Risks are continuously changing as the digital landscape evolves. Potential threats such as money laundering, terrorist financing, and rising fraud have left businesses looking for solutions to combat these issues. Integrating a risk-based approach (RBA) is an effective strategy for companies looking to protect themselves. An RBA means organisations, institutions, or authoritative bodies understand the various money laundering and terrorist financing risks they could be exposed to and apply anti-money laundering (AML) and counter-financing of terrorism (CFT) measures. Using an RBA allows businesses to create a suitable risk management plan and better prepare for future threats.
As threats continue to emerge in the digital age, global regulatory bodies like the Financial Action Task Force (FATF) and Asia/Pacific Group on Money Laundering (APG) have been established. The FATF is responsible for examining global ML procedures and trends and creating and evaluating regulatory measures. The FATF currently comprises 39 member jurisdictions and two regional organisations, representing most major financial centres in all parts of the globe. The APG consists of 41 member jurisdictions, focused on ensuring its members effectively implement the international standards against money laundering/terrorism financing (ML/TF).
In Australia, the Australian Transaction Reports and Analysis Centre (AUSTRAC) is responsible for regulating financial institutions and their involvement with money laundering and terrorism financing. AUSTRAC’s level of involvement and approach to enforcement shifted after the 2018 Royal Commission conducted by the Australian Government. This commission investigated the misconduct within the banking, superannuation, and financial services industry and highlighted the inaction of governing bodies. Since this, AUSTRAC has introduced numerous obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) and AML/CTF Rules. To help businesses meet their obligations and requirements, AUSTRAC has released industry-specific guidance and resources on how to comply. It is important to note that in April 2023, the Attorney-General announced a public consultation on proposed AML/CTF regime reforms.
Considering regulation changes and the evolving digital landscape, an RBA is the most effective solution for businesses to create an effective risk management plan and introduce risk mitigation strategies.
What is the risk?
Risk refers to potential harm or loss that may result from uncertainties or events. Risk can arise from various sources, including technological changes or human error.
What is business risk management?
Business risk management is the process of identifying and mitigating potential risks to prevent harm to the business. It aims to create a continuous cycle of identifying, assessing, and controlling risks that threaten a business’s operations, reputation and financial health. By identifying and assessing risk, companies can better utilise their resources to reduce the likelihood of potential risks and uncertainties.
Which risks do businesses need to manage?
Businesses face the risk of exploitation for money laundering, terrorism financing, and other serious crimes. These risks can be categorised as ML/TF risks. As digital transactions increase, these crimes and financial risks become more prevalent, putting pressure on businesses and regulatory bodies.
Managing risk does not mean operating in a completely risk-free environment – this is unrealistic. However, businesses must identify threats and find ways to reduce and manage them. This should be proportional to the company’s size, the possible business risks, and the available resources. It is not possible to be 100% safe, but you can do everything in your power to protect yourself and your customers.
Steps for Business Risk Management
Identifying and assessing the ML/TF risk level is the first thing you must do to determine what measures need to be included in your business risk management plan. The initial assessment enables your business to create an AML/CTF plan with actionable steps when encountering a potential risk or exploitation. After making the risk management plan, risk mitigation strategies and solutions can be introduced to manage these risks.
Understanding the four steps to help manage ML/TF and regulatory risks:
1. Identify Risks
ML/TF risk can vary depending on the customer type, products or services, jurisdiction and delivery channel. Therefore, businesses must consider the varying risks that each customer presents, especially if they are a politically exposed person (PEPs), and use the appropriate measures.
2. Assess and Measure risks
After identifying risks, each must be individually assessed due to their varying qualities and how this may impact the business. These measures include the likelihood of it happening, the amount of damage or loss it may illicit, and the overall impact on the organisation.
A risk matrix can be used to combine the likelihood and impact to obtain a risk score. The risk score may be used to aid decision-making and help decide what action to take given the overall risk.
3. Manage risks
Once risks have been identified and assessed, the risk mitigation strategies outlined in the business management plan must be correctly implemented to combat the evolving risks. Integrating a pro-active multi-layered solution is a practical approach when managing potential threats.
An example includes Data Zoo’s Customer Due Diligence solution, which involves controls like identity verification, document authentication, global screening, and remediation. Standards of risk reduction or rules could be:
Denying onboarding customers who wish to transact with high-risk countries
Setting up transaction amounts and frequency limits for high-risk products
Set up different customer risk categories for enhanced customer due diligence
Update and re-verify customer information on a regular and periodic basis
Implement event triggers to flag suspicious activity or a change in the risk category
4. Monitor and review effectiveness
Periodic and consistent assessment is critical to creating an effective risk management plan. A proactive approach to identifying strengths and weaknesses within a program allows businesses to make improvements and alterations to current procedures if needed. This process is crucial for companies to stay aware of regulatory changes and rising global risks.
Every business is different, facing its own set of ML/TF risks and individual customers. Based on this, organisations should aim for a personalised business risk management plan tailored to their needs and targeted risks. By implementing an effective multi-layered solution, your business will be better equipped to face emerging ML/TF risks and reduce potential damage or loss.