Professional Documents
Culture Documents
Anti-Money Laundering Seminar Friday 25
Anti-Money Laundering Seminar Friday 25
Corporate Governance
Nearchos A. Ioannou BAcc(Hons) U.k, MSc U.k, FCCA, CFE
AML
Seminar Agenda
• What is money laudering
• Offences linked with money laundering
• The regulatory frame work relating to anti-money laundering
• Disclosure requirements
• Discuss real Money Laundering cases and identify red flag indicators.
• How to perform AML risk assessment.
• How to apply risk appetite to risk assessment – risk Tolerance and risk
treatment.
• What are risk variables and their use for client classification.
• How to identify aspects of the Company that may be susceptible to ML/FT.
What is money laundering
• “Money laundering is any action taken to conceal, arrange, use or
possess the proceeds of any criminal conduct”
Al Capone
Funds laundered in the world could range
between two and five per cent of the world’s
gross domestic product.
Placement
Money
Laundering
Stages
Integration Layering
Placement
At this stage, illegal funds or assets are first brought into the financial
system.
This ‘placement’ makes the funds more liquid.
For example, if cash is converted into a bank deposit, it becomes
easier to transfer and manipulate.
Money launderers place illegal funds using a variety of techniques,
which include depositing cash into bank accounts and using cash to
purchase assets.
Placement techniques
Placement techniques:
◦ smurfing and structuring
◦ alternative remittance
◦ electronic transfer
◦ asset conversion
◦ bulk movement
◦ gambling
◦ insurance purchase.
Placement techniques
Smurfing and structuring
Smurfing is a common placement technique. Cash
from illegal sources is divided between 'deposit
specialists' or 'smurfs' who make multiple deposits
into multiple accounts (often using various aliases) at
any number of financial institutions. In this way,
money enters the financial system and is then
available for layering. Suspicion is often avoided as it
is difficult to detect any connection between the
smurfs, deposits and accounts.
◦ Onyancha sets up Mama Mboga Trading Co. under the laws of Kenya.
◦ Mama Mboga Trading Co. opens bank accounts with various banks.
◦ Smurfs working for Onyancha transfer illegal funds to the Mama Mboga
Trading Co. accounts.
◦ Mama Mboga Trading Co. transfers these funds to other accounts or
invests them in securities.
Many countries have realised that criminals are increasingly using non-
financial professionals as intermediaries. To counter these activities, many
countries have included non-financial professionals in new anti-money
laundering legislation.
Integration
• Laundered funds are made available for activities
such as investment in legitimate or illegitimate
businesses, or spent to promote the criminal's
lifestyle. At this stage, the illegal money has achieved
the appearance of legitimacy.
• It should be noted that not all money laundering
transactions go through this three-stage process.
Transactions designed to launder funds can also be
effected in one or two stages, depending on the
money laundering technique being used.
Integration techniques
Integration is the third stage of the money laundering process,
in which the illegal funds or assets are successfully cleansed and
appear legitimate in the financial system, making them available
for investment, saving or expenditure.
• Credit and debit cards are efficient ways for money launderers
to integrate illegal money into the financial system. By
maintaining an account in an offshore jurisdiction through
which payments are made, the criminals limit the financial trail
that leads to their country of residence.
• The consultant might not even exist. For example, the criminal
could actually be the consultant and the money is declared as
income from services performed and can be used as
legitimate funds.
There are five types of risks that an effective KYC policy can help to
mitigate:
reputational
operational
legal
financial
concentration.
What risks are mitigated by KYC?
Reputational risk:
The reputation of a business is usually at the core of its success. The
ability to attract good employees, customers, funding and business is
dependant on reputation. Even if a business is otherwise doing all the
right things, if customers are permitted to undertake illegal
transactions through that business, its reputation could be irreparably
damaged. A strong KYC policy helps to prevent a business from being
used as a vehicle for illegal activities.
What risks are mitigated by KYC?
Operational risk:
This is the risk of direct or indirect loss from faulty or failed internal
processes, management and systems. In today's competitive
environment, operational excellence is critical for competitive
advantage. If a KYC policy is faulty or poorly implemented, then
operational resources are wasted, there is an increased chance of
being used by criminals for illegal purposes, time and money is then
spent on legal and investigative actions and the business will be
viewed as operationally unsound.
What risks are mitigated by KYC?
Legal risk:
If a business is used as a vehicle for illegal activity by
customers, it faces the risk of fines, penalties, injunctions and
even forced discontinuance of operations.
Financial risk:
If a business does not adequately identify and verify customers, it may
run the risk of unwittingly allowing a customer to pose as someone
they are not. The consequences of this may be far reaching. If a
business does not know the true identity of its customers, it will also
be difficult to retrieve any money that the customer owes.
What risks are mitigated by KYC?
Concentration risk:
This type of risk occurs on the assets side of a business if there is too
much exposure to one customer or a group of related customers. It
also occurs on the liabilities side if the business holds large
concentrations of funds from one customer or group (in which case it
faces liquidity risk if these funds are suddenly withdrawn).
KYC policy elements
KYC policy has five major elements:
• Notes:
•
• At least one official document must include a recent photograph. A valid passport or
national identity card should be requested at the outset.
• Customers must be filtered against known lists to establish whether they are under any
sanctions or have any negative press information or are Political Exposed Persons
(PEPs).
Face to face meetings
A face-to-face interview with a new client should be carried out
whenever it is possible, as part of the identity verification procedure
and in order to better understand the nature of the client’s business.
For those who are initially assessed as high risk, the senior
management of the local jurisdiction should ask the client to make
himself available for a face-to-face interview.
The interview may take place at the service provider’s office or at the
client's office when dealing with a high risk case. In such a case, all
the documentation submitted by the client may be certified by the
employee of the service provider firm.
It is acceptable for the service provider to allow the interview to be
undertaken by the professional intermediaries where the service
provider is satisfied that their due diligence policies and procedures
are acceptable to the service provider.
Due diligence procedures- Face to face
Owners
Certificate of Registered Office and Address
Signature Card
Client identification documents- Legal
entities(2 of 2)
List of Legal and other advisers/Auditors/ Business partners/
Suppliers/ Others
Business and Operational Profile (industry/ market-share/ locations/
revenue sources/ key clients/ suppliers etc)
Business references (a credit reference agency or a reference from a
bank or another professional adviser)
Recent audited accounts, incl. auditors’ report
Business website
Client Due diligence documents (1 of 2)
• The periodic assessments and lists issued by Financial Action Task Force should be
taken into consideration.
• For those not registered in Cyprus they need to have in force anti-money laundering
laws and procedures that are equivalent to the Republic of Cyprus and are member
countries of FATF or CFATF and also be appropriately regulated, with good reputation
and maintain memberships of professional bodies.
Documents to be provided- Due diligence
• Validity of the business address and communication numbers of the Professional service
client
• The enhanced due diligence measures for customers who aren't physically
present and other higher risk situations are broadly the same and include:
o obtaining further information to establish the customer's identity (for example
o two officials documents could be requested instead of one for
o establishing his identity);
• (c) allowing the money laundering compliance officer in accordance with paragraph (b) above to
have direct and timely access to other information, data and documents which may be of
assistance to him and which is available to the person engaged in financial or other business
activities.
• (d) Securing that the information or other matter contained in the report is transmitted to the
Unit when the person who has considered the report under the above procedures, ascertains or
has reasonable suspicions that another person is engaged in money laundering or terrorist
financing or that the transaction may be connected to such activities.
• It is provided that, the obligation to report to the Unit includes also the attempt to execute such
suspicious transactions.
Obligations of the internal audit department
• 6. The internal audit department of the Financial Organisation reviews
and evaluates, at least on an annual basis, the appropriateness,
effectiveness and adequacy of the policy, practices, measures, procedures
and control mechanisms applied for the prevention of money laundering
and terrorist financing.
• The findings and observations of the internal auditor are submitted, in a
written report form, to the board of directors which decides the necessary
measures that need to be taken to ensure the rectification of any
weaknesses and/or deficiencies which have been detected.
• The minutes of the abovementioned decision of the board of directors and
the internal auditor’s report are submitted to the Commission at the
frequency specified in paragraph 9(4) of the Directive DI144- 2007-01 of
the Commission of 2011
Customers’ acceptance policy
• The customers’ acceptance policy is prepared after detailed
assessment of the risks faced by the Financial Organisation from its
customers and/or their transactions and/or their countries of origin
or operations
• All customers should be classified as:
• Low
• Normal
• High risk
Appointment of compliance officer- assistants
of compliance officer (section 69 of the Law)
• A compliance officer is appointed, who belongs to the management of the
Financial Organisation so as to command the necessary authority.
• Reporting entities are required to assess the money laundering and financing of
terrorism risk that they may reasonably expect to face in the course of their
business.
• In making this assessment, the Act requires that a reporting entity considers:
• the nature, size and complexity of its business;
• the products and services it offers;
• the methods by which it delivers products and services to its customers;
• the types of customers it deals with;
• the countries it deals with;
• the institutions it deals with;
• any guidance material produced by supervisors; and
• any other factors that are set out in regulations.
Risk assessment
-Low risk
-Normal risk
-High risk
Countries classified as high risk- FATF
• Afghanistan
• Bosnia and Herzegovina
• Democratic Peoples’ Republic of Korea
• Guyana
• Iran
• Iraq
• Lao People’ Democratic Republic
Countries classified as high risk
• Myanmar
• Papua New Guinea
• Syria
• Uganda
• Vanuatu
• Yemen
Key factors (1 of 2)
The economic/ financial profile of the client;
The jurisdiction (client’s jurisdiction and the jurisdictions of the related
entities and/or source and/or destination of funds). Jurisdictions subject to
sanctions and embargoes should be excluded;
The possibility of the client being a politically exposed person (pep);
The industry of operation;
The mode of operation;
The complexity of group structures and whether this is done in order to
obscure the ultimate beneficial owner(s);
The inclusion of trusts and foundations;
The possibility of the individuals having criminal records;
Non-face-to-face business relationships;
Key Factors (2 of 2)
Negative publicity/ press articles;
Invisible ultimate beneficial owners;
Frequent changes in the legal structures of a client’s company which has no
clear justifications;
Customer has a history of changing bookkeepers or accountants;
New customer carrying out large one-off transactions;
Clients involved in business that handles large amounts of cash;
Foreign clients;
A customer who makes regular transactions with same individual or company;
•
Red flags (1 of 2)
High cash-generating business;
Stock turnover ratios etc not in line with industry standards;
Promotion arrangement with significant number of agents/ individual/
representatives/ sales persons/ principals (usually people sign up to take advantage
of discounts);
•
Frequent rotation of professional service providers;
Poor financial record history;
Prior failed business or bankruptcy;
Sudden revenue jumps/ peaks, not justified by the production levels etc;
Business/ employment history;
Unstable addresses, professional or employment history;
Significant prior litigation history as a plaintiff or defendant;
Red flags (2 of 2)
High turnover in senior management;
Short operations history; sudden growth;
No prior track record for top executive and senior management in the
business e.g. Nobody has heard of them before this company;
Foreign operations or plants. E.g. Hoping you won’t check whether there is a
factory in Ireland, or whether the production volumes p.a. Justify the
revenues p.a.
Reluctance to provide references;
Pressure to get deals done quickly;
Have past/ pending regulatory, disciplinary and other actions filed against
them.
•
Characteristics of a risk based approach( 1 of 2)
A risk-based approach:
• (a) recognises that the money laundering or terrorist financing threat varies
across customers, countries, services and financial instruments;
• (c) allows the board of directors to apply its own approach in the formulation
of policies, procedures and controls in response to the Financial Organisation’s
particular circumstances and characteristics;
Identification, recording and evaluation of
risks(1 of 5)
• The identification, recording and evaluation of risk that the Financial Organisation face
presupposes the finding of answers to the following questions:
• (a) What risk is posed by the Financial Organisation’s customers? For example:
Compliance is about meeting obligations that may Risk management does not have a mandatory
have a mandatory component. component as the organisation determines how to
deal with the various risks it faces.
However, risk management may have to deal with
both mandatory and non-mandatory elements.
All compliance risks must be dealt with. Risk management is used to prioritise the compliance
risks.
Compliance identifies all the obligations an
organisation has. Risk management techniques are used to prioritise the
response to the obligations in terms of control
procedures and processes, levels of monitoring and
reporting requirements.
Shift in nature of activities
Regular activity or occasional activity
The Compliance Officer (or other designated officer) reviews the client
transactions taking place during the evaluation period as well as the
instructions given and the supporting documentation.
Warning signs that may indicate that a transaction might be suspicious are:
1. Size of transaction
2. Complexity of transaction
3. Rationality of transaction
4. International transaction with no obvious reason
Undertaking a database check
• The Compliance Officer undertakes a database search for all:
•
Registered shareholders owning more than 10%,
Ultimate beneficial owners owning more than 10%,
Directors,
Bank signatories,
Attorneys and
Authorized persons.
For all documents do the following
• (d) data of the volume of funds or level of transactions flowing through the account;
• Which of the following scenarios will most likely require the filing of a Suspicious Activity Report
• I – A dance nightclub located near a Midwestern community college, makes $9,000 cash deposits
every day. The deposited items are solely $50 and $100 bills.
• II – A check casher makes $9,000 cash deposits every day. The deposited items are primarily $10
and $20 bills.
• III – A grocery store makes multiple ATM deposits each day at around the same time. The deposits
are a combination of checks and cash – mostly smaller bills. In total, there are usually 400-500
items deposited each day.
• IV – A busy around the clock gas station / convenience store, located at a major intersection,
makes three deposits each calendar day, utilizing tellers, night drops and ATMs. The total cash
deposited on weekdays often comes near the currency reporting threshold. Monday deposits
require the bank to file Currency Transaction Reports due to the aggregation of the weekend
deposits – however, this is done in the back office without the customer’s knowledge.
• A) All of the above
• B) I and II C) I, III and IV D) III and IV
Answer
• The correct answer being “B – I and II.”
• I is suspicious as it would be unlikely that a bunch of Midwestern
community college students going out dancing would only have fifty and
one hundred dollar bills.
• II is suspicious primarily because a check casher is a consumer of cash, not
a depositor, unless there is another substantial cash generating activity
going on at the business, which was not presented in the scenario.
• III – OK, this one requires some logic. Yes there are multiple ATM deposits
made at the same time each day, but the key element here is the
statement that there are 400-500 items total in the daily deposits. Very few
ATM machines can handle an envelope that thick. Therefore your
institution’s machines force the customer to split the deposits into multiple
envelopes.
Answer
• Sometimes, there are conditions that you may assume, that prove to be
false and will reverse your view on suspicion. All that being said, I would
not view this as suspicious.
• IV – OK, a little more real world understanding. It is stated that the store
operates 24 / 7 and that it makes 3 deposits every calendar day. Many
multi-shift businesses make it a point to have a deposit made for every
shift, so, the three daily deposits would likely not be a case of structuring,
but that of a valid business decision. Also, just because the bank files the
CTRs without the customer’s knowledge, it is not suspicious. Indeed, it can
and does happen every day in the real world. To recap, I and II are
suspicious and would most likely have a SAR filed. III and IV, as presented,
would not require a SAR (in this investigator’s view).
Study questions-1 hour
• Attempt the study questions provided
Questions?