It has been great to see an advance in security controls taken to render financial businesses stress and fraud-free. Yet, here is the rub: incorporating new measures doesn’t come at ease. Business owners have to spend their time and money to renovate their anti-money laundering (AML) and counter-terrorist financing (CTF) compliance, building it more steady.
The problem is universal and we have helped a couple of hundreds of international businesses to readjust to the new normal. Based on this experience, we want to give you the keys to the AML compliance program that will work for your business. First off, let’s get going with a straightforward definition.
What is an AML compliance program?
An anti-money laundering compliance program is everything a company does relating to compliance: built-in internal operations, user-processing policies, accounts monitoring and detection, reporting of money laundering incidents. The aim of an AML compliance program is to expose and correctly react to inherent and residual money laundering, terrorist financing, and fraud-related risks.
To develop a coherent AML compliance program that helps catch bad actors and save from non-compliance fees, businesses have to follow set out requirements.
What does a business have to do to stay AML compliant?
The aims of an anti-money laundering compliance program are to expose fraud, money laundering, tax evasion, and terrorist financing within a company. To reach this goal, there are three most important must-dos.
- Sophisticated reporting
A powerful reporting system helps to immediately inform money-laundering activity to the relevant authorities.
- Detecting risky customers
Businesses must evaluate their client’s risk profiles and process them accordingly (enhanced due diligence, customer due diligence, etc.)
- Compliance officer
The whole process is not easy to manage and requires a special person in the company who would have the experience and the knowledge to keep the business in close compliance with what is demanded.
Compliance must be the moral responsibility of every team member across all organizational levels, they must be trained to recognize and report their suspicions.
Important factors that determine AML compliance
Before creating a compliance program to battle money laundering, an organization has to analyze and draw up its potential risks and legal obligations.
- The risks the business is exposed to;
- Anti-money laundering laws in their jurisdiction and fines for non-compliance;
- Possible suspicious activities that will indicate to money laundering.
To level up the development of an AML compliance process, businesses should outline solid guidelines. It will simplify the process and avoid compromise.
How to develop the program: a step-by-step guide
We have provided a guide containing the key components and a summary of all the steps necessary to develop a forceful compliance program.
1. Detecting suspicious activity
The first goal is to quickly expose money-laundering associated activities.
- Abnormally big sums of money deposited on an account;
- The lack of information submitted to open a bank account;
- Fake data found in the application.
The full list of suspicion triggers could be found here.
Based on Recommendation 20 of the FATF, if a bank has reasons to believe that certain funds are the potential proceeds of crime or are linked to fraud and terrorism, it must shortly report these suspicions to a Financial Intelligence Unit (FIU).
2. Risk assessment
Each client case is not created equal. ML and TF risk assessment can help you score and sort risky customers into different threat tiers. To develop a scoring model, assume common risk factors (high-risk countries, PEPs, UBOs, due diligence results).
The due diligence process should be determined by the relevant AML jurisdiction.
3. Internal practices
To handle ML/TF risks and support regulatory compliance (FATF, Recommendations 18, the Bank Secrecy Act) financial entities have to set internal guidelines regarding information sharing within the organization.
- Make due diligence your own
Every financial institution has to have due diligence procedures that follow both, their own and their customer’s compliance demands.
- Set roles and responsibilities
Businesses must assign an AML compliance officer or a Money Laundering Reporting Officer (MLRO) (for larger organizations) to take over all things compliance.
- Report suspicious activity
Suspicious transactions must be reported to the management first. Then, based on the evidence at hand, the MLRO will decide whether they should report it to the appropriate FIU or not.
- Training employees to spot and properly react to ML and TF activity
The employee training program has to be designed to meet the requirements of the company and should be scheduled according to changes in legislation or when a criminal doing occurs.
To properly protect their work banks and e-wallets should have internal controls across all departments and branches.
4. Training to spot criminal attempts
For compliance officers to understand their roles and obligations an AML training program should be carried out regularly.
Who to train: High-risk sectors; those where staff comes into direct contact with clients, compliance and audit teams, and senior management.
- General information: the grave results of failing to maintain money laundering and terrorist financing as well as the importance of spotting and stopping these financial crimes.
- Legal framework: detailed review of anti-money laundering regulations.
- AML penalties: an overview of penalties for failure to adhere to anti-money laundering laws.
How to train: onsite or online, through third-parties, or by yourself. There are some conventional training methods that are commonly used.
- Educational presentations and webinars prepared by a company’s compliance officer.
- Interactive e-learning modules and evaluation tests to measure anti-money laundering proficiency.
- Regular staff meetings about the latest AML issues on the market.
- Updating anti-money laundering controls according to legislation and sharing the changes with staff.
Of course, each company has to consider its AML actions through the lens of the industry and business specifics.
5. Independent Audit
A review by an independent auditor is a great way to spot the weaknesses of the company’s risk assessment and compliance program: KYC due diligence procedures, compliance training, monitoring and reporting systems. By reviewing previous reports, companies can see the effectiveness of implemented changes. Financial regulators, in their turn, use these audits to find the violations of AML laws.
Section 59(2) of the New Zealand AML/CFT Act demands an independent audit every two years or upon a supervisor request.
Criteria for selection: An independent auditor must have AML expertise and meet regulatory expectations. Under section 59B(3), the auditor must not have participated in developing the organization’s AML compliance program.
The role of an AML compliance officer
Everything from compliance development to its implementation falls on the shoulders of a compliance officer: internal audit management, compliance analysis and the development of appropriate recommendations, employee training, etc.
Appointing an AML compliance officer
Candidates must have expert knowledge of regulatory data sources, compliance analysis tools, and proficiency in the relevant regulations.
In addition, a compliance officer will need extensive experience in the financial sector, preferably in AML compliance, legal or internal risk audits. Another must is an appropriate certification (CAMS, CAFP, CRCM, etc).