In Stephen Covey's "The Seven Habits of Highly Effective People," Habit Two is "Begin with the end in mind." Customer Identification is the start of the KYC process. Basically, a thorough customer identification procedure can set the stage for best practices throughout the entire onboarding process. One variable is how much data is the front desk or the relationship manager responsible for acquiring? Weaker firms in terms of process required only the customer's name. Stronger, process oriented firms had relationship managers getting address and other basic dBSocumentation from the customer, which was then verified by the due diligence team.
Our experience with "how customer identification is achieved" varies widely from firm to firm and occasionally from department to department. In some cases customer identification is handled with aplomb by the relationship managers dealing with the customer, in other cases customer identification responsibilities are delegated to the customer due diligence team. When customer identification is given to the Customer Due Diligence (CDD) team, the method of communication between the relationship manager and the CDD team is where a best practice can most effectively be deployed.
We found three ways this communication is completed:
- Unstructured—essentially no process.
- Structured—through a request form or email that is used consistently.
- System-to-system—electronic communication from a relationship management system to a KYC/onboarding system.
As a general rule, financial institutions with unsystematic data entry mechanisms also had an overall poor KYC process. Therefore, a crucial "best practice" recommendation is to start the process in a robust manner. Without a clean and precise data entry process, it is practically impossible for a financial company to create an accurate onboarding audit trail (which will be discussed later in greater detail). Another potential risk is that the on-boarding process from initiation to completion includes many expensive, manual processes that can take days or weeks to finalize.
Often, an unsystematic process requires scanning or re-keying information into multiple internal and external back-office systems, which increases the risk of inaccuracies and spelling mistakes. To address these issues, companies should invest in an electronic data system that enables staff to key information once and then have duplicate data auto-populated into other areas of the same form or into other forms.
This will become even more critical as regulations such as FATCA become effective as the customer identification process becomes more complex, with various indicia being required to determine if the client falls under the FATCA regime. There are likely to be regulations that are similar to FATCA in other jurisdictions in coming years.
Regulatory Highlights in KYC
The CDD area is where Alacra has the most experience so we have taken a more detailed look at the CDD process by breaking it up into three sections: risk-based approach; sanctions lists, PEPs and database checks; and beneficial ownership. Directly below are excerpts that reveal the vagueness of regulatory instructions for CDD and KYC; we will have other more specific regulatory examples in the sections that follow.
FFIEC/BSA (Federal Financial Institutions Examination Council/Bank Secrecy Act): As stated in CDD Overview of the BSA Manual, "the objective of CDD should be to enable the bank to predict with relative certainty the types of transactions in which a customer is likely to engage. These processes assist the bank in determining when transactions are potentially suspicious. The concept of CDD begins with verifying the customer’s identity and assessing the risks associated with that customer. Processes should also include enhanced CDD for higher-risk customers and ongoing due diligence of the customer base."
FSA (Financial Services Authority, UK): The UK Financial Services Authority Discussion Paper 22: Reducing Money Laundering Risk; August 2003 states, "although there are no specific legal or regulatory KYC (as opposed to simple identification) requirements, high-level obligations in the Money Laundering Regulations and the FSA Handbook require a firm to counter the risk of money laundering,"
FATF (Financial Action Task Force): "Financial institutions should be required to undertake customer due diligence when:
a) Establishing business relations
b) Carrying out occasional transactions over a designated threshold
c) There is a suspicion of money laundering or terrorist financing
d) The financial institution has doubts about the veracity or adequacy of previously obtained customer data.
CCD includes identifying and verifying the customer's identity; identifying the beneficial owner; understanding the business relationship; conducting ongoing due diligence on the business relationship,” according to FATF Recommendations.
Best Practices in Customer Identification
While only the language from the FSA says, "there are no specific legal or regulatory KYC requirements," the truth is that there are few KYC process mandates in any of the jurisdictions in which Alacra has clients. This has led to a wide range of practices across firms and across department within firms. Whereas the stronger firms have robust practices in place for each of the next remaining sections of this paper, we’ve seen weak customer identification followed by a handful of Google searches and some paper files constituting an entire KYC effort.
Here are a few overall best practices before we get into more specific customer due diligence areas. These might seem obvious, but a surprising number of financial institutions do not have these practices in place.
1. Anywhere you can create a process you should create a process. In a regulatory audit, having onboarding professionals conducting due diligence in a consistent fashion will indicate the organization takes KYC seriously and has trained employees on how to do their jobs effectively.
2. Have an audit trail for each investigation. This will prove that the onboarding process was adhered to for each and every investigation and that there was no material adverse data as of the investigation date.
3. Have a "do not do business with" database. This will eliminate unnecessary work and indicate to regulators that you’re keeping track of bad guys.
4. Have a database of entities that have been successfully onboarded. This can save significant amount of resource when an existing, already vetted customer wants to do more or different business with your institution. This can also help define your refresh schedule and reduce the number of times you need to go back to the customer for more information.
5. Don’t fall behind on your refresh schedule.
For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.
Comments