Strengthening Your AML/CFT Framework: Ensuring Effectiveness in Practice

Aug 27

5 min read

Updated: 1 day ago

Last week in our newsletter, “Demonstrating the Effectiveness of an AML/CFT Framework,” we answered the question: How can we demonstrate that our AML/CFT framework is effective in practice, rather than merely documented in policies and procedures? Our evaluation of this key question can be seen here: Demonstrating the Effectiveness of an AML/CFT Framework.

In this week’s article, we consider one of our more frequently asked questions:

How do we know whether our customer due diligence, beneficial ownership verification, sanctions screening, transaction monitoring, and suspicious activity reporting processes are working reliably?

Introduction

Anti-money laundering (AML) regimes and frameworks across the region are supported by sub-programmes designed to mitigate money laundering risks. This article evaluates five of these sub-programmes: customer due diligence, beneficial ownership verification, sanctions screening, transaction monitoring, and suspicious activity reporting policies as implemented by financial institutions. We will identify the key factors that contribute to their success or failure.

1. Customer Due Diligence and Customer Identification

Customer identification and the collection of customer due diligence (CDD) information at account opening—and throughout the customer relationship—enable an institution to understand its customers. These customers may include individuals, companies, trusts, and other legal structures.

The term “Know Your Customer” is often used without sufficient consideration of what it means to “know” a customer. Organizations that perform this function most effectively typically share the following characteristics:

Establishment of a Customer Identification Programme: This is supported by a comprehensive Know Your Customer (KYC) form. At a minimum, the form should require customers to provide identification details, account-servicing information, and relevant disclosures regarding their politically exposed person (PEP) status.
Confirmation of Information Provided: Institutions should collect and verify appropriate CDD documentation. CDD must be maintained in an easily retrievable format and updated upon expiration.
Completion of a Formal Risk Assessment: Each customer should have a documented risk assessment using the CDD information obtained at account opening.
Development of an Expected Customer Profile: This should be based on the information provided and the results of the formal risk assessment.

The reliability of the customer identification programme is demonstrated by the entity's ability to consistently collect and maintain sufficient and appropriate CDD on the customer file. Programme reliability is also measured by its ability to inform the entity's expectation of the AML risk posed by each customer and expected activity levels to support ongoing monitoring.

2. Beneficial Ownership Verification

Beneficial ownership verification requires an institution to identify the natural person or persons who ultimately own or control a customer or who ultimately benefit from the funds or assets held in an account.

The requirement to obtain ultimate beneficial owner (UBO) information has become increasingly important over the past decade due to a lack of transparency that can arise when trusts, companies, and other legal structures are established. These structures may involve several individuals authorized to manage an account but who do not necessarily own or control the funds held in it. This can make it difficult to determine the true ownership and control of the account.

In the case of complex corporate structures, institutions may be required to prepare formal ownership charts and obtain share registers or equivalent documentation from business customers. These records help identify how ownership is distributed within the company and determine which individuals ultimately own or control the customer. The institution can then apply its CDD requirements to the relevant beneficial owners and controlling persons based on its understanding of company ownership.

The soundness of a beneficial ownership verification programme is ultimately measured by the institution’s ability to:

Identify the natural persons who ultimately own or control the customer.
Understand the customer's ownership and control structure.
Obtain and verify relevant information.
Maintain appropriate supporting documentation on the customer file.

3. Sanctions Screening

Sanctions screening is the process of checking customers, transactions, and counterparties against official sanctions lists to prevent dealings with restricted parties. This process is essential for financial institutions seeking to meet their legal and regulatory obligations and avoid facilitating financial crime. An institution’s sanctions policy should be formally documented in approved policies and procedures and should address, at a minimum:

Frequency of Sanctions Screening: This may include ongoing screening through an automated transaction-monitoring or sanctions-screening tool or screening at predefined intervals where the process is performed manually.
Official Sanctions Lists Used: The policy should identify the approved and authoritative lists against which customers, transactions, and counterparties are screened.
Change-Management Process: This should support the ongoing accuracy and completeness of the lists used by the institution. It would typically identify the persons responsible for updating each list, the approval process for changes, access restrictions, and the process for notifying users of list updates.

To assess the reliability of a sanctions-screening programme, institutions should determine whether transactions involving restricted countries, entities, or individuals are appropriately identified and assessed before processing. Where screening is automated, the system should be configured to complete screening before a transaction is processed and to generate appropriate alerts for review. Where sanctions screening is performed manually, the reliability of the process depends on staff members’ knowledge of the relevant sanction lists, the quality of the procedures they follow, and their ability to identify and place appropriate holds on restricted transactions.

4. Transaction Monitoring

Transaction monitoring is the process used by institutions to identify unusual customer behavior and potentially suspicious activity. As the name suggests, customer transactions are assessed to identify patterns, trends, or activities that may indicate money laundering or other financial crime.

The nature, extent, and frequency of transaction monitoring should be proportionate to the volume, nature, and complexity of the institution’s business and transactions. Institutions handling large volumes of complex or higher-risk transactions should increase the frequency and depth of monitoring to ensure that their reviews are sufficient to detect unusual activity. Conversely, organizations with fewer transactions of less complexity may reduce the frequency of monitoring to align with their business operations.

The reliability of an institution’s transaction-monitoring process is demonstrated by its ability to:

Promptly identify unusual or potentially suspicious activity.
Escalate alerts appropriately.
Conduct timely and effective investigations.
Take appropriate action based on the investigation findings.

Case investigations should be formally documented to provide a clear audit trail of the alerts reviewed, the analysis performed, the conclusions reached, and any subsequent actions taken.

5. Suspicious Activity Reporting

Suspicious activity reporting is a critical component of a reliable AML programme. The submission of a suspicious activity report (SAR) to the Money Laundering Reporting Officer (MLRO), followed, where appropriate, by a submission to the authorities, represents the culmination of several supporting AML activities. The reliability of this process is measured not only by the existence of a clearly documented and operationalized SAR process but also by the following factors:

Quality of SARs Submitted: A well-prepared SAR should clearly explain the reasons for the suspicion, include relevant background information, identify the transactions or activities of concern, and be supported by valid and appropriate documentation.
Compliance with Reporting Timelines: Staff members and the compliance team should be able to identify, escalate, investigate, and submit SARs within the applicable regulatory and internal reporting deadlines.
Effectiveness of Escalation Procedures: Staff should understand when and how to escalate potentially suspicious activity to the compliance function or MLRO.
Volume and Appropriateness of Reporting: The number of SARs submitted by personnel to Compliance, together with the corresponding submissions made by the MLRO, should be assessed in context. Reporting volumes alone do not demonstrate reliability; the quality, consistency, and appropriateness of the reports are equally important.

Conclusion

The soundness of an entity’s AML programme depends on whether each sub-programme operates as intended and whether components work together effectively. A reliable AML framework should enable an institution to: