Emerging Threats in Financial Crimes

your excellencies friends hello everybody um welcome to this highly anticipated panel on the emerging threats in financial crime I'm stepen Ray from AML intelligence the global regulatory intelligence platform for financial crime compliance anti-money laundering and anti-financial crime I'm delighted to be joined on the panel today by Sarah rungi executive managing director at K2 integrity and of course James tb's partner at anchara Sarah and James will help navigate Around The Perennial issue of AML and AFC its ever evolving nature the Regulatory regimes and getting it right so James I might start with you um what do you think are the emerging threats we are seeing in the region thank you Stephen and it's a pleasure to be here um probably too many to cover in this panel I would say there's you know there's I I would always say when we're talking about techn technology and financial crime that we're talking about familiar schemes with a different toolkit so you know if we look at this from a sort of local Regional and international level when I talk to banking clients the first thing they tell me about is fraud and and the different different types of fraud they're suffering fishing smishing will be familiar with I'm sure everybody in the room has had a text message asking whether rmx parcel has got stuck and clicking on the links that seems pretty evident to people now but nonetheless it still makes a lot of money um there's there's obviously a lot of malware floating about people clicking on email links and one of the things that I hear my clients talk about is given that we live in a very entrepreneurial part of the world there's a large number of frauds suffered by employees of new startup companies who perhaps don't have the right uh preventive mechanisms in place and that's causing a lot of knock on effect on the banks for example and other payments providers in terms of the predicate offenses and and the crimes that they see and then there's the geni which we could talk about both from a positive and a threat perspective but its capability obviously to uh to mimic to create false documentation contracts to to mimic ID Etc is a is clearly a a growing threat and I think one that that institutions and Regulators are still working to get on top of um and then some some more familiar threats so for instance money mules is a big problem um a lot of the banks particularly in Saudi Arabia saudi's launched the counter fraud framework through the Saudi Central Bank um and they're very concerned about the operation of mule accounts uh in the Kingdom um and also you know more traditional things opaque own ownership structures and benefit IAL information for example creates um you know an opportunity for people to take advantage of financial systems and on that Sarah what models can we explore to mitigate the risks uh of Technology but really any risks yeah I'm just picking up on what James said I think what's important is that we shouldn't think about these risks as as unique in a lot of ways um and the the efforts to combat them should be consistent about how we think about combating other illicit Finance risks and a key um Talking Point an area of focus over the last five or six years is on public private Partnerships um and I think this is an area that needs to be explored in a great detail more than it has so a number of jurisdictions around the world have developed these Partnerships launched these Partnerships but the outcomes and the effectiveness of them I think are really still very nent and fundamentally it has to do with bringing together government actors private sector actors and multiple parties within um the public and private sectors to share information to operationalize risk management and um you know the best examples of these are you know the US has uh a mechanism the UK has one but again I think in all contexts I think everyone is still really struggling to identify what the best outcomes are there's a tendency to view more prosecutions as um an indicaa of an effective public private partnership when in fact really should be collectively about um making the entire anti-money laundering regime more robust in terms of how we are collecting and utilizing information um transparency more broadly um enhancing transparency more broadly so um I think that there's a lot more work to be done on public private Partnerships um K2 Integrity has been working very closely with um the Iraqi government Banks the US government on a public private partnership to enhance crossb transparency as it relates to payments in Iraq that I think is a really good operational model to how we should think about taking these these these efforts forward very interesting James um I see some regulators and former regulators and former Watchdogs in in the audience what responses are Regulators employing to counter the threats I think that's a very Dynamic landscape as well I mean you know you could trace this back quite a number of years in terms of the development of regulation in the region and in the UA in general um if you look at what's happening um you know perhaps take the example of the individual to start with I mean first of all I think it's it's a lot easier to report Fort criminal activity now than it was a long time ago there's a lot of channels for doing this examples would be things like the e- crime portal but the UA accountability Authority has various methods by which private individuals and corporates can report uh can report fraud or corruption in particular and that that's that's kind of a key part in making sure that there's you know regulatory oversight is being able to identify what the problem is in the first place I think if you then go beyond that into what what The Regulators themselves are doing well um there's been a huge amount of change particularly in the in the financial crime landscapes so you know this year for example um we've had the the creation on the federal decree of the national anti-money laundering en countering the financing of terrorism and illegal organizations committee which I practiced and managed to get out all all in one go thank you very much that's that was a lot of a lot of car time practice practicing that um but that that brings new oversight and and new linkages between different parts of the infrastructure of Regulation so between the FIU the Central Bank other government organizations I think that's a key piece of it as well but also the extension of supervision and enforcement into other sectors so for example dnfbps non-financial businesses and professions of which accountants lawyers Etc are a part as well as precious metals dealers you know they now come under the purview of the ministry of economy and that supervision system has taken effect enforcement is starting to come through that's a vast population maybe 30 40,000 corporates to be able to regulate but the point is it's moving forwards and I think then when you look at particularly the work of the FIU for example and their cooperation International and I sah will have some thoughts on this as well um there's a lot of cooperation internationally and within the region in terms of information sharing and so on so really the the point I'm making is if if you look at every level down to the the individual on the street all the way through to the top levels of government there is there's change of infrastructure which is facilitating supervision absolutely and Sarah on that what what role do you think effective regulation plays I think it's important to Define what effective regulation is and um regulation in and of itself is is letters on a piece of paper that instruct the private sector to implement obligations but how is it that you actually support the effective implementation examination supervision and enforcement of those obligations and it all comes together and how it is that you take regulation how it is developed in partnership with the private sector to ensure that it is fit for purpose the guidance that is provided to support the implementation adequate resources to it for examination I mean there is a there is a huge challenge globally as more sectors are regulated that the same examiners are having additional uh entities added to their to their list of obligated entities which by definition is going to make effective examination and supervision very challenging and then the last piece is effective enforcement ultimately um examination which is followed with um supervisory framework and and findings that are in the public realm to help support and continue to Define what those obligations are that's what effective supervision um in my mind looks like I think what's challenging in the area of emerging risks is that the way the the world is kept up is by pretty much putting um existing tools which is exactly what James is saying onto the new risks so they're not new regulations defined to address the risks within the new risks they're simply you know virtual currency provide uh asset providers are regulated as money transmitters for example is that the right thing interesting question but the point is that it was easier for a lot of jurisdictions including the United States and many others to effectively put them in that box but is that effective regulation is that us keeping up with where the risks are and how we should be um identifying and addressing them absolutely and J your Well Place well placed uh what should financial institutions in the region focus on to enhance not just compliance in the space but also the customer experience yeah I'll just respond to to something that Sarah said which I think was really valid I mean the the risk assessment I'm going to talk about this when I come to the corporates as well but that is the fundamental basis of any system of preventive control and if you look at at a state level and the work that's been done on the national risk assessment there's a huge body of information intelligence datadriven um intelligence that's come out of that process recently which benefits that the I think Sarah's exactly right um when it when it comes down to the corporates St and there's a risk of sounding a bit like a consultant in giving an answer to this so I'll apologize in advance but this is generally borne out of the conversations I I have with the banks right I I still Banks and and other other financial institutions um I still feel there's a lot of work to be done on the risk assessment side and there's no there's no doubt that the burden of regulatory oversight is increasing cost is increasing um you know so so in in that context I think um risk assessment is Key Training and awareness of individuals is key and and not just in a sort of template sort of a manner not just kind of every year let's sit down and talk about what moneya laundering is right there's a what threats are we actually facing what data did we see in the last period of time 6 months 12 months what are the threats that we're aware of what's coming back to us from the FIU in a form that we can disseminate to people not just in compliance but also down at the bottom end into the branches what are those people looking for how do they become the genuine first line of defense rather than a sort of procedural mechanism and and that sort of brings together the whole piece because if you look at what the banks actually need to do in financial institutions it's it's really frankly a chronology if you get the data right at the beginning if you on board your customers properly and that data is of a high quality then pretty much everything else has got a better chance of working after that if you get that wrong then you know sanction screening is going to suffer transaction monitoring is going to suffer Etc and the investigation process becomes a lot more difficult and the amount of alerts in general terms that any institution will see is going up not down so the burden on the individuals is greater so so in that context there's I think a lot more centrally within institutions that can be done having said that um you know clearly technology is is the answer to this and that's a very very Broad and general thing for me to St and I I talked about geni upfront and some of the threats and you know potential uses of that by Bad actors the converse is obviously true fundamentally what we're dealing with is very large data volumes within an institution some of my colleagues are in the room for example we spend a lot of time working with institutions on managing their data um scrubbing it bringing it together in a form that it can be really used and then looking at the systems the TM systems and sanction screening for example um in order to make sure they're functioning correctly so I think that has to be a key plank of what uh what institutions are looking at going forwards Sarah I suppose we can't have this conversation without talking about the financial action task force and I see David Le is the former executive secretary of the financial action task force here today um so it's the global standard uh they clearly our standard Setter for this area uh so what do you think uh fatov is doing uh to address all the emerging threats we're talking about yeah before I I get to that I I want to pick up because James has said one of my my favorite things which I agree with fundamentally which is the foundation of of any compliance program being effective is the quality of the customer due diligence that is collected and and verified at the time that is the that's the Holy Grail of of a of an effective program if you get that wrong then nothing else matters because it's garbage in garbage out and it's I'm somehow coming back to the fundamentals here which is that that doesn't matter what risk you're trying to address um it does of course matter that the obligations are not consistent across different types of entities however um that is a fundamental risk mitigant as it relates to every type of illicit Finance risk so just want to double down on that um as a general matter um as it relates to the financial action task force there's a couple ways I I want to take this um conversation so for the uninitiated the FFF is the global standard Center for all things AML CFT um they revised the global standards um for moneya laundering counter uh Terrace financing and proliferation financing on approximately every 10 years although there are changes in between um and actually emerging risks related to Virtual asset service providers is a good example where they have iterated on that standard uh in between the the adjustments to the standards um the way it works is that um every country in the world is assessed against these standards um the private sector and governments do not comply the private sector doesn't comply with the fat of standards they comply with regulations that jurisdictions put in place to to comply with the fat of standards every jurisdiction in the world is assessed almost every um by the financial action task force and those reports are made public and have in some circumstances demonstrable impact on um Financial access among other things because uh a poor report can result in um challenges uh in interconnectivity um and financial relationships um the fattis um I think the most clear direct hit on emerging risks is related to Virtual asset service providers um the FFF Incorporated this into the standards um I think what's important is getting to effective implementation the fat if recognized that many jurisdictions around the world were not implementing this standard um and rather than wait for every country to be evaluated which happens approximately every 10 years the FFF accelerated um the ad des-based review and other reviews of jurisdictions complying with the obligation to apply anti-money laundering standards to Virtual currency providers the purpose being that it was viewed as a significant enough threat that waiting a decade or more for jurisdictions to be evaluated would be too long and so they have accelerated that and really iterative and I think um creative way that is is different for FFF as they've looked at this and I think it has had an impact putting pressure on jurisdictions they've published reports identifying jurisdictions that are not complying so that has had an effective impact now again though that's just a regulation so I'm going to go back to where I started doesn't matter if you have a regulation on the books if if if the entities are not examined and the obligations are not enforced but it's a good start so there's part of it I think the other thing that the fat if is spinning a lot of time on that is relevant to this is um enhancing transparency across about cross border payments so there are obligations for banks as it relates to information that travels with payments cross border um the ecosystem which gets to emerging risks has gotten very very complicated between fex money transmitters um a new entrance to the market Visa Mastercard um all of them and how it is that we all operate within the financial system I think if we all think about the way we make payments now we have multiple bank accounts we use our credit cards we're using um you know vinmo or uh refini or other crossboard payment mechanisms our payments are massively disaggregated and as a result the ability to track and Trace those payments is very challenging so fatf has put on the table um enhancing these obligations and looking to extend some of the obligations around payment transparency to non-banks which is a big deal and it's really important and again fundamentally about you know other than CDD the other really important thing is just transparency r large and how it is that we ensure transparency um is ACC companies crossb payments so that illicit activity can be tracked and traced um so those are the two main things I'd like to focus on sorry and I see under the new presidency of Eliza the Ander uh clearly fat is making some changes of its own I reckon it sees it has its own image problem uh so it's its rules will change a little bit so it's not as harsh on on smaller countries or poorer countries David or James to to find would you would you like to wrap up on what you think on on F yeah I well yes I mean I agree with Sarah entirely I think the only thing I would say in wrapping up as I said right at the beginning it'd be impossible to cover sort of all of the dimensions of this and there are a number of things that we've we've touched on that probably are worthy of a bit more air time and due course I mean you know digital assets the work of bar Etc but this is a really interesting region to work in for for all of these reasons it's very Dynamic we're close to sanction geographies we're very affected by the US government Etc um and obviously we have a casino coming at some point that will change the nature of fund flows in the country dramatically so it's a it's a really interesting space to work in absolutely and I I don't think you could be here all week without realizing you know crypto and decentralized finance and and the huge wave that's about to come come Downstream so really looking forward to that and I think it makes means our jobs will be even busier going forward uh but it's been a fascinating discussion uh thank you Sarah thank you James and look forward to picking up on this with you afterwards thank you very much indeed thank you