CA_Reports_AML-Essentials_Guide_v3
CA_Reports_AML-Essentials_Guide_v3
com
A Guide to
the Essentials
of Anti-Money
Laundering
2 A Guide to the Essentials of Anti-Money Laundering
Contents
An introduction to compliance
AML: Breaking down the most common acronym in compliance
United Kingdom
Europe
United States
Next steps
Getting started with ComplyAdvantage
Success stories
4 A Guide to the Essentials of Anti-Money Laundering
An introduction
to compliance
Anti-money laundering
(AML): Breaking down
the most common acronym
in compliance
Anti-money laundering (AML) is an umbrella term for the
various policies and legislation that require FIs to prevent
their customers from channeling funds derived from criminal
activity into the global financial system.
• Is it exposed to risks owing to specific These measures also apply to business customers or
customers, products, or locations? companies in firms’ supply chains, a process referred to
as Know Your Business (KYB). KYB determines whether
• Does it understand and meet its a business is authentic or conceals its owners to facilitate
regulatory obligations? illicit activity. If a company or individual is or appears
to be acting on behalf of someone else, then institutions
• Has it set its risk appetite? should establish ultimate beneficial ownership (UBO).
For instance, criminals may set up a company in a
• Are its policies and controls reviewed regularly? low-regulation, offshore jurisdiction and use it to trade
with legitimate counterparties to circumvent AML rules.
Implementing a risk-based approach requires several
measures to ensure firms know their customers. To establish UBO, firms must obtain information about
a business customer, including its address, registration
and licensing documents, and the identities of its directors
and owners. Sources include government and global
corporate registries. Firms may also need to conduct KYC
checks on business personnel.
6 A Guide to the Essentials of Anti-Money Laundering
What is real-time
sanctions screening?
Screening prospective customers in a variety of ways is a
crucial part of any firm’s AML obligations – more on this
later. For now, it’s important to note the importance of real-
time sanctions screening, an area that has come under the
international spotlight and requires particular attention from
firms to avoid non-compliance with the various regulations
that govern it.
What are the latest The Money Laundering, Terrorist Financing and Transfer of
Funds Act, abbreviated to Money Laundering Regulations
AML regulations? (MLR) 2017, transposed the EU’s fifth anti-money laundering
directive into UK law, while MLR 2019 implemented it.
United Kingdom To manage the transition from the EU’s sanctions regime
after Brexit, the UK introduced the Sanctions and Anti-
The Proceeds of Crime Act 2002 (POCA) is the UK’s Money Laundering Act (SAMLA) in 2018. SAMLA gives the
primary AML regulation. POCA defines offenses as UK government the power to lift and impose sanctions in
the carrying out and enabling of money laundering accordance with international obligations and as part of its
and the acquisition and distribution of the proceeds. own regime (which sets a lower bar than the EU).
The legislation states that firms should have controls
in place, such as CDD and transaction monitoring, and In 2022, the UK introduced the Economic Crime (Transparency
sets out reporting requirements. and Enforcement) Act (ECCTA), which was subsequently
amended the following year. Notably, this legislation introduced
The Terrorism Act focuses on preventing terrorism a ‘failure to prevent’ offense for cases where an organization is
financing and relies on CDD, transaction monitoring, deemed not to have reasonable measures in place to prevent
and reporting. Since its introduction in 2000, it has an individual associated with it from committing money
been amended several times, most recently in 2007. laundering, fraud, and other financial crimes.
Authorities
• Expanded the scope of regulations to previously • Made UBO registers public and interconnected lists
unregulated firms like gambling services and new across the EU to improve verification.
transactions and products, such as e-money products.
• Required firms to perform EDD on customers from
• Required firms to record UBO information in
high-risk countries.
centralized registers and added senior management
officials to the definition.
• Forced member states to publish PEP lists.
• Expanded the definition of PEPs to include domestic PEPs. • Extended criminal liability to include legal persons
(companies and partnerships) where they fail to prevent
illegal activity.
United States
The Bank Secrecy Act 1970 is America’s primary AML Authorities
regulation. It requires firms to implement CDD and
screening measures and to report and keep records of The Financial Crimes Enforcement Network
suspicious transactions and customers. (FinCEN) is the main AML regulator in the US.
It monitors firms and individuals and analyzes
The US Patriot Act was passed in 2001 in response to suspicious transactions. FinCEN shares information
the 9/11 terrorist attacks. It targets terrorism financing, with state and national law enforcement agencies.
giving law enforcement agencies greater surveillance and
investigatory powers, introducing new screening and CDD The Office of Foreign Assets Control (OFAC)
measures, and increasing the penalties for breaching the administers and enforces sanctions designed
rules. It specifically focuses on cross-border transactions. to prevent targeted countries, regimes, and
individuals from committing crimes like money
The Anti-Money Laundering Act 2020, approved at the laundering and terrorism financing.
beginning of January 2021, introduced the biggest AML
reforms since the US Patriot Act. The act strengthens
and modernizes infrastructure to account for emerging
technologies and new criminal methods. Its measures
include stricter beneficial ownership rules, heavier
penalties, and protection for whistleblowers.
Paper People
During an audit, or when the regulators visit, firms While the MLRO typically takes responsibility for
must present documentation explaining their developing policies, teams of people implement the
compliance activities, which provides a benchmark processes and procedures, and they should have the
against what they do in practice. Prospective investors right skills. The exact requirements depend on a firm’s
will also want to ensure that firms have comprehensive volume of transactions, resources, and perceived
risk mitigation policies in place. These documents levels of risk.
should take the following forms:
Customer service staff usually take care of basic CDD,
• Policies set out an organization’s compliance which is why they’re known as the first line of defense.
obligations. They provide a guide and confirm to A specialist team completes more advanced activities
regulators that an FI is aware of its responsibilities. such as EDD, monitoring and investigation, and the
Policies rarely change. ongoing maintenance of policies, processes, and
procedures. This team is the second line of defense.
• Processes describe how to meet these obligations. An audit is the third line of defense.
These change periodically.
Recruiting the right people is important. A given
• Procedures explain how to execute processes. business might consider hiring inexperienced
Procedures are like ‘How to’ guides, so they may individuals who can learn on the job, but investing
change regularly. upfront in experienced professionals is essential.
• The oversight and conduct of risk assessments • Politically Exposed Persons (PEPs): individuals
with a high-profile political or public role.
• Maintaining records
The definition of PEPs is globally inconsistent, making
• Ensuring staff receive training them hard to identify. According to the FATF, prominent
positions include legislators, ministers, members of the
The appointment of an MLRO is important because it sets armed forces and judiciary, and senior executives at
the tone for how an entire firm tackles financial crime. The state-owned companies. This version covers domestic
individual needs to be part of the executive team and have and foreign officials as well as members of their families,
sufficient AML experience and expertise. although, again, practices vary across jurisdictions here.
In the UK, a 2024 review by the FCA clarified that firms
should treat domestic PEPs as automatically lower-risk
than foreign PEPs; meanwhile, the US does not regard
domestic officials as PEPs.
12 A Guide to the Essentials of Anti-Money Laundering
CDD will also cover core categories like: Enhanced Due Diligence
• Occupation and income or a company’s nature Customers judged to be high-risk may go through
of business and turnover. For example, a customer enhanced due diligence (EDD). EDD involves gathering
in permanent employment may only receive a additional information like:
single salary payment each month, as opposed to
numerous payments. • The customer’s background and reputation
• Location and areas of operation: Certain jurisdictions • The source of the customer’s funds or wealth
are considered higher risk than others.
• A business customer’s revenue
• Products: Some combinations might be considered
• The nature of the business relationship
higher risk, such as a student current account with
foreign exchange facilities.
• Explanations for typical transactions
3. Carry out
ongoing monitoring
CDD doesn’t just happen during onboarding; it should be
ongoing throughout the lifetime of the customer relationship
so firms can continually revise customer risk ratings.
software vendor ‘False positives’ drain resources, but solutions with these
features minimize them:
When selecting a vendor, firms need to consider • To deliver more specific responses, the solution
several factors: should be configurable to the risk profiles of customers,
transactions, and sectors.
Compliance requirements
• Profile-based screening allows businesses to tailor
The vendor must meet a firm’s specific requirements
measures for high and low-risk customers.
based on their customers and business environment.
Its functionality should encompass CDD, transaction • The solution should be user-friendly and accessible
monitoring, screening of sanctions lists and PEPs, and to compliance teams.
adverse media monitoring. Other considerations include:
• The solution should be flexible enough to screen for
• Data coverage: The solution should capture the relevant data attributes while ignoring irrelevant variables.
spectrum of data that firms need to satisfy their
compliance obligations.
APIs
• Speed of updates: The software should update A software solution’s application programming interface
rapidly to reflect new risk levels. (API) determines the user experience and, therefore, the
effectiveness of a firm’s compliance efforts. Firms should
• Matching algorithms: Search algorithms should take into account the following features:
identify and assess risks effectively, using tools like
‘name transliteration,’ which considers language • Integration: The API should seamlessly sync with
differences, misspellings, and aliases. existing AML systems.
• Proactive monitoring: The solution should quickly • Availability: The API should make data available
alert the compliance team when a customer’s risk accurately and timely.
profile changes.
• Security and capacity: The API should meet
industry-level security standards and handle the
capacity of search volumes.
ComplyAdvantage.com 15
• Data: AI tools are only as good as the quality of their When infrastructure is hosted in the cloud, businesses
underlying data. This means firms must have access to have less direct control but face lower regulatory exposure
accurate, complete, up-to-date, and relevant data. because the vendor manages maintenance and security.
Cloud solutions can also be scaled up and down depending
• Explainability: Firms must be able to explain to on demand and can be deployed rapidly.
regulators how their technology works and why every
decision they have made was taken.
Security
• Effectiveness: The success of an AI tool is ultimately A solution must protect against cyber threats and comply
measured by how well it enables compliance officers with privacy regulations consistent with the sensitivity of the
to focus on specialized tasks and high-risk cases by data collected for compliance. It should help firms achieve
automating repetitive work and carrying out intelligent ISO27001 certification. ISO27001 is a globally recognized
risk scoring. standard of information security management and includes
both technological controls, the priority for AML solutions,
ComplyAdvantage’s software uses AI for AML compliance
and physical controls. Finally, the vendor should have
in specific ways, including:
disaster recovery and business continuity strategies in place
to avoid downtime in unforeseen circumstances.
• Continuously monitoring information sources,
refreshing data automatically in near real-time rather
than relying on manual updates.
Next steps
Firms around the world rely on ComplyAdvantage for
360-degree AML risk detection. Firms can start using
ComplyAdvantage’s software in different ways, each
designed for specific business profiles.
API-based integration with ongoing support API-based integration with ongoing support
• Protect against the risk of financial crime • Boost customer satisfaction with
using a best-in-class database that updates frictionless experiences.
in near real-time.
• Scale operations with international standard
• Automate manual, labor-intensive processes. data security.
If your needs are more bespoke, our expert team is on hand to discuss them with you.
You can book a meeting with one of them here.
ComplyAdvantage.com 17
Success stories
Holvi Freetrade
Holvi offers business bank accounts for small businesses, An investment company aiming to help everyone
sole traders, and freelancers. Facing high rates of invest simply and affordably, Freetrade partners with
payment recall, police requests, and seizures, Holvi looked ComplyAdvantage to conduct ongoing customer screening.
to AI-driven solutions to improve efficiency and accuracy
in flagging high-risk customers without disrupting Before working with ComplyAdvantage, Freetrade only
legitimate users. screened customers at the beginning of the business
relationship. The company realized it needed to implement
Holvi uses ComplyAdvantage to screen its customers ongoing monitoring as well, at the same time navigating
against adverse media, sanctions, and politically exposed both a global expansion and an increase in the complexity of
persons (PEP) lists. It also uses ComplyAdvantage’s the sanctions environment due to global events like Russia’s
transaction screening, monitoring, and fraud detection invasion of Ukraine.
products and deploys AI-driven Smart Alerts to optimize
the efficiency of its transaction monitoring. Freetrade selected ComplyAdvantage to deliver ongoing
screening and monitoring alongside the flexibility to
As Valentina Butera, Head of AML and AFC Operations, put configure the lists it screened against. Throughout the
it, “The implementation of Smart Alerts was the smoothest process, ComplyAdvantage has provided flexible screening
implementation of tech that we have ever experienced. tailored to its risks, reliable, up-to-date global sanctions, and
We did not experience downtime or interruption of politically exposed person (PEP) data, meaning Freetrade has
business operations – not even for a second. We know we seen an approximate 50% reduction in false positive alerts.
can serve our legitimate customers while at the same time
keeping a solid risk-based approach.” “The quality of data we get through ComplyAdvantage
is really important to us,” says Rob O’Sullivan, Director,
Read more Financial Crime Compliance and MLRO. “Through
ComplyAdvantage, we have comfort that we’re screening and
identifying high-level PEPs and down to local councilors.”
Read more
18 A Guide to the Essentials of Anti-Money Laundering
RealPage
RealPage provides software and data analytics to the
real estate industry, including tenant screening, online
billing and payments, accounting, revenue management,
and expenditure management. Processing around 100m
transactions per year across the US, RealPage has an
obligation to its banking partners, clients, and residents
to monitor transactions processed through its payment
services and to identify and reduce instances of fraud and
other illicit activities. Their task is made more complicated
by a growing spectrum of fraud typologies and their atypical
business model involving B2B and B2B2C relationships.
Read more
ComplyAdvantage.com 19
About ComplyAdvantage
ComplyAdvantage is the financial industry’s leading source of AI-driven financial crime risk data and detection
technology. ComplyAdvantage’s mission is to neutralize the risk of money laundering, terrorist financing, corruption,
and other financial crime. More than 1200 enterprises in over 80 countries rely on ComplyAdvantage to understand the
risk of who they’re doing business with through the world’s only global, real-time database of people and companies.
The company actively identifies tens of thousands of risk events from millions of structured and unstructured data points
every single day. ComplyAdvantage has four global hubs located in New York, London, Singapore and Cluj-Napoca and is
backed by Andreessen Horowitz, Goldman Sachs, Ontario Teachers’, Index Ventures and Balderton Capital. Learn more at:
complyadvantage.com
Disclaimer: This is for general information only. The information presented does not constitute legal advice. ComplyAdvantage accepts no responsibility
for any information contained herein and disclaims and excludes any liability in respect of the contents or for action taken based on this information.