Print Article

The FCA muses on AML systems and controls


One of the dilemmas of white-collar crime is the victim is too often either invisible or, in some cases, like insider dealing, believed, wrongly, not to really exist, which means the wrongdoer is more easily able to commit a crime in which real harm is never felt, seen or experienced directly. So too if the potential impact is not on ‘your street’ or in ‘your country’.

There is a version of this in relation to systems and controls, especially if they become bureaucratic insulation, attenuating [weakening] the system from the gritty reality of the predicate criminality that needs to be inhibited.

And, for the purposes of AML controls, the risks are not limited to white-collar crime, extending to the proceeds of all criminal proceeds, from drug trafficking to terrorist financing.

While the harm from such crimes may be difficult to feel or appreciate because the distance between fund flows and the scene of the crime is so attenuated, the consequences of AML failures may well be a life and death matter.

The recent FCA (Commerzbank /Goldman Sachs )cases demonstrate both the value and challenge of systems and controls.

On one hand, effective AML systems create a controlled environment that is able to identify valuable signals in complex data, with repeatable interrogations geared to specific and reasonably foreseeable crime risks, to ensure decision-making is calibrated to those risks and to record accurately how those risks have been addressed.

On the other hand, systems can become overly complicated, bureaucratised, vulnerable to gaming by less scrupulous players, and expensive.

There is an inherent risk that complex systems lose a sense of what they exist for, where the management challenge to maintain the system becomes an end in itself, rather than the system or control acting as radar to identify and manage the actual risks facing financial services firms.

AML systems and controls must be focused explicitly on the activating purpose and function of those controls to ensure the system is not just a bureaucratic process and to ensure it cannot be gamed.