Financial institutions may have adopted methods of detecting fraud in real time, but money laundering detection remains an after-the-fact judgment. Finserv specialist Sujata Dasgupta explores how one bank’s adoption of EU guidance could chart a path forward for true money laundering prevention.
Financial services have undergone tremendous transformation in terms of speed, channels, products and reach — and even expanded beyond fiat to virtual assets. From domestic payments taking a couple of days and cross-border payments a week at least, many of these are now executed close to real-time, in a few seconds or hours. Multiple channels have exploded beyond branch banking to web, kiosk, mobile and digital, including embedded finance where financial institutions are virtually invisible.
With all these disruptions, funds are now accessible much more quickly and money moves much faster than it did a decade ago. The mechanisms of monitoring these transactions to identify suspicious behavior for money laundering, terrorist financing and other issues have, however, largely remained the same: periodic post-facto batch processing of transactions for regulatory reporting purposes only.
This means that while fraud can be stopped before it happens, money laundering can be reported to regulators for enforcement action only after a criminal has moved their funds. Does the industry not need to detect money laundering or terrorist financing before it is executed and stop it in its tracks? Does this require a regulation to enable FIs move confidently in that direction? What can be the possible benefits, and challenges, in this approach? What potential operating model can support this framework?
European authorities have provided a possible roadmap.
A reimagined AML approach
The European Banking Authority (EBA), in its published guidelines to credit and financial institutions on assessing money laundering and terrorist financing risks, laid down the foundational principles of real-time transaction monitoring.
To summarize, the key pointers are:
- Determine transactions for pre- and post-execution monitoring: Firms must establish an effective transaction monitoring approach to identify unusual and suspicious transactions and transaction patterns. They must determine, with a risk-based approach, which transactions they will monitor in real time and which they will monitor ex-post.
- Determine triggers for transactions to be monitored in real time: Firms must establish which high-risk factors or combination of high-risk factors will always trigger real-time monitoring. Transactions associated with higher money laundering or terrorist financing risk are to be monitored in real time, where the risk associated with the business relationship is increased.
- Review real-time monitored transactions ex-post on a sample basis: In addition to real-time monitoring of the identified transactions, firms must also regularly perform ex-post reviews on a sample taken from all processed transactions to identify trends that can aid in their risk assessments to test the effectiveness of their transaction monitoring system and improve it accordingly.
Navigating the unknowns
While the EBA guideline was published in March 2021, apparently not a single bank within the EU had implemented this approach yet. One may argue that this was only a guidance and not a regulatory mandate, hence the lack of momentum within FIs. But if we understand the larger objective of AML, it is to prevent money laundering and terrorist financing and do all it takes to interdict the crime before it happens. Recent industry reports peg money lost to such crimes to be more than $2 trillion per year. It, therefore, becomes worthwhile for FIs to consider monitoring transactions in real time on a risk-based approach and prevent such colossal amounts of funds from getting into the hands of criminals.
The wheels have been set in motion now as Bank of Valletta (BOV), one of the oldest and largest FIs in Malta, recently announced adoption of real-time AML monitoring by leveraging AI technology. This is to align with the changing fincrime landscape, regulatory guidelines and the bank’s own internal risk assessments. BOV’s initiative is bound to encourage more FIs in the region to follow suit, while also drawing lessons from the journey, initial challenges, strategies to overcome them and business value achieved.
Moving from post-execution batch monitoring of transactions to real-time pre-execution monitoring of select transactions to identify criminal activity is a paradigm shift for the world of traditional FIs. This will involve a strategic change, right from internal risk assessment to redesigning AML policies and processes, rules and detection logics, treatment of alerts and even decisioning of payments.
For example, what happens to an instant payment if it is alerted in real-time monitoring? Should it be rejected (as the alert cannot be investigated instantly) or put on hold until an investigation is over (in which case it is no longer an instant payment)? Another example is when a standard payment is alerted in real time and a suspicious activity report is filed: Should the payment be blocked/rejected or allowed only after a go-ahead is received from investigators? Questions like these will require detailed regulatory guidance, and such clarity will help FIs to adopt this new approach.
A transformation journey
“Follow the money” has long been the motto of fincrime fighters, and now another dimension is becoming increasingly significant — “follow at the same speed as money movement.” It is not surprising that EBA has recommended risk-based real-time monitoring to match the growing real-time nature of transactions.
But making a decision in a fraction of second on whether a transaction is suspicious, whether to allow or hold/block/reject it will require very rich supporting data and is impossible manually. This is where intelligent automation, use of multiple internal and alternate external data sources and AI powered detection platforms can help FIs.
Transitioning to real-time monitoring for AML is a significant change and one where all stakeholders in the industry must be aligned to a common approach, processes and rules to treat alerts/decision payments and other best practices.
Identifying whether a transaction is suspicious in about 300-500 milliseconds by scanning through huge volumes of internal and external data will require a robust platform to ensure high performance. The detection engine itself must be a combination of rules and machine learning models that consider high-risk data attributes. The need for a strong audit trail cannot be overemphasized. Reporting will need to be more dynamic and feedback from investigators on reported activities will become crucial to enable action on blocked payments.
Lately, we have been witnessing harmonization of regulations across the world — whether it is on beneficial ownership, data privacy or public-private partnership. So we hope that EBA’s pioneering efforts in real-time interdiction of money laundering and terrorist financing will be followed by other regulators as well. This will boost its adoption on a global scale — not just for payments within EU but all cross-border payments as well. Collaboration among industry participants will be required to define the details of processes, risk triggers, workflows and reporting. It may be just a matter of time, as the needle has already moved in the right direction.
