Risk Assessment1.ppt
- 1. Annual AML/CFT Risk Assessment & Investigations Md. Sahadul Hoque Principal Officer Islami Bank Bangladesh Limited Risk Management Wing
- 2. Agenda of the Session AML Risk Management Framework Why & What Risks to be assessed? How to assess AML/CFT Risk? Implications of AML Risk Assessment AML Investigations
- 3. Let’s Refresh our Concept of Risk Intention of the man is to suicide. Jumping from the top of the building Loss of life is certain Is the event a Risky One? Risk is the uncertainty of an expected objective (ISO 31000). Risks can be seen as a combination of the chance that something may happen and the degree of damage or loss that may result if it does occur
- 4. Why Banks are Vulnerable in ML/CFT Definition: The process of disguising the proceeds of crime in an effort to conceal their illicit origins and legitimize their future use. Objective: To conceal true ownership and origin of the proceeds, a desire to maintain control, a need to change the form of the proceeds. Banks Financial services Brokerage firms Other Examples: Insurance companies, Money remitters, Cash intensive businesses, Brokerage firms, LAWYERS and ACCOUNTANTS Money is Laundered Through
- 5. Is Money Laundering a Risk? Increased headcount Increased technology budget Reputational damage Consultancy fees Long periods of Regulatory oversight Attention from other Regulators Loss of partners, clients Regulatory Fines/Penalty
- 6. Risk Management "Narrated Aisha, Ummul Mu'minin: The Apostle of Allah (peace_be_upon_him) said: Profit follows responsibility of bearing loss. “ (Sunan e Ibn Majah Book 23, Number 3501)
- 7. AML/CFT Risk Management Framework Risk Identification Business Risk Customers Products & Services Delivery Methods or Channel Country or Jurisdiction Regulatory Risk Failure to report SARs/STRs Inappropriate customer verification Inappropriate record keeping Lack of AML/CFT Program Risk Assessment Size & Importance of Risk likelihood – chance of the risk happening impact – the amount of loss or damage if the risk happened likelihood X impact = level of risk (risk score) Risk Treatment Business Risk Minimize & Manage the Risks Apply strategy, policy & procedures Regulatory Risk: Put in place systems and controls Carry out risk plan and AML/CFT program Monitoring & Review Develop & carry out monitoring process Keep necessary records Review risk plan and necessary AML/CFT Program Do internal audit and assessment Do AML & CFT Compliance Report
- 8. Why and What AML Risks to be Assessed?
- 9. Risk Assessment According to Business Dictionary, Risk Assessment is – Identification Evaluation and Estimation of the levels of Risks And comparison against standards of an acceptable level of Risk.
- 10. Is Risk Assessment Obligatory? FATF Recommendations No. 1 To identify ML & TF Risk To assess ML & TF Risk To take action To mitigate ML & TF Risk FATF Recommendations No. 15 To assess ML & TF Risk for new products, business techniques and delivery mechanisms Using technology to asses new and existing products AML Rule 2013, Rule No. 21 RO-FI shall conduct periodic assessment Report to BFIU for vetting Assessment report to be utilized by RO-FI after vetting EDD for HIGH Risk BFIU Circular Letter No. 01/2015 dated 08.01.2015 ML & TF Risk Assessment Guideline for Banking Sector September 2015 Money Laundering and Terrorist Financing Risk Management Guideline. A Risk Register is enclosed.
- 11. Uses of Risk Assessment Identify gaps and improve policy & procedures Develop Risk Based Framework Aware Sr. Management about key risks, exits and disposals Informed decision about Risk Appetite on the basis of Residual Risk Alignment of compliance with Risk Profile Risk mitigation strategies and resource allocation Regulatory reporting for remediation efforts across the FIs
- 12. Steps of Risk Assessment Identification of Risk Assessment Categories Detailed Analysis of the Gathered Data Evaluation of AML Program
- 13. Money Laundering Risks in Banks Operational Risk Legal Risk Reputational Risk Concentration Risk
- 14. Kroll’s Findings on Risk Assessment of IBBL Risk Assessment is Partial Risk rating is done on clients’ net-worth, occupation & transaction profile only Inadequate tools, technology and methodology Poor data quality Inadequate actionable information in in Risk Assessment Report Inadequate SoP & SoD
- 15. Kroll’s Findings on Risk Assessment of IBBL
- 16. Business Risks Arises to and from Customer New customer New customer but wants to conduct large transaction Transaction to the same individual or group Cash intensive business Identification is difficult to check Large but small denominated transactions Distance between business and location of the customer Non resident customer Complex corporate ownership PEPs & IPs Unreliable documents Inconsistent transaction with source of income etc. Country/Jurisdiction any country which is unidentified by credible sources as having significant level of corruption and criminal activity any country subject to economic or trade sanctions any country known to be a tax haven and unidentified by credible sources as providing funding or support for terrorist activities or that have designated terrorist organizations operating within their country any country unidentified by FATF or FATF Style Regional Bodies (FSRBs) as not having adequate AML&CFT system any country indentified as destination of illicit financial flow
- 17. Business Risks Arises to and from (Cont’d) Product & Services private banking i.e., prioritized or privileged banking credit card anonymous transaction non face to face business relationship or transaction payment received from unknown or unrelated third parties any new product & service developed service to walk-in customers mobile banking Delivery Channel direct to the customer online/internet phone fax email third-party agent or broker.
- 18. Regulatory Risks Arises to and from Regulatory Risks customer/beneficial owner identification and verification not done properly failure to keep record properly failure to scrutinize staffs properly failure to train staff adequately not having an AML&CFT program failure to report suspicious transactions or activities not submitting required report to BFIU regularly not having an AML&CFT Compliance Officer failure of doing Enhanced Due Diligence (EDD) for high risk customers (i.e., PEPs, IPs) not complying with any order for freezing or suspension of transaction issued by BFIU or BB not submitting accurate information or statement requested by BFIU or BB.
- 19. Other Qualitative Risk Factors Other Risk Factors Client base stability Integration of IT system Expected account/client growth Expected revenue growth Recent AML Compliance Employee turnover Reliance on 3rd party providers Recent introduction of new products and services Recent project and initiatives related to AML Compliance matters Recent relevant enforcement actions National risk assessment
- 20. How to Assess Risk?
- 21. Standard Risk Assessment Methodology
- 22. Risk Assessment Scales Likelihood Scale Frequency Likelihood of an ML/FT Risk Very Likely Probably occur several times in a year Likely High probability that it will happen once in a year Unlikely Unlikely, but not impossible Impact Scale Consequence Impact of an ML/FT Risk Major major damage or effect. Serious terrorist act or large- scale money laundering Moderate Moderate level of money laundering or terrorism financing impact Minor Minor or negligible consequences or effects
- 23. Risk Matrix
- 24. Risk Score Table Rating Impact – of an ML&TF risk 4 Extreme Risk almost sure to happen and/or to have very serious consequences. Response: Do not allow transaction to occur or reduce the risk to acceptable level. 3 High Risk likely to happen and/or to have serious consequences. Response: Do not allow transaction until risk reduced. 2 Medium Possible this could happen and/or have moderate consequences. Response: May go ahead but preferably reduce risk. 1 Low Unlikely to happen and/or have minor or negligible consequences. Response: Okay to go ahead.
- 25. Risk Registrar Risk Likelihood Impact Risk Score Treatment/ Action Retail Banking Customer A new customer Unlikely Minor i) CDD shall be applied properly. ii) EDD shall also be applied for high risky clients & accounts opened without physical presence of the clients. Walk-in customer (beneficiary is government/semi government/autonomous body/ bank & NBFI Unlikely Minor Obtaining proper KYC of the Remitter Walk-in customer (beneficiary is other than government/semi government/autonomous body/ bank & NBFI Likely Moderate i) Obtaining proper KYC of the remitter/ beneficiary ii) Reporting STR/ SAR if suspicious anything found. Non-Resident customer (Bangladeshi) Likely Major i) CDD shall be done ii) verification of necessary papers/ documents including work permit, passport & visa. iii) Transaction shall be allowed with constant monitoring of the account in case of High Risk nature. iv) STR shall be submitted to CCU if any transaction found suspicious. A new customer who wants to carry out a large transaction (i.e. transaction above CTR threshold or below the threshold) Likely Moderate i) CDD shall be applied properly. ii) Verifying the genuineness of the data/ information of the client. iii) Transaction monitoring shall be done. iv) STR shall be submitted to CCU if any transaction found suspicious.
- 26. Risk Registrar Risk Likelihood Impact Risk Score Treatment/ Action Retail Banking Customer A new customer Unlikely Minor 1 Low i) CDD shall be applied properly. ii) EDD shall also be applied for high risky clients & accounts opened without physical presence of the clients. Walk-in customer (beneficiary is government/semi government/autonomous body/ bank & NBFI Unlikely Minor 1 Low Obtaining proper KYC of the Remitter Walk-in customer (beneficiary is other than government/semi government/autonomous body/ bank & NBFI Likely Moderate 2 Medium i) Obtaining proper KYC of the remitter/ beneficiary ii) Reporting STR/ SAR if suspicious anything found. Non-Resident customer (Bangladeshi) Likely Major 3 High i) CDD shall be done ii) verification of necessary papers/ documents including work permit, passport & visa. iii) Transaction shall be allowed with constant monitoring of the account in case of High Risk nature. iv) STR shall be submitted to CCU if any transaction found suspicious. A new customer who wants to carry out a large transaction (i.e. transaction above CTR threshold or below the threshold) Likely Moderate 2 Medium i) CDD shall be applied properly. ii) Verifying the genuineness of the data/ information of the client. iii) Transaction monitoring shall be done. iv) STR shall be submitted to CCU if any transaction found suspicious.
- 27. Risk Register (Summary) Sl. Risk Aspects Particulars # Questions 1 ML & TF Risk Register for Customer’s Retail Banking Customer 35 Wholesale Banking Customer 8 Khidmah Card Customer 4 International Trade Customer 10 Sub-total= 57 2 ML & TF Risk Register for Products & Services Retail Banking Product 15 Retail Privilege Facilities 2 SME Banking Product 7 Wholesale Banking Product 9 Khidmah Card Product 4 International Trade 5 Sub-total= 42 3 Risk Register for Businesses Practice/delivery methods or channels Online/BEFTN/BACH 4 Mobile Banking 3 Alternate Delivery Channel 6 International Trade 2 Sub-total= 15 4 Risk Register for Country/Jurisdiction 15 5 Register for Regulatory Risk 42 Grand Total= 171
- 28. Consolidated Risk Assessment Report (example)
- 29. Consolidated Risk Assessment Report (example)
- 30. Consolidated Risk Assessment Report (example)
- 31. Risk Assessment (Examples: Factor Weights)
- 32. Risk Assessment (Exapmles: Factor Weights)
- 33. Dependants of Risk Assessment Frequency Methodology Type & extent of interim validation Result of the Risk Assessment Material Change to the Risk Environment Regulatory intervention Trigger based Usually requires to submit assessment report annually
- 34. Implication of Risk Assessment
- 35. Implications µwgK cÖK…wZ SuywKi gvÎv ‡¯‹vi 26 ‡dªBU/wkwcs/Kv‡M©v G‡R›U D”P 3 27 wjwRsdvBbvÝ †Kv¤úvbx ga¨g 3 28 BÝy¨‡iÝ/‡eªvKv‡iRG‡RÝx ga¨g 3 29 ag©xq cÖwZôvb/ms¯’v ga¨g 3 30 we‡bv`bKvix cÖwZôvb/cvK© ga¨g 3 31 ‡gvUi cvU©m Gi e¨emv ga¨g 3 32 ZvgvK I wmMv‡i‡Uie¨emv ga¨g 3 33 Drcv`bKvix cÖwZôvb ga¨g 3 34 PvKzix (†eZb wnmve e¨vZxZAb¨ wnmve) ga¨g 3 35 QvÎ ga¨g 3 36 M„wnYx ga¨g 3 37 A‡Uv cÖvBgvix (bZzb Mvox) ga¨g 2 38 †`vKv‡bi gvwjK (LyPiv) wb¤œ 2 39 e¨emv-G‡R›U wb¤œ 2 40 ¶z`ª e¨emvqx(evwl©K Uvb©Ifvi 50 j¶ UvKvi bx‡P) wb¤œ 2 41 evox wbg©vY mvgMÖxie¨emv wb¤œ 2 42 md&UIq¨vie¨emv wb¤œ 2 43 PvKzix (ïaygvΆeZb wnmve) wb¤œ 1 44 PvKzix n‡Z AemiMÖnYKvix wb¤œ 1 45 K…wlRxex wb¤œ 1 46 Ab¨vb¨.....(aiYAbymv‡i e¨vsKwi¯‹ †¯‹vi cÖ`vb Ki‡e) `ªóe¨:KYCm¤úv`bKvixKg©KZ©vMªvn‡Kie¨emv‡qi ev†ckvi cªK…wZ,e¨emv‡qi GjvKv,e¨emv‡qi AvKvi, wnmv‡eicÖK…Zmyweav‡fvMx cÖf„wZ welqmg~nwe‡ePbvq wb‡q MÖvnK†f‡`27-46µwg‡KD‡jwLZ †ckvi †¶‡Î ewb©Z†¯‹vi A‡c¶vD”PZi †¯‹vi cÖ`vb Ki‡Z cv KYC m¤úv`bKvix Kg©KZ©vMªvn‡Ki e¨emv‡qi ev †ckvicªK…wZ, e¨emv‡qi GjvKv, e¨emv‡qi AvKvi, wnmv‡ei cÖK…Z myweav‡fvMx cÖf„wZ welqmg~n we‡ePbvq wb‡q MÖvnK†f‡` 27-46µwg‡K D‡jwLZ †ckvi †¶‡Î ewb©Z
- 36. Implications Improve policy & procedures Effective Risk Based Framework Informed decision about Risk Appetite on the basis of Residual Risk Alignment of compliance with Risk Profile Risk mitigation strategies and resource allocation Regulatory reporting for remediation efforts across the FIs Charging 1.5% of MCR for risk rating below “satisfactory” under SRP
- 37. Investigation of Risk Assessment
- 38. Considerations of Investigations Identification of all areas of business and responsibilities of business units Effectiveness of systems and internal controls Inherent risk of existing, new, potential class of customers, geographies, products, services and systems Reflection of changed events like expansion, new markets, new products, new core data processing and systems Whether crossed the assets size of defined large bank Whether assessment has been done on qualitative and quantitative data Frequency of risk assessment review Whether risk assessment is communicated to the business units and the Board of Directors Whether regulatory changes have been warranted
- 39. Major Areas of Investigation AML Corporate Governance; Management Oversight and Accountability Policies and Procedures Know Your Client (“KYC”); Client Due Diligence (“CDD”); Enhanced Due Diligence (“EDD”) Previous Other Risk Assessments (local and enterprise-wide) Management Information/Reporting Record Keeping and Retention Designated AML Compliance Officer/Unit Detection and SAR filing Monitoring and Controls Training Independent Testing and Oversight (including recent Internal Audit or Other Material Findings) Other Controls/Others
- 40. Report Contents of Internal Control Key Risk Indicators (KRIs) High Risk Processes Compliance Initiatives AML Program Deficiencies Volume SAR, STR & CTR filed Accounts closed due to suspicious activity Customer Identification Program (CIP) Violations High Risk Accounts Completed and outstanding training Source of alerts reported and investigations completed
- 41. Technical Considerations Configuration of the AML Software Logics behind the alert generation Alert Management Change Control Procedure How data is imported from the CBS Independent validation of the software Gap analysis of the AML software Volume of false positive and false negative Risk of failure of the AML software, hardware and data
- 43. Glory is to You, O Allah, and praise is to You. I bear witness that there is none worthy of worship but You. I seek Your forgiveness and repent to You. Kaffara-e-Majlish