Key Constituents of AML & CFT

Transcription

1 2007/ACT/WKSP1/023 Elements of Anti-Money Laundering (AML) / Combating Financial Terrorism (CFT) Measures for Know Your Customer (KYC) / Customer Due Diligence (CDD) Compliance Submitted by: Thailand Workshop on Strengthening Cooperation Mechanisms in the Asia-Pacific in the Fight Against High-Level Corruption Lima, Peru October 2007

2 Elements of AML/CFT Measures for KYC/CDD Compliance by Police Col. Seehanat Prayoonrat Anti-Money Laundering Office Thailand Key Constituents of AML & CFT 1. Address Know Your Customer/Customer Due Diligence (KYC/CDD) 2. Link Analysis 3. Risk Scoring 4. Transaction Monitoring 5. Reporting to FIU / Regulatory Body 6. Investigative Tools

3 1.0 Why KYC / CDD? Proper KYC protects bank s reputation & integrity of bank. KYC/CDD constitutes an essential part of sound risk management (e.g. by providing the basis for identifying, limiting and controlling risk exposures in assets and liabilities, including assets under management). Risk of Non-KYC/CDD Reputational Risk Operational Risk BANK Concentration Risk Legal Risk

4 A Real World Example of Non-KYC 19/07/ /08/ /08/ /09/2000 FedWire Cr Trn #12345 From: Support Network FedWire Cr Trn #12345 From: Support Network FedWire Cr Trn #12345 From: Support Network FedWire Cr Trn #12345 From: Support Network $ 9,985 $ 9,485 $ 19,985 $ 69,985 Citibank New York, NY Account Owner Sun Trust Bank, Gulf Coast, FL Account Owner Marwan Al Shehri AA Flight 175 Pilot Source: Terrorist Financing Operations Section report 27/3/03, FBI Mohammed Atta AA Flight 11 Pilot A Real World Example of Non-KYC Marwan Al - Shehri Waleed Al - Shehri Mohammed Atta Nawaf Al-Hazmi 10/9/2001 $5,400 wired from Greyhound Station Boston, MA 9/9/2001 $5,215 wired from Logan Airport Boston, MA 8/9/2001 $2,860 & $5,000 wired from two grocery stores Laurel, MD 10/9/2001 $10,000 express Mail, Baltimore MD Citibank New York, NY Citibank New York, NY Intercepted P.O Box, Sharjah, UAE Receiver : Terrorist Support Network, UAE

5 Importance of KYC None of the hijackers had a valid or issued social security number They used Saudi Arabian, UAE, German, Egyptian and Lebanese passports/ visas to open accounts in US They used fraudulent papers to open accounts Accounts were opened with cash or cash equivalents like travelers cheque in the average amount of 3000 to 5000 USD All accounts were a/c with specific requests for debit cards They went to banks in groups to open accounts ALL THIS COULD HAVE BEEN AVOIDED IF THERE WAS A PROPER AML/ KYC GUIDELINE/ TECHNOLOGY IN PLACE AT THE BANKS Essential Elements of KYC 1.1 Customer Acceptance Policy 1.2 Customer Identification 1.3 Ongoing Monitoring of High Risk Accounts 1.4 Risk Management

6 Domestic Regulation Customer Identification Know Your Customer Monitor Accounts Report Suspicious Transactions Record Retention Training 1.1 Customer Acceptance Policy Customer s background Country of origin Public or high profile position Linked accounts Business activities or other risk indicators Due diligence for an individual with a high net worth whose source of funds is unclear.

7 1.2 Customer Identification Clear definition of customer Special attention to non-resident customer Regular review of existing records All new clients to be approved by one officer other than private banking relationship officer Obtain customer identification papers & retain copies for five years General Identification Requirements Information dependent on the type of application & expected size of contract If the problem of verification persists after its opening, the account has to be closed. If the account holder is refused facilities by other banks, enhanced due diligence has to be done.

8 Trust, Nominee & Fiduciary A/C s Banks should establish whether the customer is taking the name of another customer, acting as a "front", or acting on behalf of another person as a trustee, nominee or other intermediary Corporate Vehicles A bank should understand the structure of the company, determine the source of funds, and identify the beneficial owners and those who have control over the funds. Special care needs to be exercised in initiating business transactions with companies that have nominee shareholders or shares in bearer form. Satisfactory evidence of the identity of beneficial owners of all such companies needs to be obtained.

9 Introduced Business Introducer complies with minimum CDD standards required of banks. CDD procedures of the introducer are as rigorous as those which the bank would have conducted itself for the customer. Bank must satisfy itself as to the reliability of systems put in place by the introducer to verify the identity of the customer Bank must reach agreement with the introducer that it will be permitted the right to verify the due diligence undertaken by the introducer at any stage. Bank has to ensure that the introducer immediately submits all relevant identification data and other documentation pertaining to the customer s identity Client A/C Opened by Professional Intermediaries When a bank has knowledge or reason to believe that a client account opened by a professional intermediary is on behalf of a single client, that client must be identified. where there are sub-accounts which can be attributable to each beneficial owner, all beneficial owners of the account held by the intermediary must be identified.

10 PEP (Politically Exposed Persons) Banks should gather sufficient information from a new customer, and check publicly available information, in order to establish whether or not the customer is a PEP. Banks should investigate the source of funds before accepting a PEP. The decision to open an account for a PEP should be taken at a senior management level Non-Face-to-Face Customers Banks should apply equally effective customer identification procedures for non-face-to-face customers the same as for those available for interview. Specific and adequate measures should be available to mitigate the higher risk.

11 Documents for Non-Face-to-Face Customers Requisition of additional documents to complement those which are required for faceto-face customers Independent contact with the customer by the bank Third party introduction First payment to be carried out through an account in the customer s name with another bank subject to similar customer due diligence standards Correspondent Banking Information about the respondent bank s management Major business activities of respondent bank Identify details where they are located and their money-laundering prevention and detection efforts Identify the purpose of the account Identity of any third party entities that will use the correspondent banking services Condition of bank regulation and supervision in the respondent s country Refusal to continue correspondent banking relationships with a bank incorporated in a jurisdiction in which it has no physical presence and which is unaffiliated with a regulated financial group (i.e. shell banks) Pay particular attention when continuing relationships with respondent banks located in jurisdictions that have poor KYC standards or have been identified as being non-cooperative in the fight against anti-money laundering.

12 1.3 Ongoing Monitoring of High Risk A/C s For all accounts, banks should have systems in place to detect unusual or suspicious patterns of activity Identify suspicious activity like: transactions that do not appear to make economic or commercial sense transactions that involve large amounts of cash deposits that are not consistent with the normal and expected transactions of the customer transactions with very high account turnover transactions inconsistent with the size of the balance transactions indicating that funds are being washed through the account Ongoing Monitoring of High Risk A/C s Provide timely information needed to identify, analyse and effectively monitor higher risk customer accounts. The types of reports that may be needed include reports of missing account opening documentation, transactions made through a customer account that are unusual, and aggregations of a customer s total relationship with the bank. Senior management in charge of private banking business should know the personal circumstances of the bank s high risk customers and be alert to sources of third party information. Significant transactions by these customers should be approved by a senior manager. Banks should develop a clear policy and internal guidelines, procedures and controls and remain especially vigilant regarding business relationships with PEPs and high profile individuals or with persons and companies that are clearly related to or associated with them.

13 1.4 Risk Management Ongoing monitoring of staff performance through sample testing of compliance and review of exception reports to alert senior management or the Board Internal audit to independently evaluate risk management & controls Ongoing employee-training programmes so that bank staff are adequately trained in KYC procedures Facilitatation of external auditors to monitor bank s internal control & procedures Address KYC through Risk-Based Approach Risk identification & assessment Risk mitigation Risk monitoring Documentation Set priority. Priority = impact (of the problem if it occurs) X probability (of the problem occurring)

14 Scope of KYC Information Purpose & reason for opening account or establishing relationship Anticipated level & nature of activity that is to be undertaken Various relationships of signatories & underlying beneficial owners Expected source and origin of funds to be used in relationship Details of occupation and employment (for personal bank current accounts) Sources of wealth or income Net worth Reference or other sources to corroborate reputation information where available KYC Process Customer Acceptance Policy: Risk model based on Geography & country cisk Business & entity risk Product risk Transaction risk Customer occupation Net worth Customer is Politically or Financially Exposed (PEPs and FEPs) & other list risk Mode of operation Account status Credit rating Source of funds

15 KYC Process Customer Identification 1+1 (identity & address) check regime for face-toface customer. 2+2 (identity & address) check regime for non-faceto-face customer. Classification of customers & risk profiles Transaction profiling Verification of information from documentary and nondocumentary sources Periodic updating of records KYC Process Ongoing Monitoring of Account & Transactions MIS consolidates entire data relating to each customer Business Intelligence features that enable account and transaction monitoring based on risk grading of customer or deviation from normal or expected transactions Periodical review of high-risk customers and substantial high-risk customers known to management Investigation & examination Facilitation of documentation associated with process of investigation and examination Facilitation of both internal & external reporting.

16 KYC Process Risk Management Facilitates risk-based AML programme. Facilitates detection, review, documentation of investigation or examination, and escalation of suspicious activities. Facilitates segregation of duties. Can facilitate E-Learning for employees in banks. Facilitates risk assessment supported by compliance/risk management. KYC - Entity Scanning Entity Scanning & Filtration Maintain internal watch list Manage black lists Store watch lists/black lists/terrorist lists provided by regulatory authorities and also add/modify such lists Facilitate importing/updating of black lists and create unlimited internal watch lists Entity Scanning & Filtration features are designed for screening customers/counter-party against black lists/watch lists During static data (new customer, customer update) upload During transaction (Ex:- SWIFT Msgs.) upload Name search & matching Two-way list screening

17 2. Link Analysis Link analysis feature is to provide linkage of suspicious transaction flows. Identify Links Static Data Duplication Transactional Listed Entities Establish Links Transactional & List Match Group Accounts Monitor Groups 3. Risk Scoring Risk is categorized, based on the following parameters. This can be enhanced as per the requirement of FIs. Nature of Business Product Country / Geography Customer Type List Mode of Operation Source of Funds Customer Occupation Net Worth Account Status Credit Rating

18 3.1 Risk Scoring - Example If Customer A is a Retail Merchandiser who is a Thai national, has a corporate account offering wire transfer facilities and is the son of a top politician. Retail Merchandising is classified as extreme risk business by the bank, Thailand is a low risk geographic location, Corporate Account is classified as extreme risk product by the bank, since he is a Watch-listed entity by virtue of being a politically exposed person and Watch-listed entities are classified as extreme risk list by the bank. The account of Customer A is categorized as follows: Risk Parameter Weightage Risk Rating Customer Business Risk 4 4 Bank Product Risk 3 4 Customer Geographic Risk 2 1 Customer Type Risk 1 2 List Risk 5 4 The calculated risk of the customer is 3.74 and the account of Customer A is categorized into extreme risk. 4. Transaction Monitoring Set the Benchmarks Default Benchmarks Branch group & account group Customer type Nature of business Account risk rating Country code System Generated Benchmarks (Entity Profiling) Specific Benchmarks (Establish Entity Profile) Identify Normal Behavior Set Alert Parameters Alerts Real-time (Patterns) Non-Real-time (Scenarios) Subjective

19 4.1 Transaction Monitoring Capability to identify and monitor the transactions of high risk customers, and high risk businesses and provide such reports Product Specific Alerts Configure Alerts Business type Customer type Risk Geography 4.2 Transaction Monitoring High Risk Entities Capability to detect any incoming/outgoing transfer that derived from and of high risk countries, high risk businesses and high risk customers Alert transaction with black-listed entities SWIFT Messages Forex Transactions Sample Alerts Transactions with listed countries (NCCT, Tax Haven, Secrecy Haven) Transactions deviating from declared purpose Huge Cash Transactions

20 4.3 Questioning-Based Algorithms to Identify Suspicious Transactions Is the size of the transaction consistent with the normal activities of the customer? Is the transaction rational in the context of the customer s business or personal activities? Has the pattern of transaction conducted by the customer changed? Where the transaction is international in nature, does the customer have any obvious reasons for conducting business with the other country involved? 4.4 Sample Suspicious Transactions Insufficient, false or suspicious information provided by the customer Cash deposits that are not consistent with the business activities of the customer Purchase and /or deposits of monetary instruments that are not consistent with the business activities of the customer Wire transfer activity that is not consistent with the business activities of the customer Structuring of transactions to evade record keeping and/or reporting requirements Funds transfers to foreign countries

21 4.5 Alert Parameterization Facility to parameterize the limits for reporting of exceptional transactions Bank can set any limit (benchmark) for exceptional transactions. Limits/benchmarks can be modified/changed. Changes to existing benchmark are reflected in subsequent transaction import. Report of exceptional transactions as Alerts 5. Reporting to FIU / Regulatory Body Facilitates Mandatory Reports STR (Suspicious Transaction Report) CTR (Currency Transaction Report) SAR (Suspicious Activity Report) ATR (Asset Transaction Report) Facilitates Ad hoc & Transaction Reports

22 6.Investigative Tools - Case Management Built-in workflow to send the captured suspicious AML information to specific AML officer/ user function Auto & manual routing of alerts Case manager Case report 7. Fraud Detection Address both Internal & External Fraud Key areas of fraud include: Internal Fraud Fraudulent loans Wire fraud Forged or fraudulent documents Identity theft External Fraud Stolen, forged & alerted cheques Cheque kiting Credit card fraud Phishing & internet fraud

23 8. Business Intelligence Capture entire customer DNA Facilitate graphical analysis Primitive CRM tool Facilitate cross selling & up selling for banks AML Function for Banks Addresses AML functionality through Extensive KYC Module Transaction & Account Monitoring Scenarios Benchmark Creation Techniques Alerts Analysis & Resolutions Risk-Based Account Categorization Pattern Discovery & Recognition Investigation Management Suspicious Transaction Reporting Multidimensional Analysis Comprehensive & Detailed Audit Trails Scalable Architecture to Allow for New Products & Services Static Data Mapping Customizable Look & Feel, Easy Navigation & Drill Down Facility Easy Integration with Core Banking Solution.

24 End Police Col. Seehanat Prayoonrat Deputy Secretary-General Anti-Money Laundering Office Thailand