Chapter 4 supsicious transactions

Chapter 4
Suspicious Transactions
The Presentation Slides for Teaching
Anti-Money Laundering and Counter-Terrorist Financing
Website : https://sites.google.com/site/quanrisk
E-mail : quanrisk@gmail.com
Copyright © 2021 CapitaLogic Limited

Declaration
 Copyright © 2021 CapitaLogic Limited.
 All rights reserved. No part of this presentation file may be
reproduced, in any form or by any means, without written
permission from CapitaLogic Limited.
 Authored by Dr. LAM Yat-fai (林日辉),
Chief Data Scientist, CapitaLogic Limited,
Adjunct Professor of Finance, City University of Hong Kong,
Doctor of Business Administration,
CFA, CAIA, CAMS, CFE, FRM, PRM, MCSE, MCNE.
Copyright © 2021 CapitaLogic Limited 2

Components of a ML event
Criminal
Copyright © 2021 CapitaLogic Limited
Laundering trades
Money laundering instrument
3

 Sanctions list matching
 Transaction monitoring
 Record keeping
Outline

A transaction with a counterparty
Counterparty

Sanctioned person
 A FI cannot provide any service to a
sanctioned person
 Must assess whether the counterparty is a
sanctioned person
 Assessment must be performed before processing a
transaction
 Sanctions list matching of counterparty as the
primary tool

Sanctions list matching
 The process to determine the chance of a
counterparty to be a sanctioned person
 Closer to 0% Not matched
 Closer to 100% Matched
 For matched counterparty
 Conducting internal investigation

Counterparty information
 Country
 Financial institution
 Account name
 Account number
 Unverified address

Name search of counterparty
with sanctions lists
 Search a counterparty name in sanctions lists
containing sanctioned persons designated by
 the United Nations
 Interpol’s highly wanted criminals
 the home country of the FI
 other major countries
 Commercial sanctions list databases
 Refinitiv World-Check
 Dow Jones RiskCenter
 Lexis-Nexis Identity Verification

Interpol’s highly wanted criminals

Sanctions list matching
Counterparty name
Not matched in the
sanctions lists
Process
transaction
Matched in the sanctions lists
Internal investigation
False positive
Process
transaction
True positive
Report to
the JFIU

What is match?
 Objective
 A and B are the same person
 But you will never know until you see the two
persons
 Name A and name B look the same
 Name A and name B sound the same
 Name A and name B mean the same

Name alternations
 They look the same
 Completeness Philip W.M. LI vs Philip LI
 Order Philip LI vs LI Philip
 They sound the same
 Soundex Philip LI vs Philippe LEE
 They mean the same
 Synonym Philip LI vs Phil LI
 Trade name HKU SPACE
 Short name SPACE
 Commercial code 0484 3849 3838

Soundex
 A phonetic algorithm for indexing words by
sound
 Homophones to be encoded to the same
representation so that they can be matched
despite minor differences in spelling

OFAC sanctions list
matching algorithm
 Sanctions list search uses two matching logic algorithms, and two matching
logic techniques to calculate the score.
 The two algorithms are Jaro-Winkler, a string difference algorithm,
and Soundex, a phonetic algorithm.
 The first technique involves using the Jaro-Winkler algorithm to compare
the entire name string entered against full name strings of entries on
OFAC's sanctions lists.
 The second technique involves splitting the name string entered into
multiple name parts (for example, John Doe would be split into John and
Doe).
 Each name part is then compared to name parts on all of OFAC's sanctions
lists using the Jaro-Winkler and Soundex algorithms.
 The search calculates a score for each name part entered, and a composite
score for all name parts entered.
 Sanctions List Search uses both techniques each time the search is run, and
returns the higher of the two scores.

Non-Latin languages
 Chinese characters
 Japanese characters
 Korean characters
 Other Asian languages
 No FI is doing good on non-Latin language
matching

Non-stop growth of sanctions lists
 Many sanctions lists
 Continuous growth of sanctioned entities
 New entries will continue to be added to the
sanctions lists
 Existing entries will seldom be removed from the
sanctions lists

Very common names
 A very common name in the sanctions lists
will trigger many matched counterparty names
 More and more very common names will be
added to the sanctions lists

Matching algorithm
 The rules which define a counterparty name as
“match” or “not match”
Most stringent, least sensitive
 First name + Middle name + Last name + Country
 First name + Middle name + Last name + Region
 First name + Middle name + Last name
 First name + Last name
 Selected alternations
 Soundex
Least stringent, most sensitive
 There is no partial match

False positive
 The counterparty name identified as “match”
by the matching algorithm, after investigation,
is not an entity designated in the sanctions list
database
 The more sensitive the matching algorithm, the
more false positive

Major practical issues
 Priority
 All transactions are expected to be processed by a
FI before day end
 Delayed transactions may be subject to penalties
and civil litigations
 Quantity
 The more matched counterparties
 The more internal investigations
 The more costs against revenues

Go or not to go?
 Regulator’s expectation
 An internal investigation must be completed before
the transaction is processed
 Financial institution’s expectation
 The transaction must be processed by day end
 Rule-of-thumb
 The transaction must be processed by day end
unless there is a strong reason to hold it up

How to calibrate
the matching algorithm?
 Regulator’s expectation
 As sensitive as possible
 Financial institution’s expectation
 As insensitive as possible
 Rule-of-thumb
 To produce the number of matched counterparties
such that you can complete all internal
investigations by 6 pm every day on average

White list
 A list of counterparties which can be ignored in
case the counterparty is classified as “matched”
 For example, the counterparty name was
identified as a false positive in the previous
investigation
 The white list must be reviewed and justified on
an ongoing basis
 At least annually
 When there is a trigger event

Grey list
 A list of counterparties under which the transaction can
be processed but then followed up by justification
report, in case the counterparty is identified as “match”
 For example, the counterparty name was identified as
false positive in a previous investigation, but in a higher
risk country and industry
 The grey list must be reviewed and justified on an
ongoing basis
 At least annually
 When there is a trigger event

Sanctions list matching systems

Implementation project
 Training and awareness
 Policies and procedures
 Computer systems
 Six months to one year to complete
 Most effort spent on the calibration of
matching algorithm

Contingency
 Integrated with core transaction processing
systems
 Introduce operational delay to all transactions
 Must have a contingency procedure to bypass
the sanctions list matching system if it fails

Contingency
Sanctions list
matching
Interbank
payment
Core banking
system

Industry practices
 All retail banks have automated sanctions list
matching systems in place
 Other banks have some forms of sanctions list
matching systems in place
 Securities firms and insurance companies, in
general, do not have a descent sanctions list
matching system in place
 Transaction involving third party is less common

 Record keeping
Outline

Transaction monitoring
 The process to determine the chance of a set of
related transactions to be laundering trades
 Closer to 0% Regular transactions
 Closer to 100% Laundering trades
 For a set of transactions closer to laundering
trades
 Conducting internal investigation

 A 360 degree process to identify suspicious ML
transactions, taking into account
 Customer
 Customer risk profile
 Account history
 Many transactions
 Original parties
 Destination parties
 Amounts
 Frequencies
 Patterns

Many transactions

Transaction topologies
One-to-many Many-to-many

Outlier – Far from norm
Norm
Transaction
Threshold

Outlier – Close to suspicious scenario
Transaction
40
Suspicious scenario
Threshold

Outlier –
Far from norm, close to suspicious scenario
Norm
Transaction
41
Suspicious
scenario
Threshold

Transactions
Regular Outlier
Internal investigation
False positive
Internal report
True positive
Report to
the JFIU

Smart use of transaction monitoring
 To demonstrate that a FI is very serious on the
AML compliance
 The follow up phase of sanctions list matching
for the transactions which have processed
 No urgency
 As long as the suspicious transactions are reported
on time

Transaction monitoring solutions

SAS AML

Implementation project
 Specialist project
 Managed by ex-law enforcement agent
 Training and awareness
 Policies and procedures
 Computer systems
 One year to three years to complete

Offline and centralized process
 Day end customer profiles and transactions
transferred to a regional transaction monitoring
centre
 Computer systems to identify outliers
 Preliminary investigations within the
transaction monitoring centre
 Follow up investigations by country office

Industry practices
 Most retail banks have automated transaction
monitoring systems in place
 Other banks may have some forms of
transaction monitoring systems in place
 Most securities firms and insurance companies
do not have transaction monitoring system in
place

 Record keeping
Outline

KYC record keeping
 To ascertain that
 the basic CDD and risk assessment have been
properly completed for all customers
 the enhanced CDD and detailed justification have
been properly completed for higher risk customers

Customer records
 For all customers
 Basic CDD documents for identifying and verifying the identity
of customers and beneficial owners
 Documents for the objectives and/or intended objectives of the
business relationship
 Risk assessment records
 Account opening forms
 For higher risk customers
 Enhanced CDD documents for customers and beneficial owners
 Further documents for the objectives and/or intended objectives
of the business relationship
 Detailed risk assessment records
 Lengthily justification reports

Retention period
 All documents to be kept
 Throughout the business relationship with the
customer
 For a period of five years after the end of the
business relationship
 A regulator may request in writing a FI to
extend the period of record keeping for certain
customers

Availability of customer records
 On a timely basis upon request from a
regulator
 Usually
 within one week for specific and smaller volume
of records
 within one month for specific and larger volume of
records
 Acceptable in electronic and/or paper copy
format except ordered explicitly by the court

Outsourcing of record keeping
 Yes, any professional services provider on record
keeping
 The FI must take the ultimate statutory and regulatory
responsibilities
 The FI must put in place a framework to ensure the
compliance of service providers in accordance with the
AMLO and AML guideline
 Committee and meeting
 Policies and procedures
 MIS reports
 Regular compliance reviews
 Annual audits

Major issues of record keeping
 Too many records
 Too many records in paper form
 Too many photocopies
 Professionals prefer paper copies for job security
 Changing hands of staff
 Lacking efficient document management system
 Reliance on single record keeping services
provider

Sound practices
 Electronic document management
 Centralized database
 Indexing and search engine
 Minimum basic CDD
 To collect the least no. of sheets
 Account for the majority of customer documents
 Enhanced CDD only when there is an absolute
necessity
 Never release original documents to regulator

Transaction record keeping
 The identity of the parties to the transaction
 The date of the transaction
 The nature of the transaction
 The currency type
 The currency amount
 The origin of the funds
 The destination of the funds
 The form in which funds were offered and/or withdrawn, e.g. cash,
cheques
 The form of instruction
 The form of authority
 The type and identification number of any account involved in the
transaction

Retention period
 To be kept for a period of five years after the
completion of a transaction
 Usually in electronic format
 A regulator’s may request in writing a FI to
extend the period of record keeping for certain
transactions

Transaction screening
 Used by the HKMA to describe the extension
of sanctions list matching to cover
 counterparty vs (sanctions lists + selected watch
entities of highest risk)
 Very difficult to implement due to the huge
no. of false positive amplified by the entities
in the watch lists

Transaction screening
 How to satisfy the regulatory expectation of
transaction screening?
 Sanctions lists + their spouses

Reference
 Guidance Paper on Transaction Screening,
Transaction Monitoring and Suspicious
Transaction Reporting (May 2018)

Chapter 4 supsicious transactions

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Chapter 4 supsicious transactions

Similar to Chapter 4 supsicious transactions (20)

More from Quan Risk

More from Quan Risk (20)

Recently uploaded

Recently uploaded (20)

Chapter 4 supsicious transactions