Corporate Governance in the Age of AI

[Music] excellent welcome welcome everyone good afternoon welcome to this next session at risk 4.0 in Abby Finance week 2024 um it's my very great pleasure to be in conversation this afternoon with David Lewis David is a fellow at the Royal United Services Institute former executive secretary of the f ATF now at craw he advises governments and businesses on effectively implementing Global standards he was voted Financial crime fighter of the Year by the global coalition to fight Financial crime a public private partnership that brings together the likes of Interpol the world economic forum and major Banks now something you may not know about David is that his beneficial owner is a small Shih Tzu named morati who apparently owns and controls him that's an inside AML joke I guess and uh no public registers for that and in a past life he lived with a tribe in the highlands of West Papa David welcome back to ADW Tim lovely to be here thanks for having me thank you um also by the way I feel like that you and I are the only speakers today being fintech day that are not wearing sneakers um I guess I'm just too old school for that um David before we dive in can you just tell us a little bit about CW and your role there sure thanks Tim so I help uh governments and businesses meet Global standards on regulation compliance uh due diligence and investigations um we help firms here in the UAE set up their compliance departments Implement AI um but I also help governments with risk-based supervision um and with money laundering investigations fraud investigations corruption investigations so um uh a wide spread of activity across the uh illicit Finance area great thank you now David as many would know is a blue flame thinker around AML so it would in fact be a crime not to discuss Financial crime with him but and we'll get to that but before we do that um given the topic AML Ai and corporate governance let's start with that um you work with stakeholders around the world what are you seeing in terms of how governments and intergovernmental bodies are approaching considerations around AI the really interesting thing I think when it comes to AI is if you look back 10 years International standard Setters were saying we are technology neutral um today they are actively supporting and expecting you to use technology um but they're doing so in a in a cautious way and they're providing encouraging supervisors to provide sandboxes and so on as as we heard earlier um but they're essentially saying we don't think you can be effective in managing risk unless you are actually using these Technologies um so that is a big shift in the focus of supervision and standard Setters whether you're talking about the UN or whether you're talking about the financial action task force um and it really means firms have to get their heads around it and they have to think about um what the opportunities are but also what the risks are and how they manage it as a risk and opportunity for the business absolutely as a regulator my team and I often see boards struggle to have capacity to think about compliance issues risk issues um let alone technology issues um what are the challenges you think that Boards of companies have when they're considering the adoption of AI in their organization um and and if if need be specifically around the adoption of AI related AML tools and techniques as well so what I'm seeing when I speak to firms around the world is um they're afraid of reg risk they're afraid of you know being fined and often they don't turn to look at risk until or at least AML Financial crime risk until they've been fined and I think there's a tendency to kind of hire someone with a name um spend some money on regulation then leave it to someone else and the real risk here is that you take an unthinking approach to the adoption of AI and particularly when pressure comes on cost you think well I can cut back on a few compliance staff and I can replace them with a I but if you don't understand the data if you don't understand the problem you're trying to solve you can actually make the problem worse for boards and they have no transparency often about this um and a great example is Europe European un union today if you look at the supervisory action that's taken uh place across Europe this year some 250 financial institutions have been sanctioned for AML breaches in half of those cases there was an unthinking use of Ami AI um as part of the the reason for that breach and often this was uh earlier early deployment of AI without it being properly tested so regulatory risk now really extends to inappropriate adoption of of these Technologies and I think it's really therefore important that boards don't forget that they need to they can't just Outsource this or expect AI to replace people they need to think about the risks it brings and they're going to get done by the regulator if they just take an unthinking uh approach to to AI couldn't agree more um what are the key Global AML CFT challenges and trends that you've observed throughout your travels this year in 2024 well we heard one earlier and we had a panel on this on financial crime uh the crypto space super interesting I think it's a lot more interesting now that we know who's coming into power in the in the US next month um we have Global standards for virtual asset service providers and for virtual assets around the world um introduced in 2019 um 5 years ago yet today um only 50 countries have introduced any regulation of virtual assets so that's some 150 that haven't uh and that provides real opportunities for criminal abuse but also regulatory Arbitrage and it makes it very difficult for businesses to understand uh what the expectations are on them because it it varies so significantly from place to place so I think cryptos is an are an interesting thing to watch and the the regulation of those um interestingly uh cryptos are now the second largest political funer in the US outside uh second to fossil fuels they were the largest funder behind both campaigns in the US election um and I think us now it looks like the us are going to be stepping back a bit on the regulation of crypto so I I think that could lead to greater risk elsewhere in the world if uh if other countries follow suit so so crypto risk is a really really important one public private Partnerships we heard about earlier um there's a lot of them emerging but it's quite difficult to know well what are they there to achieve how do you do it how do you do it in a safe way how do you share information about you and I as customers of financial institutions without breaching data privacy and protection rules um and if you're going to look to AI to do that that's really quite worrying um you need to make sure that the decision for who reports suspicious activity or or who is reported on is left in the hands of people and not computers uh so I think that's that's also what one of the growing risks I'm seeing privacy Commissioners and AML Regulators are going to have to work hand in hand absolutely as a supervisor a common deficiency that we see in firms is the is is poor risk identification and poor risk management you do a lot of work at the at the National level um what are you seeing in terms of how Juris jurisdictions are approaching mltf proliferation financing risk assessment and risk risk management well in the last 10 years we saw a a requirement for countries to do a national risk assessment for moneya laundering terrorist financing and proliferation financing and most countries now do it but it often takes them two years to do one assessment it's a massive process it involves a lot of stakeholders across the the public and private sector so it's a very static process and it's also very dependent on qualitative inputs on the opinions of law enforcement on the opinions of compliance officers in Banks about what the risks are um and what we're starting to see and we need to see a lot more of is uh Reliance or use of data in that process to move to more to to a more Dynamic datadriven approach to risk assessment at both the national level um but also at the firm level at the national level it's difficult because a lot of the data isn't there but at firm level the data is there it's just often not well understood and the data hygiene around it is poor so therefore your risk assessment can often be wrong because it's based on data that's siloed that is incorrect as we heard earlier if if the wrong data or not enough data is captured at customer onboarding then you're building your R risk assessment on on poor data um and that informs all your other systems and controls so there's a real there's a real possibility that your systems and controls will not work if you're not understanding your risk and that process is still fairly fairly nent I think yeah and pulling on that thread is there anything that you've seen that distinguishes jurisdictions that are doing this well well those who include and do it in partnership with their with their regulated sector so bring in this is the government departments supervisors but also the regulated entities and have conversations with them about what they're seeing and include their data in the process so it's it's really important to do it as a partnership and that's starting starting to happen around the world and we heard about public private Partnerships in in the US and the UK I think there's appetite now and the possibility to do some here uh with technology and in Innovative use of technology so I'm quite excited about the possibilities here actually for public private Partnerships all right David we've got a few minutes left and I want to do so I want to do a lightning round of questions with you would you be up for that sure go for it okay what's one must read book or resource on financial crime can I do two okay so to understand Financial crime you need to understand the threat and the best book to understand the threat is the infiltrator by Bob Mera who was a undercover US Customs agent he laundered money for Pablo Escobar for four years there's a film called the infiltrator based on it where Bob's played by Brian cron that's for me a classic to understand stand the threat um but then a more recent one crypto launders by David kalal if you want us to understand how criminals have sought to infiltrate the the crypto verse that's a that's a great book great best piece of advice you've ever received and who gave it to you uh only do what only you can do so if you're super busy and people are coming to you to get you to do stuff focus on only the things you you know you can do uh and don't sort of take the mon monkey so this was given to me by a um Prince private secretary a Chancellor in the UK a while back is a busy busy busy lady sounds like good advice if you had unlimited time and resources what problem in the world would you try to solve Financial exclusion um it's getting harder not easier um I hate to say it but anti-money laundering all this regulation makes it a lot worse and it's pushing people outside of financial services and if you can't access Financial Services how' you buy a house how do you operate on a day-to-day basis so Financial transparency is important but actually we're not going to stop crime if we don't have money in the formal financial sector where we can follow it so I would try and solve that Financial exclusion problem and ensure that we're all dealing through transparent well-regulated financial institutions and this is one of the current FFF president's objectives and that's at the moment um any particular Financial crime case or regulatory action in 2024 that caught your attention the big one is the obviously the Canadian Bank TD Bank um biggest um prosecution of of a bank ever and when you read through some of what went on there in the last decade it's it's quite scary when I've looked into it in more detail what you don't um what you don't see in the Judgment by the US authorities is that was a data problem they didn't understand their risk because they didn't understand the data they had and going back to the the beginning of our conversation how can you put AI systems on bad data yeah absolutely um your go-to resource for staying up to date on financial crime matters I hate to say this but it's LinkedIn okay um the future of AML is it more human more AI or both there definitely both I'm not sure how much of each but you can't have ai without the human expertise to drive it and to make sense of the output last one favorite thing about the UAE well it's obviously a great place to live but I think that agile regulatory environment here and the buz you have you know there is no there's no more exciting place right now to do business with support from the regulator and right here in the uee you said it ladies and Gentlemen please let me thank David Lewis [Music] [Applause]