Risk profiling: designing a higher-risk countries strategy?

Mark Spiers and Ian Smith look at the elements involved in preparing a higher-risk countries policy, and how and when to apply it.

The UK’s Money Laundering Regulations 2007 require those firms to which they apply to develop and implement systems and controls to forestall and prevent money laundering on a risk-sensitive basis. The Law Society Practice Note on Anti-Money Laundering sets out some areas where its authors believe “money laundering and terrorist financing risk” to be high. Their categorisations might be meant for the UK and its dependent territories, but the work they and other commentators have done is also relevant to many other jurisdictions.

   The Practice Note and the guidance issued by the British Bankers Association’s Joint Money Laundering Steering Group (JMLSG) list various national and international reports that might help firms identify such areas of risk. Firms are expected to check identities, the client’s financial situation and circumstances of their engagement with increased vigour when clients or transactions involve ‘higher-risk jurisdictions’. Both the JMLSG and the Law Society refer to this category of risk. It seems impossible for any firm that follows a risk-based approach to money laundering to comply with these notes, and the regulations they try to explain, without subjecting clients connected to higher-risk jurisdictions to enhanced due diligence.

   Jurisdictional risk is only one type of risk, and if used on its own or incorrectly can have unintended consequences or be so blunt as to be ineffectual. The challenge to legal practice managers is to design an effective set of criteria that uses the opportunities afforded to them by the regulations to devote scarce resources to look at those transactions or clients that are higher risk, under whatever criteria. In this, lawyers are somewhat different to other members of the regulated sectors. It is likely that the lawyer will know a lot about their client and indeed the circumstances of their engagement. This is not only an anti-money laundering obligation, but necessary to discharge their professional duties to the client, unlike a bank that may have limited involvement with the client’s affairs save for moving and holding monies on their behalf.

Sources of information

The Law Society and the JMLSG guidelines mention several sources of information that firms can use to develop lists of high-risk countries. These are:

• The country reports of the Organisation for Economic Control and Development (OECD);
• Those of the Financial Action Task Force;
• The reports of the Serious Organised Crime Agency; and,The Corruption Perceptions Index from Transparency International.

The International Bar Association has published a series of analyses of the money laundering laws and regulations for law firms in various jurisdictions. To this list one may add:

• The OECD’s non-cooperative offshore centers report (which currently blacklists Andorra, Liechtenstein, the Marshall Islands and Monaco);
• The US State Department’s International Narcotics Control Strategy Report for 2008; and,
• The publications of the United Nations Office on Drugs and Crime in Vienna. HM Treasury has also published lists of higher-risk jurisdictions and equivalent jurisdictions.

You should note that the ‘equivalent jurisdictions’ list is compiled for the purpose of entitling regulated firms to rely upon firms in other jurisdictions as having obtained due diligence: it does not necessarily mean that the jurisdictions have lower rates of crime or corruption.

How to design and follow your higher-risk countries policy

The data from the lists and reports mentioned above will not be of much use to anyone who wants to choose between high- and low-risk countries if they are merely thrown together with little thought. The US State Department, for instance, lists the UK as a country of “primary money laundering concern” because of the size and sophistication of its financial markets. It lists others as “low risk” despite those countries being poorly rated in the Corruptions Perceptions Index. A meaningful assessment of the data obviously calls for a little more thought than one might employ if one merely gave each country a score according to its relative place on each list.

   The key objective of this type of policy is to highlight matters or client situations where risk is higher than normal and apply an appropriately increased level of due diligence. If we were to take this objective and the lists above literally, we might expect to check any client from Frankfurt, London and New York as these are the major financial centres and arguably have more money laundering by volume occurring through them than others. So what should be in and what should out?

The more complex the list, the more bureaucratic the system

A UK firm that deals primarily with clients from the European Union or equivalent jurisdictions could take a brutally simple approach to this problem. It could decide that ‘higher risk’ means anything outside the core EU 15 states, the US, Canada, Japan and so on. A small firm with low numbers of clients or matters connected with countries outside the UK may limit this further to anything outside the UK and Ireland. Larger firms may apportion several grades of riskiness to countries.

   The beguilingly simple yet tricky answer is that any list depends on the business concerned. The money laundering reporting officer (MLRO) and the senior managers within the firm in question have to understand the role that their firm’s services could play in the schemes of a financial criminal. As other commentators have often pointed out, the intelligence that would enable them to do this easily is not widely available. It might be an idea to have different lists for different products or services as each presents a different opportunity to different types of criminal.

   Once you have formulated a list of higher risk countries, what next? To whom or to what should it apply? It should obviously apply to clients and matters or transactions. In an ideal world, any client that obtains a significant proportion of its wealth from a higher risk country, or any transaction involving such a country, should be subject to some form of higher due diligence. This should be a basic assumption.

   The objective should be to ensure that the team or person responsible for the higher-risk client relationship or matter understands the economic rationale behind the work that they are being asked to do. It may also be appropriate for someone independent from the client team to make sense of the new client by conducting greater amounts of due diligence on the subject. In some firms, specialist teams look at such clients and develop extra intelligence on them this is sometimes then assessed by other management committees. The riskier the client or matter, the more scrutiny the firm gives to it before it takes any action. The keys to a smooth process are:

• Data quality in the firm’s recordkeeping systems;
• Awareness of the requirements; and,
• An efficient escalation process that balances speed and efficiency with prudent consideration of the situation by someone not directly remunerated by the success of that particular client or matter.

Understanding the limitations of the policy

Data quality and completeness

To be able to identify higher risk cases systematically, one’s systems ought to capture countries of registration, residence, tax domicile, source and final destinations of funds. Many firms have systems that can register these things. What is missing in many is the capacity to process softer information about which countries a particular client is connected to economically.

   Take a practical example: a client is a trading company registered in Jersey. The directors are all resident in Jersey. The firm takes instructions from the holder of a power of attorney resident in Germany who holds a German passport. The company is owned by a Jersey trust with Jersey-resident corporate trustees and a German settlor. All this information is captured on the client relationship database as each party mentioned is a potential ultimate beneficial owner. All these countries are listed as standard or even lower risk in the database. The goods that the client trades, however, move between Indonesia and Equatorial Guinea, two potentially higher risk countries. If the firm is facilitating money movements through its client account it can apply an appropriate filter or warning procedure for such client account transactions. If, however, the firm is not handling client money it may never see monies going to either of these countries. It would be reliant on capturing this information in a ‘source of wealth’ or ‘business description’ field that in all likelihood would have to contain free text giving rise to a risk that the relevant information held by the firm is neither recorded nor acted upon.

Keeping it up-to-date

Countries and risks change. To be a truly effective tool, this list ought to be monitored. In larger firms the job of doing this can go to a risk management team or something similar: it may prove difficult in a small firm.

Political and business considerations

When a firm does a substantial portion of its business in a particular part of the world, the MLRO can find it politically difficult to designate that area as higher risk. One hears comments such as ‘it’s discriminatory’ or ‘we can’t do that, we have too much business there to tell them they are higher risk’. This can be difficult for lawyers and compliance staff alike. To settle things properly, everyone should consider the list while looking at criteria that rest on publicly available information. Firms may also use their own experiences, but should be careful not to let the wrong kind of subjective factor cloud their judgments. For instance, a rash of suspicious transaction reports involving France might not indicate that the money laundering risk of France has in itself increased. It may instead be a staffing or awareness problem or may be confined to one particular business or client type. The MLRO who draws up their list without evidence, either saying ‘well, they are all at it’ or the taking the contrary approach, will stir up mistrust in their firm.

Monitoring activity

The classification of a client as a 'higher risk' should increase the amount of surveillance carried out on that client. MLROs should also consider the extent of monitoring carried out on transfers to and from higher risk countries.

Avoid becoming one-dimensional

The higher-risk countries strategy is only one element of a risk-based approach in which the MLRO should be filtering out higher risk cases for further examination all the time. Its function is merely to assign some resources to a particular risk. The MLRO should balance this policy with other activity monitoring higher risk categories. Anyone who evolves a higher risk countries strategy should ask themselves the following questions:

1. Which countries does it make sense for this firm to class as ‘higher risk’?
2. How will we define what a ‘connection to a higher-risk country’ means?
3. What information will our systems need to store to be able to control the processes?
4. Can we mark clients with a flag to indicate a connection and record the relevant countries?
5. Do we need a separate ‘higher-risk client committee’ to approve new clients and review existing ones?
6. What activity should we monitor in relation to such clients or transactions once they are in the firm?
7. If so, what systems shall we use?
8. Do we have enough resources to carry out the above activities?

Mark Spiers (a former MLRO at UBS) and Ian Smith (a barrister) are co-founders of SmithSpiers, providing regulatory consultancy services. www.smithspiers.com