This May 2023, it's the turn of a car finance company to be nabbed by the ACPR.

The result? A ½ million euro fine and a reprimand. Not to mention a remediation plan estimated at around 4 million euros, half of which for developments/tools.

Somewhat new to this type of sanction, one of the criticisms concerns the control exercised by the taxpayer over his outsourced service provider.

Find out more about this sanction, including the grievances of AML-CFT.

Internal control of outsourced services

The ACPR reprimands the reporting entity for having placed total trust in its service providers for the tools and/or processing of first-level alerts.

In addition to a lack of formalism in the way services were provided, it was above all imprecise deferrals, or even the inability to provide supporting documents for certain processes, that the Supervisory Authority pointed the finger at. It is even clear from the grievances that the "Freezing of Assets/Sanctions" and "Politically Exposed Persons" detections were not carried out by the same system.

Lastly, the ACPR points out that responsibility lies with the registrant, not the service provider.

APS notice:

To make life easier for themselves, tax authorities need to turn to agile, high-performance tools capable of processing very large volumes of data, in order to be able to detect all types of alerts. Sanctions, asset freezes, PEP, reputational risks, country risks, embargoes... all need to be processed in a single, central tool.

This tool must also enable exhaustive traceability and total explicability. Whether machine actions (such as automatic reduction of false positives) or user actions (decisions, comments, supporting documents, etc.), the taxpayer, particularly in the event of an audit, must be able to obtain this data easily, particularly in a wide range of Reports. The tool must allow very fine granularity in the data it can return, both quantitatively and qualitatively.

What's more, the audit trail must be non-alterable, so that the regulatory authorities have no doubts about the veracity of the information transmitted to them.

Also, if the service provider's teams have historical experience and are familiar with the different expectations of Auditors, then this can only be a bonus!

Human resources

While this contractor had over 120,000 contracts to monitor, the team consisted of just 2 employees. The team grew to 5 people.

The ACPR deemed this insufficient, as it did not allow the following actions to be carried out correctly, among others:

• Validate Relationship Entries, especially when risk is higher than normal
• Identify risks AML-CFT during the business relationship
• Process suspicions of Politically Exposed Persons (PEPs) within an acceptable timeframe, as well as those under Sanctions/Asset Freezes!

APS notice:

Under-staffing of Compliance teams can cause :

• Processing times too long
• Too many unprocessed alerts
• Alerts reviewed too quickly and misjudged
• ...

That's why it's important to have a tool with augmented intelligence and a high-performance (and fully explainable) reduction engine . Similarly, the tool must be capable of aggregating a large number of data items, so as to be able to render them in one and the same place.

In this way, the tool automates certain decisions to relieve KYC/Compliance operators, but also to smooth the customer path, especially when entering into a relationship.

Customer Knowledge

Data quality and quantity are crucial in a AML-CFT system. During this audit, the ACPR paid particular attention to the processing of corporate bodies and their Beneficial Owners.

 The ACPR states that reporting entities may rely on external sites (including official ones), but that they are still obliged to collect the information and supporting documents themselves for KYC purposes.

APS notice:

Reporting companies can therefore use a detection tool to enrich customer data by retrieving and verifying Beneficial Owners and/or the representatives of legal entities.

However, the tool must also enable them to add supporting documents , and even create inter-file relationships to get a true overview.

In this way, regulated professionals can also notice discrepancies between the Official Registers and the declarations and/or their own knowledge of the Third Party.

Update customer knowledge

The ACPR states that no update frequency was defined for customers with a standard/low risk level. For the others, if an update request remained unsuccessful, this had no impact on the processes for this Customer...

APS notice:

In addition to the daily update of lists of sensitive persons, the regular updating of customer files ensures better data quality and therefore better detection of sensitive persons.

The AML-CFT tools must filter and analyze your entire customer portfolio on a daily basis (note that this was done by the sanctioned taxpayer). This automated screening should then highlight only new alerts or alerts that have undergone a major change. In the interests of productivity, previously decided alerts which have not undergone a major change should not be resubmitted to the decision of an operator/analyst AML-CFT.

On the other hand, the tool used must be capable (depending on a decision, level of risk...) of telling you what actions and supporting documents are required for excellent follow-up of commercial relations.

Detection of PEP

The February 2023 sanction is starting to set a precedent... A reporting organization cannot rely entirely on an external tool, and must be able to verify its effectiveness (see the Internal control of outsourced services section above).

APS notice:

It is essential to carry out searches with approximate spelling. In general, the tolerance threshold for Sanctions and Asset Freezes remains low, which increases the number of alerts. In the case of Politically Exposed Persons (PEPs), their relatives (RCAs) and/or Persons with a Bad Reputation (Adverse Media), the thresholds can be increased (without, however, reaching "strict matching" or simili) in order to limit the number of alerts.
As a reminder, in the field of AML-CFTAs a reminder, in the field of financial intelligence, regulated professions have a duty to achieve results in terms of detecting people under sanction and/or asset freezes. The detection tool used must therefore be capable of using lists from private suppliers, as well as internal lists.

It is also essential for a screening tool to be parameterizable and to take into account all internal Compliance criteria. It is worth noting that the regulatory authorities are adamant about any inconsistencies between the theoretical compliance policy and the configuration of their tools AML-CFT. What's more, this configuration must be easily exportable, so that an auditor can be presented with an explanation of how the system works at any time.

Handling suspicions Sanctions / Freezing assets

The ACPR congratulates regulated professionals for screening their customer portfolios on a daily basis against the Sanctions / Assets Freeze lists. However, this effort is in vain, since when an alert is generated, it is processed several days or even weeks later! Whereas the authorities expect an alert to be processed within 24 hours...

APS notice:

As a reminder, when it comes to AML-CFT, the professions subject to the law have performance obligations regarding the detection of people under sanction and/or asset freezes. In the interests of productivity and time savings , the screening tool must be able to warn you instantly (by email, for example) that a suspected Sanction / Asset Freeze has been generated.