A vaccination for financial crime
Priya Giuliani, KPMG: Financial services can learn from the health industry and its battle against infectious diseases
Transaction monitoring is emerging as one of the top priorities for banks and other financial institutions. Some now employ up to 3% of their workforce to track financial crime. But, as leadership teams look to increase the effectiveness of their processes in the face of regulatory scrutiny and reduce costs, are there lessons to be learnt from health industry and its battle against infectious diseases?
To fulfil ongoing monitoring obligations, financial institutions, such as banks, funds and insurers, typically rely on automated systems to detect unusual transactional behaviours. Their ability to effectively set up those monitoring systems, programme the relevant rules, have meaningful customer segmentation and set adequate risk-based thresholds, is dependent on the availability of up-to-date customer data and a good understanding of the institution’s specific money laundering and terrorist financing risks.
Financial institutions frequently struggle with these factors. Poor calibration typically results in large alert volumes and low conversion rates. Essentially, the system creates a large number of false alerts that each require manual intervention that do not lead to “suspicious activity report” filing, or, the other extreme, financial institutions failing to pick up truly suspicious behaviours.
Current regulations provide limited practical guidance for transaction monitoring and leave financial institutions with the discretion, and burden, of defining their approach in isolation. The industry is on a journey to improve on the current approach, which is not sustainable, and look for greater collaboration.
What does the future look like?
Beyond financial institutions, healthcare offers an interesting parallel to finding an industry-wide solution to overcome these challenges. Specifically, the approach taken with the flu vaccination.
The flu viruses, like criminal methodologies, is constantly mutating. Drug manufacturers need to constantly adapt their vaccines to ensure their effectiveness. However, unlike FIs and transaction monitoring, healthcare does not work in isolation. The World Health Organisation (WHO) uses the Global Influenza Surveillance and Response System (GISRS) Network. This includes a partnership of 112 national influenza centres in 83 countries, which analyse viral evolutionary trends and predict strains for the production of vaccines. Manufacturers are then able to produce the right vaccine to combat the most relevant strains of virus.
Could this be a future model for transaction monitoring? Could there be an overarching (national or supranational) organisation that collates information from its members, assesses the latest money laundering and terrorist financing threats and provides guidance on new methodologies to address such threats?
It is widely recognised that public private collaboration is required, but the model of how this collaboration could take the pain out of monitoring activity has not yet been defined. The introduction of the Joint Money Laundering Intelligence Taskforce has increased collaboration in the UK, but there is an argument for a WHO equivalent for combatting financial crime.
Creating a strategy
There are other applications of the flu vaccine analogy. Like anti-money laundering, vaccine development uses a risk-based approach. Manufacturers need to understand the population, those most at risk, their characteristics and the different threats and viruses in different geographies. Polyvalent vaccines immunise against multiple threats.
A similar thought pattern should be applied to transaction monitoring. In the future, the industry can’t continue to review activity in isolation of other threats. Monitoring for fraud, trading patterns and customer buying behaviours are just a few of the activities that must come together. As such, we need to see monitoring solutions that have a holistic view of the customer and their behaviour. Ideally, the system should be able to adapt quickly to mutating threats and not rely on hard-coded rules that are designed to spot the obvious.
What can be done now?
The re-invention of transaction monitoring will not happen overnight. Financial institutions should engage in discussions about the future within their organisations, across industry and with regulators and law enforcement. This will be a collaborative journey.
In the meantime, companies must be cost-effective in delivering regulatory compliance. There is lots of room for improvement in this area. It can also be argued that the maturity of transaction monitoring varies widely across the industry. For some, it is as simple as ensuring alert handling teams have access to customer and transaction data in one place. But also, are equipped with the right technical equipment, such as dual computer screens and fast processors. This will make a noticeable difference.
At the other end of the spectrum, more advanced institutions may want to identify broader data sets, clean data and bring together various monitoring systems, such as those used in fraud operations, credit approvals or debt collections. This means effectively moving from a transaction viewpoint to a single, consistent customer approach.
Accuracy and algorithms
Progressive organisations are considering where automation could reduce manual effort and cost in the alert handling process. This needs to be achieved while increasing the accuracy and timeliness of reporting and allowing analysts to focus on those cases where more investigation is required.
Algorithms for automated decision making use complex analytical techniques to assess alerts against the historical analyst decisions. This gives rise to two new challenges; firstly, ensuring the technology replicates analyst behaviour accurately, and to ensure that it continues to do so as the business, customer-base and transactions evolve over time.
Financial institutions will still require a small team of analysts to review alerts to provide a knowledge-base for systems to learn from. This is unlikely to change in the near future, even as these new technology solutions become more prevalent. The second challenge is to be able to evidence and articulate the approach that a technology solution is taking to replicate analyst behaviour. And, to do so in a way that can be understood by management, regulators and the wider public. And finally, the third challenge is in deciding how best to phase in automated decision making. This could be through gradually expanding the scale or the role of the review. Starting with monitoring and then evolving to include quality assurance, proposing decisions and subsequently relying on automated decisions with appropriate oversight.
The industry can also invest in the creation of “smarter” rules to reduce the number of false positives. This is a combination of data analytics solutions coupled with a real understanding of criminal activity and the threat landscape. It requires a greater understanding of risk within the firm and a clear articulation of what the transaction monitoring rules are looking for, as well as documented rationale based on the risk assessment of what is not being examined. Articulating the effect of these rules, and demonstrating how they benefit levels of compliance – not just reduce cost – is key to securing support from management and regulators.
So, while the value in optimising transaction monitoring systems is clear, the challenge is re-imagining the future. Financial institutions, including the banking sector, must now work together and pursue a common approach in tackling financial crime. Of course, the industry will need to overcome the legal framework already in place to allow this to happen, but also find co-operation with the public sector to achieve its goals. While there is more work to do to tackle influenza, the financial world and the rest of society would lose little to learn from the successes in healthcare to create a better world.
By Priya Giuliani, partner, forensic risk consulting practice at KPMG
