing countries) or the illegal and improper treatment of waste through disposal, incineration, or recycling. 

Both legitimate waste management businesses and criminal organisations can engage in illicit waste trafficking, with the latter often using legitimate waste management companies. With this strategy, criminals can easily blend illicit proceeds with legitimate funds, masking their nefarious origin. Criminals may also forge documents to mislabel waste as recycling or second-hand goods or to miscategorise hazardous waste as non-hazardous.

Illegal dumping

OCGs using waste management front companies employ sub-standard disposal or storage processes, sometimes engaging in illegal dumping. These practices have tremendous cleanup costs and pose a direct threat to public safety. One example that made headlines worldwide was the Camorra, an Italian mafia group centred around Naples, that burned toxic waste in the Italian countryside for decades, contributing to increased cancer rates. More recently, a 46-hectare site in Northern Ireland, known as the Mobuoy dump, was exposed as one of Europe’s largest illegal waste sites. As a result of Mobuoy, toxins have leached into the groundwater and river, causing serious health effects on communities and the ecosystem. Among the dangerous materials are asbestos and arsenic, with a cleanup cost estimated to be £100 million.

Sadly, because of the trajectory of global waste flows, most illicit waste ends up in the developing world. In its research, the Financial Action Task Force (FATF) identifies parts of Sub-Saharan Africa, Southeast Asia, and Central and South America as primary destinations. However, recent media reports have revealed Romania and Bulgaria as growing sites for illicit waste from Western Europe.

Aside from the environmental impacts, the waste industry has ties to human trafficking as a source of cheap labour. According to one non-profit organisation, two-thirds of modern slavery victims have worked within the waste industry in the UK. There is growing evidence that illicit waste trafficking is converging with other illegal goods, including instances of waste businesses used as a front for prostitution and drug trafficking. In one case, cocaine and other narcotics were hidden in garbage to avoid detection, before being shipped to Turkey.

Laundering the proceeds of environmental crime 💵

Money laundering methods for environmental crimes are similar to other predicate offences. Front companies and front persons are commonly used to commingle profits with varying degrees of sophistication, though experts have noted waste trafficking operations can be less complex than forestry crimes.

Like other transnational crimes, shell companies are frequently used to hide beneficial owners. In addition to intermediaries such as lawyers, accountants, trust and corporate service providers, freight forwarders and customs brokers play a notable role in facilitating the illicit trade. Trade-based money laundering techniques are also used, including forging import and export documents, under- or over-invoicing, issuing multiple invoices of goods, over-shipments and under-shipments, or the complete fabrication of transactions.

Case Study: Scrap iron

As reported by EuroJust, one OCG unlawfully acquired around 165,000 tonnes of scrap iron through iron recycling companies in Italy and abroad. The OCG declared the iron was imported from Germany, and reintroduced it directly into steel mills and the legal market.

A fake German business with connections to the OCG issued false invoices to acquire the scrap iron. The criminal network brought money into Italy, including €70 million in cash taken from German bank accounts. The funds were transferred between several fake companies managed by the OCG in Germany and other countries. The profits were invested either in the illicit trafficking of waste or laundered through legitimate activities such as the acquisition of a football team in Italy. Despite false documents, the scrap iron was never cleaned or recycled. The OCG also manipulated large quantities of special and hazardous waste, such as tar, obscuring its real nature with false certificates.

What should financial institutions be doing?

For financial institutions looking to strengthen their anti-financial crime programmes against environmental crime, assessing screening procedures is vital. Non-governmental organisations that focus on reporting and investigating environmental crimes can help firms identify bad actors, with links identified through adverse media screening. Additionally, financial institutions should consider putting customers involved in higher-risk industries such as forestry, wildlife, and waste management under enhanced due diligence measures.

---

At FINTRAIL, we combine deep financial crime risk management with industry expertise to optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out how we can help you fortify your controls against environmental crimes in a practical and efficient way.

---

Measuring the Maturity of Your FinCrime Compliance Programme

Through their recent communications, the Financial Conduct Authority (FCA) and Central Bank of Ireland (CBI) map out clear supervisory expectations of how financial services firms manage their growth and associated risk management framework and governance arrangements. Often it does not keep pace with the growth in business activities; with strategic ambitions outpacing frameworks and capacity.

Considering the rapidly changing environment and emerging risks that the industry faces, firms need to proactively manage the alignment of growth and compliance. To ensure the safety and soundness of firms and to protect their consumers, it is incumbent on firms to assess that their controls and governance model are fit for purpose and support the level of maturity of their operations.

FINTRAIL Maturity Model 

FINTRAIL uses a bespoke Maturity Model to assess maturity levels across different aspects of a firm’s anti-financial crime (AFC) programme. This enables firms to review their operational effectiveness and identify potential capabilities they need to develop or acquire. Firms can also use the model to systematically analyse and assess their progress over time.

Key areas for a financial institution to consider when conducting a maturity assessment of its AFC programme:

1. Control framework

2. Documentation and record retention

3. Governance framework

4. Staff expertise

5. Group-wide fincrime awareness

6. Second and Third Lines of Defence structure

Additional areas where a maturity assessment can be conducted:

1. Roles and responsibilities

2. Regulatory, AML and sanctions policy awareness

3. Audit and conformance structure

4. Whistleblowing

5. Learning and development

6. Systems and controls assessment

• Due diligence

• Screening

• List reviews

• Transaction monitoring

Below are the definitions that can be applied to measure the maturity levels of areas within the scope of the assessment:

1. Intelligent - The firm has adopted measures which are capable of meeting both interim and strategic requirements and are tailored to meet all kinds of scenarios. The firm has invested in good governance and has knowledgeable subject matter experts at the forefront of decision making. The firm conducts regular reviews of its policies and procedures, and its three lines of defence structure is well defined and fully functional.

2. Integrated - The firm has adequate levels of controls to meet regulatory expectations and has robust validation through second and third lines controls. It has an adequately resourced team of anti-financial crime experts supporting all its business teams, with a good understanding of commercial aspects of the business. It conducts regular validation of its three lines of defence structure. 

3. Defined - The firm has sufficient controls to meet the minimum regulatory requirements with a scope for review on a periodic basis. The firm has a formal approach to decision making and has a good awareness of the requirements for its anti-financial crime framework.  It has a relatively small team of financial crime experts who are not necessarily at the senior management or decision making level.

4. Fragmented - The firm has some of the required financial crime controls in place but needs to develop consistency around governance and decision making, and to expand and develop its processes to work beyond crisis management.  It also still needs to introduce assurance and quality validation by the second and third lines of defence. The firm requires more expert resources to support all the relevant operational disciplines.

5. Ad-hoc - The firm has basic levels of controls to combat financial crime. It has poor documentation and governance controls which require immediate review. The firm also lacks the required internal expertise and does not have a defined three lines of defence model.

Why use a maturity model

1. Current state assessment - A maturity assessment can help a firm to assess the current state of its framework, or a particular aspect of its products and services. It enables the firm to check if it is doing well enough to meet minimum regulatory requirements for fighting financial crime. It gives the firm an overview of its stress acceptance capability and can help prepare for adverse situations like disaster recovery.

2. Effectiveness: Senior management can identify redundant or ineffective controls, enabling them to redeploy resources to achieve efficiency gains and make the anti-financial crime programme more effective.

3. Overview of controls - The maturity model gives a bird’s-eye view of the firm’s controls and reveals if the framework is complete or if there are gaps.

4. Area for enhancements - The model identifies any areas that require attention and lets firms prioritise development areas and remediation exercises accordingly, in order to achieve higher maturity levels.

5. Better project management - The output from the maturity model can allow firms to apply ‘lessons learned’ and plan future projects in an effective and efficient manner. 

6. Assessing progress - The assessment provides an objective view of a firm’s process and framework, which enables it to measure its future progress according to objective, consistent evaluation factors.

Difference between a maturity model and a risk assessment

As part of AML regulations, firms are required to complete periodic risk assessments to identify their risks and review their control frameworks.  Per the Financial Conduct Authority (FCA) Handbook (SYSC 4.1.1), all entities are required to conduct a risk assessment which will help them to identify the financial crime risks to which they are exposed and to assess their controls.

A maturity model assessment is advised as part of the FCA IT Maturity Assessment under MiFID II general guidance. The output from a maturity assessment is designed to help conduct an enterprise wide risk assessment, by identifying areas of risk in advance.  It helps firms prioritise the areas of immediate concern, and integrates closely with other operational risk frameworks to remediate the issues.

Examples of a good and bad maturity model

FINTRAIL’s maturity assessment process

For our assessment process, FINTRAIL reviews the areas within the scope of the maturity model against the benchmark established by industry peers and minimum standards of operational effectiveness outlined in the relevant regulations.  The steps taken are as follows:

• Identification of scope and the areas for review

• Agreement of the factors to be used  to rate maturity levels

• Project initiation meeting

• Production of a draft Maturity Assessment report

• Review of the draft report and incorporation of feedback

• Submission of final Maturity Assessment report with red-amber-green (RAG) status for individual programme areas

Snapshot of Maturity Model 

CLICK TO VIEW

---

At FINTRAIL we are passionate about combating financial crime. Our unique and diverse team has extensive hands-on experience developing and deploying risk management controls and using real-life examples to bring best practices to life. We provide deep-dive, qualitative assessments of the maturity of financial crime programmes for FinTechs, banks, and other financial institutions. 

If you are interested in conducting a maturity assessment or would like to get a better understanding of the services provided by FINTRAIL, please get in touch.

Corporate Transparency: A Global Stocktake

The past few months have seen significant global developments around the key issue of corporate transparency.  Earlier this month, the Financial Action Task Force (FATF) issued guidance on its revised Recommendation 24 on beneficial ownership, introduced in March 2022.  The revised recommendation and the guidance make clear that states should adopt central, public beneficial ownership registries, although stop short of making this an explicit requirement.  They also call for a “multi-pronged approach”, i.e. a combination of different mechanisms to collect ownership information, and state that the information should be verified.

The FATF changes were positively received by industry figures and transparency campaigners, who say they significantly strengthen the international standard for transparency.  Beneficial ownership transparency is gaining momentum globally, with over 100 countries committed to implement reforms, and G20 and G7 leaders committing to implementing the FATF standards.  Yet while anti-financial crime professionals are clear on the value of corporate registries (when done right), politicians and lawmakers are not always aligned on how best to implement them.  A core divergence surrounds privacy and public access to information, coupled with longstanding issues on accuracy and reliability.

Against the backdrop of the new FATF guidelines, we explore the most recent developments in corporate transparency in key jurisdictions, and what they mean for the fight against money laundering and terrorism.

UK

In some respects, the UK has the potential to set the standard in corporate transparency. Its stipulated disclosure requirements and the accessibility of its records are amongst the most comprehensive of any major jurisdiction.  However, even a cursory look under the bonnet quickly reveals some significant weaknesses.

Corporate records are held by Companies House, the government-run UK registrar.  To strengthen its ownership information, Companies House introduced a register of People of Significant Control (PSC) in April 2016. Freely available to the public, who can search by looking up both legal entities and individuals, it became a key KYC tool for many UK financial institutions - one that does not exist in some other advanced countries (nod to the US here). That said, Companies House has repeatedly come under criticism for how its records are maintained.  Companies House lacks the power to check and query data provided by reporting companies, providing ample opportunity for criminals to submit false data in order to create seemingly legitimate companies.  The use of UK corporate structures in numerous money laundering scandals has been well-documented; most recently media outlets have reported how fake UK companies are increasingly used for fraud, including so-called ‘pig butchering’ cases. 

“Analysis has identified 168 UK companies accused of running fraudulent cryptocurrency or foreign exchange trading schemes, with around half of these likely to be linked to pig-butchering scams.”

— The Guardian

As a result, there have been vocal calls for reforms of UK corporate records across the public and private sectors.  Following the Russian invasion of Ukraine in February 2022, HM Treasury took swift (but in the eyes of many, long overdue) action to tackle dirty money in the UK and the abuse of the financial system by criminals. Part One of the Economic Crime Act 2022, fast-tracked into law in March 2022, created a Register of Overseas Entities (ROE) designed to crack down on foreign criminals using UK property to launder money. This law requires any foreign business holding property in the UK to register with Companies House as an ‘overseas entity’ and disclose who controls them. 

Reforms of Companies House featured heavily in Part Two of the Economic Crime Bill, heard in Parliament in October 2022. The Bill will equip the “data-house” registrar with new powers to act as an active gatekeeper upholding the accuracy and reliability of the data it collects.  The identity of all directors and PSCs will be verified, meaning there will finally be some checks confirming that anyone who sets up, owns or runs a company is actually who they say they are. Companies House will also have enhanced powers to remove companies from the register and proactively share information with law enforcement if there is evidence of anomalous filings or suspicious behaviour.

However, questions remain about whether the reforms go far enough. As of 31 January 2023, when all initial ROE disclosures should have been filed, research by Transparency International UK showed that 56% of all assets held by offshore firms in the UK were still held anonymously, while 12% claimed to have no beneficial owners! Whilst it is still early into its existence, the true test for this and wider Companies House reform will be the effectiveness of enforcement activity, the provision of additional resources, and actions taken to pursue those who abuse the system. Watch this space!

US

Across the pond we have seen a lot of debate over the US’s move to create a database of beneficial ownership information. The Corporate Transparency Act (ACT) of January 2021 introduced the notion of a requirement to report beneficial ownership information, implemented by a Reporting Rule issued in September 2022 and due to come into effect on 1 January 2024. The reporting requirements will apply to both domestic and foreign entities operating in the US. 

Initial reaction to the implementing Notice of Proposed Rulemaking (the “Access NPRM”), issued by FinCEN in December 2022, was muted and has since become more critical. The proposed rule aims to balance a useful database for authorised recipients against protecting sensitive information from unauthorised access. In practice this means there will be only a limited information retrieval process to protect unauthorised or inappropriate use of the register. Instead of open-ended access like the UK, US financial institutions will have to submit identifying information for a company to receive an electronic transcript with the beneficial ownership information. Furthermore, only some financial institutions would have access (cryptocurrencies firms, for instance, would not) and the company in question would have to consent to this access. Once information has been received it can only be shared with personnel in the US, limiting access within multinational institutions. With implementation looming in less than nine months, it seems the practical considerations of this are yet to be worked through, in terms of how consent is achieved, what this looks like for existing vs new customers, and if the burden of access outweighs the use of the database. 

Industry bodies have been highly critical of the proposals. The American Bankers Association’s (ABA) called the proposal “fatally flawed”, saying it will provide “limited, if any, value to banks” and asking FinCEN to withdraw it.  Other industry bodies such as the Institute of International Bankers have urged FinCEN to consider real-time access and automated bulk request processing, and to lift the restriction on using the database only under the scope of the CDD Rule rather than “all customer due diligence requirements under applicable law”. They claim the operational burden to maintain the information and restrict its use may disincentive firms from using the system.  The ABA argues the proposal will create “significant redundancies and inefficiencies within banks’ AML/CFT compliance programmes”.

“The proposal creates a framework in which banks’ access to the Registry will be so limited that it will effectively be useless, resulting in a dual reporting regime for both banks and small businesses.”

— The American Bankers Association

Adding fuel to the fire, the proposed beneficial ownership information form that companies must fill in, shared by FinCen on 17 January 2023, allows firms to report that their beneficial ownership is ‘unknown’, enabling them to opt out of sharing the very information the CTA requires. The Financial Accountability and Corporate Transparency Coalition’s response to the proposal aptly summarised this as “an absurd result that FinCEN must avoid in promulgating”.  

With the proposed limited and inefficient access, narrow scope of application, restrictions on sharing information, and ability to opt out of reporting information, many are asking whether the initiative has failed before it has even started. It certainly does not seem to meet the new FATF standard, which states information should be “adequate for identifying the beneficial owner” and publicly available. With FinCEN erring on the side of caution in prioritising privacy concerns, it is devaluing the value of the new registry at the expense of other important principles.

EU

In a surprising move, in November 2022 the Court of Justice of the European Union in Luxembourg ruled that the EU law-mandated beneficial ownership register regime was in fact unlawful. Making beneficial ownership information accessible to the public as required by EU money laundering directives was declared 'invalid'. The court found that the Fifth Anti Money-Laundering Directive requirements to create a beneficial ownership register regime accessible to all did not comply with Articles 7 (right to respect private life) and Article 8 (data protection) of the EU Charter on Fundamental Rights. The court found that the amendment is a “serious interference with the fundamental rights to respect for private life and to the protection of personal data”. Any person wishing to view the beneficial ownership data did not have to demonstrate a “legitimate interest” in doing so, creating a regime which allows for privacy intrusions.

Initial reactions to this ruling were strong. Many have seen it as a step back in corporate transparency.  As summarised by Transparency International, “At a time when the need to track down dirty money is so plainly apparent, the court’s decision takes us back years.” In addition to the general public, the ruling impacts a number of professional groups who access registers to support the valuable work they do in uncovering corruption and dirty money, including journalists, academics and foreign government bodies. Whilst the ruling did state that certain roles in the media and other sectors could have a ‘legitimate interest’ in accessing public registries, it is not yet clear how this could work in practice.

“At a time when the need to track down dirty money is so plainly apparent, the court’s decision takes us back years.”

— Transparency International

Some countries including Luxembourg, Belgium, Austria and the Netherlands reacted swiftly to the ruling, closing public registries to those without a legitimate interest.  Ireland’s online registry now displays the following message: “RBO [Register of Beneficial Ownership] has restricted access to search the register to Designated Persons and Competent Authorities only, with very limited information being available to other parties in accordance with the recent ruling of the Court of Justice of the European Union.” 

As we look forward, many are anticipating how the sixth money laundering directive will address this issue. Understanding how those with a legitimate interest in this information will maintain access, allowing them to continue promoting corporate transparency and conducting investigations to uncover illicit flows, is key. Prior to the ruling, the European Union had demonstrated clear movement in the right direction in terms of corporate transparency. What the ruling means in the long term is yet to be determined, however it is to be hoped the previous momentum continues and the commitment to pushing for corporate transparency remains.

At FINTRAIL, we use our regulatory expertise to help clients keep their anti-financial crime programmes and governance structures in step with the latest regulations and official guidance.

Please get in touch if you would like support with designing, reviewing or enhancing any aspects of your anti-financial crime framework.

---

Crossing Countries: Lessons Learned from Globetrotting FFE Members

Fighting financial crime has always taken an international perspective, requiring global anti-money laundering standards and cross-jurisdictional information-sharing. But what about the financial crime fighters who are instrumental in building firms’ defences and catching bad actors?

What lessons can be learned from working in a different country with foreign regulations and cultural nuances? And what value can FinCrime professionals get and give from working in different corners of the world?

As one of FINTRAIL’s international hires and someone who works from different countries frequently (thanks to FINTRAIL’s progressive digital nomad policy 🎉) — I connected with three members of the FinTech FinCrime Exchange (FFE) who have lived and worked in foreign countries to find out.

If you’re a FinCrime professional curious about moving to another country for work, read on for some peer-driven wisdom, insight, and invaluable advice.

🇦🇪 UAE

Shruti moved from the UK to work for a Dubai-based FinTech in September 2022. She describes her experience as “amazing” while noting the inherent challenges of working in a new environment with different rules. The UK, which is a major global financial centre with a structured financial services system and long-established, well-regarded regulators, is contrasted to the UAE. In this region the financial free zones such as the Dubai International Finance Centre and the Abu Dhabi Global Market have been set up more recently. As the country is relatively new, its legal system and regulatory landscape is extremely agile, rapidly changing and evolving.

While a lot of the payment services regulation for the Dubai Financial Services Authority is similar to that of the Financial Conduct Authority in the UK, the complexity in the region lies in practical differences like identification documents, proof of address, and business communication styles. Unlike in the UK, business communication often happens through informal non-traditional channels. Shruti describes working informally with third-party partners in a positive light:

“we will exchange voice notes on WhatsApp to discuss arrangements which is really useful. We continue to maintain an audit trail via official channels, but this almost informal communication helps you build relationships better.”

When asked what advice she would give to a FinCrime employee looking to cross countries, Shruti says,

“Keep an open mind as to how that individual country operates and its own complexities within its own regulatory landscape. I think I assumed at times that I could easily apply regulation that I was familiar with to various jurisdictions but this didn't take into account the nuances of each country and it's way of operating. There's a social, economic and political view to also consider. You need to get to the country to work out what they do, how they do it and why they choose to do it in a particular way. So make sure you don’t get lost in your previous experience and just be very open to different ways of working and educating yourself.”

🇦🇺 Australia

David moved to Australia from the UK to work for a FinTech remittance company. In addition to favourable weather and a different pace of life, he discovered many regulatory similarities between the two jurisdictions. On key differences, David notes,

“the main thing that was difficult to adjust to was how involved some of the transaction reporting or customer information reporting obligations are. That’s something we don’t have in the UK.”

Overall, the Australian Transaction Reports and Analysis Centre and the Australian Federal Police are highly engaged: “There’s a clear line of communication and transparency of communication about their intentions when they come and speak to regulated firms and the work on all the requested information around cases or financial crime investigations”. The involvement, transparency, and feedback around financial crime investigations was incredibly motivating, making David’s team “feel really engaged with the process of stopping financial crime”. Chalking it up to Australia’s regulatory culture he says,

“there are very clear lines of authority here whereas in other countries there’s a more nuanced approach. This clarity transfers into how Australia’s set up their infrastructure for fighting financial crime.”

Beyond solid engagement with the regulator and law enforcement, adjusting to regional financial crime risks was also vital. For example, in the case of Australia, this meant being mindful of the South Pacific drug shipment corridors where a lot of the risk management is focused.

When asked to share wisdom for FinCrime professionals headed abroad, David said, “Do some homework. Go read the regulations before you get there but don’t be scared if you don’t know them backwards. Look at the intention of the law. Secondly, in our current remote-first environment, spend time in the office because you’re going to want to get to know your team.”

🇸🇬 Singapore

Genevieve has lived and worked in Singapore for the last five years, having previously lived in the UK and Australia. Speaking fondly about her time in the culturally-diverse Wise office, she recounted some of the unique experiences and exchanges that make living abroad so special. From a FinCrime perspective, being in Singapore for a significant time allowed her to witness major regulatory developments, like the expansion from manual to technology identification verification. “When I first joined, there was a piece of work done to lobby the Singapore government around face-to-face verification,” she recalls. Seeing the progression and regulator’s acceptance of online verification and the use of technology has been “really cool”. Noting the regulator’s openness and eagerness to understand and engage, Genevieve points to newer collaborative developments, such as the efforts of the Singapore Police, the Monetary Authority of Singapore, and the FinTech community to discuss escalating scam rates. Being part of these collaborative experiences add to your toolkit as a financial crime fighter, no matter which country you work in.

When asked to provide advice to other FinCrime professionals considering moving countries, Genevieve shares,

“Go for it. Don’t wait. You become so much richer for moving to other markets and understanding the FinCrime priorities and how that translates into the local rules. It’s also a great opportunity to share your experience locally. So don’t wait; go for it.”

If you want to feel connected to the international FinTech community, see job postings, or share and learn about typologies —  join the FFE today.

For a practical and comprehensive overview of fincrime risks, regulatory risks, and operational issues in some key markets — check out our Know Your Market guides. 

---

External support for remediations: When is it right for you?

Remediation programmes are often complex, protracted, and not a lot of fun. Whether it’s due to a spike of alerts, remedying control failings, or fixing regulatory findings, managing it alongside the day-to-day can be tough.

Our guide, ‘Follow The Yellow Brick Road: A Pathway to Successful Remediation’ highlights that a crucial part of remediation planning is knowing when to seek external support. Often firms wait too long to engage external consultancy support; things have already gone wrong, deadlines have been missed, and the pressure to deliver is high.

How to determine whether you need support

There is no one size fits all approach to managing remediation programmes. Sometimes, your remediation programme may not need a consultancy firm to assist; you may have surplus resources to deploy or the scope is small. In our guide we shared some key questions you should consider when assessing if your remediation needs external support.

1. Can you realistically balance BAU with any remediation activity required?

2. Do you have the expertise to resolve the root cause which is prompting the remediation in the first place?

3. Did current operational processes cause the remediation, and does this need to be enhanced prior to commencing?

4. Do you have the internal skill-set to run or execute the remediation?

5. Do you need access to a flexible pool of resources? How quickly can they be deployed? 

6. If you hire contractors, do you have the internal team leadership resources to manage them? 

7. What level of resources do you need - analysts, project managers, etc.?

6 best practices for remediation programmes

At FINTRAIL, we believe there are some fundamental elements to managing remediation programmes which we outline below. Working with a trusted partner means you have access to the right resources, dedicated focus and support to deliver a sustainable and successful remediation programme.

1. Do it early 

If you are considering bringing in an external firm to support a remediation project, we advise doing it early. Getting your programme structure and plan right from the outset is needed to ensure you deliver on budget and on time. We have learnt that remediations can get very complicated very quickly. Having a trusted partner to manage and troubleshoot can avoid spiralling costs and deadlines.

2. Root it out

Recent regulatory enforcements have shown that poorly managed remediation or transformation programmes can compound the original issue and lead to even more costly programmes to resolve. Remediations are often more than hiring temporary workers to clear the backlog of alerts. What comes before that is understanding and fixing the root cause to ensure that the forward-looking process is fit for purpose and, more importantly, avoid issues down the line.

3. Project management

Many heads of compliance are not project managers. While much of the role is managing different deadlines, resources and budgets, the skillset needed to deliver a remediation project differs. And more often than not, business as usual (BAU) is managed alongside remediation. Navigating remediations requires experienced teams with proven processes and methodologies.

4. Manage the narrative

This is a key theme throughout. Working with external consultants can help you define the narrative in your remediation. What are you remediating? Why are you remediating it? How will you remediate it? When will you remediate it? These are all critical components of your remediation narrative, but it's often easy to lose sight of them. Working with an external consultant can help you stick to this narrative, deal with new workstreams as they arise (they often do!), and manage the communication flow to all stakeholders.

5. Think about the end game

The relief of clearing a backlog or fixing a control is immense. But doing it without appropriate oversight and governance could come back and bite you. Managing quality through the project and having independent assurance to sign off a remediation programme is crucial. The proper oversight, challenge, and sign-off of your remediation programme will mean that you don’t need to worry about the issue rearing its head again down the line.

6. Flex your resources

Knowing how many resources you need and how to manage them can be a complicated process. What you need in phase one, will not be the same in a later phase. Different skill sets will be required at different stages, and for varying lengths of time. Having access to pre-vetted flexible resources that can be deployed at pace, and with the right skills can make a big difference on both output quality and your bottom line.

Whether you need someone to manage the project end-to-end, provide specialist advice, deploy flexible resources or provide independent sign-off, FINTRAIL supports remediation activities of different types and scales.

Why FINTRAIL?

FINTRAIL have proven experience in leading and delivering remediation programmes across the anti-financial crime lifecycle. Whether you need to redesign your target operating model, remediate CDD files or deal with a spike in alerts, FINTRAIL can provide the expertise and resource to support your remediation.

Impressive credentials: FINTRAIL is an anti-financial crime consultancy focused exclusively on the needs of global financial institutions. Our unique team of experts is drawn from the industries we support and has deep hands-on experience from leadership roles with market-leading firms.

Proven track record: We have demonstrable experience in assisting regulated entities navigate complex regulatory issues relating to customer due diligence, transaction monitoring and other anti-financial crime processes. We are very aware of the challenges the industry currently faces. We will leverage this knowledge to help you successfully navigate any remediation activity.

Tailored approach: Our approach is customised to each client’s unique circumstances, is regulatory and technology-driven, and focuses on providing excellent customer outcomes. We offer our clients pragmatic solutions to the most complex challenges. Our goal is to ensure our clients can thrive, free from the negative impacts of financial crime.

Scale and flexibility: We can assign experienced subject matter experts quickly and can rapidly deploy cost-efficient and flexible resources on demand.

---

“Collaboration, Collaboration, Collaboration” 🤝

We all agree that working collectively is the only way to make headway in the fight against financial crime. To that end, FINTRAIL and the FinTech FinCrime Exchange (FFE) have been proud to participate in several industry initiatives in 2022, working with a range of private and public sector organisations.

1. The FFE has participated in the National Crime Agency (NCA) SAR Reform Programme monthly sessions, and in a number of working cells of the National Economic Crime Centre (NECC) Public-Private Partnerships.

2. In partnership with the Royal United Service Institute (RUSI), FINTRAIL has formed a ‘FinTech Financial Crime Policy Group’ which brings senior members of the FinTech community together to discuss regulatory issues which prevent them from efficiently and effectively combating financial crime. We have hosted sessions with HM Treasury, the Home Office and the Payment Systems Regulator on amendments to the Money Laundering Regulations, AML regime effectiveness and authorised push payment (APP) fraud mandatory reimbursement.

3. Also alongside RUSI, we have provided training sessions on FinTech and terrorism financing as part of Project CRAAFT (Collaboration, Research and Analysis Against the Financing of Terrorism), an academic research and community-building initiative enhancing CTF capacity across the EU.

4. We have taken part in an APP Fraud TechSprint held by the Financial Conduct Authority (FCA), and have applied to be a rotating member of the FCA’s Innovation Advisory Group next year.

5. We participate in events organised by the Singapore Fintech Association (SFA) and the British Chamber of Commerce and UK Department of International Trade (DIT) in Singapore, which have included round table discussions with the Monetary Authority of Singapore (MAS) and the FCA.
   

We look forward to continuing these partnerships and forming others over the course of 2023 💪 

If you want to learn more about what we do or would like a chat with one of our team about any of our services, please get in touch.

---

FINTRAIL New Year message

Happy New Year from everyone at FINTRAIL! 

We’re excited to jump back into action and get stuck into our plans for the year.  A LOT happened in the financial crime world in 2022, and 2023 is likely to be just as busy.  

While making predictions is a fool’s game, here are some key themes we think are likely to be on the agenda this year:

• Increasing efforts to tackle fraud in multiple jurisdictions, including the UK where the House of Lords issued a report on “Fighting Fraud” and the Payment Systems Regulator introduced a plan for mandatory reimbursement of authorised push payment fraud.

• Increasingly mature and rigorous regulatory frameworks for cryptocurrency, especially following the explosive collapse of FTX in November 2022

• Evolving discussions on transparency and beneficial ownership in Europe, following the European Court of Justice’s November ruling that unrestricted public access to beneficial ownership registers violates the Charter of Fundamental Rights of the European Union

• A growing focus by regulators and industry bodies on effectiveness and outcomes over tick-box compliance

What’s happening at FINTRAIL?

Closer to home, here’s a quick overview of what we are up to over the next few months, and where we plan to focus our efforts over the coming year.

1. We’re refining our key services for financial institutions including audits, remediations, regulatory enforcement assistance, and target operating models. As ever the focus will be on innovative tech-driven approaches that focus on demonstrable and effective outcomes as well as regulatory compliance.

2. We will continue to work with and offer services to RegTechs and other vendors servicing the financial sector, covering advisory support, regulatory and market research, and the production of financial crime thought leadership including white papers, blogs, multimedia content, and webinars.

3. We’ve been developing a suite of off-the-shelf products for smaller or scaling financial institutions. So far we have launched transaction monitoring keyword lists, merchant category codes list, standard industry classification list, and outline AML / CTF policy. Keep an eye out for new releases including an MLRO report template and board reporting pack.

4. And finally, come and join us at one of our upcoming events! We’re hard at work on the plans for our annual conference in May - FFECON23, as well as a webinar on regulatory enforcement trends in January, an FFE social event in February, and a bootcamp on financial crime investigations in February / March.

We look forward to engaging with our wonderful network of clients, partners and friends in the coming months and wish you all a very prosperous and successful 2023!

If you want to learn more or would like a chat with one of our team on what 2023 holds for your financial crime team, please get in touch.

---

AML Challenges for FinTechs: Insights for the Future

Discover what AML challenges are currently at play, the trends that shaped 2022 and what to expect in 2023.

A new white paper from Refinitiv, produced in collaboration with FINTRAIL, unpacks some of the key AML challenges facing fintechs today, and explores how companies in this evolving sector can best manage AML compliance.

Based on exclusive interviews with experts in different fintech industries and geographical markets, this paper provides practical insights and advice for navigating the current and emerging challenges in the AML space.

---

Why AML Needs AI: Debunking the Myths for FinTechs

Download the exciting new white paper, ‘Why AML Needs AI: Debunking the Myths for FinTechs’, co-authored by FINTRAIL and Resistant AI.

We debunk some of the common myths around AI adoption, discuss the benefits AI can bring to firms of all sizes and offer practical guidance for achieving concrete outcomes.

---

Rapid Fire Remediation Q&A

Remediations are challenging, often pushing financial crime teams beyond their capacity and immediate capabilities. Many firms need additional resources, support and guidance throughout the process. And the same key questions are repeatedly asked.  

To tackle this, grab a cuppa and let’s chat about all things remediation in this rapid fire Q&A. In five questions, James Nurse, Managing Director at FINTRAIL and Ian Christie, Senior Resourcing Consultant, answer your most pressing remediation queries.

Q1. What types of remediation programmes can FINTRAIL support?

At FINTRAIL we cover the full spectrum of remediation issues, whether that be issues with controls and associated enhancements, backlogs, or adapting requirements across BAU processes and first line activities. This could be new customer due diligence backlogs but also existing customers’ periodic reviews, trigger files and EDD files. We also remediate activities associated with ongoing customer management such as transaction monitoring, suspicious activity investigations and reporting, and customer screening activities for sanctions, adverse media and PEPs.

Q2. What are the various stages of preparing for a remediation project?

Before you even dream of starting a remediation, the big question is ‘What caused the remediation in the first place?’ You want to conduct a thorough gap analysis on two main elements. Firstly, ‘Is the current operational process fit for purpose?’  Secondly, ‘Is the data that you're working with in a fit state that can actually be used?’  

Once you're done this you can then think about producing procedures, workflow and training materials, and putting together a test squad in order to run the process to make sure it works and you’re getting quality output from the start.

I guess for me, it's the planning piece - making sure you understand the root cause of the issue before you dive in, but also your plan of attack to resolve it. Without proportionate planning you don't set yourself up for success. Making sure you've understood the scale, timings, how long things take, and quantifying this into an actual plan in terms of how much resource you will need.

Q3. How do you take steps to ensure a remediation project is successful?

There are a few key aspects that you need to consider when approaching your remediation.

1. Open and clear communications with the team and keeping everyone updated on progress.

2. Setting process, procedures and goals from the start, which need to be well tested and robust.  

3. Ensuring that targets are achievable and are tracked throughout. 

4. Managing potential blockers quickly and effectively to stop bottlenecks. 

5. Having brainstorming sessions with the team to get feedback on any improvements and embed if possible.

Q4. How does FINTRAIL ensure clients are in the best place during a project?

During the project we allow an element of flexibility in the resourcing. We offer flexible resourcing that can be scaled up or down as needed. It allows spikes to be managed before they get too high. Sometimes you need more staff to manage the alerts or manage the output itself. 

Ultimately, it’s about working with the client to optimise processes, helping out on configuration activities to reduce false positives and be effective and efficient, whilst still identifying and managing the key controls and risks they need to look at.

Q5. Who manages the remediations projects and how do you ensure they are a good fit for your clients?

We have an experienced and pre-vetted bench of over 200 seasoned financial crime professionals ranging from operations managers and project managers, to analysts and investigators with FinTech, payments and banking backgrounds, across multiple jurisdictions and with a wide range of language capabilities. We maintain that bench on an ongoing basis with up-to-date CVs and targeted interviews to ensure everyone has the skills and experience that align to the project and the firm that we are working with.

Find out more about our remediation and flexible resource services and keep an eye out for more upcoming remediation guidance!

FINTRAIL has proven experience in leading and delivering remediation programmes and providing flexible resources across anti-financial crime programmes. Whether you need to redesign your target operating model, remediate due diligence files or deal with a spike in alerts, FINTRAIL can provide the expertise and resources to support your remediation.

---

Black History Month: Reflections for Inclusion

Here in the UK, October is Black History Month. We at FINTRAIL are constantly reflecting on ways that the anti-financial crime industry can and should actively support diversity, inclusion, and social justice. As the gatekeepers of finance, we are responsible for upholding inclusive values and ensuring our practices work actively toward eliminating racism and discrimination.

A snapshot of the problem:

• Within FinCrime teams: according to an industry survey, two in three UK finance workers from black and minority ethnic backgrounds have suffered discrimination in the workplace.

• Accessing financial products and services: The proportion of black or ethnic minority UK consumers who don’t have a current account is twice as high as white consumers - 4% compared to 2% in 2020.  In the US, nearly half of black households are unbanked or underbanked.

• Treatment from financial institutions: In the UK, one study found that black victims of fraud were more than twice as likely to be denied a refund by their bank than white customers.

How we can work towards a solution:

There are many increasingly complex issues surrounding race and discrimination in the finance industry, and there are no easy solutions. However, we have identified the following areas in which the FinCrime sector can aim to make a difference.

• Diversity in hiring and inclusion within FinCrime teams. Actively hiring and recruiting diverse teams is an essential step in championing inclusion. It can reduce bias, as evidenced in data science teams, and overall makes teams stronger. Check out our blog post with actionable tips and insight on hiring diverse and inclusive FinCrime teams.

• Financial inclusion in anti-financial crime policies. When it comes to customer risk assessments, or reviewing and investigating screening hits or transaction monitoring alerts, ensure procedures and processes are free from prejudice and don’t inadvertently single out or impose restrictions on certain groups. Check out the FinCrime Principles of Inclusion designed in partnership with Tech Nation for practical guidance when designing or assuring your anti-financial crime framework.

• Recognising and mitigating biases within ID&V solutions. Facial recognition algorithms are not universal in their classification accuracy. In fact, the poorest accuracy is within Black female subjects between 18 to 30 years old. Recognising these biases and limitations, as gatekeepers to the financial system financial institutions must engage with ID&V solution providers to ensure they are working to ensure fairer outcomes.

• Amplifying diverse voices. When organising an event like a conference or webinar, consider the diversity of speakers. To whom are you giving a platform? Is there enough diversity in the representation of speakers? Sadly non-diverse panels and speaker rosters remain extremely common, though there are plenty of great speakers out there from a broad range of backgrounds, as well as groups dedicated to supporting these individuals who can provide recommendations and inspiration.

We are committed to continuously reflecting on how we as consultants support diversity and inclusion in the FinTech community. While there is unquestionably always more we can do, we hope the sector can use this opportunity of Black History Month to reflect on the inequalities that persist, successful initiatives already underway, and actions that we must take going forward to support a fairer industry.

Do you have any initiatives, suggestions, or ideas on how to champion anti-racism in the anti-financial crime industry? Please send us a note at contact@fintrail.com.

---

Winter is Coming: How Financial Crime Thrives During a Recession

Economic recession.  An impossible living crisis.  Unprecedented inflation. 

Not just alarming media headlines, these forecasts carry severe consequences for the most vulnerable in society. More extreme economic conditions lead to more extreme behaviours, and so as the situation deteriorates, anti-financial crime teams are likely to see an uptick in criminal activity. Through analysing current trends and near-term predictions, financial institutions (FIs) can strategically prepare their compliance teams as the world gears up for an economic winter. 

History repeating itself

Small-scale financial crimes appear to thrive during a downturn. Historically mortgage fraud, identity theft, and employee-related schemes have all increased during economic recessions, including the 2008 Great Recession, as have other smaller-scale frauds and scams. In the UK, the fraud prevention service Cifas has already noted the higher risk of criminals targeting loan products and deferred credit services, motivated by the economic downturn.

More recently, the economic decline at the start of the pandemic witnessed enormous amounts of fraud from robocalls, text and email phishing and smishing. It also saw huge volumes of online fraud, with a plethora of get-rich-quick schemes from cryptocurrency investment scams, non-fungible token (NFT) rug pulls, and multi-level marketing schemes (MLMs) abounding. Stuck at home, people turned to the internet in droves and became susceptible to too-good-to-be-true schemes to make money online. As the economic situation deteriorates, we can expect similar types of fraud to come to the fore again.

Consequences of economic hardship

Looking towards the end of 2022 offers a grim picture, with inflation skyrocketing across the globe. Impacted by the Russia-Ukraine war and the hangover from the COVID pandemic, inflation recently reached 10.1% in the UK and around 8.9% in the eurozone. The increased cost of living means people have more difficulty making ends meet. 

The consequences of economic hardship have two angles. On the one hand, individuals are more likely to fall victim to illegal lending services or other fraudulent schemes. On the other hand, they may be more drawn to commit financial crimes themselves to stay afloat, such as fraud or money muling. One way of understanding this is by using criminologist Donald R. Cressey’s fraud triangle which showcases the three components that lead to fraud. In times of recession, financial hardship provides the motivation pushing previously law-abiding people towards crime.

With that context, here are three financial crime predictions for the upcoming economic storm:

1. More fraud

Unsurprisingly, economically stretched individuals are more likely to turn to fast ways to make cash. Individuals looking for side hustles to supplement their income may be duped by scammers operating on popular freelancing platforms like Upwork or Freelancer.com, coaxing people to go off the platform and use peer-to-peer cash transfer apps instead. Another type of fraud likely to see an uptick is advance or loan fee fraud, where customers are instructed to pay a fee in order to access credit they will never receive. 

Money mule schemes disguised as legitimate jobs are also likely to spread through internet job sites, unregulated online forums, and Facebook groups. While reports posit that money mules victims are more likely to be under the age of 35, including children under 18, there has also been an increase in middle-aged mules, shifting assumptions about who will participate in these types of crimes. FIs should remain diligent in detecting money muling activity and be aware of changes to the demographics of potential mules.

2. More loan sharks

As individuals are pushed to their financial limits, illegal lenders that target the poorest and most vulnerable will increase their operations. These unlicensed lenders, which are illegal in the UK, charge extremely high-interest rates and use intimidation and other tactics to retrieve payments. Perpetrators can take many forms, from individuals to community-based lenders. On average, loan shark victims take nearly three years to come forward after borrowing, meaning it will take time to understand the impacts of the latest recession. However, a recent March 2022 study warned that one million people are estimated to be using illegal loan sharks in England. 

Since the financially excluded are more susceptible, FIs should assess how their policies impact financial exclusion.  They should also ensure they have channels available for people who are struggling to repay loans or credit cards, so that they can receive appropriate support rather than turning to illegal lenders.

FINTRAIL Highlights: FinCrime Principles of Inclusion

Financial exclusion affects countless individuals worldwide, with an estimated 2 billion persons being unbanked globally. As anti-financial crime professionals, how do we carefully consider our controls and understand how they impact those who vitally need access to the financial sector?

As anti-financial crime professionals, we must do more to proactively support financial inclusion and ensure the controls that we design do not inadvertently disadvantage those who need access to services the most.

To check out the FinCrime Principles of Inclusion, click here.

3. Possible increase in human trafficking

Drastic economic conditions can make people desperate, liable to take greater risks. The most recent global human trafficking report by the United Nations Office on Drugs and Crime posits that an economic downturn will increase the number of potential human trafficking victims as vulnerable people are targeted by criminals. A similar trend was observed during the last recession in 2009. From forced labour schemes to sex trafficking, FIs should be on alert for typologies related to human trafficking.

How to plan ahead

Winter is coming, and so is an economic downturn. Economic decline stokes uncertainty, fear, and desperation — all of which criminals prey on.  Sadly financial crime itself is recession-proof, and is likely to thrive in the near future. Since declining economic conditions in the UK are predicted to worsen at the end of the year, coinciding with holiday seasons that already put a financial strain on most households — factors contributing to fraud and other types of financial crime will become even more aggravated.

Here are some actions for FIs to plan ahead for the economic winter:

• Be aware of changing risk profiles and fortify your firm’s controls accordingly, particularly regarding money muling and fraud, and identifying and supporting vulnerable customers. 

• Plan ahead for additional compliance or anti-money laundering capacity during traditionally busy year periods. Interim support can help you efficiently respond to spikes or intense periods of activity.

• Review your customer monitoring and assess if the evolving economic conditions require changes. Now is a good time to do some targeted assurance on your systems and rules.

At FINTRAIL, we’re here to support you in planning for the changing conditions of the upcoming economic winter. We combine deep financial crime risk management with industry expertise to help you organise flexible capacity and provide interim support; conduct systems testing and targeted assurance or health checks; and provide context-based training to your teams. 

Get in touch to find out how we can help you weather the financial crime impacts of the economic downturn.

---

From the Mouths of Babes: Are Young People Aware of Financial Crime?

At the start of a new academic year, we are asking ourselves a question - what can financial industry practitioners, educators and government authorities learn about teaching young people about financial crime? This topic has sparked a lot of interest in the FFE community when we’ve raised it before, most notably in one of our most popular FFECON sessions, with the VICE journalist Obi Juwah (available to watch on demand).

We’re revisiting this topic through the eyes of a student - Stefan Wlodarczyk, who recently completed a stint of work experience at FINTRAIL. We asked him to investigate what students his age know about financial crime, particularly money muling.

---

Stefan:

Financial crime is an increasingly common problem, with younger generations becoming more and more at risk. As a 15-year-old secondary student doing work experience at FINTRAIL, I investigate whether my generation is even aware of these risks.

To provide some background:

• The UK’s 2020 National Risk Assessment of money laundering and terrorist financing states that there were 42,482 suspected cases of mule activity in 2019, a 32% increase since 2017. 📈

• The National Risk Assessment recorded cases of children as young as 13 and 14 being approached on the playground to carry out these operations. 🚸

Teenagers through to university students are being recruited to become mules via social media. 📱Social media has the greatest influence on younger generations since it has become such an ingrained part of society. This makes it so dangerous, and so easy for people to become accidentally involved in money laundering.

Furthermore, the recent COVID-19 pandemic exacerbated the number of financial crime cases due to more people being online. 

In 2020, the European Money Mule Action EMMA6 programme identified at least 227 money mule recruiters who recruited over 4,000 mules. According to Cifas, cases of under 21-year-olds being used as money mules fell by 12% in 2020 compared to the previous year, which is still a 27% higher number of cases than in 2017. The change may be due to lockdown restrictions which forced teenagers to stay indoors rather than being recruited to carry out mule work.

The survey: Are younger generations aware of money mules?

I interviewed ten people around my age (15) from four different schools to explore this further.

1. Have you received any education regarding financial crime?

Three out of ten students (30%) said they had received financial crime education, two of them went to the same school. 70% said they had not received any education about financial crime. This is despite Cifas and the PSHE Association (the national body for Personal, Social, Health and Economic education) creating an Anti-Fraud Education campaign targeted at 11-16 year olds.

2. Do you know what money muling is?

Four out of ten respondents said that they knew what money muling was. Out of the four who said yes, three had received education on financial crime.

3. Where did you learn about money muling and financial crime?

Out of the four respondents who knew about money muling and financial crime, three said they learnt about it at school, and one said they had learnt about money muling on YouTube. 

4. Have you ever seen an advertisement for money muling on social media?

All respondents said no. 

5. Have you ever been approached by someone asking you to use your bank account (if you have one)?

Again, all respondents said no.

6. Have you ever been a victim of fraud linked to social media (e.g. purchase of goods which never arrived, or arrived and did not match the description)?

Only one out of ten respondents said yes. This student frequently uses eBay to buy and sell items, and has been a victim of authorised push payment fraud (being deceived into authorising a payment to a criminal).

7. Have you ever been encouraged on social media to invest in cryptocurrency or any other high-return investments?

Five out of ten respondents said yes to this question, having seen adverts on the internet rather than actually being approached directly on social media. However, I am fairly confident that at least one respondent was actively encouraged to invest.

8. What social media platform do you believe is the most likely to expose you to financial crime?

Five respondents said they believed that Instagram was the social media platform most likely to offer exposure to financial crime, and four said they thought it to be Facebook/Meta. 

The results

The results of my survey show that most (70%) of the respondents have not received any education on financial crime.  One respondent stated:

“To be honest, our school doesn't teach us anything on finance stuff.”

Interestingly, of two people interviewed from the same school, only one of them said they had received an education on this topic, which they had received the same day I conducted the survey. 

Consequently, all students who received an education on financial crime knew what money muling was, yet of those students that did not receive this education only one knew what money muling was. This is because they had seen a video on YouTube about the topic, demonstrating how effective social media can be at spreading information (or encouraging people to become mules).

Thankfully none of my respondents said that they had seen adverts encouraging money muling, or had been approached to become one. Unfortunately though, one respondent said they were a victim of fraud.

“I was dumb enough to send someone money, but the product never arrived. The bank said that I had been scammed, and they gave us our money back.”

The results of question six (on high-risk investments) may be skewed by legitimate online advertisements or social media influencers encouraging people to invest, rather than shady offerings. Although one respondent said,

“A lot of scammers on YouTube are promoting their apps for investment.”

Noting this, I would recommend more research into this area, and the impact of this.

My last question on which social media platforms are most likely to expose users to financial crime had interesting results with Instagram and Facebook/Meta being most commonly highlighted. During my interviews, Instagram came under fire for allegedly having “a lot of ads'' that were “really fake”.  Interestingly, one respondent said that they believed that YouTube is the riskiest regarding exposure to financial crime due to the large amount of adverts put out by influencers encouraging people to invest in their apps or programs.

Is enough being done?

Personally, I don’t think enough is being done to educate teenagers and younger children on financial crime risks. I cannot remember ever being taught about this at school, and I only first learned about it by watching a documentary on money muling and from my work experience at FINTRAIL. 

The UK government and some financial organisations have released educational resources such as the Don't Be Fooled programme, yet they do not appear to have reached their targeted audience. The reason seems to be because money muling and financial crime isn't exactly a topic that teenagers are interested in or actively seeking out information on.

School is an important educator in spreading awareness about financial crime.
One student I interviewed wasn't happy about the level of education he received. He said, “I did it [finance] at the start of Year 10, and I don't remember much of it. We’re getting weighed down by exams and tests; we need lessons that refresh consistently on that stuff”.

In my opinion, the logical solution would be to designate personal, social, health and economic (PSHE) sessions at schools in the UK to educate students on this hugely important matter. However, I think that it shouldn’t just be one-off lessons but, as suggested by one respondent, “repeat [these] important topics every year”.

Looking ahead: Beyond secondary school students

The problem goes beyond secondary students. A Nationwide Building Society poll found that 56% of university students (compared to 60% of secondary students) did not know what a money mule was. The high percentage illustrates a failure to properly educate students on financial crime issues. The same study states that 61% of the students believed they were susceptible to such advertisements, and 37% admitted that they would respond to or click on such advertisements. 🤯

I believe that in addition to more education, social media companies themselves should do more to prevent mule handlers from recruiting mules in the first place. They can do this by regularly screening users with suspicious hashtags or other indicators similar to “make money quick” in order to see if the user is actively attempting to contact potential victims. 

---

FINTRAIL's Final Thoughts

• There is a real need for greater awareness of financial crime, along with a host of other financial topics, among young people. However, given the competing demands of the school curriculum, the logistics of how to deliver it are clearly a challenge.

• There have been educational campaigns for young people on the risks of money muling and fraud, but they do not seem to have had real impact. Without redesigning the wheel, educational bodies and government authorities should consider the best ways to reuse this material and more effectively raise awareness amongst young people. Static, text-based campaigns focused on the classroom may not be as effective as countering fraudsters and recruiters on their own turf, namely social media.

To read more about money mules and their use of social media and common typologies check out FINTRAIL’s blog posts here. 

If you want to get in touch for dedicated money mule training or create educational materials, give us a shout at contact@fintrail.com.

---

Green Gold: How Mexican Drug Cartels are Profiting From Avocados

Earlier this year, a US health inspector at a Mexican avocado plant received a verbal threat over the phone. Mere days before the Super Bowl (where guacamole is an indisputable tradition), the US responded by temporarily suspending avocado imports from their biggest trading partner, Mexico. 🇲🇽

A ban on operations is no light matter. In 2020 Mexico’s avocado exports were valued at $3.2 billion, of which 79% went to their northern neighbour, the US. While the short-lived ban has since been lifted, the security incident is a sobering reminder of what and who is at play in the lucrative avocado industry. More specifically, multiple drug cartels have diversified their operations to infiltrate and profit from the iconic fruit known as ‘green gold’, creating a surprising link between avocados and organised criminal organisations and leading to one newspaper dubbing avocados “the world’s new conflict commodity”.

Why avocados? 🥑

Rising in global popularity, avocados have significantly benefited from positive marketing campaigns and favourable trade treaties. The game-changing 1994 North American Free Trade Agreement (NAFTA) allowed the avocado-hungry US to import Mexican-grown avocados, significantly increasing consumption. Subject to USDA sanitary regulations, the state of Michoacán became the primary exporter of the nutrient-dense fruit, with climate-ideal attributes like rich volcanic soil and high rainfall. These favourable conditions make Mitchoacán the avocado capital of the world.

Alongside its vibrant culture and beautiful varying landscapes, Mexico is known for its extremely violent drug cartels, emerging from a long, contentious history steeped in the war on drugs. As a result, the far-reach of Mexican cartels has permeated many aspects of society and industry, with the agricultural sector not being immune. As opportunistic cartel members have recognised the profitability of avocado growing, they have become more involved. Avocado producers, transporters, and packers are routinely subject to extortion. Cartels even use government databases to find, extort, and kidnap avocado farmers. In some instances, cartels directly take over the farming lands, becoming ‘informal owners’ of the fields or installing avocado orchards on protected woodlands. They ensure they get their share of a thriving industry using force, intimidation, and violence.

Diversity in Business 📈

Running like multinational corporations, cartels are profit-oriented businesses. While their activity is incredibly violent, Mexican cartels have sophisticated operations intertwined with different industries. Beyond avocados, cartels have been involved in several other agricultural sectors. For example, Mexico’s favourable climate makes it one of the largest producers and exporters of citrus fruit, and unsurprisingly drug cartels are keen to cash in. They exploit the rich industry by purposefully limiting the number of fruit produced to artificially manipulate prices and increase their market value, then demand a share from producers. Experts suggest that limes, berries, and other products have risen in price since Mexican cartels have become involved.

Business opportunists like the El Cartel de los Quesos, which moved contraband cheese between Honduras and El Salvador, and The Knights Templar, which has been involved in taxing the Mexican iron ore industry, all exemplify the diversification of gangs from the drug trade. More diversified cartel involvement means that extortion is an increasing daily reality across more and more sectors. From small-scale agricultural producers of high-demand fruits to high-end hotels and restaurants in tourist areas, evidence of routine shakedowns is noticed throughout the country.

FINTRAIL highlights: Narconomics: How to Run a Drug Cartel by Tom Wainwright

Exposing how cartels operate using a framework suited to a multinational corporation, Wainwright explores and investigates Central America’s drug cartels in a captivating narrative. An editor at The Economist, Wainwright combines journalistic flair with business analysis to innovatively apply principles such as supply management, human resourcing, franchising, and offshoring to understand some of the most notorious crime groups on earth.

To join FINTRAIL’s monthly FinCrime Book Club and discuss other great books with like-minded fincrime enthusiasts, click here or get details of the next meeting here.

Laundering the ill-gotten gains 🧺

How do Mexican cartel members conceal these illicit gains? Much like any other predicate crime, the proceeds of extortion (a recognised predicate offence by the EU’s 6AMLD) or other dirty money can follow complex money laundering schemes and be commingled with legitimate business. Owning businesses like avocado or lime farms, restaurants, and export or trucking companies allows gang members to launder money and also smuggle illegal substances into other countries.

Historically, we know that the financial sector has been ineffective at tackling drug cartel activity through the application of proper anti-money laundering controls. As demonstrated by the infamous HSBC scandal and the more recent Wells Fargo involvement in aiding the Sinaloa cartel, negligence by financial institutions has undoubtedly helped facilitate brutal criminal gangs. Even for institutions trying to do the right thing, the gangs’ wide variety of economic activities confuse the picture, as does the use of sectors not generally seen as high risk.

Conclusion 📌

For financial institutions serving clients with a footprint in higher-risk jurisdictions or operating in higher-risk industries, awareness of jurisdictional nuances and transaction-related red flags, plus an understanding of trade-based money laundering, is paramount. It is also important to consider the potential ESG and reputational risks of servicing companies that source avocados and other ‘conflict commodities’ from high-risk areas.

At FINTRAIL, we combine deep financial crime risk management with industry expertise to help you optimise your anti-financial crime programmes. We’re here to support you in creating robust policies and procedures; refining, enhancing or testing your systems and processes; and providing context-based training to your teams. Get in touch to find out more.

---

11 Tips to Make Sure Your Next Audit Goes Smoothly

‘Audit’ can be an intimidating word, and the process is one that people don't often look forward to - or proactively manage as best as they potentially could.

Anti-financial crime audits, whether they be external or internal, are an expected part of a firm’s three lines of defence - but more importantly, a key part of the assurance cycle.

They don't have to be an uphill struggle, though. FINTRAIL’s audit and assurance experts have shared some of their best practices and tips for getting the right auditor in and managing the process effectively.

1. Define scope
It may sound obvious, but make sure you have a defined scope with your auditors so you understand what FinCrime topics they are covering and how. This should also align to your local regulators’ and banking partners’ expectations.

2. Be aware of regulatory changes
Regulatory audit changes are a constant battle for everyone, but it’s important to stay on top of them. Knowing what has changed since your last audit and whether you have implemented it will certainly be a question for most auditors.

• Check out our Audit Regulations Guide to gain insight into key regulatory changes, emerging areas of regulatory focus and regulatory enforcement trends.

3. Be prepared
Much of the work we do in FinCrime is often reactive, but as you’ve organised the audit, you can be prepared for it. For instance:

• Does your senior manager know they are going to be interviewed?

• Are the team aware they will be involved in thematic sessions/testing?

The more planning you do, the better the outcome will likely be.

4. Honest self declarations
Within any kick-off session or self declaration session, try to be honest about the current situation. If you have a gap in your AFC framework, the likelihood is your auditors are going to find it. It is better to be honest with obvious gaps you are aware of and be able to demonstrate you are taking proactive measures to resolve them.

5. Collaborative, not combative
This point refers to both parties. There is no need for either side of the table to create a combative environment. Ultimately, a good auditor wants to provide you with useful information on where you need enhancements. This can be done in a considerate way without intimidating the life out of your analysts.

6. Practical recommendations
In our view at FINTRAIL, a good audit report will not only highlight areas of deficiencies, but also elaborate on expectations of how to resolve the issue. Just telling you that you do not meet line 1.3.11 of the AML Regulations or line 2.4.7 of the Bank Secrecy Act isn’t actually that helpful! Don’t by shy about asking for practical recommendations to resolve issues.

7. Auditor profiles matter
Do you actually know who is conducting the audit? Many regulators talk about fit and proper tests for those in regulated roles, but it’s reasonable to expect that your auditor is qualified for the job as well.

8. Be mindful of time
Make sure you have a full understanding of how long your FinCrime auditors are spending through the process. Whilst a short, light touch audit may sound good in principle, the likelihood is they are going to miss something.

9. Challenge findings
It is perfectly acceptable to challenge your findings or the rating of the findings. You should have a closing session with your auditors and make sure you come prepared with evidence why you disagree - just telling them you don’t agree is not going to be sufficient justification for closing a recommendation.

10. Opportunities for budget and project approvals
Audits are a perfect opportunity to provide justification to your management of where more budget is required for a new tool or more headcount.

11. Track your findings
Once your audit is complete, make sure you track your findings, allocate them to someone specific, and prioritise them against the ratings provided. Auditors know you won’t be able to do everything at once - but come the following year, you will need to be able to present sufficient progress against closing last year’s findings.

Selecting the Right Audit Partner

By following these tips, you’re likely to have a smoother, more efficient experience during your next audit. But of course, who you choose to work with will also determine the outcome.

FINTRAIL’s audit professionals come from the very industries we support - they have extensive experience in auditing the financial crime and compliance controls within electronic money, payment institutions, virtual asset providers and innovative financial service businesses.

To find out more about how we can support your audits and assurance requirements, get in touch with our team.

---

Know Your Associates: The Need for Enhanced Due Diligence Investigations

FinTechs are used to conducting enhanced due diligence (EDD) on customers as a matter of course - to meet their KYC obligations and to identify red flags. But what about their own business operations? How confident are they that they know who they’re partnering with, where their money is coming from, and who’s getting involved in their business?

There are several scenarios in which FinTechs should seriously consider conducting EDD investigations into investors or business associates. These include:

Why are enhanced due diligence investigations important?

What do we mean by EDD investigations? The kind of research called for in these cases goes a long way beyond standard watchlist and adverse media screening. We have seen countless cases of subjects with chequered histories that raise serious red flags sail through screening. When managing high-risk customers, screening is generally the most appropriate option - you can’t conduct bespoke investigations on each customer. But when you are embarking on a one-off acquisition or conducting a funding round worth millions of pounds, there is the opportunity and the expectation to go further.

Cautionary Tales: The need for Enhanced Due Diligence

UK EMIs
Transparency International UK published a report in December 2021 which found that more than one in three UK registered electronic money institutions (EMIs) had money laundering red flags relating to their owners, directors or activities. These included:

• Individuals named in money laundering allegations and investigations
• Individuals with close links to high-risk firms in Russia and Ukraine
• Individuals with question marks over their suitability to run an FCA-authorised firm

Money Laundering Arrest
In 2020, UK peer-to-peer lender Zopa found itself in the news when board member Kapil Wadhawan was arrested as part of a $420m money laundering investigation. Wadhawan had co-led a £32m investment in Zopa which secured him a seat on the company’s board in 2017. He was arrested in January 2020 in connection with a money laundering probe in India, and subsequently had to resign his position at Zopa.

Kremlin Connections
Israeli-Russian billionaire Yuri Milner has invested in numerous FinTech companies in the US and UK, often through venture capital firm Digital Sky Technologies. In February 2020 he led a funding round worth tens of millions of pounds into the British start-up online mortgage broker Habito.

In 2017, media coverage of the so-called Paradise Papers reported that Milner’s investments in Facebook and Twitter used funds from two Kremlin-owned and now sanctioned Russian firms, VTB Bank and Gazprom. The origins of the money was reportedly obscured by shell companies.

Takeaway: In the thrill of securing financing, it can be tempting not to scrutinise potential backers too closely. However, as these case studies show, this is a potentially risky area and companies mustn’t be afraid to ask questions. Investors with poor reputations can affect portfolio companies’ credibility and their ability to raise capital in the future. And in the worst case scenario, target companies could even find their investors or directors are involved in criminal proceedings, or discover that an investment consisted of illicit funds.

What Does an Enhanced Due Diligence Investigation Include?

EDD investigations provide a full picture of a subject, allowing firms to really know their counterparties and to understand their backgrounds and source of funds.

• Background, track record, modus operandi and reputation of the counterparty

• Thorough review of corporate records, seeking to confirm information presented and even complex ownership structures, and to reveal any undisclosed beneficiaries or hidden interests.

• Details of civil or criminal litigation or other regulatory or legal proceedings, which are often publicly available but not discoverable through standard screening searches

• Details of any business disputes, or improper or illegal conduct

• Any political exposure or relations with government officials, beyond that captured in PEP screening lists

Download our EDD Services Summary Sheet to learn more

A full enhanced due diligence investigation involves in-depth research of both the surface and deep web (gated, subscription-only and database sources) ideally using a mix of advanced AI tools, including sophisticated natural language processing, and expert human analysis. It may require research in multiple languages, the manual retrieval of records in jurisdictions where these are not available online, or consultation with vetted human sources.

Unlike routine customer due diligence, such investigations should be bespoke and allowed to develop based on the findings - there is no one-size-fits-all approach, as the information required and the research conducted will be different in each case. This calls for experienced investigators who know how to appraise findings critically and when to follow a lead, pursue a hunch, discount information or revise a theory.

Case Study: High-risk Investor

FINTRAIL conducted a series of EDD investigations on potential investors on behalf of a UK-based FinTech. One of these investors was a businessman from Zimbabwe who had built his career in the high-risk telecoms sector. Moreover, he was a former associate of a high-profile African billionaire with top-level business and political connections.

FINTRAIL confirmed that the subject had a credible track record in the telecoms sector and was likely to have the funds for investment due to his previous career. We identified no noteworthy allegations of corruption or criminal behaviour. The subject’s companies had undergone financial failures and civil lawsuits, but we assessed these were the result of mismanagement and poor commercial decisions at an early stage in the subject’s career, as well as bad fortune with macro-level economic issues. We also investigated the subject’s current relationship with the billionaire and the latter’s political status, and confirmed that he had a remarkably sound and unblemished track record and reputation.

FINTRAIL contextualised the high-risk nature of the telecoms sector and the African jurisdictions in which the subject operated, and analysed the negative media reports around his companies. With this information, the FinTech was able to be confident there were no credible reputational issues or indications of criminal or unethical behaviour, and that the subject was within its risk appetite as a potential investor.

Case Study: Russia-Related Red Flags

FINTRAIL conducted open source analysis of a Russian venture capitalist looking to invest in a UK FinTech, focusing on his background and reputation, political connections, and links to known high-level scandals, including the Russian and Azeri Laundromats.

Our experts uncovered concerns about the subject’s source of wealth and modus operandi: he had political connections to the Kremlin, held business interests in opaque jurisdictions through apparent shell companies, and had unexplainable UK corporate interests. We used our in-depth expertise of Russia to contextualise the findings and profile the individual concerned, navigating the fact his media profile was limited as his political connections likely shielded him from overtly negative scrutiny in the Russian-language press.

While there was no evidence to show the subject was directly involved in criminal activities, the various red flags and reputational concerns convinced the FinTech to reject the investment - a disappointment in the short term, but likely a prudent decision in the long run.

Case Study: Sanctions Investigation

A UK-based financial institution asked FINTRAIL to conduct an investigation into a group of high-risk customers named in an OFAC sanctions investigation. They needed additional information beyond their standard EDD process, and an independent assessment of their existing controls.

Working closely with the client, FINTRAIL provided:

• in-depth information on the state of the sanctions investigation and the customers’ role in the underlying transactions
• a review of the client’s existing due diligence measures, and suggestions for enhancements and additional measures
• a view on whether the firm could be comfortable continuing to do business with the customers.

FINTRAIL confirmed there was no reason the firm should have deduced that the customers were involved in illicit activity, specifically any complicity in sanctions evasion. We opined that the firm was taking appropriate measures to limit and manage its risks, but that it may ultimately decide the customers were outside its risk appetite given the threat of future investigations and the reputational risk and operational costs associated with these relationships.

How FINTRAIL Can Help

At FINTRAIL, we combine deep experience in financial crime risk management with proven due diligence capabilities to provide clear, actionable, risk-focused intelligence using advanced analytical skills and data discovery tools. We contextualise all findings using in-depth knowledge of the countries and sectors concerned, including geopolitical context. We keep you updated of our findings throughout, and deliver comprehensive final reports with network diagrams and visuals where appropriate.

What makes us unique and sets us apart from other intelligence and due diligence providers is that our team is drawn from the industries we support, and has extensive experience of risk management processes within financial institutions. We provide intelligence by compliance officers for compliance officers. We understand your needs and operational considerations, and can supply you with the targeted, relevant information you need alongside informed recommendations and advice to produce actionable outcomes, guided by your own risk appetite and decision-making framework.

To learn more about how we can help with your requirements - whether it’s a one-off report or outsourcing complex casework - please get in touch with our team.

---

Read more: Investor Due Diligence - A Two Way Street

FFECON22: A New Reality for AFC Review

This year marked the fifth iteration of FFECON, bringing together a diverse set of speakers to share insights on the new landscape of financial crime in 2022.

The Business of War: Inside the Global Arms Trade

Andrew Feinstein, Executive Director of Shadow World Investigations, Investigative Writer, Broadcaster, Researcher and Campaigner, gave a captivating talk on the most corrupt of all trades. The arms trade accounts for 40% of corruption in all global trade. Casting light on the highly secretive industry that operates under national security and whose bribes play a crucial role in financing political systems, Andrew discussed some of the far-reaching and devastating socio-economic costs. In order to combat this corruption stemming from the weapon industry, accountability, transparency, and awareness is badly needed  — starting with exposure and simple legislation.

Friend or Foe: The Impact of Anti-Financial Crime on Human Rights

A riveting panel discussion led by Maya Braine, Managing Director, Head of Insights, FINTRAIL touched on the diverse ways anti-financial crime and anti-corruption measures impact human rights, with case-studies from Nigeria and Russia. From the exaggeration of terrorist financing risks in the non-profit sector and harsh applications of FATF’s Recommendation 8 to the problem of de-risking and its real-world consequences for humanitarian initiatives — panellists shared unique perspectives on the unintended consequences of anti-financial crime on human rights. Professional Evasion: The Impact of SWIFT Exclusion

Professional Evasion: The Impact of SWIFT Exclusion

Another panel discussion moderated by CEO of FINTRAIL Robert Evans looked at the hot topic of sanctions and SWIFT exclusion, focussing on Russia. Experts discussed the symbolic versus the real impact of the SWIFT ban and the legal frameworks versus the responsible business conduct approach. Speakers highlighted humanitarian challenges, the complexity of sanction avoidance and evasion, and the difficulties with implementing sectoral sanctions. Panellists also spoke about industry and operational impacts, with the unprecedented sanctions regimes diverting resources away from other areas of economic crime prevention and detection, the changing roles and responsibilities of transaction monitoring teams, staff burnout and broader industry collaboration.

The Tinder Swindler: A Victim Story

In a brave and compelling fireside chat with John-Paul Eaton, Global Community Director of FINTRAIL and Cecilie Fjellhøy, Fraud Victim of ‘The Tinder Swindler’ and Founder of action:reaction foundation, Cecile shared her touching story of being a victim of fraud and abuse. Recounting the different types of social engineering and manipulative tactics, including love bombing and fearmongering, Cecile shared how vital empathy is for financial institutions to detect this type of crime and help reveal the truth. All financial institutions should lead with empathy and compassion especially when investigating potential fraud. 

The Crypto Conundrum: The Use of Privacy-Enhancing Tools

In a dynamic and diverse discussion between panellists led by Greg Wlodarczyk, Managing Director, Virtual Assets and New Payment Methods at FINTRAIL, experts debated legitimate and illegitimate uses for privacy-enhancing tools such as virtual currency mixers and privacy coins. While there are some valid reasons for using such tools in dangerous jurisdictions or for high net worth individuals who want to protect their identity, privacy tools like virtual currency mixers are considered risky as they are favoured by criminals and hackers. Panellists discussed that while a global ban on these tools is unlikely, there is vast importance in increasing knowledge and education and strengthening public-private partnerships in this space. 

Does Identity Matter?

Moderated by Natasha Vernier, Co-founder and CEO of Cable, panellists discussed the concept and use of zero-proof identity and centralised versus decentralised solutions for digital IDs. In a context where consumers are becoming more conscious of the dangers of data breaches and awareness surrounding the types of personal information being shared, panellists emphasised the role of trust in the adoption of specific technologies and practices as well as the required legislative basis for reusable identities. Opportunities for financial inclusion were also discussed as digital identities may help the unbanked.

FinCrime Book Club

Author of Very Bad People: The Inside Story of the Fight Against the World’s Network of Corruption and founder of Global Witness, Patrick Alley, was interviewed by Ciara Aitchison, Director, Insights and Research at FINTRAIL. In a fascinating discussion, Patrick shared his story of how he first started his international NGO, emerging from exposing the funding of the war in Cambodia from the illegal forestry trade. Among riveting personal stories, Patrick emphasised how corruption erodes democracy and the importance of naming and shaming the ‘very bad people’ who cause suffering — highlighting that every single person can make an impact. As London is the centre of many of the enablers of corruption, there is a huge opportunity to turn things around and make system-wide change. Patrick also shared more recent work that Global Witness is doing to combat climate change and assist in the Ukraine war. Patrick’s book is a must-read for every anti-financial crime professional, undoubtedly igniting a passion for why anti-financial crime professionals do what they do. 

With Great AI Power Comes Great FinCrime Responsibility!

Last but certainly not least was the engaging and jam-packed panellist discussion on artificial intelligence (AI) solutions in financial crime moderated by James Nurse, Managing Director of FINTRAIL. Panellists illuminated the different challenges and opportunities in AI and machine learning’s application, especially concerning bias. All speakers agreed that before implementing AI, organisations need to have their house in order — the data architecture, rule system, and overcoming data silos. Particular challenges for fintechs are working with sparse data sets that inevitably create biases and detrimental impacts on financial inclusion. Experts advocated for anti-financial crime professionals to work with data scientists, being involved in the model design process and asking critical questions. Explainability is not just important for regulators — being able to explain technology in layman’s terms is a marker of a good data culture. Additionally, having diverse teams encourages diversity of thought and better solutions throughout organisations!

This year’s conference highlighted:

• An unsurprising but important recurring theme of partnerships between private and public and industry in more general terms. From unprecedented sanctions to new technologies in the crypto sector, creating channels for education and information sharing is vital to fight financial crime effectively.

• Financial institutions must lead with empathy in all areas of their work, including the way teams deal with potential victims of fraud.

• Exposure and awareness are vital. From naming and shaming corrupt leaders and behaviour, to openly discussing industries that are in the shadows like the global arms trade — each individual, especially anti-financial crime professionals, can make an impact on the fight against corruption and democracy.

• Unintended consequences for human rights and artificial intelligence are essential to bringing to the fore in order to mitigate. From bias in machine learning systems that impact financial inclusion to de-risking of important humanitarian initiatives — we all have a duty to critically think about the ways in which anti-financial crime measures impact the most vulnerable.

All in all, the conference was a hit! We already can’t wait for the next one!  

Canada’s Emergencies Act: Lessons Learned

Often revered as a peaceful and largely untroubled nation, Canada made international headlines earlier this year. The government’s adoption of the Emergencies Act, announced by Prime Minister Justin Trudeau on 15 February 2022 and subsequently revoked eight days later, was a response to ongoing disruptive protests in the nation’s capital Ottawa. The controversial use of the Act, which encompasses the Emergency Economic Measures Order, gave financial institutions (“FIs”) new obligations under broad action to ‘follow the money’ and stop funding flowing to the newly-illegal protests.

Given time to reflect on such a broad sweeping move, and while awaiting the findings from the official Rouleau Commission’s inquiry, FINTRAIL examines Canada as a case study to extract valuable lessons for FIs. Looking forward and in the face of another potential emergency, how can compliance staff logistically implement such urgent measures? And what lessons can be learned for the wider international compliance community?

Change of Rules

In the case of Canada, the never-before-invoked Emergencies Act demanded that FIs, including payment platforms, funding platforms and digital currency exchanges, assess whether they control or are in possession of property by a designated person. In essence, these organisations were to cease business with anyone directly or indirectly associated with the newly-illegal activities of the protest.

The following measures were adopted:

• The scope of Canada’s AML/CTF rules was expanded to cover crowdfunding platforms and the payment processors they use. They are obliged to register with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and report suspicious or large transactions.

• FIs could immediately freeze or suspend accounts suspected of financing the demonstrations without a court order. This covers all forms of transactions, including digital assets.

• FIs were to review their relationships with anyone involved in the blockades.

• FIs were required to report any relevant relationships or activity to the Royal Canadian Mounted Police (“RCMP”) or Canadian Security Intelligence Service (“CSIS”).

Unlike typical sanction scenarios where institutions are given a list of individuals and businesses by law enforcement, the broad application of anyone who is “engaged, directly or indirectly” in prohibited public assemblies as a ‘designated person’ leaves much up to the discretion of FIs.

Though one week after the measures were announced, on 22 February 2022, the Canadian federal police gave FIs a list of both “influencers in the illegal protest” and “owners and drivers of vehicles who did not leave the protest zone” — this non-exhaustive list is just a piece of the puzzle. FIs had to continue to use their own judgement when determining who falls under the category of ‘designated person’ and what is effectively considered ‘suspicious activity’. In practical and logistic terms, this can prove to be difficult.

FI’s Discretion

Left to their discretion in determining which individuals and businesses are associated with the illegal blockades, FIs were undoubtedly informed by publicly available information like media reports. However, the looseness in definition led to some critiques and questions about what exactly qualifies as suspicious and what type of recourse customers would have once their accounts were frozen.

One particular difficulty is the sheer number of those potentially involved, with leaked donor lists showing more than 92,400 donations made on fundraising websites. Despite government officials dismissing the likelihood of small-scale donors being affected, unsubstantiated claims of those who had their accounts frozen despite donating prior to the 15 February state of emergency emerged. The official inquiry examining the use of the Emergencies Act, which will produce a final report in February 2023, notably does not grant standing to a number of individuals who had their bank accounts frozen.

Best Practices

While Canada’s use of a state of emergency to target protestors is largely unprecedented in a Western democracy, some experts have argued that it is part of a larger pattern of using anti-money laundering and counter-terrorist controls beyond their initially intended purpose — suggesting an event like this, stoked by rising global political uncertainties, could occur in other jurisdictions. Other governments have also reacted with firm responses to recent public protests, such as the Black Lives Matter protests in the US, Extinction Rebellion actions in the UK, and the Gilets Jaunes movement in France. It is, therefore, possible to imagine scenarios in other countries where similar actions could be taken to cut off protestors’ funding. After examining the situation in Canada, we recommend the following best practices for compliance teams.

• Clear internal communication. For FIs, clear and distilled internal instruction on what and who constitutes a designated person needs to be consistent, proportional, and well-communicated among compliance teams. Since a broad and poorly understood legal definition can easily lead to inconsistencies and a heavily subjective approach, clear communication and protocols should be widely distributed.

• Work closely with law enforcement. Clear communication between law enforcement and FIs are paramount. In the case of Canada, the RCMP began working closely with FIs to unfreeze accounts after giving lists of crypto wallets to exchanges, and the names of certain individuals involved to FIs.

• Work closely with peers. When it comes to responding immediately to such rapidly evolving situations, everyone is in the same boat. Rather than each FI devoting resources to identifying details of fundraising activities and linked names individually, such information could be pooled and shared to make the industry response more effective and efficient. Similar actions were taken by a number of banks in 2016, when the US and EU imposed “sanctions by extension” on all corporate entities owned 50% by sanctioned people or entities.

• Awareness of financial exclusion. While in Canada, the FIs themselves were given protection from civil liabilities for any actions taken to comply with the orders, the potential consequences for customers are enormous. As gatekeepers of the financial system, understanding those individuals who have their assets frozen may be at risk of financial exclusion in the future is another factor to consider, and encourages the need for thorough due diligence and informed action.

When reflecting on the situation in Canada and any similar situations which may emerge in the future, FIs and their often thinly-spread compliance teams may find themselves walking a tightrope between proportionate action and obeying the law. The aftermath of Canada's Emergencies Act provides valuable analysis, serving as a case study for other countries that may see this type of broad application of AML/CFT controls.

---

In rapidly evolving situations, sharing information with peers can be extremely valuable. The FinTech FinCrime Exchange provides a unique network for FinTech compliance professionals to do exactly that, and leverage the collective efforts of a community. Click here to find out more and join the community, or email us at ffe_admin@fintrail.com.

Review of the UK’s AML/CFT regulatory and supervisory regime

The UK government has issued its much anticipated response to the call for evidence on the UK’s AML/ CTF regulatory and supervisory regime. It’s well considered, detailed … and perhaps a little safe.

Does it provide ground breaking changes? No.

Is it moving us forward? Slowly.

But realistically, this was never going to offer speedy and simple solutions. What it does do is recognise the importance of the fight against economic crime, and the vulnerabilities that exist, both at board level and on the streets. The report mostly serves to tell readers to ‘watch this space’, as this is “only the start of [the] reform agenda”, with further legislative measures to come this year via the second Economic Crime Bill and Companies House reform.

The foreword by Economic Secretary to the Treasury John Glen, highlights the need to continue to enhance efforts at home while working with the international community to influence and shape global standards. The report also recognises that in order to make a difference globally, the UK needs to strengthen and “harness the capabilities, expertise and information of both public and private sectors”.

This review is seen as only one part of the UK’s efforts. Along with the Economic Crime Plan Part II and reforms to Companies House, the UK is seeking to go beyond tick box compliance and “build a thorough and dynamic system of controls which responds to the real risks we face”.

The review has been structured around 3 key themes:

1. Systematic Effectiveness – what effectiveness looks like and how to measure it

2. Regulatory Effectiveness – equipping firms with a strong risk understanding and effective risk-based controls targeting areas of highest risk

3. Supervisory Effectiveness – reform of the supervision regime

The report builds on the work under the parallel updates to the Money Laundering Regulations (MLRs) and sets out the intention to develop an improved range of metrics to measure and evaluate the effectiveness of the MLRs in future.

The highlights:

• The National Risk Assessment (NRA) and existing public-private dialogue will be used to assess emerging risks and potential future changes to the MLRs.

• Post-Brexit, some areas of regulatory changes to support a risk-based approach have been identified, but other areas such as Suspicious Activity Reporting (SARs) and gatekeeping show limited need for regulatory change.

• The use of new technology and improving the AML guidance regime are potential areas for the government to support the private sector. Incremental improvements in collaboration with partners is the favoured approach

• Possible reforms of supervisory structure are considered with the aim of ensuring effective and consistent supervision across all sectors.

So how does this translate into action and what are the next steps? Below we summarise some of the key aspects of the review.

Defining Effectiveness

a. Objectives of the MLRs

The government has decided to refine the objectives for the MLRs, linked to the FATF methodology, by amending the following areas:

• Explicitly including the ‘provision of valuable intelligence’, aligning with the principle that effective prevention is more than just technical compliance

• Clarification of supervision - monitoring and enforcing compliance as part of a risk-based approach

• Collation of accurate information on beneficial ownership is not a primary objective but a means to identify and report suspicious activity.

b. Measuring Effectiveness

Many respondents questioned whether the specific requirements in the MLRs are having a direct impact on the scale and nature of disrupting ML/TF. The government will set out ‘outcomes focused’ metrics as part of the Economic Crime Plan to provide direct and clear feedback on the effectiveness of the MLRs.

c. High/low impact activity

Unsurprisingly, the regulated sector is in favour of reducing the number of mandatory requirements in the MLRs. Themes raised included:

• ‘High impact’ activity - consistent compliance with due diligence requirements and good quality suspicious activity reporting

• A disproportionate burden on ‘low impact’ areas of routine due diligence and transaction monitoring driven by mandatory requirements, and the inability to move resource to ‘higher impact’ areas

The government view is that firms have some discretion when adopting a risk-based approach, but resources and policies must be in place to meet the objectives of the MLRs. While there is scope to “dial down” less impactful activity, there is “insufficient evidence” to overhaul the MLRs.

d. Strategic national priorities

The UK will not publish standalone National Priorities such as exist in the US - the focus will be on developing the upcoming Economic Crime Plan and NRA to provide more strategic direction.

Regulated firms demanded more granular sharing of public-private intelligence, including in response to live threats and emerging risks. The government will explore how law enforcement agencies can provide more coordinated and timely communications. The NRA will be the primary vehicle for assessing emerging risks and identifying changes needed to the MLRs going forward.

Driving Effectiveness

a. Risk-based approach

Respondents felt that the MLRs contain too many prescriptive requirements, which goes against the premise of a risk-based approach. The government will not fundamentally shift the balance of mandatory requirements, but will consider the following factors:

• Small / new firms: Supervisors and the Office for Professional Body Anti-Money Laundering Supervision (OPBAS) will assess the support that can be offered to these firms to fulfill their obligations under a risk-based approach

• Guidance / information sharing: Law enforcement and supervisors will assess how information is currently shared and enhancements that could be made

• Supervisory approach: Supervisors will review how to ensure a risk-based approach is incorporated into supervision

• Enhanced due diligence (EDD): There are no plans to amend the mandatory requirement to perform EDD as listed in Regulation 33. However further work will be done on assessing the risk profile of domestic PEPs, removing the list of required checks for high-risk third countries, changing the wording of ‘complex or unusually large transactions’, and evaluating the effectiveness of EDD.

• Simplified Due Diligence (SDD): respondents highlighted that the time and effort to conduct SDD is the same as standard CDD, thus it is not useful. However, the government does not plan to change the components or description of SDD, with the exception of Pooled Client Accounts, where the government will consult on options to allow easier application.

b. New technologies

The government believes that inefficiencies and resource-intensive compliance processes are partly driven by failures to maximise the use of technology. Three workstreams will be established to find solutions and explore more effective models of engagement. As the MLRs are intended to be technology neutral, no specific changes will be made except for digital identity products., where the government is considering amendments to ensure greater clarity on electronic identity processes.

c. Supervisors’ role in SARs regime

Focus in this area should be on improvements to SAR technology and IT, an increased feedback loop, and better information and intelligence sharing. With a number of initiatives already underway, the government will keep a watching brief.

d. Gatekeeping function

There was broad agreement about the effectiveness of the gatekeeping function of supervisors surrounding the ‘approvals’ and ‘fit and proper’ test, with some consensus about enhancing this in higher-risk sectors such as crypto assets. The government will uphold the status quo and consult on specific feedback.

e. Guidance

Sector specific feedback is crucial, but it is too long, complex and inconsistent. Striking the right balance is difficult - there needs to be room for a risk-based approach. The result is we won’t see radical overhauls, but reform along the lines of three key principles:

• Sector specific guidance drafted by experts, including industry

• Improved approval process to streamline and speed up updates

• Improved quality control to ensure consistency, clarity and conciseness

AML/CFT supervision

The UK has 25 supervisors: three statutory supervisors (the Financial Conduct Authority (FCA), HMRC and the Gambling Commission) and 22 legal and accountancy Professional Body Supervisors (PBSs) who supervise the legal and accountancy sectors. This section considered potential structural reforms.

a. Enforcement

Respondents highlighted inconsistencies across different sectors. They noted the level of fines brought against financial institutions is higher than other sectors, which has led to high levels of AML investment but has made banks risk-averse. There is a call for greater transparency and consistency of approach.

b. Supervisory gaps

Some supervisory gaps exist in the legal sector where practitioners are not members of one of the legal Professional Body Supervisors (PBSs) with a general consensus on creating a default supervisor for the sector.

c. Supervisory reform

With FATF identifying major deficiencies in the UK regime in its last evaluation report, it’s not surprising this is an area of focus. And it is still a work in progress. With some high-profile enforcement actions and steps taken to improve a risk-based approach, there is room for further reform.

The shortlisted options for reform include additional powers for OPBAS, consolidating and reducing the number of PBSs, or establishing a single supervisory body for professional services. A formal consultation will be issued to further understand the pros and cons of each.

So what next?

Well, the review has provided greater understanding on the barriers to effectiveness but some of the solutions are unclear, meaning further work and engagement is needed. The key areas of focus for the next phase of development of the MLRs and wider AML regime are:

• Potential supervisory reform

• Further evidence and understanding needed on MLRs

• New objectives to the MLRs with measurable metrics

• A focus through tools such as the NRA to improve risk understanding

• Further engagement on new technologies

• Case by case updates to guidance

So as we said at the start, watch this space - the second Economic Crime Plan is now the next much anticipated document!

---

At FINTRAIL, we combine deep financial crime risk management with regulatory expertise to help keep your anti-financial crime programmes and governance structures in step with the latest official guidance.

Please get in touch if you would like support with designing, reviewing or enhancing your anti-financial crime framework.