A.risk.perspective aml

Mohammad Fheili ⌂⌂⌂ fheilim@jtbbank.com
The 5th Annual Forum for
HEADS OF AML/CFT UNITS AT ARAB BANKS AND FINANCIAL INSTITUTIONS
November 10th & 11th of 2015
Movenpick Hotel
The Many Facesof Compliance Risk

Over 30 Years of Experience in Banking . . .
Mohammad Fheili currently serves in the capacity of an
Executive at JTB Bank in Lebanon.
 He has successfully delivered over 1,500 hours of training
to professional bankers.
 He served as an Economist at Association of Banks in
Lebanon (ABL), and as a Senior Manager at BankMed and
Fransabank.
 He worked as an Advisor to the Union of Arab Banks.
 Mohammad also served as Basel II Project Implementation
Advisor to CAB and HBTF Banks in Jordan.
 Mohammad received his college education (undergraduate
& graduate) at Louisiana State University (LSU), and has
been teaching Economics and Finance for over 25
continuous years at reputable universities in the USA (LSU)
and Lebanon (LAU).
 Finally, Mohammad published over 25 articles, of those
many are in refereed Journals (e.g., Journal of Money
Laundering & Control; Journal of Operational Risk; Journal
of Law & Economics; etc.) and Industry Bulletins.”
mifheili@gmail.com
+(961) 3 337175

A Risk Perspective . . .
Between Ambiguity, Ignorance, Uncertainty, Risk
and Fear . . .
Between Compliance Risk & The Risk of Non‐
Compliance?
Risk

Client is Engaged
Compliance Cycle
Service Cycle
st1Client
Interface
Start
Interface
End
CIP, KYC
AML Compliance (Regulator Decides)
Client Engagement is Constrained by: The Bank is
Deemed AML‐Compliance Responsible & Accountable
Customer Satisfaction (Customer Decides)
Client Engagement is Driven by: The Potential for
Revenue: Interest Income, Commissions & Charges;
and a Word‐of‐Mouth Free Marketing
Branch
Both Cycles Are Ongoing
Processes; None is a Destination
by itself
The Most Critical Customer
Interface; Manage With Care:
You Either Collect all the
needed information (CIP &
KYC), or you have planted the
seeds of Troubles to Come . . .

On Going Monitoring &
Compliance
Client is Engaged
Compliance Cycle
Service Cycle
st1Client
Interface
Start
Interface
End
CIP, KYC
DD, EDD
Branch
On Going Follow up &
Service
 Handling Complaints
 Cross‐Selling
 Updating Customer
Profile (CIP),
 Etc….
Possible Source of RISK: IF “Satisfaction” is
Competing with “Compliance”
End
Customer Risk Scoring
Customer Due Diligence Risk
Automated Transaction Monitoring Systems
Cash Aggregation and Reporting Systems,
Etc…..
Scope & Scale of Client Engagement is
a Function of:
 Client Satisfaction
 AML Compliance
 Ability to Have “Satisfaction” and
“Compliance” both Converge for
the interest of the Bank.

AML
ComplianceCustomer
Satisfaction
Process
Gap
Closing The Gap:
To Secure Accuracy, Completeness
and Consistency of Client‐Data,
BankCompliance Officer Must
Persuade the Client to Supply the
needed Information; NOT FIGHT
WITH HIM/HER
 Lack of Awareness
 Absence of Know‐How
 Fear of Losing the Business
 Corporate Culture
 Failure to See the Value Added
in AML Compliance, Etc….
 No Sustainable Compliance
 Client Retention is Weak
 Reputation is Tainted
 Etc….
Caused By:
Significantly Impact:

Banking Has Been
Dynamically
Changing….
The Good Old Days!

But Technology & Automation did not change “The Person”; it ONLY
Changed “Processes” and “Transactions”
SIMPLE! Bricks & Mortals
Data is
Important, BUT
People Come
1st
Data Come 1st;
People Turned into
Shadows!
Technology‐
Intensive
Production
Processes
>>> More COMPLEX!

No Doubt, We Are Evolving . . .!
We Must Recognize that:
 The absolute Impossibility of Accurately Predicting the Future, Particularly at the Detail Level (and the Devil of Money
Laundering and Sanction Violation Reside in the Details)
 The Decisions/Reactions of People Creating the Future are only Partially Predictable, and are Linked to their Current
Set of Relationships Through a Complex Responsive Process (AML Compliance Starts & Ends with The Person)
 We like to convince ourselves that “Technology” is (or Has) the Solution to Everything. BUT Technology ONLY Changed
the Process/Transaction but NOT the Person (Potential Source of AML Risk)
 Automated
Processes
 Data‐Rich Decision
Processes
 Complex Products
& Services
 E‐Banking
 M‐Banking
 E‐Payments
 Etc.
Rendering AML Compliance
Increasingly COMPLEX & Cumbersome!
From
Papers

Data
Technology
RelationshipsProcess
Connected Eco‐System
Revenue Pressures
brought on by regulatory
compliance, Low interest
Rates, Increased Customer
Demands and new
competitive threats
require new Business
Models that are both
Strategic and Integrated in
Approach.
In a connected ecosystem,
human interactive virtual
environments allow FSIs
to foster collaboration in a
cross functional,
integrated approach to
regulatory readiness.
FSIs must enhance customer
engagement by creating
compelling multi‐channel
experiences and developing
innovative business models
that capitalize on the
emergence of a networked
society.
Financial Service
Institutions risk losing
ground on competition
unless they can restore
market and customer
trust, manage
regulatory changes
effectively, lower
expenses and introduce
new revenue streams.Organizational
Agility: Readiness
To Cope

NON-FINANCIAL
Services
(Unintentional Risks Taking)
(esp. Operational risk)
The Core
Banking
Activities
FINANCIAL Transactions / Services
(Intentional Risk Taking)
(esp. lending money and taking in deposits
which = Credit Risk, Market Risk, Liquidity Risk etc.)
Are The
Product
of
=
Financial risk and other risks must therefore be measured,
managed and optimised as a core competency.
&
Core Drivers of Financial
Performance Measurement /
Evaluation
Earnings
Capital
Adequate
Capital
1. This Reality Changed The Way Banks Look At RISKS

Return
Risk
Return
Risk
Speculative Risk
Managing Revenue
Hazard + Others
Managing Costs
Market Risk
Reputation Risks
Operational Risk
Liquidity Risk
FX Risk
Other Risks
Other Risks
Where Should
We House AML &
Compliance Risks
Intentional
Risk
Unintentional
Risk
AML RISK
Compliance RISK
CREDIT RISK

In Desperate Search
for Risks (Intentional &
Unintentional) which
May Be Encountered
By The Financial
Institution . . .
Non‐Identifiable Risk
Non‐Identifiable Risk
Financial Institution’s Risk Population
What is Normally Used in
Risk Identification:
• CIP
• KYC
• DD
• EDD
• Complete Credit File,
EAD, LGD, PD, UL, EL,
etc. and Proper
Follow Up
• Comprehensive &
Consistent Data about
the Market
• Etc.
Identified &
Identifiable
Risks
• Expected Losses
are normally
controlled or met
using Gross
Income,
• While Unexpected
Losses require
Capital.

Understand Potential
Outcomes.
Aware of Probability of
Occurrence
“Blank” over the Nature &
Scope of the Outcomes.
Aware of Probability of
Occurrence
“Blank” over the Nature
& Scope of the Outcomes.
Unaware of Probability of
Occurrence
Understand Potential
Outcomes.
Unaware of Probability
of Occurrence
RiskUncertainty
AmbiguityIgnorance
The Purpose behind Risk
Identification is to carry this
step further to:
• Provide Evidence on
Probability of Occurrence
• Push Towards Increased
Understanding of
Potential Outcomes.
There is a BIG difference
between Ambiguity,
Ignorance, Uncertainty and
RISK.
Increasing Our Understanding of
Potential Outcomes
Increasing Evidence on Probability of
occurrence

Increasing Our Understanding of
Potential Outcomes
Increasing Evidence on Probability of
occurrence
RiskManagement Ambiguity
Uncertainty
Data‐Rich, Information‐Driven
Decision‐Making Process:
 KYC, CIP, DD, EDD, RBA, Etc..
 EL, UL, PD, EAD, LGD, Etc…
 DEaR, VaR, Etc…
Ignorance
The Financial
Institution is expected
to collect the needed
data to move closer to
Risk Management and
Away from Ambiguity,
Ignorance, and
Uncertainty.

Universe Compliance
The of
Soft: Regulatory,
Data, Figures, etc.
Hard: Regulatory,
Legal, Incriminating,
People, etc.

Basel I
Basel II
Credit Risk
Credit Risk
Market Risk
Operational Risk
1986 proposed
1999 proposed
1988 effective
2007 effective
Basel III
Credit Risk
Market Risk
Operational Risk
Capital Quality
Additional Buffers
Liquidity: LCR, NSFR
2009 proposed
Kick Off in 2011
Amendments
Amendments
Basel 2 ½
Basel 1 ½
Amendments
Basel3½
Basel IV
2015 Anticipated
Kick Off in 20??
• Capital Requirements
• Liquidity Requirements
• Disclosure Requirements
• National Divergences
• Risk Sensitivity
• Use of Internal Models in
Decision Making
• Total Risks = Credit Plus
Market Risks
• Internal Models Emerged
• Later on, Tier 3 Capital
• Enhanced Pillar 2, 3
• Complex Securitization
obtained higher Risk
Weights.
• Trading Books
Regulations
• How Often the Banking Model Has Changed
• How Often Regulatory Guidelines Have Changed
• How Complex The Banking Environment Has Become
• How Technology Has Evolved
• How Many Crisis Have We Had.
1. The Soft Side of Compliance: The Basel Accord

MAXIMIZE PROFIT subject to:
RISK , REGULATORY,
Compliance, Reporting, Etc. Constraints
RISK .  . .
 Default
 Liquidity
 Maturity
 Others . . .
REGULATORY . . .
 Basel I
 Basel II
 Basel III
 Basel IV (In the making)
 TLAC Requirements
 Sanctions Rules
 USA_FATCA Requirements
 OECD_CRS (1st Reporting 2017)
 IFRS9
 AML, Etc. . . .
Uses of Funds Sources of Funds
 Reserves
 Loans
 Securities
 Other
Investments
 Fixed Assets
 .  .  .
 All Types of
Deposits
 Borrowings
 Other
Sources
 Capital
 .  .  .
Off-Balance Sheet
Legal Issues .  . .
2. The Soft Side of Compliance: The Banking Model

PRIMARY SECONDARY
PEOPLE
Employee Fraud / Malice (Criminal)
PROCESSES
Payment / settlement / delivery risk
SYSTEMS
Technology investment risk
EXTERNAL
Legal / Regulatory Risk / Public Liability
Unauthorized activity / Employee misdeed (Willful)
Employment Law
Workforce disruption
Loss or lack of key personnel
Documentation or contract risk
Valuation / Pricing
Internal / External reporting and compliance
Project risk / Change management
Selling Risks
System development and implementation
Systems failures
Systems security breach
Systems capacity
Criminal Activities
Out‐sourcing / Supplier Risk
In‐sourcing Risks
Disaster and Infrastructural utilities Failures
Political and Government Risks
People are the Source of Many Risks
and the Solutions to the Management
of all Risks!
There are no right answers here only
“acceptable” ones and what is
acceptable is very much driven by:
• People’s risk attitudes and
• The Organization’s culture (i.e.,
People)!
3. The Soft Side of Compliance: Treatment of Operational Risk (Where
COMPLIANCE Resides)

4. The Soft Side of Compliance: Treatment of Operational Risk
• Expected Losses Are Controlled Using Gross Income,
• Unexpected Losses Require Additional Capital.

What is the Cost of
Non‐
Compliance?

Non‐Compliance By
Mistake… Due to lack of
understanding …
1. The Hard Side of Compliance: Compliance Choices!
Simply Comply
Comply By Fear

2. The Hard Side of Compliance: Bank Clients
Legal Obligation Where its
impact on the Financial
Institution’s Reputation and
Performance is often severe.
Profitability suffers, and it
triggers immediate additional
expenses for Damage Control.
Regulator Obligation Issues
of non‐compliance are handled
inside closed doors Regulators.
The
Issue of
Jurisdiction
AML Compliance: It’s Time for Thicker Gloves . .
.  Sometimes You Lose By A Knock Out
AML Compliance: It’s Time for Thicker Gloves . .
.  Sometimes You Lose By A Knock Out

The FI The Amount The Sanctions [Countries]
$8.9 Billions Sudan, Iran, Cuba
$1.3 Billions and $665
millions in Civil Penalties
Cuba, Iran, Libya, Sudan, Burma
$619 millions Cuba, Iran
$536 millions Iran, Sudan
$350 millions Iran
$298 millions Cuba, Iran
$227 millions Iran, Sudan, Libya, Burma
No criminal
intent but hefty
fines… Thus the
element of
Fear.
Not to mention
the implications
on Reputation.
3. The Hard Side of Compliance: The Cost Of Non‐Compliance

As the Financial industry has evolved:
Offering New high‐risk products,
Acquiring new types of customers, and
Adapting to frequently changing money laundering requirements
Banks increasingly rely on complex models to meet the challenges of
AML Compliance.
Bank Regulators are Resolved to Punish banks and other Financial Institutions that
fall behind in the struggle to stay current with Anti‐Money Laundering (AML)
Regulations.
This hardline approach is evident in several recent high‐profile enforcement
actions, fines, and penalties assessed by regulators against financial institutions
with lax controls over money laundering.
Some of these actions were the result of a Bank’s failure to appropriately apply
the concepts of a model risk management framework to design, execute, and
maintain the models it deployed to manage AML Risk.
4. The Hard Side of Compliance: Changing Environment!

The Regulator Aims for Continuous Compliance Which can only be made possible
through Full Automation of The Compliance Process.
The Regulator Aims for Continuous Compliance Which can only be made possible
through Full Automation of The Compliance Process.

Many Banks are using AML Models for:
 Customer Risk Scoring
 Customer Due Diligence Risk
 Automated Transaction Monitoring Systems
 Cash Aggregation and Reporting Systems, and
 Watch‐List Filtering Systems.
The Term “Model” refers to;
 A Quantitative Method,
 System, or
 Approach
That Applies
 Statistical,
 Economic,
 Financial, or
 Mathematical theories,
 Techniques, and
 Assumptions
To process input data into quantitative estimates. This framework enables banks to predict and
identify risk more accurately and, therefore, make better top‐level and line‐of‐business decisions
based on model results.
BUT BANKS often rely on Vendor Input, Feedback, . . .
Much more than a Comprehensive Self‐Assessment
Automated AML Compliance Processes, . . .
5. The Hard Side of Compliance: Modeling Risk & Reporting!

Low
High
Low
High
Accept
Mitigate
Transfer
Avoid
Frequency of Occurrence of Mistakes in Serving the
Client
Severity ofLosses Resulting From These
Mistakes
High‐Frequency / High‐
Impact Client Account (Or
Transaction) Behavior
Low‐Frequency / High‐
Impact Client Account
(Or Transaction)
Behavior
High‐Frequency / Low‐
Impact Client Account (Or
Transaction) Behavior
Low‐Frequency / Low‐
Impact Client Account
(Or Transaction)
Behavior
Operational Risk (Frequency/Impact) Characterization of Money Laundering
ML‐Incidents Population of the Bank
It’s likely that any change in the
Financial Institution will have
some impact on its Operational
Risk Profile: AML Processes
Automation tends to replace
people with systems.
In terms of operational losses,
the result may be a transition
from High‐Frequency, Low‐
Impact losses TO Low‐Frequency,
High‐Impact losses. The event
type will change as well.
Risk‐Culture
Awareness
maybe a superior
solution to
Automation
Compliance is turning Time
Consuming

Low
High
Low
High
Accept
Mitigate
Transfer
Avoid
Here there are clear evidence of High Risk due to Unusual account
activities, Sanctioned Countries, High‐Risk Professions, etc. IF COST
(and/or FEAR) is an Issue, an FI would be more likely get engaged in
De‐Risking with Low‐Frequency/High‐Impact & High‐Frequency/High‐
Impact Client Incidence: Discontinue Relation with Existing, and
decline Business with New Clients with similar Risk Profile.
These would be some
missing information on
the KYC/CIP, slacking on
Staff Training in AML,
etc.
Although ML incidents are characterized
with low impact, there is a need to
carefully probe about their Root‐Causes:
• Due Diligence
• Enhanced Due Diligence
• Risk‐Based Compliance
To prevent having these incidents turn into
High‐Frequency/High‐Impact Or Incidents
of Non‐Compliance
Frequency of Occurrence
Severity ofLosses
Resorting to Automation
may not always be the
best solution; especially if
the Financial Institution is
not adequately equipped
with the capacity to
Manage Advanced IT
Environment.

Level Of Maturity in AML Compliance
Nature & Extent of Efforts Deployed
DD
EDD
RBA
Moving in this direction is a clear indication that there is a desire
on the part of the FI to continue on serving the client. Otherwise,
the FI would be engaged in De‐Risking
Due Diligence
Enhanced Due Diligence
Risk‐Based Approach to AML Compliance
Enhancing Compliance Capabilities …
AML Cost
Skills Needs
Know‐How
AML Analytics
Those Enhanced AML Compliance Steps require
the Use of Technology. Increase reliance on
Technology; Increase exposure to Technology
Failures. In such an instance, does the FI have a
good track record with Managing Technology
Issues?

Level Of Maturity in AML Compliance
Nature & Extent of Efforts Deployed
Where the FI is on this Continuum
of AML Compliance Maturity has
to do with:
• Profile of its Portfolio of Clients
• The FI’s Geographical Spread
• Management Sensitivity to
rising Cost of Compliance (Cost
is Real)
• Perceived Benefits (hard to relate
to the Benefits of Compliance
outside the scope of Avoiding hefty
Penalties)
• Resource Availability
• Tolerance for Risk
• Fear (of Penalty)
• Etc.
DD
EDD
RBA
Due Diligence
Enhanced Due Diligence
Risk‐Based Approach to AML Compliance
Enhancing Compliance Capabilities …
AML Cost
Skills Needs
Know‐How
AML Analytics

A.risk.perspective aml

More Related Content

What's hot

Viewers also liked

Similar to A.risk.perspective aml

More from Mohammad Ibrahim Fheili

A.risk.perspective aml