Improve Threshold Values Tuning of Transaction Monitoring Systems by Taking a Qualitative Approach

Transcription

1 Imprve Threshld Values Tuning f Transactin Mnitring Systems by Taking a Qualitative Apprach Issue Central t any transactin mnitring system are the threshld values at which each f the selected transactin mnitring scenaris perates. If set t lw, threshld values will result in numerus false psitives, requiring analysts t expend cnsiderable time investigating useless alerts. If threshld values are set t high, analysts may fail t detect and reprt suspicius activity, as required by varius regulatry agencies acrss the glbe. In an effrt t ptimize threshld values, mst financial institutins take an apprach t threshld setting and tuning that is fcused slely n quantitatively determining, r tuning, the threshld values. This apprach enables institutins t determine threshld values that are supprted by a statistical r a datadriven analysis, but it fails t factr in the business intelligence that can be gleaned frm alert investigatins and available suspicius activity reprt (SAR) data. Challenges and Opprtunities In ur experience, financial institutins face multiple challenges with respect t tuning threshld values. The mst cmmn and critical f these include: Knwledge f business impacts Mre ften than nt, threshld setting and tuning is executed by a team with deep quantitative knwledge f varius mdel and statistical techniques, but withut a strng understanding f alert investigatin and the resulting impacts f lwer r higher threshld values. Infrmatin availability Infrmatin that wuld infrm the alert tuning prcess, such as the rati f alert-t-sars and the nature f SARs, is nt easily retrievable. Fr example, SAR data may reside in a separate financial intelligence unit (FIU) and may nt be easily accessible t a test envirnment used fr evaluating alerts befre they are put int prductin. Resurce availability Even thugh an rganizatin may understand the need t perfrm alert investigatins befre deplying threshld values in prductin, it may nt have cnsidered the need fr seasned investigatrs t cllabrate with the quantitative team and perfrm qualitative analysis f the alerts. These challenges ntwithstanding, cmbining quantitative and qualitative analysis is the nly way t ensure that mathematical results are balanced apprpriately with real-wrld business experience and judgment.

2 The specific benefits yu ll gain frm incrprating a qualitative prcess include: Reduced false psitives By executing a scenari tuning cycle that includes qualitative analysis, such as histrical infrmatin gathered at the investigatin level f pre-prductin alerts, a financial institutin will be able t establish mre targeted threshlds. Additinally, by cnsidering previusly filed SARs, the institutin can extract pertinent infrmatin abut clusters f activity respnsible fr the suspicius activity. This infrmatin can then be leveraged t perfrm tuning f the threshld values fr the patterns f activity that is identified in the SARs. Identificatin f redundant scenaris Additinally, thrugh the review f alert-t-case infrmatin and SARs, an institutin can identify current rules r scenaris that are nt yielding prductive alerts, and can use this infrmatin t evidence redundant/ineffective scenaris and make a case f retiring them. Our Pint f View Based n ur experience assisting institutins with threshld tuning, we have develped a threshld tuning methdlgy that is deeply rted in the qualitative analysis f ptential alerts. The qualitative analysis phase begins after the initial threshld values have been determined quantitatively. At a high level, the illustratin belw depicts where the qualitative analysis fits in the verall threshld tuning prcess: Fllwing are cnsideratins that are especially imprtant fr perfrming effective qualitative tuning: Sandbx Envirnment The rganizatin shuld create a dedicated sandbx envirnment where the qualitative tuning exercise can take place. The key requirements f the sandbx envirnment include: Existence f prductin data The sandbx envirnment shuld cntain prductin data and be cnfigured t enable an investigatr t btain a real picture f hw the alerts will appear when they are actually deplyed in prductin. Key data pints are custmer, accunt, transactins and scenaris. Prtiviti 2

3 Capability t execute alert generatin cycle The sandbx envirnment shuld prvide fr the capability t execute multiple alert generatin cycles t allw fr multiple iteratins f alert investigatins befre the right set f threshld values can be deemed apprpriate. Alert Sampling Alerts that are generated in the sandbx envirnment shuld be sampled fr investigatin. A statistically valid sample shuld be extracted frm the alert ppulatin. If the rganizatin leverages custmer segmentatin r risk levels, then a stratified sample shuld be extracted such that alerts are sampled frm each f the custmer segments r risk levels. Investigatins Lite This is a key phase f the qualitative tuning. Each f the sampled alerts is reviewed by investigatrs t determine whether it is prductive (high likelihd f SAR filing), unprductive (lw likelihd f SAR filing) r errneus (result f underlying bad data such as duplicate transactins, incrrect cuntry cdes, etc.). In rder fr investigatrs t perfrm their analysis effectively, they need the fllwing infrmatin: Custmer data Investigatrs shuld have access t the custmer data attributes necessary t understand the custmer s backgrund and business r banking activities. Available data may vary based n custmer type (individual, business, financial institutin). Name Address Occupatin r industry Entity type (partnership, limited liability crpratin, crpratin, trust, private investment cmpany) Incme Accunt data Investigatrs shuld have access t the accunt data necessary t understand the nature f the accunt, as well as the identities f individuals r entities that have access t, influence ver r an interest in the accunt. Accunt type Date pened Average accunt activity Related accunts Authrized signatries Beneficial wners Transactin data Investigatrs shuld have access t the transactin data necessary t understand the nature f the transactins being reviewed. Minimum f six mnths prir t perid cvered by the alerts Originatr, beneficiary, and intermediary details (e.g., name, address, accunt number, financial institutin, cuntry) Transactin type (ACH, wire, cash, check, internal transfer, etc.) Prtiviti 3

4 Prir SARs Knwledge f prir SAR filings in relatin t the custmer r a custmer s accunt will aid in determining the effectiveness f alerts being reviewed by investigatrs. Alerts f custmers r accunts with previus SAR filings may be viewed as mre effective than alerts fr custmers r accunts with n such previus filings. Prir alerts An understanding f prir alerting activity and alert dispsitins will aid in understanding the kinds f activity that have been subject t previus review and t assist in determining the effectiveness f alerts being reviewed by investigatrs. Recurring alerts fr repeated, nnsuspicius activity may be viewed as less effective than alerts fr different ptentially suspicius behavirs. Hw We Help Cmpanies Succeed Our AML prfessinals and ur team f mdeling experts, including Ph.D.-level prfessinals with deep quantitative skills, help institutins implement and maintain a sund and rbust threshld-setting and tuning methdlgy. We have experience with a number f AML transactin mnitring systems n varius platfrms, including but nt limited t Actimize, Detica NetReveal AML (Nrkm), Mantas and SAS AML, Fiserv, as well as a number f hmegrwn systems. Our AML transactin mnitring technlgy services include: Develping and executing a sund and efficient scenari-setting and tuning methdlgy and apprach Perfrming any r all f the fllwing tasks by acting as an independent team: AML red flag gap analysis Data validatin Scenari lgic validatin Threshld values validatin Perfrming custmer segmentatin Recmmending imprvements t scenaris/threshlds Example A large bank engaged Prtiviti t assist with threshld tuning f its existing scenaris. We develped a systematic threshld-setting and tuning methdlgy that nt nly tk int accunt the quantitative aspects f these scenaris, but als the qualitative aspect f alert review in rder t determine the final threshld values that the client shuld deply in prductin. The deliverables cnsisted f a dcumented methdlgy and apprach t assess peridically the apprpriateness f scenaris and threshlds bth frm a quantitative and qualitative perspective, sftware scripts that the bank culd leverage n an nging basis t perfrm threshld setting and tuning, sampled alerts, and investigatin lite review results. By leveraging this qualitative apprach, the bank was able t reduce ptential false psitives, thus imprving investigatr efficiency. Prtiviti 4

5 Abut Prtiviti Prtiviti ( is a glbal cnsulting firm that helps cmpanies slve prblems in finance, technlgy, peratins, gvernance, risk and internal audit, and has served mre than 40 percent f FORTUNE 1000 and FORTUNE Glbal 500 cmpanies. Prtiviti and its independently wned Member Firms serve clients thrugh a netwrk f mre than 70 lcatins in ver 20 cuntries. The firm als wrks with smaller, grwing cmpanies, including thse lking t g public, as well as with gvernment agencies. Prtiviti is a whlly wned subsidiary f Rbert Half (NYSE: RHI). Funded in 1948, Rbert Half is a member f the S&P 500 index. Cntacts Carl Beaumier carl.beaumier@prtiviti.cm Luis Caneln luis.caneln@prtiviti.c.uk Bernadine Reese bernadine.reese@prtiviti.c.uk Chetan Shah chetan.shah@prtiviti.cm 2014 Prtiviti Inc. An Equal Opprtunity Emplyer M/F/D/V. Prtiviti is nt licensed r registered as a public accunting firm and des nt issue pinins n financial statements r ffer attestatin services.