How an International Organization Deals with Assessing Risk for both Its National and Global Operations with Reference to Compliance and AML/CTF

Transcription

1 How an International Organization Deals with Assessing Risk for both Its National and Global Operations with Reference to Compliance and AML/CTF Presented To: AUSTRAC AML/CTF Conference 2009 Date: 2 April 2009 Michael Matossian EVP and Global Head of Group Regulatory Compliance It s not success at all costs, it s success only the right way.

2 Arab Bank Profile Established in Jerusalem in 1930 Head Quartered in Amman since 1948 Operates in 30 countries and five continents, including a global network of more than 500 branches and offices Provides personal banking, corporate and investment banking, private banking and Treasury Arab Bank Group achieved a pre tax profit of $1.06 billion for 2008, with total assets of $45.6 billion, and shareholders equity of $7.5 billion at the end of the year Arab Bank Group Proprietary 2

3 Presentation Overview Regulatory Areas of Focus MENA Compliance Framework Compliance A Business Positive Defining & Understanding Compliance Risk Elements of an Effective Compliance Program Challenges Arab Bank Group Proprietary 3

4 MENA Developments US MENA Private Sector Dialogue launched Hawkamah launched Institute for Corporate Governance MENA FATF formed 17 MENA countries now members UN Convention Against Corruption Treaty Ratified 12 MENA countries now members Today all MENA countries (19) have criminalized money laundering 13 criminalized financing of terrorism 15 have established Financial Intelligence Units Arab Bank Group Proprietary 4

5 Compliance: A Global Initiative In an era of globalization, compliance requires a multilateral, collaborative effort to reach mutual objectives. Purpose Regulatory Agencies Economic Development & Growth Financial Stability & Transparency Consumer Protection Financial Institutions Enhanced Customer Service Arab Bank Group Proprietary 5

6 Regulatory Areas of Focus Prevention Create robust accountability mechanism, rules, and internal and external audit system Reengineer business processes within the public and private sectors to reduce opportunities for corruption Enhance supervisory capacity Prosecution Update legal framework Create a dedicated anti corruption agency, appropriate financial intelligence unit, etc. Pass legislation Enhance oversight & enforcement Public Awareness Promote transparency and awareness Arab Bank Group Proprietary 6

7 Corporate Governance... within the global economy, the private sector will invest and thrive only where the demands for accountable and transparent institutions are met. World Bank, MENA Economic Developments and Prospects 2008 Arab Bank Group Proprietary 7

8 Current Reality MENA Governance Indicators Source: Hawkamah Corporate Governance Survey of Listed Companies & Banks Across MENA, 2008 IFC Arab Bank Group Proprietary 8

9 MENA Governance Indicators Rule of Law The extent to which agents have confidence in and abide by the rules of society Country Regulatory Quality The ability of the government to provide policies and regulations that promote private sector development Percentile Rank Governance Score Country Percentile Rank Governance Score (0-100) (-2.5 to +2.5) (0-100) (-2.5 to +2.5) Qatar Bahrain Oman UAE Kuwait Oman UAE Qatar Bahrain Jordan Jordan Kuwait Tunisia Tunisia Saudi Arabia Saudi Arabia Egypt Morocco Morocco Lebanon Syria Egypt Libya Algeria Lebanon Yemen Algeria Libya West Bank/Gaza Syria Iran Iraq Yemen West Bank/Gaza Iraq Iran Source: Governance Matters 2008: Worldwide Governance Indicators, World Bank Arab Bank Group Proprietary 9

10 Anti-Corruption Corruption is a cancer that steals from the poor, eats away at governance and moral fibre, and destroys trust. Robert B. Zoellick, President, World Bank Arab Bank Group Proprietary 10

11 Corruption Perceptions Index Arab Bank Group Proprietary 11

12 Control of Corruption (2007) World Governance Indicators 90 TH 100 TH percentile 75 TH 90 TH percentile 50 th 75 th percentile 25 th 50 th percentile 10 th 25 th percentile 0 10 th percentile Source: World Bank Kaufmann D., A. Kraay, and M. Mastruzzi 2008: Governance Matters VII: Governance Indicators for Arab Bank Group Proprietary 12

13 Control of Corruption 2007 MENA Region Qatar United Arab Emirates Oman Bahrain Kuwait Jordan Tunisia Saudi Arabia Morocco Algeria Djibouti Iran Egypt Yemen Lebanon Libya Syria Iraq 90 TH 100 TH percentile 75 TH 90 TH percentile 50 th 75 th percentile 25 th 50 th percentile 10 th 25 th percentile 0 10 th percentile Arab Bank Group Proprietary 13

14 OECD Foreign Bribery Investigations Shown: Transparency International Progress Reports Enforcement of the OECD Convention on Combating Bribery of Foreign Public Officials Arab Bank Group Proprietary 14

15 AML/CTF Today money laundering and terrorist financing is the biggest danger facing the world threatening to damage global peace, harmony, and stability. Stuart Levey, US Under Secretary for Terrorism and Financial Intelligence Arab Bank Group Proprietary 15

16 AML/CFT Compliance: Compliance with AML/CFT Standards Most countries fall short of the AML/CFT standard (40+9 Recommendations) Source: World Bank/International Monetary Fund (2005) Arab Bank Group Proprietary 16

17 AML/CFT Compliance: Compliance with AML/CFT CTF Standards Standards Compliance with the 9 Recommendations against the financing of terrorism Source: World Bank/International Monetary Fund (2005) Arab Bank Group Proprietary 17

18 Compliance Framework Board Oversight Infrastructure Effectiveness Reporting & Communications Monitoring Program Policies & Procedures Culture Of Ethics Management Commitment Identify & Prioritize Risk Compliance Self Assessment Regulatory Examinations Key Risk Indicators Risk Appetite Stop Light & Country Compliance Reports Internal Audit Findings Leadership Strategy & Oversight

19 Compliance A Business Positive An effective compliance program can help reduce or prevent altogether the costs of fines, penalties, and critical reputation risk. An effective compliance program also has positive business benefits: A strong compliance program speaks to organizational integrity, a building block of ethical corporate culture An ethical corporate culture helps build a strong reputation within our customers, shareholders, employees, and communities Arab Bank Group Proprietary 19

20 Defining Risk Risk The potential that events, expected or unanticipated, may have an adverse impact on the bank s reputation or financial condition. Risk Management The employment of systems, people, and processes to manage the critical tradeoff between risk and return, ensuring that the risk taken is the risk intended. Risk is more than something that just happens It is about choices and decisions made throughout the organization and can be better managed by making informed decisions. Arab Bank Group Proprietary 20

21 Understanding Risk I have never been in an accident of any sort that is worth speaking about. I never saw a wreck, nor was I ever in any predicament that threatened to end in disaster of any sort. Captain Edward J. Smith, RMS TITANIC (New York Press, 1907) We need to understand the compliance risk we face; we should not deny the fact that it could happen to us. We should always be thinking What if Arab Bank Group Proprietary 21

22 Compliance Principles Success occurs when opportunity meets preparation. Do the right thing and do it well. Do the new right thing, but expect to make some mistakes. Continuously assess risk & enhance process efficiencies Change Discover the right thing is now the wrong thing. Develop strategy and action plan. Drivers of Change New and revised regulatory requirement & international standards World events Globalization Communicate and execute plan. Increased risk of litigation Corporate social responsibility Arab Bank Group Proprietary 22

23 Compliance DNA Keys to Success Strategy Culture Skills Recognize need for change Sense of urgency People Shared Values Systems & Technology Believe in the new right thing Commit to the new plan Governance Structure Arab Bank Group Proprietary 23

24 Compliance Continuum Institution s actions should be based on its values and should evolve to include the need to do the right thing, applying not only the letter, but also the spirit of regulations. Customer Focused Compliance Culture Minimum Standards Non Compliance Compliance Continuum Arab Bank Group Proprietary 24

25 Compliance Governance CEO/Chairman Global Head of Group Regulatory Compliance Board of Directors Risk & Compliance Committee of the Board Enterprise Programs & AML Office Oversee enterprise compliance management Manage Group AML and CTF initiatives, including policy setting, sanctions, investigations, reporting, analysis Group Regulatory Compliance Management Country & Line of Business Compliance Identify and prioritize risk Establish and drive Country and LOB compliance programs Ensure formal policies/procedures Conduct compliance monitoring Risk Evaluation & Assurance (REA)/ Project Support Provide independent evaluation of compliance process and procedure effectiveness Perform targeted reviews and other special projects Communications, Reporting, Education, & Standards Develop corporate Communications Prepare Board & management reporting Identify training opportunities and customize training Interpret regulatory requirements Arab Bank Group Proprietary 25

26 Eight Elements of an Effective Compliance Program # Element I. Management Commitment & Oversight II. Culture of Ethics & Compliance Accountability III. Policies & Procedures IV. Training Programs & Professional Competency V. Identify & Prioritize Compliance Risk VI. Monitoring & Tracking Compliance Issues VII. Reporting & Communication VIII. Infrastructure Effectiveness Rating Compliance and Effectiveness Fully Compliant (FC) Compliant (C) Needs Improvement (NI) Level of Compliance Fully Compliant Management is committed and is employing industry leading practices to proactively identify FC and mitigate risk. Compliance management processes can be characterized as effective, formal and wellsupported, thereby minimizing the likelihood of material loss or adverse publicity due to risk exposure C Compliant Management oversight and bank systems are deemed responsive and capable of identifying and correcting errors on a timely basis. Practices meet or exceed the minimum required to ensure effective compliance management, thereby reducing the exposure to material loss or adverse publicity. Certain process enhancements should improve the effectiveness of compliance management Needs Improvement Opportunities exist to strengthen compliance program. If not corrected, these gaps could NI impair the effectiveness of compliance management, thereby heightening the exposure to material loss or adverse publicity. Arab Bank Group Proprietary 26 Notes

27 Assessing a Compliance Program I. Management Commitment & Oversight Risk Component Weight Risk Rating Calculation 1. Area Management meets on a regular basis and is accessible for ad hoc meetings with Country Compliance Manager; Area Management is directly involved in the discussion and review of compliance issues. 2. Compliance is engaged in and consulted in advance of making significant business decisions/ transactions with compliance implications. 3. Compliance is provided with comprehensive and adequate resources (e.g. staff, budget, systems, etc.) 4. Compliance has unrestricted access to information, systems, and people as it relates to compliance risk identification, monitoring, and reporting. 5. The compliance governance structure ensures the Country Compliance Manager is empowered to conduct responsibilities per Bank policy, standards, requirements, and operating procedures. Risk Assessment Score Arab Bank Group Proprietary 27

28 Assessing a Compliance Program II. Culture of Ethics & Compliance Accountability Risk Component Weight Risk Rating Calculation 1. The Code of Conduct is provided to and signed by new Bank staff as part of the hiring process. 2. The Code of Conduct is acknowledged by all Bank staff on an annual basis. 3. Violations of the Code of Conduct, as well as noncompliance with Bank policies and procedures, are reported, documented, and tracked. 4. There are direct consequences, documented and enforced, for violations and noncompliance. 5. Accountability for compliance performance is specifically defined and included in job descriptions. 6. Accountability for compliance performance is specifically included as part of personnel evaluations/appraisals. Risk Assessment Score Arab Bank Group Proprietary 28

29 Assessing a Compliance Program III. Policies & Procedures Risk Component Weight Risk Rating Calculation 1. Current products/services/processes are documented in the form of policies and procedures; policies are standardized across the business areas. 2. Policies and procedures reflect the necessary legal/regulatory requirements that pertain to the business area. 3. Policies and procedures follow the appropriate approval process and are reviewed on an annual basis. 4. Policies and procedures are communicated and understood by the staff (policies and procedures are clear and detailed), as appropriate. Risk Assessment Score Arab Bank Group Proprietary 29

30 Assessing a Compliance Program IV. Training Programs & Professional Competency Risk Component Weight Risk Rating Calculation 1. Training programs are well developed, address the compliance risk issues for the business, have formalized training plans, and are approved by appropriate parties. 2. Relevant Bank staff received compliance training, as appropriate; training attendance is monitored, tracked, and reported. 3. Bank staff have received AML training at least once within the last two years; training attendance is monitored, tracked, and reported. 4. Compliance staff demonstrate investment in their continued compliance education and certification programs (e.g. CAMS and IFQ) to ensure their knowledge of compliance is current and that they are aware of regulatory developments, industry trending, and leading compliance practices. 5. Compliance staff demonstrate investment in their continued competencies/skills (non compliance) to ensure quality (e.g. computer skills, interpersonal skills, etc.) Risk Assessment Score Arab Bank Group Proprietary 30

31 Assessing a Compliance Program V. Identify & Prioritize Compliance Risk Risk Component Weight Risk Rating Calculation 1. Country Compliance Manager maintains a current understanding of country risk profile, inclusive of existing products/services, distribution channels, customer types and segmentation, transaction types, and geographies. 2. New and revised regulatory developments, inclusive of compliance related laws, rules, regulations, and instructions are closely monitored and the Regulatory Inventory is updated accordingly. 3. Identification and implementation of process changes, new products and services, and organizational or management changes are timely and effective. 4. Documentation of compliance risks is exceptional (e.g. timeliness and completeness of the Risk Control Matricies per line of business). 5. Compliance activies are proactive (e.g. leading KRIs). 6. Compliance risks are prioritized according to risk exposure/impact. Risk Assessment Score Arab Bank Group Proprietary 31

32 Assessing a Compliance Program Regulations Inventory Arab Bank Group Proprietary 32

33 Assessing a Compliance Program Risk Control Matrix Arab Bank Group Proprietary 33

34 Assessing a Compliance Program VI. Monitoring & Tracking Compliance Issues Risk Component Weight Risk Rating Calculation 1. Monitoring programs are developed to effectively detect violations, noncompliance, or weak control systems (e.g. completeness of Compliance Monitoring Programs per line of business). 2. Compliance monitoring is performed according to the Compliance Monitoring Programs and results are prioritized and addressed as appropriate. 3. Compliance Monitoring Programs per line of business are annually updated. 4. System controls are effectively utilized to allow potential violations and noncompliance to be detected before actually occurring as well as after a violation occurs. 5. AML alerts are managed and investigated in a timely and thorough manner; Suspicious Activity Reports (SARs) are filed with authorities as appropriate. 6. Corrective actions required as a result of monitoring, complaints, Internal Audit, Risk Evaluation and Assurance, and regulatory reports are timely and effective in reducing the potential exposure. Risk Assessment Score Arab Bank Group Proprietary 34

35 Assessing a Compliance Program Compliance Monitoring Program Arab Bank Group Proprietary 35

36 Assessing a Compliance Program VII. Reporting & Communication Risk Component Weight Risk Rating Calculation 1. The status of compliance issues is communicated to appropriate levels of branch (non customer outlet)/entity management as well as the Country Management Committee through accurate and timely formal status reports/scorecards/matrices. (e.g. Stop Light Report, Compliance Self Assessment, Regulatory Compliance Report, KPIs). 2. The status of compliance issues is communicated to appropriate parties through accurate and timely formal status reports/scorecards/matrices. (e.g. Stop Light Report, Compliance Self Assessment, Regulatory Compliance Report, KPIs, and Audit/Exam notification per Bank Operating Procedures). 3. Compliance related regulatory communications are received by, logged, and tracked; action is taken and responses provided in a timely manner, where required. 4. Awareness of compliance issues and requirements is achieved through periodic communications (e.g. newsletters, internal memos, presentations, etc.) to appropriate employees and management. 5. Compliance staff have developed solid relationships with internal and external business partners and serve as industry leaders in trade associations, committees, etc. 6. Strong relationship and open channels of communication exist related to compliance with regulatory agency contacts (e.g. Central Bank and FIU). Risk Assessment Score Arab Bank Group Proprietary 36

37 Assessing a Compliance Program Stoplight Report Compliance Initiatives Country/LOB Responsible Party Risk Enhancement Opportunities/ Action Plans New Target Date Updated Closed Low Identified items are being adequately addressed and managed. Moderate Potential impact to reputation if enhancement opportunities identified are not addressed in a timely manner. High High potential for reputation risk if challenges and priorities identified are not addressed in a timely manner. Arab Bank Group Proprietary 37

38 Assessing a Compliance Program VIII Infrastructure Effectiveness. Risk Component Weight Risk Rating Calculation 1. Stop Light report enhancement opportunities are adequately addressed and closed in a timely manner. 2. Compliance Monitoring Program results indicate that compliance management systems and information processes are strong. 3. Regulatory report, external audit, internal audit, and compliance review items relating to violations, noncompliance, as well as weaknesses are few and are deemed relatively insignificant. 4. There are no recent losses or negative publicity associated with compliance issues, including regulatory penalties imposed. 5. Customer complaints are infrequent and deemed insignificant. Risk Assessment Score Arab Bank Group Proprietary 38

39 Compliance Challenges - MENA Cash based economies and diverse payment systems Political instability in parts of the region Close knit society susceptible to unfair use of connections (wasta) and facilitation payments (bakshish) Disparate buy in and leadership commitment Costs of implementing compliance infrastructure are high (e.g. people, technology, and processes) Operational challenges, e.g. converting foreign names to English and use of multiple types of identification documents Absence of established credit rating agencies Arab Bank Group Proprietary 39

40 Compliance Challenges - MENA Inconsistent regulations and supervisory practices across jurisdictions Ineffective or overly detailed regulations where costs and burdens outweigh benefits and hinder ability to revive customers Rules are not applied equally to regulated and unregulated companies offering comparable products and services Weak law enforcement and prosecution Barriers to international cooperation Broad low quality of governance and transparency Culture of secrecy in financial institutions and government Lack of information sharing between institutions and between institutions and governments Limited awareness of compliance risks by public and private sectors Arab Bank Group Proprietary 40

41 Continued Global Cooperation It is no longer feasible to achieve change through national approaches applied only to the home institution of the home country. Effective solutions to many of the concerns we face in our national financial systems will require multilateral approaches. Timothy F. Geithner, US Treasury Secretary Arab Bank Group Proprietary 41

42 Thank You Michael Matossian EVP & Global Head of Group Regulatory Compliance Arab Bank Group Head Office, P.O. Box , Amman 11195, Jordan Tel.: , Ext. 5822