CHAPTER 1
Introduction
"If there is a book that you want to read, but it hasn't been written yet, you must be the one to write it."
— Toni Morrison
About This Book
As we all know there is no magical formula for implementing pain-free anti-money laundering (AML) information systems in financial services organizations. And we also know that sharing of knowledge and best practice is critical for compliance professionals in financial institutions (FIs) to combat money laundering and terrorist financing. There have been many books on AML compliance, most of them focus on statutory, legal, regulatory compliance and business subjects but very few (only some consulting firms' white papers, not books) touch the AML information systems (IS) technical implementation in great detail. This has motivated me to write an introductory book about AML information systems implementation, from a practitioner's point of view, to share the germane experience I have gained from my previous AML and other compliance projects/programs, as well as to share the accumulated knowledge I have learned from industry subject matter experts on both compliance side and Information Technology (IT) side. Hopefully this book could provide some practical details to address some pain points in AML information systems implementation for fellow AML compliance practitioners.
In this book, an AML information systems implementation refers to an implementation of brand new or enhanced/updated or migrated AML information systems.
The Target Audience and Scope of This Book
This book is intended for compliance professionals, IT professionals and business stakeholders who are working on AML or Financial Crime Risk Management information systems implementation. And hopefully anyone who is interested in AML or financial crime risk management information systems implementation could also use this book as one of the reference sources.
Most topics discussed in this book are for banks in the United States and Canada, but the principles and frameworks mentioned in the book could also be utilized in AML information systems implementations for insurance companies, asset/investment management firms and securities dealers/ brokers in North America or other jurisdictions even though different type financial institutions have different AML regulatory requirements in different jurisdictions.
In Chapter 2 and Chapter 3, an overview of the most common and important topics in AML compliance and related information systems is provided, but readers are assumed to have some basic knowledge of financial services industry and information technology.
This book focuses on the AML information systems technical implementation, especially the implementation/project planning, and current state, future state, gap analysis as well some technical solutions/ practical approaches. The following three compliance software modules are out of the scope of this book:
1. The implementation or integration of an organization's Governance, Risk and Compliance (GRC) module.
Today, many financial institutions adapt the holistic GRC approach to comply with the numerous statutory, legal, and regulatory requirements. But GRC functions are not necessarily administered by the AML compliance program but rather by the enterprise risk management (ERM) department in an organization. Also, the implementation of a GRC platform is not dependent upon and is not necessary to have been completed earlier than the implementation of AML information systems in financial institutions.
2. The implementation or integration of an organization's AML training module.
Per the regulatory requirements, most financial institutions already have AML training programs in place prior to the AML information systems implementation, and very likely, other department(s) in the organization might own the training software and be responsible for the administration and coordination of training software usage.
3. The implementation or integration of an organization's internal auditing module.
Internal auditing tools are usually not dedicated to AML compliance only. And the implementation of internal auditing tools is very likely not dependent upon the implementation of AML information systems in financial institutions.
The technical discussions in this book are software vendor agnostic and platform neutral. Although the emphasis of this book is on AML information systems implementation, I strongly believe the planning methodologies and solution approaches could also be applied to the implementation of financial crime risk management information systems/ modules in the following areas:
• Anti-Bribery and Anti-Corruption (ABAC) (Foreign Corrupt Practices Act (FCPA) in U.S. and Corruption of Foreign Public Officials Act (CFPOA)/Canadian Criminal Code in Canada)
• Foreign Account Tax Compliance Act (FATCA)
• Fraud (including but not limited to banking fraud, investment fraud, employee fraud, tax fraud, senior/elder abuse, identity theft and other financial frauds)
• Market Conduct
• Cyber security related financial crimes
Of course, each type of financial crime has its own characteristics and red flags, but all of them do share many commonalities, in particular some common information/data elements about customers, accounts, transactions and etc.
How This Book Is Organized
The rest of this book is organized as follows. Chapter 2 provides an overview of AML laws and regulations in the United States and Canada first, and then emphasizes the key components of a sound AML compliance program in a financial institution. Chapter 3 covers an overview of key AML information systems available in the market, and then looks at some common features in two key system components, watch-list screening and transaction monitoring modules. Chapter 4 describes some challenges of AML information systems implementation first, and then proposes a unified implementation planning framework: from stakeholder analysis and the implementation governance model, up to activity breakdown for implementation planning and some other implementation management considerations. Chapter 5 discusses the practical solution approaches in the whole life cycle of AML information systems implementation – pre-deployment, deployment and post-deployment stages. In the pre-deployment part, topics of the current state, future state and gap analysis, business requirements, Commercial Off-The-Shelf (COTS) systems/vendors selection, systems specifications, architecture and design, systems building and testing are discussed. In the deployment part, topics of data loading/migration, configuration settings, production readiness check, information security, business continuity planning (BCP) and disaster recovery planning (DRP), documentation and training are discussed. In the post-deployment part, topics of support and operations, performance reporting and benchmarking, calibration and enhancements are discussed. The appendixes start with Appendix A, which covers an introduction of entity resolution and its applications to AML compliance. Appendix B provides the background information about the major funds transfer systems in the United States and Canada that are critical for AML compliance.
Acknowledgements
I would like to thank those people who were influential either directly or indirectly in the existence of this book, especial my former/current colleagues and supervisors Christine West, Brenda Meyer, Alyssa Burton, Carol Ann Levesque, Colin Simpson, Mike Jensen, Eugenio (Gene) DiMira, Rob Jones, Christine Reid, Bob Bray, Betty Havasi, Dave Sepa, Michael Rand, Raquel Garcia, Aanchal Gulia, Fiona Cowden, Lynne Butterworth, Gokul Kallambunathil, Mark Scarmozzino, Rachel Workman, Peter Romano, Uday Gulvadi, Vishnu Vellampalli, Siyu Tu, Dianjie Hou, Maolin He, Andrew Davies, Frits Fraase Storm, Pierre Isensee, Henk Huisman, Ryan Fifield, Ken Wolckenhauer, Richard Hoogenboom, Gloria Chu and many others. I also appreciate Paul McKay, Richard Hogeveen, John McEachen, Tim Traill, Brad Caron, Jeff Lapierre, Gord Willms, Andy White, Linda Buchanan, Dianne Lapierre, Jim McInnis, Kathleen Pettit, Sharon Murrell-Foster, Maureen Hurley, Gillian Embro, Wendy Voisin, Salvatore Cangialosi, Mahesh Viswanathan and other senior managers for their directly or indirectly guidance and support in my previous projects and programs.
I am greatly indebted to Michael Gerrie and Anthony Shum for their readings of the manuscript and extremely valuable suggestions. And of course, any remaining mistakes and errors are purely mine.
And, I would also like to thank the AuthorHouse team, Mae Genson, Rowella Alvaro and Joseph Elas for their help and patience in the editing of this book.
Last but not least, I would like to thank my wife, Annie, my daughter, Rita, and my extended family members around the world for their understanding and support throughout my career.
CHAPTER 2
Anti-money Laundering Compliance
"Money laundering is a very sophisticated crime and we must be equally sophisticated."
— Janet Reno
What Is Money Laundering and Terrorist Financing?
The United Nations (UN) defines Money Laundering (ML) as "any act or attempted act to disguise the source of money or assets derived from criminal activity." Essentially, money laundering is the process of making dirty money look clean.
Terrorist Financing (TF) provides funds for terrorist activities. The main objective of terrorist activities is to intimidate a population or compel a government to do, or refrain from doing, something.
Money laundering and terrorist financing share one common element — they are both keen to disguise the source and/or destination of funds.
Terrorist groups seek to develop and utilize sources of funds to obtain materials and other logistical items needed to commit terrorist acts.
The process that disguises a legitimate source of funds that are to be used for illegal purposes (in the future) is called "reverse money laundering". Since cash is anonymous and its source is nearly undetectable, from time to time, terrorist groups or criminals perform the reverse money laundering transactions to accumulate cash for illegal purposes.
The United Nations Office on Drugs and Crime (UNODC) conducted a study to determine the magnitude of illicit funds generated by drug trafficking and organized crimes, and to investigate to what extent these funds are laundered. The report estimated that in 2009, criminal proceeds amounted to 3.6% of global gross domestic product (GDP), with 2.7% (or 1.6 trillion U.S. dollars) being laundered. This falls within the widely quoted estimate by the International Monetary Fund (IMF), which stated in 1998 that the aggregate size of money laundering in the world could be somewhere between 2% and 5% of the world's GDP.
Money laundering and terrorist financing can have potentially devastating economic, security and social consequences.
The Stages of Money Laundering
There are three recognized stages that can occur simultaneously in the money laundering process: Placement, Layering and Integration.
Placement – the physical disposal of cash derived from criminal activity and the initial entry of the "dirty" cash or proceeds of crime into the financial system.
Layering – (sometimes referred to as structuring) the separation of illicit proceeds from their source by layers of financial transactions intended to obscure the audit trail and sever the link with the original crime.
Integration – the money is returned to the criminal from what seem to be legitimate sources of funds. Having been placed initially as cash and layered through a number of financial transactions, the criminal proceeds are now fully integrated into the financial system and can be used for any purpose.
The following is a real life example of money laundering:
On September 29, 2014, in Miami, Florida, USA, Alvaro López Tardón, of Miami Beach and Madrid, Spain, was sentenced to 150 years in prison and ordered to pay a $14 million forfeiture money judgment and $2 million fine. Tardón was also ordered to forfeit a significant number of assets, including luxury real estate, cars and bank accounts. Tardón was convicted on one count of conspiracy to commit money laundering and 13 substantive counts of money laundering. According to court documents, Tardón was the head of an international narcotics trafficking and money laundering syndicate which distributed over 7,500 kilograms of South American cocaine in Madrid and laundered over $14 million in narcotics proceeds in Miami by buying high-end real estate, luxury and exotic automobiles and other high-end items. The proceeds were smuggled into Miami by couriers, wire transferred to South Florida by co-conspirators, wire transferred to third parties internationally on behalf of Tardón, and wire transferred directly to Tardón and his coconspirators in Miami through Tardón's exotic car dealership and other companies controlled by him located in Madrid, Spain.
In this example, all three money laundering stages were involved:
• Placement – the money launderer(s) smuggled and deposited "dirty money" directly into bank accounts or purchased high value goods.
• Layering – deposited cash was wire transferred from one bank account to another internationally.
• Integration – laundered proceeds were put back into the economy to create the perception of legitimacy by investing the funds in real estate, luxury assets or other business ventures as well as by reselling high value goods for payment by check or bank transfer.
As the reference [6] pointed out, not all money laundering transactions involve all three distinct stages, and some may indeed involve more. Nevertheless, the three-stage classification is a useful decomposition of what can sometimes be a complex process.
Overview of AML Laws and Regulations in the United States and Canada
U.S. Laws and Regulations
The legal regime for money laundering controls that is applicable to U.S. financial institutions consists mainly of the U.S. Bank Secrecy Act (BSA) and BSA regulations, the USA Patriot Act, the U.S. Treasury Department Office of Foreign Asset Control (OFAC) regulations and the U.S. money laundering laws (including the Money Laundering Control Act). These statutes and regulations direct banks and other financial institutions to establish and maintain procedures reasonably designed to detect and report money laundering, large cash, and other suspicious transactions to the U.S. government.
There are several U.S. federal agencies that are responsible for the oversight of the various financial institutions operating in the U.S. These include the Board of Governors of the Federal Reserve System commonly known as the Federal Reserve Board (FRB), Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), Office of the Comptroller of the Currency (OCC), the Consumer Financial Protection Bureau (CFPB), and State Liaison Committee (SLC). And the SLC includes representatives from the Conference of State Bank Supervisors (CSBS), the American Council of State Savings Supervisors (ACSSS), and the National Association of State Credit Union Supervisors (NASCUS).
The Federal Financial Institutions Examination Council (FFIEC), consisting of these U.S. regulators issues BSA/AML Examination Manuals that offer guidance to examiners for carrying out BSA/AML and Office of Foreign Assets Control (OFAC) examinations. The BSA/AML Examination Manual includes guidance on identifying and controlling risks associated with money laundering and terrorist financing.
Many U.S. banks and other financial institutions use the FFIEC BSA/ AML Examination Manual as a guidance document for implementing and designing a risk-based AML program and monitoring efforts.
The FFIEC BSA/AML Examination Manual contains an overview of BSA/AML compliance program requirements, BSA/AML risks and risk management expectations, industry sound practices, and examination procedures.
Banks and other financial institutions are subject to BSA reporting and record keeping requirements set forth in regulations issued by the U.S. Treasury Department. They include but not limited to requirements applicable to cash and monetary instrument (MI) transactions and funds transfers, Currency Transaction Report (CTR) filing and exemption rules, and due diligence, certification, and other requirements for foreign correspondent and private banking accounts.
Financial institutions are required by federal regulations to file a Suspicious Activity Report (SAR) no later than 30 calendar days after the date of the initial detection by the reporting financial institution of facts that may constitute a basis for filing a report.
