Know your customer

With Ellen Zimiles, Daylight Forensics & Advisory

FST. Why is an effective KYC program an important part of a financial institution’s overall compliance program?
EZ. Adopting a strong, effective KYC program lets an institution reduce the risk of unlawful activities and helps demonstrate to regulators a good-faith effort to identify and thwart suspicious activity. Regulators are demanding increasingly proactive and complex efforts to combat money laundering and terrorism financing, and institutions that do not know their customers adequately and fail to have effective anti-money laundering controls in place risk facing significant penalties. The end result of an effective KYC remediation project is a bank that really ‘knows’ its customers, has a streamlined customer base and has significantly lowered its money laundering and terrorist financing risk.

FST. What are the keys to gathering and maintaining meaningful KYC information?
EZ. An effective KYC program must have four essential elements:

1. Risk ranking to identify the customers or activities warranting the most concern and ensure that they are addressed before accounts needing less attention.
2. A corporate culture that fosters a sense of accountability and an understanding for why KYC should be viewed as a proactive responsibility, not a regulatory burden.
3. Complete, reliable databases to accurately identify and monitor customers who are failing to comply as a matter of law.
4. Consistent quality control throughout a project to ensure that KYC reviews are free from error and yield the desired result.

FST. What are the main factors to consider when initiating a KYC remediation project?
EZ. KYC remediation projects frequently are implemented in response to problems detected by internal reviews or regulatory exams. In these situations, it is important for the remediation program to be custom-tailored to address identified shortcomings while also allowing the flexibility to detect and correct other problems. An effective KYC program must ensure the institution has reliably confirmed customers’ identities, properly considers a variety of risk factors and includes processes to deter and detect potentially suspicious activity. A KYC remediation or improvement project should include:

1. The involvement of senior management to establish the appropriate ‘tone at the top’ by clearly communicating priorities, individual responsibilities and accountability.
2. The application of a risk-based approach to identify, monitor and investigate the most high-risk accounts on a priority basis.
3. The use of case-management technology to plan and guide the project, track and measure progress and ensure individual accountability.
4. Mandates to document all activities, including unproductive reviews reflecting due diligence. Without a proper paper trail, regulators will often assume a customer or account has not been reviewed, which could require unnecessary, duplicative reviews.

Other important considerations include candidly assessing an institution’s existing customer identification program (CIP) and KYC procedures and identifying ways to ways to improve them, deciding whether to outsource the remediation project or internally staff it, and ensuring quality control. A final, frequently overlooked step is training employees about customer identification procedures and why they are necessary, with a goal of making KYC a routine part of the corporate culture.

FST. What are some do’s and don’ts of KYC remediation?
EZ. Let’s start with some do’s:

1. Set the proper tone. Management should establish the appropriate tone at the top by clearly communicating project priorities, individual responsibilities and accountability.
2. Prioritize. Use a risk-based strategy to remediate high-risk accounts first.
3. Lever technology. Powerful software can assist with account prioritization, case management, tracking and measuring progress and ensuring accountability. This improves results while helping to control costs.
4. Document all of your activities. Document all activities, regardless of the result. Regulators often say: “If there is no audit trail, it did not happen.” So document all of your investigations, even if they fail to detect any suspicious activities, because they will reflect good faith efforts to conduct due diligence.

Moving on to the don’ts:

1. Don’t define risk narrowly. Always consider the full universe of possible risk indicators. Risk ratings based on narrow parameters such as geography are not enough.
2. Don’t have disparate data systems. Multiple information systems for client information hamper remediation processes and reduce the effectiveness of monitoring programs.
3. Don’t use inadequate identification. A KYC program cannot be successful if the first step – identifying customers – is not completed properly. Demand adequate documentation to confirm a customer’s identity and conduct enhanced due diligence as warranted.