Contextual Monitoring: Enabling banks to reduce false positives while catching the bad guys

Transcription

1 Contextual Monitoring: Enabling banks to reduce false positives while catching the bad guys

2 Executive summary The need for a new approach The current approach to Anti-Money Laundering (AML) Transaction Monitoring is being questioned by many organisations and in the majority of cases it is deemed to be ineffective at managing the risk or the cost of compliance. Financial Institutions are struggling to manage the financial and regulatory burden of AML and despite their best efforts are still unintentionally facilitating money laundering. The implementation, tuning and maintenance of these platforms would make the cost of transaction monitoring platforms prohibitive, if they were not mandated by regulations and fined for non-compliance or breaches. However, the most striking shortcoming is the performance. Despite the hundreds of millions spent on these platforms the performance statistics leave a lot to be desired. Challenges to banks with traditional transactional: Huge numbers of false positives (90%+ on average) Extremely slow investigation of alerts (60mins+ on average) Failure to detect complex AML cases (Russian, Azerbaijani Laundromat, etc.) This paper will describe how Contextual Monitoring works and will illustrate how easily it can be adopted as well as the benefits in both accuracy and speed.

3 Current transaction monitoring (TM) platforms are incapable of analysing very broad data sets. Existing approaches focus on the accounts and customers of the bank rather than the ultimate originator and beneficiary of transactions. Attempts to understand the original source of transactions are inconsistent and inaccurate. In addition, the current approach is restricted to relatively simplistic linear rules that look at value and volume profiling and use simple Peer models (static single dimension) to detect anomalies. Attempts to build complex rules results in excessive false positives as well as a lengthy and costly process to develop and tune them. In addition, the ability to adapt the current TM approach to more complex and high risk business segments such as Capital Markets, Correspondent Banking and Trade Based Money Laundering has met with little or no success. This all means that alerts generated by the traditional TM platforms are based on an incomplete picture of activity. During the escalation review process, it is left to the investigators to fill in the gaps, understand the context of the transaction, and investigate the counterparties. In a recent exercise with Tier 1 banks, it was identified that a TM platform takes an average of 30 data points or less to generate an alert. In contrast more than 100 data points are assessed by a Level 1 (L1) investigator in making a decision. If a TM platform only has 30% or less of the data need to conclude a L1 investigation, it is no surprise that the false positive rates are so high, resulting in even longer investigation time. Recent studies have shown that of an investigator s time: 75% is spent gathering and creating the contextual information 15% is used to analyse the data and make a risk decision 10% is spent writing up findings and the conclusion of the investigation If 75% of the data is missing, do we really have enough information and context to detect criminal activity? Can such a process be said to be effectively managing risk? Effective and efficient transaction monitoring requires a fresh approach. We believe that we have found a solution to the current shortcomings in AML. Significantly reduce the number of alerts generated from thousands of alerts to hundreds or even tens of alerts, by providing the additional context that current TM platforms lack. Speed up investigations by 100 to 150% - automatically provide investigators with the context and pre-analysed answers to their questions. Effectively identify the complex AML cases which were previously missed - provide the additional data points needed to write more sophisticated rules. The approach is called Contextual Monitoring. 3

4 What is Contextual Monitoring? Contextual monitoring is the ability to join and connect together data from different systems and sources to create context and meaning to identify significant connections. Where certain sources hold more information on specific entities (individuals, businesses, addresses, telephone numbers, etc.) this additional data is used to enrich all the other linked sources and potentially uncover additional matches. More data means a more complete network of connections. This is essentially what an investigator does when they investigate an alert, but it is a time-consuming procedure. Contextual Monitoring will perform this process automatically and the enriched data can be made available to the monitoring platforms. This in turn enables more advanced machine learning and Artificial Intelligence (AI) algorithms, allowing more sophisticated scoring and analytical approaches to either stop the alerts being generated or so they can be triaged into hibernation or fast close queues. The key data sources that are used for enrichment and network generation are: Internal Reference Sources (Know Your Customer data) Internal Transactional Sources External Reference Sources (Bureau van Dijk (BVD), Dunn and Bradstreet (DNB), etc) Internal and External Negative Sources (Watchlists, ICIJ, Dow Jones, WorldCheck, AML Alerts, etc) Internal Reference Sources - Know Your Customer (KYC) data When analysing KYC data, it is critical that the same customer is identified and connected across multiple systems. For instance: If Customer A has four products (e.g. current account, savings account, credit card, mortgage) those customer records should be linked and the products monitored as a collective on the customer level. If Customer A also has a business and investment account alongside the four retail accounts then these need to be found and linked together. Marital and family connections should also be linked together. 4

5 Figure 1. Multiple customer records within a bank. Many customers have multiple products in a bank and a separate customer record for each one. This example shows one customer having a current, savings, mortgage and credit card account within one organisation. Figure 2. Generating a single customer view with Quantexa technology. 5

6 Internal transactional sources When analysing transactional activity it is critical that the foreign counterparties (not the bank s customers) are identified. For example: If Customer A sends 50 international wires to another bank to Counterparty B, Counterparty B needs to be identified and these transactions should be grouped together. When looking at Correspondent Banking, if there are 50 customers sending 10 transactions each to Counterparty B these 50 customers and 500 transactions should be grouped together to analyse Counterparty B correctly. Figure 3. Transactional monitoring of Customer A. This customer has sent money out of the bank to Company L, who is not a customer of the bank and therefore no other information is available. External Reference Source (BVD, DNB, etc) When analysing a customer or business, it is critically important to link the business, director or shareholder to their records in corporate registers and sources such as BVD and DNB. If Customer A is a director of 12 companies it is vital to be able to see these relationships. If Counterparty B is a company then being able to find that company record on BVD or DNB is important to understand the business type and ownership structure. 6

7 If Counterparty B is a subsidiary it is important to know who the Regional and Global parents are as well as other business in the legal entity. Where Counterparty B has shareholders being able to trace the ownership structure and any controlling interests is essential. Figure 4. Customer A is a director of Company A and the transaction to Company L is part of a larger Legal Entity with a Parent Company P. From the customer data and transactions, a corporate registry (External Data Source) can add more context. 7

8 Figure 5. The ownership structure identifying the Ultimate Beneficial Owners (UBO) to analyse other touch points. Parent Company P is expanded and we can see other subsidiaries, companies M, N and O. These companies are sending money back into the bank to companies B, C and D. 8

9 Internal and External Negative Sources Negative sources are important to highlight high risk connections in the data If Counterparty B shares a director with Counterparty C and there has been a previous SAR disclosure on Counterparty C, Counterparty B represents a much higher risk. If one of Customer A s companies has a director that is the spouse or partner of a finance minister Customer A and their connected company have an increased risk profile. Figure 6. Uncovering hidden risks by adding Negative Sources. Linking across internal KYC data, External data, Transactions and Negative sources can potentially mean billions of records. A big data approach is required. Quantexa has already proven that it can complete this process with 6.4 billion records at a Tier 1 Global Bank, providing real time and dynamic search and linking capabilities that allow investigators to more quickly identify and investigate complex cases. 9

10 What context can Quantexa generate to assist in AML investigations? Quantexa are delving deeper into what investigators are doing and the questions they are asking. We have found that it is possible to replicate the data gathering, analytical questioning and risk weighting process of an investigator in software. The key focus for investigators is understanding the foreign counter parties (non-bank customers) that are sending money to or receiving money from the bank s customer. The investigators questioning was simple but provided critical data in the decision making. There are four key areas of focus: 1. The transactions or activity 2. The customer and KYC on all parties 3. Negative news 4. Writing up the findings and evidencing the alert outcome Transactional Activity Let s consider a fictitious example. An alert is raised for by a $1million transaction to the Philippines from Company A. What are the questions an investigator is asking and how can Contextual Monitoring support this? The first questions asked were: Has this customer transacted with this counterparty before? If yes then is this in normal bounds for value and volume? Figure 7. Is this transaction a risk? Current approaches will alert to this and require the investigator to determine if this is suspicious. In this instance it is the first time this transaction has occurred for this customer 10

11 If not, has any of the banks other customers transacted with this counterparty? If yes, then what are these other customers, what businesses do they operate and does this alerted customer behave similarly to the others? (industry types, size of company, size of transaction, etc.) Figure 8. If the investigators discover other companies within the bank, in this case Company X and Company Y, who are both in the same industry segment, working with electronics and for a roughly similar value this adds legitimacy to the transaction. If I find the counterparty and it is a business can I find the company on corporate registers such as BVD and DNB? This data allows banks to consider the following: The economics of the trade, e.g. should a banana exporter be trading with a mining company? How big is the foreign party and does the trade make sense in the context of its financial size and workforce? Are there any hidden ownership connections between the companies? Are there any connections to Sanctions or PEPs through the ownership structure that could indicate corruption or capital flight? 11

12 Figure 9. As the investigator researches the foreign counterparty, they discover that they are the within the same legal entity as Company A. In this instance this is assembling company paying its supplier for parts. This make the transaction completely legitimate and not interesting. 12

13 What is the activity in this account and other related accounts for the customer? Are there any suspicious transactions from high risk countries? Can I see pattern of life activity, such as: Retail customers, bill payments, Council Tax, utilities, supermarket spend, salary, etc. Businesses, VAT, payroll, bills, utilities, etc. Figure 10. Looking at Customer A s account we see a different mix of transactions and can conclude that there are bill payments, payroll and other international transfers, so it appears legitimate. As these examples show, Contextual Monitoring provide answers to all of the questions an investigator asks. Quantexa software automates this process to provide a faster and more comprehensive investigation which also allows data scientists to write rules and build models with the new attributes. The customer and KYC The next step is to understand their customer s KYC and the KYC of any of the identified companies, including the directors, shareholders, Beneficial Owners and any Ultimate Beneficial Owners (UBO) and any other connections What KYC data is available on the customer and any other businesses, their directors, shareholders and UBOs? What type of businesses are they and does it make economic sense for these companies to transact with each other? Are there any connections to negative lists (internal or commercial), sanctioned entities or PEPs involved? 13

14 Figure 11. In this example company B is no longer related to company A. All the parties needed for KYC have been identified and automatically screening against any watch lists, internal or commercial. In this example one of the directors and the UBO Company C are on watch lists. Company X and Y are also automatically screened to see if there are any connections to watch lists. CLOSING DATE MONTHS UNITS CURRENCY TOTAL ASSETS SHAREHOLDER CAPITAL FUNDS LIQUIDITY ACCOUNTING CURRENT RATIO PRACTICE ASSETS INTANGIBLE FIXED ASSETS OTHER CURRENT ASSETS NET OTHER CURRENT SHAREHOLDER ASSETS FUNDS 31/03/ units GBP Local GAAP /03/ units GBP Local GAAP /03/ units GBP Local GAAP /03/ units GBP Local GAAP Figure 12. The collation of data also includes the financial information and industry codes from BVD, which allows investigators to quickly see if the companies should be trading with each other and the financial legitimacy (years trading, turnover, profit, employees, etc.) of the companies, 14

15 Negative News searches Negative News is a vital step but searching for names brings back too many hits. Intelligent methods are required to focus on key words (terrorism, money laundering, etc.) and filter the results. For the identified entities is there any negative news indicating they might be involved in financial crime, fraud, money laundering, etc.? Figure 13. Negative news searches become more accurate as the context of the network view and enriched data is used to hone in on the correct articles. For example, with our techonology searches can be performed using the company name and industry description. Directors are searched using their full name, date of birth and the companies they are involved with. Writing up the findings and evidencing the alert outcome The final stage of the investigation is to update an evidence document and record the outcomes and findings. Organisations use a variety of tools to do this, include Word, Excel and case management tools. CUSTOMER ACCOUNT INTERESTING COUNTERPARTIES LINKED BUSINESSES Customer A Counterparty A Company A Customer B Counterparty B Company B Figure 14. Quantexa automatically collates all of the information from the Network view and flattens this into tables that are more easily understood by L1 and L2 investigators. 15

16 Summary The context collated by investigators can be automatically created by Quantexa software. This context can be used to enrich alerts generated by traditional transaction monitoring systems. This essentially completes a L1 investigation in software, presenting investigators with pre-analysed information to enable them to make quicker, more effective and consistent decisions. The network diagrams and analysis is flattened into tables so it can be more easily consumed by L1 and L2 investigators. The system generated networks are also available for L3 investigators and the FIU to interact with, expand and interrogate. How can Quantexa s enhanced context help with reducing false positives and alert volumes? Making investigators more efficient, effective and consistent is the first major benefit that Contextual Monitoring brings. The next major benefit is that all the information that is available to investigators is also available to rule writers, AI and Machine Learning algorithms. Very simply, if the investigator checks something or draws a conclusion from information this can be completed automatically by the software and then an associated risk score and weighting can be applied. Some of the questions a Contextual Monitoring system can ask are: 1. Is this the first time we have seen this counterparty before for: This customer? This customer s peer group? This country? The bank as a whole? 2. Can I find this counterparty on BVD? If not that is a risk factor. If I can find this counterparty then I can now ask the following How big are they? What type of industry is this? Where do they operate? Is there any risk in the ownership structure? Do I see any transactions to or from other companies in the ownership structure? If I do see transactions do they go to my customers? If they do does it make sense compare to the first set of transactions? All of this context is critical in understanding why a transaction has happened and has the potential to change the way organisation monitoring and look for AML activity. 16

17 Benefits to Financial Institutions of this approach Many banks have started the adoption of this approach in investigations as there are immediate benefits in managing operational costs, understanding the full extent of the risk and exploring the fund flows more effectively and efficiently. It also provides consistency and transparency into the investigations process, filling in gaps and correcting poor processes. Furthermore, our software allows contextual data to be collected which will allow the tuning team to know definitively what the positive contributing factors are which will enable more accurate rules to be created in future cycles. The Key benefits that contextual monitoring brings are: 1. Faster, more comprehensive identification and investigations of complex, high risk money laundering cases such as the Gupta / Zuma corruption scandal, Russian Laundromat case, etc. effective reducing tasks which take months reduced to days. 2. Accurate and consistent identification of all involved parties, giving a Full 360 view of all activity 3. Increased efficiency of investigation increasing alert handling rates by 100 to 150+%. Reduce the 75% of time spent on data collection. 4. Highly effective detection, thousands of alerts reduced to hundred or tens of alerts 5. Reduced operational costs and system maintenance. 6. More comprehensive coverage of AML risk. 17

18 How easily can Contextual Monitoring be adopted? Financial Institutions have chosen to implement Contextual Monitoring capabilities in a number of areas. The following table outlines the different areas where contextual monitoring can be applied to the AML landscape and a timetable. Stage Area Proposition Description Benefits Stage 1 Stage 2 Stage 3 Stage 4 Stage 5 Financial Intelligent Unit Alert Investigation Level 3 Alert Investigation Level 1 and 2 Post Alert Generation Alert Generation Financial Intelligence Unit Contextual Investigation Alert Management Support Advanced Triage Contextual Monitoring Complex Cross border alert investigation, thematic reviews (such as the Azerbaijan and Russian Laundromat investigations) Assist the complex investigation and SAR disclosure teams covering multiple customer and alert types to understand the full extent of the risk before disclosures are made. Automating the L1 and L2 investigation process in software with 65 proven risk indicators to help prioritise and guide investigator. Collation of the investigation template. Picking up events from other TM platforms and enriching them with the additional information an investigator needs. The solution determines if events are hibernated or raised to alerts. Full contextual monitoring and alert generation across the organisation. Creating alerts with the same data and asking the questions that investigators ask. Faster, more comprehensive identification and investigations of complex, high risk money laundering cases. Months reduced to days. Full 3600 review and identification of all involved parties. Improve alert handling rates by 100 to 150+%. Reduce the 75% of time spent on data collection. Thousands of alerts reduced to hundred or tens of alerts. Reduced operational costs and system maintenance. More comprehensive coverage of AML risk. 18

19 The first step is to quickly create a pilot system. This can be completed in 12 weeks and will take: All internal data Global BVD Internal negative lists 1 Commercial watchlist 12 months of domestic and international transactions (restricted number of payments formats to complete in 12 weeks). Once the pilot system is operational it is manually refreshed until the production environment is delivered. Full installation takes six to nine months, depending on a bank s processes. Adopting this approach allows investigation benefits to realised immediately and future phases can be chosen based on the bank s priorities and normally concludes with Quantexa generating alerts. Areas that benefit the most from contextual monitoring are: Markets AML Trade based money laundering Correspondent banking High Net worth individuals Second Screening for Name List Screening 19

20 T E info@quantexa.com Quantexa, Capital Tower, 91 Waterloo Road, London, SE1 8RT