Fit to fight financial crime

Not only are firms keen to mitigate the risk of getting involved in costly enforcement, they are also called upon to meet more exacting regulatory demands and societal expectations that they provide the first line of defence against financial crime.

Within the gamut of financial crime, the following risk management themes stand out:

Governance, systems and controls

Increased and evolving threats require systems and controls that are both sufficiently flexible to respond quickly and appropriately and which are demonstrably subject to robust oversight and governance. Digital solutions present opportunities, but firms need to be aware that regulators expect these solutions to be fit for purpose. In the UK, this builds on the FCA's recent review of AML systems and controls in challenger banks and aligns with its 'data-driven' approach.

In relation to AML compliance more broadly, focus on automated transaction monitoring controls has grown. Traditionally there has been little specific guidance and limited enforcement action in relation to this area. But that seems to be changing – particularly in the UK – as regulators become alive to this as an area of potential weakness, and when specific crystalised risk incidents raise questions as to why weaknesses were not identified (or identified sooner).

Good quality management information remains key for informed governance of both sanctions and AML compliance. In Australia, ASIC has commenced first-of-its-kind proceedings against some of the directors of a casino for failings in directors’ duties due to weak AML governance and oversight. This has created waves in the local market.

In the UK, enforcement actions highlighted the slow pace of financial crime remediation projects. Authorities' statements have focused on the quality of governance and oversight in relation to such projects, with a particular emphasis on the delineation between the three lines of defence.

Following due process – Too much or too little?

There has been a particular issue with being able to identify politically exposed persons (PEPs) and conduct sufficient due diligence both before onboarding and as part of ongoing enhanced due diligence (EDD). In the UK, a parallel concern has been that firms may be 'over-complying', creating unnecessary friction for PEP customers. The UK FCA has launched a thematic review, and new UK legislation will see the EDD standard in relation to domestic PEPs updated.

De-banking is a global concern. Reasons given (or sometimes suspected) are broad ranging from exposure to crypto, to operating in certain high-risk industries or even (allegedly) for political views or association with religious or charity organisations. Banks in New Zealand and Australia have been found to have wrongfully de-banked religious communities and human appeal associations, and similar incidents have occurred elsewhere. Meanwhile, a recent UK FCA review of bank account closures found no evidence of closures on political grounds, but the regulator reminded the UK Government that the time is right for a debate on how policymakers should balance access to bank accounts with the threat of financial crime – as well as firms’ reasonable risk and commercial appetites. 

Regulators globally have reminded firms that when customers are exited – even for good reason – due process must be followed. In the UK, the FCA has linked due process to its new Consumer Duty. In Australia, the AML regulator, AUSTRAC, has published guidance on de-banking which asks firms to strike a balance between risk management and financial inclusion.