Data collection for a risk matrix

Three main segments of a risk matrix:

1. Structural information on the financial institution.
2. Inherent risks divided by factors, such as:
1. Customers,
2. Products, services, and transactions,
3. Geographic reach,
4. Delivery channels.
3. Control measures of the financial institution.

Risk matrix

A risk matrix is an ordering of the various data and information on the inherent ML/TF/PF risks and AML/CFT control measures that allows a justified and reasoned computation for the residual ML/TF/PF risks of an institution.

1. Distinguishes risks between inherent as well as the residual ones once the controls have been considered.
2. Consists of a Mix of quantitative and qualitative data to capture details relevant to risk.
3. Considers the jurisdiction’s risks as detailed in the National Risk Assessment (NRA) or thematic risk assessments.
4. Includes various risk factors and should use differentiated risk weights to reflect sectoral and institution-specific characteristics and regulatory concerns.
5. Includes institutional features based on structural information on a financial institution. These can include corporate structure, transparency in the institution’s shareholding, culture of compliance, previous enforcement measures imposed, etc.

nostro and vostro accounts.

​​Nostro and Vostro accounts facilitate international transactions and foreign exchange, providing banks a way to hold and manage foreign currency. These terms describe the same bank account from different perspectives: 

1. ​A bank account held by a bank in a foreign country, in the currency of that country, is referred to as a Nostro account. "Nostro" is derived from Latin, meaning "our account." For example, if an American bank has an account with a British bank in British Pounds, that is a Nostro account for the American bank. 
2. ​Vostro Account is the same bank account, but from the perspective of the bank where the account is held. "Vostro" also comes from Latin and means "your account." So, in the above example, the British bank would refer to this account as a Vostro account.

Supervisory plan

A risk-based supervisory plan should detail scope, objectives, and timelines for conducting supervisory activities for the short-term ensuring that higher risk institutions receive more comprehensive and frequent supervision, while lower risk institutions are subject to less intensive oversight:

1. Awareness. Promoting a culture of compliance.
2. Outreach and guidance. Targeting emerging risks, best practices, risk mitigation techniques and regulatory requirements.
3. Data analysis. Performing regular analysis of customer and transaction data to identify potential risks.
4. Cooperation. Collaborating with domestic and international actors to share information, trends, and typologies on institutions.

Prioritizing supervisory activities

Factors in determining the prioritization, planning, and allocation of resources for supervisory activities:

1. Level of inherent risk in combination with information on the effectiveness of internal controls.
2. Institutional complexity. More complex institutions generally may pose higher ML/TF/PF risks and may require more extensive supervisory efforts.
3. Reputation. The institution’s record of effective risk mitigation and compliance.
4. Intelligence or information received from other authorities.

Supervisory toolkit

The supervisory toolkit contains a blend of various onsite and offsite supervisory activities:

• Onsite activities may involve inspections at financial institutions to assess actual implementation of AML/CFT requirements by reviewing and testing processes, systems and customer files, interviewing staff, and assessing operations and controls.
• Offsite activities may involve analysis of reports, data submissions, and other relevant information to assess ongoing compliance.

The onsite and offsite activities can consist of:

1. Full-scope inspections. Comprehensive end in-depth review of the institution’s operations, systems, policies, and procedures related to AML/CFT.
2. Targeted inspections. Focus on on specific ML/TF/PF risks or control weaknesses.
3. Thematic inspections. Risk mitigation across multiple institutions on specific risk areas, emerging trends, or areas of supervisory concern.
4. Periodic compliance meetings. Useful for lower risk financial institutions to ensure that they are covered by supervisory activities.
5. Outreach and capacity building initiatives. To understand obligations and implement effective AML/CFT measures.
6. Enforcement and sanctions. The toolkit should also have a range of enforcement measures and sanctions against institutions that fail to comply with AML/CFT requirements.

Home and host supervision

Home and host financial supervision for cross-border financial activities.

Home financial supervision conducted by the country of a financial institution. The primary responsibility of home financial sector supervisors is to oversee the operations and activities of all financial institutions within the group and ensure compliance with applicable laws, regulations, and standards.

Host financial supervision conducted by the jurisdiction where a foreign financial institution operates or provides financial services through a branch, subsidiary, or offering its services on a cross-border basis. Host financial sector supervisors have the responsibility to ensure that foreign financial institutions operating within their jurisdiction, through a branch or a subsidiary, comply with local laws, regulations, and supervisory requirements.

Both supervisors, home and host, work in coordination:

1. ML/TF/PF risk assessments. Home and host share their ML/TF/PF risk assessments of the financial institutions under their jurisdiction. This information will help the supervisors understand the inherent risks posed by the financial institutions.
2. Emerging ML/TF/PF issues. Home and host share information on emerging threats, vulnerabilities, and typologies. This includes intelligence related to new methods, techniques, or channels used for ML/TF/PF purposes. By exchanging this information, supervisors can enhance their understanding of evolving risks and adapt their supervisory approaches accordingly.
3. Supervisory findings. The supervisors can share their findings, inspection reports, enforcement measures and other supervisory information related to ML/TF/PF risk management and AML/CFT compliance of financial institutions, but also on fit and proper assessments. This includes details on deficiencies, weaknesses, and areas of improvement identified during inspections or ongoing supervision. The supervisors can use this information to complement their supervisory activities and assess the effectiveness of the institutions operating within their jurisdiction.
4. Changes in AML/CFT regulations. Home supervisors can inform host supervisors about changes in AML/CFT regulations, laws, or guidance within their jurisdiction. This exchange of information ensures that host supervisors stay updated and can align their supervisory expectations and requirements with the evolving AML/CFT standards for the group.
5. Joint inspections. Home and host supervisors can conduct joint inspections in the host countries. For some overarching AML/CFT topics, such as the AML/CFT risk management and governance systems of a financial institution, joint supervisory activities or inspections might be a good option.

RBS strategy components

Four important components of a risk-based supervisory strategy:

1. Medium-term and long-term objectives, approaches, and resources required highlighting the different approaches and objectives for the different categories of risk profiles-- for instance, higher, medium, or lower risks.
2. Operational plan focused on a sector or a group of financial institutions: Processes, compliance testing. 
3. Supervisory activities analyzing trends, typologies, and risks, on one hand, and informing developments, priorities and training, on the other. 
4. Stakeholder engagement with domestic and international relevant actors, facilitating the exchange of best practices, emerging trends, and effective risk mitigation strategies.

Residual risks

The assessment of the inherent risks in combination with the assessment of the AML/CFT controls, will result in the residual risks of an institution. The residual risk will inform the risk profile of an institution.

Inherent risks are ML/TF/PF risks intrinsic to a financial institution’s business activities before any AML/CFT controls are applied. With respect to AML/CFT, inherent risks are generally linked to these risk factors: customers, transactions, products and services, geographic areas, and delivery channels.

AML/CFT controls refers to the measures that an institution has in place to mitigate ML/TF/PF risks by way of policies, procedures and systems. Qquestionnaires or self-assessments tools with assigned weightings. 

Residual risks are the ML/TF/PF risks of a financial institution after AML/CFT controls have been implemented. Determining the residual ML/TF/PF risks is an important part of the process of developing a risk profile of a financial institution. A risk profile will help categorize financial institutions into risk levels, allowing the supervisory authority to allocate resources and apply appropriate levels of oversight. 

The relationship between the inherent risks, AML/CFT controls and the resulting residual risks can be depicted in a heatmap or matrix.

Securities Sector risks

National Risk Assessment (NRA). Supervisors should know the ML/TF/PF risks of their country. Where higher risks are identified in a country, supervisors should ensure, to the extent relevant for their task, that their AML/CFT supervisory framework addresses these risks.

Sectoral Risk Assessments (SRA) provide a deeper understanding of the unique ML/TF/PF risks associated with a sector, allowing for the use of targeted risk mitigation measures and regulatory actions across a sector. Supervisory authorities are natural candidates to lead the SRA exercise. The starting point for the development of an SRA is the collection of relevant information about the sector, its participants, and its characteristics. This includes understanding the types of products and services offered, customer profiles, transaction patterns. Subsequently, ML/TF/PF threats specific to the sector are identified as well as the vulnerabilities specific to the sector.

Banking sector risks

Private banking. Management of the wealth of high-net-worth families and individuals. Complexity to ascertain the legitimacy of the source of wealth, as well as the high value and complex transactions typically undertaken by persons using this type of service.

Corporate banking. Large conglomerates with complex corporate structures active in many countries (including countries with a higher risk profile), and the international transactions that they conduct.

Commercial banking. Transactions from businesses having clients who deal in precious metals, precious stones, or in art and antiques, e.g., cash deposits and third-party payments, cash-intensive services.

Trade finance. Goods and funds related to proliferation-sensitive items. Finance products that could be used to finance the procurement of embargoed goods or to obscure the true nature and destination of certain transactions, making it a higher risk area for proliferation financing.

Remittances. Easiness, speed and anonimity of fransferences that can be used to funnel money across borders to support illegal activities.

Risk and uncertainty

Economist Frank Knight made a distinction between risk and uncertainty.

According to Knight, risk refers to situations in which the probability distribution of outcomes is known or can be estimated objectively. In other words, risks are situations where the probabilities of different outcomes can be assigned based on statistical analysis or historical data. Risk, in this context, can be quantified and managed through risk management techniques.

On the other hand, Knight defined uncertainty as situations where the probabilities of outcomes cannot be determined or estimated objectively due to the lack of available data or predictability. Uncertainty involves events or situations that are characterized by ambiguity, novelty, and unpredictability. Unlike risk, uncertainty cannot be easily quantified or managed using traditional statistical methods.

The 3 factors of risk

Risk is a function of three factors:

A threat is a person or group of people, object, or activity with the potential to cause harm (to the state, to society, or to the economy). 

Vulnerabilities are the legal, technical, cultural, political, geographical, and other features that can be exploited by threats or that may support or facilitate criminal activities. (i.e. outdated or ill-designed regulation on beneficial ownership).

Consequence refers to the impact or harm that money laundering, terrorist financing, or proliferation financing may cause, and it includes the effect of the underlying criminal or terrorist activity on financial systems and institutions as well as on the economy and society more generally. (Legal consequences, financial losses, reputational damage, hampering growth, operational impact).

Ideally, a risk assessment, involves making judgments about threats, vulnerabilities and consequences. The ML/TF risk assessment is product of a methodology, that attempts to identify, analyze and understand ML/TF risks and serves as a first step in addressing them. 

Supervisory response

The nature of the supervisory response will be informed by the following:

1. Ongoing monitoring. Review and assessment of the financial institution's AML/CFT measures to ensure that they remain effective in mitigating the identified risks. This will involve, among others, conducting periodic assessments of the financial institution's risk profile, reviewing its AML/CFT policies and procedures, and sampling its customer and transaction data.
2. Offsite and onsite activities. Appropriate balance of resources and efforts between offsite and onsite supervisory activities in line with the risk profiles of the financial institutions. The scope and intensity of these supervisory activities will also be based on the assessed risks.
1. Offsite activities generally focus on identifying and assessing an institution’s ML/TF/PF risks, though they may also include broader AML/CFT-related topics.
2. Onsite activities typically involve assessing the level of AML/CFT compliance, but they can also serve to gain deeper insights into an institution’s risk management practices.
3. Periodic re-assessment. Adequate follow-up by the supervisory authority of any new facts or developments within a financial institution or sectors that may impact on the ML/TF/PF risks for the financial institution or sector, a structured dialogue with supervised institutions’ management, and outreach sessions and feedback meetings with a financial institution or the sector as a whole.

Key supervisory objectives

An effective AML/CFT supervisory framework with the following key objectives:

1. Identify and assess ML/TF/PF risks. Analyzing the nature and scale of inherent ML/TF/PF risks and the effectiveness of AML/CFT systems and controls in place.
2. Ensure compliance. Assessing the AML/CFT systems and controls of institutions, and incentivize compliance.
3. Mitigation of ML/TF/PF risks. Providing guidance on best practices for AML/CFT compliance commensurate with the identified risks.
4. National and international cooperation. Facilitate cooperation and coordination by working with other national and international AML/CFT supervisors and law enforcement authorities to share information and coordinate efforts.
5. Enforcement. Put in place enforcement measures proportionate to the severity of breaches (administrative sanctions, such as fines, or referring the matter to law enforcement for criminal prosecution).

Judicial review

The judicial review process allows an affected party to challenge the decision made by the regulatory or administrative body by seeking a review of the decision by a higher authority, typically a court of law.

Three main grounds of judicial review:

1. Illegality. The regulatory or administrative body has acted outside its legal authority when imposing the sanctions (e.g. discretionality).
2. Unfairness. The regulatory or administrative body has not followed a reasonable process. It might be because a decision-maker was biased or the institution was not given the chance to make representations.
3. Irrationality. This applies when the decision to impose the sanctions is so unreasonable that no reasonable regulatory or administrative body could have made the decision in question. This may include a decision that is arbitrary, capricious, or based on irrelevant considerations.

Pros and cons of publishing sanctions

Publicizing the administrative sanctions for AML/CFT violations.

Pros:

• Deterrent to other financial institutions. 
• Foster culture of responsibility among financial institutions.
• Motivate financial institutions to prioritize mitigating ML/FT/PF. 
• Promote transparency in the financial system. 
• Build trust in the supervisory authority and financial institutions.

Cons:

• Public action may not be appropriate, proportionate, or achieve the intended outcome.
• Impact reputation of the financial institution.
• Impact institution's ability to attract and retain customers, investors, and employees. 
• Increase the risk of legal action against the financial institution. 
• Disclosure of sensitive information related to the financial institution's operations.
• Revelation of  confidential or very sensitive information 
• Potentially systemic impact on the whole sector.

types of sanctions

1. Reprimand Letter. Warning the institution to discontinue minor AML/CFT violations.
2. Corrective Action Order or Instruction. To take specific actions to address AML/CFT violations, such as implementing new policies and procedures or improving internal controls.
3. Cease and Desist Order. To stop engaging in activities that violate AML/CFT regulations. These may be accompanied by fines (e.g., daily, weekly, monthly) for non-compliance with the order.
4. Monetary Fine. Calculated based on severity and frequency of the non-compliant behavior, and proportionate to the financial institution's size and financial resources.
5. Appointing a Caretaker. A team to manage and oversee the AML/CFT operations when there are serious concerns about the institution's AML/CFT compliance.
6. Operational Limitations or Prohibitions. To limit from engaging in specific activities related to AML/CFT, such as opening new accounts or conducting certain types of transactions.
7. Suspension or Revocation of License. In cases of criminal involvement, prevents the financial institution from operating in the financial system until they address the issues and meet the necessary regulatory requirements. Las resort.

Ne Bis in Idem Principle

Any action that violates administrative law will be sanctioned by an administrative regime and any action violating criminal law will be sanctioned under criminal law. Nevertheless, some actions can be in breach of both administrative and criminal laws; and therefore, could be punished twice. This will depend on if and how the principle of ne bis in idem is applied in that country.

Effective, dissuasive, and proportionate

FATF Recommendation 35 requires that supervisory sanctions for breaches of AML/CFT requirements by institutions be effective, proportionate and dissuasive.

• Effectiveness. Sanctions should have a real impact on the financial institution and its behavior, to serve as a deterrent and send a message to other financial institutions. 
• Dissuasiveness. Sanctions should discourage the financial institution from engaging in noncompliant behavior. The cost of noncompliance should outweigh any potential benefit (fines or public disclosure of noncompliant behavior).
• Proportionality. Sanctions should be commensurate with the offense, and should be appropriate to the severity and frequency of the noncompliant behavior. Not too severe, not too lenient. Sanctions must be fair and transparent.