The fifth pillar: best practices for implementing FinCEN’s final rules

The primary obstacles to successful CDD implementation involve the following: evolving complexities of corporate and legal entity structures; disparities in data integrity; and asymmetric bank secrecy regimes in foreign jurisdictions. The latter creates incongruities, which can obstruct the collection of true beneficial ownership records.

To overcome these compliance hurdles, institutions must first be proactive and forecast modes for shell structure adaptation, with a close eye on suspicious geographies and exempted entities. Additionally, institutions must begin exploring automated regulatory technology, or regtech, solutions.

With the right strategy, financial institutions can mitigate the confusion, inefficiencies, costs and growing legal penalties imposed by regulators. The following overview will highlight best practices for the implementation of new CDD, BSA and international bank-compliance regulations. The key considerations for banks to comply with the new beneficial-ownership diligence regime entail the anticipation of CDD loophole exploitation schemes; the selection of suitable regtech assets; and the rigorous self-assessment and diagnosis of counterparty risks.

Adaptive Implementation

In today’s regulatory climate, “checkbox compliance,” or doing the bare minimum, is no longer a suitable response to legislative reform. The ingenuity of white-collar criminal conspiracies and transnational money laundering schemes ensure that adverse elements will always find weak points to exploit. Given the new regulatory landscape, banks need to perform self-diagnostics to see which of their unique legal entity customers expose them to newly articulated beneficial owner risks. Institutions should tailor their risk-scoring and monitoring mechanisms to reflect the geographies, lines of business, and ownership structures most likely to threaten their specific organizations and branches. In short, compliance officers must adopt a risk-based approach that addresses the unique challenges and conditions facing their organizations.

And while risk parameters now specify 25 percent equity ownership as the cut-off, suspicious activity reporting must adjust to account for reactive criminal BO smurfing schemes. In the same way smurfs aim to avoid detection by structuring bank transactions in sums that fall below the $10,000 currency-transaction-report limit, offshore launderers may restructure legal entities so that no stakeholder owns 25 percent or more of a shell company. New risk controls need to apply the same type of SAR mechanisms deployed in retail bank transactions towards the analysis of equity interests in offshore LLCs and other legal entity customers.

Lastly, financial institutions should also take the initiative to devise risk-monitoring controls that track unusual flows towards exempted entities. With the latest rules, banks have no obligation to collect beneficial ownership records for nonprofits, pooled investment vehicles, certain trusts and legal entities that are at the point of sale for the purchase of retail goods. Because they are not subject to new BSA reforms, financial criminals may find that these structures afford them more breathing room to operate under the radar.

According to ex-U.S. Customs Agent Robert Mazur, who worked undercover in several high-profile money-laundering stings in the 80s and 90s, one scheme that continues to be effective, despite FinCEN’s final rules, is a scenario where launderers structure accounts to look like European mutual funds. This tactic continues to work because mutual funds generally have highly diversified ownership profiles, where no single investor holds or comes close to holding 25 percent ownership in the pooled vehicle. As such, financial institutions must be aware of pooled investment schemes involving multitudinous nominee owners and straw men, used to obscure the true account beneficiary.

Regtech Optimization

In 2016, new bank secrecy reforms are unenforceable without the right regtech solution. Every financial institution is different and has its own unique customers, vendor relationships, technology infrastructures and risk exposures. As such, a regtech asset that makes sense for one bank may be unsuitable for a different depository institution for a whole number of reasons. The only constant factors that every compliance executive must prioritize above all else are the vendor’s data quality and data integrity.

When evaluating new regtech vendor partnerships, compliance decision makers must ask themselves five key questions:

1. Where is the vendor sourcing the data?
2. Is the vendor data current & accurate?
3. Is the solution dynamic, does it update in real-time?
4. Is the technology intuitive or will I have to exhaust significant resources training staff?
5. How easily does the solution integrate with all of my pre-existing and prospective workflow software and data feeds?

Additionally, in the same way institutions are starting to allocate enhanced due diligence resources towards the screening of vendor prospects, subsidiaries and other third parties, compliance officers must ensure that their regtech partners have no willful blind spots. Decision makers must satisfy themselves that their regtech providers, from risk-scoring and monitoring, to incident flagging and reporting and background screening, are leveraging all essential customer, jurisdictional, organizational and transactional data. For example, an institution facing heightened risks of Latin American drug-money laundering, cannot select an investigative solution with porous LatAm recordkeeping and law enforcement data.

Beyond the unanimous importance of data quality and data integrity, compliance decision makers can agree on the importance of investigative technology. The solutions of today offer law-enforcement-grade database search capabilities, with records that adjust in real-time. Optimal for the enhanced CDD regime, investigative regtech assets help mitigate and avoid risk, before adverse counterparties and legal entities metastasize into regulatory tumors. These compliance assets also possess multidimensional infographic features that generate rich visual displays, mapping suspicious business connections and activities, so compliance analysts can see the whole picture.

Rigorous Self-Diagnosis

Just like Socrates’s old adage, “to know thyself is the beginning of wisdom,” the same principle can be applied to BSA and CDD compliance. Before financial institutions can properly implement FinCEN’s latest reforms they need to have a clear view of their strengths and weaknesses. Beyond reviewing existing legal entity clientele and offshore business customers, banks need to carefully assess their third- party vendor and subsidiary relationships.

With regulators holding banks more accountable for the transgressions of their affiliates, new CDD rules add another layer of complexity. As such, institutions must rigorously audit and review the legal entity customers, partnerships and jurisdictions that impact their subsidiaries, vendors and other third parties. This added layer of diligence is a necessary response to the regulatory shift initiated by a 2015 Department of Justice memo, titled “Individual Accountability for Corporate Wrongdoing.” Authored by Deputy Attorney General Sally Yates, the memo empowers prosecutors to seek criminal penalties against individual employees who break the law.

While banks typically have the advantage of standardized IT and data networks within their core infrastructures, subsidiary and vendor recordkeeping systems are often alien to the parent company. The inherent lack of transparency with 3rd party networks presents the most glaring risk exposure for financial institutions. The addition of a fifth pillar to AML compliance means that risk managers must now factor reformed beneficial ownership standards in their review of non-customer counterparties. This undertaking cannot be taken lightly. The reassessment of business counterparties may seem resource-intensive at the start, but in the long run, institutions will find that this precaution will be a less of a cost center and more of a revenue driver.

Bank Secrecy Moves Onshore

While FinCEN’s expedited passage of the new BSA rules is a direct response to murky offshore financial structures, the U.S. has quietly become one of the world’s most desirable tax havens, according to an Economist article from last February. Ranked in the same category as Hong Kong and Switzerland, the U.S. has shunned global information sharing initiatives like the Common Reporting Standard, stifling international efforts to identify the beneficial owners of legal entity depositors on American soil. The irony is that, per Foreign Account Tax Compliance Act rules, the U.S. forces foreign financial institutions to reveal the account details of their American customers or face punitive withholding taxes on U.S.-sourced payments.

According to a Financial Times article from May (paywall), U.S. states like South Dakota have become magnets for offshore wealth through permissive trust laws. Trusts are fiduciary arrangements that allow a third party, or trustee, to hold assets in the name of a beneficiary or beneficiaries, according to Fidelity. South Dakota’s secrecy-friendly state laws promote the registration of a financial vehicle that is still exempted from beneficial owner reporting under FinCEN’s new CDD rules. In this climate, South Dakota’s trust assets have grown from $32.8 billion to $226 billion, in the period between 2006 and 2014, according to the article. And with the Boston Consulting Group reporting in 2015 that offshore wealth will grow at a clip of six percent a year, behind only Hong Kong and Singapore, it’s no wonder sources quoted in the FT article are referring to America as the new Switzerland.

With this paradox in mind, financial institutions would be wise to scrutinize their trust business practices more closely. Although the financial incentives of gathering large deposits and assets are compelling for many bank account managers, the long-term benefits of compliance pose a better value proposition, both financially and legally. Still, for the implementation of fifth-pillar AML practices to succeed, institutions must find a way to financially reward their employees for integrity and the avoidance of adverse selection. When the benefits of doing the right thing are tangible and immediate, employees are less likely to cut corners down the road.