PwC’s AML Survey 2023

Majority of firms only reviewing  their AML/CFT risks on an annual basis

A key part of the BWRA process is ensuring it remains up-to-date and relevant. 85% of respondents conduct their BWRA annually, while just 2% update their BWRA in real-time.

AML/CFT legislation and guidance is based on a risk-based approach to money laundering and terrorist financing. This means firms must know and understand the related risks for their particular business and apply appropriate controls to manage these risks.

The AML/CFT BWRA underpins all procedures and controls. In 62% of firms, second line compliance is responsible for their BWRA. However, risks are happening in the front office and only 31% noted a collaborative approach between the front office business units and second line compliance.

An effective BWRA process involves both functions:

• Second line compliance: responsible for the development, implementation and oversight of the BWRA methodology; and
• Front line business units: responsible for identifying, assessing and owning the risks.

75% of respondents confirmed that their BWRA process is entirely manual, with only 3% of firms able to rely on a fully automated process. This can lead to human errors, be resource intensive and can result in a lack of audit trail. Additionally, a manual BWRA process can take up to 6 months to complete. This may result in an outdated board-approved risk assessment, which may not reflect the current AML/CFT risks within the business and ultimately result in inadequate controls. Real-time risk assessments are far more effective in the prevention of financial crime.

Majority believe there is scope for further automation in the onboarding process

52% of respondents have automated some or all of their Know Your Customer (KYC) collection processes. However, a lot of manual intervention is still required, with 72% collecting documents via email and almost 50% requiring hard copy documents from some customers. These results vary significantly across industries, with e-money and payment firms further advanced in their automation journey than more traditional financial institutions. Unsurprisingly, almost 90% of respondents believe there is scope for further automation to improve their CDD onboarding process.

Customer due diligence (CDD) is a critical control against the entry of potential crime into a firm. The CDD process gathers information to help firms know their customers and understand and document their expected patterns of behaviour. This allows them to identify and report suspicious activity throughout the customer life cycle.

Unexpectedly, only 75% of firms conduct annual periodic reviews for their high-risk customers. This was surprising given the risk that higher risk customers can pose to businesses. Using a risk-based approach, medium-risk and low-risk customers are reviewed less frequently (every two years or more). Over 30% of firms use trigger events to keep information up-to-date for their lower-risk customers. This was significantly lower for respondents in the Asset & Wealth Management (AWM) industry, where over 80% of firms rely on periodic reviews to keep their medium-risk and low-risk customer information up-to-date. One firm is wholly reliant on trigger events to refresh their customer information.

Governance remains a hot topic for the CBI

Governance is a critical component of all compliance frameworks and a consistent theme in all types of CBI feedback. The CBI holds the board ultimately responsible and without appropriate governance, the board will not have complete visibility or understanding of the AML/CFT threat to the firm. Strong AML governance includes:

• timely and regular data-driven management information (MI);
• active oversight across all three lines of defence; and
• a board that is familiar with the BWRA and ensures that the residual risk is within the firm’s risk appetite.

Within organisations, AML MI reports and updates develop and grow organically over time. Additional data points are added without considering the implications for managing this on an ongoing basis. This results in time-consuming and sometimes irrelevant reporting. Almost 90% of firms reported challenges with their reporting processes. The most common challenges include:

• highly manual processes (69%);
• inefficient processes (49%); and
• duplication or reworking (33%).

Key actions businesses can take today

1. Be prepared

With a new EU regulator on the way, having a robust AML/CFT framework is crucial in managing the threat of financial crime. To ensure your AML/CFT framework is set up for success, review the following areas for gaps and enhancement opportunities:

• governance and oversight;

• people and capabilities, with clearly defined roles and responsibilities across the three lines of defence;

• risk-based approach; and

• processes and controls.

2. Emerge stronger

Without reliable data and innovative technology, regulated entities in Ireland cannot effectively respond and adapt to emerging AML threats. Over the next three years, more than half of firms will invest in their AML/CFT technology.

Before you do, assess your firm’s current infrastructure. Sometimes, enhancements to existing technology can be as efficient and effective as new technology—and a significant cost-saving.