IT'S HERE - NOW WHAT? - The Anti-Money Laundering Act of 2020: riskCanvas
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
WHITE PAPER The Anti-Money Laundering Act of 2020: IT’S HERE - NOW WHAT? The most significant financial crime regulation passed in two decades increases the expectation of AML and CFT efforts for U.S. Institutions. This whitepaper provides a summary of the regulation and actionable insights.
2 The AMLA of 2020 Table of Contents 01 Preface 02 Summary of The AMLA of 2020 03 The AMLA 2020 Will Drive Change for FIs 04 The Specifics of AMLA 2020 05 What Financial Institutions Can Do Now 06 Conclusion 07 Note on New Beneficial Ownership Requirements
White Paper 3 Preface 1 The Anti-Money Laundering Act of 2020 The US will set AML/CFT national is the most significant addition to financial priorities. These national priorities crime regulation since the USA PATRI- will sharpen regulatory and law OT Act passed nearly 20 years ago. The enforcement focus. Financial new law requires the US government to set national Anti-Money Laundering and institutions must align their programs Counter Terror Financing priorities to ex- with these priorities as part of a risk- pand FinCEN’s power, directs regulator based program to combat money and law enforcement agencies to better laundering and the financing of coordinate, and increases Congressional terrorism. 2 oversight of the Department of Justice The AMLA 2020 increases FinCEN’s and Treasury, including FinCEN. power. FinCEN’s responsibility in both When Congress grants regulators and regulatory examinations and law law enforcement more authority to fight enforcement investigations increases financial crime and explicitly directs them substantially, as does Congress ’s to do more with that power, institutions oversight of FinCEN. This new power and those that lead Anti-Money Launder- and Congressional oversight means ing and Counter Terror Financing (AML/ a greater US government emphasis CFT) programs must take notice. The An- on AML/CFT regulation and ti-Money Laundering Act 2020 (AMLA enforcement. Financial institutions 2020) creates new compliance require- must prepare for more rigorous ments and increases expectations that AML/CFT examinations, particularly financial institutions improve their AML/ around suspicious activity detection, CFT programs.[1] investigation, and reporting AML officers must assess the AMLA’s processes. impact on their existing compliance pro- 3 grams. In particular, AML officers should The AMLA 2020 mandates regulators evaluate whether their current program remove barriers and encourage will withstand inevitable heightened reg- financial institutions to modernize ulatory and enforcement scrutiny. A few of AML/CFT software systems. The law the new AMLA 2020 requirements of in- requires regulators to specify how terest to AML/CFT officers include: banks should upgrade technology. Financial institutions will feel pressure to modernize AML/CFT technology systems which in many cases, have not be updated in more than a decade. [1] “Regulators” refers collectively to the Federal functional regulators defined by Gramm-Leach-Biley Act to include the Federal Reserve, the Office of Comptroller of the Currency, the Federal Deposit Insurance Company, the National Credit Union Association Board, and the Securities and Exchange Commission. It also refers to relevant State regulators. “Law enforcement” refers to Federal law enforcement agencies.
4 The AMLA of 2020 Summary of The AMLA of 2020 The purposes of the AMLA 2020, which became law on January 1, 2021, are: 1. To improve coordination and information sharing among regulatory, law enforcement, national security agencies, intelligence agencies, and financial institutions. 2. To modernize AML/CFT laws to adapt to the government and private sector to new and emerging threats. 3. To encourage AML/CFT technological innovation by financial institutions. 4. To emphasize the financial institution’s AML/CFT policy, procedures, and controls should be risked-based. 5. To establish uniform beneficial ownership reporting requirements. It appears the purpose of the AMLA 2020 is to strengthen the “whole of government” approach to AML/CFT efforts. Prior AML/CFT laws, like the USA PATRIOT Act, emphasized financial institutions be required to create and maintain specific programs like Customer Identification Programs and SAR reporting. The AMLA 2020 focuses less on new requirements for financial institutions and much more on new responsibilities and requirements on FinCEN, DOJ, and regulators. In particular, FinCEN’s role expands to become the national coordinator of AML/CFT efforts among law enforcement, regulators, national security and intelligence agencies, and the private sector. With the new power, FinCEN will be subject to more Congressional oversight. The new emphasis on government coordination does not diminish the fact that financial institutions will need to update old AML/CFT practices and implement new ones. After all, financial institutions are a crucial part of the nation’s efforts to detect and prevent crime, and it is clear that the AMLA 2020 heightens the importance of AML/CFT program compliance.
White Paper 5 The AMLA 2020 Will Drive Change for FIs The AMLA 2020 mandates FinCEN, law capable of identifying, tracking and tracing enforcement, and regulators to strengthen money laundering and terrorist-financing the US AML/CFT regime. As Congress seeks networks in order to conduct and support to determine the AMLA’s effectiveness, it criminal AML and CFT investigation(.)” In will press regulators and law enforcement order to the Analytical Hub to be effective, to ensure financial institutions improve their FinCEN must rely on the quality of data it AML/CFT programs. As a result, FinCEN and receives, in this case SARs, CTRs, and other the regulators will require financial institutions BSA reports. Increased emphasis will be to strengthen their AML/CFT programs. placed upon whether SARs and CTRs are filed on time, are complete and are accurate. New requirements placed on FinCEN and Financial institutions should be aware that regulators inevitably cascade onto financial as regulators intensify examinations, what institutions. To illustrate this point, take the was considered adequate for AML/CFT AMLA 2020 mandate that FinCEN create a compliance over the past few years may no new “Analytical Hub” with “financial experts longer be so.
6 The AMLA of 2020 The Specifics of AMLA 2020 National AML/CFT Priorities The AMLA 2020 does not change the regulator’s role in conducting AML/CFT Will Focus the Government’s examinations. However, the AMLA 2020 Attention requires examiners from each agency to receive annual training. The training must By July 1, 2021, the Secretary of the Treasury,include financial crime patterns and trends, consulting law enforcement, national security why law enforcement sees AML/CFT agencies, intelligence agencies, and state programs as critical to its missions, and the and federal regulators must publicize national effects of de-risking. This annual training AML/CMT priorities. These priorities must serves to focus the examiner’s attention on be consistent with the National Strategy for the national AML/CFT priorities. Combating Terrorist and Other Illicit Finance, last published in February 2020. The Secretary An often-heard complaint among AML/CFT must update the national AML/CFT priorities officers is that regulatory examinations are at least every four years. not aligned with the BSA’s purpose and intent, because examiners sometimes focus on literal Strengthening FinCEN and compliance versus effective compliance. It Congressional Oversight would seem lawmakers are aware of this complaint. By requiring annual training, Increases Expectations on ensuring examiners focus on the issues Financial Institutions FinCEN considers most important, financial institutions should see more predictable and The AMLA 2020 directs FinCEN to increase its consistent examinations in 2021 and beyond. domestic and foreign staff, work closely with federal and state regulators, and develop and The AMLA 2020 clarifies that Congress now provide expert support to law enforcement will exercise more oversight of FinCEN than and national security agencies. Notably, the it has in the past. With FinCEN’s increased AMLA 2020 requires FinCEN now regularly budget and responsibility comes increased report its activities to Congress, exposing the accountability. bureau to more scrutiny.
White Paper 7 Patrick McHenry is the top Republican on understand the need for this legislation. the House Financial Services Committee, No such data was forthcoming. Rather, the Committee responsible for the FinCEN gave anecdotes of very scary House’s contributions to the AMLA 2020. stories to justify the need for a new Congressman McHenry’s December 8, reporting regime. It is my expectation 2020 remarks to the House clarify an that FinCEN will provide Congress with influential Member’s view of FinCEN. Part of the necessary data to justify this new McHenry’s statement includes the following: reporting regime and the burdens it is placing on legitimate companies.” “For far too long FinCEN has evaded any type of congressional check on its AML officers, their teams, and financial activities. Yet, it has amassed a great deal service institution executives should of authority. Now, Congress will shine a read McHenry’s words closely. Congress light on its operations. It is my expectation expects FinCEN to move past “anecdotes that FinCEN will provide Congress with of very scary stories” and now provide hard data on its effectiveness in targeting “hard data on its effectiveness…”. An active bad actors(.)” Congress impacts AML/CFT compliance. Congressional investigations of Riggs Bank McHenry goes on to say; and HSBC ushered in periods of intense and punitive regulatory enforcement. To “In the months leading up to the House’s avoid future Congressional heat, regulators consideration of H.R. 2513 last October, and law enforcement must show Congress I sought data from FinCEN and from that they are vigorously examining financial the Treasury Department, along with institutions’ compliance with the AMLA the Department of Justice, to better 2020. Congress expects FinCEN to move past ‘anecdotes of very scary stories’ and now provide ‘hard data’ on its effectiveness…
8 The AMLA of 2020 Specifics Continued AML/CFT Data Analysis Congress has reacted to banks’ legitimate complaints that regulators have focused on Required and Data Sharing SAR quantity rather than quality, and FinCEN does not provide enough feedback on SARs For years, AML professionals have wondered filed by banks. As a result, the AMLA 2020 if all the SARs and CTRs filed are useful to instructs FinCEN to publish twice a year law enforcement. It seems Congressman the “Sharing of Threat Pattern and Trend McHenry has the same question. The AMLA Information” report. FinCEN will share with 2020 requires this question be answered financial institutions and regulators financial every year. By December 31, 2021, and every crime typologies as well as data about year onward, the Attorney General working typologies that can be used to improve with Federal law enforcement and intelligence transaction monitoring algorithms. agencies, and the regulators must submit to the Treasury Department (FinCEN) a, “report In addition to this twice a year report, the AMLA that contains statistics, metrics, and other 2020 establishes a “FinCEN Exchange,” a information on the use of the data derived public – private information sharing partnership from financial institutions reporting under the between law enforcement, regulators, and Bank Secrecy Act.” financial institutions. The report is required to publish whether the BSA data (SARs, CTRs for example) includes AML/CFT Modernization “actionable information” that leads to law Means AML/CFT Programs enforcement action such as subpoenas, Must Modernize warrants, or arrests.” The annual report must also state how quickly the SARs and CTRs led to It’s been nearly two decades since the USA law enforcement action, whether subsequent PATRIOT Act became law. To comply with investigation subjects were individuals or requirements to identify customers, monitor businesses, how often investigations involve transactions, and report suspicious activity, cross border transactions, and maybe most financial institutions spent heavily on software. importantly, how often BSA information Unfortunately, transaction monitoring provided by financial institutions leads to software generates unmanageable numbers arrests, convictions, forfeitures, or actions by of low value or false positive alerts, burdening national security or intelligence agencies. In investigators and jeopardizing compliance. other words, Congress wants to see evidence While the exact cost of outdated AML/CFT the BSA is working. software is probably incalculable, no one disagrees that hundreds of millions of dollars a
White Paper 9 year is spent on AML/CFT work that produces CFT technology. The standards “may include little value. an emphasis on using innovative approaches such as machine learning or other enhanced Despite this massive cost, financial data analytics processes.” The new standards institutions are slow to scrap old systems. may also include specific criteria for how Because replacing systems is costly and risky, institutions conduct risk-based comparison many banks decide that keeping existing testing of new technology against existing applications is better than purchasing new systems. This allows new technology to be software. validated as effective before and after new software is implemented, bringing clarity to Realizing this, the AMLA 2020 incentivizes a vexing problem – how to transition from government agencies and financial institutions old monitoring systems to new monitoring to modernize AML/CFT technology and systems without running afoul of regulators. promotes using machine learning and artificial With clear standards on replacing outdated intelligence to do so. systems, financial institutions are more likely to act, accelerating much-needed financial The Bank Secrecy Act Advisory Group or crime compliance technology change. “BSAAG” was formed by The Annunzio- Wylie Anti-Money Laundering Act of 1992. To emphasize the significance of these new The BSAAG is a group of government and technological testing standards, the AMLA industry executives whose purpose is to 2020 directs that the FFIEC BSA/AML advise the Secretary of Treasury on AML/ Examination Manual be updated to include CFT issues. The AMLA 2020 creates a new them. By creating and documenting new BSAAG “Subcommittee on Innovation and uniform technology testing requirements, Technology” whose mission is to advise financial institutions now have a published, Treasury on how Federal regulators “can consistent process to follow when most effectively encourage and support implementing new software. technological innovation” in AML/CFT programs. In addition, the Subcommittee is In addition to promoting technological to “reduce…obstacles to innovation that may innovation as a means to modernize, the arise from existing regulations, guidance, and AMLA 2020 codifies into law its October examination practices…” 3, 2018, Interagency Statement of Sharing Bank Secrecy Act Resources [INSERT LINK]. With the AMLA 2020 now specifically directing In that statement, Federal regulators permit regulatory agencies to “reduce examination institutions to enter into agreements to “pool and guidance obstacles” to technological human, technology, or other resources to innovation, the time for meaningful AML/CFT reduce costs, increase operational efficiencies, software modernization is here. and leverage specialized expertise.” Perhaps the AMLA 2020 will spur smaller institutions Perhaps most significantly, the AMLA 2020 to form AML/CFT consortiums where they directs Treasury to specify standards financial can combine staff and technology systems to institutions will follow to implement new AML/ improve compliance and manage costs.
10 The AMLA of 2020 What Financial Institutions Can Do Now The AMLA 2020 significantly changes many aspects of AML/CFT compliance. FinCEN’s new responsibilities will lead to increasing attention on financial institution AML/CFT programs. The push to modernize technology will accelerate much-needed software changes, and greater coordination between regulators and law enforcement are all reasons financial institutions need to look closely at their 2021 – 2022 AML/CFT plans. In particular, in response to the AMLA 2020, the following AML/CFT program areas should be assessed: 1 2 3 4 Updating Risk Assessments Updating Customer Risk Updating AML/CMT Assessing AML/CFT to incorporate national AML/ Rating and De-Risking technology systems detection, staffing needs CMT priorities Processes investigation, and reporting Update Enterprise AML/CFT Risk Assessment to Include National Priorities By July 1, 2021, The Secretary of Treasury the US government may prioritize, AML must publish the US national AML/CFT officers should read the 2020 National priorities. Once published, the national Strategy for Combating Terrorist and Other priorities will drive the US regulatory and Illicit Financing, whose primary author is the enforcement agenda. As a result, regulators US Department of Treasury. Assessing the will examine how financial institutions adapt AML/CFT risks Treasury called out in 2020 is their AML/CFT programs to align with the US an excellent place to understand Treasury’s national priorities, starting with examining financial crime-fighting priorities. The risks how each institution updates its AML/CFT Treasury identified in 2020 include narcotics Risk Assessment. It will be expected that trafficking, terrorist financing, weapons of every financial institution’s AML/CFT Risk mass destruction proliferation, organized Assessment includes assessing whether crime, human trafficking, corruption, the national priorities present a risk to your beneficial ownership identification, real financial institution and, if so, what is that estate purchases and sales, correspondent risk, how is that risk identified, mitigated, banking, cash and trade-based money managed, and tracked. Without this new laundering, digital currencies, complicit work, the AML/CFT risk assessment will be actors within financial institutions, insufficient. gatekeeps like attorneys, money service businesses, securities broker-dealers, and The 2021 national AML/CFT priorities will casinos. It makes sense to see these risks not be published for six months. However, are addressed in your most recent AML/CFT in anticipation of understanding which risks Risk Assessment.
White Paper 11 After decades, AML laws have been updated and national security and law enforcement officials are combatting emerging threats by working on updating obsolete tools to prevent kleptocrats and criminals’ from sophisticated strategies. Ian Gary, executive director of the FACT Coalition Update Customer Risk Rating and De-Risking Processes With national AML/CFT priorities established The AMLA 2020 includes a “sense of by July 1, 2021, AML programs will be Congress” section in which lawmakers expected to review and update Customer acknowledge the unintended consequence Risk Rating (CRR) policies and procedures. of de-risking embassies, charities, MSBs, Treasury’s published national AML/CFT and foreign correspondent accounts. The priorities will identify specific types of legislation states that because many of these customers, products, services, and locations “underserved individuals” and organizations it considers high risk. Financial institutions are excluded from the banking system, their must determine if their current High-Risk need to send and receive funds is driven into Customer identification, enhanced due less transparent markets. In other words, diligence, and on-going monitoring policies, it is possible de-risking ends up increasing procedures, and processes include all those money laundering and terrorist financing Treasury calls out. If not, then updating risk. Customer Risk Rating and Enhanced Due Diligence policies and procedures are The Government Accounting Office (GAO) required. is directed to deliver a De-Risking Analysis report to Congress by December 31, 2021. The AMLA 2020 addresses an issue that Once this report is published, the AMLA 2020 has challenged AML/CFT departments instructs the federal functional regulators since 2004 when specific categories of to spend 2022 updating examination customers became “too high risk.” In 2004, standards and regulatory guidance to these “too high-risk customers” included “consider the adverse consequences of de- foreign embassy, Money Service Business risking entire categories” of customers. The (MSB), and charity accounts. Since 2004, law explicitly cites charities, embassies, and other customers, including many foreign money service businesses as account types correspondent banking accounts, are also regulators must considering in drafting new considered especially high risk. As a result, de-risking (or “non-de-risking”) rules. many institutions have policies that prohibit the banking of these types of customers, a At this point, financial institutions should process known as “de-risking.” continue to refine their de-risking policies while paying attention to forthcoming government guidance.
12 The AMLA of 2020 Upgrade Software and Incorporate New Technology Approaches The best way to strengthen AML/CFT In 2021 AML/CFT officers need compliance is to measure how useful to look more seriously at new law enforcement finds SARs. The detection and reporting software AMLA 2020 requires DOJ to report to as well as incorporating modern Congress every year “the frequency computer science approaches with which the reported data (SARs like machine learning. For some and CTRs) contain actionable institutions, this may mean installing information that leads to” law new transaction monitoring and enforcement investigations, arrests, case management applications. national intelligence action, and other For many other institutions, it may national security or legal process. As mean looking closely at software a result, financial institutions should hosted in the cloud, also known as expect more regulatory scrutiny of Software as a Service, or SaaS, where their suspicious activity detection implementation time, expenses, and and reporting programs. on-going maintenance costs are reduced. Financial institutions must demonstrate they have effective Regardless of whether institutions software systems, people, and install or subscribe to new software processes to file timely, accurate, systems, all AML/CFT officers should and complete SARs. Lacking this consider how modern approaches will capability means inevitable AML/ strengthen compliance. In addition to CFT program failure, as it always has. machine learning, AML/CFT officers should consider improvements Congress is telling FinCEN to Robotic Process Automation (RPA) modernize its operations, and the and data analytics brings to everyday AMLA 2020 is pushing industry to AML/CFT work. RPA can automate do the same. As a result, financial much of the time-consuming data institutions must consider that using gathering investigators endure. software installed 10 or 15 years ago Better data analysis can reveal that buries analysts and investigators inefficient processes, measure under piles of false-positive alerts, individual investigator performance, distracting them from work that and identify transactions and matters, is no longer acceptable. customer behavior that can improve detection scenarios.
White Paper 13 Assess Staffing Needs Modernizing AML/CFT should also prompt assessing long-standing compliance staffing approaches. For 20 years, the response to new AML/CFT requirements was to add more people, which as a practice is unsustainable. Much of the work that drives hiring additional people stems from outdated software that generates too many alerts. As better software proliferates, AML leaders must assess current approaches to staffing. Modern software changes how AML/ CFT teams collect and access data. Better software produces better alerts, which in turn produces more useful investigations and better SARs. However, because of the massive volume of financial transactions worldwide, and the fact that money laundering and terror financing often look like legitimate economic activity, even better software will continue to produce alerts that do not end up as SARs. 2021 is time for AML/CFT leaders to think about alternatives to hiring and maintaining large staffs dedicated to high volume repetitive work. Over the past several years, institutions began to outsource high volume, simpler, repetitive work. It is time to assess an AML/CFT department’s makeup and determine which tasks require more experience, more specific knowledge, and are of higher value. Perhaps these jobs remain in-house, and the more straightforward, repetitive work is outsourced or, as the AMLA 2020 codifies into law, shared with other financial institutions.
14 The AMLA of 2020 Conclusion Writing the numerous regulations that implement the directives of new laws takes time. It also takes time for regulators to incorporate the new regulations into their examinations. Using the USA PATRIOT Act passed in late 2001 as an example, it took about a year before the first signs of intensified regulatory examinations uncovered glaring weaknesses in AML/CFT programs. Of course, in 2021, AML/CFT programs are more sophisticated and seasoned than 20 years ago. However, the US government and most other governments around the world have massively grown their regulatory and enforcement infrastructure to review, assess, and determine the effectiveness of AML/CFT programs. The AMLA 2020 further expands this power in the US. With it comes increased expectations from Congress and the public that financial institutions will do more to detect, prevent, and report financial crime. For institutions that do not meet the new standards, the consequences will be severe. As 2021 begins, every financial institution’s work around assessing, strengthening, and modernizing their AML/CFT programs must begin.
White Paper 15 Note on New Beneficial Ownership Requirements “The Corporate Transparency Act” is existing policy and procedures. It is enacted as part of the AMLA 2020. likely Financial institutions will need to To AML/CFT professionals, this Act update their policies and procedures may become known as something to include how they collect FinCEN like the “Beneficial Ownership CTA registration numbers, how to Database.” Under the AMLA 2020, request customers approve access financial institutions and their AML/ to the FinCEN database, procedures CFT departments are not permitted if customers deny access to the access to the Beneficial Ownership database, and the processes the Database except only when customers financial institution undertakes to give permission for the bank to do access the Database. Policies will so. Instead, FinCEN maintains the also need to include requirements to database for use by law enforcement document results and maintain the and other government agencies. Strict security of those results. Until 2022, procedures will govern access to the financial institutions must continue Beneficial Ownership Database, and to collect beneficial ownership all information must be protected and information as they do now. After considered confidential. 2022, changes to beneficial ownership information may change, or they may The Corporate Transparency Act not. (CTA) is to take affect by January 1, 2022. By that time FinCEN will Requiring corporate entities to register have established a database to store should make gathering Beneficial the collected beneficial ownership Ownership information easier for information. FinCEN is instructed to financial institutions. Because work with states to where feasible registering with FinCEN will be to use existing business registration required, all companies will have the processes to collect beneficial necessary documents and receive a ownership information. Over the next FinCEN registration number proving year, FinCEN will need to publish a they have registered. Perhaps as the considerable number of regulations Database and the registration process to govern the CTA. AML/CFT officers matures, financial institutions can will need to follow these regulations fulfill their Beneficial Ownership due to understand how the new beneficial diligence requirements merely by ownership information collection obtaining and verifying the FinCEN rules will impact financial institution’s registration number. One can hope.
ABOUT riskCANVAS, A GENPACT COMPANY In 2015, riskCanvas™ Holdings, LLC has developed a technology solution and consulting services focused on financial crime risk management. Its heritage stems from designing and delivering big data systems and analytics to the US Government Intelligence Agencies and DOD, which empowers riskCanvas™ with a deep understanding of the technologies, trade-craft, and illicit finance subject matter and creates a competitive advantage relative to the existing space. riskCanvas™ is the future of financial crime compliance technology and leverages the most cutting-edge big data, automation, and machine learning technologies to deliver compliance, efficiency, and automation to its clients. As of January 8th, 2019, riskCanvas™ was acquired by Genpact and operates as a wholly owned subsidiary. A TRUSTED AND EXPERIENCED PARTNER As a leader in Financial Crime Risk Management (FCRM), Genpact has deep domain expertise and a global understanding of the threats your organization faces. Our “FCRM as-a-service” utility give you the support you need to manage your FCRM lifecycle. These services include: • Strategy and Design: Our expert team of subject matter experts, consultants, data scientists, and technologist can provide a strategic outside view of the industry best practices, regulatory direction, and technology roadmaps to help your institution become a leader in fighting financial crime. • People: Ranked as a “leader” and “star performer” by Everest Group Peak Matrix for Financial Crime Operations Services, we have over 2000+ financial crime profes- sionals servicing 40+ customers globally. We provide onshore and offshore dedi- cated resources to help manage your financial crime operation needs. • Technology: riskCanvas is our next-generation financial crime technology suite. This platform allows end-to-end program coverage by leveraging big-data to enhance the prevention, detection, and investigation of AML/Fraud based threats. L E A D E R S H I P A N D AU T H O R S Joseph Gillespie Quinten Hout David Caruso Founder / President Head of Global FCRM Vice President, Advisory Advisory Financial Crimes Advisory info@riskCanvas.com www.riskCanvas.com
You can also read