How to optimise your anti-money laundering approach

The Transparency International announcement doesn’t pull its punches. £6.7 billion (€7.8 billion) worth of property in the UK has been bought with suspicious wealth since 2016. [1]

Of this total, £1.5 billion (€1.75 billion) was bought by Russians accused of corruption or links to the Kremlin. And more than 55% of these investments by value is held by anonymous shell companies.

The fight against dirty money and financial crime generally is bigger than any individual nation state or geopolitical event. However, recent events in the Ukraine have brought the role of money laundering and its enablers to the fore.

Governments around the world are imposing sanctions against Russia. Banks, real estate brokers, lawyers and other intermediaries are being challenged on their record on dirty money. We review what is planned, and how acquirers and payment service providers (PSPs) can respond.

Pushing beneficial owners into the light

The UK is just one of many countries looking to create a register of overseas entities. This would require overseas companies and individuals to declare the beneficial owners of all property bought in England and Wales over the past 20 years.

Beneficial owners are defined as those who own or control more than 25% of the shares or voting rights of a company, or otherwise exert significant control. The planned register is designed to prevent criminals hiding behind shell companies that provide anonymity, conceal ownership and disguise the origin and audit trail of funds.

This comes on the back of recommendations from Financial Action Task Force (FATF), the global standards-setting body. It has proposed amendments to Recommendation 24 (transparency and beneficial ownership of legal persons), requiring countries to set up beneficial ownership registers or sufficient alternatives. [2] This will allow authorities to see who ultimately owns or controls companies and legal arrangements.

Money launderers getaway vehicle

The UK Economic Crime Bill became law in mid-March 2022 and includes several measures to tackle illicit finance. [3] However, the legislation omits reforms to Companies House, the UK register of companies. Mandatory identity verification for those setting up companies and digitising processes are planned for later in 2022.

We have written before on how UK companies are the money launderer’s getaway vehicle of choice. Currently, anyone from anywhere in the world can set up a UK limited company or limited liability partnership (LLP) within 24 hours at a cost of £12. There are no requirements for residency or a physical presence in the UK, and no restrictions on the number of directorships any company or individual can have.

The last FATF mutual evaluation report on the UK found that while the information in the register was subject to basic checks, “it remains largely unverified”. Companies House has no powers to query, amend or remove data, dissolve limited partnerships or share suspicious information with law enforcement or financial intelligence units.

Customer due diligence obligation

In truth, although country-specific registers may assist acquirers and PSPs in meeting their obligations, it does not modify the requirement to conduct customer due diligence. In fact, the implementation of the Fifth Anti-Money Laundering Directive (5AMLD) [4] in Europe requires a wider group of firms, such as real estate agents, auditors and notaries among others, to conduct customer due diligence on clients.

Firms must check the identity of their customers, verify beneficial ownership, identify politically exposed persons or PEPs, ensure ongoing monitoring and more. In Germany, for example, the implementation of 5AMLD has led to new legislation requiring notaries to verify and document the ownership structure of every contractual party before acting for a customer.

The complexity of sanctions

Sanctions have become an increasingly dynamic and specific sub-specialism within AML/CFT. They are designed to promote adherence to international norms or bring about specific policy objectives where diplomatic efforts have failed. Sanctions can be applied against countries, regimes, people, companies, vessels, activities or industry sectors.

There were already more than 300 sanctions lists globally, in different languages and formats, involving different levels of specificity and compliance, before the conflict in Ukraine. That’s according to World-Check, a division of Refinitiv that specialises in due diligence for sanctions and AML risk.

The volume and speed of sanctions changes, the lack of alignment between lists and short timeframes to comply make an already complicated area even more complex. Those on-boarding and monitoring clients are advised to keep abreast of sanctions changes and engage a reputable sanctions screening agency. They should also regularly evaluate their business models and approach to sanctions changes, bearing in mind that change brings opportunities as well as threats.

It is also worth noting that in most cases, sanctioned individuals and entities know they appear on sanctions lists. They are not able to transact in their own name, so use techniques similar to those used for money laundering to evade sanctions.

Devising a robust AML approach

This shouldn’t come as news: there are no silver bullets with risk management. It’s best to develop a defence in depth, layered or matrix approach to managing risk. The protection afforded across the various layers or stages then becomes greater than the sum of its parts.

Advice for managing money laundering risks is not very different to managing other types of acquirer risks

• Conduct thorough due diligence on merchants and their principals.
• Identify and verify identities using reliable, independent source documents, data or information.
• Collect and analyse information about the merchant business and beneficial owner(s).
• Understand the purpose and intended nature of the business relationship.
• Conduct additional enhanced due diligence for higher risk relationships.

This will help identify and assess the risks relevant to the merchant and their customers. Naturally, this will depend on their nature of business, products and services they sell, channels of operation, for example face-to-face sales, remote e-commerce sales or both, geographical areas of operation and so on.

Use the merchant application form to obtain detailed information about all aspects of a prospect’s business. This includes relevant information on:

• Business background
• Business operations
• Nature of goods or services sold
• Principals who are running the business

It almost goes without saying, but review the functional set-up of a merchant’s website and follow up any anomalies. This includes:

• Disclosures
• Terms and conditions
• Customer experience

Lastly, design and implement appropriate policies, procedures and controls. This includes internal controls, customer due diligence measures and ongoing monitoring, reliance and record-keeping, monitoring, managing compliance and staff training.

Review and monitor

Having nicely drafted policies, procedures and controls does not in itself manage or mitigate risks. Assess the degree to which policies are implemented and lived day-to-day within your organisation, and flex according to current risk exposure.

For example, review the systems for customer identification and verification, including enhanced arrangements for high-risk customers. Request examples of when additional information was requested from customers. And the arrangements for recording the action taken or not, together with the rationale, as appropriate.

Finally, consider your monitoring controls. Ongoing monitoring is a second, third and ongoing chance for you to check that the merchant or client risk was correctly assessed in the first place — and is still applicable.

How Web Shield can help

Web Shield’s on-boarding solution, InvestiGate, automates manual investigations for faster and cheaper on-boarding. The platform comprises various modules, including third-party services from sanctions list, address and identity verification providers. This helps eliminate multiple interfaces, parallel processes and manual reviews, saving time, cost and resource.

The sixth book in Web Shield ‘Fundamentals of Card-Not-Present Merchant Acceptance’ series is about money laundering and is available here.

Various Web Shield online academy courses are also available on anti-money laundering, merchant acceptance, and underwriting. The courses are packed full of practical, real-life information and case studies to help risk professionals recognise various risks, plus advice on how to manage and monitor them.