Getting sanctions screening right is a growing priority for financial services institutions in their AML/CFT compliance program. The constant drumbeat of increasing regulatory requirements, the mix of customer profiles that grows more complex by the day, and an ever-expanding menu of financial products and services have only made such due diligence all the more critical.

However, current AML/CFT detection systems and procedures that lean heavily on rules-based screening engines and manual inputs can not keep up with today’s reality. The issue of false positives is arguably one of the most consequential areas this plays out. On one hand, financial institutions need a new set of tools to accurately detect true matches and reduce the occurrence of false positives. On the other hand, too few false positives in an indication that an institution’s AML systems are not appropriately calibrated to catch the wily evaders.

What are False Positives and Why Do They Happen?

In its most basic form, an AML compliance program includes three fundamental functions:

1. Assess the risk of new and current customers
2. Implement screening measures to weed out clients who present a high risk for financial crimes
3. Conduct ongoing monitoring of customer activity

There are really two goals to an organization’s AML program. The first is to create an alert system that can efficiently identify and actively prevent the emergence of money laundering and other financial crimes within the organization. The second is to avoid regulatory sanctions and their fallout like the plague.

These two goals are often at odds with each other. Moving from financial crime identification to financial crime prevention can be a resource-intensive high-wire act.

In order to comply with the strict regulatory requirements and stiff fines for non-compliance, financial institutions will often operate on the side of caution in their screening and monitoring efforts.  That is, they will lean towards “Over-Screening“. In practice, this means the definition of suspicious activity, for example, would include a very broad range of actions and behaviors– each of which will generate an alert.

An AML alert does not necessarily mean that criminal activity of any kind is in fact happening. It is quite common for a subsequent manual review to result in a cleared warning. When this happens, it is called a false positive.

Such manual reviews are simply “baked” into the AML compliance system of many traditional and established financial institutions. The time and resources required to conduct this oversight is then written off as the cost of doing business.

The added piece of mind comes with a big price tag, however. The industry average rate of false positives currently hovers around 42%. But for larger institutions it can reach a whopping 95%. This translates into millions and even billions of dollars of lost revenue each year.

Another indirect cost of a high false positive rate is the negative impact it has on the customer experience. In recent years, the financial services industry has been required to pour more resources into the experience users have as they move through the buyer’s journey. According to the 2020 Digital Banking Report, customer experience is a key element in maintaining a competitive edge. Customers increasingly want financial institutions to provide personalized services. This is putting increasing pressure on financial institutions to perform to rapid, frictionless transactions and offer personalized customer communications.

A large number of false positives can slow down the on-boarding process as well as customer transaction times. They are thus an obvious stumbling block. However, compliance teams must find a way to reduce their rate of false positives without compromising the accuracy and effectiveness of AML transaction monitoring and screening.

What are Your False Positives Telling You?

The solution to the false positives conundrum is to fundamentally change the way your organization perceives false positives in the first place. False positives are a necessary and unavoidable occurrence. When your rate of false positives stays within a healthy range appropriate for your user base and risk profile, then it is a sign that your institution is on the right track.

When the number of false positives steps outside of that range, then you’ll want to pay attention. You are getting valuable information about your AML compliance efforts. Usually, it means that something within your system has to be tweaked or reworked.

Let’s consider a few examples…

Scanning sanctions watchlists and associated data, such as adverse media and PEP lists, coupled with ongoing transaction monitoring require firms to process and analyze a vast amount of information from a variety of sources which are themselves evolving. With sanctions screening in particular, these sources often vary wildly in quality and completeness, and they are bloated with redundant or useless information. On top of this, they generally come in an unstructured format.

A high rate of false positives could simply be the result of relying on poor data pools full of outdated or irrelevant information that has been ineffectively culled, organized and structured. Of course, the more confusing the data, the more challenging it becomes to discern false positives from true positive matches.

For this reason if your institution is experiencing an unusually high rate of false positives, you may want to reevaluate your data capture. You need to ensure it truly fits the needs of your organization along with the reality of the market base you are servicing.

For example, we developed VisionIQ, a comprehensive watchlist database with access to over 1000 watchlists and automatically updated news sources from more than 200 countries. VisionIQ is powered by advanced technologies, such as artificial intelligence (AI) and natural language processing (NLP). This smart data system is structured and organized to make it easy to selectively group watchlists for different risk profiles and screening criteria. Data is de-duplicated and cross-linked across watchlists to better resolve the data into personas.

Smart data by itself may help reduce the rate of false positives, however, it may not be enough. Part of the challenge is being able to manage the sheer volume and velocity of data creation today, as well as the constantly growing number of data sources. Even the best compilation of data and news is useless without an intelligent search and scoring engine built on AI algorithms and machine learning. Such an automated screening solution can significantly reduce labor-intensive manual interventions. In the process it will significantly minimize False Positives, while helping to ensure that True Positives are discovered.

Utilizing an automated screening solution solves yet another factor in a high false positives rate: the need for real-time data updates. It’s common for those involved in financial crimes to change their names or move to another region in order to avoid prosecution. It’s also common for innocent individuals to make such life changes.

Your organization should thus ensure that the customer data you are relying on is both relevant and up-to-date. A false positive might be created, for example, if a firm neglects to update a user’s change of name or list their new home address– particularly if the new region presents less of a risk than that of the previous residence.

When Even a Little Becomes A Lot

When it comes to false positives, some organizations, for example, a financial services business, may discover that their ability to conduct manual reviews on even a moderate rate of false positives is a struggle. Despite all the advances in technology, sanction screening still requires a significant amount of manual intervention that can dramatically slow down and disrupt the customer verification and on-boarding processes. Many sanction screening solutions on the market are designed to filter a set of watchlists. The search results must then be manually exported for review.

For nimble organizations with limited human resources, there are stand-alone decisioning systems that yield screening decisions in real-time without requiring manual review. This of course includes the automatic clearing of false positives using AI.

A smart, AI and NLP based sanction and PEP screening decision system, like our very own DecisionIQ, can render 95% of all verification decisions automatically within a 60-second response time and a low decision error rate. For records that still require manual screening, they can be sent within minutes to compliance officers, who should have all the info they need to take immediate action.  The screening decisions are then setup for ongoing monitoring based on your risk-based approach.

Slow customer on-boarding and the constant drumbeat of false positives will quickly eat up your profitability and your competitive advantage. On the other hand, failing to identify criminal financial activity can lead to unwanted regulatory attention and action.

The use of smart automated technologies can help to alleviate the challenge of false positives in sanction screening more effectively, more rapidly, and more affordably than ever before.

As credit unions continue to grapple with a growing mountain of costly and complex financial regulations as well as an evolving digital ecosystem, they have been ramping up their investment in regulatory technology (RegTech) solutions.

Determining which AML compliance solutions make the most sense for a specific credit union, however, can be a challenge. Over the next four years, the global RegTech industry is expected to reach $16 billion. While there are many established players already in the market, this growth is in large part driven by a rising wave of new RegTech innovators. These companies are harnessing advanced technologies to address a wide range of issues in addition to AML compliance, such as data and network security, user experience, the increasing demand for faster digital transactions, affordability and ease of integration.

RegTech has become mission critical among credit unions seeking support in their AML/CFT compliance efforts. Earlier in this series, we examined the ways in which modern Credit Unions need to rethink their approach to AML/CFT compliance as well as the unique challenges they will face in the process. The distinct path awaiting Credit Unions towards an accurate, cost-effective, and nimble AML compliance regime requires that they look beyond many of the established vendors.

Credit unions do not operate in the same way as banks do. They have their own unique structure, mission, and set of needs. RegTech platforms that prioritize affordability, accuracy, customization, support, and ease of use are better suited to these financial institutions.

Heading into the future, partnerships with RegTech vendors can help to make credit unions more adaptable and competitive in a changing financial services landscape. Many small and mid-sized credit unions today face two options: either adapt to changes in regulation, technology, and financial market trends or be absorbed by a bigger financial institution. Though the Covid-19 pandemic initially slowed down M&A activity among credit unions, all signs indicate that M&As will increase in 2021.

Having smart, customized AML compliance solutions in place is a necessary growth strategy for today’s credit unions. In fact, it could end up being one of the most significant factors in the fundamental viability of the credit union model going forward.

In this final article of our series on AML compliance among credit unions, we will look at three core RegTech solutions that are putting these financial institutions back on the financial services playing field.

3 Smart AML Compliance Solutions for Today’s Credit Unions

A solid AML/CFT credit union compliance program will depend on some combination of three core services:

Moving from Big Data to Smart Data

AML compliance begins with screening clients as part of customer due diligence (CDD). A good sanction, PEP, and adverse media screening program begins with great watchlist data.

Most AML compliance data vendors build and promote BIG DATA. However, when it comes to a given database, bigger isn’t necessarily better. The problem with big data is that it is often full of junk and bloated with duplicates. This unnecessary, incomplete, or unwanted information creates added work for AML compliance staff who must manually reconcile and clear the excessive false positives. Financial institutions typically end up over-engineering their screening systems to deal with junk data to strike a balance between an “acceptable” number of false positives with their efforts to avoid missing true positives.

The beginning of modern KYC and sanctions screenings still starts with sanctions lists, but now extends to other watchlist data, including PEP (politically exposed persons), RCA (relatives and close associates of politicians), HIO, Regulatory Authority, Negative News, and more. These lists are constantly evolving, while sanctions are becoming more complex and the number of regulatory bodies are growing. For credit unions working with limited resources, this big and constantly changing data pool must be augmented and transformed by SMART data systems prior to consumption for screening. SMART DATA leads to INTELLIGENT SCREENING. Solving the data problem is the most effective way to enhance a credit union’s AML compliance program.

For this reason, KYC2020 developed VisionIQ, the most comprehensive, advanced, and affordable watchlist database on the market with access to over 1000 watchlists and over 10,000 automatically updated news sources from more than 200 countries. The VisionIQ data advantage is not just that the data is comprehensive so that a credit union never misses a relevant true positive, but that we spend a great deal of time to make it SMART so that our clients are not dealing with endless false positives.

For a credit union to be served the right data to suit their risk profile, VisionIQ is powered by advanced technologies, such as artificial intelligence (AI) and natural language processing (NLP).

Data is structured and organized to make it easy to selectively group watchlists for different risk profiles and screening criteria. Data is de-duplicated and cross-linked across watchlists to better resolve the data into personas. Data, especially PEP and RCA data, is further augmented by name and entity recognition in relevant adverse media. Personas are also tagged with aliases, common name variants and misspellings to reduce fuzzy search errors and false positives. Plus, we have added machine learning (ML) to the mix which makes the data, and by extension the AI-based compliance system smarter over time.

Best of all, we have priced VisionIQ with smaller financial institutions in mind. Data does not have to be so expensive, and credit unions do not have to compromise quality for good data.

Smart Sanction Screening Solutions

Sanction screening is an integral part of KYC and AML/CFT compliance. Sanction screening systems are designed to protect financial institutions from high-risk customers and help to ensure the integrity of the financial services sector. But it does not stop with just sanction screening. Today, financial institutions must screen for PEP, criminal, and even negative news.

Aside from the risk of regulatory fines, credit unions must think about their reputation. Nothing will ruin a credit union’s reputation faster than being tied to a rogue member or an employee who has generated negative publicity. Where a financial crime was committed, the financial institution’s ties may be made public, creating a reputational crisis. The credit union may be deemed guilty by association, with members questioning the integrity of the credit union itself even if it has done nothing wrong.

For example, corruption among public employees, such as politicians, government officials and their associates is on the rise. As part of their customer due diligence obligations, banks and financial institutions must establish and report whether their clients are Politically Exposed Persons (PEP) and at risk of being involved in financial crimes, like money laundering, or are associated with a predicate offense as reported in the news.

A great KYC sanction screening solution for CDD begins with an exhaustive watchlists and negative news database. However, even the best compilation of data and news sources is useless without an intelligent search and scoring engine that works to minimize False Positives, while helping to ensure that True Positives are discovered.

KYC2020 SmartScan is the best in class sanction, PEP and negative news screening and scoring service that integrates automation, AI and NLP for big and small credit unions alike with flexible price plans to suite any budget.

SmartScan gives credit unions the smarts and sophistication of an enterprise sanction screening solution while avoiding all the cost and complexity. It is available as SaaS solution or OnPrem deployment. Plus, we have developed an extensive API Library for easy integration with in-house systems and workflows.

From Screening to Decisioning

Despite all the advances in technology, sanction screening still requires a significant amount of manual intervention that can dramatically slow down and disrupt the customer verification and on-boarding processes. There are generally four main hurdles to overcome:

1. False Positives. The best systems still yield 5-7% false positives that must be cleared manually by a compliance officer.
2. Record keeping. Compliance best practices require the storing and organizing of auditable documentation for minimum of 5 years. The administrative effort and resources needed to fulfill this requirement are high, costly, and can lead to expensive inaccuracies.
3. Long On-boarding Times. Sanction screening plagued by over-engineered systems, depends even more on manual interventions that are not only slower, but prone to mistakes and discrepancies. This results in a slow customer verification and on-boarding process.
4. Ongoing Monitoring. Constantly changing data means regular and recurring screening of customers. Depending on your risk-based approach, this could mean quarterly, weekly, or even daily screening. A poor screening system invariably leads to an inaccurate and ineffective batch monitoring program.

Traditional sanction screening solutions are designed to filter a set of watchlists. The search results are then manually exported for review. To stay relevant and competitive, credit unions must move from screening tools built around integrated manual workflows to stand-alone decisioning systems that automatically clear false positives to yield actionable screening decisions. All this in near real-time, with a human readable and audit friendly decision proof-of-work file, and without requiring manual effort.

Manual-centric AML compliance systems are by nature reactive. When processes are dependent on manually clearing a mountain of false positives and routinely tie up a large amount of resources, credit union leaders can feel like they are never in control.

On the other hand, a smart, automated sanction screening decisioning system can render 95% of all verification decisions automatically within a 60-second response time and a low decision error rate. For records that require manual screening, they can be sent within minutes to compliance officers, who should have all the info they need to take immediate action.

With DecisionIQ, we put credit union AML compliance teams back in the driver’s seat. We take a risk-based approach coupled with the best watchlist data and latest technologies in search, scoring, AI, NLP, and decision systems. Automated clearing dramatically speeds up on-boarding while reducing wasteful manual work. Each decision is accompanied by a rational proof-of-work file that is securely stored. All case management and AML officer reviews can be done electronically, and best of all, our highly intelligent monitoring system actively tracks watchlist data changes, automatically re-scans impacted customer records, and only send an alert when appropriate. This means no more manual redundant reprocessing of customer batch files in the name of ongoing monitoring!

No Need to Go it Alone

Credit unions do not have to figure out the best AML compliance system on their own, nor should they resort to requiring staff to multi-task between their regular roles and AML/CFT compliance efforts. Our qualified CAMS and VSkills certified specialists have experience working with credit unions and can help with a range of compliance needs, from revamping an AML system or tailoring our products to fit established workflows.

In Closing…

Smart data and automated decisioning promise to be a fundamental part of AML compliance among all financial institutions in the future. Credit unions, however, require smart AML compliance solutions that suit their unique structure, workflow, transactional needs and budget. Such systems are more than just a way for credit unions to stay AML compliant. They are necessary growth strategy that can keep them competitive in the years ahead.

Want to learn more about how KYC2020 solutions can help your financial institution? Contact us here or send us an email at sales@kyc2020.com.

KYC2020 is also not alone in the world of RegTech innovation. To find out more about other 2021 innovators, check out the RegTech100 list.

.

Anti-money laundering (AML) compliance has always been a significant burden to credit unions. But as the new year gets underway, fulfilling the regulatory requirements against financial crime may be all the more daunting.

Over the past few years, consumers and a growing range of business clients have been seeking faster banking, more convenient access to their accounts and quicker funding decisions. But credit unions have been stuck treading water in the rising wave of new and existing financial regulations, while risks of default, fraud and other types of cybercrime continue to mount.

Historically, AML compliance and regulation did not apply to credit unions in the same way it has to larger banks and traditional financial institutions. However, as digital commerce goes mainstream among credit unions and they open the door to under-served, yet higher-risk businesses, recent changes to BSA/AML compliance have been shifting this dynamic.

Understanding the Challenges in Credit Union AML Compliance

In the first article of this series, we looked at the four critical pillars of AML/CFT compliance among credit unions. In this second article, we’ll now examine the five biggest obstacles that are standing in the way of an accurate and effective compliance program.

Balancing Accuracy and Speed

Regulatory authorities have been charging hefty fines to financial institutions that fail to meet all the compliance requirements of AML, KYC, and BSA. In fact in 2020 alone, financial institutions across the world have been penalized with a staggering $10.4 billion in fines and penalties.

The continual screening, monitoring, recording and reporting requirements is a resource-intensive business process for even the biggest financial institutions. Big banks, however, can afford to throw people and money at the process, and they can more easily absorb the financial “hiccups” along the way.

With smaller financial institutions there is a struggle to balance accuracy and speed while fulfilling ALM/CFT compliance regulations. Many credit unions still employ legacy systems that rely on a significant amount of manual activity and action.

Not only are these systems expensive to run, maintain and upgrade, but they are incredibly inefficient, too. The reliance on manual, repetitive procedures increases the chance of mistakes and omissions, and onerous reporting and auditing requirements frequently tie up employee time and attention. Moreover, senior leaders continue to invest significant time and money into cybersecurity and compliance rather than strategic initiatives and goals.

Making Informed, Smart Data-Driven Decisions

This leads us to a rather strange paradox: Many financial institutions already understand that in order to comply with anti-money laundering, fraud and data security regulations, they need the assistance of automated software. A number of credit unions have already done the research and plugged the best tools into their system. But instead of improving performance, their compliance efforts are impeded.

There are two main reasons for such an outcome. The first issue involves the synergy between automation, AI, and machine learning on one side with human decision-making, input and due diligence on the other side. Relying too heavily on manual operations opens the door to inefficiencies and inaccuracies. But, an over-reliance on the results of AML detection and risk assessment solutions, can lead to a disproportionate amount of false positives and negatives– the effects of which can be catastrophic for both the credit union and its members.

The second issue can be traced back to bad data. Global watchlist data, especially PEP, RCA, HIO, is unstructured, impractical and “ugly.” Though it’s a real challenge to aggregate and standardize, it is mis-information to think that it’s a “big data” problem. The race to bigger databases leads to lack of quality in the data itself. Credit unions would be wise to start with quality data such as VisionIQ Global Watchlist Database where the data philosophy is compliant, comprehensive, and smart versus big, getting bigger, and becoming dirtier.

For these reasons, it’s not uncommon for an AML system to generate a high proportion of false positives. We’re talking about 80 to 90 percent of alerts. If a credit union blindly acts on a suspicious activity alert and files a SAR on a client, yet the client’s transaction activity was actually legitimate, it can lead the financial institution down a rather destructive path.

The member client will now become subject to frequent review. Each review will scrutinize the customer’s financial activity. If the suspected suspicious activity happens again, the credit union could decide to close all associated accounts. Multiple SARs could also attract the interest of law enforcement and eventually lead to an investigation. An initial query by internal AML investigators can easily de-risk a client who is making legitimate transactions and save a tremendous amount of time, money and headache.

On the other hand, if credit unions are not diligent enough in monitoring transactional activity and paying attention to other red flags, they become complicit with the illegal activities of the clients in their watch. Many compliance and risk assessment monitoring systems are equipped to mitigate risk on behalf of the financial institution. Credit union leaders would do well to keep in mind that although these solutions are getting better with time, the techniques and strategies criminals are using to cover up fraudulent behavior are, too.

Working with MSBs and “High-Risk” Entities

With increasing regulatory scrutiny on large financial institutions, many high-risk clients, such as money services businesses (MSBs) and marijuana-related companies, are turning to credit unions for their banking needs.

Some of these high-risk organizations may indeed be involved in money laundering and other financial crimes. Small institutions are preferred targets for such operations since they tend to have less regulatory oversight and compliance processes in place.

Consider, for example, a large MSB. A money services client can generate significant transaction volumes that could overwhelm a small credit union. Yet to ensure compliance with the KYC and BSA regulations, a credit union must continue to assess the risks posed by this client, closely monitor activity, report any unusual behavior, and implement a range of added controls to manage any exposure to risk. This includes continuously monitoring media for relevant negative news on their customers and members.

Such AML compliance measures may often be at odds with providing a good customer experience to high-risk credit union members, but are necessary. Fast, sophisticated, affordable, and low-friction regulation technology solutions can be a boon to help balance both goals. For example, as it relates to negative news screening, our Adverse Media Check ®, relies on AI, Machine Learning, and Natural Language Processing to continuously monitor thousands of relevant global news sources to create a persona database of individuals, companies, and politically exposed persons (PEPs) for relevant negative news. But we don’t stop there, the results are then fed into a AI-based decisioning system to clear false positives and identify risk. More about this and other market solutions in our final article in this series.

Mitigating Data Security Threats

As incidents of cyberattacks continue to evolve and grow, small and mid-sized credit unions face a greater threat in a sense than the largest enterprises due to their tighter budgets and access to fewer resources. Compromised customer data typically leads to fraud, stolen identities, and more. Solving for AML compliance should not be at a cost of compromising customer data.

Only sustainable data security best practices will help credit unions stay BSA/AML compliant while keeping their data and networks safe. Specifically, credit unions must now have controls in place to protect the security and confidentiality of member records, respond to and report security breaches in a timely manner, and maintain vital data helpful in identifying the source of cyber criminal behavior.

Maintaining a Positive Customer Experience

Customer expectations for fast, seamless banking create two competing priorities for financial institutions: staying AML compliant and keeping customers happy. Slow on-boarding, false positives, and cyberattacks will certainly compromise that experience.

Credit unions are known for their customer service towards members and it is a big reason why clients would choose to bank there. According to a recent PwC report, speed, convenience, helpful employees and friendly service is important for more than 70% of banking consumers, and positive customer experiences influence 75% of customer decisions in banking. Satisfied credit union members are loyal customers who will increase the scope of their relationship and recommend their credit union to others.

In short, AML/CFT compliance has always been a complicated, resource-intensive process for credit unions, and all signs indicate that it will only get more challenging in the years ahead. But, credit unions don’t have to go through this process alone. A number of regulation technology innovators can help credit unions stay compliant, even with evolving threats, while maintaining the level of quality service they are known for. At KYC2020, we have a history of working within the credit union space. We understand the unique challenges credit unions face on a daily basis and offer local solutions.

In the last article of our AML for credit unions series, we’ll examine some of the many solutions that are giving credit unions the technological edge they need to both stay compliant and expand their operations.

.

….

.

For SME’s, credit unions, and Fintech companies, finding efficient and affordable solutions had been out of reach… until now.  RegTech innovators are taking advantage of AI, ML (machine learning), and NLP (natural language processing) to deliver compliant screening solutions that are fast, affordable, and low friction for smaller businesses.

The False Positives Challenge

There are a few factors that slow down the timing of approvals during screening. A main one is the volume of false positives exposed. This is a nightmare for companies looking to improve their customer acquisition. They win customers by advertising faster approvals in opening accounts and managing transactions.

When the volume of false positives spirals out of control, unexpected delays extend from a few days to weeks. Moreover, delays in customer onboarding and transaction processing do not just cause frustration for the customer but also for the company.

Online customers are not sticky, and according to a study done by Forbes, customer experience is perhaps the biggest reason why customers switch vendors.

Machine learning and AI

With AI and machine learning becoming an essential part of the compliance world. Companies can now manage the volume of false positives with autonomous clearing of alerts. AI based decision systems use a rule-based approach and built-in learning models to filter out the data.

Once the AI learns of a particular alert that is cleared manually, it will learn the behavior and create new rules to clear false positives automatically.

Decision systems for automated clearing of false positives can be a business savior. However, replacing human intelligence with artificial intelligence does not come without risks. You need to follow best practices to avoid auditor scrutiny and avoid penalties for non-compliance.

For example, one of the system’s most important features is that it must be auditable and provide transparent proof of decision that is easy to read and track. For more on best practices for AI-based decision systems, download this whitepaper from KYC2020.

An ongoing process

Ongoing monitoring of customers is a requirement for most AML compliance regimes since databases and sanction lists update almost daily.

Algorithms are always learning new alerts and rules. Manual processes are no match against AI-based systems for ongoing monitoring of customer lists. Development of AI, Machine Learning (ML), and Natural Language Processing (NLP) in AML compliance applications reduces the need for human reviews of false positives. This seemingly simple addition shortens the time required to get approvals.

Win-Win-Win

The best outcome for smaller companies is to move towards a tech-based compliance approach for their customers. This will help reduce the possibilities of fines for non-compliance and make it cost-effective for companies to carry out compliance.

KYC2020 provides affordable and effective AML compliance solutions that take advantage of latest technologies. KYC2020 is the best in class source for global Sanction, PEP, HIO, and Adverse Media data. We have designed our AI and NLP based screening and ongoing monitoring solutions to eliminate false positives and reduce manual work.

Contact Us for a free trial or to learn more about why KYC2020 is recognized as one of the world’s most innovative regulation technology solution providers by RegTech Analyst.

Most startups find hiring a professional to create an AML program too costly, so they end up creating their AML policy themselves. This is a risky proposition as they usually lack the expertise to identify potential pitfalls. Banks are wary of DIY attempts, and costly delays or false starts haunt those Fintechs that pursue the DIY method.

What is an AML Policy?

An AML policy details the steps your organization takes to combat financial crimes such as money laundering and terrorist financing. Regulations have slight variations depending on your jurisdiction, but largely follow the Financial Action Task Force (FATF) recommendations to help align global efforts in combating financial crimes. Since most jurisdictions largely apply the FATF recommendations, it is possible for you to create an AML policy through a template. But using templates can have its disadvantages which we will talk about later.

Why You Need an AML Policy for Your Fintech Startup?

While some Fintechs are regulated directly, and must comply with the law by having an AML policy, many more must comply because their financial partners require it. Failure to comply with AML regulations can result in fines, cease and desist notices, and permanent industry bans. For startups, even small fines can cause a business venture to fail, and delays while you negotiate your policy with the banks take time and resources away from the business venture. Enacting an appropriate AML policy to ensure you follow all AML regulations keeps risks to a minimum.

How To Create an AML Policy

Creating an AML policy must, therefore, be a priority for regulated organizations, and those Fintechs that partner with banks to provide financial services. For those interested in the DIY method, there are free resources online such as FINRA’s AML template. This template guides you through each piece of information you need to include in your AML policy complete with examples of how you should fill it in. You can use this template to create your policy and then have an expert review or complete the policy. This provides you with a cost-effective method of ensuring your policy follows all AML regulations without the need to hire a professional for the entire process.

Firm Policy

The first section of an AML policy outlines your firm’s policy on your intentions to combat money laundering and other financial crimes. Within this section you define the kinds of financial crimes that your Fintech startup could be exposed to and confirm your intentions to fully comply with all AML regulations, by detecting and deterring such attempts.

AML Compliance Personnel Designations

In the next section, you designate who is responsible for AML compliance within your organization. The key role you must fill to ensure AML compliance is the Chief AML Compliance Officer, or CAMLO. This individual oversees your entire AML compliance operation ensuring your overall compliance as well as determining how to improve the way you achieve compliance.

Sharing AML Information with Law Enforcement

This section provides an overview of your organization’s policies for sharing all AML information with the applicable authorities. As part of your AML compliance, you must share all of your findings related to AML with the authorities applicable to your jurisdiction. Within this section you should highlight which authorities your organization can share information with and how your organization will share that information. Generally, you must comply with all requests from FinCEN, National Security Letters, Grand Jury Subpoenas, and most law enforcement requests subject to a subpoena; however, some jurisdictions have additional discovery methods.

Sharing AML Information with Other Financial Institutions

While you are not required to share information with other financial institutions, it can help you fulfill your AML compliance obligations. Within this section, you must detail whether you intend to share certain types of otherwise confidential information with other financial institutions. If you intend to share information with other financial institutions, you should include how you intend to share that information and under what circumstances you intend to share information.

Procedure for Checking Sanctions Lists

The Office of Foreign Asset Control maintains a list of sanctioned entities and individuals. Though this section is not directly related to AML, the requirements to identify individuals are so closely tied to the AML expectations, that they are often lumped together. This section demonstrates your organization’s compliance with these sanctions. Within this section you detail your organization’s exact steps for checking all sanctions lists when opening a new account for a client, altering an existing account, or partnering with a client. For an inventory of global watchlists and a list of sanction screening solution vendors visit Mr. Watchlist. For help with what sanction lists you should be screening for your compliance program, check out this free Watchlist Builder Tool from KYC2020.

Know Your Customer (KYC) Compliance

Your Fintech’s method for verifying the identities of your customers is required in writing within your organization’s AML policy. These regulations are commonly referred to as Know Your Customer, or KYC, regulations. These regulations are so close to the OFAC identification requirements that they are usually lumped together. In this section you must define reasonable procedures your company follows to confirm the identity of your customers. These procedures must include:

• Required customer information
• Customers that refuse to provide information
• Verifying information
• Record keeping
• Comparison of customers to terrorist lists
• Notice to customers
• Any organizations your organization relies on for identity verification

Customer Due Diligence

This section declares that your organization establishes a customer’s risk rating. It must outline how you will identify beneficial owners, politically exposed persons, and senior management of organizations. You must also define when your organization follows an enhanced due diligence procedure based on the individual’s risk rating.

Filing Suspicious Activity Reports and Currency Transaction Reports

Finally, your AML policy must declare your organization’s procedures for filing suspicious activity reports (SAR) and currency transaction reports (CTR). You must include that your organization will file CTRs for any currency transaction exceeding $10,000 and how you file your CTRs. Filing a SAR is determined by certain requirements and the result of your organization’s monitoring. In some cases you can move this responsibility to the partnering bank, while in other cases, you must file these reports with FinCEN directly.

Simplify the Process with KYC2020’s AML Policy Builder

Taking a template and filling it out for your specific business can become a difficult and time-consuming task. Figuring out how to write each section and what information must go in each section only becomes more complicated the more you learn. So, to make the process easier, KYC2020 created a special AML Policy Builder tool. This tool helps you create your AML policy without the hassle of typing out legalese. All you need to do is answer questions specific to your business, and the policy builder creates a full document for you to use. It also provides a review function, tracking and version control capabilities, and the ability to engage an AML specialist to securely and confidentially review your policy or AML compliance regime.

Reviewing Your AML Policy

Once you write your AML policy, whether you use a template or KYC2020’s AML Policy Builder tool, you will want to have an expert review it to ensure your program is complete and effective. The AML Policy Builder tool is supported by KYC2020’s network of qualified independent AML specialists. You can use the hire function from within the tool to engage an expert to review or help complete your policy. This allows you to benefit from the expertise of an AML professional without the high cost of having one create your entire AML policy.

Your AML policy defines exactly how you intend to achieve AML compliance and can be subject to review by various AML compliance agencies. So, getting your AML policy right the first time is of the utmost importance. If you are confused by any aspect of your AML policy, reach out to KYC2020 to have an AML professional review and guide you on the best practices used to achieve compliance.

Why You Need a CAMLO

Many countries around the world have adopted the Financial Action Task Force (FATF) recommendations which requires a CAMLO be designated. For example, in implementing the Bank Secrecy Act (BSA), the United States government appointed various regulators and oversight groups like FinCen, FINRA, and the SEC. These groups ensure that identified entities, including most FinTech, comply with all AML regulations. FINRA is an example of a Self-Regulatory Organization (SRO) that ensures all dealer-brokers implement an Anti-Money Laundering Compliance Program. This program requires that the AML Compliance Officer (ie. CAMLO) oversee the program and provide a point of contact between the organization and FINRA. Other requirements of an AML Compliance Program under FINRA Rule 3310 include:

• Written approval of the program by senior management
• Reasonable assurance of detection and reporting any suspicious activity
• Achieve reasonable compliance with all AML regulations with a risk based customer identification program
• Provide regular independent testing
• Continuous training for all relevant employees and customers

So, to achieve full compliance your organization is required to designate one of the members of your organization as your CAMLO.

The Roles and Responsibilities of a CAMLO

Essentially, your CAMLO is responsible for ensuring your Fintech startup efficiently complies with all AML regulations. This takes the form of managing risks, advising on business strategies, training relevant employees, staying up to date on changing regulations, and finding cost saving methods to achieve compliance.

Your CAMLO helps your organization determine your acceptable level of risk when it comes to complying with AML regulations. Once your risk levels are determined, they create an AML Compliance Program according to your acceptable risk. While an effective compliance program is required, what constitutes “effective” is left up to interpretation leaving room to match the program to your organization.

A CAMLO also advises on your business strategies to ensure your methods of growth still allows for AML compliance. Taking their recommendations and utilizing them keeps your risks of violating any regulations to a minimum. This also ties into training relevant employees. Keeping those in charge of business strategy up to date on how your organization maintains AML compliance enables them to make better decisions on how to grow your business.

The complexity of AML regulations cannot be understated. As they constantly shift to keep up with new technologies and demands, your CAMLO must understand how they continue to evolve. Some of these shifting rules could lead to ways you can save on your compliance costs. Your CAMLO can identify these regulations and alter your AML Compliance Program accordingly.

Legal & Financial Accountability

Prior to designating yourself or one of the members of your organization as a CAMLO, they need to understand the risks they are taking. If your startup is found to be in violation of AML regulations whomever you designate as your CAMLO can be held personally responsible. For example, MoneyGram’s AML Compliance Officer paid a $250,000 penalty for failing to comply with regulations in New York State. These violations included failure to terminate their relationship with fraudulent organizations and failure to implement organizational policies to terminate relationships with high risk organizations.

In just February of 2018 two other cases like this penalized the compliance officer of the US Bank and Rabobank. The liability of a CAMLO significantly changed after Wells Fargo’s officer was found in violation in November of 2017. Prior to this case, most violations were directed at the organization instead of the individual. This new wave of charging individuals instead of organizations alleviates some responsibility. However, it makes it more difficult for Fintech startups to designate themselves as their organization’s CAMLO without taking on unnecessary risks. So, if you are considering designating yourself as your startup’s CAMLO, you must be sure you fully understand how to achieve full compliance to minimize your personal risk. You may wish to consider ensuring your E&O insurance covers this type of risk.

Alternative Options to Ensure Compliance and Minimize Risk

There are several cost-effective options to ensure full compliance with AML regulations and avoid taking unnecessary risks. These options can include:

• Employing a part-time expert and designating them as your CAMLO
• Hiring a consultant to review and advise you on maintaining your compliance program
• Create a culture of training and learning to ensure your entire organization helps maintain AML compliance

Employing a part-time expert provides a simple way to avoid personal risks of violating AML regulations. They will most likely request that your E&O cover them in any lapses your organization has failed to implement. They can fully understand your organization and goals to create programs that ensure compliance. While this is likely the most expensive method of designating a CAMLO, it minimizes your personal and organizational risks.

Hiring a consultant does not provide you with a CAMLO, however it does minimize the risks associated with designating yourself as your organization’s compliance officer. They can create your compliance program and advise you on how to implement the program. The consultant can also train your employees on keeping your startup fully compliant. Keeping this culture of training and learning helps your employees stay up to date on changing regulations long after the consultant has finished their work.  Here are 5 Key Aspects to Finding the Right CAMLO when you to to hire a consultant.

Conclusion

While becoming the Chief AML Compliance Officer for your fintech startup is possible, it requires extensive work, preparation, and ongoing maintenance to keep yourself qualified and your firm from being fined for a violation. KYC2020 offers a quiz to help you assess your basic knowledge of AML compliance regulations by your business type. Take the quiz and find out whether you should even consider putting on the CAMLO hat and take on the additional liability.

KYC2020 also supports a network of certified independent AML specialists that can advise you on effective options to maintain compliance. They look into your organization and how you operate to provide cost-effective plans your organization can follow. At first glance AML compliance may seem like a burden to getting your fintech startup off the ground, however it does not have to be complicated or costly with the help of KYC2020.

• Financial Industry Regulatory Authority (FINRA)
• Financial Crimes Enforcement Network (FinCEN)
• Federal Financial Institutions Examination Council (FFIEC)

Financial Industry Regulatory Authority (FINRA)

FINRA is a private corporation in the United States that acts as a self-regulatory authority. It became the successor of the National Association of Securities Dealers in 2007 shortly after the SEC approved its formation. Since then, FINRA grew to over 3,400 employees working primarily out of Washington, D.C. and New York, NY with 20 other regional offices throughout the United States.

FINRA’s overall responsibilities revolve around regulating member brokerage firms and exchange markets, one part of which is ensuring AML compliance. With these responsibilities, the 3,400 employees oversee approximately 4,250 brokerage firms, 154,000 branch offices, and 625,000 registered representatives. As a part of these responsibilities, FINRA holds periodic regulatory exams for all member firms they oversee. These reviews help FINRA determine where they see room for improvement within these institutions for more streamlined compliance.

Despite being a private corporation, the Securities and Exchange Commission granted FINRA approval to discipline registered representatives and member firms. They also license individuals, admit firms to the industry, and create the rules that govern their behavior. In 2018 alone, FINRA levied approximately $61 million in fines and another $25 million in restitutions. This makes them one of the primary organizations you will have to deal with to achieve AML compliance if you are dealing in securities. They set the rules and regulate them, so be sure to pay attention to everything they do.

Financial Crimes Enforcement Network (FinCEN)

FinCEN was formed in 1990 with the goal of combating domestic and international money laundering, terrorist financing, and other financial crimes. They’re a bureau of the United States Department of Treasury that analyzes information about financial transactions. They are one of 147 Financial Intelligence Units (FIUs) that make up the Egmont Group of Financial Intelligence Units. FinCEN’s director summed up their mission through a statement in 2013 as, “safeguard the financial system from illicit use, combat money laundering and promote national security.” They accomplish this mission through following any financial trails that might lead to a case of money laundering, terrorist financing, or other financial crimes.

One of FinCEN’s primary responsibilities revolve around data collection and data use. They created the FinCEN Query which allows other Financial Intelligence Units to search the mass amounts of data FinCEN collects on all financial transactions. The search engine operates similar to Google making it easy for any of the Financial Intelligence Units to find any information they need. They also create four yearly reports:

• Suspicious Activity Report
• Currency Transaction Report
• The Designation of Exempt Person
• Registered Money Service Business

These reports contain their findings on various threats and indicators facing the United States when it comes to combating money laundering, terrorist finance, and financial crime

Through the use of the extensive data they collect on financial transaction, they conduct investigations into at risk individuals and organizations. This puts anyone not following AML regulations at risk of an expensive investigation that could halt your business entirely. So, to avoid a nasty letter from FinCEN, make sure you follow all financial requirements and regulations to ensure you do not participate in money laundering, terrorist financing, or any other financial crimes.

Federal Financial Institutions Examination Council (FFIEC)

The FFIEC was established in 1979 through the Financial Institutions Regulatory and Interest Rate Control Act of 1978. They are composed of five banking regulators that create uniform guidelines and standards that every financial institution must follow. The five banking regulators that make up the FFIEC include:

• Federal Reserve Board of Governors
• Federal Deposit Insurance Corporation
• National Credit Union Administration
• Office of the Comptroller of the Currency
• Consumer Financial Protection Bureau

In recent times, one of the top priorities of the FFIEC became protecting financial institutions from cyber-attacks. They achieve this through creating guidelines and standards for cyber security that every financial institution must follow. As part of their effort to help financial institutions combat cyber-attacks, they released the Cybersecurity Assessment Tool. Regulators of the FFIEC use the results of this tool as part of their examination into any financial institution.

Another helpful resource the FFIEC released to simplify compliance with the Bank Secrecy Act and Anti-Money Laundering is their BSA/AML info base. Within this infobase you can find guidelines to help you achieve AML compliance, examination manuals, and a range of other resources to help you maintain compliance. Since their overall goal surrounds helping financial institutions combat financial crimes, they aim to teach appropriate standards you should follow to maintain compliance. You can also use this database to see exactly what the FFIEC looks for during compliance examinations of your organization. This helps ensure you pass your examination when that time inevitably comes. You should look to the FFIEC to help you create procedures and maintain compliance with all BSA and AML regulations.

Do You Need Help Achieving and Maintaining AML Compliance?

These organizations are only the tip of the iceberg when it comes to navigating the complexities of AML Compliance. There is the OFAC which regulates all foreign assets, the OCC, FDIC, FRB, CFPB, and then various state level oversight agencies. These organizations play an important role in ensuring you remain compliant with all AML regulations.

If you need help navigating the complexities of AML compliance, contact KYC2020 for a consultation today. They offer software tools to help you manage all aspects of AML compliance and streamline your AML Compliance Program to ensure efficiency. KYC2020 also supports a network of qualified CAMS certified AML Compliance Specialists to help answer any of your questions and guide you through the process of achieving AML compliance. AML compliance does not have to be costly or complicated, so let KYC2020 help you decide your next steps to achieving and maintaining AML compliance in a cost effective and efficient way.

Spreadsheets for Everything

While an RA is the foundation for a good risk-based AML Regime, it is often marginalized by many non-bank financial firms.  It is done in a superficial manner, using tools that are convenient and free, but ill-suited for the job. Spreadsheets are generally the tool of choice to input, track, and manage the annual risk assessment compliance requirement. As one can imagine, this approach is rather ineffective. It lacks proper controls, is prone to human-errors, difficult to audit, share, or track revision history. Moreover, as banks enhance their KYC regimes, they require annually updated formal AML Risk Assessment documentation.  The inherent limitations of spreadsheets for RA reporting and management is obvious.

Alternatives to Spreadsheets

So then, what are the alternatives to spreadsheets? The challenge once again for most SMEs and FinTech innovators is Cost, Availability, Competence, and Convenience. In our search for alternatives, we could not find a competent RA tool that met our basic requirements, was available at low-cost, was easy to get started, and convenient to use.

When we introduced our FREE Watchlist Curator Tool, we made the following statement:

“At KYC2020, we could have invested in writing a blog and talked about why “over-screening” is an expensive problem…  Instead, we decided to have our CAMS AML specialists build a tool to help you identify what Sanction, PEP, and watchlists you should be screening based on your company’s risk profile. And we decided to make our watchlist builder available free of charge.”

KYC2020 Free AML Risk Assessment Tool

For our AML Risk Assessment Tool, we decided not to be so lazy. We not only built a tool that we could make available for FREE, but also forced our CAMLO, Joseph Iuso, CAMS, to write a Blog on the What, Why, and How’s of an AML Risk Assessment. Between the information and wisdom of Joseph’s blog and the competence and convenience of our RA tool, I believe we have got you covered. Of course, we have the standard disclaimers, and you should already know that a tool cannot replace the advice of your in-house Compliance Officer.

Get started by clicking below.

KYC2020 AML Risk Assessment Tool benefits heavily from the Federal Financial Institutions Examination Council’s (FFIEC) Risk Assessment guidelines, as well as the Conference of State Bank Supervisors (CSBS) BSA/AML Self Assessment tool.  The tool considers five (5) main categories to arrive at an aggregate risk score for your business. These are: 1) Products and Services, 2) Customers, 3) Geography, 4) Operations, and 5) Agents. For each category, you have the opportunity to specify the High, Medium, and Low Risk definitions inherent to the business. For the inherent risk definitions you then specify your controls and mitigation measures to arrive at the residual risk; the risk that still remains after application of your counter-measures. This residual risk is then scored and aggregated across all categories to complete your risk assessment.

Who said it would be Easy

Sounds complicated? That’s because it is. Even for AML specialists working on a low-risk profile business, this is a minimum 2+ hour investment of time. It is for this reason the tool has the ability to save work and complete the assessment over multiple sessions. With a little bit of study, watching our Get Started Video, and rolling up your sleeves you can get through with your risk assessment on your own and for FREE!

Need Help with your RA?

For those who need a little bit of help completing, we offer some reasonably priced paid options to speed up your risk assessment process and follow best practices. These include, access to business specific templates that can be customized to speed up the assessment, different consulting packages to help prepare, review, and/or audit your Risk Assessment by our CAMS or VSKILLS certified AML specialist.

Once again, there is no catch. The tool is no obligation and we do not take any payment information. We do hope you might take the time to see what awesome and affordable AML compliance solutions we offer, from Global Watchlist Data to Sanction Screening to AML compliance consulting services. Chat with us online now, email us, or just use the tool. Our aim is to help you reduce the cost and friction of AML compliance.

AML Training Program and Strong Internal Controls

AML compliance cannot be confined to a single department. It is an organization-wide process. If you want to have a proper AML Compliance program in place, then you must carry out training sessions with all of your employees. Make sure they are aware of good AML practices and also play an active role in implementing them. A lot of suspect organizations and individuals will look legitimate to your system and pass security checks, setting up ‘checkpoints’ in the form of diligent employees can prevent this.

Independent Audits

Besides the inclusion of AML policies and procedures within the company, you must also be open to independent audits. These are conducted by qualified teams and can help identify any inconsistencies in the company’s financial records. Audits tend to feel invasive, but they are in everyone’s best interests. They also help make sure that your system of internal controls is working.

Open Communication

Communication is one of the requirements of AML Compliance. You must try and propagate a culture where your employees can approach the senior management and the appointed compliance officer regarding anti-money laundering.  The resulting trust and transparency will encourage the employees to take AML practices more seriously. It will also help identify any existing drawbacks in your current AML compliance program.

Use Technology

This is extremely important. AML compliance does not come cheap. There are significant costs attached to it, which is why a number of small businesses may fail to implement sound AML practices in their company. Technological solutions can help you out in this regard. These not only make it easier to follow AML guidelines, but they also reduce compliance issues. In case any discrepancies are detected, these solutions also enable you to respond quickly and resolve the situation. Let’s take a look at some of the tools you can consider using:

Global Watch Lists and Screening Solutions:

One of the most useful digital solutions for AML compliance is accessing a global watch list. This helps you access a database carrying more than 900 international watch lists. Using this can help speed up your screening process.

There are also screening solutions available that are designed to minimize the chances of false positives. You can look for an option that suits your budget. The best digital solutions providers will offer you flexible packages.

Screening Decisions and Risk Assessment Tools

Carrying out a manual risk assessment and then taking a decision can be extremely time-consuming. Fortunately, you can use software that can take a decision on your behalf. This will ensure that you remain compliant while also speed things up.

The Final Word

AML compliance is not easy, but it is not impossible either. All you really need to do is strike a balance between an organization-wide commitment and seeking aid from technology. If you’re looking for strong AML compliance tools, we suggest you contact the team at KYC2020.

The chance of becoming an unwitting conduit for a money laundering scheme is becoming greater for small and medium-sized enterprises (SMEs) recently. Criminals are adopting more sophisticated means of circumventing the traditional defenses against money laundering. SMEs can become easy targets if they don’t keep up their guard. At the same time, regulatory requirements have gotten tighter and the consequences for failing to comply have become more harsh.

Companies with in-house solutions are at increased liability when it comes to these regulations. So how can you minimize your liability and improve your AML regime? Outsourcing your AML compliance solution is one idea. This method is cost efficient and works to mitigate company liability. But outsourcing isn’t without its risks. Sharing confidential data with a third-party can be risky, if you aren’t careful.

Here are a few things to consider before your organization makes the plunge into third-party compliance solutions.

Improvements in AML Policies and Infrastructure

Traditional enterprise AML compliance solutions require a lot of investment and ongoing manpower to run effectively. These systems were not developed for SMEs and as such, and can be difficult for small companies for small companies to source the resources to run them. In-house AML compliance regimes need to be maintained. For smaller companies, this can be a huge disruption. Outsourcing your AML compliance alleviates these potential stressors by taking the onus off of the company and putting it in the hands of experienced professionals. A team that can handle:

• Reviewing your existing AML controls
• Preparing and helping with the implementation of a robust AML compliance program
• Preparing your organization for audits

Access to CAMLO Services

Every organization should have a chief AML officer (CAMLO) to head its AML compliance program. These individuals receive regular training on anti-money laundering practices. They also stay up-to-date with money laundering trends and use this information to align the existing AML regime of an organization with changing laws and regulations. However, acquiring the services of a chief AML officer is considered a luxury that most SMEs cannot afford. If you’re considering outsourcing your AML compliance, check that the service provider offers you the equivalent of a CAMLO. The addition of a CAMLO can improve the quality of your AML compliance program and help you meet global compliance standards.

Access to Technology

Some AML compliance firms make use of technological solutions that help automate AML procedures. This can prove to be extremely cost-effective for small organizations that that use/employ manual methods. These tools also help improve the accuracy and speed of AML-related screening and decision-making. You can process new clients much faster and stick to the pre-requisites of your AML regime without inconveniencing a client.

To Sum It Up

Some organizations cannot outsource their compliance activities due to the nature of their operations. For others, outsourcing is definitely an alternative. However, it’s important that you understand the security risks of outsourcing your AML compliance. Opting for a reputable company with positive reviews is one way to avoid a breach of security.

KYC2020 isn’t just an AML Software solutions provider. Our team of CAMS and VSkills certified AML specialists can help you with your consulting and outsourcing needs. We have experience working with, and understand, the unique needs of SMEs, virtual currency operators, ICOs, Charities, and MSBs. Learn more about our consulting services by clicking here.