Tackle Governance And Culture For AML Compliance

Opinion: By Adam Hunt


The advent of AML requirements is a response to an old problem with an old treatment: if we can prevent people enjoying the rewards of their villainy, can it discourage anti-social behaviors and prevent crime?


At the heart of this question is social science, especially criminology and behavioral economics, both of which have only relatively recently started to lay some claim to adopting a truly scientific method. That means that many of our assumptions suffer from what Stephen Colbert calls ‘truthiness’, because for many years our understanding of what causes and allows crime has been largely driven by flawed assumptions, fundamental attribution error and propaganda.


Whether root causes are important to a compliance function depends very much on the culture of the organisation. Those that regard compliance as a government mandated burden to be managed at minimal cost will rail against the apparent illogic, and use it as an excuse to attack the foundations of the regime. They will also maintain a consistently higher business risk, both in terms of regulatory action and brand. The lucky ones will get away with it, the rest will suffer losses (which they will blame on others).


Those organisations that look on AML as an opportunity to demonstrate their role as good corporate citizens will want to understand, explore and look for opportunities to leverage a good customer experience, intelligently using risk analysis to inform their compliance processes. This means moving beyond simplistic transactional understanding of the legislative requirements, resisting the temptation to pander to accountants and abrasive customers. They will strive to maintain a culture of enquiry and growth. It has the added advantage of making the work more fulfilling for the team and turning an overhead into a brand advantage.


Making the shift


To make the shift reporting entities first need to tackle governance and culture, which is a big ask. But I believe it can be achieved in all but the most monolithic organisations (you know who you are.) And it is built on foundations of strong ethical culture from the bottom up, not just top down.


Among the regulatory community concepts of ‘intelligence led’ thinking have become embedded. This is an evidence driven approach to regulation that depends on understanding risk, systems thinking and quality analysis – in fact all the same foundations as the scientific method. At its heart is the use of techniques to compensate for the cognitive misfires that hamper our thinking, using process to counter flawed reasoning.


Our brains have evolved to be pattern recognition engines simply for survival. We don’t always have the opportunity to stop and think, and we certainly don’t have the cognitive bandwidth to consider every decision fully before we take it. These heuristics are how we manage day to day life and they become embodied in our social and legal rules.


We all like to think we are rational and have free will, but the reality is that our brains are designed to make quick decisions based on limited inputs. And our ego (which is essential to our wellbeing) will defend those quick decisions beyond the point of rationality, retrospectively re-writing our memories and justifications. Stop for a moment and honestly consider a situation where you have argued a contentious point: I’ll bet, on reflection, you can find moments where you were relying on some pretty tentative logic to maintain your position.


Tackling the flaws


So what are some of the techniques we can use to tackle these flaws at an organisational level? Starting at the top, we need to ensure there is not a culture of denial filtering through. Boards and governance groups must accept that the regime does have a positive effect for society. The cognitive challenge is often that leaders have taken positions that their monkey brain will continue to defend to protect their ego.


Technical leaders may focus on points of process rather than the overall purpose of the regime. A pincer movement is sometimes effective in tackling this. Alongside pointing out that it is simply a business necessity, try to connect a compliance strategy to brand risk and process efficiency. Look for examples in your sector where competitors seem to be able to effectively leverage AML for other benefits, including ease of onboarding. In other words, change the conversation from cost to value.


At a tactical level in your team it’s good to agree on your stance. Share stories and make sure you collect examples of where CDD is easy or effective. Most customers understand why these checks are carried out – they are getting used to it. Point out to them that the identity checking protects them too (among other things it helps defend against identity fraud.) Look for opportunities to measure the outcomes in terms of real costs, customer experience and compliance with requirements. Regulators will generally support a reporting entity that can show it is genuinely trying to comply.


Make sure the reports and outputs (in the intelligence world these are called products) look good. AUSTRAC use very professional formats. This contributes to subtle messaging that this is an important process that deserves attention.


CDD and monitoring


CDD and monitoring rely on human beings noticing abnormalities (red flags) so this is a good opportunity for engagement with front-line staff. While the IDV process gets a lot of attention, it really only exists in its current form for historical reasons – AML is an international regime, so its recommendations have to work in any jurisdiction. Intelligence is the real mechanism to know your customer, and it is important that people who work with customers and their data know that they can raise a flag in a blame free context.


This means that they often need to be protected from conflicting interests in the organisation. Facilitating money laundering is profitable, and the people who will profit internally may try and hide information (willful blindness) or bully staff to avoid processes.


There is no magic bullet to solve these issues, but one factor is organisational culture: who really wants to work in a firm that rewards sharp behaviour and aggressive use of seniority?


It is ten years since the regime was introduced. That’s well past the point where people should have stopped whining about it or looking for technology silver bullets. The profession needs to grow up, and part of that is improving our depth of strategic thinking, moving beyond tactical discussion of process to deeper understanding.


Adam Hunt
Adam Hunt

Read more opinion pieces from Adam Hunt in 'the Pandora Papers and hidden world of white collar crime'.