Risk based approach – BLOG

5 Key Aspects to Finding the Right CAMLO

Joseph Iuso — Thu, 07 May 2020 00:33:58 +0000

As a reporting entity under most Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) regulations you must appoint an able and qualified person as your Chief Anti-Money Laundering Officer (CAMLO). This is essentially the first step to meeting your legal obligations. The role of a CAMLO is significant as they guard your business from the serious consequences associated to AML/CTF non-compliance which could include financial or even criminal penalties, losing your banking relationships, or even going out of business.

Finding the right candidate with AML/CTF expertise is critical to being able to develop and implement an ongoing AML/CTF compliance program for your business. Besides this, what other qualities should you be looking for in an individual that you seek to appoint as your company’s CAMLO?

Here are 5 key aspects to think about when looking to bring on the right person for this vital position.

1. Do they understand your sector?

Find a CAMLO that understands your sector. There are many types of reporting entities and various obligations based on risk associated with your products, services, delivery channels and geography. Their knowledge will ensure that the appropriate level of Know Your Customer (KYC), Enhanced Due Diligence (EDD), Reporting and Record-Keeping, ongoing monitoring, training, and effectiveness reviews are maintained and up to date with your policies and procedures. Measures and controls will be based on your company’s vulnerabilities and risks, so finding a CAMLO with an understanding of your type of business structure and functions enables them to develop and implement an AML/CTF compliance program that effectively fulfills your obligations.

2. Do they possess critical thinking skills?

A CAMLO has many complex duties and an effective AML/CTF compliance program is mandatory by law and regulations. This demands a carefully thought-out risk based program that is tailored to achieve mandated objectives and goals. Cookie cutter programs only work so far, but a seasoned CAMLO with critical thinking skills will be able to gather and dissect the information that is necessary to formulate the proper risk assessment for your business and move on from there and with a plan of action. Critical thinking is vital in many tasks including assessment of inherent and residual risks, drafting and maintaining of policies and procedures, and managing the process of organizing reviews and reports to share with bankers, regulators, examiners, and law enforcement.

3. Are they trustworthy and ethical?

Your CAMLO must be given the right to have full of oversight of your business, with access to all kinds of confidential information, and the authority to request aspects of your operation be changed where needed to meet your regulatory requirements. They must assess and will contribute to the management of your internal and external activities, partnerships, and all other relationships your organization maintains. They must understand the details of these business relationships in order to make appropriate recommendations for enhancements to meet the AML/CTF compliance requirements of your business. Look for a CAMLO that understands matters such as privacy, discretion, and confidentiality. This includes someone that holds business ethics, integrity and trust issues as important elements of their own value system. A professional with knowledge and belief in these business virtues is likely to be vigilant and take their commitment in defending your business from non-compliance issues much more diligently, if or when they occur.

4. Are they a positive influence?

A CAMLO plays a big role in establishing the way your internal and external relationships are ultimately informed and managed in regards to policies and procedures. They must effectively guide staff through communication and training in order to get them on board as part of your lines of defense. They must distribute and enforce many of the measures and controls that define the way you and third parties do business together, while also ensuring the necessary KYC, EDD, reporting and record-keeping, training, and ongoing monitoring is implemented for all your relationships. Your CAMLO must have a direct line to your Board or most senior level management in order to effectively and efficiently communicate matters that relate to AML/CTF aspects of your business. You want to find a CAMLO that is able to influence stake holders and that recognizes the importance of how their administration is perceived. A CAMLO that considers relationship building and themselves as an influencer can inspire your staff, vendors, and other connected parties to relate, to share, and to team-up where needed to essentially implement the necessary AML/CTF measures and controls to meet regulatory requirements.

5. Do they have a passion for learning?

The laws are ever changing, technology and systems are constantly evolving, criminals and nefarious organizations are incessantly challenging the fringes of regulated entities. New products and services are rapidly being brought to markets, and with the evolution of globalization and the internet, new financial crime schemes are more insidiously penetrating vulnerable businesses. Find a CAMLO that is a visionary, who thinks ahead and plans based on what is upcoming while reflecting on what has happened in the past. Someone who stays up to date with emerging trends, that has a desire to learn and an appreciation for innovation. This type of person is likely to seek new tools that could be implemented for the development and maintenance of a robust AML/CTF compliance program. If your CAMLO has a passion for learning their enthusiasm will benefit your business by keeping you in compliance and less of a target for the bad actors.

Conclusion

While there are many other aspects to consider when appointing your CAMLO, considering these 5 key aspects will surely help you find that right fit!

Alternatively, you may be thinking of designating yourself as the CAMLO. Be forewarned, it requires extensive work, preparation, and ongoing upkeep to ensure your business does not fall into non-compliance of AML/CTF regulations. KYC2020 offers a quiz to help you assess your basic knowledge of AML/CTF laws and regulations by your business type.

Take the quiz and find out whether you should even consider putting on the CAMLO hat and taking on the additional responsibility and liability.

AML Risk Assessments are an Eye Opener

Joseph Iuso — Mon, 17 Jun 2019 21:17:03 +0000

As part of any AML compliance regime, the first step is to do an assessment of the risk associated with the business according to regulatory requirements. The Risk Assessment, or RA, takes into account a large scope of the business and relies on value judgments for each. This includes, but is not limited to, products, services, delivery channels, geography, operations, training, suspicious monitoring, record keeping and reporting. this includes having a program in place for any agents or third parties who are part of the value chain in the financial transaction.

On a global scale, the Financial Action Task Force (FATF) has recommended that a RAs should be conducted before the launch of any new business venture. Be that a new delivery channel, product/service, geographic location, etc. The RA “should take the appropriate measure to manage and mitigate those risks.” –FATF

In the US, the FinCen MSB Exam Manual indicates that one should “identify and assess the money laundering risks that may be associated with its unique combination of products, services, customers, geographic locations, etc.” Further it goes on to state that the focus should be on those “areas of its business that management believes pose the greater risks.”

In Canada, FINTRAC “expects a well-developed, documented and justifiable Risked Based Approach process that appropriately identifies, rates and mitigates the risks to a given entity.” It includes all the same risk areas as laid out by FATF, in this respect, it mirrors the FinCen guidance. The nuance here is that FINTRAC splits up risk into Inherent Risks and Residual Risk. This means, a business must take actions to mitigate the initial risk of a business venture and continue to manage ongoing risk afterwards.

The same regulations, guidance, and expectations resonate with every one of the FATF G38 member counties as well as many of the 184 observing members. This shows that The regulators are acknowledging that a RA provides the basis for understanding the risks and how and where to allocate resources to mitigating the largest risks first.

Identifying the risks

The FATF recommendations show that certain risks apply across the board. There is no one size fits all approach to determined AML risks. Rather, it offers a road map to plot a course, all the while reminding the business that this is not an exhaustive list of risks, and there may be some that are unique to new industries. Area’s that should be considered are;

Product Risk – depending on the product, there will be inherent risk related anonymity, handling of large sums of cash or equivalent, as well as residual risks related to ongoing monitoring, reporting, and record keeping requirements.

Customer Risk – relates to all aspects of the customer relationship including but not limited to inherent and residual risks related Know Your Customer responsibilities like sanctions and PEP screening, method of payment, geographic considerations, transaction size and frequency, occupation, etc.

Geographic Risk – identifies location internationally where there may be a high risk of criminal activity, money laundering, terrorist financing, or sanctions. Domestic geographic risk should also be taken into account specifically relating to any manner of a predicated criminal offense.

Operational Risk – relates to the procedures and controls in place like having limits in place, transaction monitoring, amount of employee turnover, record keeping capabilities, senior management buy in, and appropriate training for all staff and agents.

Agent Risk – relates to the types of activities that an agent does when acting on behalf of the business. This can be as simple handling of transaction to a comprehensive and robust AML regime.

Each of the components in the risks identified should be bucketed into high, medium, and low risk based on the potential impact it would have on the business in the event a violation is discovered by a regulator, or worse, law enforcement. This self assessment should consider these risks accordingly and ensure there is a suitable mitigating control.

Mitigating Controls

Going back once again to FATF, a mitigating control, or “countermeasures” as referenced in Recommendation 19, covers 9 broad ways of mitigating risks. These include everything from assessing when Enhance Due Diligence is required, to appropriate reporting and record keeping, to limiting or even prohibiting certain aspects of the business, to 3rd party determination, and on and on. Suffice to say, it is recommended that each risk that is deemed high and even sometimes medium, should have the adequate countermeasure to dealing with ML/TF.

A business must take care though to ensure that not everything is deemed medium or low risk with no underlying high risks. This is a tell-tale sign to the regulator that the AML regime put in place by the business may not have adequately assessed the risks. In these cases, regulators have been known to insist that the bar be raised and that all medium risks be considered high risks and that appropriate mitigating controls be put in place.

Overall Risk

Once the business has decided to undertake a proper RA, it will become clear that the line of business engaged in can be categorized as high, medium or low risk. This in turn will set out the amount of resource to expend on the AML regime that should warrant a successful examination if properly implemented and managed.

Developing a Risk Assessment

As stated earlier, each of the FATF G38 regulatory bodies has its own nuances but typically follows those laid out in their guidance and as summarized above. Many provide free toolkits, guidance, spreadsheets and relevant documentation for ensuring a proper RA is done. Most are very text heavy and rudimentary, that to quickly be able to produce a well-thought-out and structure RA would require more than a just a RA course.

Start with a template

KYC2020 has created a FREE AML Risk Assessment tool that guides the novice to expert on the various risks as identified by FATF, FinCen, FINTRAC, and others. The RA tool has taken it to the next level by providing a framework and identified sample risks for each of the key areas outlined above. This can take the guessing out of starting from scratch. For example, depending on the business type, there may or may not be agents, cash may not be a choice, or for the newest entrants, virtual currency where its mostly pseudonymous. If a particular risk is not there, the RA tool provides the ability to add them at will.

At the end of the exercise, a RA report is provided which then can be used as the basis of an AML compliance regime. Additional paid options are available like personalized branded reports, AML specialists to assist or consult with on AML Compliance solutions, or custom requirements to further assist in the complete AML life cycle. Try it today here!