US and UK regulators continue to focus on enforcement actions against institutions and individuals for violations of anti-money laundering (AML) laws and regulations, and the trend is intensifying.

A review of recent US and UK enforcement cases reveals common themes financial institutions might consider when establishing or assessing the effectiveness of AML programs.

Specifically, regulators continue to direct their attention to

1. internal controls,
2. the identification and timely reporting of potentially suspicious activity, and
3. conduct that may give rise to the individual liability of employees.

Over the past 15 months, US regulators¹ have

1. brought more than 40 enforcement cases and imposed penalties totalling more than $1 billion² primarily against financial institutions such as banks, credit unions, broker-dealers, and money services businesses.

Many cases involved missing or ineffective AML programs, which led to other deficiencies, such as failure to file Suspicious Activity Reports (SARs) and Currency Transaction Reports.

Likewise, in recent years, UK regulators³ have fined nine banks for AML breaches.

1. The majority of the cases involve a bank breaching Principle 3 of the Financial Conduct Authority’s Principles for Businesses, i.e., failing to “take reasonable care to organize and control its affairs responsibly and effectively, with adequate risk management systems.”⁴
2. The most recent penalty (Deutsche bank), issued on January 31, 2017, amounted to more than £160 million ($195 million) and was the largest fine ever imposed by that UK authority for AML breaches.  https://www.fca.org.uk/news/press-releases/fca-fines-deutsche-bank-163-million-anti-money-laundering-controls-failure

Internal Controls: The Key to Successful AML Programs

1. In the US, the rules of the Department of Treasury’s Financial Crimes Enforcement Network (FinCEN)⁵ require financial institutions to establish systems, policies, and procedures to comply with the Bank Secrecy Act, including:
   1. a system of internal controls to assure ongoing compliance;
   2. independent testing of the program;
   3. the designation of a qualified individual for coordinating and monitoring day-to-day compliance;
   4. training of appropriate personnel; and
   5. appropriate risk-based procedures for conducting ongoing customer due diligence.⁶
2. In the UK, financial institutions must look to the Money Laundering Regulations 2007 (MLR), which set minimum standards using a proportionate and risk-based approach to combatting money laundering risks.
3. The Financial Conduct Authority also expects financial institutions to maintain effective systems and controls to counter the risk of systems being used to further financial crime⁷ and to enable those systems to “identify, assess, monitor and manage money laundering risk.”
4. The systems should be “comprehensive and proportionate to the nature, scale and complexity of its activities.”⁸
5. The Financial Conduct Authority has published extensive guidance on this topic: its Financial Crime Guide contains examples of poor AML controls⁹ and consolidated examples of good and poor practices under themes which include
   1. private banking,
   2. high-risk situations, and
   3. automatic monitoring.¹⁰
6. In recent years, US and UK regulators have charged financial institutions with failure to establish sufficient internal controls in the following areas:
   1. Policies and Procedures.
      1. Regulators charged financial institutions with failing to establish and implement adequate procedures and with failing to follow established procedures.
      2. Examples in the US include:
         1. A US financial institution failed to provide meaningful guidance for monitoring, detecting, and investigating potential suspicious activity in its procedures; another institution’s procedures, which called for a manual review of activity, were deemed unreasonable given the volume of relevant transactions; and
         2. another failed to conduct a documented risk assessment and review of its customers despite a requirement to do so in its written supervisory procedures.
      3. In one UK case, the Financial Conduct Authority emphasized
         1. a board of directors’ failure to act cohesively and effectively due to lack of experience and expertise in regulatory and compliance matters that led to manifest differences in opinion about how to approach and comply with regulatory requirements.
   2. Failure to Tailor the AML Program.
      1. In multiple instances, US regulators found that financial institutions failed
         1. to tailor their AML supervisory systems to their business models.
      2. In December 2015, two financial institutions were cited for failing to establish an AML program tailored to cover their high volume of low-priced securities.
      3. In another instance, a financial institution failed to adequately tailor the parameters and thresholds of the alerts generated by the system to review transactions executed by its high net worth private banking clients.
      4. In a 2015 case, the UK’s Financial Conduct Authority highlighted
         1. a similar failure to tailor thresholds in an automatic transaction monitoring system to the type of activity expected on the accounts; there was no alternate manual monitoring, which meant some large transactions passed through the system unnoticed.
   3. Due Diligence Requirements.
      1. Financial institutions were also cited for failing to conduct adequate due diligence at account opening and on an ongoing basis. Examples include
         1. failing to conduct appropriate due diligence of a correspondent account established for a foreign financial institution and failing to take adequate steps to learn whether certain customers had “criminal histories and/or negative regulatory backgrounds.”
      2. In a recent US case, a money services business
         1. consented to a finding that it failed to conduct adequate due diligence on its agents, which resulted in a failure to identify the agents’ fraudulent transactions.
      3. Similarly, in a UK case decided in October 2016,
         1. remittance thresholds for obtaining a source of funds information were set at inappropriate levels, and there was an inadequate screening of customers to identify politically exposed persons.
   4. Adequate Risk Assessment of New Accounts.
      1. An important part of an AML program is assessing the risks of opening a new account. To illustrate,
         1. in February 2016, FinCEN cited a financial institution for failing to prepare adequate risk profiles on clients, finding that the risk profiles were incomplete, out of date, and lacked sufficient analysis and validation.
         2. FinCEN also found a violation where a financial institution failed to revise the customer’s risk profile after it detected a deviation from the customer’s anticipated activity as reflected on new account documentation.
         3. Similarly, in an October 2016 UK case, a financial institution failed to perform adequate due diligence by neglecting to provide its staff with guidance on what constitutes “sufficient” due diligence before opening a new account and by improperly documenting the purpose and intended nature of new business relationships or anticipated activity.
   5. Inadequate Resources for AML Program.
      1. In some cases, financial institutions failed to allocate adequate resources or tools for AML surveillance.
      2. This inevitably impacted the regulatory staff’s ability to review and investigate alerts as well as to conduct risk assessments and sufficient due diligence.
      3. Regulators also found violations where a financial institution collected data for business development purposes but failed to use the same data to monitor AML compliance.

Identification and Timely Reporting of Potential Violations

1. In both the US and the UK, financial institutions are subject to reporting obligations and must
   1. report any transaction they know, suspect, or have reason to suspect funds derived from illegal activities or is being conducted to disguise funds from illegal activities.
   2. Also, a reporting requirement may be triggered if the suspected activity is
      1. designed to evade reporting or recordkeeping requirements;
      2. has no apparent business or lawful purpose;
      3. is outside of the activity expected from the account and the institution, or
      4. involves the use of the financial institution to facilitate criminal activity.¹¹
2. Failure to file a Suspicious Activity Report (SAR) can lead to criminal liability in the UK for individuals.
3. Financial institutions in the UK also must be cognizant of regulatory obligations under the Financial Conduct Authority’s
   1. Principle 11 (which requires open cooperation with regulators)¹² and
   2. Supervision Manual (SUP) 15 (which sets out procedures for notifications to the Authority).¹³
4. In many recent cases, financial institutions identified the suspicious activity but failed to timely file an SAR.
   1. One US financial institution investigated a Ponzi scheme for two years without filing an SAR and only did so after the scheme was reported in the media; another had an SAR committee that never met to review and discuss possible filings.
   2. In a recent UK case, a Money Laundering Reporting Officer (MLRO) noticed low levels of SAR reporting by staff, but the bank did not carry out a proper investigation of why this might be. Following the regulatory intervention, more than 200 additional SARs had to be filed.
5. There also were cases in which financial institutions failed to detect and investigate red flags, meaning the reporting stage was never reached.
6. A number of US cases involved transactions of microcap securities, which the regulators posited were red flags warranting further review.
   1. In one instance, a financial institution failed to detect and investigate the sale of more than 73 billion shares of microcap securities over an 18-month period to determine if the sale constituted an illegal unregistered distribution.
   2. In another instance, a financial institution failed to collect any identification information from a client who had been the subject of 15 prior SARs and five Currency Transaction Reports.

Individual Liability: A Growing Trend

1. The US and the UK regulators have brought recent actions against officers charged with AML compliance (for example, Anti-Money Laundering Compliance Officers, Money Laundering Reporting Officers, and Chief Compliance Officers), charging them with
   1. failure to establish and implement AML systems reasonably designed to achieve and monitor compliance with regulatory and legal requirements and
   2. failure to establish and implement reasonable procedures to identify and investigate “red flags” indicating suspicious activity.
2. The Financial Industry Regulatory Authority (FINRA) took the lead in the US against individuals by
   1. initiating nine actions, with penalties ranging from $5,000 to $30,000, and suspensions from the industry of up to three months.¹⁴ In all instances, FINRA charged the AML officer for, among other things, failing to implement an adequate AML program or to follow written supervisory procedures requiring the individual to conduct due diligence on clients.
3. Likewise, the US Securities and Exchange Commission (SEC) brought an action against a president of a broker-dealer that
   1. allowed 23 non-US citizens to conduct more than $23 million in securities transactions through the account of one of its affiliates without ever collecting, verifying, or maintaining any identification documents for those individuals.
   2. The SEC charged that the president knew of the existence of the affiliate account and the trading in the account but failed to take any action.
4. In October 2016, the UK’s Financial Conduct Authority
   1. imposed a penalty of almost £18,000 ($21,900) on a bank’s AML officer, stating that many of the failings in the bank’s AML function fell within that officer’s area of responsibility.
   2. In 2015 and 2016, the Financial Conduct Authority also used its powers to seek restraint orders and investigate potential confiscation of the proceeds of crime against 62 individuals.

Looking Forward

1. US- and UK-regulated financial institutions, as well as their senior management and AML officers, can expect to come under increased scrutiny.
2. FinCEN continues its aggressive enforcement, already bringing two actions for AML violations in 2017, with one of them resulting in a penalty of $184 million.
3. Likewise, FINRA and the Financial Conduct Authority both announced that anti-money laundering is one of their current regulatory priorities, highlighting once again that enforcement in this area will be a regulatory focus in the upcoming year.

Ref

1. The United States Department of Treasury’s Financial Crimes Enforcement Network has primary responsibility for the enforcement of and compliance with the Bank Secrecy Act and anti-money laundering rules and regulations. Other federal agencies, including the Securities and Exchange Commission and the Financial Industry Regulatory Authority, as well as state regulators also investigate potential anti-money laundering violations under express or delegated authority and may bring enforcement actions against financial institutions and individuals subject to their jurisdiction.
2. This amount includes the forfeiture of funds more than $500 million.
3. The UK’s Financial Conduct Authority monitors compliance with the Financial Services and Markets Act 2000 (FSMA) and Money Laundering Regulations 2007 by institutions which carry on regulated activities as defined in FSMA Order 2001. The Financial Conduct Authority’s annual business plans, for several years, have highlighted financial crime as a priority, and the 2016-2017 plan is no exception. Her Majesty’s Revenue and Customs also has powers to monitor money laundering compliance by so-called money services businesses and to prosecute where necessary.
4. Financial Conduct Authority, Handbook at PRIN 2.1.1 (2014), http://www.handbook.fca.org.uk/handbook [from now on FCA Handbook].
5. 31 C.F.R. §§ 1020.210, 1021.210, 1022.210, 1023.210.
6. Specifically broker-dealers registered with the Securities and Exchange Commission, FINRA Rule 3310 requires
   • that firms develop and implement a written AML program reasonably designed to achieve and monitor compliance with the requirements of the Bank Secrecy Act (31 U.S. C. § 5311, et seq.) and  the regulations promulgated thereunder by the Department of the Treasury.
   • Rule 17a-8 of the Securities Exchange Act of 1934 requires broker-dealers to comply with the reporting and record reporting requirements of the Bank Secrecy Act. 17 C.F.R. § 240.17a-8.
7. FCA Handbook, SYSC 3.
8. FCA Handbook, SYSC 6.3.1.
9. Financial Conduct Authority, Financial crime: a guide for firms, Part 1: firm’s guide to preventing financial crime (July 2016), http://www.handbook.fca.org.uk/handbook/document/fc/FC1_FCA_20160703.pdf.
10. Financial Conduct Authority, Financial crime: a guide for firms, Part 2: Financial crime thematic reviews (April 2015), http://www.handbook.fca.org.uk/handbook/document/FC2_FCA_20160307.pdf.
11. U.S. 31 CFR §§ 1020.320, 1021.320, 1022.320, 1023.320.
12. FCA Handbook, PRIN 2.1.
13. FCA Handbook, SUP 15.
14. This only includes actions where AML violations were the sole or primary violation

SOURCE – http://www.lexology.com/library/document.ashx?g=144c4798-04ac-4070-a7e2-764a5a9da246