FINTRAC – BLOG

The Various AML Compliance Agencies

The Newcomer — Mon, 10 Feb 2020 10:24:47 +0000

Navigating the complexities of AML compliance is no easy task. Simply understanding the agencies that create regulations and enforce regulations can be challenging enough. This makes the task of maintaining AML compliance even more challenging especially when it comes to keeping up with new regulations. These agencies oftentimes create guidelines you can follow to simplify the process of AML compliance as well. So, the key agencies and regulatory bodies you should track when it comes to AML compliance in USA include:

Financial Industry Regulatory Authority (FINRA)
Financial Crimes Enforcement Network (FinCEN)
Federal Financial Institutions Examination Council (FFIEC)

Financial Industry Regulatory Authority (FINRA)

FINRA is a private corporation in the United States that acts as a self-regulatory authority. It became the successor of the National Association of Securities Dealers in 2007 shortly after the SEC approved its formation. Since then, FINRA grew to over 3,400 employees working primarily out of Washington, D.C. and New York, NY with 20 other regional offices throughout the United States.

FINRA’s overall responsibilities revolve around regulating member brokerage firms and exchange markets, one part of which is ensuring AML compliance. With these responsibilities, the 3,400 employees oversee approximately 4,250 brokerage firms, 154,000 branch offices, and 625,000 registered representatives. As a part of these responsibilities, FINRA holds periodic regulatory exams for all member firms they oversee. These reviews help FINRA determine where they see room for improvement within these institutions for more streamlined compliance.

Despite being a private corporation, the Securities and Exchange Commission granted FINRA approval to discipline registered representatives and member firms. They also license individuals, admit firms to the industry, and create the rules that govern their behavior. In 2018 alone, FINRA levied approximately $61 million in fines and another $25 million in restitutions. This makes them one of the primary organizations you will have to deal with to achieve AML compliance if you are dealing in securities. They set the rules and regulate them, so be sure to pay attention to everything they do.

Financial Crimes Enforcement Network (FinCEN)

FinCEN was formed in 1990 with the goal of combating domestic and international money laundering, terrorist financing, and other financial crimes. They’re a bureau of the United States Department of Treasury that analyzes information about financial transactions. They are one of 147 Financial Intelligence Units (FIUs) that make up the Egmont Group of Financial Intelligence Units. FinCEN’s director summed up their mission through a statement in 2013 as, “safeguard the financial system from illicit use, combat money laundering and promote national security.” They accomplish this mission through following any financial trails that might lead to a case of money laundering, terrorist financing, or other financial crimes.

One of FinCEN’s primary responsibilities revolve around data collection and data use. They created the FinCEN Query which allows other Financial Intelligence Units to search the mass amounts of data FinCEN collects on all financial transactions. The search engine operates similar to Google making it easy for any of the Financial Intelligence Units to find any information they need. They also create four yearly reports:

Suspicious Activity Report
Currency Transaction Report
The Designation of Exempt Person
Registered Money Service Business

These reports contain their findings on various threats and indicators facing the United States when it comes to combating money laundering, terrorist finance, and financial crime

Through the use of the extensive data they collect on financial transaction, they conduct investigations into at risk individuals and organizations. This puts anyone not following AML regulations at risk of an expensive investigation that could halt your business entirely. So, to avoid a nasty letter from FinCEN, make sure you follow all financial requirements and regulations to ensure you do not participate in money laundering, terrorist financing, or any other financial crimes.

Federal Financial Institutions Examination Council (FFIEC)

The FFIEC was established in 1979 through the Financial Institutions Regulatory and Interest Rate Control Act of 1978. They are composed of five banking regulators that create uniform guidelines and standards that every financial institution must follow. The five banking regulators that make up the FFIEC include:

Federal Reserve Board of Governors
Federal Deposit Insurance Corporation
National Credit Union Administration
Office of the Comptroller of the Currency
Consumer Financial Protection Bureau

In recent times, one of the top priorities of the FFIEC became protecting financial institutions from cyber-attacks. They achieve this through creating guidelines and standards for cyber security that every financial institution must follow. As part of their effort to help financial institutions combat cyber-attacks, they released the Cybersecurity Assessment Tool. Regulators of the FFIEC use the results of this tool as part of their examination into any financial institution.

Another helpful resource the FFIEC released to simplify compliance with the Bank Secrecy Act and Anti-Money Laundering is their BSA/AML info base. Within this infobase you can find guidelines to help you achieve AML compliance, examination manuals, and a range of other resources to help you maintain compliance. Since their overall goal surrounds helping financial institutions combat financial crimes, they aim to teach appropriate standards you should follow to maintain compliance. You can also use this database to see exactly what the FFIEC looks for during compliance examinations of your organization. This helps ensure you pass your examination when that time inevitably comes. You should look to the FFIEC to help you create procedures and maintain compliance with all BSA and AML regulations.

Do You Need Help Achieving and Maintaining AML Compliance?

These organizations are only the tip of the iceberg when it comes to navigating the complexities of AML Compliance. There is the OFAC which regulates all foreign assets, the OCC, FDIC, FRB, CFPB, and then various state level oversight agencies. These organizations play an important role in ensuring you remain compliant with all AML regulations.

If you need help navigating the complexities of AML compliance, contact KYC2020 for a consultation today. They offer software tools to help you manage all aspects of AML compliance and streamline your AML Compliance Program to ensure efficiency. KYC2020 also supports a network of qualified CAMS certified AML Compliance Specialists to help answer any of your questions and guide you through the process of achieving AML compliance. AML compliance does not have to be costly or complicated, so let KYC2020 help you decide your next steps to achieving and maintaining AML compliance in a cost effective and efficient way.

AML Risk Assessments are an Eye Opener

Joseph Iuso — Mon, 17 Jun 2019 21:17:03 +0000

As part of any AML compliance regime, the first step is to do an assessment of the risk associated with the business according to regulatory requirements. The Risk Assessment, or RA, takes into account a large scope of the business and relies on value judgments for each. This includes, but is not limited to, products, services, delivery channels, geography, operations, training, suspicious monitoring, record keeping and reporting. this includes having a program in place for any agents or third parties who are part of the value chain in the financial transaction.

On a global scale, the Financial Action Task Force (FATF) has recommended that a RAs should be conducted before the launch of any new business venture. Be that a new delivery channel, product/service, geographic location, etc. The RA “should take the appropriate measure to manage and mitigate those risks.” –FATF

In the US, the FinCen MSB Exam Manual indicates that one should “identify and assess the money laundering risks that may be associated with its unique combination of products, services, customers, geographic locations, etc.” Further it goes on to state that the focus should be on those “areas of its business that management believes pose the greater risks.”

In Canada, FINTRAC “expects a well-developed, documented and justifiable Risked Based Approach process that appropriately identifies, rates and mitigates the risks to a given entity.” It includes all the same risk areas as laid out by FATF, in this respect, it mirrors the FinCen guidance. The nuance here is that FINTRAC splits up risk into Inherent Risks and Residual Risk. This means, a business must take actions to mitigate the initial risk of a business venture and continue to manage ongoing risk afterwards.

The same regulations, guidance, and expectations resonate with every one of the FATF G38 member counties as well as many of the 184 observing members. This shows that The regulators are acknowledging that a RA provides the basis for understanding the risks and how and where to allocate resources to mitigating the largest risks first.

Identifying the risks

The FATF recommendations show that certain risks apply across the board. There is no one size fits all approach to determined AML risks. Rather, it offers a road map to plot a course, all the while reminding the business that this is not an exhaustive list of risks, and there may be some that are unique to new industries. Area’s that should be considered are;

Product Risk – depending on the product, there will be inherent risk related anonymity, handling of large sums of cash or equivalent, as well as residual risks related to ongoing monitoring, reporting, and record keeping requirements.

Customer Risk – relates to all aspects of the customer relationship including but not limited to inherent and residual risks related Know Your Customer responsibilities like sanctions and PEP screening, method of payment, geographic considerations, transaction size and frequency, occupation, etc.

Geographic Risk – identifies location internationally where there may be a high risk of criminal activity, money laundering, terrorist financing, or sanctions. Domestic geographic risk should also be taken into account specifically relating to any manner of a predicated criminal offense.

Operational Risk – relates to the procedures and controls in place like having limits in place, transaction monitoring, amount of employee turnover, record keeping capabilities, senior management buy in, and appropriate training for all staff and agents.

Agent Risk – relates to the types of activities that an agent does when acting on behalf of the business. This can be as simple handling of transaction to a comprehensive and robust AML regime.

Each of the components in the risks identified should be bucketed into high, medium, and low risk based on the potential impact it would have on the business in the event a violation is discovered by a regulator, or worse, law enforcement. This self assessment should consider these risks accordingly and ensure there is a suitable mitigating control.

Mitigating Controls

Going back once again to FATF, a mitigating control, or “countermeasures” as referenced in Recommendation 19, covers 9 broad ways of mitigating risks. These include everything from assessing when Enhance Due Diligence is required, to appropriate reporting and record keeping, to limiting or even prohibiting certain aspects of the business, to 3rd party determination, and on and on. Suffice to say, it is recommended that each risk that is deemed high and even sometimes medium, should have the adequate countermeasure to dealing with ML/TF.

A business must take care though to ensure that not everything is deemed medium or low risk with no underlying high risks. This is a tell-tale sign to the regulator that the AML regime put in place by the business may not have adequately assessed the risks. In these cases, regulators have been known to insist that the bar be raised and that all medium risks be considered high risks and that appropriate mitigating controls be put in place.

Overall Risk

Once the business has decided to undertake a proper RA, it will become clear that the line of business engaged in can be categorized as high, medium or low risk. This in turn will set out the amount of resource to expend on the AML regime that should warrant a successful examination if properly implemented and managed.

Developing a Risk Assessment

As stated earlier, each of the FATF G38 regulatory bodies has its own nuances but typically follows those laid out in their guidance and as summarized above. Many provide free toolkits, guidance, spreadsheets and relevant documentation for ensuring a proper RA is done. Most are very text heavy and rudimentary, that to quickly be able to produce a well-thought-out and structure RA would require more than a just a RA course.

Start with a template

KYC2020 has created a FREE AML Risk Assessment tool that guides the novice to expert on the various risks as identified by FATF, FinCen, FINTRAC, and others. The RA tool has taken it to the next level by providing a framework and identified sample risks for each of the key areas outlined above. This can take the guessing out of starting from scratch. For example, depending on the business type, there may or may not be agents, cash may not be a choice, or for the newest entrants, virtual currency where its mostly pseudonymous. If a particular risk is not there, the RA tool provides the ability to add them at will.

At the end of the exercise, a RA report is provided which then can be used as the basis of an AML compliance regime. Additional paid options are available like personalized branded reports, AML specialists to assist or consult with on AML Compliance solutions, or custom requirements to further assist in the complete AML life cycle. Try it today here!