Selecting & implementing AML system that meets regulatory & business requirements

Transcription

1 Selecting & implementing AML system that meets regulatory & business requirements Camille Barkho Chief Compliance Officer Lebanon and Gulf Bank SAL Lebanon Mohamad Mansour Sr. AGM Chief Compliance Officer Commercial Bank Qatar

2 What is the regulator looking for?? Effectiveness & Evidence of compliance: Dynamics of any financial institution, Regulatory developments, Availability of resources. Meeting regulators expectation and national AML strategy, Compliance program and Evidence of compliance ; aligned with the national assessment and FATF methodology. FATF methodology : Assessing Technical Compliance, and assessing effectiveness of AML/CFT system is effective. Effectiveness is the extent to which financial systems mitigate the risks and threats of ML/TF, in relation to : A given (a) policy, law, or enforceable means; Program of law enforcement, supervision, or intelligence activity; Implementation of a specific set of measures to mitigate ML/TF risks. Assessing effectiveness judgment as to what extent defined outcomes are being achieved. Advanced Technology & Technology upgrades is an inevitable necessity. Insufficient/outdated technology (Dow Jones Survey 38%) Enhancing transaction monitoring/ filtering solutions/rba. Excessive false positivealerts, lessconfidence inclient screening dataproviders. Concerns about data quality, structure and integration Reviewing, updating, and maintaining KYC

3 Changing /updating AML Technology - Challenges System & vendor selection is a very comprehensive and tedious process (Cross functional expertise) what does the compliance function usually seek in an AML system? A risk scoring process/model to identify and monitor the risks of the customers of the bank and country specific risk parameters. ( RBA) Advanced AML scenarios to identify ML/TF risks based on RBA integrate KYC module with the bank and account on boarding system to deliver a risk score during the on boarding process using a separately configured and licensed functionality called, Real Time Account On Boarding Risk Assessment (ROAR). Configuration of KYC module for matching names against watch lists for identifying the watch list risk for the customer. One Jurisdiction /multi jurisdiction configuration for bank to filter customers and accounts. Integration of KYC with AML for risk assessments to be posted dynamically for AML transactions for AML scenarios. Technology upgrade must achieve strategic goals for the institution.

4 Issues faced by FI RFP ( Request for Proposal)/BRD ( Business Requirement document/specifications) Data Availability. Data Quality. Ability to Integrate between Multiple Systems. Resource Availability Purpose of the RFP Obtain firm, well designed and documented proposals that can be utilized as a basis or /enable to assess, evaluate and select prospective Product Vendor whose Product / Services are requested in the document. AML System Objectives: Meet the functional, Non functional and Technical requirements. Meet all the regulatory (local as well international) requirements. Application which can be customized to business needs. Parameterized changes should be possible Case management Produce clear and accurate Dashboard and reports.

5 Functional Requirements Name Filtering Systems: Quality and power of search engine (Phonetic Fuzzy Dictionary Based Individual Person names VS Entity Names)(Speed of Search)(False Positive VS False Negative Balance)(Single Language match VS Multi Language Match)(Culture Based). Client On Boarding (Real Time VS EOD)(Centralized VS De Centralized). New additions to Lists (Automated VS Manual). Cross Border name filtering (Real Time Automated Who does what). Within a Global AML/CFT Framework system or isolated system. Update Responsibility of Lists (Bank or Vendor)(within Bank IT VS Compliance). Transaction Monitoring Monitoring of Declared Client Activity Ability (Turnover, Type of Transactions and Periodicity)(Link with KYC Systems). Monitoring of Anticipated ML/FT Scenarios (Ease of Management of Scenarios)(Limitations of Scenarios)(Scope of Scenarios Transactional only VS more Levels). Monitoring of Transactions through Artificial Intelligence Systems (Expected Trends from Historical Data). Management of an RBA Platform. Country Specific Configurations (CTSs, STRs, Reports etc ). Dynamic VS Static Reporting. Real Time VS EOD Monitoring. Within a Global AML/CFT Framework system or isolated system. On Boarding Systems: E Form VS Intelligent Application. Only CIF VS Complete On Boarding Workflow. Document Management. Rules Engine. D i VS S i R i

6 Functional Requirements Case management well defined case management system to handle AML cases. capability to categorize cases into various groups based on definitions from compliance users. pre defined as well as configurable workflows for each category of cases. It should be possible to link multiple alerts into a single case as well as demerge an alert Analysis and business intelligence Solution should support risk based AML approach. Risk classification is applicable for both customers as well as for transactions monitoring. Based on the parameters defined by FI, the AML solution should be able to categorize a customer as high / medium / low risk. Risk classification should then be applied to transaction monitoring scenarios to enable compliance users to monitor on priority those transactions that have highest risks. Parameters to be considered for risk classification should include but not limited to customer risk (with factors like residence, economic sector classification, nationality etc.), product risk (the type of products used by the customer), delivery channel risk (the channel used by the customer) and geography risk (the countries involved in the transaction). Reporting / MIS requirements Compliance users should be able to generate various reports to be submitted to regulator. The format of reports to be generated for regulatory entities should be configurable by compliance users. Report should be generated in various formats (e.g. doc, docx, pdf, csv, xml, txt, xls, xlsx etc). Solution should support generation of various management information reports. Examples of MIS reports include no. of AML cases investigated, no. of suspicious transactions reported, no. of FIU enquires etc. System should support creation and generation of ad hoc reports. The MIS reports should be configurable.

7 None Functional Requirements Non functional requirements Solution should have a very user friendly interface, one which can be used by non technical user with minimal training. Solution should support multi lingual interface (English and Arabic) as MIS and reports. Solution should provide same experience to the user across various channels pc and, laptop. The system should be web based. User interface, navigation, messages and usage should be simple, clear and concise. There must be in filed or on screen help related to the system or screen within the system that is being accessed.

8 Vendor / Implementer Related Issues Vendor Related Issues: History of Vendor. Experience of Vendor (Number of installation that are Live in same jurisdictions for same modules). Vendor Continuity (R&D Commitment). Promise to deliver (Implementation time, Data Requirements). UAT ( when to go live, issues identified, retesting) After Sales Support (Technical and Business). Vendor Specialization (AML/CFT VS Multiple other solutions). Ability to Integrate between Multiple Systems.

9 Business Requirement Specification Vendor Importance / Priority S. No. Description Response Comments 1 Access / upload / add / update various regulatory / custom generated blacklists, watch lists Example and sanctionof lists BRS (World Check, OFAC, United Nations Security Council resolutions, regulators lists and other regional lists (UK, EU etc.), sanction lists of individuals and entities. Required 2 All the lists should be accessible from within the solution and eliminate the need to navigate away from the AML system. Required 3 Access lists from source files in different formats (e.g. csv, txt, xls, xml etc). Required 4 Capability for compliance staff to define its own black and white lists. Such lists will override any conflicts with other lists. The user should be able to create the lists manually through an interface or can upload them to the AML system. Required 5 Screen the names of authorized signatory, guardians of minors and partners, in addition to customer names and names of companies. Required 6 Screen not only the new customers that would be on boarded but also names of existing customers / authorized signatory / guardians of minors / partners on a periodical basis and pre defined events (e.g. lists getting updated). Required 7 There should be a functionality to search for names in the lists manually. Required

10 How the customer explained it How the project leader understood it How the analyst designed it How programmer wrote it How business consultant described it How the project was documented How operations installed it How customer was billed How it was supported What customer really needed

11 Thank You