FINTRAIL has recently launched its Financial Crime Intelligence and Investigations practice, something we’re really excited and passionate about. We believe that intelligence and investigation form critical and complementary parts of any robust financial crime risk management program. Before we explain why that is, we’ll kick off with a couple of definitions:
Intelligence: This is information about an event that you receive in advance of it happening. Examples from history include the intelligence gathering (on both sides) about troop movements in the Second World War. Examples in financial crime include receiving information from an issuing bank about an account that is purportedly connected to fraudulent transactions in another account.
Investigation: This is the process that takes place after an event occurs, and usually tries to figure out what went wrong or what is going on once a credible threat has been identified. So, following a terrorist attack, for instance, the police will launch an investigation to try to understand as much about the attacker’s background as possible, and exactly what happened to support any formal judicial or enquiry process.
Although we’ve separated out the two concepts theoretically, they are intrinsically linked with each feeding the other. To use another example, a firm might look at new typologies that criminals are developing to commit fraud, and proactively add new rulesets to transaction monitoring to detect similar behaviour before the fraud takes place. This process will flag a number of customers, some of whose accounts will need to be closed or who may be vulnerable. It might also flag other accounts with suspicious behaviour, but which appear to display a different typology. These accounts can be individually investigated, but if there are enough of theme, there may be sufficient information to identify a new typology (intelligence), and therefore a new set of rules stemming from the new activity observed - it’s a cyclical process!
So, what is FINTRAIL doing in this space? Well, we’re bringing together the leading technology and new data, along with our expertise (if you look at our Team page, you’ll see we’ve all been doing this kind of work for years!) to provide intelligence and investigations expertise as an outsourced service. In start-ups, this can help keep small financial crime teams lean while still having access to the best capabilities in this area and removing the more complex work around intelligence and investigations from the fast-paced environment of a start-up. And for more established firms, this provides access to the latest technology, and can help with resourcing challenges on a long or short-term basis. We hone in on customer protection and solid recommendations for system, rule or other structural improvements on the basis of our findings; and this is why intelligence and investigations are such a crucial part of any financial crime risk management framework, as it actively helps to inform and improve existing systems and processes, keeping them up-to-date, proactive and targeted at the most serious threats.
The team at FINTRAIL is really excited to have worked with UK FinTech Financial Crime Exchange (FFE) members to produce this White Paper. An extract and the full paper are below.
Financial technology companies (fintechs) leverage online and mobile applications to offer new financial services with efficient and cost-effective customer experience. However, the non-face-to-face (non-f2f) nature of fintech businesses poses risks that fraudsters or other criminals may seek to exploit these remote platforms and related products.
Robust customer due diligence (CDD) is one element of an overall risk management architecture that can mitigate these threats. Fintechs are uniquely suited to harness and develop innovative CDD approaches, owing to their dynamic business models and comfort in using technological solutions. This white paper describes examples of best practice in CDD among members of the FinTech Financial Crime Exchange (FFE), offering practical insight for fintech companies and other stakeholders – such as banks and regulators – seeking to better understand the industry. It provides examples of how fintechs are utilising innovative CDD approaches to manage risks while also enabling a high-quality customer experience. For example:
• Fintechs are leveraging numerous data points and employing innovative analytical approaches to enable a dynamic and holistic view of customer risk.
• This includes the use of facial recognition techniques, interactive user interfaces, innovative document scanning and analysis, Internet Protocol (IP) geolocation, predictive analytics and machine learning.
• These solutions can enable fintechs to employ a genuinely risk-based approach to CDD as their customer base and service offerings evolve.
This paper also assesses areas where fintechs can benefit from further development and exploration. For example:
• Fintechs should carefully consider the appropriate balance of in-house and third party solutions for their business model.
• Fintechs must be prepared to conduct thorough and formal assurance testing of both in-house and third-party solutions and outsourced services.
• As they scale, it is important that fintechs have in place adequate governance arrangements to manage risks that come with changes to their CDD systems and controls.
In January 2017 FINTRAIL (www.fintrail.co.uk) and the Royal United Services Institute (RUSI) (www.rusi.org) launched the UK FinTech Financial Crime Exchange (FFE). The FFE brings together 17 of the UK’s leading Financial Technology (FinTech) firms who have agreed to collaborate, by sharing best practice and pooling information on financial crime typologies in order to protect their customers and strengthen their sector’s ability to detect and counter the global threat of financial crime, including money laundering, terrorist financing, bribery and corruption, tax evasion and market manipulation.
The UK FinTech sector is at the forefront of the global FinTech revolution, accounting for a total of £783m investment in 2016. This coincides with a growth in the risk of financial crime driven by the expansion of digital channels and the increasingly interconnected nature of global finance and business.
As the UK continues to lead the global FinTech revolution, UK FFE members are taking a proactive and robust stance against financial crime and the negative impact it can have on customers, communities and the financial services industry. Through collaboration members are sharing information on typologies and leveraging advanced technology to deter, prevent and detect criminality.
“The FFE gives senior management a forum to share industry knowledge, and gain an understanding of best practices specifically relating to Fintechs.”
James Nurse – Head of Fraud and Payments, Pockit
“Our company's core value is collaboration. Thanks to the FFE and participating members, we have been able to share and learn from industry leaders. This, ultimately, will lead to a more secure sector.”
Merlin Gore – Head Engineer, Bud
“At Ozan.com, we’ve developed innovative and dynamic financial crime tools to keep our customers safe. The FFE’s network of fintech industry experts provides insights enabling us to continually improve our risk management products to continually mitigate fraud and other criminal behaviour.”
Ozan Ozerk – Co-Founder, Ozan.com
“Fintech businesses are using tech solutions to address today’s problems. We use AI and Machine Learning in our day-to-day business, ensuring UK businesses receive meaningful working capital quickly which they need to grow. In this endeavour, we must also have the capabilities to tackle financial crime. We look forward to collaborating with FFE members to ensure high standards and to secure the industry’s defences.”
Anil Stocker, CEO and co-founder, Marketinvoice
“The FFE helps Monzo share knowledge and get a better understanding of financial crime across the industry as part of our mission to build the best current account in the world”
Natasha Vernier, Monzo
“As an online mortgage lending and investment platform we deal with customer finances and data every day, so security is at the heart of our online systems and processes. Forums like the FFE are invaluable to ensure that as an industry we share our experiences and solutions in the rapidly evolving fintech space so that together, we can keep our customers safe.”
Julian Cork, Chief Operating Officer, Landbay
For any enquiries on the FFE please contact Rebecca.firstname.lastname@example.org
On 21 April 2017 FINTRAIL co-founder Robert Evans joined Samantha Sheen from ACAMS and Laurence Twelvetrees from Revolut to deliver an interactive educational webinar on FinTech and financial crime risk within innovate business. With an average audience of over 1150 attendees from over 80 countries, it demonstrates the ongoing interest in the rapidly developing world of FinTech and disruptive financial services.
The session focused on three training objectives:
Gaining a clear understanding of the risk profiles of innovative business firms and their risk characteristics as they relate to financial crime
Obtaining greater awareness about the steps taken by these types of businesses to mitigate the risk of their possible misuse in order to launder the proceeds of crime
Developing a wider comprehension about the information that should be sought and understood in order to undertake an appropriate and accurate risk assessment of these types of business relationships
You can listen to the full webinar by visiting the ACAMS webinar library via the button below and searching for - "FinTech, Crowdfunding and Other Innovative Businesses."
FinTech is a term that has entered the collective public consciousness in recent years. There is an increasing awareness of the disruption and exciting opportunities FinTech is bringing to financial services and consumers alike. This article looks at the benefits of FinTech, some of the challenges, and examines how the world of financial crime compliance and FinTech complement each other.
Originally published in the March-May 2017 ACAMS Today magazine, a publication of ACAMS © 2017.
The open and engaging way in which FinTechs attract customers and their razor sharp focus on customer experience presents an exciting opportunity to build-in and enhance the concept of deterrence as an effective and efficient part of their financial crime risk management.
The act of deterrence has become a common sight on the streets of many european capital cities, where armed police now patrol in response to the terrorist threat. Their very presence is designed to inhibit the confidence of a terrorist to physically act or target the venue where they are present. The presence of the police officer is both a physical control but also creates a perception of security. This is similar to airport screening, where the signs on approach to the screening points are designed to increase the perceived pressure on those seeking to breach the screening process, before they even get to X-ray machine. How many of you now spend the time in the airport queue tapping your pockets checking that you have no metal present as you don't want to be delayed for a few minutes? Imagine the feeling of stress that an individual would be feeling if they actually were trying to by-pass the screening process. Not only does this deter some uncommitted actors, it also presents additional opportunities to detect the activity.
In financial crime risk management terms deterrence is often discussed in the context of controls, where they physically stop illicit actors gaining access to an account, and this is a critical component; however, a credible and efficient deterrence process can and should be applied well before your customers start to interact with a physical control. If you think about it in purely operational and monetary terms, reducing the attempts of illicit actors that come into contact with your physical controls by 10%, say, results in potentially 10% fewer KYC matches or anomalies that need to be reviewed at cost, a percentage fewer transaction monitoring alerts that need to be investigated, and a reduction in the chances of a potential regulatory breach.
If we refer back to our analogy of the armed police officer standing outside a museum - do you need to physically interact with the officer to know he means business? Generally the answer would be no - you get a perception that he is there to do a job. This same theory can be applied to the perception you build of your company's financial crime controls and your corporate position when it comes to managing and dealing with financial crime.
Criminals are equally vulnerable to human emotions and will avoid firms where they feel the risk reward is not balanced in their favour. In some cases, they won't even try and test or breach your actual controls - turning their attention on those services they feel are more vulnerable. As with the analogy of the armed police officer, perceived deterrence is not enough and must be backed up by sound protection, detection and disruption activities/controls but perceived deterrence can be a hugely powerful and have tangible benefits.
Application of this key concept does not mean that you need to have big scary signs (digital or physical) that turn-off your customers and impact customer experience, in fact quite the opposite. Intelligent and credible deterrence can be integrated seamlessly into the open and engaging way new financial services are interacting with their actual or prospective customers while also reinforcing the point that FinTech businesses take the protection of the their customers and corporate responsibility seriously. For example, engaging your customer and user base through considered content is not only an open and transparent way to communicate exciting progress but it also presents the opportunity to get a strong deterrence message into the public domain. That messaging is then front and centre when the illicit actors are researching and scoping opportunities.
It goes without saying that you do not want to compromise the effectiveness of your actual controls by disclosing sensitive features such as specific KYC conditions or transaction monitoring methodology but this should not inhibit the use of the deterrence concept as part of an effective layered financial crime framework, where its use can maximise efficiency, improve operational performance and also positively reinforce your customer engagement and protection objectives.
The team at FINTRAIL work with FinTech and regulated businesses to implement intelligent and risk-focused financial crime controls. Please contact the team at FINTRAIL for further information.
Why Adopting a Threat-Focused and Intelligent Approach to Financial Crime Will Help Drive Fintech Success.
The 21st century has been characterized by an interconnectedness that impacts every aspect of business and society. This level of connection itself is not new, especially in business, where there have always been long, connected chains of actors, actions, and goods. Two key forces have increased this global interconnectedness in recent years: the globalization of business and society in all forms – including friendships, cultural influence, criminality, and terrorism – and the rapid development of information and communication technology.
A new set of assumptions is emerging about operating in this technology-enabled, interconnected financial services environment. Actions and relationships are expected to be fast (if not instantaneous), and they should be rendered both transparent and permanent by the information and communications technology that enable them. Moreover, regulators’ expectations of what one needs to know about the connections within any given financial system have also increased.
In 2016, a large-scale leak of client data from Panamanian law firm Mossack Fonseca revealed details of offshore companies and transactions, some of which were alleged by investigative journalists to involve criminality in various forms. The response from global government bodies was to request information from financial institutions almost indiscriminately – even the governments themselves did not know which actors and activities were illicit or licit. Financial institutions faced a choice: investigate every actor and transaction with a potential link to Mossack Fonseca, or explain to government institutions what they knew about their exposure to Mossack Fonseca and their understanding of the financial crime risk associated with that exposure.
Though the latter choice was manifestly less labor intensive, it required companies to know, in detail, who their clients were at any given point in time. This was the only way they could state with confidence whether their business with various clients fell within or exceeded the company’s desired level of risk. In other words, companies needed to know who their clients were, what they were doing, and what they were expected to be doing – they needed good intelligence.
Academic debate on the definition of intelligence continues to rage, but for the purposes of this article, we regard it as the ongoing process of gathering requirements (a need for information, a need for a service), collecting information pertinent to those requirements (market data, customer profiles), and analyzing and assessing that information to draw out conclusions. This, in turn, drives the next set of actions (product development) or requirements (more research). Intelligence in practice is a constant iterative cycle of activity that matures as a company learns and gathers more information.
The concept of applying an intelligence process is not new for fintech or financial services companies on the product side of business. An examination of how successful firms build and iterate their products is enough to illustrate that the ability to generate good intelligence already exists within the core DNA of how fintech companies operate. The methods they apply to product development are a great example. Fintech companies identify a market opportunity or process that is prime for disruption before collecting supporting data, planning a method or solution, producing a product, issuing it to customers, and then learning from their feedback. They are continuously iterating at pace. In fact, many good fintech CEOs state that they value the feedback loop with users most, as this feedback allows them to identify areas for improvement and focus on the things customers really want and are willing to pay for.
Donald Gillies, CEO of PassFort, a rapidly growing technology firm that provides anti-money laundering (AML) and know your customer (KYC) solutions for regulated business, elaborated on this: “For companies that are truly innovating, there is no more valuable commodity than engagement and feedback from customers. It’s more valuable than revenue. More valuable than funding. It’s feedback and, more specifically, the learning that results from it that allows you to deliver excellence. Minimizing the time between feedback being given by a customer, that feedback being understood and evaluated by the product team, and evolving [that feedback] into tangible product outcomes enhances process credibility. Enhanced process credibility increases customers’ willingness to devote time and resources to contribute more feedback. In such a set up, more feedback leads to better product outcomes.”
Gillies goes on to state that “excellence itself is where such efficiency and desirable outcomes are achieved repeatedly. This ability to repeatedly deliver excellent outcomes is what enables businesses to scale quickly and efficiently – no matter what line of business they operate in.”
It is this innate mindset and thirst for knowledge and feedback that positions fintech firms to have an exciting opportunity to build the same intelligence-led concepts and associated excellence into the financial crime controls they develop. There is huge potential commercial benefit as these companies build proportionate, progressive controls that foster trust across customers, partners, and regulators while also addressing the complexity of interconnected, diversified, and evolving global financial crime risks.
In February 2002, then US Secretary of State for Defense, Donald Rumsfeld, stated the now globally recognized words: “There are known knowns. There are things we know that we know. There are known unknowns. That is to say, there are things that we now know we don’t know.” This phrase has become synonymous with the often explored and debated issues around intelligence and analysis, but its sentiment also rings very true in the battle against financial crime. The application of a very static, compliance-only financial crime risk-management methodology will always enable a company to identify and deal with the known knowns. However, in most cases it is not the known knowns that cause debilitating consequences. These come more often from the left field of known unknowns. However, our work with fintech firms has brought an interesting trend to our attention: an increasing appetite for and ability to look for known unknowns.
This development is probably being driven by the personality type of those working in fast-paced fintech firms in combination with increases in access to data and technical knowledge. This new trend is exciting and has the potential not only to effect positive change in how the financial services industry addresses financial crime, but also to delineate additional areas of competitive advantage for fintech. Developing intelligent processes and working to fill the void of information created by known unknowns will drive excellence across all fronts: it will enable competitors to disrupt existing structures, processes, and services; it will allow them to see opportunity in risk and manage it proactively and intelligently; and, crucially for startups in the financial services space, it will allow them to drive customer trust through their effective and frictionless financial crime risk management practices. In the context of globalization and interconnectedness, intelligence and excellence are a powerful combination. This combination can rebalance the complex equation behind the efficient management of financial crime without hindering the exciting commercial and social potential of disruptive financial services. Fintech can lead that charge, as they already have the inbuilt personality traits, data, and technical capabilities to think intelligently about financial crime controls. And, in this sense, intelligence leads to excellence.
The team at FINTRAIL work with FinTech and regulated businesses to implement intelligent and risk-focused financial crime controls. Please contact the team at FINTRAIL for further information.
To read this article on the fantastic MISC website please visit - https://miscmagazine.com/intelligence-delivers-excellence/
Image Credit: The Digital Way
RUSI’s Centre for Financial Crime and Security Studies will host the first meeting of the FinTech and Fincrime Exchange (FFE), a new initiative to promote an increased understanding of financial crime by the FinTech industry.
Organised in collaboration with FINTRAIL, a financial crime risk management company, this initiative has been conceived due to the recognition that as a rapidly growing industry, FinTech providers, much like traditional financial institutions, must ensure that their organisations are not misused for financial crime purposes.
Technological innovation has undeniably reshaped the financial landscape, in which efficiency, customer experience and ease of use is prioritised by FinTech providers – in a sharp contrast to traditional financial institutions. Nonetheless, the key financial crime threats and vulnerabilities remain, as criminals and terrorists will seek to exploit the system for their own gain, including money laundering, terrorist financing, cybercrime, bribery and fraud, to name a few.
Whilst there is gradually increasing awareness of these issues, there are few spaces in which relevant personnel from FinTech can engage with one another, discuss shared challenges and foster a greater level of financial crime understanding.
This initiative seeks to fill this gap through the creation of the FFE, which will aim to meet once every two months to discuss key issues as identified by its members. Its objective is to inform, debate, and develop knowledge and best practices in financial crime that both policy makers and regulators can adopt.
For more information on this project, please contact Florence Keen, Centre for Financial Crime and Security Studies, or Rebecca Marriott, FINTRAIL.
We at FINTRAIL are pleased to launch our free Financial Crime and Cyber Security Surgeries.
Launching on Tuesday 31st January, we will be running free monthly surgeries providing early stage companies in financial services, including FinTechs, with friendly informal advice and counsel. We are passionate about helping businesses manage their financial crime risks effectively (money laundering, terrorist financing, fraud, sanctions compliance, tax evasions, bribery & corruption) through a risk based approach, as well as demystifying financial crime risk and compliance.
Our experts will be available to;
- answer any questions you have on financial crime or cyber security
- brainstorm ideas or approaches to your financial crime risk
- advise on how to prevent regulations from inhibiting your business and demystify the regulatory requirements
- prioritise and plan your roadmap
- have a chat about anything else really!
Come and talk to our experts!
Date: Tuesday 31st January & Tuesday 28th February (follow us on social media for future dates)
Time: 45 minute sessions available from 1400hrs
Address: WeWork, 9 Devonshire Square, London EC2M 4YD (please let us know if you are not based in London and we can make alternative arrangements)
How to book: Email email@example.com
We look forward to meeting you!
After what has been an exciting year for FINTRAIL, and FinTech, we look ahead to what we think will be three hot topics that will shape the industry in 2017.
1. Indian Demonetisation
November 2016 saw the Indian Prime Minister make his demonetisation announcement, where all 500 and 1,000 rupee banknotes are no longer recognised as legal tender in a drive to combat ‘black money’ and financial crime, predominately terrorism financing and tax evasion. These two notes comprise around 86% of the currency in circulation in India.
There is a known correlation between cash-heavy societies and crime – cash fuels black market activities, and that cash then needs to be laundered. The extent to which India can successfully reduce financial crime through demonetisation, without creating more financial crime than they began with, remains to be seen and will be an interesting test case in 2017.
So what will the world learn about this drive to digitalisation, particularly in emerging markets? A move to digitalisation increases transparency and traceability of funds but it can also open up new channels or risk vectors such as an increase in cybercrime and internet fraud.
There are already some Indian FinTechs in existence, and benefiting from the demonetisation already. Paytm, an Indian-based FinTech that offers products such as bill payments and e-commerce, had 5 million customers join shortly after the demonetisation announcement, and such rapid onboarding can of course create potential risks unless managed very carefully.
India’s move away from cash and to digital solutions presents huge opportunity for the regional FinTech sector as it moves in to 2017, as well as an opportunity for us to understand more about how financial crime risks materialise when markets make a sudden and rapid transition from cash to digital.
2. RegTech in 2017 – KYC for Businesses
RegTech is going from strength to strength, whether it be the UK Financial Conduct Authority (FCA) creating the RegTech Sandbox (shortly to take its second cohort) or the likes of Deloitte calling RegTech ‘the new FinTech’. We’ve seen some brilliantly innovative tools in 2016, and it looks like 2017 will continue to be a great year for RegTech. So what do we think will be big in the operational world of RegTech and specifically financial crime compliance focused RegTech for 2017?
There’s now many RegTech companies offering Identification and Verification (ID&V) and/or Know Your Customer (KYC) for retail customers, transforming the way innovative businesses now onboard customers, enhancing the customer experience and offering a key point of difference over incumbents. However, the same cannot be said for onboarding business customers. As FinTechs that have to date catered for a retail focused customer base go in search of higher margins offered by business products, we at FINTRAIL think that KYC for businesses will be the focus in 2017.
KYC for businesses is more challenging and has a higher number of complexities than KYC for an individual. In simplistic terms conducting KYC on an individual usually involves confirming their individual identity. However, KYC for a company requires more layered information, which can be far more challenging to obtain and confirm. For example, there can be many company directors linked to the business, it can be difficult to identify the beneficial owner, the company can have a convoluted corporate structure with multiple subsidiaries, those subsidiaries could be based in different jurisdictions, it can be challenging to verify the company’s trading activities, source of funds, industry and whether it is in your risk appetite, and so on.
The fact that so much information is required to complete KYC on a business is partly why incumbent banks can take many months to onboard a client. However, it is important to get it right as the risks in providing products for businesses can be higher, as there is the potential for more money, counterparties and individuals to be involved.
3. FinTech, Financial Crime and Information Sharing.
Information sharing between companies or financial institutions to combat financial crime seems obvious, yet it has only recently begun to gain traction, with the UK Joint Money Laundering Intelligence Taskforce (JMLIT) becoming BAU in May 2016. Major banks only make up a small proportion of the UK and international financial eco-system, and their market share is being eroded as disruptors offer new and innovate products. This means there is potential for a significant gap in knowledge and information exchange that could undermine efforts to collectively address financial crime risks. To address that in-balance FINTRAIL, in partnership with Royal United Services Institute (RUSI), is excited to be launching the FinTech FinCrime Exchange (FFE) in early 2017.
The FFE is a non-commercial information sharing forum for FinTechs, which addresses an industry requirement to build financial crime risk management knowledge and capability within FinTech and the disruptive finance space. It will do so through sharing experiences of dealing with financial crime, developing typologies and trends, and helping FinTech members learn from each other. The FFE will also improve public/private engagement on financial crime risk issues in FinTech.
Good information sharing can have a profound impact on a FinTechs ability to effectively manage their financial crime risk, and help stop criminals using their products or services for illicit purposes.
If you would like more information on the FFE, or to become a member, please contact the FINTRAIL team.
FINTRAIL co-founder Robert Evans recently spoke at the PayExpo MENA event in Dubai on the issue of de-risking, the impacts it is having on the correspondent banking, payments, remittance and FinTech sectors as well as offering business owners and leaders in the audience some practical advice on minimising the risk to their business. We thought it would be worth sharing some of the insight for our readers.
What is de-risking?
The Financial Action Task Force (FATF) defines de-risking as:
"Situations where financial institutions terminate or restrict business relationships with categories of customer to avoid rather than manage risk - such as respondent banks, NGO’s, gaming/gambling entities and money service businesses (MSBs)."
Within the financial institution community the term de-risking is seen as unhelpful, but we use it today as it has become a widespread and recognised label that carries a level of industry recognition.
As global correspondent and clearing banks have felt increased regulatory pressure in markets such as the UK and US, that has in-turn filtered down to regional correspondents, local respondents, issuers and all those that rely on the banks for their accounts and services.
There has been lots of debate about the issue of de-risking, with papers published by industry, regulators and global bodies and many industry initiatives underway to address the strategic drivers behind the trend. We are not going to re-hash that content here but instead focus on it from the other direction - bottom up.
We want to give business owners and leaders some advice based on our direct knowledge of leading de-risking decisions and some of the drivers behind it, in order that vulnerability and weakness can be addressed.
Reducing vulnerability to de-risking.
While we recognise that pan-industry efforts are critical to solving some of the fundamental drivers to de-risking (such as over regulation and cost of KYC), we also think as an industry we have not done enough to understand and articulate at a micro or individual level what drives some of the operational decisions that often lead to a de-risking or refusal to onboard scenario.
Historically during previous employment, our team have sat in client interviews, reviewed business profiles, business plans and looked at transactional flows that were very high risk, and in some cases that was totally new to those individuals we were talking to. Interestingly, and a cause for concern, was that some of the worst cases were not in those markets that were deemed to be traditionally ‘high risk’, but those within for example supposedly heavily regulated European countries. While we can potentially point the finger at the regulators and big bad banks, we think there is also a need for personal accountability amongst the industry, business leaders and individuals to look very carefully at their business models and ensure they understand the risks.
It will cost a bank somewhere in the region of £40-100k to onboard a new respondent, and it is not too dissimilar for payments firms, depending on the risk profile. In addition there are significant ongoing compliance costs that quickly mount up. In a high risk scenario annual due diligence could easily run to tens of thousands of pounds when you consider increased monitoring and onsite visitation requirements. In a pure correspondent banking scenario that is fairly easy to imagine but when onboarding or retaining a payments provider that is not so easy, especially where the margins for the bank are relatively small. Some of the core industry initiatives that are underway can and will drive down the associated costs, but making some of those items genuinely operational is still some way off.
All of this means that as a payment provider seeking an account or wishing to maintaining banking services you need to do everything you can to positively influence that risk vs reward equation. We are not going to focus on the commercials, especially as there may be little margin to improve that, particularly in the early days, but more on the risk side of the balancing act as that is one area we have seen can be significantly enhanced and make businesses more bankable.
FINTRAIL want to give you some simplified and distilled points drawn from direct experiences of assessing the risk reward equation - what were we and others really looking for when balancing that equation and how can you as a business owner and key industry leader help shape the tone of the discussion.
While some of these points may have slightly grand sounding titles or definitions, they are really real-world activities that will help you position your business and conversations far more effectively:
1. Understand and use a financial crime risk appetite.
All financial service firms should have an appreciation of their appetite for financial crime risk and how that correlates to their business strategy that in turn drives how you manage the day-to-day operations of your business. In simplistic terms we define a risk appetite as a formal statement of intent that guides and should underpin how you approach financial crime risk as a business and should really form part of your company DNA.
It is really important to acknowledge you can not operate a successful financial services business with zero financial crime risk, but you should be able to articulate and evidence how you are managing your business within a defined appetite that is based on an honest assessment of your control environment and the risks you face.
That is all very theoretical but how does this manifest itself in the real world? Your risk appetite is a neat and concise way to articulate your overall risk profile to a potential partner that further underpins your ongoing dialogue regarding controls and flows. It also underpins policy decisions about clients and markets as it can be used to guide strategy.
We have seen a number of beautifully crafted risk appetite statements but we continue to see very poor operationalisation of the intent behind the statement. You may ask why risk appetite is so important - and our answer is that the process of developing a risk appetite forces you to consider and genuinely understand your likely exposure to financial crime risk and possibly even more important, assess how effective your controls actually are.
If for example a business stated to us that they have no appetite for defence and arms related business, we would expect that it manifests itself in policies and procedures, restricting those clients at onboarding and in turn this should be further reflected in the transactional flow.
You must always allow a margin of error and potential differences in definitions but systemic failings call into question the efficacy of the control framework and would be an immediate red flag of wider issues.
2. Know and understand your customer base.
This links quite nicely to our observation about risk appetite and is one of the ways we would assess how a risk appetite is operationalised.
Would we expect you to know every single client by name? No, but you should have a view of your customer base and risk segmentation, especially when it comes to those customers that may fall into the high risk categories such as PEP’s or in a bank context, MSBs/payment firms.
It builds confidence that controls are well established and effective if you are able to accurately articulate the segmentation of your customer base and evidence that coherently. It also goes a long way to building open and transparent relationships with your partners as you are able to identify anything particularly high risk that you may wish to disclose or discuss. It is worth noting that depending on the exact nature of the transactional relationship, your partner will be able to see roughly what your customer base looks like so hiding it is not helpful. This will magnify the issues if something contentious is identified.
3. Transparency and Openness
We have always believed that fighting financial crime should be a team sport pan industry, between public and private sector and especially between partners. As an industry have we always approached it that way? Probably not but there is growing recognition that we need to do more.
When engaging with partners it is about building a relationship of trust and that requires transparency. Bring your partners along on your journey. If you have a weakness, don't hide it but explain what it is and what is being done about it - it builds trust.
Make sure you start your compliance dialogue at an early stage and take the time to understand the drivers on both sides of the conversation - it will help you articulate the message and information more effectively.
Make sure you clearly understand the questions that your partner is asking and they understand exactly what you need from them. We have seen confusion lead to a rapid break down in trust.
Additionally, try and make sure your data and materials are easy to understand and relevant. We are not suggesting you need beautiful designed templates and dashboards but it really helps the dialogue if your materials and data make sense.
We do not necessarily mean some of the more mundane items but more specifically, what you are doing to manage the higher risk business categories. For example are you processing payments from locations that may be transit countries for foreign terrorist fighters? How do you control and mitigate the risks of that?
You need to be able to clearly articulate to your partners what the risks are, what controls you are applying, and the icing on the cake is when you can evidence the control is effective.
One of the best working examples of this we have seen in previous employment was a UK based entity who had a relatively large component of gaming and gambling activity. Transactional analysis had identified what appeared to be fairly high risk activity that was on face value outside our risk appetite but our engagement with the client soon allayed specific fears as they were very quickly able to articulate precisely what additional controls they were applying to that activity, and prove effectiveness - we allowed them to continue to process that flow.
Their approach was so effective, because they had already done step 1, 2 and 3.
We have deliberately simplified some points to fit them into a short article and we recognise that some of these items are not new and not necessarily easy to do, especially when you add scale and global presence into the mix, but hopefully the sentiment of what we are suggesting is evident.
Do we need to do more to address the strategic issues driving de-risking - absolutely. However there is also more self help that smaller businesses can do to engage effectively with partners at both the initiation of the relationship and an ongoing basis. We have seen first hand that there is far more that the industry can be doing to make themselves attractive customers, especially in the early stages where the commercials may not tip the balance in that all important risk vs reward equation.
The team at FINTRAIL are uniquely positioned to help organisations address the issues and challenges presented by de-risking and a risk-off appetite as well as supporting businesses to effectively engage Partners in higher risk scenarios. Please contact the team at FINTRAIL for further information.
At FINTRAIL, we were really excited to present at the recent ACAMS seminar, KYC/CDD for the 21st Century. It was an excellent day, with some great presentations and speakers.
The theme for the day focused on applying a risk based approach to KYC and CDD and examined developing trends in the industry, with an audience drawn from across the financial services spectrum. FINTRAIL provided the audience with a simple methodology for conducting risk based due diligence on a FinTech business, examining some of the challenges, but also the opportunities the sector and approach may bring.
Delegates worked through a case study, which showed that although there are risks, the entrepreneurial spirit that defines FinTech can often be appropriately harnessed to improve financial crime controls such as onboarding and KYC. In turn this can result in more efficient and effective processes - reducing the perceived risks a FinTech may pose to issuing banks and Partners.
There is no denying that accessing banking facilities remains a significant challenge for payments providers and FinTech, driven by the continuing fall-out associated with de-risking/risk-off appetite and a general perception that the FinTech sector is of higher risk from financial crime. This session highlighted that a risk based approach to both the onboarding and ongoing due diligence of a FinTech business presents an opportunity to build a strong relationship between the provider and client, where the perceived or actual risks are understood, appropriately managed and the parties are then empowered to collectively capitalise on exciting commercial opportunities the sector is creating.
Our thanks again to ACAMS and Samantha Sheen for organising such a great event.
Please feel free to contact the team at FINTRAIL if you would like further information.
We are living in an increasingly connected and digital world and one where the delivery and consumption of financial services is moving online. This is driving a hugely positive and rapid evolution in financial services, offering customers more choice and a generally more convenient and focused experience. However this positive evolution has potential to be undermined by a break down in trust for companies, their partners, customers and regulators driven by failures to protect against cyber enabled crime. This is even more important in fledgling financial service businesses such as FinTech where hard won customers can be quickly lost via a breakdown in trust.
There is a complex dictionary that accompanies cyber security, complimented by huge numbers of confusing and expensive systems hitting the market that claim to combat the risk of cyber enabled crime. For those who do not have the depth of experience in cyber and data security it can be daunting to get your head around, never mind simplistically understand what you should be doing to better protect your customers and business. We are often asked by our clients and contacts to help them simplify the discussion around cyber and data security - so that is what we are going to do over the next few months. FINTRAIL are going to strip it back to the fundamental basics, in a language that everyone can understand and provide some useful pointers that should help readers think logically about the risks they face. Where we do use a technical term, you will find it hyper-linked to its definition.
Understand the scale of the problem
The aims of the cyber criminal will determine a business’s attractiveness as a potential target. As a general rule any business could be a target of ransomware style attack as this tends to be a volume approach - infect everyone and see who pays up. However, the nature and construct of a particular business model or system will have characteristics that make it potentially more or less attractive to cyber criminals. For example, do you provide customer accounts or facilitate value transfer? Do you collect and store lots of data on customers? Do you integrate with or have partners accessing your network/system? Answering yes to any of these may, at face value, make you more attractive to cyber criminals as the dividend or reward for them is higher than that of an individual.
In this edition we are going to focus on the logical and most simplistic place to start and forms our basic step number 1 - understand the risks and scale of the problem.
We have been watching with interest over the last few years as the boundaries between physical and digital crime have become increasingly blurred. If you read the news in any given week there are usually a number of cyber related stories hitting the headlines, whether it be well-sourced and detailed allegations of state-sponsored interference with National elections, cyber fraud targeting retail banking customers or institutional banking systems targeted. It can make for daunting and at times confusing reading but it is really important to set this issue within the context of your business.
The 2016 UK National Crime Agency (NCA) Cyber Crime Assessment made a number of interesting observations:
The accelerating pace of technology and criminal cyber capability development currently outpaces the collective response to cyber crime. This ‘cyber arms race’ is likely to be an enduring challenge, and an effective response requires collaborative action from government, law enforcement, industry regulators and, critically, business leaders.
The NCA assesses that the most advanced and serious cyber crime threat is the direct or indirect result of activity by a few hundred international cyber criminals, typically operating in organised groups, who target businesses to commit highly profitable malware- facilitated fraud.
Although the most serious threat comes, directly or indirectly, from international crime groups, the majority of cyber criminals have relatively low technical capability. Their attacks are increasingly enabled by the growing online criminal marketplace, which provides easy access to sophisticated and bespoke tools and expertise, allowing these less skilled cyber criminals to exploit a wide range of vulnerabilities.
A ‘compliance approach’ that aims to meet minimum standards does not adequately deal with intelligent and evolving adversaries, as threats are evolving faster than most defensive technologies and security practices.
As the NCA assessment above highlights, cyber criminals will often need to expend effort and resources to target a business effectively. Much of this is now achieved via relatively old vulnerability 'exploits' that are cheap and easy to come by and can be deployed at scale by the criminals. The newer exploits are becoming cost prohibitive for anything but the most sophisticated and well-funded cyber criminals.
Criminals have made a large pivot recently from using technical system exploits that require minimal user interaction to an old approach that focuses on applying social engineering tactics (Any act that influences a person to take an action that may or may not be in their best interest) to convince victims to click or run infected documents. These techniques date back to the mid-90’s but are really easy to scale.
The growth in the online criminal marketplace has now enabled cyber criminals to focus on niche areas of expertise, buying in the skills or access they need. The marketplace also helps them to scale up quickly – with tools such as exploit packs designed to automatically find the best possible web exploit for a target, packaging tools much like commercial SaaS solutions. They even use the terms ‘conversion rates’ when advertising the solutions to the criminal customers!
By taking some time to understand what is happening in the industry and how it applies to your business model, you will be able to contextualise developments and understand their significance. In our next post we are going to focus on the need to complete a risk assessment to structure and formalise some of the thinking about data and cyber security. Turning it into a user friendly and simple format that can help you make decisions and build a responsive and proportionate plan to mitigate the risks.
FINTRAIL’s cyber experts offer practical advice and commercially focused guidance to businesses looking to address the risk of cyber-crime. If you would like to discuss your cyber or data protection needs further, get in touch with the team at FINTRAIL. www.fintrail.co.uk
The past century has seen a huge shift in the financial services landscape – from the growth of retail banking (as we know it) in the late 1800s; to Diners Club developing the first credit card in 1950; and the elusive Satoshi Nakamoto’s invention of Bitcoin, the world’s first fully virtual currency, in 2008. The evolution in financial services has been complemented by the rapid development of enabling technology, the internet, a huge growth in connectivity, and the successful emergence of mobile and flexible payment channels. Collectively, these exciting developments are opening up financial services to new markets and users, as well as offering customers better value and more choice. With such developments – which are often rapid and occasionally chaotic – the risks and opportunities for both legitimate consumers and financial criminals have evolved and expanded. This article produced by the team at FINTRAIL explores the future of financial crime, its evolution and likely impact on the financial services industry as we move towards 2020.