AREN'T YOU ROAD-TESTING YOUR AML PROGRAMME ?

Perhaps the most disturbing bit of information about the deficiencies cited in the Citigroup Cease & Desist Order* is the startling admission* that a Citigroup computer system was "inadvertently disconnected" from the anti-money laundering monitoring programme for four years. The fact that nobody caught this means that the bank was not running any ongoing activities meant to road-test their AML programme.

Perhaps at this time it is best to explain that, as a part of banking best practises, all financial institutions should be performing operational testing of the adequacy of their AML/CFT policies, a road-test if you will, where outside actors seek to evade in-house Compliance procedures. This is not a theoretical exercise:

(1) Third parties, engaged with the approval and authority of senior bank management, are tasked with penetrating your bank's compliance defenses at account opening.

(2) Armed with identity documents, and possessing negotiable financial instruments and cash, they attempt, at multiple times and in various branches and offices, to open accounts for prospective clients that either pose an unacceptable level of risk, or have anomalies or inconsistencies that should make them utterly unacceptable as clients.

(3) Needless to say, those individuals seeking to breach compliance security must have the appropriate training and experience to be convincing to your New Accounts staff.

(4) I am hesitant to go into further detail, as the techniques involve money laundering trade-craft, and I have no wish to educate white collar criminals, who might employ the specific "tricks" necessary to pull this off, for improper purposes. Please email me directly, using your bank email, if you wish to discus this further.

Bottom line: if you are not currently testing your AML/CFT programme in this manner, you are advised to do so, lest your deficiencies not be found, and you too suffer the indignity of a Cease & Desist Order.      
______________________________________________________________
*Cease and Desist Order
* The other frightening admission was that the bank reportedly allowed foreign clients to use Remote Deposit capture (RDC), and failed to properly monitor them.