The below chapter was published in International Comparative Legal Guide's Anti-Money Laundering 2018.
Anti-money laundering (AML) enforcement presents a mounting risk and compliance burden for financial institutions as well as other businesses that conduct cash-based transactions. Over the past decade, enforcement of AML regulations has grown far more stringent. Financial penalties have mushroomed, and regulators are increasingly holding executives personally responsible for non-compliance. Meanwhile, the financial industry's exposure to money laundering is vast. An estimated 2% to 5% of global GDP is laundered every year.1 Much of this cash enters the international banking system.
The vigor of enforcement, the broad scope of conduct that constitutes money laundering, and the challenges of compliance add up to a serious risk for financial institutions. By extension, there is also a risk to their directors, executives and shareholders. Money laundering is so common that no financial institution can safely doubt they are at risk or adopt a casual approach to AML compliance.
While it is too early to know exactly how the Trump Administration might alter AML enforcement, there is ample reason to believe the current trend of vigorous enforcement will persist. The administration's agenda of reducing the regulatory burden likely will be offset in the AML arena by an emphasis on fighting terrorism, drug trafficking and other international crimes.
Official statements regarding other categories of financial wrongdoing suggest the administration will continue to emphasize both strict enforcement and individual accountability. These statements include the approach to securities enforcement espoused by Securities and Exchange Commission (SEC) Chairman Jay Clayton, as well as the new guidelines on Foreign Corrupt Practices Act (FCPA) enforcement announced last fall by Deputy Attorney General Rod Rosenstein. Likewise, both the SEC and the Financial Industry Regulatory Authority (FINRA) have identified AML compliance as a continuing enforcement priority for 2018.
In conversations with our firm, executives and officials who hold AML responsibilities have understandably expressed concerns. While regulatory relief on AML is unlikely, in our experience there are various steps companies can take to minimize the risk of money laundering. This article examines current trends in AML enforcement and provides observations on best practices available to financial institutions to measure and mitigate risks. While we believe these observations are applicable to most businesses that face AML risks, we recognize each company's situation is unique, and there is no substitute for targeted professional advice.
Trends in AML Enforcement
As noted above, AML enforcement has escalated in recent years. This escalation has taken several forms: holding individuals personally liable for compliance failures and the underlying conduct; imposing greater financial penalties; emphasizing an admission of wrongdoing; and targeting a broader scope of money service companies, and even vendors, for AML non-compliance. Moreover, compliance expectations are mounting. For example, the new "beneficial ownership" Customer Identification Program (CIP) rules going into effect in May 2018 will require companies subject to Bank Secrecy Act2 (BSA)/AML rules to identify individuals who hold more than a 25% interest in customers structured as entities. This section addresses each of these trends.
- Individual Liability: Since the financial crisis, financial regulators have stressed their intention to hold individuals accountable for wrongdoing. In AML compliance, this has resulted in notable enforcement actions against corporate officials. In May 2017, for example, FinCEN secured its largest ever fine against an individual, a $250,000 civil penalty against a chief compliance officer for failing to implement an effective AML program. The settlement included an admission of guilt and a three-year injunction barring the officer from performing a compliance function.3 It marked only the second time in FinCEN's history that it sued to enforce a monetary penalty.4 The case set an important precedent in which a federal district court reaffirmed that regulators were authorized to impose monetary penalties against officers of financial institutions. Despite concerns that such penalties would have a chilling effect on the compliance profession,5 FinCEN stated that individual liability "strengthens the compliance profession by demonstrating that behavior like this is not tolerated within the ranks of compliance professionals."6
- Corporate Financial Penalties: The Congressional Research Service (CRS) recently reported a significant escalation in both the frequency and size of corporate AML penalties since 2012. Citing a National Economic Research Associates study,7 CRS noted that from 2012 through to 2015 nearly 90% of AML enforcement actions included financial penalties, compared to less than half between 2002 and 2011, and that "more than 80% of total money penalties imposed for BSA/AML violations since 2001 have been levied after 2012". The CRS report also noted that "since October 2009, nearly one-third of BSA/AML penalties have exceeded 10% of a defendant institution's capital. By contrast, no penalty imposed before 2007 exceeded 9% of a defendant institution's capital."8
- Admission of Wrongdoing: Regulators have increasingly required an admission of wrongdoing to be an important element of resolving enforcement actions. As former FinCEN director Jennifer Shasky Calvery stated in her remarks to the American Bankers Association/American Bar Association Money Laundering Enforcement Conference, "Acceptance of responsibility and acknowledgment of the facts is a critical component of corporate responsibility".9 This contrasts with pre-crisis practices and raises reputational risks. It also creates increased litigation risk for institutions that settle AML prosecutions. Required admissions have applied both to individual compliance officers and corporations. The two largest monetary penalties, both assessed against major financial institutions, have included acceptance of wrongdoing.10 In some cases, regulators have even required a sanctioned compliance officer to disclose the enforcement action to future employers.11
- Broader Scope of
Compliance: Another clear message from regulators and law
enforcement is that the range of entities subject to AML laws and
regulations is broader than has sometimes been understood.
Regulators have underscored that virtually any money services
business can be held accountable. Additionally, several federal
agencies have recently released guidance on corporate liability
arising from third-party relationships, including vendors, for
violations caused by the third party. Under 2017 Office of the
Comptroller of the Currency guidance, for instance, potential
enforcement targets could include mortgage servicers, software
providers and even independent auditors.
Another trend regarding culpability involves an increasing tendency of prosecutors to infer willfulness, or intent to violate BSA/AML requirements, from the resources an institution devotes to compliance. One vivid example is the 2017 prosecution of a firm in which willfulness was inferred from the paucity of resources devoted to AML compliance. Some examples include running only two scenarios to identify risky transactions, generating only paper reports for a business that engaged in almost $9 billion of money transfers annually, and filing only nine SARs out of a total of 18,000 alerts the bank's system had triggered as warranting further review.12
- Beneficial Ownership Rule: Finally, trends in enforcement and investigations over the past several years have shown heightened expectations around the customer due diligence process, particularly following revelations from the Panama Papers controversy. FinCEN has issued a new "look through" rule that requires financial institutions subject to the BSA to identify the beneficial owners of customers organized as shell companies and other entities they do business with. The new rule, which carries a compliance deadline of May 11, 2018, defines a beneficial owner as any individual holding an ownership stake of 25% or more of a company. Practitioners are eagerly awaiting the issuance of regulatory guidance on the new rule, which is lengthy and complex.
Key Steps for AML Compliance
The most effective way to navigate this more stringent AML landscape is to avoid the enforcement minefield altogether. This means complying with the spirit and letter of the law and meeting regulatory expectations. Regulators have stressed that an intent not to break the law is not an adequate defence, nor is ignorance of a customer's activities or subcontracting AML compliance to a vendor. Instead, the onus is on the firm to demonstrate that it has built an AML compliance program sufficiently robust to address the risks posed by its business and customers.13
In brief, there are three pillars to implementing a robust compliance program:
- the program must be based on a detailed, well-executed risk assessment;
- it must designate and faithfully implement compliance procedures tied to the risks identified in the assessment and report any suspicious activity promptly to regulators; and
- the program must undergo regular and ongoing review, testing and evaluation.
Within this framework, the following describes best practices that firms should consider.
Get Your Risk Assessment Right
Risk assessment is the first pillar of AML compliance and is the backbone of any AML compliance program. Defining and evaluating potential risks is a crucial first step towards building an effective compliance program. In other words, a company can't manage what it doesn't measure. In the event that wrongdoing occurs, regulators and prosecutors often view a failure to conduct an adequate risk assessment as being more culpable than not conducting one at all. Moreover, the assessment should be updated whenever there is a material change to the business, such as through a merger, acquisition, substantial geographic or operational expansion, or a change in customer base that significantly changes the company's risk profile.
Attention to detail is vital. A covered institution should ensure the individuals conducting the risk assessment have the background, skills and resources required to identify all of the firm's potential risks. The assessment team should be empowered by a mandate from the C-suite to promote cooperation. The team should examine all entities and lines of business subject to AML regulations, reviewing documents and conducting interviews with key personnel. It should consider such factors as: location; type of entity; and the degree of difficulty in conducting due diligence and determining the beneficial ownership of clients or customers, in accordance with local laws and regulations. The risk assessment should document risks and flag businesses and geographies where money laundering activities are particularly prevalent. Regulators have underscored the importance of evaluating the unique risks posed by a business and of identifying reasonable controls. Failing to do this has been characterized as an "unacceptable risk" of AML non-compliance.14
Using the information gathered during the research phase of the risk assessment, the firm should develop a scoring system (for example, by line of business, geography, customer category or individual customers) to help the firm's compliance personnel target their surveillance efforts. A well-executed risk assessment should also be sufficiently forward-looking to prepare the firm for external review of the compliance program. For example, it should identify areas of focus for testing transactions and for reviewing client files and other records for later evaluation of the program. Finally, the risk assessment should be sufficiently thorough and well designed to persuade regulators that the firm has invested adequate time and resources in its efforts to identify potential money-laundering activities.
Ensure Appropriate AML Leadership, Staffing and Reporting
The second pillar of AML compliance, effective implementation, relies largely on the personnel charged with day-to-day oversight of the program. Ideally, the AML compliance officer should be an experienced, board-selected expert in AML. The compliance officer should also have access to outside professional assistance, particularly if the individual does not have significant AML expertise. Moreover, the compliance team should have a budget that enables it to carry out its mandate, and the budget should adapt to changing conditions within the institution or in its competitive or geographic environments. The AML compliance budget should keep pace with the demands of a growing institution, especially one that has acquired new lines of business.
It should be stressed that the AML compliance officer, or designee, is responsible for reviewing and signing off on all AML-related documentation. This is a time-consuming, yet critical, responsibility. Duff & Phelps has found that a failure to comply with this requirement can raise red flags, triggering enforcement action.
Address Hurdles to Collecting Know Your Customer (KYC) Documentation
A common barrier to effective AML compliance is an unwillingness of clients and customers to share documentation needed to fulfill the KYC requirements that are a cornerstone of the AML regulations.
Typically, for instance, a covered institution will request a company's articles of incorporation as evidence that a business exists as a legal entity. If the client is reluctant to provide its articles, it often helps for the relationship manager and/or the firm's AML compliance vendor to provide an explanation, clarifying why the information is needed.
Alternatively, AML regulations allow for a variety of acceptable documents in cases where customary documentation is unavailable. For example, in lieu of articles of incorporation, a company may submit a government-issued business licence, a partnership agreement or a trust instrument. This is not an exclusive list. FINRA has clarified that a financial institution "may use other documents for verification provided that the documents allow a firm to establish a reasonable belief that it knows the true identity of the customer".15 FINRA encourages firms to obtain "more than one type of documentary verification to ensure that they have a reasonable belief that they know their customers' true identities".16 Multiple forms of verification increase the likelihood of identifying inconsistencies that might raise red flags. Extra care should always be taken in cases involving politically exposed persons and particularly with senior foreign political figures, who should always be subject to enhanced due diligence under AML regulations.
If a prospective client remains unable or unwilling to comply with basic information requests even after the financial institution clarifies why the documentation is needed, and offers alternative documentation options, the firm would typically be advised not to do business with the client. The willingness of a financial institution to decline potential clients, particularly major ones, who are unable to satisfy KYC requirements is a critical measure of whether its compliance program is truly robust.
Consider Outsourcing Judiciously
The decision of whether to outsource all or some elements of an AML compliance program is a complex, firm-specific decision. Many firms choose to retain outside expertise to assist with certain aspects of the program, such as training employees and, as discussed above, conducting risk assessments, and reviewing and testing compliance programs. Firms often outsource in circumstances where they don't have adequate time or resources to hire and train a full-time compliance team. Some may choose to outsource a significant part of the program when they face business constraints, such as a new acquisition that dramatically changes the risk profile.
If the firm selects a professional, seasoned consultant, it benefits from a well-trained, well-equipped team on day one. Moreover, when comparing the cost-effectiveness of maintaining expertise in-house versus contracting with a specialist, many firms find compelling cost efficiencies to outsourcing. It should be stressed, however, that outsourcing a compliance program does not shift the ultimate compliance responsibility to the vendor, regardless of the vendor's reputation or track record. If a violation occurs, regulators will still hold the firm accountable. Hiring a reliable consultant with a strong track record may boost the credibility of the compliance program with regulators.
Regularly Conduct Independent Compliance Program Testing
The third pillar of robust AML compliance is an obligation to conduct ongoing review, testing and evaluation of the compliance program. A continuous process of evaluation and testing of the AML compliance program is an essential feature of an effective program. (This is true also with respect to compliance efforts relating to the FCPA, sanctions, anti-terrorist financing and other financial crimes.) In our experience, this is a requirement that deserves extra vigilance, as it is an area where regulators often find that firms fall short.
While the law allows for independent reviews to be conducted internally, retaining a consultant to conduct periodic assessments of the effectiveness of an AML compliance program reduces the risk of conflicts or appearances of conflict. It is especially important to construct a framework in which the assessment is conducted by persons not associated with the businesses being evaluated. Some institutions rely on their internal audit team to develop the expertise needed to evaluate compliance program effectiveness; while others engage external consultants to conduct an independent review, or at least to train and support internal audit personnel in these efforts. Such consultants should have deep experience in testing AML programs and should be independent of the firm hired to handle compliance. The team conducting the review should have a direct reporting line to senior management, as well as to the audit committee or independent directors in a public company.
Provide Open Communication Channels for Whistleblowers
Regulators are inundated with thousands of SARs each year. As such, some of their most promising AML enforcement leads may arise from employee tips, independent of official compliance channels. Such tipsters, who may in some cases benefit from federal whistleblower incentives, can put even the most diligent company compliance office in a difficult situation. As such, companies are advised to cultivate a culture where employees are encouraged to bring suspicions or evidence of wrongdoing to the relevant compliance officials in the first instance.
The company's compliance policies should set the right "tone at the top," including clear guidance on how to submit tips. The company should also publicize a strict anti-retaliation policy, noting that employment law assigns criminal penalties for retaliating against whistleblowers. While statutes prohibit discouraging a tipster from filing a report with law enforcement, companies can diminish the odds of escalation by stressing that the tip is welcomed and will be taken seriously. A well-administered anonymous tip program can also help by providing a channel for employees who may not be comfortable coming forward in person, especially if a hotline or anonymous e-mail reporting channel is administered by a third party rather than by the company itself.
Think Like a Regulator
Regardless of how robust a firm's AML efforts are, what matters most in avoiding the enforcement minefield is how regulators view the implementation and effectiveness of a compliance program. Generally speaking, with regulators the rule is the rule. If a firm is required to collect documentation and it doesn't consistently do so, it is liable to suffer enforcement action. Attempting to show that, despite lapses, the firm has a strong program may have a minor mitigating effect, but it is unlikely to keep enforcement at bay.
Be Proactive About SARs
Regardless of the effort and resources dedicated to a compliance program, many enforcement actions are rooted in a firm's failure to file SARs with sufficient diligence, timeliness and consistency. This, therefore, is a key area for monitoring and measuring by the compliance team. Regulators receive thousands of SARs each year. In general, if a firm suspects it might need to file a SAR, it probably should do so. Financial institutions that proactively alert regulators to problems can generally expect more favorable treatment in terms of fines or other sanctions in the event of wrongdoing.
Establish an Expansive AML Training Program
Training is an essential element of an effective AML compliance program and a key expectation within AML regulations. When examiners review a firm's program, training is typically one of the areas they inspect. Compliance officials should review the program regularly to confirm it is up to date with the law, enforcement priorities and the firm's mechanisms and risk profile. All relevant employees should be trained in AML compliance, and the firm should have a certification requirement to ensure that all required employees fulfill this obligation. Additionally, employees in specific risk categories should receive more frequent and detailed training.
Computer-based training programs can help streamline this expectation and can track fulfillment. In addition to providing the necessary information and guidance, training should underscore a culture of compliance. Finally, training compliance should be reviewed regularly, particularly when employees change jobs.
Look for Potential Conflicts of Interest
Finally, we note that client-facing employees who earn commissions or performance bonuses, based on assets under management, have an incentive to overlook the suspicious activities of a large client. For many firms, this poses a vulnerability, and one that may be difficult to address.
A strong, well-designed compliance structure can help. Many firms establish incentives for the compliance team that are not tied to profits. Others embed compliance personnel in operating units to have an ongoing presence, with the goal of reducing tensions and fostering cooperation. The firm's messaging and conduct should indicate to the revenue-generating personnel that the compliance team is not the enemy and that both teams share a common goal: the health, success and prosperity of the business. Finally, particularly given the current aggressive enforcement climate, firm are advised to enforce a well-publicized zero-tolerance policy for employees who put financial incentives ahead of regulatory obligations.
Conclusion
Under an increasingly rigorous and expansive AML enforcement regime, all financial institutions and money service firms are advised to implement a robust compliance program to minimize the risks and potentially mitigate or altogether avoid large financial penalties and personal liability. The steps outlined in this article can help companies to achieve these goals by maintaining vigorous and effective compliance efforts, and by monitoring and adapting to changes in applicable laws and regulations. Every institution that faces money laundering risks should obtain the necessary expertise and carefully tailor its compliance program to the specific risks it faces.
Footnotes
1. https://www.unodc.org/unodc/en/money-laundering/globalization.html
2. BSA is the Bank Secrecy Act, which governs anti-money laundering regulations on financial institutions.
4. https://www.bakerdonelson.com/trends-in-anti-money-laundering-enforcement-and-compliance.
5. https://www.wilmerhale.com/pages/publicationsandnewsdetail.aspx?NewsPubID=17179883478.
8. https://fas.org/sgp/crs/misc/R45076.pdf
10. https://fas.org/sgp/crs/misc/R45076.pdf.
11. Anti-Money Laundering Enforcement: The Rise of Individual Liability for Compliance Professionals; Securities and Commodities Regulation, Vol. 49 No. 21 December 7, 2016
13. https://www.sec.gov/news/speech/anti-money-laundering-an-often-overlooked-cornerstone.html.
14. https://www.sec.gov/news/speech/anti-money-laundering-an-often-overlooked-cornerstone.html.
15. http://www.finra.org/sites/default/files/NoticeDocument/p003246.pdf.
16. http://www.finra.org/sites/default/files/NoticeDocument/p003246.pdf.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
