1 Who should read this chapter? This chapter is relevant, and its statements of good practice apply, to banks we supervise under the Money Laundering Regulations. It may be of interest to other firms we supervise under the Money Laundering Regulations.

1In November 2014 we published the findings of our thematic review of how small banks manage AML and sanctions risk. We assessed the adequacy of the AML and sanctions systems and controls of 21 small banks. We also looked at the extent to which the banks had considered our regulatory AML guidance, enforcement cases and the findings from our 2011 review of ‘banks’ management of high money laundering risk situations’. To this end, our sample included five banks that had also been part of our sample in 2011.

1A small number of banks in our sample had implemented effective AML and sanctions controls. But, despite our extensive work in this area over recent years, we found significant and widespread weaknesses in most of the sample banks’ AML systems and controls and some banks’ sanctions controls. We also found that AML resources were inadequate in one-third of all banks in our sample and that some overseas banks struggled to reconcile their group AML policies with UK AML standards and requirements.

1The contents of this report are reflected in FCG 1-3.

1You can read the findings of our thematic review here: http://www.fca.org.uk/news/tr14-16-how-small-banks-manage-money-laundering-and-sanctions-risk

1Useful MI provides senior management with the information they need to ensure that the firm effectively manages the money laundering and sanctions risks to which it is exposed. MI should be provided regularly, including as part of the MLRO report, and ad hoc, as risk dictates.

Examples of useful MI include:

1. • an overview of the money laundering and sanctions risks to which the bank is exposed, including information about emerging risks and any changes to the bank’s risk assessment

2. • an overview of the systems and controls to mitigate those risks, including information about the effectiveness of these systems and controls and any changes to the bank’s control environment

3. • legal and regulatory developments and the impact these have on the bank’s approach

4. • relevant information about individual business relationships, for example:

   1. ◦ the number and nature of new accounts opened, in particular where these are high risk

   2. ◦ the number and nature of accounts closed, in particular where these have been closed for financial crime reasons

   3. ◦ the number of dormant accounts and re-activated dormant accounts, and

   4. ◦ the number of transaction monitoring alerts and suspicious activity reports, including where the processing of these has fallen outside of agreed service level agreements.

1Banks should have a governance structure that is appropriate to the size and nature of their business.

To be effective, a governance structure should enable the firm to:

1. • clearly allocate responsibilities for financial crime issues

2. • establish clear reporting lines and escalation paths

3. • identify and manage conflicts of interest, in particular where staff hold several functions cumulatively, and

4. • record and retain key decisions relating to the management of money laundering and sanctions risks, including, where appropriate, decisions resulting from informal conversations.

1An effective AML and sanctions control framework depends on senior management setting and enforcing a clear level of risk appetite, and embedding a culture of compliance where financial crime is not acceptable.

Examples of good practice include:

1. • senior management taking leadership on AML and sanctions issues, for example through everyday decision-making and staff communications

2. • clearly articulating and enforcing the bank’s risk appetite – this includes rejecting individual business relationships where the bank is not satisfied that it can manage the risk effectively

3. • allocating sufficient resources to the bank’s compliance function

4. • ensuring that the bank’s culture enables it to comply with the UK’s legal and regulatory AML framework, and

5. • considering whether incentives reward unacceptable risk-taking or compliance breaches and, if they do, removing them.

1Banks must identify and assess the money laundering risk to which they are exposed. This will help them understand which parts of their business are most vulnerable to money laundering and which parts they should prioritise in their fight against financial crime. It will also help banks decide on the appropriate level of CDD and monitoring for individual business relationships.

A business-wide risk assessment:

1. • must be comprehensive, meaning that it should consider a wide range of factors, including the risk associated with the bank’s customers, products, and services – it is not normally enough to consider just one factor

2. • should draw on a wide range of relevant information – it is not normally enough to consider just one source, and

3. • must be proportionate to the nature, scale and complexity of the bank’s activities.

Banks should build on their business-wide risk assessment to determine the level of CDD they should apply to individual business relationships or occasional transactions. CDD will help banks refine their assessment of risk associated with individual business relationships or occasional transactions and will determine whether additional CDD measures should be applied and the extent of monitoring that is required to mitigate that risk. An individual assessment of risk associated with a business relationship or occasional transaction can inform, but is no substitute for, a business-wide risk assessment.

A customer risk assessment:

1. • should enable banks to take a holistic view of the risk associated with a business relationship or occasional transaction by considering all relevant risk factors, and

2. • should be recorded – where the risk is high, banks should include the reason why they are content to accept the risk associated with the business relationship or occasional transaction and details of any steps the bank will take to mitigate the risks, such as restrictions on the account or enhanced monitoring.

See regulation 20 of the Money Laundering Regulations and SYSC 6.3.1R

1The central objective of EDD is to enable a bank to better understand the risks associated with a high-risk customer and make an informed decision about whether to on-board or continue the business relationship or carry out the occasional transaction. It also helps the bank to manage the increased risk by deepening its understanding of the customer, the beneficial owner, and the nature and purpose of the relationship.

The extent of EDD must be commensurate with the risk associated with the business relationship or occasional transaction but banks can decide, in most cases, which aspects of CDD they should enhance.

Senior management should be provided with all relevant information (eg, source of wealth, source of funds, potential risks, adverse information and red flags) before approving PEP relationships to ensure they understand the nature of, and the risks posed by, the relationship they are approving.

Examples of effective EDD measures we observed included:

1. • obtaining more information about the customer’s or beneficial owner’s business

2. • obtaining more robust verification of the beneficial owner’s identity on the basis of information obtained from a reliable and independent source

3. • carrying out searches on a corporate customer’s directors (or individuals exercising control) to understand whether their business or integrity affects the level of risk associated with the business relationship, for example because they also hold a public function

4. • using open source websites to gain a better understanding of the customer or beneficial owner, their reputation and their role in public life – where banks find information containing allegations of wrongdoing or court judgments, they should assess how this affects the level of risk associated with the business relationship

5. • establishing the source of wealth to be satisfied that this is legitimate – banks can establish the source of wealth through a combination of customer-provided information, open source information and documents such as evidence of title, copies of trust deeds and audited accounts (detailing dividends)

6. • establishing the source of funds used in the business relationship to be satisfied they do not constitute the proceeds of crime

7. • commissioning external third-party intelligence reports where it is not possible for the bank to easily obtain information through open source searches or there are doubts about the reliability of open source information, and

8. • where the bank considers whether to rely on another firm for EDD purposes, it ensures that the extent of EDD measures is commensurate with the risk it has identified and that it holds enough information about the customer to carry out meaningful enhanced ongoing monitoring of the business relationship – the bank must also be satisfied that the quality of EDD is sufficient to satisfy the UK’s legal and regulatory requirements.

See regulation 7 of the Money Laundering Regulations.

1In addition to guidance contained in FCG 3.2.9G:

1. • compliance has adequate oversight over the quality and effectiveness of periodic and event-driven reviews, and

2. • the firm does not place reliance only on identifying large transactions and makes use of other ‘red flags’.

Transaction monitoring

Examples of red flags in transaction monitoring can include (this list is not exhaustive):

1. • third parties making repayments on behalf of the customer, particularly when this is unexpected

2. • repayments being made from multiple bank accounts held by the customer

3. • transactions that are inconsistent with the business activities of the customer

4. • the purpose of the customer account changing without adequate explanation or oversight

5. • transactions unexpectedly involving high-risk jurisdictions, sectors or individuals

6. • early repayment of loans or increased frequency/size of repayments

7. • accounts with low balances but a high volume of large debits and credits

8. • cumulative turnover significantly exceeding the customer’s income/expected activity

9. • debits being made shortly after credits of the same value are received

10. • the customer making frequent transactions just below transaction monitoring alert thresholds

11. • debits to and credits from third parties where there is no obvious explanation for the transaction, and

12. • the customer providing insufficient or misleading information when asked about a transaction, or being otherwise evasive.

Customer reviews

Banks must keep the documents, data or information obtained as part of the CDD process up to date. This will help banks ascertain that the level of risk associated with the business relationship has not changed, or enable them to take appropriate steps where it has changed.

Examples of factors which banks may consider when conducting periodic reviews.

1. • Has the nature of the business relationship changed?

2. • Does the risk rating remain appropriate in the light of any changes to the business relationship since the last review?

3. • Does the business relationship remain within the firm’s risk appetite?

4. • Does the actual account activity match the expected activity indicated at the start of the relationship? If it does not, what does this mean?

Examples of measures banks may take when reviewing business relationships:

1. • assessing the transactions flowing through the customer’s accounts at a business relationship level rather than at an individual transaction level to identify any trends

2. • repeating screening for sanctions, PEPs and adverse media, and

3. • refreshing customer due diligence documentation, in particular where this is not in line with legal and regulatory standards.

See regulation 8 of the Money Laundering Regulations.

1In addition to guidance contained in FCG 7, examples of good practice include:

1. • firms carrying out ‘four-eye’ checks on sanctions alerts before closing an alert or conducting quality assurance on sanctions alert closure on a sample basis

2. • firms regularly screening their customer database (including, where appropriate, associated persons, eg, directors) against sanctions lists using systems with fuzzy matching capabilities, and

3. • specified individuals having access to CDD information held on each of the bank’s customers to enable adequate discounting of sanctions alerts.