What is the impact of a failed risk management program as a result of actions committed by a vendor or service provider? Your financial institution may be exposed to reputational damage and financial losses running into billions of dollars. During this webinar, our financial crime and risk management experts discussed current financial crime trends, steps to identifying vendor risks, the need for Know Your Vendor (KYV) and due diligence, and creating a cross-functional risk-based approach to vendor governance.

1. NAVIGATING THE FINANCIAL CRIMES
LANDSCAPE WITH AN EFFECTIVE VENDOR
MANAGEMENT PROGRAM
JANUARY 15, 2015

2. 2
ABOUT PERFICIENT
Perficient is a leading information technology consulting firm serving clients throughout
North America.
We help clients implement business-driven technology solutions that integrate business
processes, improve worker productivity, increase customer loyalty and create a more agile
enterprise to better respond to new business opportunities.

3. 3
GlobalDeliveryCenters/OffshoreDelivery
Deep Financial Services Domain Expertise
Enterprise
Information Solutions
Finance
Enterprise Insights
Portal
Web Content
Social Solutions
SOA
Cloud
API Solutions
Company Wide Practices
Deep Financial Services Domain Expertise
BANKING
Wholesale
Consumer
Credit Unions
Payment Processing
Trust & Custody
Trade Services
Treasury Services
ASSET & WEALTH
MANAGEMENT
Equities & Fixed Income
SMA & Wrap
Hedge Funds
OMS & EMS
Portfolio Modeling
Portfolio Accounting
CAPITAL
MARKETS
Equities & Fixed Income
FX & Commodities
Future & Options
Electronic Trading
INSURANCE
Investments
Customer Acquisition
Property & Casualty
Life Annuities Services
Claims Evaluation
Underwriting
Consumer Direct
Business/
Technology Solution
Rationalization
and Delivery
Business Process
Improvement
Program Value,
Quality and
Cost Management
Client
Centricity
Risk and Regulatory
Compliance
Finance
Transformation
Solutions & Services
INDUSTRY DRIVEN SOLUTIONS

4. 4
ABOUT THE SPEAKER
Richard Brownstein, Director of Risk and Compliance, Perficient
Rich leads Risk and Compliance in Perficient’s Financial Services national
practice. He has more than 20 years of experience working for and with large
financial institutions in the areas of operational risk management, legal and
compliance, IT governance, and project portfolio management. He has a deep
understanding of industry challenges and best practices. Rich has a proven
track record leading strategic business, product and technology initiatives to
minimize risk and maximize effectiveness and efficiency for organizations.

5. 5
WHAT WE WANT TO TALK ABOUT TODAY
• Introduction
• Financial Crimes on the Rise / Increased
Regulatory Pressure
• Taking an Enterprise View of Risk
• Know Your Vendor – KYV
• Vendor Assessment

6. 6
AML COMPLIANCE PENALTIES
Source: “AML & Sanctions Enforcement and the
Price of Dirty Money” Infographic 2014

7. 7
HIDDEN COSTS OF NONCOMPLIANCE*
*In 2014 alone…
$12.4 B
in monetary fines as disclosed
in trade publications.
Unknown Costs
Lost Business
Reputational
Damage
Third-Party &
Vendor RisksSource: “AML & Sanctions Enforcement and the
Price of Dirty Money” Infographic 2014

8. 8
2015 RISK & COMPLIANCE CHALLENGES
Agencies and the self-regulatory organizations are continually revising
and adopting new rules and regulations

9. 9
GOALS OF FINANCIAL CRIME PREVENTION
Current Compliance Goals
• Meet regulatory requirements
• Prevent fraud losses
• Reduce false positives
• Manage reputational risk
• Streamline operations and reduce costs
New Compliance Goals
• Governance and enterprise view
• Integrated risk controls and framework
• Data quality and standards
• Risk intelligence
• Vendor risk management

10. 10
AREAS CONTROLS SHOULD BE PUT IN PLACE
Electronic Communication
Surveillance
Information Security
SEC Trade Surveillance
Rules Compliance
AML, KYC
Transaction Monitoring
PATRIOT ACT / CFT
Client Suitability / Broker Fraud
Sales Practice Abuse
Fraud Detection & Surveillance
Corruption / Collusion / Bribery
FACTA Identity Theft Prevention
Regulatory Red Flags
Regulatory Assessment
and Review
Regulatory
Impact Analysis

11. 11
THE VAST
LANDSCAPE OF
FINANCIAL CRIMES
Financial crimes have been increasing at a disturbing
rate causing increased scrutiny by regulatory bodies and
greater due diligence applied by business risk officers.
Fraudsters are finding more ways to fund activities or profit
by multifarious means both internally and externally.

12. 12
ALTERNATE
CHANNELS
New ways of gaining access to customer
information have increased the ways of
committing financial crimes
• Cross-channel and cross-product fraud
• Online banking and bill pay services
• Mobile banking
• Mobile payments
• Virtual currency
• Gift card theft and scams
• Email scams

13. 13
INTERNAL
THREATS
Internal Threats are on the rise
• Identity theft
• Embezzlement
• Fraud
• Bribery
• Gifts and entertainment
• Vendor relations
• Information security breaches

14. 14
EXTERNAL
THREATS
External threats continue to be on the rise as well,
even with existing regulatory demands increasing
• Fraud
• Trading Violations
• Brokerage Fraud
• Client Suitability / Sales Practice Abuse
• AML / CFT – AML & Countering Funding for
Terrorism
• OFAC / FinCen Sanctions & BSA Requirements
violations
• Mutual Fund Abuses
• Vendor Services SLA breaches / Vendor KYC / Data
breaches
• FATCA – Foreign Account Tax Compliance Act
• FACTA – Fair and Accurate Credit Transaction Act
• Identity Theft

15. 15
CURRENT AML/FRAUD DETECTION FUNCTIONS
Alert / Case
Management
Regulatory
Compliance
Risk Rating / Enhanced
Due Diligence / CIP
Surveillance and
Supervision
KYC / New Account Opening
(NAO) / Client On-boarding
FRAUD SOUCE DETECTION FUNCTIONS
Broker Fraud Misrepresentation KYC Failures Employee Fraud – Internal Controls
Data Security Breaches Information Security Identity Theft
Integrated
AML Compliance
Program
• Identify verification
• Validate source of funds and
product suitability
• Confirm no negative news ,
watch list and PEP
• Central and standardized
Customer, LEI & Account data
• Cross enterprise activity view
• Review changes
• Vet activity against scenarios
• Extended customer behavior
patterns detection
• Alert tuning to increase
accurate/efficient detection
• Alert manager driven by alert
type & research
• SLA and escalation
• Role based workflow
• Procedures and Training
• Reporting, logging, audit
• SAR investigation contents
• Regulatory review and audit
coordination / Exception investigation
• CCO Governance & Control Standards
• AML & Sanction Policy & Procedure
Manager
… evolving process and solutions to
meet evolving Fraud, AML & Sanctions
management objectives …

16. 16
AREAS OF SYNERGY WITH EXISTING FRAMEWORK
Financial Crime and Compliance Technology Environment

17. 17
ENTERPRISE VIEW OF RISK
The current regulatory climate is giving new meaning to the
term‘Governance’.
By focusing on compliance with individual regulations, banks and
insurance companies risk developing a requirements-based, siloed,
myopic approach and creating overlapping, uncoordinated
bureaucracies (and cost centers) that deal
with disparate regulations inconsistently.
“Governance takes a holistic, flexible, and forward-thinking approach
that addresses all areas of the business to create value beyond mere
compliance and minimize risk on an enterprise level.”
– CEB Towergroup

18. 18
ENTERPRISE INTEGRATED RISK & COMPLIANCE
Definition: The ability to integrate All Risk
Management and Compliance activities
Enterprise-Wide.
• Driven from Policies
• 3 Lines of Defense / Front to Back
• Bottom-Up & Top-Down Risk Identification
• GRC Model
Business Process and Assurance
Operational Risk
Operations Risk Control
Validate &
Remediate
Enterprise
Integrated
Compliance &
Risk Mgmt.

19. 19
POLL: How are you currently
managing and identifying vendor
risks?

20. 20
VENDOR PRODUCT / SERVICES POTENTIAL RISK AREAS
Risk Control Self Assessments drive increased management awareness
into strong controls, potential blind spots and key control issues

21. 21
KYV TYPICALLY NOT INCLUDED IN SRM
DUE DILIGENCE ACTIVITY
SUPPLIER RISK
MANAGEMENT
KYV
Assist or lead RFP/Proof of concept/ Selection Process 
Confirm financials and references 
Negotiate MSA / Contract / Pricing 
Ensure performance measures / SLAs are set Ideally
Ensure SLAs are achieved Rarely
Assure appropriate control entitlements and IT access  
Validate Vendor Party ID 
Perform upfront on ongoing Sanctions and Watch List
monitoring

Perform Activity Monitoring 
Screen Vendor Payments (A/P) 

22. 22
INHERENT RISK VS.
RESIDUAL RISK
There are two ways to look at vendor risk:
Inherent Risk – The risk that activity would pose if
no controls were in place
• What is the vendor doing for your company?
• How critical are they to your business?
• Where are they located?
• What data are they handling?
• What naturally occurring threats do they face?
Residual risk – The risk that remains after controls
are taken into account
• Cybersecurity/data breaches/InfoSec
• IT Services/IT vendors
• Labor issues
• Bribery and corruption
• Fiduciary responsibility
• Vendor transaction monitoring

23. 23
US Foreign Corrupt Practices Act:
• Offense to bribe public officials.
• Does not cover bribery on a private level.
• Only covers active bribery (the giving of a bribe).
• Companies subject to US jurisdiction can be held
vicariously liable for acts of its employees and
agents.
• Must be proved that the person offering the bribe did
so with a “corrupt” intent.
• FCPA creates an exemption for facilitation payments.
REGULATORY IMPLICATIONS FOR 3rd PARTY
SERVICES
UK Bribery Act
• Offense to bribe public officials.
• Covers bribery on a private level.
• Covers the giving (active) and taking (passive) of a
bribe.
• Creates a strict liability corporate offence for failure to
prevent bribery (no vicarious liability).
• No requirement for a “corrupt” or “improper” intent.
• The Bribery Act makes no such exception.

24. 24
A COMBINED VIEW
OF RISK
The convergence of Supplier Risk
Management and Compliance in Vendor
acceptance is key:
• Vendor Procurement/Supplier Risk
Management to interface with Compliance
and the business to conduct KYV and more in
depth due diligence
• Risk-rate new and existing vendors
periodically to perform risk-based approach to
support departmental functions…
• Support the departmental functions as well as
protect the enterprise
Supplier Risk
Mgmt. Office
Department
KYV

25. 25
THIRD PARTY VENDOR RISKS CONSIDERATIONS
Several typical Financial Crimes could be sourced at the Third Party Vendor level.
Avoid potential risks and threats from vendor products and service providers by:
• Increasing Third Party Vendor Due Diligence during selection process
• Reviewing and updating Third Party Vendor Contracts
• Inspecting all Third Party Vendor Service Level Agreements (SLAs)
– Make sure all regulatory considerations have been covered
– Make sure Vendor financial viability is strong
– Evaluate Third Party Vendor business and data processes and controls
– Consider data location and access follows strict controls
– Require that vendors endure the same due diligence as customers and employee
• Financial, Reputational, and Legal Risks
– Information security for companies handling sensitive information
– Social responsibility and labor standards, especially in third‐world countries
– Bribery and corruption
– Financial stability of critical suppliers
– Geopolitical risks that threaten to disrupt business
Your comfort with the level of residual risk determines what you do next: continue the business
relationship by working with the vendor to further reduce that risk, or sever the relationship and
find an alternate supplier

26. 26
• Internal controls
– Adopt rigorous accounting policies, procedures and controls, including dual signoff
– Conduct due diligence on suppliers and vendors (special attention and possibly EDD on off-shore providers).
– Establish a system for monitoring transactions and developing review processes to ensure that transactions “fit the business” of
the vendor.
• Regulatory guidance
– Adopt risk management processes commensurate with the level of risk and complexity of its third-party relationships.
• Ensure comprehensive risk management and oversight of third-party relationships involving critical activities.
• An effective risk management process throughout the life cycle of the relationship includes, but is not limited to:
– Planning
– Due diligence and third-party selection
– Contract negotiation
– Ongoing monitoring
– Termination
– Oversight and accountability
– Documentation and reporting
– Independent reviews
OCC SR 2013-29 RISK MANAGEMENT GUIDANCE

27. 27

28. 28
KYV DUE DILIGENCE: HOW WE CAN HELP
• Regulatory Compliance Program
Management
• Vendor Assessments, Solution
Rationalization & Project Roadmaps
• Risk & Controls Assessments
• Business Requirements
• Data Governance & Data Quality
• Testing & Validation
Our risk and compliance expertise,
management consulting experience, reusable
assets, and client track record in the industry,
enable us to delivery business value for firms
leveraging existing sanctions platforms and
evolve their culture of compliance through KYV
processes and controls.

29. 29
VENDOR SELECTION APPROACH
Obtain
Management
Approval to
Proceed
Conduct
Management
Interviews
Identify Unique
Requirements
Review Existing
Requirements
Document
Develop
Solution
Architecture
Develop
Product
Information
Request
Manage Project--Quality Assurance
Select Software
Package
Finalize
Hardware
Requirements &
Costs
Develop
Implementation
Plan
Organize
Project/
Research
Software
Options
GATHER REQUIREMENTS ANALYZE OFFERINGSDEVELOP EVALUTATION
CRITERIA
SELECT SOFTWARE
Refine Scoring
Methodology
Develop Demo
Scripts
Check
References
Facilitate
Interactive
Demos
Score PRI
A rigorous approach to the Third Party Vendor Product or Service is focused around the concept of high-impact and fast-response,
understanding broad requirements, identifying vendor landscape, due diligence and selection process. Perficient uses a packaged
selection methodology and assets where applicable to accelerate the selection. The approach is flexible based on individual client
requirements for vendor selection and is customized to establish a strong and low risk exposure selection.
The approach is modular and can be easily adapted to client-specific circumstances
Proof of
Concept Test
KNOW-YOUR-VENDOR
Party
Identification
Risk Rating
Enhanced Due
Diligence

30. 30
VENDOR SELECTION BASED ON KEY CRITERIA
Short List of VendorsLong List of Vendors
1. Vendor X
2. Vendor Y
3. Vendor Z
Prioritized Client Criteria
Institutions are challenged in identifying their most suitable partners. The risk and compliance space
requires a diligent yet efficient vendor assessment.
Vendor 1
Vendor 2
Vendor 3
Vendor 4
Functional
Capabilities
Cost
Company/Client base
Technology
NumberofVendors
VendorsVendors Vendors Vendors
Complete
Enhanced SRM
& KYV
To RFP or
Quick
Selection

31. 31
INTEGRATED RISK MANAGEMENT FRAMEWORK
FRAUD SOUCE DETECTION FUNCTIONS
Broker Fraud Misrepresentation KYC Failures Employee Fraud – Internal Controls
Data Security Breaches Information Security Identity Theft
Alert / Case
Management
Surveillance and
Supervision
Integrated
AML Compliance
Program
Regulatory
Compliance
Risk Rating / Enhanced
Due Diligence / CIP
KYC / New Account
Opening (NAO) / Client
On-boarding

32. 32
2015 RISK & COMPLIANCE SERIES
How to Drive Value from
Operational Risk Data
Thurs., January, 29 12:00 – 1:00 ET
Registration details will follow in post-
webinar email communications or
visit www.perficient.com.