You may be interested in what John Everett, Director of Funds and Fiduciary said at the STEP Jersey’s 23rd Annual International Conference on Thursday 5th November 2015 on the BRA as well as many other AML matters:

BRA

1. We do think that a firm’s Business Risk Assessment is a key tool in the fight against money laundering, but too many documents that we review are still generalised and not reflective of the specific risks facing the individual firm concerned, given its strategy, risk appetite and customer base.
2. Fundamentally, the risks identified through the BRA should then inform the policies and procedures which should serve as mitigating controls to those risks.
3. Nor is the BRA supposed to be a static exercise, for the document to be put on the shelf and perhaps dusted off when the Commission is due to visit. Some firms had not given due attention as to whether the acquisition of a book of business, or some other type of organisational development, necessitated change to their BRA. Given the amount of corporate activity in the sector, this was a concern.

Other feedback on AML/CFT issues included

SARS

1. Regarding suspicious activity reports, we found examples of weak internal procedures, including some that might have resulted in internal reports not reaching the MLRO.
2. Evaluation of internal SARs sometimes appeared to have taken a disproportionate length of time, even where public domain information was available. The evaluation process preceding the decision not to file a SAR was undocumented. In some cases we believed that the MLRO was under-resourced to carry out their role properly.

Customer due diligence.

1. A key area of day-to-day business relates to customer due diligence.
2. In this area we found weaknesses in the identification and verification of customers – for example, lack of information on file, poor understanding of ownership and control and failure to properly verify information or documents.
3. In some cases, services had been provided before the completion of identification measures.
4. The identification of, and then – importantly – the response to, risk factors was unclear – for example, regarding initial and ongoing PEP classification and the carrying out of enhanced due diligence. Often this appeared to reflect a lack of understanding, or at least documentation, of the rationale.
5. From time to time the Commission is told on visits, when there is not much written down, that ‘Fred knows all about this structure’ – which makes us wonder how the business will cope if Fred falls under the proverbial bus…

ENHANCED DUE DILIGENCE

1. Regarding enhanced due diligence, it appeared that sometimes ‘red flags’ did not receive appropriate attention. The sort of factors we think of here include:
   • connections to high risk jurisdictions or those subject to sanctions;
   • allegations of corruption or an association with financial crime;
   • uncertainty regarding the settlor of a structure; and
   • lack of information to support the source of funds or title to assets.

ONGOING MONITORING

1. In respect of ongoing monitoring, we noted that in some cases automated search criteria and screening parameters had been set too narrowly.

BRA

1. We do think that a firm’s Business Risk Assessment is a key tool in the fight against money laundering, but too many documents that we review are still generalised and not reflective of the specific risks facing the individual firm concerned, given its strategy, risk appetite and customer base.
2. Fundamentally, the risks identified through the BRA should then inform the policies and procedures which should serve as mitigating controls to those risks.
3. Nor is the BRA supposed to be a static exercise, for the document to be put on the shelf and perhaps dusted off when the Commission is due to visit.
4. Some firms had not given due attention as to whether the acquisition of a book of business, or some other type of organisational development, necessitated change to their BRA. Given the amount of corporate activity in the sector, this was a concern.

Corporate governance

1. Regarding corporate governance and wider internal controls, we continue to see some examples of inadequate identification, recording and management of conflicts of interest, which will always be a warning sign for regulators.
2. In some cases Boards or Committees did not appear to meet with sufficient frequency, or there were unclear reporting lines or deficiencies in meeting CPD requirements.
3. We also saw instances of missing client records, limitations in compliance monitoring programmes and challenges with the resourcing of compliance functions, which I will return to later.

READ MORE – STEP Jersey’s 23rd Annual International Conference – Speech by John Everett, Director of Funds and Fiduciary – Thursday 5th November 2015 (part 1) http://bit.ly/1PaKUkg