AP Solutions IO is happy to come back to you to comment on and dissect theACPR's latest condemnation, mainly on anti-money laundering and terrorist financing issues (AML-CFT).
ACPR once again sanctions a French mutual insurance group to the tune of 4 million euros.
This sanction is mainly focused on the screening and detection system for sensitive persons that the regulated professions must implement.
The ACPR's main criticisms:
- A novelty on data quality, which will set a precedent:
the quality and quantity of data entering the relationship is clearly judged insufficient, with the ACPR explicitly requesting :- Date of birth (or at least year of birth)
- Country of birth
- Representatives/Beneficial Owners of a legal entity
- Detection by "exact match", i.e. without spelling approximation (strictly the same name): FORBIDDEN.
This was already present in the last convictions. Here, it's reiterated in the strongest terms: you can't rely on absolute spelling concordance. Fuzzy logic" is required. - Weekly frequency for updating lists of Credit/Sanction freezes: INSUFFICIENT.
- Absence of detection of a sanctioned ongoing business relationship: Customer stock must not be omitted from the screening process, particularly following the updating of the Credit/Sanction Freeze lists.
Let's get into the details!
Screening quality
Screening must absolutely be carried out by a "fuzzy logic" detection engine (orthographic approximation) and not simply "exact match". Relevant screening requires a high level of data quality in the customer base (distinct first and last names, date of birth and country of birth, gender, etc.).
The ACPR contests a match rate of 99% for the detection of Politically Exposed Persons!
APS' opinion: It is essential to carry out searches with spelling approximation. In general, the tolerance threshold for Sanctions and Asset Freezes remains low, which increases the number of alerts. In the case of Politically Exposed Persons (PEPs), their close relations (RCAs) and/or Persons with a bad reputation (Adverse Media), the thresholds can be increased (without, however, reaching "strict matching" or simili) in order to limit the number of alerts.
As a reminder, in terms of AML-CFT, the regulated professions have obligations to achieve results in terms of detecting persons under sanction and/or asset freeze. Whereas they have obligations of means concerning the detection of PEP, RCA, AME,...
List updates
Also reported by the ACPR, list updates (freezing of assets, politically exposed persons, etc.) are too infrequent(e.g. weekly).
APS's opinion: It is essential that your AML-CFT systemautomatically integrates, on a daily basis, at a minimum, all lists of sanctions and freezing of assets, as well as lists of politically exposed persons, their relatives (RCA) and/or persons with a bad reputation (Adverse Media), high-risk countries...
Screening frequency and scope
The ACPR considers that monthly or even weekly screening frequencies are still insufficient, particularly with regard to obligations concerning the detection of asset freezes.
APS' opinion: It is essential that your screening tool filters your entire customer portfolio on a daily basis. This automated screening should then highlight only new alerts or alerts that have undergone a major change. For the sake of productivity, previously decided alerts that have not undergone a major change should not be resubmitted to the decision of an operator/analyst AML-CFT.
Data quality and quantity
As with most sanctions since the beginning of the year, this latest one has not escaped criticism for the level and quality of its customer knowledge:
- Information that is too vague or too imprecise does not allow for acceptable customer profiling and risk classification.
- In addition, proof of identity and knowledge of the customer is essential.
- Customer knowledge based on declarations is still tolerated for customers deemed "low risk", but is not recommended.
APS's advice : It is essential that any action, decision (manual or automatic), supporting document, comment, etc. be traced and stored in your tool AML-CFT, with the possibility of making them available at any time. ACPR inspection reports prove that investigators know exactly what to ask to verify compliance of AML-CFT systems. What's more, your system must be capable of integrating and analyzing any data you may transmit to it. The quality of the information transmitted is essential if the ACPR is to consider your AML-CFT system as adequate.