Supervisory Developments Regarding BSA/AML and OFAC Compliance. Opportunities and Challenges to Operationalizing AML Compliance

Transcription

1 Supervisory Developments Regarding BSA/AML and OFAC Compliance Opportunities and Challenges to Operationalizing AML Compliance By Ellen Zimiles Managing Director Head of Global Investigations & Compliance Institute of International Bankers October 8, 2014 DISPUTES & INVESTIGATIONS ECONOMICS FINANCIAL ADVISORY MANAGEMENT CONSULTING

2 Table of Contents I. Defining Operationalize 1 II. Operationalizing Element of AML Processes 4 III. When is it Appropriate to Operationalize? 5 IV. Challenges of Operationalizing AML 7 V. Conclusion 8 i

3 1 I. Defining Operationalize A. Manual Investigative Processes and Analysis 1. Protocol AML Analysts dispositioning transaction monitoring alerts often perform many work steps to document and evidence their conclusions, pursuant to a wri\en protocol. 2. Types of Reviews Work steps include: a. Ma\ers requiring an experienced eye in determing whether activity rises to an actionable level of suspicion thereby requiring SAR filing. b. More routine ma\er, such as compiling KYC forms, samples of historical transactions, corporate records, etc. 3. Quality Assurance In an effort to ensure that following the protocol does not rob the reviewers of their analytical work, a strong quality assurance function needs to be in place.

4 2 I. Defining Operationalize Cont d A. Manual Investigative Processes and Analysis Cont d 4. Transparency & Auditability This analysis is typically formalized into an investigative memorandum and documented sufficiently enough to permit the process to be re- performed by a third party. In this context, operationalize refers to identifying the routine work steps and developing a process whereby another resource within the financial institution provides such information to the analyst to expedite the work.

5 3 I. Defining Operationalize Cont d B. Automated Data Analysis 1. Alert dispositioning and sanctions analyses can include a false positive or triage stage review that deploys an expedited and repetitive analysis. 2. These are often expedited review processes based on known detection scenarios or interdiction/algorithmic logic shortcomings that: a. Create false positives under certain conditions; b. Do not require extensive documentation to evidence; c. Occur regularly; and d. Often remain deployed because detection scenario or logic changes might result in losing good hits. In this context, operationalize refers to identifying the known conditions and deploying data queries to capture the conditions, not for automatic dispositioning, but rather to for the purpose of expediting the process and presenting such data to analysts for final manual review en masse.

6 4 II. Operationalizing Elements of AML Processes The following three AML processes each include elements that might warrant consideration for operationalization. A. AML Transaction Monitoring Alert Dispositioning 1. Gathering KYC files and corporate records 2. Querying internal systems to compile historical transactions 3. Summarizing dollar amount, party and intermediary transactions information 4. Conducting initial public records searches utilizing pre- defined search terms 5. Alert triage for known issues B. Customer Due Diligence 1. Compiling historical records, including previous regulatory filings, from internal systems 2. Conducting initial public records searches utilizing pre- defined search terms 3. Compiling public records documents required for customer due diligence C. Sanctions 1. Automated data analysis in support of alert triage 2. En masse known false positive reviews 3. Final manual review for known

7 5 III. When is it Appropriate to Operationalize? It is appropriate to operationalize when doing so strengthens the compliance program. Specifically: A. Process Selection 1 Revising existing processes results in program improvements, decreased execution risks and improved quality of the work product. 2. Leveraging operationalized work product remain appropriately skeptical and are permi\ed to re- perform or test the work product they receive. 3. Ensuring that the technical bases for any automated process operationalization remain relevant. B. Protection 1. Ensuring that client data remains protected and SAR related safe harbors remain intact. 2. Extensive testing prior to finalizing processes and procedures. 3. Training should be comprehensive and Desk Operating Procedures precise and transparent enough to be re- performed by a third party and regularly updated. 4. Expectations regarding quality, productivity and data security should be appropriately set and managed via comprehensive management reporting.

8 6 III. When is it Appropriate to Operationalize? - Cont d C. Governance 1. All stakeholders should be included in the selection process. 2. Thoughtful service level agreements should be prepared and regularly audited. 3. Appropriate governance and independent testing should occur regularly.

9 7 IV. Challenges of Operationalizing AML Challenges include: A. Selecting the appropriate AML process elements to operationalize failure to do so can be critical to success and call the overall substantive outcome of the broader AML process(es) into question; B. Managing the implementation and testing of mitigating controls; C. Obtaining analyst buy- in on new operationalized resources while simultaneously encouraging them to feel free to expand and test the work product; D. Protecting data while increasing the number of individuals with access to it; E. Testing and new processes, especially automated processes; F. Training the team that is performing operationalized tasks to execute on precise procedures while simultaneously encouriaging the to escalate/deviate where appropriate; G. Preparing service level agreements that can adjust to volume and process changes while remaining focused on the substantive issues; H. Managing governance and reporting line challenges; and I. Leveraging quality assurance and reporting metrics to make a clear and transparent compliance case to Internal Audit, Examiners.

10 8 V. Conclusion The following consideration should remain top of mind: A. Focusing scarce and potentially expensive AML resources on the appropriate analyses is critical to AML program sustainability. B. Certain elements of the AML Compliance Process are more appropriate than others for operationalization. C. Too much operationalization of an AML Compliance process can be disastrous. If only the most appropriate elements are identified for operationalization, and robust controls are designed, implemented and operating effectively, operationalization can strengthen the AML program and make it more sustainable.

11 9 Contact Ellen Zimiles Managing Director Head of Global Investigations and Compliance Navigant Consulting, Inc. 90 Park Avenue New York, NY