In an effort to increase loans and deposits and expand their customer base, smaller financial institutions and credit unions have been considering whether or not to work with cannabis-related businesses. It’s a decision that should not be taken lightly. Servicing this customer pool will in some cases greatly increase your institution’s risk profile. It also entails significantly more scrutiny around Anti-Money Laundering/Bank Secrecy Act (AML/BSA) compliance.

Whether or not you decide to bank a cannabis-related entity, before your institution can even open its doors to this emerging market, there are two elements of your AML compliance regime in particular that you need to focus on:

1. A thorough risk assessment
2. A rock-solid onboarding process from start to finish

Much regulatory, legal and reputational damage can be averted right from the beginning when you have access to intelligent data, can automate screening processes, and can combine this with good KYC policies and systems.

A Brief Overview of the Cannabis Business Industry

One of the biggest challenges of cannabis business banking is that the Cannabis industry itself as well as the rules that guide it are incredibly diverse and extensive. For starters, cannabis products actually fall into one of three categories: hemp, Cannabidiol (CBD) oil, and marijuana. Each one of these categories is treated differently from a legal and regulatory standpoint. Complicating matters, there are also differences in the rules and regulations from one state to another.

Here is a brief rundown of each type of Cannabis product, including its current legal and regulatory standing:

Hemp

Hemp is a variety of the Cannabis sativa plant species that is grown specifically for commercial use. Hemp produces a broad range of cannabinoids, including tetrahydrocannabinol (THC), the intoxicating chemical in marijuana. Hemp, however, does not contain enough THC to produce intoxicating effects.

Many countries differentiate hemp from marijuana by the amount of THC produced by the plant. In the US, industrial hemp must not contain more than 0.3% THC.

Hemp has a variety of uses. Hemp fibers can be used to make an assortment of products including paper, clothing, textiles, rope, building materials and compost. Hemp seeds and the oil produced from them, on the other hand, can be consumed as healthy, nutrient-rich, super food.

CBD Oil

CBD oil comes from the flower and leaves of the hemp plant. It is not the same as hemp seed oil, which comes from the seed and contains little to no CBD. Over the past few years, there has been a growing demand for CBD oil as a wellness supplement to such an extent it is a sub-industry all to itself.

Both hemp and products containing CBD oil are treated the same from a legal and regulatory standpoint. CBD is also subject to Food and Drug Administration (FDA) oversight with respect to how products containing CBD can be advertised.

According to the 2018 Farm Bill, growing, processing and selling hemp and hemp derivatives is legal at the federal level, and so is transporting hemp across state lines.

There are, however, many restrictions placed on such activities. For instance, all growers, processors and dealers must be approved, registered and/or licensed by the U.S. Department of Agriculture (USDA). Hemp that is not produced in accordance with the 2018 Farm Bill is designated as illegal marijuana.

For financial institutions in particular, the Financial Crimes Enforcement Network (FinCEN) recently issued their guidance regarding due diligence requirements under the Bank Secrecy Act (BSA) for hemp-related business clients.

Marijuana

Marijuana is the dried leaves and flowering tops of either the cannabis sativa or cannabis indica plant. Since marijuana contains a significant amount of the psychoactive substance THC, it is still considered a Schedule 1 substance under federal law. Many states, however, have legalized the cultivation and selling of medical and/or recreational marijuana.

This odd contradiction between federal and state law has brought about two indirect, yet consequential results:

1. Marijuana is primarily a cash-based industry since most payment networks will not process marijuana-related transactions.
2. Many big marijuana companies rely on the investments of foreign individuals and entities.

Marijuana-related businesses (MRBs) can also be classified into one of two tiers:

1. Tier I MRB- A company that is directly involved in cultivating or dispensing marijuana
2. Tier II MRB- A company that supports Tier I MRBs, such as hydroponic suppliers, packaging suppliers, licensing consultants, or marijuana software providers

Although cannabis business banking may be challenging in the current environment, it represents a potentially lucrative emerging industry for financial institutions. With total sales of cannabis in the states where it is legal expected to reach nearly $30 billion by 2025, a growing number of cannabis-related businesses are seeking access to mainstream financial products.

Moreover, cannabis products derived from Hemp and CBD are both federally legal and considerably less taboo. This means that institutions looking for untapped markets, could get their foot in the door with less risk and uncertainty.

With MRBs, currently 36 states have legalized the distribution of medicinal and/or recreational marijuana. The largest draw for both banks and credit unions in this high-risk market is the vast untapped potential. Like any business, MRBs need access to financial services in order to survive and expand. The MRB industry, however, is expected to reach a staggering $57 billion by 2027, yet a majority of MRBs (70 percent in total) remain unbanked or under-banked.

Understanding Cannabis Business Banking Risk

Whether or not your financial institution chooses to bank hemp, CBD, or MRB customers, your will be making a risk-based business decision. There are three main areas of risk to consider right from the start:

The Risk Posed by the Cannabis Business

As mentioned above, the risks associated with banking hemp companies versus CBD companies versus MRBs all differ tremendously. Not only would you potentially need to stay updated with the current legal and regulatory status of hemp, CBD and marijuana businesses across several different regions, but there are serious know your customer (KYC) risks, too.

The big risk in banking hemp or CBD companies is that either:

• The hemp involved is actually marijuana
• The hemp or CBD company has not followed all legal requirements, such as having the correct licenses and registrations, or it is growing the hemp in a tract of land that has not been approved.

Support services provided by third parties to cannabis businesses, such as hemp testing facilities, may also put financial institutions at risk for money laundering schemes. These types of companies, however, generally do not pose the same amount of risk as direct cannabis businesses, such as farmers, processors, and dealers.

With cash-oriented MRBs, financial institutions face the real risk of legal action for money laundering and aiding and abetting in drug trafficking. But, that’s not all. Some legal MRBs are committing fraud or opening up shell companies just to gain access to the services of a financial institution. For example, an MRB may list itself as a “pharmacy”, “nursery” or “wellness center” in order to get through the onboarding process.

Risk Posed by the Beneficial Owner

Aside from the typical risk associated with politically exposed persons (PEP) or those with a criminal background, one of the biggest risks surrounding the beneficial owners of a cannabis-related business is figuring out who they are in the first place. The challenge is even greater when determining the true beneficial ownership of marijuana companies due to the prevalence of foreign investment and the prolific use of management agreements and shell companies in the industry.

Risk Posed by the Financial Product

The final area of risk to consider is that posed by the desired financial product(s). The risk to offer a deposit account differs greatly from the risk of providing a loan. Once you’ve determined the risk of the cannabis business itself and of the beneficial owner, making this decision depends on your institution’s risk appetite.

Mitigating the High Risk of Cannabis Banking from the Beginning

A great deal of mitigating the risk of cannabis business banking happens at the beginning, before a client has completed the onboarding process. There are two key steps and areas of focus your financial institution should be concerned about:

Conducting a Risk Assessment

After becoming familiar with the relevant laws and regulations across your institution’s entire footprint, you should conduct a cannabis-risk assessment and set your institution’s risk appetite for the industry. The risk assessment process with the aid of AML Compliance tools and consulting will provide an opportunity for your financial institution to see if cannabis business banking products and services truly fall within the scope of its strategy and risk appetite.

A significant part of your institution’s risk management starts with good KYC practices and systems. Thus, the risk assessment process should confirm whether there is adequate infrastructure and support in place in your AML compliance program. For instance, how is your institution scanning watchlist data, which alternative data sources will you be consulting, and how will matches be sorted and verified?

When evaluating any higher risk activities, the legal and regulatory impact should also be considered in terms of both AML/BSA compliance and potential exposure to litigation.

Developing a Thorough Onboarding Process

The Onboarding process starts with the onboarding request, followed by data capture and initial CDD/CIP, and then enhanced due diligence (EDD) for KYC. This is where much of your risk management and AML compliance happens in practice.

After conducting a risk assessment, you then need to set the risk-rating criteria and processes for risk-rating new customers. Here are a few important considerations:

• Use a comprehensive application and onboarding questionnaire to understand the nature of the business and its financial activity and to secure the necessary documentation, such as the business’ registration and license information. Because banking hemp or CBD is different from marijuana businesses, it’s good practice to have different onboarding questionnaires for each of the three types of cannabis products.

• Invest in automated onboarding technology powered by artificial intelligence and machine learning. These technologies can help your institution conduct enhanced due diligence and deep web searches for automating EDD. You’ll have better insight into the background of each business and its beneficial owners. Moreover, automated platforms such as our own DecisionIQ will not only screen for sanctions, PEP, criminal records, negative news media and more, but create an intelligent scoring engine that reduces manual processes and False Positives.

• Developing an onboarding process that reflects your risk appetite should always be considered a work in progress that you periodically return to and adjust where needed. This reevaluation process will also help your institution conduct its ongoing monitoring for suspicious activity.

In short, banking cannabis-related companies raises the level of risk for any financial institution. But your institution can mitigate the high risk in cannabis business banking by getting your onboarding process, systems and procedures in line with your risk appetite and financial goals.

.

.

In the previous article of the KYC 2020 Guide to PEP Screening, we learned that engaging with PEPs and RCAs who are involved in financial crime can be damaging to your financial institution’s reputation. Although you may already recognize the risk and have tried to address it with legacy screening systems, your current program may not provide enough protection and oversight.

AML/CFT systems and procedures need to protect your financial institution against corrupt PEPs and RCAs. However, these days they must do so while accurately verifying legitimate transactional activity and creating a positive customer experience.

Slow customer onboarding and the constant drumbeat of false positives will eat up your profitability and your competitive advantage. On the other hand, failing to identify corrupt PEPs or RCAs can lead to unwanted regulatory attention and action.

Thanks to AI and advancements in regulation technology (RegTech), screening for PEPs in global watchlists, government sources, and in adverse media is more effective, fast, and affordable than ever before.

Over the next four years, the global RegTech industry is expected to reach $16 billion. Much of this growth is driven by a wave of up-and-coming fintech innovators. These companies are harnessing advanced technologies to make AML compliance more doable and budget-friendly for smaller organizations and FinTech. In the process, they are leveling the playing field for financial innovators against their bigger, more established competitors.

Considerations Before Choosing PEP Data and Screening Solutions

One of the most important things to understand in your search for PEP data and screening solutions is that not all solutions (or vendors) are created equal. Not all solutions will be a perfect fit for your organization, either.

To give your institution a good chance of finding the most suitable tools for the identification and prevention of PEP financial corruption, keep in mind the following three considerations:

1. What are your needs?

Which kinds of PEPs or RCAs do you work with? What types of products or services does your organization offer that would be of interest to them? What is your workflow, and what AML/CFT compliance tools or technologies do you already employ?

Another important point to consider is how much direction and assistance you need to set up and run these tools. At KYC2020, for example, our CAMS and Vskills certified specialists help clients define a risk-based approach to compliance that fits their risk profile. We can also tailor our products to fit established workflows and assist with the integration.

2. What are the specifics of the PEP data and screening solution?

What is the scope of the solution? What methodologies does the vendor use? Does the AML/CFT compliance database go beyond sanction lists and other standard databases? Does the vendor also include other sources of data for PEP identification, such as negative news databases? How much of this data is truly necessary and how well is the data structured and de-duplicated? Does the vendor use advanced technologies such as AI and NLP for identity recognition and resolution? What search technologies does the software use to filter matches? How often is the data updated?

3. What kind of relationship does the vendor offer?

Who is the vendor and how do they work with their clients? Do they have experience working with your type of financial institution, credit union, Fintech company or MSB? Do they offer direct assistance and support to get started or integrate, as mentioned above?

Elements of a Good PEP and RCA Screening Tools

The most reliable, efficient, and modern data screening systems for PEPs and RCAs will include the following three core functions:

Smart Screening and Verification

Your institution is required by law to conduct reasonable procedures to identify PEPs either before a relationship is established or as part of the onboarding process. The quality of such screening, however, depends on the quality of the data you use. PEP and RCA sanctions screening always starts with traditional sanctions lists and Regulatory Authority databases. However, these watchlists are aggregated from thousands of independent sources, are highly unstructured, and are constantly changing. Simultaneously, sanctions are becoming more complex, while the number of regulatory bodies are growing.

In short, maintaining quality data is a resource-intensive challenge.

Given the nature of watchlist data, you must start with a smart watchlist database that is well structured, normalized, and regularly updated to catch true positives while minimizing false positives. This data should be coupled with an intelligent screening engine to help filter, sort and analyze search results.

In the event a firm wants to eliminate the manual effort of clearing false positives and speed up onboarding, they must move from screening to decisioning systems. These smart systems use AI to automatically clear false positives and deliver pass/fail decisions so your organization can speed up its customer onboarding.

The Ability to Conduct Enhanced Due Diligence

Once you have successfully identified a PEP or RCA and have defined the level of risk the individual brings, additional research and analysis may be appropriate. You may want to validate, for example, the individual’s source of funds and/or wealth. The bulk of this added investigation will often include non-watchlist data, such as adverse media screening.

Accounts with a PEP relationship are also subject to enhanced monitoring and periodic review. This helps to ensure that due diligence information remains current and the risk assessment and associated controls remain appropriate.

Automated Processes

Sanction screening still requires a significant amount of manual intervention that can dramatically slow down and disrupt the PEP verification and onboarding processes. False positives in particular will hold your workflow hostage. Most sanction screening systems still yield 5-7% false positives that must be cleared manually by a compliance officer.

Advanced sanction screening solutions leverage latest technologies, such as AI, machine learning, and NLP to significantly reduce such manual intervention. They also go beyond the matching, sorting, and analysis of watchlist data results. Smart solutions, like our DecisionIQ^TM, can render 95% of all verification decisions automatically in under a minute with a low decision error rate.

Each screening decision is accompanied with a transparent ‘Proof of Decision’ that is electronically stored. The Proof of Decision can be electronically reviewed and annotated by a compliance officer. When a PEP or RCA is identified, they can be assigned to different customer lists based on the risk level. These customer lists can then be set up for scheduled or active ongoing monitoring and alerts. All this can be done via an easy to access online user interface, or via an easy to integrate API library.

Just imagine what your institution could do with all the time, money and other resources that would be freed up under such a system! Decision-making would be a lot more accurate, too.

The point is PEP data and screening solutions are evolving, just as the regulatory environment and even the world itself shifts and transforms. When you are in search of AML compliance tools of any kind, you need to partner with an AML compliance vendor that understands the winds of change. This knowledge should be worked into their collection of solutions. In the financial services sector, such partnerships are what it takes to stay in the game.

.

In the previous article of the KYC 2020 Guide to PEP Screening, we learned about the many uncertainties surrounding PEPs, including how to even define them. In this article, we are going to take a closer look at PEP risk.

The Challenge of Serving PEPs

In Ontario, Sanjay Madan, a Ministry of Education computer specialist was recently fired after an alleged fraud involving $11.6 million in COVID-19 funds. Madan is also being accused of running an elaborate kickback scheme that stole at least $30 million more from the Canadian government.

Meanwhile, in the US, Tennessee state senator Katrina Robinson was recently charged with theft and embezzlement. According to court records, Robinson stole more than $600,000 in federal funds while serving as the director of a health care company. She then used this money to pay for her wedding, a new vehicle for her daughter, entertainment and various other personal expenses.

In the US and Canada and throughout the world, there are countless high-profile examples of PEPs using financial institutions as conduits for their illegal activities.

For this reason, PEPs and their relatives and close associates (RCAs) generally present a higher level of risk to your financial institution. When people are in positions of influence and power and have access to insider information, there is a greater chance that they will abuse their privileges. PEPs can end up leveraging their status for personal gain through bribery, money laundering, and corruption instead of benefiting those they are meant to serve.

PEP corruption undermines the rule of law. If left unchecked, corrupt PEP behavior can be detrimental to the overall health of the economy. It can drain a state or a country’s assets, compromise judicial and governmental systems, hurt fair commerce, and extinguish open competition.

It also can spell the end of your financial institution. Banks, credit unions and money services businesses (MSBs) that conduct business with dishonest PEPs face substantial reputational risk, additional regulatory scrutiny, and potential regulatory action.

Mitigating PEP Risk Through Red Flags

In the context of KYC and BSA compliance, identifying a client as a PEP or RCA is not the goal in and of itself. A PEP designation also does not mean the individual is necessarily involved in corruption or other forms of criminal activity. It is merely a call for extra vigilance. PEP screening and monitoring is thus one piece of a bigger process to discover and assess client risk.

The truth is that not all PEPs present the same level of risk. This risk will vary depending on numerous factors, including: the PEP’s geographic location, industry, sector, and position as well as the level or nature of the authority invested to this individual. Other factors, such as the type of account and its purpose, the transactional activity, and the complexity of the account, can all influence the risk to your institution when servicing a particular PEP.

PEP screening is a standard part of a risk-based approach to AML compliance. Though this process is usually performed as part of KYC and on-boarding procedures, account monitoring should continue periodically throughout the customer relationship. After determining that a customer is a PEP, your institution is responsible for conducting ongoing due diligence that is specifically tied to the individual’s current PEP status.

If your organization needs to assess PEP risk, then there are several red flags and indicators you can use to detect suspicious behavior and potential financial abuse.

PEPs that exhibit the following behavior or characteristics, should be approached with caution:

• Attempting to shield identity and obscure ownership through the use of corporate vehicles, intermediaries, or family members/associates as legal owners
• Exhibiting odd or suspicious behavior, for example: showing difficulty discussing the source of funding or wealth, providing incomplete or inaccurate information, asking questions about your institution’s AML/CFT policy
• Being involved with an industry or sector that is high-risk, such as arms trade and defense, banking and finance, businesses that sell or work with the government, healthcare, and mining
• Having a position in or an involvement with a business or organization that is operating in a high-risk sector
• Having a high-ranking position with significant authority, such as control over or access to state assets and funds, policies, and operations, as well as control over regulatory permissions like being able to approve an operating license
• Conducting suspicious transactional activities, such as payments and transactions that are anonymous

When on-boarding a client who possesses one or more red flags such as these, you need to proceed with caution. Your AML/CFT systems and procedures should kick in to protect your institution against unscrupulous individuals while verifying legitimate transactional activity and creating a positive customer experience.

To make this possible, you first need to be able to detect and identify PEPs and RCAs. This has traditionally been an expensive and time-consuming undertaking that greatly slows down customer onboarding. As a result, compliance for PEP screening has been lax and irregular across the financial markets. Now, thanks to AI and other advancements in regulation technology (RegTech), screening for PEPs in global watchlists, government sources, and in adverse media is not only effective and fast, but also affordable.

We’ll address the solutions helping to mitigate PEP risk in the next article.

That is how it is supposed to work in theory.

PEP screening and monitoring in practice, however, is an incredibly challenging process. Governments and regulators are calling upon banks, credit unions, and a growing range of money services businesses (MSBs) to act as a shield against political corruption and financial crime.

At the same time, AML/CFT regulations and fines for non-compliance have become more stringent over the past few years. Just recently, congress passed the Anti-Money Laundering Act (AMLA) of 2020. This piece of legislation which is being dubbed “the biggest anti-money laundering reform in a generation,” significantly adds to the regulatory burden in AML compliance across the board for institutions involved in financial services.

Yet even with all of this, there is surprisingly little guidance and support available to financial institutions to help them conduct a “reasonable” level of due diligence towards higher-risk customers.

In the KYC2020 guide to PEP screening we will address these issues and others. In this first article, we are going to start by defining what a PEP is and identify some of the big challenges that stand in the way of a good PEP screening program.

What is the Definition of PEP and RCA?

PEPs are any individuals who run the risk of involvement in bribery, intimidation or corruption because of their position of importance, power or influence.

If that seems like a vague statement, that’s because it is.

The criteria for what defines a PEP are actually very broad and may vary from country to country. Even among the regions of a country, there can be significant differences. Some common and generally accepted examples of PEPs, according to the BSA in the US, include:

• Government officials. For example, members of legislative bodies, such as the US congress, executive bodies, such as a head of state, judiciary bodies, such as members of state federal supreme courts, and diplomatic positions. A good example here would be a Member of Parliament, Senator, and Supreme Court Judge.

• Members of government organizations and institutions. For example, top military officials and ranking members of centralized financial institutions, such as the Federal Reserve and World Bank.

• Executives at state-owned enterprises. For example, high-ranking members of the Federal Deposit Insurance Corporation (FDIC), and Department of Treasury.

Most banks, credit unions and other regulated entities rely on the criteria and recommendations put forth by the Financial Action Task Force on Money Laundering (FATF).

The FATF divides PEPs into a few different categories based on the perceived level of risk. However, even those categories are up for interpretation depending on the geographic location. For example, defining PEP based on the level of risk could be as follows:

• High risk PEPs could include, heads of state and government, active members of the Federal government and top-ranking officials of political parties, as well as heads of the military, judiciary, law enforcement and the board of central banks.

• Medium risk PEPs could include regional government officials, ambassadors, senior officials of the military, judiciary, law enforcement and other state agencies, as well as high ranking members of prominent religious groups.

• Low risk PEPs could include, mayors and members of county, city and district assemblies.

In 2012, the FATF’s latest definition of PEPs includes a distinction between foreign and domestic individuals. Foreign PEPs are people who are entrusted with prominent public functions by a foreign country, for example Heads of state or Heads of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, and important political party officials. In general, foreign PEPs represent a greater risk than their domestic counterparts.

To make things even more complicated, immediate family members, publicly known associates and even businesses that are either related to or closely associated with a PEP are also considered a risk and must be both screened and regularly monitored. This group of people and entities are called Relatives and Close Associates (RCAs).

Immediate family members who are considered PEPs include:

• Parents and children of PEPs
• Spouse or partner
• Siblings
• Aunts, uncles and cousins
• Indirect family members, such as in-laws

Close associates who are considered PEPs include:

• An individual who has a close business relationship or shares in the ownership of legal entities with a PEP
• An individual who is the owner of a legal entity which is known to have been set up for the de facto benefit of a PEP

How the PEP Definition Creates Challenges in PEP Screening

There are several factors that can make it harder for your institution to effectively conduct PEP screening and customer due diligence (CDD) while fulfilling AML/CFT compliance rules.

First and foremost, the absence of a universal definition of a PEP as well as a clear set of rules to determine the apparent risk level of a specific individual or entity is an obvious hindrance. Identifying a head of state or a high-level government official would take little work. However, there are many politicians and people of influence who would fit the definition of a PEP, but who may be considered low key and thus fly under the radar. Despite the presence of numerous watchdogs and the importance of approaching these parties with proper due diligence and ongoing monitoring, there is still limited specific guidance on how to identify, screen and continuously monitor PEP activity.

In other words, it’s largely up to your financial institution itself to decide how to screen, on-board, and monitor PEPs in relation to your Risk-Based Approach (RBA).

Moreover, PEP watchlists and the other resources that financial institutions use to identify a PEP vary significantly in quality and comprehensiveness. AML compliance data sources in general contain large amounts of “junk” or “404” data that effectively gets in the way of good PEP screening. This in turn leads to operational inefficiencies and an increase in costly, time-consuming false positives.

Keep in mind that even if individuals are identified as PEPs, this does not mean that they are actually involved in criminal activity. It just means you need to treat every PEP as high-risk, take precautions, and implement an ongoing monitory program for such individuals. You also need to consider the balance between oversight, regulatory compliance and maintaining a fundamental level of customer service.

When it comes to PEP screening, in order to unlock the protection such oversight affords your institution’s reputation and revenues, you need to know what to look for in the first place.

In the next article, we will dive more deeply into the risk posed by PEPs and why it is essential that you effectively screen for them.