How Big Data And Industry Trends Impact The Compliance Profession
All businesses must be compliant with some kind of Government regulation. In certain industries, regulation is more complex and thus compliance becomes more complex. For example, financial services and the food industry. How can companies remain compliant, how is compliance evolving, and what is the role of Big Data in this domain?
On Thursday 14 February 2019 I spoke about this topic in an interview of New Business Radio, the digital radio station of the website Financials van Morgen (Finance of Tomorrow; in Dutch). Following up on this radio interview, in today’s blog I’ll elaborate on this topic. For the sake of discussion, I focus on compliance primarily in financial services, however as will become evident in the discussion, the same thoughts are applicable also in other domains. My interview is available as a podcast (in Dutch).
What Is Compliance?
Compliance is the process of adhering to all relevant
Preventing Money Laundering And Terrorist Financing
In recent years, within Financial Services there has been a strong focus on compliance with AML (Anti-Money Laundering) regulations, driven by an increasing globally-orchestrated effort to fight the financing of terrorism and organized crime. In its core, this area of compliance requires financial service providers (so-called “obliged entities”) to perform a Customer Due Diligence process, and to report certain “suspicious” (or: “unusual”) cases to the Government. This is well-described in the diagram below (source: European Commission website). The European Commission explains on its website why such regulation is necessary: “Fighting money laundering and terrorist financing contributes to global security,
Trend Impacting Compliance: More Extensive Regulation
As with other regulations, also Anti Money Laundering (AML) regulation is being updated regularly to reflect new insights and changes in the environment. The trend is that regulation only gets more extensive and more complex; not simpler (just like the business environment and the sophistication of terror groups and organized crime). For example, the 5th AML Directive of the EU now covers exchange platforms for virtual currencies, providers of electronic wallets, rental brokers,
Trend Impacting Compliance: The Responsibility Of The Service Provider
Another interesting development is the responsibility that the regulator assigns to a service provider. Thus not knowing that you facilitate wrongdoing does not relieve you from responsibility for the wrongdoing, because you’re expected to ensure that you do not facilitate wrongdoing. A recent example is ING, a large Dutch bank, who agreed to pay 775 million Euro to settle charges for violations of the AML regulations. According to the Dutch prosecutor, the bank did not prevent that bank accounts of ING customers in the Netherlands were used for the laundering of hundreds of millions of Euros. A similar approach is taken by the regulator also in other areas of compliance. In 2017, the Dutch airline KLM had to pay “for having co-committed the intentional transport of military goods without the required transit license”. Although the airline was merely a transporter of the cargo and not its supplier, and although it is the agent (freight forwarder) who typically obtains such a transit license, as a service provider the airline had the responsibility to verify the content of the shipment and to ensure that the shipment does not violate regulations (in this case: a special permit was required). The court ruling used the word “intentional”, which I interpret as reflecting that not making sufficient effort to prevent a violation is equal to an intentional violation.
Trend Impacting Compliance: Compliance Gets Global
Globalization is not new, but have you considered what globalization entails, from a compliance perspective? For example, if a company operates in the U.S., it is subject to U.S. regulations. Nowadays when companies buy other companies and create complex corporate structures, it is enough that one entity in the family tree does business in the U.S., and the corporation already falls under U.S. law. Similarly, many companies set up entities in Luxembourg, Ireland or in The Netherlands for tax reasons; consequently, they are subject to EU regulations, i.e. they need to be compliant with EU law. Take the example of VimpelCom (current name: VEON). The Russian-owned company agreed to pay 835 million USD to settle U.S. and Dutch charges that it paid massive bribes to enter the Uzbekistan telecommunications market. Because VimpelCom stocks are traded in the U.S. (NASDAQ), the company falls under U.S. anti-bribery laws, which were violated in Uzbekistan. Similarly, due to the company’s headquarters in The Netherlands, it was subject to Dutch and EU anti-bribery regulations. In this case there was not necessarily any wrongdoing in the U.S. or in The Netherlands, but the company was still subject to regulations of these jurisdictions. To conclude: compliance is as global as a company’s operations.
KYC: It’s Not Easy To Know Your Customer
KYC – Know Your Customer – is a process of a company verifying the identity of its clients and assessing potential risks of illegal intentions for the business relationship. A thorough KYC process is part of the due diligence that companies are required to perform. However, it’s easier said than done. Criminals and terrorists excel in hiding their illegal activities, and thus just verifying the details that your client (or: supplier) has given you
The Tough Challenge of a Compliance Team
In sum, ensuring compliance is an ever more complex task, from the regulation perspective (increased regulation), due to the global nature of doing business (regulations in other countries are applicable to your business) and from the business environment perspective (the magnitude of change in company information is too massive for most companies to follow). At the same time, more and more responsibility is placed on the service provider (e.g. bank, art dealer or logistics service provider; and the same applies to any service provider). So how can you remain compliant with the need for a thorough KYC process?
Experience From Other Industries
Client contact moments are critical to
Three Components In Compliance
The same logic holds also for financial service providers or other companies that are required to perform a thorough KYC process and Customer Due Diligence process for compliance with Government regulations. The compliance task can be de-composed into four components:
- Know Your Customer (KYC): understanding who your customer really is.
- Screening your customer once you know who the customer is, you screen the customer against all potential relevant risks
- Risk assessment: The results of the screening are assessed, to decide whether a significant problem has been found (red light), or whether no problem has been found (green light), or whether a more thorough assessment is required (amber light) in order to classify the case as red light or green light. Red light cases would typically be
refused, or reported to the relevant authorities (depending on the risk and the applicable regulations). For green lightcases we can continue the business transactions. - An ongoing data analytics process to understand what is “usual”, and what is “unusual”.
KYC Requires Data
In order to perform KYC, you need access to extensive data about businesses (assuming you’re in the B2B business; if you’re in the B2C business, you need data about individuals). As discussed above, it is not feasible for most companies to keep track of the ever-changing business environment, and therefore understanding who your client actually is should rely on external data. Namely, if you cannot excel is maintaining an up-to-date database on all the companies, use the services of a company whose core business this is.
External Data At Your Service
With this external data you establish:
- What are the true (official) name and address of your client?
- What does your client company actually do? (e.g. if your client’s business with you does not fit their declared activities, this should raise a red flag)
- Does your client belong to a larger corporate structure (e.g. does it have a parent company? A daughter company?). If so, who are these other companies in the same family tree? Note that the corporate structure can extend beyond country boundaries, and therefore even if all your clients are local, you need access to global data.
- Who are the beneficiary owners of your client (similarly: who are the beneficiary owners of your client’s full family tree)?
- What is the identity of key directors within your client organization? Who are
key directors within their parent company? Do they hold roles in other companies too? If so, are these companies legitimate?
Screening Requires Data
This enriched understanding of who your Customer (i.e. with answers to the above questions) serves as input for the screening. In the screening process you verify whether there is any information that links your client – enriched with information about beneficial owners, directors, corporate structures and other relevant business links) appears on any black lists, sanctions lists, or any other relevant list. It is up to you how much you extend this screening, depending on your risk appetite. For example, you can decide to screen the company also against involvement in environmental issues and child labor / modern slavery, or screen the directors against involvement in sex offences. Such enhanced screening is often driven by a CSR (corporate social responsibility) policy or by the wish to mitigate brand damage, and not by regulations. Yet the two come together because both external regulations and internal policies are reasons for screening your business partners.
Data-Driven Risk Assessment
Screening your business relations is an important aspect of making an effort (as the law requires) to detect and prevent cases where your business relations are using you to cover illegal activities. But what if this is a “first time criminal”, i.e. there is no known connection to any known criminal or terrorist, or even to a party that is somehow affiliated with a criminal or a terrorist? Such an entity will not appear on any “black list”. Yet, service providers have the obligation to make an effort to detect unusual behavior of their business relations, which may indicate illegal activities. But what is “unusual”? There’s no clear-cut answer. Neither is it possible to define what is unusual, because “usual” keep evolving, as the business environment changes. And therefore the only way to find “unusual” cases is to have a continuous data analytics effort to define what is usual, and what is not. By examining large datasets of historic data, analysts and supporting software tools detect patterns of normal behavior, as well as patterns of illegal activity. Once you know these patterns, you can compare every single transaction to the pattern, to establish a level of risk. Because the business environment keeps changing, these patterns and rules need to be re-evaluated and adapted on a continuous basis.
Data Analytics Within Financial Institutions
Therefore, analytics skills become a core competency for organizations that want to detect and prevent risks in financial transactions. This is not new to large banks though. Large financial institutions have been among the most IT-savvy organizations for many years, and many of them have large IT departments. The same data analytics skills used for creating risk models for financial investments can also be deployed for detecting fraud, money laundering or other illegal activities. Why is this reasoning important? Because it highlights the conclusion that the Compliance practice requires not only Compliance officers, but also Data analysts and analytics experts as a core skillset.
To Outsource, Or Not To Outsource; This Is The Question
Given that KYC and screening both require extensive data, and that this is not the core business of most companies,
Compliance Is A Never-Ending Journey
Catching the “bad guys” and finding the “unusual transactions” is a never-ending undertaking because the business environment keeps changing. If a bank detects attempts to launder money in one area, the criminals will shift their operations to another area. This is no different than any other area of law enforcement, where police, tax agencies, Customs agencies, border agencies and other law enforcement agencies deal daily with the challenge of “finding the needle in the haystack”. We’re not dealing here with a well-defined problem that has a well-defined solution which can be procured as an “off the shelf” product.
Capacity Building
Instead, the approach is to build a capability within organizations, where:
- Smart and curious people;
- Have access to rich internal data (your data about your clients); and
- Have access to rich external data (about your business relations, about other entities and their behavior; about known offenders); and
- Use data analytics tools to detect patterns of “good behavior” (i.e. low risk) as well as patterns of “bad behavior” (i.e. high risk); and
- Based on the identified patterns, software tools screen transactions in real-time, and pro-actively send alerts to Compliance analysts when potentially high-risk cases are detected
These people, and this process will combine the rigor of data analysis (the “science”) with the creativity of exploring hidden patterns (the “magic”). The combination of science and magic is a key to success.
Why Define Patterns of “Good Behavior”
If we are trying to detect illegal activities, why spend resources on understanding “good behavior”, i.e. behavior that we consider to be legitimate, and very low risk of illegal activity? The answer is simple: efficiency. We consider that most financial transactions are legitimate. Thus if we’re able to to define that these cases are “low risk” (in an automated way), we will not spend any resources on investigating them. We call this “de-risking”.
Businesses Can Learn From Governments
Compliance and fighting fraud go hand in hand, and show great similarities to many areas of law enforcement. Government agencies have a long history of detecting and preventing fraud and other forms of illegal activity. Nowadays, businesses are more and more required to develop similar skills. Thus, experience in implementing such capabilities at Government agencies become highly relevant for Financial institutions. In my own experience – having worked with law enforcement agencies for many years – financial institutions are very well positioned to succeed, because they already are very data- and IT-savvy organizations.
Beyond Compliance: Brand Protection
Digitization is a driver for risk-asymmetry. Information explosion, and even more importantly the ability to easily distribute information to large audiences, created a reality where brands become vulnerable. Negative press or bad customer experience are quickly shared on social media and distributed worldwide. Consequently, brands can be more vulnerable than in the past. Negative press can easily result in loss of share value. Consequently, more and more brands are currently becoming more aware of potential damage to their reputation. As a means to prevent such damage, they perform voluntary Due Diligence checks to their business relations, in a manner that is very similar to checks that regulators impose on financial institutions. Such checks can relate to the business relations’ involvement in environmental crimes, child labor, financial crimes, or even sex offenses of directors within the company. These are different types of risks (compared to AML regulations), but the approach to tackling them is the same.
Where To Start?
Do you recognize these challenges within your own organization, and do you wish to brainstorm about our experiences and about best practices for implementing such capabilities? Get in touch today.
Suggested Reading:
- Big Data For Customs At The Borders: Start Small, Think Big!
- Risk Identification in International Trade – From Data to Science to Insights
