0. Fighting Money Laundering Seven sound practices
Frederick E. Curry III Deloitte Financial Advisory Services LLP October 2, 2013
Crime Stoppers International

1. Seven sound practices
Understand the quantity of money laundering risk at your organization
Confirm that policies, procedures, and controls address all products and services that you offer
“Know Your Customer”
Commit sufficient resources to AML compliance
Customize employee training to address money laundering risks
File required regulatory reports
Test your compliance program regularly
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

2. Understand your money laundering risk
The Board and senior management should know the quantity of money laundering risk within your organization
The U.S. Federal Sentencing Guidelines establish that risk assessments are a foundational element of a compliance program
Products, services, customers, delivery channels, and geographies served should have a risk classification
Relationships posing higher risks should be reviewed more closely at the inception of the relationship and frequently throughout the term of their relationship
Key business stakeholders should be involved in the risk assessment process
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

3. Risk assessment
Institutions should identify, measure and consider four main risk measures
Based on the extent and the combination of the given risk measures, the overall risk of a customer can be quantified and differentiated through calibrated scales from Low to High
Geographies
Channels
Products & Services
Customers •
International Wires
Internet Banking
Large Cash/Large Dollar transactions
Private Banking
Int’l Correspondent Banking
Face - to
Face Banking
Agents
OFAC
Areas of Primary ML Concern
FATF Non-Cooperative Countries
Typical Daily/Monthly Volume
Politically Exposed Person
Industry / Occupation
Customer Geographic Location
Length of Relationship
EXAMPLES OF RISK MEASURES
RISK •
Areas identified in the annual International Narcotics Control Strategy Report

4. Risk assessment matrix
Inherent money laundering risk is assessed across four main risk areas. Multiple risk factors are evaluated within each to determine the overall inherent money laundering risk.
Risk Factor
Low
Medium
High
Customer Base Inherent Risk
Stable, known customer base
Customer base increasing due to branching, merger, or acquisition
A large and growing customer base in a wide and diverse geographic area
Product / Account Type Inherent Risk
Limited or no private banking, trust or asset management accounts
Limited domestic private banking, trust or asset management services
Significant domestic and international private banking, trust or asset management services
Transactional Inherent Risk
Limited number of funds transfers, third party transactions, and foreign fund transfers
Moderate number of funds transfers, limited international funds transfers with typically lower risk countries
Large number of funds transfers incl. noncustomers, PUPID transactions and high risk jurisdictions
Geography Inherent Risk
No transactions with high risk jurisdictions
Limited transactions with high risk jurisdictions
Significant volume of transactions with high risk jurisdictions
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

5. Residual risk illustration
High
Medium
Low
Weak
Moderate
Strong
Final AML
Controls
Assessment
Final Inherent Risk Assessment

6. Establish detailed policies, procedures, and controls
Policies and procedures should be written, up to date and reviewed and approved by Board of Directors or other authority
Policies and procedures should cover all products and services
Policies and procedures should be commensurate with levels of compliance risks
Policies and procedures should be implemented
Policies and procedures must be effective!
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

7. Know Your Customer (“KYC”)
KYC is the basic tenet of an effective AML compliance program
KYC procedures help protect the institutions good name
KYC is an essential part of sound risk management
KYC procedures should articulate customer acceptance standards
KYC provides the basis for identifying unusual or suspicious activity
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

8. Commit sufficient resources to compliance
Senior management is responsible for establishing an effective compliance function
The compliance executive should be a member of senior management
The board and senior management is responsible for ensuring the compliance function has the resources to carry out its responsibility effectively
The compliance function should establish an annual compliance plan
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

9. Customize employee training
Education is essential in managing compliance risks
Training should be based on a formal training needs assessment
Training should be tailored to the institution’s risk profile
Leading practice is to train all employees at least annually
The board and senior management should also receive compliance training
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

10. File required regulatory reports
Reports establish a paper trail for criminal investigations
Regulatory reporting has been highly useful in warding off criminal prosecutions
Regulatory reports must be accurate and filed timely
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

11. Test your compliance program regularly
It is important to independently assess the effectiveness of the compliance program
Leading practice is to test the program annually
The scope of testing should include all products and services
A written report summarizing the findings should be provided to senior management and the board
Compliance deficiencies should be logged and tracked to resolution
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

12. Most common compliance weaknesses
Insufficient resources dedicated to compliance
Inadequate KYC procedures
Employees have not received relevant compliance training
Unqualified compliance staff
Failure to identify and periodically monitor high risk accounts or activity
Lack of automated transaction monitoring procedures
Poor record keeping
Failure to file timely and accurate required regulatory reports
2 aspects:
Information sharing
Policy shifts as gov’t link to international economy

13. Deloitte Financial Advisory Services LLP
Frederick E. Curry III Principal Deloitte Financial Advisory Services LLP th Street, Suite 500 Washington, DC
This publication contains general information only and Deloitte Financial Advisory Services LLP is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.
Deloitte Financial Advisory Services LLP shall not be responsible for any loss sustained by any person who relies on this publication.

14. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Please see for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.
Copyright © 2011 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited 14