AlacraBlog

CICI Self-Registration Data Requires Cleaning and Vetting

We responded to a number of calls following our post last week highlighting the challenges faced by the CICI Utility with regard to self-registration. One call came from a senior executive of the DTCC, who carefully explained that many of the data issues we highlighted were the result of business rules being applied to entity registrations.
 
For example, in cases where there are Inadequate Sources to verify the registration information, the information is added to the database “as is.”

INADEQUATE_SOURCES - If the record is not a duplicate of an existing record and does not conflict with publicly available sources, the information may not be able to be found via publicly available sources. In this case, "Inadequate Sources" is noted. Source: CICIUtility

Another issue we found was that a large number of entities are tagged with the Legal Form of “Other.” This is due to the significant number of Funds in the database, for which there is no legal form classification.
 
In an effort to improve data quality, the DTCC plans to establish a vendor workgroup that, working together, can enhance the business rules and data accuracy of the CICI and ultimately the LEI. We at Alacra look forward to joining the group.
 
In the interim, Alacra thoroughly checks each of the Certified CICI entities before admitting it to the Alacra Authority File. This is the process the Alacra Reference Data team follows to handle quality assurance and data corrections.

• Split records into groups with
  • populated data and
  • unpopulated data fields.
• For records with populated data fields
  • Correct information in the wrong fields (city/state attributes switched).
  • Review populated fields and correct any internal inconsistencies (postal not matching country).
• For records with missing data
  • Populate missing data from inference off another field. (Infer city from postal).
• Correct spelling mistakes.
• Expand address abbreviations.
• Format address attributes in consistent format per country. Note: we do not verify the reported address.
• Remove notations from the name field.
• Expand name abbreviations.

We have made thousands of changes to date when we add Certified CICI entities to the Alacra Authority File.  The result is an accurate, consistently populated database containing all Rated, Regulated, Listed and Certified CICI (and other pre-LEI) entities that can be used as a reference data backbone or can enhance the accuracy of an existing reference data repository.

If you would like to stay in touch with us about our approach and view of reference data, Sign up here.

 

Ongoing Monitoring–Best Practices

All the financial institutions we’ve worked with have deployed a transaction monitoring system that alerts the bank to suspicious activity. Sophisticated financial institutions have entities exhibiting unusual activity automatically sent to the due diligence team for review. This review results in the KYC information for that entity being updated.

Firms also monitor or refresh their customer and counterparty due diligence information on a regular schedule: high-risk entities every six months to a year; medium-risk entities every two years; low-risk entities every three years. Some larger banks monitor their customers much more closely, screening entities on a daily basis against commercial databases of Sanction List hits and adverse news.

Ongoing Monitoring–Regulatory Highlights

BSA/Patriot Act: “As due diligence is an ongoing process, a bank should take measures to ensure account profiles are current and monitoring should be risk-based. Banks should consider whether risk profiles should be adjusted or suspicious activity reported when the activity is inconsistent with the profile.”¹⁷

FinCEN: “Based on past efforts and ongoing industry and regulatory consultation and outreach, FinCEN believes that an effective CDD program includes conducting ongoing monitoring of the customer relationship and conducting additional CDD as appropriate, based on such monitoring and scrutiny, for the purposes of identifying and reporting suspicious activity.”¹⁸

FATF: “Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of the relationship to ensure that the transactions being conducted are consistent with the institutions knowledge of the customer, their business and risk profile, including, where necessary, the source of funds.”¹⁹

For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.

Sanctions Lists, PEPs, and Database Checks–Best Practices

Again, communication is critical. Those firms that utilized electronic communication from the relationship manager to the onboarding team had better processes overall. In some cases searches of various databases (sanctions lists, PEPs, adverse news) were run automatically on the verified customer name from the relationship management system. This eliminated re-keying of data, which is a surprisingly costly effort and contributes significantly to operational risk. One firm admitted, “It’s not that unusual for us to vet the wrong person.”

A question we often get is, “What do other banks do in terms of database searches. Answers vary widely for these reasons:

1. More searching/researching creates higher costs and everyone wants to reduce costs.

2. Similarly, more searching/researching will generate more false positives, which also leads to higher costs and everyone wants to reduce costs.

3. No one will readily admit the amount of KYC due diligence they are conducting to actually prevent money laundering and terrorist financing and how much KYC they are doing to meet the vague regulatory requirements of the jurisdictions in which their companies operate. In other words, they are covering their backside.

At a minimum, all clients are searching sanction lists and adverse news.

Many firms search on the verified customer name as well as on a set of name variations and potential aliases using commercial software or an in-house system. Most firms also search their own “do not do business with” list that was a component of their research. In the US, commercial banks making significant loans often search legal databases for criminal record, liens, judgments and changes of address.

For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.

Sanctions Lists, PEPs, and Database Checks–Regulatory Highlights

Nowhere in the regulations are financial institutions instructed to use a proprietary database or conduct a proscribed level of research when onboarding a new customer or counterparty. Yet this is where the bulk of the money is spent: in database costs, workflow tools, and investigative labor. As this is where the money is, we have provided a number of detailed best practices with regard to the research component of KYC.

Patriot Act: Section 326 says all banks must have a written CIP that describes client entity verification and determine whether the name of the new customer appears on any government list of known or suspected terrorists or terrorist organizations. Banks should take all reasonable steps to ensure that they do not knowingly or unwittingly assist in hiding or moving the proceeds of corruption by senior foreign political figures, their families, and their associates. Because the risks presented by PEPs will vary by customer, product/service, country, and industry, identifying, monitoring, and designing controls for these accounts and transactions should be risk-based.¹⁴

FSA: “Firms need to ensure that prospective and existing customers are assessed for being potential PEPS, either under the definition set out in the Money Laundering Regulations ("MLR's") or by reference to a wider definition…In this regard it is important to remember that PEPs include those who are family members or "known associates" of PEPs.”¹⁵

FATF: “Financial institutions should be required, in relation to politically exposed persons (PEPs) (whether as customer or beneficial owner) in addition to performing normal CDD measures to: a) have appropriate risk-management systems to determine whether the customer or the beneficial owner is a politically exposed person; b) obtain senior management approval for establishing (or continuing, for existing customers) such business relationships; c) take reasonable measures to establish the source of wealth and source of funds; and d) conduct enhanced ongoing monitoring of the business relationship.”¹⁶

For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.

The Effect of M&A Activity on Reference Data

Although M&A activity picked up late in 2012 and in the first quarter of 2013, overall 2012 was a slow year, as was the entire post-financial crisis period.  Despite low interest rates and huge amounts of cash on corporate balance sheets, M&A activity over the past few years has been subdued. 



But subdued M&A activity is not the same as no M&A activity.  Deals were closed last year and these deals had an impact on every financial institution’s client and reference databases.  The targets all have new ultimate parents, many had address changes and in some cases their domicile has changed.  When I discussed this issue with several clients and asked them to check if the changes created by some of deals were reflected in their “golden copy,” several were surprised to discover that their data was out of date.  These errors had flowed through to a number of other silos within their organizations, and they expressed concern about some quality aspects of their database they thought they had under control.  When I left they were happy that I had come, but seemed happier that I was leaving.

How many deals are there that matter?

In 2012 there were over 350 deals announced in the financial services industry with a deal value of over $100MM. This includes deals where the target was a commercial bank, a bank holding company, credit union, investment or commodity firm, a broker-dealer, or an exchange.  In these deals the targets were very likely to be clients or counterparties of other financial institutions.  Of these deals more than half were cross-border. 

While every firm subscribes to one or more corporate actions feeds to support trading operations and reduce financial risk, our experience is that many firms are not focused on corporate events that may affect their reference data repositories and the risk ratings of their clients and counterparties.  The Alacra Authority File was created to meet these needs. 

The Alacra Authority File is a database of 210,000 entities that are the common clients and counterparties of large financial institutions – regulated, listed, rated and having certified CICIs.  To keep the Alacra Authority File up-to-date, Alacra monitors dozens of sources so we are alerted about merger and acquisition activity, spin-offs, bankruptcies and any other event that might lead to a change in an entity’s ultimate parent or address.  Our research team then investigates the alert and makes changes to the database when they confirm the event has occurred.  These events can be seen in Alacra’s Counterparty Intelligence Application and are reflected in the change feeds we send to clients every day.



Keeping reference data repositories or your “Golden Copy” accurate and up to date is an expensive, time-consuming process.  The expected increase in M&A activity is one factor that will make this harder in the near future.  The Alacra Authority File can help.
 
Ask Alacra to do a free checkup of the health of your reference data.  We’ll prove to you we can improve the accuracy and add value to your client and counterparty data.

Sign up for our monthly Alacra Reference Data Alert email.

 

Best Practices in Beneficial Ownership Identification

Identifying beneficial owners is the most difficult part of the onboarding process. In the seven years Alacra has been providing compliance solutions, we have seen the beneficial ownership requirements increase dramatically. Early on, only owners of 50% or greater needed to be identified. Then for several years most institutions were collecting information on 25% and above owners. Now many firms are interpreting the FATCA requirement to be owners of 10% and above. Financial institutions are revolting against FinCEN’s recently proposed plans to make beneficial ownership verification even more difficult. Once you have established who the beneficial owners are (and in many cases the officers and directors) each individual (often referred to as a related entity) must have a PEP check, sanctions check and adverse news search run on them.

In terms of acquiring beneficial ownership information, we’ve seen a wide range of techniques and databases used. One flaw we’ve seen in some banks is that they conduct entity due diligence separately from their beneficial owner due diligence. Our best practice recommendation is to keep the related entities—officers, directors and beneficial owners—together in the same investigation with the customer or counterparty being vetted.

Beneficial Ownership–Regulatory Highlights

Patriot Act (USA Patriot Act): The final rules similarly provide that, based on a financial institution's risk assessment of a new account opened by a customer that is not an individual, a financial institution may need to take additional steps to verify the identity of the customer by seeking information about individuals with ownership control over the account, including signatories.¹⁰

FinCEN: On Feb. 29, 2012, FinCEN issued an ANPR (Advance Notice of Proposed Rulemaking) seeking comments on a proposed CDD regulation that would explicitly require covered financial institutions to institute defined programs to identify the real or beneficial ownership of accountholders. FinCEN noted in its ANPR that there currently are two limited circumstances (concerning private bank accounts and correspondent accounts) in which financial institutions are expressly required to obtain beneficial ownership information, and that it is considering expanding the explicit requirement to obtain beneficial ownership information to all customers.¹¹

FATCA: The Internal Revenue Service has published a draft of Form W-8BEN-E, which overseas entities must use to certify beneficial ownership status for US withholding tax purposes under the Foreign Account Tax Compliance Act. Depending on which of the 22 different descriptions that they correspond to in Part 1, which deals with the identification of the beneficial owner, entities are directed to different sections of the 25-part document.¹²

FATF: “Identifying the beneficial owner, and taking reasonable measures to verify the identity of the beneficial owner, such that the financial institution is satisfied that it knows who the beneficial owner is. For legal persons and arrangements this should include financial institutions understanding the ownership and control structure of the customer.”

For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.

(This is Part 5 of an ongoing series - Best Practices in KYC for Financial Institutions)

Compliance Speakers at ACAMS 2013 Remind Everyone to Watch it All

Alacra is visiting ACAMS 2013 in Florida this week, joining our friends and partners in the key KYC compliance space to help firms of all types stay within the bounds of the law.

On the first full day of the conference, we heard from some of the luminaries of the financial crime and compliance space, including OFAC Director Adam Szubin and a panel comprised of the top compliance executives, including David Clark from Barclays Wealth & Investment Management, William Langford of Citigroup, Timothy Leary of the Federal Reserve Bank Board of Governors, Richard A. Small of American Express, and the OCC’s John Wagner.

The morning began with remarks by OFAC’s Mr. Szubin. To paraphrase Mr. Szubin, sanctions rules are the last effort before military action. Sanctions are designed to change behavior through material or financial pressure. Given the gravity of sanctions in diplomacy, it stands to reason that sanctions lists are taken very seriously by many states, and even more so with the new reality of compliance enforcement against individuals.

During Mr. Szubin’s speech, he reminded the many compliance professionals that countries under pressure, like Iran and North Korea, are using new tactics to use their foreign assets in contradiction to US and UN sanctions. Non financial firms are now used as middle men and as trade conduits, some willingly, others unaware. So it is no longer enough to vet typical financial counterparties. Director Szubin emphasized that enforcement actions can and will be taken against firms who do not take appropriate steps to verify counterparties of all types. Even mid-sized rural banks could be misused and it is up to the bank to ensure their clients are above board.

Which leads us to a thought that was not emphasized in the morning sessions: firms of all types can and should use KYC tools to better ensure they are not exposed to legal as well as reputational risk. Dodgy suppliers can quickly ruin a clean environmental or labor record in a matter of minutes given today’s fast moving information. Avoid the costs of reputational repair—and fines—by implementing a consistent approach to your KYC workflow.

After Mr. Szubin, we heard from a feisty panel on risk based approaches and what to expect from examiners. While there was no consensus on what risk based approaches really meant, everyone agreed that the process was critical to ensuring consistency and regulatory compliance.

During the Caribbean session on Global Tax Compliance, Cherise Cox-Nottage of UBS Bahamas noted that banks are caught in the middle—between their government obligations and their obligations to client service. Balancing these needs well and legally will be the hallmark of future banking.

Looking forward to today’s sessions. See you around the floor!

Lower Your Cost of Compliance with the Latest Release of Alacra Compliance Enterprise

New ACE Features Streamlined Workflow Resulting in Dramatically Reduced Case Investigation Times

We are delighted to announce the latest release of Alacra Compliance Enterprise for global financial institutions. Alacra Compliance Enterprise helps banks and trading firms around the world reduce regulatory, financial, legal, and reputational risk.

If you are not familiar with our compliance solutions, let’s take a quick tour: Alacra Compliance Enterprise, also known as “ACE”, helps clients lower their cost of compliance for CIP, KYC, EDD, and credit investigations by integrating disparate datasets into a single workflow, eliminating inconsistencies in the KYC process. The integrated workflow allows analysts to quickly screen, onboard, and monitor clients and counterparties.

Alacra Compliance Solutions are already recognized as a leading KYC solution by the world’s largest banks and corporations. Alacra Compliance Enterprise has won industry accolades including a 2011 CODiE Award for “Best Solution Integrating Content into Workflow” and by VIP as a tool which can “Simplify compliance-related searching...to help firms standardize their reporting practices.”

The latest release of ACE includes improved features, including the ability to easily conduct investigations that involve multiple subjects, such as a corporation and its officers, directors and beneficial owners.

For Investigators:

The ACE workflow simultaneously searches all the databases your firm uses to onboard a new client or counterparty. This includes multiple sources of sanctions lists, PEPs, adverse news, public records, credit reports, public records, criminal records, and hundreds of web sites. ACE can also search internal “Do Not Do Business” lists. Consistency, thoroughness and time savings are the result.

The ACE Investigation Dashboard now displays the complete search criteria for each data source.  Investigators can now add comments to each search result, either using a pick list or free text.  Four-eye review or management approval can be put in effect so investigators and supervisors are on the same page.

For KYC Managers:

Our enhanced Investigation Results Report puts the most important information upfront, highlighting findings that may affect the onboarding. 

ACE now provides tools for better resource and performance management. We track where investigation bottlenecks occur and uncover which investigations are not meeting internal SLAs. ACE lets you manage your limited resources much more effectively.

For Compliance Executives:

ACE lowers the cost of the entire onboarding process by streamlining the process and allowing resources to be optimally deployed.  ACE clients have experienced over an 80% increase in investigator productivity. Risk is reduced as each case follows a consistent process. Case error rates have been reduced by over 40% at some firms.  And revenues increase – the sooner a customer is onboarded the faster you can do business with them.

From Onboarding to Ongoing, Alacra Compliance Enterprise helps financial firms manage their team and streamline their KYC process. Interested? Send us a note to start the conversation.

Best Practices for the Risk Based Approach

Most firms we have spoken to have a set of basic rules in place that are used to assign a risk rating to an entity. These are usually based on geography of the customer, type of customer, kind of business the customer wants to do with the bank and the appropriateness of that business to the customer. In addition, some firms will check to see if an entity has any listed securities and will see if the entity is regulated by an “approved” regulator. The list of “approved” regulators varies from firm to firm. For higher risk entities or entities that have affiliated PEPs, some firms have a four-eye review process, where a peer must review the work of the KYC investigator. Some firms conduct a four-eye review on all investigations because they want a second set of eyes confirming an entity is low-risk. More difficult or high-risk investigations are often conducted by more seasoned analysts.

Our observations reveal that the degree to which financial institutions deploy a risk-based approach depends on three factors:

1)       Communication between relationship managers and the KYC team

2)       Size of business the customer intends to do with the financial institution

3)       The level of “process” employed by the KYC team.

The more formal the communication is between relationship managers and the KYC team, the more likely that critical information about the applicant will be complete. When the KYC team understands the type of business the customer wants to conduct, from which geography and in what size or volume, they can conduct the appropriate level of due diligence. Lack of such communication often results in many customers being onboarded in the same way, often with less rigorous diligence.

In the case of size of business, a risk-based approach is simply the deployment of common sense. In the commercial banks we observed there was a strong correlation between the level of due diligence and the size of the loan applied for, both to combat money laundering as well as to reduce credit risk.

For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.

Risk-based Approach - Regulatory Highlights

“Risk-based approach” is a phrase used in many domains, from pharmaceutical manufacturing practices to auditing, to testing internal controls, to combating money laundering and terrorist financing. The AML regulations are consistent in saying a risk-based approach should be deployed; our best practices that follow explain how some financial institutions get this done.

BSA (Bank Secrecy Act): In a report regarding BSA, Gibson Dunn states, “Under the BSA and its implementing regulations, and, with respect to banks, parallel requirements of the Federal bank regulators, banks, securities broker-dealers, and certain other "financial institutions" are required to implement risk-based anti-money laundering ("AML") programs to prevent and detect money laundering and terrorist financing and to comply with a labyrinth of BSA/AML laws, regulations, and regulatory guidance.”

FCPA (Foreign Corrupt Practices Act): “We recommend companies follow a risk-based approach: focus on the nature of relationships with their distributors. Determine which distributors are the most likely to qualify as agents, for whose acts the company can be held responsible. Once a company segregates the high-risk distributors that likely qualify as agents and potentially subject the company to FCPA liability from mere resellers that pose little FCPA risk, FCPA compliance procedures can be tailored appropriately. Distributors that qualify as ‘‘agents’’ and also pose FCPA risk, full FCPA due diligence, certifications, training, and contract language are imperative,” according to the FCPA Professor.

FSA (Financial Services Authority, UK): The FSA states, “Firms must put in place adequate and risk-sensitive AML policies and procedures. This means that firms have to identify and assess their money laundering risk and put in place systems and controls adequately to manage and mitigate this risk. Firms who apply a risk-based approach to AML will focus AML resources where they will have the biggest impact. The risk-based approach means a focus on outputs. Firms must have in place policies and procedures in relation to customer due diligence and monitoring, among others, but neither the law nor our rules prescribe in detail how firms have to do this. Firms’ practices will vary depending on the nature of the money-laundering risks they face and the type of products they sell.”

For more, download Alacra’s Best Practices in KYC for Financial institutions whitepaper.