Getting sanctions screening right is a growing priority for financial services institutions in their AML/CFT compliance program. The constant drumbeat of increasing regulatory requirements, the mix of customer profiles that grows more complex by the day, and an ever-expanding menu of financial products and services have only made such due diligence all the more critical.

However, current AML/CFT detection systems and procedures that lean heavily on rules-based screening engines and manual inputs can not keep up with today’s reality. The issue of false positives is arguably one of the most consequential areas this plays out. On one hand, financial institutions need a new set of tools to accurately detect true matches and reduce the occurrence of false positives. On the other hand, too few false positives in an indication that an institution’s AML systems are not appropriately calibrated to catch the wily evaders.

What are False Positives and Why Do They Happen?

In its most basic form, an AML compliance program includes three fundamental functions:

1. Assess the risk of new and current customers
2. Implement screening measures to weed out clients who present a high risk for financial crimes
3. Conduct ongoing monitoring of customer activity

There are really two goals to an organization’s AML program. The first is to create an alert system that can efficiently identify and actively prevent the emergence of money laundering and other financial crimes within the organization. The second is to avoid regulatory sanctions and their fallout like the plague.

These two goals are often at odds with each other. Moving from financial crime identification to financial crime prevention can be a resource-intensive high-wire act.

In order to comply with the strict regulatory requirements and stiff fines for non-compliance, financial institutions will often operate on the side of caution in their screening and monitoring efforts.  That is, they will lean towards “Over-Screening“. In practice, this means the definition of suspicious activity, for example, would include a very broad range of actions and behaviors– each of which will generate an alert.

An AML alert does not necessarily mean that criminal activity of any kind is in fact happening. It is quite common for a subsequent manual review to result in a cleared warning. When this happens, it is called a false positive.

Such manual reviews are simply “baked” into the AML compliance system of many traditional and established financial institutions. The time and resources required to conduct this oversight is then written off as the cost of doing business.

The added piece of mind comes with a big price tag, however. The industry average rate of false positives currently hovers around 42%. But for larger institutions it can reach a whopping 95%. This translates into millions and even billions of dollars of lost revenue each year.

Another indirect cost of a high false positive rate is the negative impact it has on the customer experience. In recent years, the financial services industry has been required to pour more resources into the experience users have as they move through the buyer’s journey. According to the 2020 Digital Banking Report, customer experience is a key element in maintaining a competitive edge. Customers increasingly want financial institutions to provide personalized services. This is putting increasing pressure on financial institutions to perform to rapid, frictionless transactions and offer personalized customer communications.

A large number of false positives can slow down the on-boarding process as well as customer transaction times. They are thus an obvious stumbling block. However, compliance teams must find a way to reduce their rate of false positives without compromising the accuracy and effectiveness of AML transaction monitoring and screening.

What are Your False Positives Telling You?

The solution to the false positives conundrum is to fundamentally change the way your organization perceives false positives in the first place. False positives are a necessary and unavoidable occurrence. When your rate of false positives stays within a healthy range appropriate for your user base and risk profile, then it is a sign that your institution is on the right track.

When the number of false positives steps outside of that range, then you’ll want to pay attention. You are getting valuable information about your AML compliance efforts. Usually, it means that something within your system has to be tweaked or reworked.

Let’s consider a few examples…

Scanning sanctions watchlists and associated data, such as adverse media and PEP lists, coupled with ongoing transaction monitoring require firms to process and analyze a vast amount of information from a variety of sources which are themselves evolving. With sanctions screening in particular, these sources often vary wildly in quality and completeness, and they are bloated with redundant or useless information. On top of this, they generally come in an unstructured format.

A high rate of false positives could simply be the result of relying on poor data pools full of outdated or irrelevant information that has been ineffectively culled, organized and structured. Of course, the more confusing the data, the more challenging it becomes to discern false positives from true positive matches.

For this reason if your institution is experiencing an unusually high rate of false positives, you may want to reevaluate your data capture. You need to ensure it truly fits the needs of your organization along with the reality of the market base you are servicing.

For example, we developed VisionIQ, a comprehensive watchlist database with access to over 1000 watchlists and automatically updated news sources from more than 200 countries. VisionIQ is powered by advanced technologies, such as artificial intelligence (AI) and natural language processing (NLP). This smart data system is structured and organized to make it easy to selectively group watchlists for different risk profiles and screening criteria. Data is de-duplicated and cross-linked across watchlists to better resolve the data into personas.

Smart data by itself may help reduce the rate of false positives, however, it may not be enough. Part of the challenge is being able to manage the sheer volume and velocity of data creation today, as well as the constantly growing number of data sources. Even the best compilation of data and news is useless without an intelligent search and scoring engine built on AI algorithms and machine learning. Such an automated screening solution can significantly reduce labor-intensive manual interventions. In the process it will significantly minimize False Positives, while helping to ensure that True Positives are discovered.

Utilizing an automated screening solution solves yet another factor in a high false positives rate: the need for real-time data updates. It’s common for those involved in financial crimes to change their names or move to another region in order to avoid prosecution. It’s also common for innocent individuals to make such life changes.

Your organization should thus ensure that the customer data you are relying on is both relevant and up-to-date. A false positive might be created, for example, if a firm neglects to update a user’s change of name or list their new home address– particularly if the new region presents less of a risk than that of the previous residence.

When Even a Little Becomes A Lot

When it comes to false positives, some organizations, for example, a financial services business, may discover that their ability to conduct manual reviews on even a moderate rate of false positives is a struggle. Despite all the advances in technology, sanction screening still requires a significant amount of manual intervention that can dramatically slow down and disrupt the customer verification and on-boarding processes. Many sanction screening solutions on the market are designed to filter a set of watchlists. The search results must then be manually exported for review.

For nimble organizations with limited human resources, there are stand-alone decisioning systems that yield screening decisions in real-time without requiring manual review. This of course includes the automatic clearing of false positives using AI.

A smart, AI and NLP based sanction and PEP screening decision system, like our very own DecisionIQ, can render 95% of all verification decisions automatically within a 60-second response time and a low decision error rate. For records that still require manual screening, they can be sent within minutes to compliance officers, who should have all the info they need to take immediate action.  The screening decisions are then setup for ongoing monitoring based on your risk-based approach.

Slow customer on-boarding and the constant drumbeat of false positives will quickly eat up your profitability and your competitive advantage. On the other hand, failing to identify criminal financial activity can lead to unwanted regulatory attention and action.

The use of smart automated technologies can help to alleviate the challenge of false positives in sanction screening more effectively, more rapidly, and more affordably than ever before.

Adverse media screening, also known as negative news screening, is an integral part of your KYC and AML regime. In its most basic form, AMS is the process by which a current or prospective customer is screened for negative news mentions and other unfavorable information. AMS allows your organization to flag a person or business as a potential risk and thus avoid future reputational and compliance damages.

Getting AMS right, however, comes with many challenges, including:

• AML compliance teams are often already bogged down by time consuming, manual processes. Manually searching news sources via search engines just adds to the complexity.
• The sheer volume and complexity of the news data that must be scanned and sorted is staggering.
• Dealing with news feeds versus public watchlists is exponentially more complex. It goes beyond filtering false positives and identifying the correct person or business. One has to resolve the news article for sentiment, context, and other aspects of relevancy to determine if it is truly adverse media.
• AML compliance reporting requirements are becoming more stringent among smaller financial institutions and MSBs. Credit unions in particular are currently facing many changes to their AML compliance requirements. This leads to either under-reporting or over-engineering, either of which can lead to costly mistakes.

Institutions need to develop AML compliance systems that can successfully and efficiently identify high-risk customers. In particular they should define:

• When to perform adverse media scans?
• What types of data to search for and from which sources?
• What type of systems and procedures to use in order to balance manual and automated interventions?

Adverse Media Screening: Finding the Right Balance

Luckily, AMS is not rocket science. However, developing an effective and efficient AMS does require a structured approach as well as the integration and implementation of some core technologies. It also requires striking a balance between taking a risk-based approach to AMS while maintaining high-level of customer service and flexibility to scale operations for future growth. Done right, and done with the right technologies, such as AI and NLP, AMS should not result in a slow down of your customer onboarding and ongoing monitoring.

That said, here are four best practices that your organization can use to get your AMS off to the right start:

1. Determine Your Risk Tolerance and Perform a Risk Assessment

Setting the parameters for what constitutes an acceptable level risk when deciding whether or not to work with a particular customer, is a critical first step. This process involves answering a number of questions, such as:

• Which high-risk groups of individuals or businesses is your institution comfortable servicing?
• Which offenses would bar a potential customer from being accepted? What offenses would not?
• How much weight do charges and allegations get versus an actual conviction by a court or an admission of guilt?
• Which types of adverse media could be considered lower-risk over time?
• What systems and processes will be in place to take action and perform Enhanced Due Diligence (EDD) when the results of adverse media screening return matches?

Every financial institution and MSB has its own unique exposure to potential financial crime based on the kinds of customers it serves, the locations it operates in, it’s product and service mix, and the channels it uses to service customers. Every financial institution and MSB also has its own unique risk tolerance.

Before you can even begin to design an effective AMS, it is crucial that you set clear risk categorization thresholds and outline the relevant actions and details required for each.

To help with you with that, try our FREE AML Risk Assessment Tool!

2. Decide When is the Right Time to Screen

Though most financial institutions and MSBs engage in customer screening during the onboarding process, many do not have a clear and consistent screening strategy, particularly when it comes to ongoing monitoring for adverse media. When standardized procedures and decisioning are lacking, both routine monitoring as well as monitoring triggered by an event, such as a news item, can result in discrepant responses.

Adding fuel to the fire are increases in regulatory expectations, expanding sanctions data bases and watchlists, and an increasing number of categories that must be screened against. For example, in recent years AML transaction monitoring has grown to include crimes dealing with human trafficking and smuggling, as well as new business customer types that fall in ‘High Risk’ category, such as cannabis-based businesses and a wide range of innovative fintechs, such as crypto-currency.

Some of the best practices to help ensure that your organization screens customers at the right time without increasing the rate of false positives includes:

• Decide which events and activities warrant further examination
• Include AMS in the standard onboarding procedures for all new customers and for any new accounts from current customers
• Establish automated AMS for all customers on a routine basis
• Screen current higher-risk customers based on your organization’s risk-based approach.

3. Use Credible and Current News Sources

These days, anyone with internet access can become a publisher of “news.” Although this helps to ensure that critical information becomes available to the public, at the same time it creates several challenges for your AML compliance system and procedures:

• First, how can you verify the credibility of an original adverse media source?
• How should you handle alternative news sources, such as social media?
• Which of the many tens of thousands of verifiable sources should you choose to monitor for a particular customer– especially since the sources themselves may change?
• How do you ensure that you are working with current news items?
• How far back in time to go for screening adverse media?
• Finally, how can you sift through all of this information in an efficient and effective way?

Given the dynamic nature of sanctions and screening data, you need a smart watchlist database that can actively weed out unnecessary information while focusing in on items of true value. This data can then be coupled with a dynamic, automated system to help you match, sort and analyze the results. You must get this step right before you even venture into the minefield of negative news screening.

That brings us to final best practice in adverse media screening…

4. Use Smart AMS Technologies

Automated AMS technology can help your organization address the deluge of information and alerts by focusing in on the most relevant matches. Sophisticated AMS tools also significantly reduce false positives and help you screen customers according to their risk categories.

Consider our Adverse Media Check ^®. We harness the power of AI, NLP, and machine learning to continuously monitor thousands of quality relevant global news sources. Our sophisticated algorithms get to work identifying sentiment, context, and the prime actors (i.e. personas) in each article. This information is then structured and fed into a persona database of individuals, companies, and politically exposed persons (PEPs) to identify cross-links between news and government and public watchlists. Each Persona is also tagged with FATF supported categorization of risk of financial crime.

Adverse Media Check also feeds into the KYC2020 DecisionIQ decisioning engine to render Pass/Fail/Verify decisions on AMS so that you can speed up your customer onboarding with the help of AI-based decision systems.

Anti-money laundering (AML) compliance has always been a significant burden to credit unions. But as the new year gets underway, fulfilling the regulatory requirements against financial crime may be all the more daunting.

Over the past few years, consumers and a growing range of business clients have been seeking faster banking, more convenient access to their accounts and quicker funding decisions. But credit unions have been stuck treading water in the rising wave of new and existing financial regulations, while risks of default, fraud and other types of cybercrime continue to mount.

Historically, AML compliance and regulation did not apply to credit unions in the same way it has to larger banks and traditional financial institutions. However, as digital commerce goes mainstream among credit unions and they open the door to under-served, yet higher-risk businesses, recent changes to BSA/AML compliance have been shifting this dynamic.

Understanding the Challenges in Credit Union AML Compliance

In the first article of this series, we looked at the four critical pillars of AML/CFT compliance among credit unions. In this second article, we’ll now examine the five biggest obstacles that are standing in the way of an accurate and effective compliance program.

Balancing Accuracy and Speed

Regulatory authorities have been charging hefty fines to financial institutions that fail to meet all the compliance requirements of AML, KYC, and BSA. In fact in 2020 alone, financial institutions across the world have been penalized with a staggering $10.4 billion in fines and penalties.

The continual screening, monitoring, recording and reporting requirements is a resource-intensive business process for even the biggest financial institutions. Big banks, however, can afford to throw people and money at the process, and they can more easily absorb the financial “hiccups” along the way.

With smaller financial institutions there is a struggle to balance accuracy and speed while fulfilling ALM/CFT compliance regulations. Many credit unions still employ legacy systems that rely on a significant amount of manual activity and action.

Not only are these systems expensive to run, maintain and upgrade, but they are incredibly inefficient, too. The reliance on manual, repetitive procedures increases the chance of mistakes and omissions, and onerous reporting and auditing requirements frequently tie up employee time and attention. Moreover, senior leaders continue to invest significant time and money into cybersecurity and compliance rather than strategic initiatives and goals.

Making Informed, Smart Data-Driven Decisions

This leads us to a rather strange paradox: Many financial institutions already understand that in order to comply with anti-money laundering, fraud and data security regulations, they need the assistance of automated software. A number of credit unions have already done the research and plugged the best tools into their system. But instead of improving performance, their compliance efforts are impeded.

There are two main reasons for such an outcome. The first issue involves the synergy between automation, AI, and machine learning on one side with human decision-making, input and due diligence on the other side. Relying too heavily on manual operations opens the door to inefficiencies and inaccuracies. But, an over-reliance on the results of AML detection and risk assessment solutions, can lead to a disproportionate amount of false positives and negatives– the effects of which can be catastrophic for both the credit union and its members.

The second issue can be traced back to bad data. Global watchlist data, especially PEP, RCA, HIO, is unstructured, impractical and “ugly.” Though it’s a real challenge to aggregate and standardize, it is mis-information to think that it’s a “big data” problem. The race to bigger databases leads to lack of quality in the data itself. Credit unions would be wise to start with quality data such as VisionIQ Global Watchlist Database where the data philosophy is compliant, comprehensive, and smart versus big, getting bigger, and becoming dirtier.

For these reasons, it’s not uncommon for an AML system to generate a high proportion of false positives. We’re talking about 80 to 90 percent of alerts. If a credit union blindly acts on a suspicious activity alert and files a SAR on a client, yet the client’s transaction activity was actually legitimate, it can lead the financial institution down a rather destructive path.

The member client will now become subject to frequent review. Each review will scrutinize the customer’s financial activity. If the suspected suspicious activity happens again, the credit union could decide to close all associated accounts. Multiple SARs could also attract the interest of law enforcement and eventually lead to an investigation. An initial query by internal AML investigators can easily de-risk a client who is making legitimate transactions and save a tremendous amount of time, money and headache.

On the other hand, if credit unions are not diligent enough in monitoring transactional activity and paying attention to other red flags, they become complicit with the illegal activities of the clients in their watch. Many compliance and risk assessment monitoring systems are equipped to mitigate risk on behalf of the financial institution. Credit union leaders would do well to keep in mind that although these solutions are getting better with time, the techniques and strategies criminals are using to cover up fraudulent behavior are, too.

Working with MSBs and “High-Risk” Entities

With increasing regulatory scrutiny on large financial institutions, many high-risk clients, such as money services businesses (MSBs) and marijuana-related companies, are turning to credit unions for their banking needs.

Some of these high-risk organizations may indeed be involved in money laundering and other financial crimes. Small institutions are preferred targets for such operations since they tend to have less regulatory oversight and compliance processes in place.

Consider, for example, a large MSB. A money services client can generate significant transaction volumes that could overwhelm a small credit union. Yet to ensure compliance with the KYC and BSA regulations, a credit union must continue to assess the risks posed by this client, closely monitor activity, report any unusual behavior, and implement a range of added controls to manage any exposure to risk. This includes continuously monitoring media for relevant negative news on their customers and members.

Such AML compliance measures may often be at odds with providing a good customer experience to high-risk credit union members, but are necessary. Fast, sophisticated, affordable, and low-friction regulation technology solutions can be a boon to help balance both goals. For example, as it relates to negative news screening, our Adverse Media Check ®, relies on AI, Machine Learning, and Natural Language Processing to continuously monitor thousands of relevant global news sources to create a persona database of individuals, companies, and politically exposed persons (PEPs) for relevant negative news. But we don’t stop there, the results are then fed into a AI-based decisioning system to clear false positives and identify risk. More about this and other market solutions in our final article in this series.

Mitigating Data Security Threats

As incidents of cyberattacks continue to evolve and grow, small and mid-sized credit unions face a greater threat in a sense than the largest enterprises due to their tighter budgets and access to fewer resources. Compromised customer data typically leads to fraud, stolen identities, and more. Solving for AML compliance should not be at a cost of compromising customer data.

Only sustainable data security best practices will help credit unions stay BSA/AML compliant while keeping their data and networks safe. Specifically, credit unions must now have controls in place to protect the security and confidentiality of member records, respond to and report security breaches in a timely manner, and maintain vital data helpful in identifying the source of cyber criminal behavior.

Maintaining a Positive Customer Experience

Customer expectations for fast, seamless banking create two competing priorities for financial institutions: staying AML compliant and keeping customers happy. Slow on-boarding, false positives, and cyberattacks will certainly compromise that experience.

Credit unions are known for their customer service towards members and it is a big reason why clients would choose to bank there. According to a recent PwC report, speed, convenience, helpful employees and friendly service is important for more than 70% of banking consumers, and positive customer experiences influence 75% of customer decisions in banking. Satisfied credit union members are loyal customers who will increase the scope of their relationship and recommend their credit union to others.

In short, AML/CFT compliance has always been a complicated, resource-intensive process for credit unions, and all signs indicate that it will only get more challenging in the years ahead. But, credit unions don’t have to go through this process alone. A number of regulation technology innovators can help credit unions stay compliant, even with evolving threats, while maintaining the level of quality service they are known for. At KYC2020, we have a history of working within the credit union space. We understand the unique challenges credit unions face on a daily basis and offer local solutions.

In the last article of our AML for credit unions series, we’ll examine some of the many solutions that are giving credit unions the technological edge they need to both stay compliant and expand their operations.

.

….

.