Risk Based Approach(RBA) in Customer Due Diligence(CDD)-FATF
A. Risk Based Approach(RBA)
The
risk-based approach (RBA) is preferable
to a more prescriptive approach in the area of AML/CFT because it is more:
- Flexible-as money laundering and terrorist financing risks vary across
jurisdictions, customers, products and delivery channels, and over time.
- Effective-as companies are better equipped than legislators to effectively
assess and mitigate the particular money laundering and terrorist financing
risks they face.
- Proportionate-because a risk-based approach promotes a common sense and
intelligent approach to fighting money laundering and terrorist financing as opposed
to a "check-the-box" approach.
- Allows firms to minimize the adverse impact of anti-money laundering procedures on their low-risk customers.
A RBA to AML/CFT means that countries,
competent authorities and financial institutions, are expected to identify,
assess and understand the ML/TF risks to which they are exposed and take AML/CFT measures commensurate to those risks in order to mitigate them effectively.
When assessing ML/TF risk, countries,
competent authorities, and financial institutions should analyse and seek to
understand how the ML/TF risks they identify affect them; the risk assessment
therefore provides the basis for the risk-sensitive application of AML/CFT
measures
The RBA is not a “zero failure” approach;
there may be occasions where an institution has taken all reasonable measures
to identify and mitigate AML/CFT risks, but it is still used for ML or TF
purposes.
A RBA does not exempt countries, competent
authorities and financial institutions from mitigating ML/TF risks where these
risks are assessed as low
B. THE RATIONALE FOR A NEW APPROACH
In 2012, the FATF updated its Recommendations to
strengthen global safeguards and to further protect the integrity of the
financial system by providing governments with stronger tools to take action
against financial crime.
One of the most important changes was the increased emphasis on the RBA to AML/CFT, especially in relation to preventive measures and supervision. Whereas the 2003 Recommendations provided for the application of a RBA in some areas, the 2012 Recommendations consider the RBA to be an ‘essential foundation’ of a country’s AML/CFT framework.
This is an over-arching requirement applicable to all relevant FATF Recommendations. According to the Introduction to the 40 Recommendations, the RBA ‘allows countries, within the framework of the FATF requirements, to adopt a more flexible set of measures in order to target their resources more effectively and apply preventive measures that are commensurate to the nature of risks, in order to focus their efforts in the most effective way’.
The application of a RBA is therefore not optional,
but a prerequisite for the effective implementation of the FATF Standards.
C. APPLICATION OF THE RISK-BASED APPROACH
Recommendation
1 sets out the scope of the application of the RBA. It applies in relation to:
Who
and what should be subject to a country’s AML/CFT regime: in addition to the
sectors and activities already included in the scope of the FATF
Recommendations, countries should extend their regime to additional
institutions, sectors or activities if they pose a higher risk of ML/TF.
Countries could also consider exempting certain institutions, sectors or
activities from some AML/CFT obligations where specified conditions are met,
such as an assessment that the ML/TF risks associated with those sectors or
activities are low.
How
those subject to the AML/CFT regime should be supervised for compliance with
this regime: AML/CFT supervisors should consider a bank’s own risk assessment
and mitigation, and acknowledge the degree of discretion allowed under the
national RBA, while INR 26 further requires supervisors to themselves adopt a
RBA to AML/CFT supervision; and
How
those subject to the AML/CFT regime should comply: where the ML/TF risk
associated with a situation is higher, competent authorities and banks have to
take enhanced measures to mitigate the higher risk. This means that the range,
degree, frequency or intensity of controls conducted will be stronger.
Conversely, where the ML/TF risk is lower, standard AML/CFT measures may be
reduced, which means that each of the required measures has to be applied, but
the degree, frequency or the intensity of the controls conducted will be
lighter.
D. CHALLENGES
Implementing
a RBA can present a number of challenges:
ALLOCATING
RESPONSIBILITY UNDER THE RBA
An effective risk-based regime builds on, and reflects,
a country’s legal and regulatory approach, the nature, diversity and maturity
of its financial sector, and its risk profile. Banks’ identification and
assessment of their own ML/TF risk should consider national risk assessments in
line with Recommendation 1, and take account of the national legal and
regulatory framework, including any areas of prescribed significant risk and
any mitigation measures defined at legal or regulatory level. Where ML/TF risks
are higher, banks should always apply enhanced due diligence, although national
law or regulation might not prescribe exactly how these higher risks are to be
mitigated (e.g., varying the degree of enhanced ongoing monitoring)
Banks
may be granted flexibility in deciding on the most effective way to address
other risks, including those identified in the national risk assessment or by
the banks themselves. The banks’ strategy to mitigate these risks has to take
into account the applicable national legal, regulatory and supervisory
frameworks. When deciding the extent to which banks are able to decide how to
mitigate risk, countries should consider, inter alia, their banking sector’s
ability to effectively identify and manage ML/TF risks as well as their
supervisors’ expertise and resources, which should be sufficient to adequately
supervise how banks manage ML/TF risks and take measures to address any failure
by banks to do so. Countries may also take into account evidence from competent
authorities regarding the level of compliance in the banking sector, and the
sector’s approach to dealing with ML/TF risk. Countries whose financial
services sectors are emerging or whose legal, regulatory and supervisory
frameworks are still developing, may determine that banks are not equipped to
effectively identify and manage ML/TF risk and any flexibility allowed under
the risk based approach should therefore be limited. In such cases, a more
prescriptive implementation of the AML/CFT requirements may be appropriate
until the sector’s understanding and experience is strengthened.
Institutions
should not be exempted from AML/CFT supervision even where their capacity and
compliance is good. However, the RBA may allow competent authorities to focus
more supervisory resource on higher risk institutions.
IDENTIFYING
ML/TF RISK
Access
to accurate, timely and objective information about ML/TF risks is a
prerequisite for an effective RBA. INR 1.3 requires countries to have
mechanisms to provide appropriate information on the results of the risk
assessments to all relevant competent authorities, financial institutions and
other interested parties. Where information is not readily available, for
example where competent authorities have inadequate data to assess risks, are
unable to share important information (i.e. due to its sensitivity) on ML/TF
risks and threats, or where access to information is restricted by, for
example, censorship or data protection provisions, it will be difficult for
banks to correctly identify (i.e., find and list) ML/TF risk and therefore may
fail to assess and mitigate it appropriately.
ASSESSING
ML/TF RISK
Assessing
ML/TF risk means that countries, competent authorities and banks have to
determine how the ML/TF threats identified will affect them. They should
analyse the information obtained to understand the likelihood of these risks
occurring, and the impact that these would have, on the individual banks, the
banking sector and possibly on the national economy for large scale, systemic
financial institutions, if they did occur19. As a result of a risk assessment,
ML/TF risks are often classified as low, medium and high, with possible
combinations between the different categories (medium-high; low-medium, etc.).
This classification is meant to assist understanding ML/TF risks and to help
prioritise them. Assessing ML/TF risk therefore goes beyond the mere collection
of quantitative and qualitative information: it forms the basis for effective
ML/TF risk mitigation and should be kept up-to-date to remain relevant.
Assessing
and understanding risks means that competent authorities and banks should have
skilled and trusted personnel, recruited through fit and proper tests, where
appropriate. This also requires them to be technically equipped to carry out
this work, which should be commensurate with the complexity of the bank’s
operations.
MITIGATING
ML/TF RISK
The
FATF Recommendations require that, when applying a RBA, banks, countries and
competent authorities decide on the most appropriate and effective way to
mitigate the ML/TF risk they have identified. This implies that they should
take enhanced measures to manage and mitigate situations in which the ML/TF
risk is higher; and that, correspondingly, in low risk situations, exemptions
or simplified measures may be applied:
Countries looking to exempt certain
institutions, sectors or activities from some of their AML/CTF obligations
should assess the ML/TF risk associated with these financial institutions,
activities or designated non-financial businesses and professions (DNFBPs) and
be able to demonstrate that the risk is low, and that the specific conditions
required for one of the exemptions of INR 1.6 are met. The complexity of the
risk assessment will depend on the type of institution, sector or activity,
product or services offered and the geographic scope of the activities that
stands to benefit from the exemption.
Countries
and banks looking to apply simplified measures should conduct an assessment of
the risks connected to the category of customers or products targeted and
establish the lower level of the risks involved, and define the extent and the
intensity of the required AML/CFT measures. Specific Recommendations set out in
more detail how this general principle applies to particular requirements
DEVELOPING
A COMMON UNDERSTANDING OF THE RBA
The
effectiveness of a RBA depends on a common understanding by competent
authorities and banks of what the RBA entails, how it should be applied and how
ML/TF risks should be addressed. In addition to a legal and regulatory
framework that spells out the degree of discretion, banks have to deal with the
risks they identify, and it is important that competent authorities and
supervisors in particular issue guidance to banks on how they expect them to
meet their legal and regulatory AML/CFT obligations in a risk-sensitive way.
Supporting ongoing and effective communication between competent authorities
and banks is an essential prerequisite for the successful implementation of a
RBA. It is important that competent
authorities acknowledge that in a risk-based regime, not all banks will adopt
identical AML/CFT controls and that a single isolated incident of
insignificant, crystallised risk may not necessarily invalidate the integrity
of a bank’s AML/CFT controls. On the other hand, banks should understand that a
flexible RBA does not exempt them from applying effective AML/CFT controls.
Countries
and competent authorities should take account of the need for effective
supervision of all entities covered by AML/CFT requirements. This will support
a level playing field between all banking service providers and avoid that
higher risk activities shift to institutions with insufficient or inadequate
supervision.
FINANCIAL
INCLUSION
Being
financially excluded does not automatically equate to low or lower ML/TF risk;
rather it is one factor in a holistic assessment. Financial exclusion can
affect both individuals and businesses, and have many reasons. For individuals,
this can include a poor credit rating or a customer’s criminal background and
institutions should not, therefore, apply simplified due diligence measures or
exemptions solely on the basis that the customer is financially excluded.
A
RBA may help foster financial inclusion, especially in the case of low-income
individuals who experience difficulties in accessing the regulated financial
system. When applying a RBA, countries may therefore establish specific cases
for exemptions in the application of FATF Recommendations (based on proven low
risks), or allow financial institutions to be more flexible in their
application of CDD measures in case of lower ML/TF risks. In this context,
financial inclusion will contribute to greater transparency and traceability of
financial flows.
RBA-GUIDANCE FOR BANKS: FATF
This consists of Risk Management Process and its Administration
A. Risk Management Process
1. RISK ASSESSMENT
The
risk assessment forms the basis of a bank’s RBA. It should enable the bank to
understand how, and to what extent, it is vulnerable to ML/TF. It will often
result in a stylised categorisation of risk, which will help banks determine
the level of AML/CFT resources necessary to mitigate that risk. It should
always be properly documented, maintained and communicated to relevant
personnel within the bank.
In identifying and assessing the ML/TF risk to which they are exposed, banks should consider a range of factors which may include:
- The nature, scale, diversity and complexity of their business;
- Their target markets;
- The number of customers already identified as high risk;
- The jurisdictions the bank is exposed to, either through its own activities or the activities of customers, especially jurisdictions with relatively higher levels of corruption or organised crime, and/or deficient AML/CFT controls and listed by FATF;
- The distribution channels, including the extent to which the bank deals directly with the customer or the extent to which it relies (or is allowed to rely on) third parties to conduct CDD and the use of technology;
- The internal audit and regulatory findings;
- The volume and size of its transactions, considering the usual activity of the bank and the profile of its customers.
A
bank’s risk assessment need not be complex, but should be commensurate with the
nature and size of the bank’s business. For smaller or less complex banks, (for
example where the bank’s customers fall into similar categories and/or where
the range of products and services the bank offers are very limited), a simple
risk assessment might suffice. Conversely, where the bank’s products and
services are more complex, where there are multiple subsidiaries or branches
offering a wide variety of products, and/or their customer base is more
diverse, a more sophisticated risk assessment process will be required.
Risk Spectrum of Products & Services:
The risk assessment should be approved by senior management and form the basis for the development of policies and procedures to mitigate ML/TF risk, reflecting the risk appetite of the institution and stating the risk level deemed acceptable. It should be reviewed and updated on a regular basis. Policies, procedures, measures and controls to mitigate the ML/TF risks should be consistent with the risk assessment.
Banks
should develop and implement policies and procedures to mitigate the ML/TF
risks they have identified through their individual risk assessment. Customer
due diligence (CDD) processes should be designed to help banks understand who
their customers are by requiring them to gather information on what they do and
why they require banking services. The initial stages of the CDD process should
be designed to help banks assess the ML/TF risk associated with a proposed
business relationship, determine the level of CDD to be applied and deter
persons from establishing a business relationship to conduct illicit activity.
Based
on a holistic view of the information obtained in the context of their
application of CDD measures, banks should be able to prepare a customer risk
profile. This will determine the level and type of ongoing monitoring and
support the bank’s decision whether to enter into, continue or terminate, the
business relationship. Risk profiles can apply at the individual customer level
or, where groups of customers display homogenous characteristics (for example,
clients with similar income range, or conducting similar types of banking
transactions) can be applied to such groups. This approach is particularly
relevant for retail banking customers.
Initial
CDD comprises:
Identifying the
customer and, where applicable, the customer’s beneficial owner;
Verifying the
customer’s identity on the basis of reliable and independent information, data
or documentation to at least the extent required by the applicable legal and
regulatory framework; and
Understanding the
purpose and intended nature of the business relationship and, in higher risk
situations, obtaining further information. In addition, banks should take
measures to comply with national and international sanctions legislation by
screening the customer’s and beneficial owner’s names against the UN and other
relevant sanctions lists.
As a
general rule, CDD measures have to apply in all cases. The extent of these
measures may be adjusted, to the extent permitted or required by regulatory
requirements, in line with the ML/TF risk, if any, associated with the
individual business relationship as discussed above under Risk Assessment. This
means that the amount and type of information obtained, and the extent to which
this information is verified, must be increased where the risk associated with
the business relationship is higher. It may also be simplified where the risk
associated with the business relationship is lower. Banks therefore have to
draw up, and periodically update, customer risk profiles, which serve to help
banks apply the appropriate level of CDD.
Where
banks cannot apply the appropriate level of CDD, Recommendation 10 requires
that banks do not enter into the business relationship or terminate the
business relationship.
The
BCBS’s guidance on the Sound management of risk related to money laundering and financing of terrorism provides detailed guidance to banks on the management of
money laundering risk in correspondent banking and in situations where banks
rely on third parties to carry out all, or part, of their initial CDD.
3. ONGOING CDD/MONITORING
Ongoing
monitoring means the scrutiny of transactions to determine whether those
transactions are consistent with the bank’s knowledge of the customer and the
nature and purpose of the banking product and the business relationship.
Monitoring also involves identifying changes to the customer profile (for
example, their behaviour, use of products and the amount of money involved),
and keeping it up to date, which may require the application of new, or
additional, CDD measures. Monitoring transactions is an essential component in
identifying transactions that are potentially suspicious.
Monitoring
should be carried out on a continuous basis or triggered by specific
transactions. It could also be used to compare a customer’s activity with that
of a peer group. It need not require electronic systems, although for some
types of banking activity, where large volumes of transactions occur on a
regular basis, automated systems may be the only realistic method of monitoring
transactions. However, where automated systems are used, banks should understand
their operating rules, verify their integrity on a regular basis and check that
they address the identified ML/TF risks.
Banks
should adjust the extent and depth of monitoring in line with their
institutional risk assessment and individual customer risk profiles. Enhanced
monitoring should be required for higher risk situations, while banks may
decide to reduce the frequency and intensity of monitoring where the risks are
lower. The adequacy of monitoring systems and the factors leading banks to
adjust the level of monitoring should be reviewed regularly for continued
relevance to the bank’s AML/CFT risk programme.
Banks
should document and state clearly the criteria and parameters used for customer
segmentation and for the allocation of a risk level for each of the clusters of
customers. Criteria applied to decide the frequency and intensity of the
monitoring of different customer segments should also be transparent.
Examples
of monitoring in high/lower risk situations
Monitoring
in high risk situations: daily transaction monitoring, manual transaction
monitoring, frequent analysis of information, considering the destination of
funds, establishment of red flags based on typologies reports, reporting of
monitoring results to senior management etc.
Monitoring
in lower risk situations: thresholds, low frequency, automated systems The
BCBS’s guidance on the Sound management of risk related to money laundering and
financing of terrorism sets out in Section II 1 (d) what banks should consider
when assessing whether their monitoring system is adequate. It stresses that a
bank should have a monitoring system in place that is adequate with respect to
its size, its activities and complexity as well as the risks present in the bank.
For most banks, especially those which are internationally active, effective
monitoring is likely to necessitate the automation of the monitoring process.
To
this end, banks should properly document, retain and communicate to the
relevant personnel the results of their monitoring as well as any queries
raised and resolved.
4. REPORTING
Recommendation
20 requires countries to mandate that if a bank suspects, or has reasonable
grounds to suspect, that funds are the proceeds of crime or are related to
terrorist financing, it shall report its suspicions promptly to the relevant
FIU. Banks should have the ability to flag unusual movement of funds or
transactions for further analysis. Banks should have appropriate case
management systems so that such funds or transactions are scrutinised in a
timely manner and a determination made as to whether the funds or transaction
are suspicious.
Funds
or transactions that are suspicious should be reported promptly to the FIU and
in the manner specified by competent authorities. The processes banks put in
place to escalate suspicions and, ultimately, report to the FIU, should reflect
this. While the policies and processes leading banks to form a suspicion can be
applied on a risk-sensitive basis, a bank should report once ML/TF suspicion
has formed.
B. INTERNAL CONTROLS, GOVERNANCE AND MONITORING INTERNAL CONTROLS
Adequate
internal controls are a prerequisite for the effective implementation of
policies and processes to mitigate ML/TF risk. Internal controls include
appropriate governance arrangements where responsibility for AML/CFT is clearly
allocated, controls to monitor the integrity of staff, in accordance with the
applicable local legislation, especially in cross-border situations and the
national risk assessment, compliance and controls to test the overall
effectiveness of the bank’s policies and processes to identify, assess and
monitor risk.
For
larger banking groups, there should be controls in place for a consistent
approach to AML/CFT controls across the group. The BCBS’s “Sound management of
risk related to money laundering and financing of terrorism” document provides
comprehensive guidance to banks on the effective management of ML/TF risk in a
group-wide and cross-border context.
GOVERNANCE
The
successful implementation and effective operation of a RBA to AML/CFT depends
on strong senior management leadership and oversight of the development and
implementation of the RBA across the bank.
Senior
management should consider various ways to support AML/CFT initiatives:
·
Promote
compliance as a core value of the bank by sending a clear message that the bank
will not enter into, or maintain, business relationships that are associated
with excessive ML/TF risks which cannot be mitigated effectively. Senior
management, together with the board, are responsible for setting up robust risk
management and controls adapted to the bank’s stated, sound risk-taking policy;
·
Implement
adequate mechanisms of internal communication related to the actual or
potential ML/TF risks faced by the bank. These mechanisms should link the board
of directors, the AML/CFT chief officer, any relevant or specialised committee
within the bank (e.g., the risks or the ethics/compliance committee), the IT
division and each of the business areas;
·
Decide
on the measures needed to mitigate the ML/TF risks identified and on the extent
of residual risk the bank is prepared to accept; and n
adequately resource the bank’s AML/CFT unit.
Examples
of steps taken by banks’ senior management to promote compliance:
·
To
carry out product development and commercial campaigns in strict compliance
with national AML/CFT legislation. n
To involve senior management in AML/CFT training of staff.
This
implies that senior management should not only know about the ML/TF risks to
which the bank is exposed but also understand how its AML/CFT control framework
operates to mitigate those risks. This would require that senior management:
·
Receives
sufficient, regular and objective information to get an accurate picture of the
ML/TF risk to which the bank is exposed through its activities and individual
business relationships;
·
Receives
sufficient and objective information to understand whether the bank’s AML/CFT
controls are effective (for example information from the Chief Compliance
Officer on the effectiveness of control, or audit reports);and
·
That
processes are in place to escalate important decisions that directly impact the
ability of the bank to address and control risks.
It
is important that responsibility for the consistency and effectiveness of
AML/CFT controls be clearly allocated to an individual of sufficient seniority
within the bank to signal the importance of ML/TF risk management and
compliance, and that ML/TF issues are brought to senior management’s attention.
This includes, but is not restricted to, the appointment of a skilled
compliance officer at management level
ENSURING
AND MONITORING COMPLIANCE
A
bank’s internal control environment should be conducive to assuring the
integrity, competence and compliance of staff with relevant policies and
procedures. The measures relevant to AML/CFT controls should be consistent with
the broader set of controls in place to address business, financial and
operating risks generally.
VETTING,
RECRUITMENT AND REMUNERATION
Banks
should check that staff they employ have integrity and are adequately skilled
and possess the knowledge and expertise necessary to carry out their function,
in particular where staff are responsible for implementing AML/CFT controls.
The level of vetting procedures of staff should reflect the ML/TF risks to which individual staff are exposed and not focus merely on senior management roles. Steps should be taken to manage potential conflicts of interest for staff with AML/CFT responsibilities. Their remuneration should be in line with principles on the independence of the compliance function in the BCBS paper on principles on compliance and the compliance function in banks.
The
effective application of AML/CFT policies and procedures depends on staff
within banks understanding not only the processes they are required to follow
but also the risks these processes are designed to mitigate, as well as the
possible consequences of those risks. It is therefore important that bank staff
receive AML/CFT training, which should be:
- Of high quality, relevant to the bank’s ML/TF risks, business activities and up to date with the latest legal and regulatory obligations, and internal controls;
- Obligatory for all relevant staff;
- Tailored to particular lines of business within the bank, equipping staff with a sound understanding of specialised ML/TF risks they are likely to face and their obligations in relation to those risks;
- Effective: training should have the desired effect, and this can be checked for example by requiring staff to pass tests or by monitoring levels of compliance with the bank’s AML/CFT controls and applying appropriate measures where staff are unable to demonstrate the level of knowledge expected;
- Ongoing: in line with INR 18, AML/CFT training should be regular, relevant, and not be a one-off exercise when staff are hired;
- Complemented by AML/CFT information and updates that are disseminated to relevant staff as appropriate.
Overall,
the training should also seek to build up a working behaviour where compliance
is embedded in the activities and decisions of all bank’s staff.
ASSESSMENT
OF CONTROLS
Banks
should take steps to be satisfied that their AML/CFT policies and controls are
adhered to and effective. To this end, their controls should be monitored on an
ongoing basis by the bank’s compliance officer. In addition, the adequacy of
and compliance with banks’ AML/CFT controls should be reviewed by an audit
function.
Recommendation
18 requires countries to require banks to appoint a compliance officer at
management level. In addition to advising relevant staff how to meet their
obligations, their role should be to monitor and assess ML/TF risks across the
bank as well as the adequacy and effectiveness of the measures the bank has put
in place to mitigate the risks. The compliance officer should therefore have
the necessary independence, authority, seniority, resources and expertise to
carry out these functions effectively, including the ability to access all
relevant internal information (including across lines of business, and foreign
branches and subsidiaries).
Examples of internal controls to encourage compliance
i Facilitate the reporting of suspicious transactions:
· Set up staff
training on mechanisms to adequately detect unusual transactions
· Establish
adequate channels to allow staff to report unusual transactions to the
Compliance Officer
· Ensure
confidentiality to staff reporting suspicious transactions
ii Allow staff to report areas of policy or controls
they find unclear/unhelpful/ineffective:
· Establish ongoing
consultation channels for staff concerning AML/CFT issues
· Ensure consistency
of the answers given to staff questions concerning AML/CFT issues
· Conduct AML/CFT activities in such a way that they are perceived by all staff as a support to the quality of the banking services provided to clients and the integrity of the bank.
Recommendation
18 also requires countries to require banks to have an independent audit
function to test the bank’s AML/CFT programme with a view to establishing the
effectiveness of the bank’s overall AML/CFT policies and processes and the
quality of its risk management across its operations, departments, branches and
subsidiaries, both domestically and, where relevant, abroad. The findings
should inform senior management’s view of the design and implementation of the
bank’s AML/CFT framework. The audit function needs to examine the adequacy of
all risk determinations and should therefore not focus exclusively on higher
risks.
Both
the compliance and audit functions should base their assessment on all
information relevant to their task including, where relevant and appropriate,
information obtained confidentially through relevant internal mechanisms or
whistleblowing hotlines. Other sources of information can include training pass
rates, compliance failures, and analysis of questions received from staff.
Comments
Post a Comment