FinCen – BLOG

Designating the Chief AML Compliance Officer

The Newcomer — Mon, 24 Feb 2020 10:17:30 +0000

A classic Fintech startup has a tight budget making it difficult to hire a dedicated Chief AML Compliance Officer (CAMLO). This leads them to designating either a founder or other members in the organization to take on this role as a portion of their overall responsibilities. While this seems like a great way to save some money, it can lead to costly mistakes and fines if the individual designated is not properly prepared. But, before getting into cost-effective ways of designating a qualified CAMLO, we’ll first go over why a CAMLO is required.

Why You Need a CAMLO

Many countries around the world have adopted the Financial Action Task Force (FATF) recommendations which requires a CAMLO be designated. For example, in implementing the Bank Secrecy Act (BSA), the United States government appointed various regulators and oversight groups like FinCen, FINRA, and the SEC. These groups ensure that identified entities, including most FinTech, comply with all AML regulations. FINRA is an example of a Self-Regulatory Organization (SRO) that ensures all dealer-brokers implement an Anti-Money Laundering Compliance Program. This program requires that the AML Compliance Officer (ie. CAMLO) oversee the program and provide a point of contact between the organization and FINRA. Other requirements of an AML Compliance Program under FINRA Rule 3310 include:

Written approval of the program by senior management
Reasonable assurance of detection and reporting any suspicious activity
Achieve reasonable compliance with all AML regulations with a risk based customer identification program
Provide regular independent testing
Continuous training for all relevant employees and customers

So, to achieve full compliance your organization is required to designate one of the members of your organization as your CAMLO.

The Roles and Responsibilities of a CAMLO

Essentially, your CAMLO is responsible for ensuring your Fintech startup efficiently complies with all AML regulations. This takes the form of managing risks, advising on business strategies, training relevant employees, staying up to date on changing regulations, and finding cost saving methods to achieve compliance.

Your CAMLO helps your organization determine your acceptable level of risk when it comes to complying with AML regulations. Once your risk levels are determined, they create an AML Compliance Program according to your acceptable risk. While an effective compliance program is required, what constitutes “effective” is left up to interpretation leaving room to match the program to your organization.

A CAMLO also advises on your business strategies to ensure your methods of growth still allows for AML compliance. Taking their recommendations and utilizing them keeps your risks of violating any regulations to a minimum. This also ties into training relevant employees. Keeping those in charge of business strategy up to date on how your organization maintains AML compliance enables them to make better decisions on how to grow your business.

The complexity of AML regulations cannot be understated. As they constantly shift to keep up with new technologies and demands, your CAMLO must understand how they continue to evolve. Some of these shifting rules could lead to ways you can save on your compliance costs. Your CAMLO can identify these regulations and alter your AML Compliance Program accordingly.

Legal & Financial Accountability

Prior to designating yourself or one of the members of your organization as a CAMLO, they need to understand the risks they are taking. If your startup is found to be in violation of AML regulations whomever you designate as your CAMLO can be held personally responsible. For example, MoneyGram’s AML Compliance Officer paid a $250,000 penalty for failing to comply with regulations in New York State. These violations included failure to terminate their relationship with fraudulent organizations and failure to implement organizational policies to terminate relationships with high risk organizations.

In just February of 2018 two other cases like this penalized the compliance officer of the US Bank and Rabobank. The liability of a CAMLO significantly changed after Wells Fargo’s officer was found in violation in November of 2017. Prior to this case, most violations were directed at the organization instead of the individual. This new wave of charging individuals instead of organizations alleviates some responsibility. However, it makes it more difficult for Fintech startups to designate themselves as their organization’s CAMLO without taking on unnecessary risks. So, if you are considering designating yourself as your startup’s CAMLO, you must be sure you fully understand how to achieve full compliance to minimize your personal risk. You may wish to consider ensuring your E&O insurance covers this type of risk.

Alternative Options to Ensure Compliance and Minimize Risk

There are several cost-effective options to ensure full compliance with AML regulations and avoid taking unnecessary risks. These options can include:

Employing a part-time expert and designating them as your CAMLO
Hiring a consultant to review and advise you on maintaining your compliance program
Create a culture of training and learning to ensure your entire organization helps maintain AML compliance

Employing a part-time expert provides a simple way to avoid personal risks of violating AML regulations. They will most likely request that your E&O cover them in any lapses your organization has failed to implement. They can fully understand your organization and goals to create programs that ensure compliance. While this is likely the most expensive method of designating a CAMLO, it minimizes your personal and organizational risks.

Hiring a consultant does not provide you with a CAMLO, however it does minimize the risks associated with designating yourself as your organization’s compliance officer. They can create your compliance program and advise you on how to implement the program. The consultant can also train your employees on keeping your startup fully compliant. Keeping this culture of training and learning helps your employees stay up to date on changing regulations long after the consultant has finished their work. Here are 5 Key Aspects to Finding the Right CAMLO when you to to hire a consultant.

Conclusion

While becoming the Chief AML Compliance Officer for your fintech startup is possible, it requires extensive work, preparation, and ongoing maintenance to keep yourself qualified and your firm from being fined for a violation. KYC2020 offers a quiz to help you assess your basic knowledge of AML compliance regulations by your business type. Take the quiz and find out whether you should even consider putting on the CAMLO hat and take on the additional liability.

KYC2020 also supports a network of certified independent AML specialists that can advise you on effective options to maintain compliance. They look into your organization and how you operate to provide cost-effective plans your organization can follow. At first glance AML compliance may seem like a burden to getting your fintech startup off the ground, however it does not have to be complicated or costly with the help of KYC2020.

The Various AML Compliance Agencies

The Newcomer — Mon, 10 Feb 2020 10:24:47 +0000

Navigating the complexities of AML compliance is no easy task. Simply understanding the agencies that create regulations and enforce regulations can be challenging enough. This makes the task of maintaining AML compliance even more challenging especially when it comes to keeping up with new regulations. These agencies oftentimes create guidelines you can follow to simplify the process of AML compliance as well. So, the key agencies and regulatory bodies you should track when it comes to AML compliance in USA include:

Financial Industry Regulatory Authority (FINRA)
Financial Crimes Enforcement Network (FinCEN)
Federal Financial Institutions Examination Council (FFIEC)

Financial Industry Regulatory Authority (FINRA)

FINRA is a private corporation in the United States that acts as a self-regulatory authority. It became the successor of the National Association of Securities Dealers in 2007 shortly after the SEC approved its formation. Since then, FINRA grew to over 3,400 employees working primarily out of Washington, D.C. and New York, NY with 20 other regional offices throughout the United States.

FINRA’s overall responsibilities revolve around regulating member brokerage firms and exchange markets, one part of which is ensuring AML compliance. With these responsibilities, the 3,400 employees oversee approximately 4,250 brokerage firms, 154,000 branch offices, and 625,000 registered representatives. As a part of these responsibilities, FINRA holds periodic regulatory exams for all member firms they oversee. These reviews help FINRA determine where they see room for improvement within these institutions for more streamlined compliance.

Despite being a private corporation, the Securities and Exchange Commission granted FINRA approval to discipline registered representatives and member firms. They also license individuals, admit firms to the industry, and create the rules that govern their behavior. In 2018 alone, FINRA levied approximately $61 million in fines and another $25 million in restitutions. This makes them one of the primary organizations you will have to deal with to achieve AML compliance if you are dealing in securities. They set the rules and regulate them, so be sure to pay attention to everything they do.

Financial Crimes Enforcement Network (FinCEN)

FinCEN was formed in 1990 with the goal of combating domestic and international money laundering, terrorist financing, and other financial crimes. They’re a bureau of the United States Department of Treasury that analyzes information about financial transactions. They are one of 147 Financial Intelligence Units (FIUs) that make up the Egmont Group of Financial Intelligence Units. FinCEN’s director summed up their mission through a statement in 2013 as, “safeguard the financial system from illicit use, combat money laundering and promote national security.” They accomplish this mission through following any financial trails that might lead to a case of money laundering, terrorist financing, or other financial crimes.

One of FinCEN’s primary responsibilities revolve around data collection and data use. They created the FinCEN Query which allows other Financial Intelligence Units to search the mass amounts of data FinCEN collects on all financial transactions. The search engine operates similar to Google making it easy for any of the Financial Intelligence Units to find any information they need. They also create four yearly reports:

Suspicious Activity Report
Currency Transaction Report
The Designation of Exempt Person
Registered Money Service Business

These reports contain their findings on various threats and indicators facing the United States when it comes to combating money laundering, terrorist finance, and financial crime

Through the use of the extensive data they collect on financial transaction, they conduct investigations into at risk individuals and organizations. This puts anyone not following AML regulations at risk of an expensive investigation that could halt your business entirely. So, to avoid a nasty letter from FinCEN, make sure you follow all financial requirements and regulations to ensure you do not participate in money laundering, terrorist financing, or any other financial crimes.

Federal Financial Institutions Examination Council (FFIEC)

The FFIEC was established in 1979 through the Financial Institutions Regulatory and Interest Rate Control Act of 1978. They are composed of five banking regulators that create uniform guidelines and standards that every financial institution must follow. The five banking regulators that make up the FFIEC include:

Federal Reserve Board of Governors
Federal Deposit Insurance Corporation
National Credit Union Administration
Office of the Comptroller of the Currency
Consumer Financial Protection Bureau

In recent times, one of the top priorities of the FFIEC became protecting financial institutions from cyber-attacks. They achieve this through creating guidelines and standards for cyber security that every financial institution must follow. As part of their effort to help financial institutions combat cyber-attacks, they released the Cybersecurity Assessment Tool. Regulators of the FFIEC use the results of this tool as part of their examination into any financial institution.

Another helpful resource the FFIEC released to simplify compliance with the Bank Secrecy Act and Anti-Money Laundering is their BSA/AML info base. Within this infobase you can find guidelines to help you achieve AML compliance, examination manuals, and a range of other resources to help you maintain compliance. Since their overall goal surrounds helping financial institutions combat financial crimes, they aim to teach appropriate standards you should follow to maintain compliance. You can also use this database to see exactly what the FFIEC looks for during compliance examinations of your organization. This helps ensure you pass your examination when that time inevitably comes. You should look to the FFIEC to help you create procedures and maintain compliance with all BSA and AML regulations.

Do You Need Help Achieving and Maintaining AML Compliance?

These organizations are only the tip of the iceberg when it comes to navigating the complexities of AML Compliance. There is the OFAC which regulates all foreign assets, the OCC, FDIC, FRB, CFPB, and then various state level oversight agencies. These organizations play an important role in ensuring you remain compliant with all AML regulations.

If you need help navigating the complexities of AML compliance, contact KYC2020 for a consultation today. They offer software tools to help you manage all aspects of AML compliance and streamline your AML Compliance Program to ensure efficiency. KYC2020 also supports a network of qualified CAMS certified AML Compliance Specialists to help answer any of your questions and guide you through the process of achieving AML compliance. AML compliance does not have to be costly or complicated, so let KYC2020 help you decide your next steps to achieving and maintaining AML compliance in a cost effective and efficient way.

AML Risk Assessments are an Eye Opener

Joseph Iuso — Mon, 17 Jun 2019 21:17:03 +0000

As part of any AML compliance regime, the first step is to do an assessment of the risk associated with the business according to regulatory requirements. The Risk Assessment, or RA, takes into account a large scope of the business and relies on value judgments for each. This includes, but is not limited to, products, services, delivery channels, geography, operations, training, suspicious monitoring, record keeping and reporting. this includes having a program in place for any agents or third parties who are part of the value chain in the financial transaction.

On a global scale, the Financial Action Task Force (FATF) has recommended that a RAs should be conducted before the launch of any new business venture. Be that a new delivery channel, product/service, geographic location, etc. The RA “should take the appropriate measure to manage and mitigate those risks.” –FATF

In the US, the FinCen MSB Exam Manual indicates that one should “identify and assess the money laundering risks that may be associated with its unique combination of products, services, customers, geographic locations, etc.” Further it goes on to state that the focus should be on those “areas of its business that management believes pose the greater risks.”

In Canada, FINTRAC “expects a well-developed, documented and justifiable Risked Based Approach process that appropriately identifies, rates and mitigates the risks to a given entity.” It includes all the same risk areas as laid out by FATF, in this respect, it mirrors the FinCen guidance. The nuance here is that FINTRAC splits up risk into Inherent Risks and Residual Risk. This means, a business must take actions to mitigate the initial risk of a business venture and continue to manage ongoing risk afterwards.

The same regulations, guidance, and expectations resonate with every one of the FATF G38 member counties as well as many of the 184 observing members. This shows that The regulators are acknowledging that a RA provides the basis for understanding the risks and how and where to allocate resources to mitigating the largest risks first.

Identifying the risks

The FATF recommendations show that certain risks apply across the board. There is no one size fits all approach to determined AML risks. Rather, it offers a road map to plot a course, all the while reminding the business that this is not an exhaustive list of risks, and there may be some that are unique to new industries. Area’s that should be considered are;

Product Risk – depending on the product, there will be inherent risk related anonymity, handling of large sums of cash or equivalent, as well as residual risks related to ongoing monitoring, reporting, and record keeping requirements.

Customer Risk – relates to all aspects of the customer relationship including but not limited to inherent and residual risks related Know Your Customer responsibilities like sanctions and PEP screening, method of payment, geographic considerations, transaction size and frequency, occupation, etc.

Geographic Risk – identifies location internationally where there may be a high risk of criminal activity, money laundering, terrorist financing, or sanctions. Domestic geographic risk should also be taken into account specifically relating to any manner of a predicated criminal offense.

Operational Risk – relates to the procedures and controls in place like having limits in place, transaction monitoring, amount of employee turnover, record keeping capabilities, senior management buy in, and appropriate training for all staff and agents.

Agent Risk – relates to the types of activities that an agent does when acting on behalf of the business. This can be as simple handling of transaction to a comprehensive and robust AML regime.

Each of the components in the risks identified should be bucketed into high, medium, and low risk based on the potential impact it would have on the business in the event a violation is discovered by a regulator, or worse, law enforcement. This self assessment should consider these risks accordingly and ensure there is a suitable mitigating control.

Mitigating Controls

Going back once again to FATF, a mitigating control, or “countermeasures” as referenced in Recommendation 19, covers 9 broad ways of mitigating risks. These include everything from assessing when Enhance Due Diligence is required, to appropriate reporting and record keeping, to limiting or even prohibiting certain aspects of the business, to 3rd party determination, and on and on. Suffice to say, it is recommended that each risk that is deemed high and even sometimes medium, should have the adequate countermeasure to dealing with ML/TF.

A business must take care though to ensure that not everything is deemed medium or low risk with no underlying high risks. This is a tell-tale sign to the regulator that the AML regime put in place by the business may not have adequately assessed the risks. In these cases, regulators have been known to insist that the bar be raised and that all medium risks be considered high risks and that appropriate mitigating controls be put in place.

Overall Risk

Once the business has decided to undertake a proper RA, it will become clear that the line of business engaged in can be categorized as high, medium or low risk. This in turn will set out the amount of resource to expend on the AML regime that should warrant a successful examination if properly implemented and managed.

Developing a Risk Assessment

As stated earlier, each of the FATF G38 regulatory bodies has its own nuances but typically follows those laid out in their guidance and as summarized above. Many provide free toolkits, guidance, spreadsheets and relevant documentation for ensuring a proper RA is done. Most are very text heavy and rudimentary, that to quickly be able to produce a well-thought-out and structure RA would require more than a just a RA course.

Start with a template

KYC2020 has created a FREE AML Risk Assessment tool that guides the novice to expert on the various risks as identified by FATF, FinCen, FINTRAC, and others. The RA tool has taken it to the next level by providing a framework and identified sample risks for each of the key areas outlined above. This can take the guessing out of starting from scratch. For example, depending on the business type, there may or may not be agents, cash may not be a choice, or for the newest entrants, virtual currency where its mostly pseudonymous. If a particular risk is not there, the RA tool provides the ability to add them at will.

At the end of the exercise, a RA report is provided which then can be used as the basis of an AML compliance regime. Additional paid options are available like personalized branded reports, AML specialists to assist or consult with on AML Compliance solutions, or custom requirements to further assist in the complete AML life cycle. Try it today here!