Quick Reference Guide to BSA/AML Risk Assessment
- 1. Quick Reference Guide to BSA/AML Enterprise Risk Assessment By Mayank Johri & Erik De Monte 1 Introduction The AML Risk Assessment is a key pillar in a financial institution’s AML compliance program addressing BSA/AML regulations. The assessment is an essential mechanism to assist management in understanding the institution’s vulnerability to money laundering and terrorist financing including: i. Playing a critical role in the compliance governance structure. ii. Providing transparency of AML risk across businesses, product, and customer. iii. Guiding management to make informed decisions about risk appetite and implementation/prioritization of control efforts, allocation of resources, technology spend, etc. iv. Ensure both internal (i.e. senior management) and external (i.e. regulators) relevant parties are made aware of the key risks, control gaps and remediation efforts. The AML Risk Assessment calculates an aggregate AML risk rating for each line of business (LOB). The aggregate AML risk is a combination of AML risk (inherent risk) and quality of risk management (control effectiveness). The methodology is based on published regulatory guidelines and input from the institution’s AML policy office. In addition to providing insight over the points discussed above, the risk assessment acts as a foundation and an essential driver for all areas within the BSA/AML group for the period following the assessment. The following diagram outlines from a high level the risk assessment approach. Inherent risks are identified and the control environment is analyzed to understand how these risks are being mitigated. What remains is the aggregate, or residual, risk that is to be addressed. Figure 1.1 High Level Approach 2 Challenges Institutions face a myriad of challenges while conducting a risk assessment. Foremost of their challenges being sourcing data from the various LOBs which proves difficult to accomplish in a timely and efficient manner. Management of multiple documents across LOB can be extensive and reliance on LOB resources to perform data validation is time consuming. BSA/AML expertise over data is limited and the process of reviewing, cleaning up and transforming can be an onerous task. Another challenge is setting thresholds and scoring as this process is usually subjective and manual which results in an indefensible methodology to define the institution’s BSA/AML risk. 3 Solution The BSA/AML risk assessment should be considered a collaborative analytics and policy function. Across financial institutions, the acquisition and understanding of the data environment is the area in which the analytics team can act as a bridge for the BSA/AML team. Ideally, management should allocate a dedicated analytics team having BSA/AML risk expertise to take the lead by and collaborate with the policy team. Together, the team can build an automated, robust, and defensible BSA/AML risk assessment.
- 2. The investment of time and co-collaboration between Analytics and the policy office to build an automated risk assessment model will alleviate data acquisition pain points and allow the policy office to allocate more time towards their qualitative assessment (as discussed further below). The automation model can be built on a dynamic platform which will be leveraged for all subsequent year assessments. 3.1.1 Automated Data Sourcing and Extraction As discussed above, one of the largest challenges that the BSA/AML group faces is in the first phase of the assessment: data sourcing. The steps below outline the collaborative process that the BSA/AML and dedicated analytics teams can take to move towards a more efficient and technologically supported system: 1) Analytics and BSA/AML gain a collaborative understanding of data required to perform the assessment by building a comprehensive questionnaire. Review prior assessment’s data and understand any challenges that are faced in the procurement process of said data. 2) Analytics and BSA/AML map the questionnaire to data elements in various systems. Consult LOB contacts as needed. 3) Analytics team will utilize knowledge of cross-LOB systems and backend databases to build custom queries and conduct completeness and accuracy test on extracted data. Any data transformation processes which can be automated can be incorporated through data extraction queries as needed. 4) QC and validate queries for across all LOBs. Consult LOB contacts as needed. 5) Engage technical support team and build an ETL structure which allows for targeted and quality data that can be pulled daily, monthly, etc. 6) Build an AML-wide data dictionary. The benefit of building an automated data sourcing process can be seen in the visual below. Time consuming challenges faced due to manual data extraction and validation can be automated by leveraging the Analytics team. The new automated process provides a peace of mind over the data that is sourced and opens up availability for the BSA/AML team to focus on subsequent steps within the risk assessment (i.e. qualitative assessment of inherent risks, control effectiveness, etc.). Figure 3.1.1.1 Data Sourcing Automation
- 3. It is important to note the benefit of using this exercise to solidify an AML-wide data dictionary. As the risk assessment not only identifies and drives much of the BSA/AML efforts throughout the year, it also incorporates understanding the customer, product, channels, etc. data which is leveraged by all functions of the BSA/AML department in their various day to day projects. 3.1.2 End to End Automated Solution Included below is the proposed process under the new Analytics driven automation model. The process still follows the structure of a standard risk assessment (Data Sourcing, Inherent Risk, Control Assignment, Threshold and Scoring Analysis, etc.) but now includes automated processes that can be implemented using the co-collaboration of BSA/AML and a dedicated Analytics team. Figure 3.1.2.1 End to End Automated Solution This effort in turn will see the following impact: a) Automate and remove the delegated responsibility of data requests from all LOBs. b) Allow data to be pulled and presented in an already agreed upon and familiar format. c) Eliminate the preliminary data pull and validation process, freeing up more time to allocate to the assessment process. d) Integrate front end forms/repositories (i.e. SharePoint) and automate calculation of scoring based on dynamic and flexible thresholds for flexibility year over year. e) Integrate advanced data visualization tools (i.e. Tableau) for a more dynamic visual UI (i.e. real-time threshold adjustment analysis, etc.).
- 4. 4 Understanding the Risk Assessment and Additional Automation Opportunities Once data has been acquired, the BSA/AML team works to understand the inherent risks associated with the bank and the effectiveness of the controls in place to calculate what aggregate risk remains. The figure below depicts a high level understanding of the process. Each of these phases is elaborated on in further detail below and includes opportunities in which an analytics team can be leveraged to bring automation to each stage of the process. Figure 4.1 Understanding the Risk Assessment 4.1 Inherent Risk Inherent risk is defined as “the risk absent controls”. This assumes that the quality of the controls in place to mitigate money laundering or sanctions risk never result in an Aggregate Risk that is higher than Inherent Risk. The controls either mitigate or fail to mitigate Inherent Risk. For each line of business the Inherent Risk Rating is comprised of four attributes: Customer Risk, Product and Channel Risk, Geography Risk, and Other Risk. Each will need to be evaluated independently to understand the overall risk that the institution faces. 4.1.1 Customer Risk Customer Risk reviews the overall client landscape of the institution to understand what inherent risk the clients and their distribution poses to the institution. Customer Risk will be determined by reviewing the following attributes: 1. High Risk Customer Type (e.g., PIV’s, PSPs, PICs, cash intensive, etc.) 2. AI Governance 3. AML Subpoena 4. Entity Structure 5. Industry Risk 6. New Customer 7. OFAC 8. Prior SAR 9. Section 312 10. 314a Often times, a pre-existing Customer Risk Rating model can be leveraged, particularly if the model is built to incorporate the aforementioned attributes.
- 5. 4.1.2 Product and Channel Risk Product and Channel Risk reviews the various products and services offered by the institution and the channels available to the consumer to procure, utilize, and terminate these products. An in depth understanding of financial instruments and the inherent nature of these products is key in assessing the overall risk landscape of the institution given the offered products and channels. Product Risk will be determined by the following attributes: 1. Anonymity in transaction / Difficult to ascertain ultimate beneficiaries 2. Transaction related to the product can result in wire transfers to or from high risk countries 3. Complex product (i.e., involves multiple parties) 4. Involves online account services 5. Unrelated third parties receive disbursements, provide collateral, make payments or receive released collateral 6. Speed of Funds Movement 7. International transactions possible 8. Account floor requirements 9. Transactions in Products can be done with CASH It is important to note here that engagement with the LOB directors or contacts is pinnacle at this step of the assessment, particularly for any new products offered since the last assessment. Assessment of risk should not be based solely on the inherent risk of the financial product/channel alone but also with an understanding of the way in which the client base specific to the institution uses the product/channel. This is where the LOB directors or contacts can be a resource in providing insight on the expected behavior and what risks this poses to the institution as a whole. 4.1.3 Geographic Risk To understand the geographic risk is to understand the geographic impression of the financial institution. Geographic risk will pose a risk if the institution is a regional bank with branches in HIDTA and HIFCA, large institution with operations in high risk countries or an institution with private banking. In addition, geographic risk is particularly important to reassess during each assessment as different geographic areas hold different risk year to year due to changes in economic climates or political shifts (i.e. new regulations). Geographic Risk will be determined by the following attributes: 1. Citizenship 2. NRAs 3. Residence 4. Country of Formation 5. Country of Operations 6. Country of Investment 7. Country of Investors 8. Transactions from/to high/medium/low/domestic destination Additional consideration should be allocated to the anti-bribery and corruption risk assessment which can either be performed as a part of the AML risk assessment or as a supplemental risk assessment, at the discretion of the BSA/AML management. 4.1.4 Other Risks to Consider Additional risks will need to be considered that do not particularly fall into any of the aforementioned risk categories but still contribute to the overall inherent risk that the institution faces. The following are an example of some of additional risks to consider. Relevance will vary based on financial institution. 1. Are there any planned future changes to business units related to staffing in the next year - either business or compliance staff - that could impact the ability to comply with AML and perform AML compliance related tasks? 2. Have there been significant changes in marketplace (geography, customer segments, and competition/expansion), technology (systems), business processes or products within the past year? 3. Are there any dealings with counter parties that may be used to facilitate a transaction or refer a customer? 4. Does the business or technology plans take special consideration to include details surrounding customer, geography, products and system changes?
- 6. 5. What is the staff turnover for full time personnel? 6. Which channels are used to access the products offered by the business line? 7. Are there plans to grow the business inorganically through Mergers and Acquisitions? 8. Does the business rely on a vendor or a third party to carry out a process or part of a process related to compliance with AML regulations? 4.1.5 Final Calculation of Inherent Risk Once the risks have been fully vetted and quantified (at the discretion of the policy office’s procedures around quantitative assignment), the total of each of the risks are aggregated to numerate the total inherent risk. The policy office will then assess if any weights will need to be applied to any of the risk groups based on the specific financial institution. For example, if there is a considerable number of high risk customers in the population, customer risk will weigh more than other categories. Please note that this inherent risk calculation is performed separately for each LOB. Should the policy office deem it necessary, different weights will be assigned to different LOBs based on those LOB’s specific risk environment. Figure 4.1.5.1 Inherent Risk Calculation 4.2 Control Effectiveness After inherent risk is calculated for each LOB, the assessment continues to understand what controls currently exist to mitigate and address the inherent risks identified. This is performed through interviews with the respective contacts in each of the LOBs. Best practice calls for each LOB to upload all the supporting documentation on controls in a shared repository such as a SharePoint site. As needed, internal audit may be engaged at this step to provide any documentation that they hold in their repositories that would prove relevant to the assessment. The BSA/AML team then reviews the control documentation provided for each inherent risk identified. After understanding the control in place and the impact it has against the inherent risk, the BSA/AML team measures the effectiveness of the controls and each control is given a numerical value. Similar to the calculation for the inherent risk, depending on the prominence and how extensive a control is may require that a weight be applied in the calculation at the discretion of the policy office. 4.2.1 Factors and Determination Below is a table that outlines factors related to the control effectiveness of a financial institution. Included in the table are the various factors that the BSA/AML team will inquire with each LOB about and the expected documentation that would assist in the determination of the control effectiveness.
- 7. Factors Proposed Weight Determination Oversight/Culture, AML Corporate Governance/Organization xx% Culture of compliance from management, with clear roles, responsibilities, and reporting lines; number of FTEs or equivalents and skill levels Training & Staffing xx% AML training for all staff, including performance reviews IT Tools & Information Systems/Management Information/Management Reporting Record Keeping and Retention xx% Transaction monitoring systems, data platforms, systems integration Policies & Procedures / Quality Assurance/Independent Testing and Oversight (including recent Internal Audit, most recent Compliance Testing or regulatory examination specific to AML policies, procedures, or programs or Other Material Findings/Other Risk Assessments) Action Plan items noted during annual risk assessment and Action Plan items are tracked xx% AML policies and procedures, including KRIs and updates based on changes in industry practices and regulatory expectations; KYC adherence; independent monitoring (pre- and post-on boarding) and testing Monitoring/Investigations/Detection and CTR/SAR filing xx% Implementation of policies and procedures; record retention, tracking, and documentation of investigations for CTR and SAR filings Exceptions to policy or obtained approval for any exceptions to policy xx% Approval process for exceptions Know Your Customer (“KYC”); Client Due Diligence (“CDD”); Enhanced Due Diligence (“EDD”) xx% Robust KYC and EDD program FIU’s documented procedures for transaction monitoring and reporting Independent assessment for effectiveness annually xx% Third party validation of process and procedures Internal controls over general ledger suspense, sweep or other concentration accounts used to process customer funds xx% Documented controls of general ledger accounts 4.2.2 Setting Thresholds & Scoring Once inherent risk and control effectiveness assessment have been completed, the policy office will now assess: What constitutes a “high” risk? What constitutes a "moderate" risk? What constitutes a "low" risk? Without established thresholds, the policy office cannot effectively answer these questions. And without the answers to those questions, they cannot effectively determine aggregate risk.
- 8. This is where an Analytics team can be leveraged to cluster the data for threshold identification. The basic approach to clustering is to partition objects/observations into several similar subsets. By extracting data and using the clustering functions in a statistically dynamic coding language (such as R, python, etc.) these datasets can be broken down into groups of distinct clusters around one common entity within the dataset (which represents the group). As such, a single data point in a cluster happens to have the minimal average dissimilarity to all other data points assigned to the same cluster. This partition more accurately allows the assignment of a boundary (such as a target threshold to distinguish normal from unusual). Subsequently, thresholds can be set by determining the outliers and the percentile population in this outlier cluster. The advantage of using a statistically dynamic coding language is that as long as the data inputs remain consistent through each year, the same code can be run year after year to automate the threshold identification process. This allows BSA/AML to allocate more time for qualitative analysis as well as provides a defensible model backed by quantitative validation for the threshold selection process. Refer to figure5.2.2.1 below for a visual understanding behind the clustering concept in identification of thresholds for a risk attribute. Figure 4.2.2.1 Clustering and Outlier Identification 4.3 Aggregate Risk Once both the inherent risk and the effectiveness of the internal control environment have been considered, the aggregate risk can be determined. Aggregate risk is the risk that remains after controls are applied to the inherent risk. The aggregate risk rating is used to indicate whether the money laundering risks within each of the line of business are being adequately managed. Illustration of a three (3) tier risk calculation is included in the visual below: Inherent Risks Controls Strength Aggregate Risks Low 90-100% Low 80-89% Moderate <80% High Moderate 90-100% Low 80-89% Moderate <80% High High 90-100% Low
- 9. 80-89% Moderate <80% High 4.3.1 Aggregate Financial Institution Risk Once aggregate risk has been calculated for each line of business, the BSA/AML team is now able to assess the overall risk for the financial institution at an aggregate level. As discussed in section 5.1.5, the inherent risk is calculated for each line of business using the formula below. Inherent RiskLOBn = (Customer RiskLOBn )(Customer Risk Weight LOBn ) + (Geography RiskLOBn )(Geography Risk Weight LOBn ) + (Products and Channels RiskLOBn )(Products and Channels Risk Weight LOBn ) + (Other RiskLOBn )(Other Risk Weight LOBn ) As discussed in the section above, the Aggregate Risk is calculated by subtracting the control effectiveness score from the inherent risk score for each LOB. Aggregate RiskLOBn = (Inherent RiskLOBn ) − (Control EffectivenessLOBn ) Lastly, the total risk for the financial institution is calculated by aggregating each LOB’s aggregate risk where x is equal the total number of LOBs. Per the policy office’s discretion, a weight can be applied for each of the LOBs. Aggregate Financial Institution Risk = ∑(Aggregate RiskLOBn )(WeightLOBn ) x n=1