Durrus & Mizen Group: AML Cultural & Process Performance Diagnostics Case Study

Transcription

1 Durrus & Mizen Group: Cultural & Process Performance Diagnostics Case Study

2 Durrus & Mizen Group: Cultural & Process Performance Diagnostics Case Study Background In 2015 an acquisition focused investor group acquired a Bank with operations in six countries, several of which rank amongst the fastest growing countries, by GDP, in the world. The investors needed to quickly assess the compliance competency and technology capabilities of their new acquisition, particularly as it related to US regulatory requirements. A US based consulting company with a global team of experienced security and technology consultants, and compliance and monitoring experts, was retained to carry out the compliance review. They worked in conjunction with Mizen Group, a Boston based company specializing in Anti-Money Laundering () compliance, to undertake the elements of the assessment. Mizen was tasked with executing a full compliance operations and technology assessment in a compressed timeframe. To deliver within these constraints Mizen needed to accelerate the assessment process while ensuring consistency across the six different regions. In summary, Mizen needed to find a way to simultaneously assess an extended bank network in six separate countries to identify compliance trouble spots, and to diagnose the degree to which a robust culture was embedded in the various countries. This had to be done rapidly and without compromising the consistency of approach. Mizen had a partnership relationship with the Business School at University College Cork (UCC) Ireland, and was aware that a Capability Maturity Model for and web-based tools to enable rapid diagnosis of performance capability (-PD) and cultural embedding (-CD) had been developed. The -CD The - CD is a web based diagnostic that is used to rapidly, objectively and consistently assess an organisation s culture for compliance and risk awareness across all layers of the business. It navigates the user through a series of questions that examine 7 cultural embedding factors. It is taken anonymously and should be deployed to at least 70% of staff. The diagnostic takes about 20 minutes to complete and provides Boards with insight and a deep understanding of the attitudes, strengths and weaknesses of their institution s business culture for.

3 The -PD The -PD is a rapid, cost-effective, end-to-end web based diagnostic. It navigates the user through a standardised, easily executed, assessment of process capability measured across 17 process areas. It should take approximately 4 hours to complete and provides the institution s directors and senior executives with an assurance that their institution is maintaining an effective control structure. The -PD provides boards, MLROs, compliance officers and their teams with a complete understanding of their process strengths and weaknesses. Anti-Money Laundering Maturity Model (-MM) Domains & Process Areas Architecture Definition Governance Domain Strategy Definition Policy Formulation Quality Assurance Organizational Supports Domain Training ML Risk Assessment Risk Domain ML Mitigation Assessment Record Keeping Customer Onboarding Due Diligence Domain Monitoring Investigation & Reporting Domain Alert Disposition Correspondent Relationships Sanctions & Payments Screening Process & Technology Improvement Employee Due Diligence Third Party Management Data Measurement & Analytics

4 The performance and cultural diagnostic proved itself to be immensely powerful in summarizing, in a consistent and concise fashion the capability level of the Bank. The results truly became real to us as they independently reflected what we observed on the ground. Paul McCarthy, The Mizen Group Execution Mizen was confident that the -PD and the -CD diagnostics would expedite the assessment process and rapidly deliver an evaluation of the bank s process capabilities and the extent to which they were culturally embedded. They retained the UCC team to assist them in deploying both diagnostics. As an initial step Mizen identified champions in each of the geographic locations to promote and encourage staff to take the assessments within the provided time period. -CD (Cultural Diagnostic) To ensure a comprehensive assessment of the organisation s culture was obtained it was agreed that staff in the following areas should take the -CD with an expected uptake in excess of 70%. All banking operations staff. All branch managers, branch supervisors and relationship officers. All corporate retail staff. All risk, legal and compliance staff working from country headquarters. All corporate, investment and treasury staff working from country headquarters. The -CD was distributed and completed anonymously and it also enabled participants record their own free-text input. -PD (Performance Diagnostic) The -PD was targeted at the six country level MLROs and relevant compliance support staff in addition to senior group level compliance personnel. Unlike the -CD the -PD is not taken anonymously. The participants were given a communication that explained the purpose of the -PD, how important it was for them to be open and honest with their responses to the questions in the diagnostic, and explained how critical it was to the future plans of the organisation. Both diagnostics were deployed simultaneously to all participants across all six countries using web-based survey instruments. The assessments took place in November 2015 with the UCC team monitoring response rates and advising the consultants in situ where response levels were low and more encouragement to participate was required. Data storage and processing was hosted securely by UCC and deployment and management of the diagnostics was performed by the team in UCC. In the space of just 10 days both diagnostics were completed with the expected participation targets exceeded and the results ready for processing.

5 RESULTS Both diagnostics ran on schedule and were completed within the 10 day timeframe allotted. The engagement was regarded as a great success with the output and data gathered far exceeding the expectations of the client. At the outset it was expected that there would be significant variation across the 6 countries with their diverse teams and operations. The data collected confirmed this disparity and also identified a number of other key findings that influenced subsequent work on the remediation programme and the training activities. Real free text commentary from case study participants. Training for money laundering is just there to meet regulator s requirement, but we do not live it. Processes and procedures for compliance are in place but there is need for awareness training within the organisation. Reference to these standards is usually made only when something goes wrong.

6 BenEFITS Within one week of completing the diagnostics Bank management had a comprehensive picture of whether the bank had a robust and defensible control structure and culture. Some of the findings included: Full -PD benchmarking comparing each country s capability at the process area level showing differing standards. Full -CD benchmarking comparing each country s compliance and risk awareness culture for each cultural embedding factor, again showing differing perceptions across levels and geographies. Extensive insights into the design of work practices where 62% of -CD respondents believed that the design of work practices had a great or a very great effect on their ability to be money laundering risk aware. The responses indicated major differences in cultural awareness between -CD respondents who were experienced new hires and those who were long-term employees in the bank. Analysis of the commentary surrounding Training provided by -PD respondents demonstrated that while training was provided it was not frequent enough, was inconsistent across geographies and staff levels and needed to be revamped. The majority of -PD respondents believed the transaction monitoring parameters were either poorly or minimally maintained. It was evident from this engagement that the Diagnostics are Accelerators they enable organisations to rapidly discover a great deal about their /CFT performance capability and cultural embedding and provide a means to have a Standardised Approach to evaluation across diverse teams and operations.

7 ABOUT DURRUS COMPLIANCE DIAGNOSTICS Durrus Compliance Diagnostics is headquartered in Cork, Ireland. It is a University College, Cork (UCC) spin-out company set up to commercialise the Maturity Model Suite which includes the -CD. The Maturity Model Suite was the result of many years research by an expert team at UCC in conjunction with an Industry working group. The research was funded by Irish government development agencies within a national centre for financial services research.

8 t: e: e: