The Risk-based Approach to AML Management

by Anuj Khurana, CEO of Anaptyss, a digital solutions consulting and implementation firm specializing in transforming global BFSI operations.

Money laundering has significant consequences for organizations, society, and economies worldwide, including monetary losses, reputational damage, loss of trust in financial systems, terrorism, and economic instability.

According to the United Nations Office on Drugs and Crime (UNODC), approximately 2-5% of global GDP, up to $2 trillion, is laundered annually, underscoring the impact of money laundering.

The Risk-Based Approach (RBA) provides an effective solution to combat money laundering. By emphasizing a proactive mindset and holistic implementation approach, RBA enables robust anti-money laundering (AML) management.

Why Are Risk-Based Principles Imperative?

Adopting RBA for AML management is crucial because money laundering schemes are becoming more sophisticated and obscure.

For example, the recent Polisario-Hezbollah money laundering scandal reportedly injected tainted money into the formal financial system. It used an inventive compensation technique to abuse currency-exchange nodes.

Systemic disparity is another reason to prioritize the risk-based approach for managing AML. Banks and other financial institutions should recognize the differences across their operating ecosystems and capabilities.

Banks operate within their country’s economic and policy makeup and are subject to applicable AML regulatory mandates. They also have different internal AML policy frameworks, governance, checks & controls, and abilities to address money laundering.

These factors and the growing third-party transactions create an ideal ground for money launderers to continue dodging the law and shaping the parallel economy.

Recognizing the Endless Existence of Risks is Critical

Grasping the essence of RBA is key for countries, authorities, and financial institutions to deploy more concrete and contextualized measures for effective AML management.

The crux of the risk-based approach lies in a holistic and proactive approach that integrates controls/checkpoints, mechanisms, accountabilities, policies, products, and the business ecosystem. The central tenet and premise of RBA is “risk always exists.”

The purpose of RBA is to unify the necessary components to establish an agile and preemptive culture for a robust and realistic AML compliance framework.

Combating Money Laundering with RBA

The risk-based approach is based on identifying, evaluating, and understanding the risks. Subsequently, financial institutions need to take proportionate measures to mitigate the risks.

The Financial Action Task Force (FATF) breaks down the RBA guidance for banks into three areas: risk assessment, risk mitigation, and internal controls, governance & monitoring.

Risk assessment spans Know Your Customer (KYC) processes, including customer identification program (CIP), customer due diligence (CDD), and enhanced due diligence (EDD). KYC processes assess the customers’ risk profiles and their perceived levels and types of money laundering risks.

Verifying customer details like name, date of birth, identification, profession, financial details, etc., is the baseline to determine their risk profiles during onboarding.

EDD is the subsequent procedure for profiling (and bucketing) customers that pose high risks of money laundering and terrorism financing.

RBA identifies factors like the number of high-risk customers, jurisdiction, audit findings, target market and distribution channels, and transaction size/volume for banks to assess the risks. Institutions should also consider the information from national risk assessment databases, government organizations, BU heads, etc.

The risk mitigation stage continues the CDD processes through perpetual monitoring and reporting of suspicious transactions. Financial institutions need to install systems and practices to scrutinize transactions against factors such as the customer’s profile, banking product, and relationship.

The purpose is to identify any changes in the transaction patterns and interactions with the product to update the customer risk profile and detect suspicious transactions. FATF guidelines on RBA recommend banks to evaluate their automated systems’ efficacy for mitigating money laundering risks.

Further, the monitoring intensity depends on customers’ updated risk profiles based on CDD and audits. Banks should document the risk profiles and use them to guide the extent of ongoing monitoring for customer segments.

For high-risk customers, enhanced due diligence or EDD process is necessary as a part of the risk-based approach. EDD extends the surveillance to broader resources and activities, including adverse media screening, independent sources, intelligence reports, source verifications, and more.

Adverse media screening forms a core element of the risk mitigation strategy, entailing the real-time scanning of negative developments about a customer. Banks need to screen various sources such as news stories, social media, blogs, magazine articles, forums, etc. Additionally, they must conduct watchlist screening and PEP matching to address the risk.

Need for Internal Controls and Governance

Adequate internal controls and policy implementation are fundamental to driving the recommended actions per the risk-based approach; for example, timely reporting of suspicious activities to the Financial Intelligence Unit (FIU) and authorities or monitoring the integrity of processes and people can enable system-wide governance.

An AML domain-centric approach can drive the adoption of risk-based principles in banks by enabling a deeper understanding of their operating ecosystem and regulatory context. And the adoption of RBA is the need more than ever.