For more than 30 years, the Financial Action Task Force (FATF) has been the global standard by which many countries have wholeheartedly adopted the measure to combat Money Laundering and Terrorist Financing(ML/TF). Since the FATF first started in the late 1980’s, many countries have come a long way in adopting FATF regulations and limiting the spread of ML/TF. While the primary G37 members have strict adherences and enforcement to the FATF 40 “Recommendations”, other members follow the guidelines with more leniency. When FATF was first founded,  there were only 7 pages of the 40 “Recommendations”. A mere 7 pages!  On the other hand, there are now a staggering 127 pages printed In the recently published June 2019 version of the “Recommendations”. Let that sink in.

Similarly, the original version only mentioned “policies” once, while in the latest version these policies are mentioned 30 times. This means that new “policies” were added almost 10 times per decade, resulting in about 42 new pages per decade.  This progression is not lost on most Compliance Officers, nor is it unexpected whenever regulations come into play.  So, when one may I ask, “Why is an AML Policy so important?” The answer to the question comes down to, its required by law!

Seriously though, WHY! Apart from the legal aspect there are many more important reasons why AML policy is becoming so crucial.  To be able to combat ML/TF risk, one needs to understand the risk which can come from all types of criminal individuals and organizations.  From the lone wolf to the entrepreneurial criminal enterprises, criminals launder trillions of dollars in drugs, human trafficking, bribery and the like according to a UN study in 2011. The FATF states “The possible social and political costs of money laundering, if left unchecked or dealt with ineffectively, are serious. Organized crime can infiltrate financial institutions, acquire control of large sectors of the economy through investment, or offer bribes to public officials and indeed governments.”

For some companies it can be complicated to build and maintain an AML Policy. AML regulations are constantly being updated as seen by the FATF example over a 30+ year period. In addition, some of these businesses operate in more than one jurisdiction, and often there is more than one regulator. If you think you have what it takes to build your own AML Policy, take our CAMLO quiz and see if you have what it takes.

If not, our team at KYC2020 has set out to create a tool to help with the development and support of an AML policy.  It was built with templating in mind to have a base to start with and then customize for each entities specific lines of business.  The first version was focused on FINRA regulated entities in the US.  Now we have two more in production for Money Service Businesses (MSB) and Dealers in Virtual Currencies (DIVC) in Canada and the US. The AML Policy template mechanism is structured to allow for flexible sections and content to be tailored to the specific activities of the Regulated Entities (REs).

Once a template is chosen, the RE works through the various sections answering the questions related to the particular component of a standard AML Policy, while customizing the components and sections specifically related to their business.  Once done, the RE can request to have a certified CAMS (or equivalent) person review it and provide additional feedback or suggestions on updates and changes.

When the RE is satisfied with the results, the AML Policy can be frozen, and version control kicks in.

As with FATF and their 40+ recommendations, it is the same idea with the RE’s AML Policy.  It will be a living breathing document that expands and changes over time.   The constant transformation of the document is a good thing, it demonstrates that the REs AML regime is maturing over time to deal with new risk, regulations, and changes to the business to fight ML/TF.

Want to find out more about our AML Policy tool?  Click here and sign up for this and all the other offerings at KYC2020.

Finding the right candidate with AML/CTF expertise is critical to being able to develop and implement an ongoing AML/CTF compliance program for your business.  Besides this, what other qualities should you be looking for in an individual that you seek to appoint as your company’s CAMLO?

Here are 5 key aspects to think about when looking to bring on the right person for this vital position.

1. Do they understand your sector?

Find a CAMLO that understands your sector.  There are many types of reporting entities and various obligations based on risk associated with your products, services, delivery channels and geography.  Their knowledge will ensure that the appropriate level of Know Your Customer (KYC), Enhanced Due Diligence (EDD), Reporting and Record-Keeping, ongoing monitoring, training, and effectiveness reviews are maintained and up to date with your policies and procedures.  Measures and controls will be based on your company’s vulnerabilities and risks, so finding a CAMLO with an understanding of your type of business structure and functions enables them to develop and implement an AML/CTF compliance program that effectively fulfills your obligations.

2. Do they possess critical thinking skills?

A CAMLO has many complex duties and an effective AML/CTF compliance program is mandatory by law and regulations.  This demands a carefully thought-out risk based program that is tailored to achieve mandated objectives and goals. Cookie cutter programs only work so far, but a seasoned CAMLO with critical thinking skills will be able to gather and dissect the information that is necessary to formulate the proper risk assessment for your business and move on from there and with a plan of action. Critical thinking is vital in many tasks including assessment of inherent and residual risks, drafting and maintaining of policies and procedures, and managing the process of organizing reviews and reports to share with bankers, regulators, examiners, and law enforcement.

3. Are they trustworthy and ethical?

Your CAMLO must be given the right to have full of oversight of your business, with access to all kinds of confidential information, and the authority to request aspects of your operation be changed where needed to meet your regulatory requirements.  They must assess and will contribute to the management of your internal and external activities, partnerships, and all other relationships your organization maintains.  They must understand the details of these business relationships in order to make appropriate recommendations for enhancements to meet the AML/CTF compliance requirements of your business.  Look for a CAMLO that understands matters such as privacy, discretion, and confidentiality. This includes someone that holds business ethics, integrity and trust issues as important elements of their own value system.  A professional with knowledge and belief in these business virtues is likely to be vigilant and take their commitment in defending your business from non-compliance issues much more diligently, if or when they occur.

4. Are they a positive influence?

A CAMLO plays a big role in establishing the way your internal and external relationships are ultimately informed and managed in regards to policies and procedures. They must effectively guide staff through communication and training in order to get them on board as part of your lines of defense.  They must distribute and enforce many of the measures and controls that define the way you and third parties do business together, while also ensuring the necessary KYC, EDD, reporting and record-keeping, training, and ongoing monitoring is implemented for all your relationships.  Your CAMLO must have a direct line to your Board or most senior level management in order to effectively and efficiently communicate matters that relate to AML/CTF aspects of your business. You want to find a CAMLO that is able to influence stake holders and that recognizes the importance of how their administration is perceived.  A CAMLO that considers relationship building and themselves as an influencer can inspire your staff, vendors, and other connected parties to relate, to share, and to team-up where needed to essentially implement the necessary AML/CTF measures and controls to meet regulatory requirements.

5. Do they have a passion for learning?

The laws are ever changing, technology and systems are constantly evolving, criminals and nefarious organizations are incessantly challenging the fringes of regulated entities.  New products and services are rapidly being brought to markets, and with the evolution of globalization and the internet, new financial crime schemes are more insidiously penetrating vulnerable businesses.  Find a CAMLO that is a visionary, who thinks ahead and plans based on what is upcoming while reflecting on what has happened in the past.  Someone who stays up to date with emerging trends, that has a desire to learn and an appreciation for innovation. This type of person is likely to seek new tools that could be implemented for the development and maintenance of a robust AML/CTF compliance program.  If your CAMLO has a passion for learning their enthusiasm will benefit your business by keeping you in compliance and less of a target for the bad actors.

Conclusion

While there are many other aspects to consider when appointing your CAMLO, considering these 5 key aspects will surely help you find that right fit!

Alternatively, you may be thinking of designating yourself as the CAMLO.  Be forewarned, it requires extensive work, preparation, and ongoing upkeep to ensure your business does not fall into non-compliance of AML/CTF regulations. KYC2020 offers a quiz to help you assess your basic knowledge of AML/CTF laws and regulations by your business type.

Take the quiz and find out whether you should even consider putting on the CAMLO hat and taking on the additional responsibility and liability.

Why You Need a CAMLO

Many countries around the world have adopted the Financial Action Task Force (FATF) recommendations which requires a CAMLO be designated. For example, in implementing the Bank Secrecy Act (BSA), the United States government appointed various regulators and oversight groups like FinCen, FINRA, and the SEC. These groups ensure that identified entities, including most FinTech, comply with all AML regulations. FINRA is an example of a Self-Regulatory Organization (SRO) that ensures all dealer-brokers implement an Anti-Money Laundering Compliance Program. This program requires that the AML Compliance Officer (ie. CAMLO) oversee the program and provide a point of contact between the organization and FINRA. Other requirements of an AML Compliance Program under FINRA Rule 3310 include:

• Written approval of the program by senior management
• Reasonable assurance of detection and reporting any suspicious activity
• Achieve reasonable compliance with all AML regulations with a risk based customer identification program
• Provide regular independent testing
• Continuous training for all relevant employees and customers

So, to achieve full compliance your organization is required to designate one of the members of your organization as your CAMLO.

The Roles and Responsibilities of a CAMLO

Essentially, your CAMLO is responsible for ensuring your Fintech startup efficiently complies with all AML regulations. This takes the form of managing risks, advising on business strategies, training relevant employees, staying up to date on changing regulations, and finding cost saving methods to achieve compliance.

Your CAMLO helps your organization determine your acceptable level of risk when it comes to complying with AML regulations. Once your risk levels are determined, they create an AML Compliance Program according to your acceptable risk. While an effective compliance program is required, what constitutes “effective” is left up to interpretation leaving room to match the program to your organization.

A CAMLO also advises on your business strategies to ensure your methods of growth still allows for AML compliance. Taking their recommendations and utilizing them keeps your risks of violating any regulations to a minimum. This also ties into training relevant employees. Keeping those in charge of business strategy up to date on how your organization maintains AML compliance enables them to make better decisions on how to grow your business.

The complexity of AML regulations cannot be understated. As they constantly shift to keep up with new technologies and demands, your CAMLO must understand how they continue to evolve. Some of these shifting rules could lead to ways you can save on your compliance costs. Your CAMLO can identify these regulations and alter your AML Compliance Program accordingly.

Legal & Financial Accountability

Prior to designating yourself or one of the members of your organization as a CAMLO, they need to understand the risks they are taking. If your startup is found to be in violation of AML regulations whomever you designate as your CAMLO can be held personally responsible. For example, MoneyGram’s AML Compliance Officer paid a $250,000 penalty for failing to comply with regulations in New York State. These violations included failure to terminate their relationship with fraudulent organizations and failure to implement organizational policies to terminate relationships with high risk organizations.

In just February of 2018 two other cases like this penalized the compliance officer of the US Bank and Rabobank. The liability of a CAMLO significantly changed after Wells Fargo’s officer was found in violation in November of 2017. Prior to this case, most violations were directed at the organization instead of the individual. This new wave of charging individuals instead of organizations alleviates some responsibility. However, it makes it more difficult for Fintech startups to designate themselves as their organization’s CAMLO without taking on unnecessary risks. So, if you are considering designating yourself as your startup’s CAMLO, you must be sure you fully understand how to achieve full compliance to minimize your personal risk. You may wish to consider ensuring your E&O insurance covers this type of risk.

Alternative Options to Ensure Compliance and Minimize Risk

There are several cost-effective options to ensure full compliance with AML regulations and avoid taking unnecessary risks. These options can include:

• Employing a part-time expert and designating them as your CAMLO
• Hiring a consultant to review and advise you on maintaining your compliance program
• Create a culture of training and learning to ensure your entire organization helps maintain AML compliance

Employing a part-time expert provides a simple way to avoid personal risks of violating AML regulations. They will most likely request that your E&O cover them in any lapses your organization has failed to implement. They can fully understand your organization and goals to create programs that ensure compliance. While this is likely the most expensive method of designating a CAMLO, it minimizes your personal and organizational risks.

Hiring a consultant does not provide you with a CAMLO, however it does minimize the risks associated with designating yourself as your organization’s compliance officer. They can create your compliance program and advise you on how to implement the program. The consultant can also train your employees on keeping your startup fully compliant. Keeping this culture of training and learning helps your employees stay up to date on changing regulations long after the consultant has finished their work.  Here are 5 Key Aspects to Finding the Right CAMLO when you to to hire a consultant.

Conclusion

While becoming the Chief AML Compliance Officer for your fintech startup is possible, it requires extensive work, preparation, and ongoing maintenance to keep yourself qualified and your firm from being fined for a violation. KYC2020 offers a quiz to help you assess your basic knowledge of AML compliance regulations by your business type. Take the quiz and find out whether you should even consider putting on the CAMLO hat and take on the additional liability.

KYC2020 also supports a network of certified independent AML specialists that can advise you on effective options to maintain compliance. They look into your organization and how you operate to provide cost-effective plans your organization can follow. At first glance AML compliance may seem like a burden to getting your fintech startup off the ground, however it does not have to be complicated or costly with the help of KYC2020.

Spreadsheets for Everything

While an RA is the foundation for a good risk-based AML Regime, it is often marginalized by many non-bank financial firms.  It is done in a superficial manner, using tools that are convenient and free, but ill-suited for the job. Spreadsheets are generally the tool of choice to input, track, and manage the annual risk assessment compliance requirement. As one can imagine, this approach is rather ineffective. It lacks proper controls, is prone to human-errors, difficult to audit, share, or track revision history. Moreover, as banks enhance their KYC regimes, they require annually updated formal AML Risk Assessment documentation.  The inherent limitations of spreadsheets for RA reporting and management is obvious.

Alternatives to Spreadsheets

So then, what are the alternatives to spreadsheets? The challenge once again for most SMEs and FinTech innovators is Cost, Availability, Competence, and Convenience. In our search for alternatives, we could not find a competent RA tool that met our basic requirements, was available at low-cost, was easy to get started, and convenient to use.

When we introduced our FREE Watchlist Curator Tool, we made the following statement:

“At KYC2020, we could have invested in writing a blog and talked about why “over-screening” is an expensive problem…  Instead, we decided to have our CAMS AML specialists build a tool to help you identify what Sanction, PEP, and watchlists you should be screening based on your company’s risk profile. And we decided to make our watchlist builder available free of charge.”

KYC2020 Free AML Risk Assessment Tool

For our AML Risk Assessment Tool, we decided not to be so lazy. We not only built a tool that we could make available for FREE, but also forced our CAMLO, Joseph Iuso, CAMS, to write a Blog on the What, Why, and How’s of an AML Risk Assessment. Between the information and wisdom of Joseph’s blog and the competence and convenience of our RA tool, I believe we have got you covered. Of course, we have the standard disclaimers, and you should already know that a tool cannot replace the advice of your in-house Compliance Officer.

Get started by clicking below.

KYC2020 AML Risk Assessment Tool benefits heavily from the Federal Financial Institutions Examination Council’s (FFIEC) Risk Assessment guidelines, as well as the Conference of State Bank Supervisors (CSBS) BSA/AML Self Assessment tool.  The tool considers five (5) main categories to arrive at an aggregate risk score for your business. These are: 1) Products and Services, 2) Customers, 3) Geography, 4) Operations, and 5) Agents. For each category, you have the opportunity to specify the High, Medium, and Low Risk definitions inherent to the business. For the inherent risk definitions you then specify your controls and mitigation measures to arrive at the residual risk; the risk that still remains after application of your counter-measures. This residual risk is then scored and aggregated across all categories to complete your risk assessment.

Who said it would be Easy

Sounds complicated? That’s because it is. Even for AML specialists working on a low-risk profile business, this is a minimum 2+ hour investment of time. It is for this reason the tool has the ability to save work and complete the assessment over multiple sessions. With a little bit of study, watching our Get Started Video, and rolling up your sleeves you can get through with your risk assessment on your own and for FREE!

Need Help with your RA?

For those who need a little bit of help completing, we offer some reasonably priced paid options to speed up your risk assessment process and follow best practices. These include, access to business specific templates that can be customized to speed up the assessment, different consulting packages to help prepare, review, and/or audit your Risk Assessment by our CAMS or VSKILLS certified AML specialist.

Once again, there is no catch. The tool is no obligation and we do not take any payment information. We do hope you might take the time to see what awesome and affordable AML compliance solutions we offer, from Global Watchlist Data to Sanction Screening to AML compliance consulting services. Chat with us online now, email us, or just use the tool. Our aim is to help you reduce the cost and friction of AML compliance.