Where needed – the optimal use of Suspicious Activity Reports (SARs) in anti-money laundering (AML)

Money Laundering Bulletin, 24 October 2022

Suspicious Activity Reports (SARs), at their best, are crucial intelligence in the fight against illicit finance. But with AML-obliged entities filing defensively and some financial intelligence units (FIUs) flooded with reports, how can ‘good SARs’ make it to the frontline of law enforcement? Paul Cochrane investigates.

Up and up

The volume of suspicious activity reports (SARs), or suspicious transaction reports (STRs), filed is rising year-on-year. In the USA alone, the number of SARs submitted to the Financial Crimes Enforcement Network (FinCEN) crossed the 3 million mark for the first time last year (2021), with 3,069,450 filed. That figure is nearly double that of 2014’s 1.66 million, and an increase of 570,000 filings on 2020. Some 312,379 SARs were filed in September (2022), indicating this year’s total could be around 3.7 million. (1)

In the UK, 573,085 SARs were filed in 2019-2020 (the latest numbers published), up 20% on the previous period. (2) Among the Egmont Group of 166 financial intelligence units (FIUs), some 15.5 millions suspicious and unusual transaction reports were received in 2021.

“If you add all the SARs together with other intelligence, there are possibly up to 100 million pieces of financial intelligence filed around the world every year,” said John Cassara, an AML expert and former US Treasury Special Agent.

Rich ore

In his view, “It is a treasure trove of potentially useful information for all sorts of law enforcement issues, not just money laundering. But if you divide the SARs by the assets forfeited and criminals convicted, it is not a good return on investment by any metric. We’re a decimal point from failure.”

Indeed, despite the increase in SAR filing, the estimate for effectiveness is 0.1% to 1%, according to New Zealand AML specialist Dr Ron Pol, based on estimated criminal proceeds seized by authorities versus crime proceeds retained by criminals. (3)

Filing bind

Of primary concern, said Cassara, is the lack of information and analysis about how many SARs are of strategic value to law enforcement, or which content is particularly useful in solving crimes. In the USA’s case, one reason is the absence of a feedback loop between reporters and FinCEN, he said.

The US Government Accountability Office (GAO), in a 2020 report on opportunities to increase law enforcement use of Bank Secrecy Act (BSA) reports (that is SARs), noted: “FinCEN provides BSA report access to law enforcement agencies, which use those reports to support investigations. FinCEN receives limited data from law enforcement agencies on their use of BSA reports or the reports' impact on case outcomes because agencies largely do not collect such data. As a result, FinCEN cannot provide comprehensive feedback to financial institutions on the usefulness of the BSA reports they file.” (4)

It is a similar story in other jurisdictions. Tristram Hicks, an AML and criminal justice expert in the UK, said: “We have invested a lot of resources in FIUs and the private sector, and it seems well resourced, enormously so when compared to the competent authorities, yet compliance departments are judged by what law enforcement ends up recovering. This is something they don’t have a direct role in, only indirectly through filing a SAR, and we don’t have good statistics about this. Also the relationship that exists between the private and public sectors isn’t very good, partly because the competent authorities comes down to just one person in certain countries,” he said.

A better way

As a solution, Hicks, who wrote an article for MLB on the value of ‘the Good SAR’, is advocating for genuinely suspicious filings – the Good SARs - to get to the frontlines as soon as possible so it can act upon them. (5)

“We need to start with the notion that if the purpose of crime is money, then investigate the money. We will arrive at a predicate offence whatever that is, so we need someone to identify that predicate offence, and then do a criminal investigation. At the moment it is the other way around, and it’s not really working,” said Hicks. “We need to focus on criminals, and have that in the database, and follow the money from the criminal to the crime, which is easier. It is very difficult to hide the money from crime.”

FIUs typically acting as gatekeepers to SARs information, deciding what SARs to analyse further and what to pass on to law enforcement, perhaps needs to be addressed in a more effective and timely manner, said Hicks.

Officers inside the FIU

FinCEN has tried to lead by example here, embedding law enforcement representatives in the agency to have more direct access to financial information: “FinCEN to its credit made a decision a while back to empower their own customers to access the information themselves,” said Cassara.

He spoke highly of the use of SARs during his time in law enforcement, as did Kevin Sullivan, a former New York law enforcement officer now president of The AML Training Academy in the US. “We downloaded about 4,000 SARs a month, and every one was reviewed. We narrowed it down to around 150 SARs to look at. The second phase was to run some databases and then follow though, or not,” said Sullivan.

Value confirmation

The GAO report backs up such views, arguing that SARs have intrinsic value. Its survey of six federal law enforcement agencies “found that more than 72 percent of their personnel reported using BSA reports to investigate money laundering or other crimes, such as drug trafficking, fraud, and terrorism, from 2015 through 2018.” The survey also found that “93 percent of law enforcement personnel who used BSA reports to start investigations almost always, frequently, or occasionally found relevant reports to identify potential subjects or networks from which a new investigation might be initiated.”

The GAO report did, however, note that access to the BSA database was only available to 54 percent of state law enforcement agencies in 2018, and less than one percent of local law enforcement. The research found that 21 of the 50 largest local police departments did not have direct access to the database.

Access is restricted, according to FinCEN, to manage “oversight costs and to protect against improper access to BSA reports.” (Stringent criteria must be met before granting a law enforcement agency access, covering number of staff, potential number of BSA database searches, location and agency priorities.) But such access could be expanded, said Sullivan, to include the 87 percent of large local police departments and 24 percent of smaller local police departments that have designated personnel to investigate financial crimes, according to Department of Justice data. The GAO reports that “from 2015 through 2018, FinCEN denied approximately 39 percent of the 103 applications it received. To help ensure BSA reports are accessed only by authorised uses for authorised purposes, FinCEN conducts annual inspections of law enforcement agencies with direct access. FinCEN also monitors searches to identify any irregular use.”

“We need a huge database that law enforcement can access. The information could lead to evidence used for convictions,” said Sullivan.

The GAO has recommended that FinCEN establish “a mechanism through which law enforcement agencies may provide regular and institution-specific feedback on BSA reporting”. It also called on FinCEN to “more consistently and publicly provide summary data on the usefulness of BSA reporting.” Yet while FinCEN committed to implementing a strategy to better communicate results and on the value of BSA reporting, as of April (2022), “GAO had ongoing work following up on this issue,” said its report. (4)

On the inside

Follow-up on what works and doe not should also extend to interviewing criminals, said Hicks: “We don’t record the number of people we froze assets from, and we don’t ask them if it made a difference. We could do research and ask criminals what works, but we choose not to.”

More useful SARs might also result from re-launching meetings between law enforcement and the private sector, which used to be common practice, said Sullivan. “The best thing that came out of the meetings we had was networking. We got to know each other, and could pick up the phone and talk about (financial crime) issues. It was worth its weight in gold. I highly suggest ‘Know Your Law Enforcement’ and ‘Know Your Financial Institution’, as if they both do that, then they can know what they’re looking for in a SAR. There are a lot of things today that are not picked up on,” he said.

Capacity and growth

Getting more SARs to law enforcement, however, depends on more analysis, which becomes ever harder as the number of SARs filed builds up, said Cassara: “There are not enough people to go through them and analyse them. For FinCEN, with a staff of 200 to 300 people, of which only a dozen are analysts, it’s impossible.”

The workload pressures are clear: the number of SARs - from just banks – to be analysed per FinCEN employee went from 2,000 in 2005, to around 3,800 in 2019, according to the agency.

“The problem is not so much with the production of financial intelligence but enforcement, and lack thereof. It has been easier for policymakers to mandate the financial industry to do this or that, than to say we need a budget to beef up enforcement,” said Cassara.

Could some of the needed funds come from the fines incurred by banks for violating AML requirements, with regulators issuing US$2.73 billion in fines worldwide in 2021, according to a report by Kyckr? (7) “I would love to see a reckoning of where all the fines go. Maybe the fines should be used to supplement money laundering investigations - just a crazy suggestion,” said Sullivan.

Notes

1) fincen.gov/reports/sars-stats

2) https://nationalcrimeagency.gov.uk/who-we-are/publications/480-sars-annual-report-2020/file

3) Ron Pol estimates that AML policy intervention has less than 0.1% impact on criminal finance. https://www.tandfonline.com/doi/full/10.1080/25741292.2020.1725366 

4) https://www.gao.gov/products/gao-22-105242

5) The Good SAR, Tristram Hicks

https://www.moneylaunderingbulletin.com/moneylaundering/reporting/the-good-sar-151774.htm?origin=internalSearch

6) https://www.gao.gov/products/gao-19-582

7) https://www.kyckr.com/resources/aml-fines-2021

Cost & benefit – anti-money laundering (AML) performance measurement

Money Laundering Bulletin, 18 October 2022

So much anti-money laundering activity calls for big data analysis it is ironic, at the least, how little rigorous statistical study there appears to be of its impact, but if you can’t, don’t or won’t measure a strategy’s results, how can you know if it’s working? Paul Cochrane goes in search of key perfomance indicators (KPIs).

How effective is the ongoing fight against money launderers and terrorist financers? Anti-money laundering (AML) experts are arguing that despite the Financial Action Task Force's (FATF) increasing focus on effectiveness in mutual evaluation reports and its extensive data on jurisdictional compliance with its Recommendations, more statistical indicators would be valuable. 

NRAs – worth it?

National Risk Assessments were supposed to help provide some guidance on the risk-based approach for AML/CFT, but the World Bank has been underwhelmed by their value. Earlier this year (2022), it released a report, 'National Assessments of Money Laundering Risks: Learning from Eight Advanced Countries’ National Risk Assessments'. Its findings on NRAs from countries supposedly at the forefront of AML – the USA, UK, Singapore, Japan, the Netherlands and others – were damning.

“The experience of reviewing 11 published NRAs from leading nations is troubling,” wrote the authors. “They lack conceptual clarity, the data are highly limited, most are analytically weak or fail to explain the methodology, and the whole goal of the NRA—to inform policy decisions—is often missed or at least not made explicit in the published version.” (1)

The report is indicative of the wider problems afoot in tackling financial crime, not least in how AML measures are assessed in terms of efficiency and effectiveness, said John Cassara, an AML expert and former US Treasury Special Agent: “Whatever the financial industry is spending on compliance – roughly US$30 billion in North America alone – and compared to government spending, it is easily much more. Count up law enforcement and regulator expenses – although no one has counted that – it has to be in the tens of billions of dollars. Do the maths, how much are we spending on combating AML and what are we getting back? The numbers are terrible.”

Fractional ROI

Estimates on total money laundered or available to be laundered from the proceeds of all crime globally is estimated at US$2-6 trillion annually, said David Lewis, managing director and global head of AML advisory at Kroll, the New-York-based risk advisory firm. The cost of compliance in Europe has been estimated by European Union police agency Europol at Euro 300 billion a year, while there are estimates of global expenditure of up to US$1.3 trillion, he added.

“This compares to a fraction of 1% of the proceeds of crime being recovered by the authorities. Not a good return on investment when looked at through that lens. There are of course many problems with such comparisons but it is useful in making the point about the need for better measures and improvements in both efficiency and effectiveness of those measures,” said Lewis.

In the way of collection

The former executive secretary of FATF attributed the general problem of measuring effectiveness, costs and benefits to the “the lack of data and the lack of consistent data between countries, firms, regulators and so on. There is resistance from government officials to more systemically collect and report data given the additional burden of doing so,” he noted.

Needless to say, this is not how the system is designed. FATF Recommendation 33 states: “Countries should maintain comprehensive statistics on matters relevant to the effectiveness and efficiency of their AML/CFT [countering the financing of terrorism] systems. This should include statistics on the STRs [suspicious transaction reports] received and disseminated; on money laundering and terrorist financing investigations, prosecutions and convictions; on property frozen, seized and confiscated; and on mutual legal assistance or other international requests for cooperation.”

FATF also notes during mutual evaluation reports, “it is the responsibility of the assessed country to demonstrate that its AML/CFT system is effective. If the evidence is not made available, assessors can only conclude that the system is not effective”. (2)

Tristram Hicks, an AML and criminal justice expert in the UK, said that despite the FATF Recommendation for meaningful statistics being in place for over 30 years, there was a dearth of such figures: “FATF doesn’t provide guidance on what those statistics should be or enforce the issuing of statistics,” he said.

Apples and pears

Moreover, mutual evaluation reports only happen every 10 years, and these assessments show that “only 20% of countries evaluated by FATF are in the ‘substantially effective’ category,” said Hicks. “And as countries collect statistics in their own way, you can’t make international comparisons.”

An example of this is that Spain recently published a report on asset confiscation, showing an increase from Euro 18 million to 91 million over a five year period, but it did not state the number of people convicted. In other jurisdictions, reports are not always released to the public. “The UK passed the Proceeds of Crime Act in 2002 but only publicly reported its asset recovery results from 2015 onwards,” noted Hicks.

The World Bank report on NRAs also noted such reticence, including on the analytical methods used for assessment. “Some NRAs did nothing more than present numbers ... Japan presented numerous tables describing criminal justice processing of various kinds of cases; the relationship of those data to money laundering risks was never explained. The UK stated that it used a model developed by law enforcement agencies that cannot be found in open-source form, so no one can assess its credibility for the purpose.”

Lewis noted that this lack of transparency extends to cost-benefit analysis of AML/CFT measures. It is carried out, typically, when new laws and regulations are introduced, such as in the European Union and the UK, he said.

Best guess, at best?

Lewis cited a cost-benefit analysis of the UK’s regime when he was at HM Treasury, in 2010, that was not published: “In part, this was because industry stakeholders thought there was no representative estimate for the costs on business as it varies by so much based on so many different factors, from firm to firm and because the same measures meet several different purposes and so the cost is not just an AML cost,” he said. Lewis suggested getting information from governments on AML costs through Freedom of Information Act requests, in countries where such legislation exists.

A wider problem is that cost-benefit analysis must include preventative benefits, which financial institutions are involved in through customer checks, transaction monitoring, and the filing of STRs. However, “these are very difficult to measure,” said Lewis. “The cost benefit analysis my team did around 2010 had a go at this and there are ways of doing it but it’s a finger in the air at best.”

AML veterans think that since FATF’s establishment in 1989, more headway should be evident: Cassara argues, “We should have seen more AML progress by the metrics that matter - asset forfeitures and convictions. FATF needs to look hard at themselves: What are we doing wrong? They are too caught up in box-checking whether a country is compliant or non-compliant with the 40 recommendations. For 15 to 20 years we’ve been trying to get all countries on the same page, and work with the same FATF directives, and we have done that now, so it is time to rethink it. The bottom line is go after the criminals, and most countries are not,” he said. (3)

Frustration, a spur

Such criticism was noted by the World Bank in its report: “Conducting an NRA may also be
seen as just a box-checking exercise to meet international standards, leading to a lack of motivation to do anything more than the internationally accepted bare minimum.”

The report further highlighted some of the chronic problems with assessing risk, which is, after all, the model advocated by FATF - the risk-based approach. “Most NRAs simply repeat the FATF Guidance definitions but then do not say how, for example, threats might be measured; they simply list a series of offences.” The report also notes that countries have not agreed on definitions of what areas are high risk and low risk, which is “not as helpful as they could be”.

The report calls for setting up an international research centre focused on money laundering risk assessment “to advance understanding of how to conduct such an assessment well,” and for more databases to share information.

“To our knowledge, no country has created a database of proven money laundering transactions to determine what can be learned about threats and vulnerabilities,” it noted. The World Bank has, however, started encouraging countries that use its NRA tool to use its proceeds of crimes data collection tool, which aims to collate money laundering cases and proceeds of other serious crimes as well as develop a live database to strengthen countries' data collection and management systems. (4)

The Wolfsberg Group of 13 international banks has also issued statements on how they think financial institutions can better assess risk and demonstrate effectiveness, with one paper published in 2019, and a second in 2021.(5) Suggested steps include assessing risk in defined priority areas; implementing and enhanced risk-based AML controls; prioritising resources; better engagement with law enforcement; and publicly demonstrating AML/CFT programme effectiveness.

While such guidance and databases on proceeds of crime are welcome, ultimately more research needs to be carried out to improve the AML regime, said Hicks. “I think it is worth us all considering that as we spend billions on compliance, surely we can spare some money for research to see how it works, and do it better,” he told MLB.

Notes

1) National Assessments of Money Laundering Risks: Learning from Eight Advanced Countries’ NRAs, World Bank 2022 - https://openknowledge.worldbank.org/bitstream/handle/10986/37305/IDU02386c9b80f623045e70bf8a09a30b6162595.pdf?sequence=1&isAllowed=y

2) https://www.fatf-gafi.org/media/fatf/documents/methodology/FATF%20Methodology%2022%20Feb%202013.pdf

3) FATF was not available for comment.

4) https://pubdocs.worldbank.org/en/422681580318460585/POC-Update-04.pdf

5) https://www.wolfsberg-principles.com/sites/default/files/wb/Wolfsberg%20Group_Demonstrating_%20Effectiveness_JUN21.pdf

 

Disenable: now, hit the (money laundering) professionals

 Money Laundering Bulletin, 20 September 2022

 

Prosecutors are often unwilling to put their hand in the proverbial snake pit to go after professional launderers, opting for easier, low hanging fruit instead. (Paul Cochrane).

MLAAS – Money Laundering As A Service – must, logically, exist to layer in the billions and billions of, well, choose a currency, generated by criminal enterprise: who does it, how should they be stopped and why isn’t that happening? Paul Cochrane talks to those with reason to know.

Professional money launderers are exceedingly hard to catch, and - if convicted - are invariably replaced by other pros waiting in the wings. What more can be done to go after them?

Negligible returns

Going by estimates of the global scale of money laundering, and the low seizure rates - by some accounts 1%, by others (such as New Zealand AML specialist Ron Pol) less than 0.1% - efforts to curb the amounts of dirty money sloshing around the financial system are proving ineffective. (1) This is especially apparent when it comes to investigating, charging and convicting professional money launderers (PMLs) and related enablers.

Known unknowns

Indeed, as Sir Rob Wainwright, now a senior partner at Deloitte, said, before stepping down as executive director of Europol, in 2018: “Professional money launderers – and we have identified 400 at the top, top level in Europe – are running billions of illegal drug and other criminal profits through the banking system with a 99 percent success rate.” (2)

The inability to arrest these 400 European PMLs and the unknown hundreds, if not thousands, of other top-level PMLs around the world cannot be simply put down to a general lack of anti-money laundering (AML) controls at financial institutions, or the high rate of false positives in suspicious transaction reports (STRs) filings, said Jim Richards, head of RegTech Consulting in the US.

Hard facts

“People talk of a failure in the private sector, but I think it’s doing a bang-up job in doing what they’re supposed to do. The failure is law enforcement and prosecutors in bringing money laundering cases,” he said. “In my 20-plus years as a Money Laundering Reporting Officer (MLRO), my teams filed over 1 million STRs, but in many cases, law enforcement did nothing with the intelligence. They don’t have the interest or ability to go after the enablers.”

A rare success story is the arrest in Spain, on 12 September 2022, of “one of Europe's biggest money launderers,” according to Europol. Identified in press reports, Johnny Morrissey is alleged to have worked for the Kinahan clan, an Irish organised crime group responsible for trafficking drugs across Europe. He is said to have overseen hawala transfers of criminal proceeds totalling over Euro 200 million in 18 months: the laundering allegedly involved use of Nero Drinks, a vodka business, set up as a front to justify the large sums of cash, and linked shell companies in London and Gibraltar to disguise the underground banking activity.

The difficulty in tackling PMLs was highlighted by the Financial Action Task Force (FATF) in a 2018 report on Professional Money Launderers (3): “Many countries are not sufficiently investigating and prosecuting a range of money laundering activity, including third-party or complex money laundering. Many countries continue to limit their investigations to self-launderers: criminals who launder the proceeds of drug trafficking, fraud, tax evasion, human trafficking or other criminality… (this) does not impact on those specialised in providing criminals with money laundering services. PMLs, professional money laundering organisations and professional money laundering networks can survive law enforcement interdiction against any of its criminal or organised crime group clients, while still standing ready to support the next criminal clientele.”

Lawyers for hire

To Canadian law enforcement veteran (ex-Royal Canadian Mounted Police) and AML expert Chris Mathers, the biggest challenge in going after PMLs lies with the legal profession. “It is impossible to launder money without lawyers, even just to set up the corporate structure to move money around,” he said. “The absolute majority of lawyers are law-abiding individuals, but we have to realise a small percentage are not, so we need to change the rules regarding (lawyers’) financial disclosures or we’ll not accomplish anything.” Canada, for instance, does not insist that lawyers (except notaries in British Columbia) file STRs.

Plenty of form

The role law firms can play as enablers was highlighted in the Panama Papers, leaked in 2016, which detailed the financial and attorney-client information of more than 214,488 offshore entities held by Panamanian law firm Mossack Fonseca. The Paradise Papers, leaked in 2017, involved Bermuda-based law firm Appleby. And the Pandora Papers, a leak of nearly 12 million documents in 2021, also involved law firms and service providers.

Another case is that of 1Malaysia Development Berhad (1MDB), the Malaysian-government joint venture development vehicle whose exploitation has just led to the imprisonment of former Malaysian Prime Minister Najib Razak. Between 2009 and 2010, financier Jho Low embezzled USD368 million through an ‘Interest on Lawyer’ account held by a New York-based law firm. No action has been taken against the law firm as it did not violate AML rules at that time. That is unlikely to be the case in the future, however. The 1MDB case features in the Appendix of the USA’s ENABLERS Act, which was proposed in response the Pandora Papers. Passed in July 2022 by the House of Representatives, with a supporting vote anticipated later this year in the Senate, the Establishing New Authorities for Businesses Laundering and Enabling Risks to Security (ENABLERS) Act is part of the regularly approved National Defense Authorization Act (NDAA) for Fiscal Year 2023. Section 5401 of the NDAA is called the STOP Dirty Money Act (Services That Open Portals to Dirty Money). (4) 

The proposed Act, however, has been watered down since it was proposed in 2021. The initial draft required seven professions to have full AML programmes: investment advisors; dealers in art, antiquities, and collectibles; lawyers “involved in financial activity on behalf of another person”; trust or company service providers; accountants; public relations (PR) firms that “provide another person with anonymity or deniability”; and third-party payment providers. In the final House of Representatives version of the Act, investment advisors, art dealers and PR firms were excluded, said Richards. This goes against advice in the OECD’s 2021 paper, ‘Ending the Shell Game, cracking down on the professionals who enable tax and white collar crime’. (5) However, it goes beyond Designated Non-Financial Businesses and Professions (DNFBPs) - lawyers, accountants and other service providers - to include financial institutions as targets for AML action against professional launderers; that is a sensible suggestion, in Richards' view: “If we stick to DNFBPs, my sense is that PML cases will be very difficult to prosecute,” he reflect, stressing that financial institutions should also be included as they are the conduits for cash transfers.

Too tough to tackle

As for targeting lawyers, “The Feds and Europe know who these law firms are but are afraid of challenging them due to client-attorney privilege, said Richards. He added that often, going after an accounting firm, or a real estate type of organisation involved with ML “is just so fraught with political and prosecutorial difficulties that such cases are too difficult to take on”: the firms are able to bring pressure to bear on politicians, while prosecutors prefer to go after easier cases - “low hanging fruit”.

The international element to such cases is a further hinderance to prosecuting cases against PMLs, said Tristram Hicks, an AML and criminal justice expert in the UK: “Even the most simple of money laundering crimes are extremely difficult to deal with in different jurisdictions. As we have an International Criminal Court for war crimes, we should have an international facility for financial crimes,” proposed Hicks.

While greater international cooperation not readily apparent, more could be done at the national level to fight professional ML if there was the political will, he added. Substandard information requirements for registering a company have been a particular bugbear, impeding beneficial ownership data collection and adding a layer of obfuscation to law enforcement investigations.

Reliable registers

In the UK, Companies House, which registers companies established in England and Wales, the need for reform has been a topic for some 25 years. “It is ridiculous that a government agency receives information which it doesn’t verify, and then it is published without making clear there is no real veracity to the information there,” said Hicks. “If law enforcement had a team of half a dozen investigators at Companies House, I am sure they would find some crime.”

The US also needs to do more despite passing the Corporate Transparency Act (2019-20), which requires companies to disclose their ownership and control structures. The Act also calls for a national registry of companies to be established. (6) “The registry is still years away, but the problem is, like with Companies House, it is a garbage in and out type of situation. There is no verification of the information of the companies, such as the address or the beneficial owner,” said Richards.

Actionable answers

Law enforcement needs to be emboldened to go after PMLs and for there to be consequences against enablers. Richards said prosecutors are unwilling to be involved in complex money laundering cases that cannot always be won, instead going after easier cases or those with a good media angle, such as seizing a criminal’s mega yacht. “I would empower law enforcement and prosecutors to enable them to go after the elite enablers. Instead of seizing a Russian oligarch’s yacht, a better strategy is to go after the enablers of the oligarchs that buy and service for them,” he said.

Enablers, including financial institutions, should also be held accountable for money laundering violations, said Hicks. “We could convict bankers,” he said, although he was not generally in favour of prosecuting bankers: “It should not be up to the public prosecutor to determine who in the bank was culpable, the bankers can sort that out among themselves,” he said. In this regard, inside investigators are in a better position to do this than an outside investigator: “That would focus minds. If not fines, then confiscations in relation to the crime committed,” he said. If bankers are targeted, then Iceland's post-financial crash convictions is a good example to follow, he said: “When Iceland sent (36) bankers to prison (for market manipulation and breach of fiduciary duties following the 2008 financial crisis) it had an effect,” with Iceland's financial sector being scandal-free since that time.

Stronger consequences are certainly needed to make the lives of PMLs and enablers harder, said Robert Mazur, a former undercover operative that worked for the US’ Drug Enforcement Agency (DEA) and US Customs Service. “Unless and until somebody has the balls to yank someone’s licence for intentionally committing an offence, they will pay a fine that the shareholders pay, and it all moves on. You can’t regulate morality,” he said.

Notes

1. Ron Pol estimates that AML policy intervention has less than 0.1% impact on criminal finance. 

2) Sir Rob, now working at Deloitte, declined an interview with MLB. https://www.politico.eu/article/europe-money-laundering-is-losing-the-fight-against-dirty-money-europol-crime-rob-wainwright/)

3) FATF report 2018, Professional Money Laundering - https://www.fatf-gafi.org/media/fatf/documents/Professional-Money-Laundering.pdf

4) https://amendments-rules.house.gov/amendments/GATEKEEPERS_NDAA_xml%20v3220711190941114.pdf

5) OECD paper 2021, Ending the Shell Game: Cracking down on the Professionals who enable Tax and White Collar Crimes - https://www.oecd.org/tax/crime/ending-the-shell-game-cracking-down-on-the-professionals-who-enable-tax-and-white-collar-crimes.htm

6) https://www.congress.gov/bill/116th-congress/house-bill/2513/text

On the scent – illegal wildlife trade and money laundering

Money Laundering Bulletin, 9 August 2022 

                        A de-horned White Rhino and calf, South Africa (Paul Cochrane copyright).

Criminal dealing in ‘protected’ rare and endangered species is serviced by networks of illicit finance, which are coming under increasing scrutiny, finds Paul Cochrane, in Pietermaritzburg, South Africa. 

The Financial Action Task Force (FATF) issued a dedicated report, ‘Money Laundering and the Illegal Wildlife Trade’ in June 2020 (1) and has followed up with further analysis on a topic that is being researched in depth by a wide range of NGOs.

Call of the wild

The criminal trade is estimated to be worth up to US$23 billion a year, with more than 100 million plants and animals trafficked annually, according to UN figures. (2)

The 2020 FATF report noted that “criminals are making enormous profits by using front companies to mix legal and illegal goods and payments early in the resource supply chains. They also rely on corruption, trade-based fraud, and offshore corporate structures to conceal the ultimate criminals benefitting from these crimes.” 

FATF expanded on the issue in 2021, with a report on Money Laundering from Environmental Crime, which includes forestry crime, illegal mining and waste trafficking (3), and generates “around USD110 to USD281 billion in criminal gains each year.”

Friends in high places

Awareness about the illegal wildlife trade has been driven by high-profile support, for example, from the Duke and Duchess of Cambridge: Prince William addressed FATF in December 2021 on environmental crime.

“We are definitely seeing more focus on environmental and illegal wildlife crime. The cynics will say Prince William’s patronage has had a lot to do with that, and I will not dispute that,” Denisse Rudich, a senior policy advisor at The Sentry, a US-based investigative and policy organisation, told MLB. “In terms of industry adoption, it has been about making that link between elephants being poached and how that shows up in the supply chain. Some regulatory technology [regtech] firms are asking: ‘What do we look for? How do we set the rules, and the standards?’.”

The regtech sector is certainly focusing on IWT, especially in Europe and North America, with some vendors changing their services to address the challenges “From what I have seen, financial institutions are concerned about taking it seriously but worry they may not have all the data, and how to record transactions and things like that,” said Dr Janet Bastiman, Chief Data Scientist at UK-based AML technology vendor Napier. “Generally, financial institutions are receptive to any tools and help we can give them to identify IWT. Fundamentally they don’t want to be party to any of these crimes.”

ESG context

The spotlight on IWT and environmental crime has come at the same time as the financial industry increasingly focuses on environmental, social and governance (ESG) criteria. Sustainability reporting standards are being developed this year (2022) by the International Sustainability Standards Board (ISSB), the USA’s Securities & Exchange Commission (SEC) and the European Financial Reporting Advisory Group (EFRAG), the latter for mandatory reporting from 2025 under a European Union sustainability reporting directive.

“The ESG and AML worlds are coming together on this, as big financial institutions are making quite strong ESG commitments. The rising tide of ESG responsibility is a nice motivator for businesses, and understanding the role of corruption, politically-exposed persons (PEPs) and money laundering that underpins the trade is a very good way to show the threat IWT presents,” said Ben Brock, Wildlife Crime Analyst at TRAFFIC, a UK-based non-governmental organisation (NGO) working globally on trade in wild animals and plants.

Joint initiatives

Awareness and cooperation between regulators, law enforcement and the private sector have been driven by initiatives by international NGOs the World Wide Fund for Nature (WWF), TRAFFIC, United for Wildlife, and the Basel Institute on Governance.

New tools to identify illegally traded species and body parts is also aiding investigations: TRAFFIC has launched a new online Learning Centre to provide resources around IWT, including 3D replica shark fin scans to identify protected shark fins (4), while the Arcadia charity, a TRAFFIC Wildlife Trade Portal, tracks global seizures of illegal wildlife products (5), and the USAID Reducing Opportunities for Unlawful Transport of Endangered Species (ROUTES) Partnership, provides capacity building materials for the aviation sector. (6)

WWF and TRAFFIC have developed a compliance protocol to manage stockpiles of shark fins in Hong Kong to prevent co-mingling those listed by the UN Convention on International Trade in Endangered Species (CITES), which require permits to be traded, with non-CITES listed varieties. The Hong Kong authorities recorded their largest seizure, in May 2020, of 26 tonnes of protected Thresher and Silky sharks.

The implementation of CITES has key to fighting illicit wildlife trades. It has 184 signatory states (as of January 2022), and received a boost in May (2022) when another UN agency, the International Maritime Organisation (IMO), adopted new ‘Guidelines for the Prevention and Suppression of the Smuggling of Wildlife on Ships Engaged in International Maritime Traffic’. (7)

TRAFFIC welcomed the move, given shipping accounts for an estimated 72%-90% of wildlife trafficking volumes.

At the national governmental level, in March (2022), the United Arab Emirates (UAE) and the UK jointly launched a toolkit to support financial institutions to tackle illicit financial flows in IWT.

An Eastern-Africa TWIX (Trade in Wildlife Information eXchange) network has also been expanded, with Djibouti joining Kenya, Tanzania and Uganda this year to share online information about wildlife crime that passes within and through their borders. (8) Another dedicated online platform was launched in 2021 to support members of the East Africa Association of Prosecutors (EAAP) in combatting wildlife crime: participating countries are Kenya, Uganda, Tanzania, Rwanda, Burundi and South Sudan. (9)

Train for free

US-based AML training body the Association of Certified Anti-Money Laundering Specialists (ACAMS) has also adopted the cause, in 2020 developing a free-of-charge online certificate on Ending Illegal Wildlife Trade, developed with WWF and supported by the Basel Institute on Governance, United for Wildlife and the Royal Foundation of the Duke and Duchess of Cambridge. (10)

In July (2022), ACAMS partnered with TRAFFIC to launch a Simplified Chinese version of the certificate, which outlines the complex methodologies used to circumvent import-export and AML laws, and features case studies highlighting recent ivory, timber and wildlife-trafficking investigations in Thailand, Tanzania and China. ACAMS is planning to design a further two programmes to enable AML practitioners to identify IWT-related activity, said an association note. 

“The fact that we are seeing big organisations like ACAMS issue this kind of guidance shows that there is demand from customers to know more about IWT,” said Brock. “But the first thing that needs to happen, that has not happened across all organisations and countries, is to assess the threat... There are a lot of unknown unknowns, as countries don’t know their exposure.”

Distinctive features

Brock said financial institutions should focus on the specificities of IWT rather than adopt a generalist approach: “Talking about IWT from an AML perspective as a whole is like talking about the drugs trade as a whole. The cocaine trade has different geographic preferences compared to say European home-grown cannabis or Afghan heroin, as does IWT,” he said.

“If you look at rhino horn and elephant ivory trafficking, they look like other typical crimes like drugs, but if you start to look at illegal fishing or illegally harvested wood, it is a completely different profile, as it is very much enmeshed in legitimate trade and you have tainted supply chains,” he said.

Rudich highlighted how difficult it is to identify typologies and raise red flags related to IWT, despite some commonalities with the trafficking of humans, drugs and weapons. “There are also new crimes that need to be looked at more closely, such as green-washing and what the world is doing to tackle climate change – there is fraud in carbon trading, food security issues such as illegal fishing, and the dumping of waste and technology. There needs to be an evolution in what crimes are looked at, but also more work done specifically on financial flows and how they go through the international system,” she said.

South Africa – model of collaboration

Analysts think more public-private partnerships (PPPs) should be created, emulating the South African Anti-Money Laundering Integrated Task Force (SAMLIT), a PPP that is especially focused on tackling IWT. (11) “When I work in other parts of the world, I frequently cite SAMLIT as the most successful and proactive PPP in the world on IWT. It is Financial Intelligence Centre [FIC, the country’s FIU] led; there’s really good public sector engagement; they have engaged NGO expertise; and the financial institutions themselves seem to be proactively engaged. I am not aware of any European FIU that is engaged in a PPP on environment crime,” said Brock.

PPPs may be given a push by the July (2022) appointment of Xolisile Khanyile, the FIC director as chair of the Egmont Group of FIU’s for a two-year term. “It is definitely good Khanyile is becoming the head of Egmont as she has made IWT a priority as an economic crime, unlike other countries,” added Brock.

NOTES:

1 - http://www.fatf-gafi.org/media/fatf/documents/Money-laundering-and-illegal-wildlife-trade.pdf 

2 - https://www.traffic.org/about-us/illegal-wildlife-trade/and https://www.sciencedirect.com/science/article/abs/pii/S0006320717312478 

3 - https://www.fatf-gafi.org/media/fatf/documents/reports/Money-Laundering-from-Environmental-Crime.pdf 

4 - https://www.traffic.org/news/traffic-launches-its-online-learning-centre/#:~:text=TRAFFIC%20has%20launched%20a%20new,available%20to%20all%20target%20stakeholders. 

5 - https://www.wildlifetradeportal.org/#/login 

6 - https://routespartnership.org/  

7 - https://www.traffic.org/news/new-international-maritime-organization-guidelines-to-combat-wildlife-smuggling/ 

8 - https://www.easternafrica-twix.org/ 

9 -  https://www.traffic.org/news/prosecutors-in-east-africa-set-their-sights-on-wildlife-criminals/ and https://eaaprosecutors.org/

10 - https://www.acams.org/en/training/certificates/ending-illegal-wildlife-trade 

11 - https://www.fic.gov.za/samlit/Pages/default.aspx#:~:text=SAMLIT's%20activities%20in%202020%20built,%2C%20forfeiture%2C%20and%20prosecutorial%20successes. 

Money laundering in the UAE: Beyond the mirage

 Money Laundering Bulletin, 23 June 2022

The United Arab Emirates (UAE) was put on FATF’s grey list in March 2022. Since then, the Emirates government says it has striven to build out and strengthen its AML/CFT regime, but it window dressing or really dealing with the problems? Paul Cochrane investigates.

Performance measurement

FATF's grey-listing of the UAE over "strategic deficiencies" in its anti-money laundering (AML) and countering the financing of terrorism (CTF) laws, policies and programmes (1) surprised some in its government as while the global standard-setter had placed it under 12 month's observation following a 2020 mutual evaluation report (MER), the country had introduced a raft of new measures in 2021. (2)

But FATF judged the progress to be inadequate; it wanted to see practical advances, for instance, demonstrating through case studies and statistics a sustained increase in outbound requests to help facilitate investigation of terrorist financing, money laundering, and high-risk predicates.”

David Lewis, a former executive secretary at FATF, and now a managing director and global head of AML advisory, in the forensic investigations and intelligence practice at Kroll, the New York-based risk advisory firm commented: “The UAE was hopeful they wouldn’t be listed, as they invested a lot and did a big public awareness campaign about what they’ve done. The reasons for listing was mostly because the FATF needed to be persuaded that recent efforts made were not just a one-off to get off the list, and were in fact part of a long-term and sustainable effort to tackle ML and TF.” He stressed: “You can be fully compliant with FATF standards and still be grey listed. Countries are starting to understand the importance of that,” he told the MLB.

Lakshmi Kumar, Policy Director at Global Financial Integrity, a Washington-based think tank, said the listing was “significant and unexpected”. She said: “Due to the UAE’s strong relationship with the USA and the UK, there was strong expectation they would not vote against the UAE. This has happened despite the UK signing an agreement (with the UAE) to tackle illicit financial flows (in September 2021), and came at a time when the relationship with the US government was and is being tested by the situation with Russia.”

A long time coming

While the UAE has naturally felt slighted by FATF’s decision, it has been welcomed in many quarters. The Emirates, particularly Dubai, has long been considered a hub for illicit financial flows, as highlighted in recent exposes such as the FinCEN Files, the Luanda Leaks and Dubai property data leaks. (3)

The listing “is a great sign of FATF’s growing independence and operational capabilities. The Emiratis knew what they were expected to do (to not be on the grey list), and have suffered the consequences,” said Alex Zerden, a former official at the US Treasury Department, now founder of Capitol Peak Strategies, a Colorado USA-based risk advisory group, and adjunct senior fellow at the Center for a New American Security, a think tank, in Washington.

In the US and UK “there is private and public frustration with the UAE on illicit finance issues, which is why the FATF’s multinational and technical criticism has an impact. It is decades of frustrations coming together,” said Zerden.

Work in progress

In March (2022), FATF noted that the UAE has made “significant progress across its MER’s recommended actions to improve its system, including by finalising a Terrorist Financing Risk Assessment, creating an AML/CFT coordination committee, establishing an effective system to implement targeted financial sanctions without delay, and significantly improving its ability to confiscate criminal proceeds and engage in international cooperation. Additionally, the UAE addressed or largely addressed more than half of the key recommended actions from the MER.” (4)

At the FATF plenary on 17 June 2022, no further action was taken regarding the UAE’s listing. The plenary noted that the “UAE chose to defer reporting to focus on its efforts,” and that the (aforementioned) March 2022 statement “may not necessarily reflect the most recent status of the jurisdiction’s AML/CFT regime."

Lewis said that FATF had wanted action in four key areas: international cooperation, an increase in the number and quality of suspicious transaction reports (STRs), more prosecutions related to money laundering, and non-proliferation financing. “They also need to demonstrate and improve money laundering and terrorism financing risks in the non-financial sectors, where there’s clearly not a common understanding. Improvements in intelligence capacity at the financial intelligence unit (FIU) is another thing FATF wants to be assured is happening before the UAE comes off the list,” said Lewis.

Recent results

The UAE has certainly been more active over the past year, with its Executive Office of AML and CTF releasing a factsheet in March (2022) touting its achievements in 2021, which include USD625 million in confiscated assets; USD64 million in fines for AML/CFT non-compliance; USD10.8 million in penalties imposed on several individuals found guilty of a tax evasion and money laundering scheme, in addition to seven years in prison; and USD109 million confiscated as preventative measures for CTF in 2021. There were over 6,300 supervisory inspections for AML/CFT last year, up from 2,812 in 2019. The factsheet stated that 1,000 professionals are to be trained in AML/CFT in the coming five years, and that there had been a 200% increase in staffing in the FIU’s international cooperation unit since 2019. (5)

Companies and charities – beneficial ownership and due diligence

Also in 2021, the ministry of economy released requirements for non-financial businesses to be registered to enable monitoring and transaction reporting, (6) and initiated a process to identify beneficial ownership of all such legal persons, which covers the 39 UAE free trade zones (FTZs), updating its registry of companies in this way. (7) The law, however, excludes companies operating in the two Financial Free Zones (in Dubai and Abu Dhabi) and government-owned entities. A new fundraising law for non-profit organizations (Federal Law No. 3 of 2021) was also passed, which includes requirements to carry out enhanced due diligence and fines of AED200,000-AED50,000 (USD54,458-USD136,147) on anyone illegally profiting from donations. (8)

The question is if such efforts are enough to warrant removal from the grey-list given the FATF focus on effectiveness. Kumar said there is a long way to go. “The challenge with the UAE has always been it is a black hole of information, and is designed to be so. If you look at the biggest exports and imports, 50% is uncharacterised, and what really grabs the attention is the big figure dual-use items like oil, gold and diamonds,” she said.

The UAE’s federal system also poses challenges, as noted in the US State Department’s International Narcotics Control Strategy Report 2022: “The overlapping yet distinct jurisdictional regimes for supervision and enforcement across the seven emirates and disparate commercial and financial free zone systems within the UAE create exposure to regulatory arbitrage.”

The country’s 39 FTZs also pose risks, despite the new beneficial ownership law. “Instead of one beneficial ownership registry, you need to get information from 39 registries. It makes it easier for a criminal to conceal illicit assets,” said Kumar.

International relations – Ireland, South Africa, Russia

At the international level, the UAE has been more active, establishing a partnership to tackle illicit financial flows with the UK, and freezing the assets of an Irish drug gang in April 2022. “Ten years ago international cooperation was difficult, now there are some good examples,” said Lewis.

Moreover, in June 2022, Dubai arrested the Gupta brothers, who are wanted in South Africa in connection with fraud and money laundering during the presidency of Jacob Zuma. “This certainly appears to be a reaction to the greylisting where Dubai wants to be seen to be cooperating on high profile money laundering charges. However, at this stage this is only an arrest, no decision appears to have been made on extradition,” said Kumar. “On the one hand, extradition sends a positive signal to the FATF. However, Dubai has been and continues to be a magnet for the criminally wealthy. It has to balance the signal this would send members of the Russian political elite that are now flooding into Dubai and other high profile political elites that hide money or keep assets in the UAE on the risks of continuing to use the UAE as a base.”

How the UAE handles US sanctions on Russia may be a particular sticking point with Washington, amid reports of Russian funds flowing into Dubai. “With respect to secondary sanctions, the major live issue in the US administration is how to handle these key jurisdictions – like the UAE and India – that haven’t signed up to this global coalition, and have strong economic ties with Russia,” said Zerden.

Lawyers yet to learn

As for UAE efforts to improve compliance by designated non-financial businesses and professions, it appears to be uneven, particularly among law firms. “The big firms are taking this seriously and have very strict onboarding processes, as they do not want any scandals. The small firms could not care less. I was shocked by what some law firms offer, including the falsification of documents. The criminal spirit is still in the market,” said a Dubai-based lawyer on condition of anonymity.

Even if the UAE is taken off the grey-list at FATF's October 2022 plenary, the country will still be considered a high risk jurisdiction. “Taking the UAE off the list doesn’t make a big difference from a private sector US risk standpoint, as the UAE was already in a risk category due to its geography and other factors, based on OFAC and other public guidance and reporting. That may be a bit unfulfilling for the Emiratis, as it does matter reputationally, but if I were advising a private company, the UAE would be in the high risk bucket due to all the known risks – sanctions evasion, money laundering, corruption, terrorist financing. It has it all,” said Zerden.

The UAE FIU did not respond to MLB’s interview requests for this article.

Notes

1) https://www.fatf-gafi.org/publications/high-risk-and-other-monitored-jurisdictions/documents/increased-monitoring-march-2022.html

2) https://www.fatf-gafi.org/media/fatf/documents/reports/mer4/Mutual-Evaluation-Report-United-Arab-Emirates-2020.pdf

3) https://www.occrp.org/en/investigations/dubai-uncovered-data-leak-exposes-how-criminals-officials-and-sanctioned-politicians-poured-money-into-dubai-real-estate

Also see - https://carnegieendowment.org/2020/07/07/dubai-s-role-in-facilitating-corruption-and-global-illicit-financial-flows-pub-82180

4) https://www.fatf-gafi.org/publications/high-risk-and-other-monitored-jurisdictions/documents/increased-monitoring-march-2022.html

5) file:///home/paul/Downloads/UAE%20progress%20on%20AML%20CFT.pdf

6) This includes brokers and real estate agents, dealers of precious metals and stones, auditors, and corporate service providers.

7) UAE government-owned companies are excluded from beneficial ownership reporting requirements.

8) https://www.state.gov/wp-content/uploads/2022/03/22-00768-INCSR-2022-Vol-2.pdf

ChatGPT and its variants could offer criminals new weapon

Commercial Crime International, June 2023

The public deployment of large language models such as AI chatbot ChatGPT has potential crime risks, particularly for online fraud and cybercrime, as Europol has warned. On the flipside, such systems are bolstering the capabilities of AI to ward off cybercrimes, and to decipher what is real and what may be a deep-fake. Paul Cochrane reports.

In the six months since the public launch of ChatGPT, there are no publicised cases of it being utilised for criminal activities, but cyber security experts say it is just a matter of time. Indeed, in March, European Union (EU) police agency Europol released a report on the impact of large language models (LLMs) on law enforcement.

Europol noted that given the information ChatGPT provides freely on the internet, by asking contextual questions “it is significantly easier for malicious actors to better understand and subsequently carry out various types of crime”.

The launch of artificial intelligence (AI) chatbots such as OpenAI’s ChatGPT and Google Bard into the public realm has caused much excitement. These LLMs can draw on massive amounts of data to answer a user’s question, create a text or image, or write code.

Easier for criminals

Such systems have been available in the AI field for some time. What has made LLMs disruptive is its public availability, and the possibility of its capabilities being deployed for more nefarious means.

“In the cyber security space, it’s one of the biggest events over the past decade. Any tool we have in the security space, the adversaries have, which makes life easier for criminals,” said Anna Collard, senior vice-president content strategy for Knowbe4 Africa, a security awareness training and simulated phishing platform.

While LLMs have a content moderation policy to not answer questions classified as harmful or biased, such safety measures “can still be circumvented in some cases with the correct ‘prompt engineering’”, noted Europol. This enables users to refine the way a question is asked to influence the output generated by an AI system, said Collard. If prompts are broken down into individual steps, “it is trivial to bypass these safety measures,” she said.

Circumventing laws

An example is asking “how to circumvent sanctions on Russia” in a less direct way, said Ilya Volovik, senior manager, payment fraud intelligence at Recorded Future, a Boston-based intelligence company.

“You could ask how to ship goods to Russia via Kazakhstan through a forwarding address in the United States. ChatGPT may bring up the top companies to use, which is easier than searching online for the answer. There are many different areas ChatGPT can assist with circumventing the law,” he said.

Fraud and phishing

More direct concerns are related to cybercrimes, particularly fraud and phishing. ChatGPT can for instance make a phishing email grammatically correct and more sophisticated. “In the past you looked out for spelling errors, but that doesn’t apply anymore,” said Collard.

Knowbe4 ran a demo of ChatGPT having a conversation with a human target on an app. “ChatGPT responds based on the stimuli it gets back. The goal is to trick the target [into providing certain information], and it does that automatically. If we can do that for good purposes – or phishing simulations – then the bad guys can definitely do it as well,” said Collard.

Other risks involve AI being used for deep-fakes, whether videos or photos, or replicating a person’s voice for impersonation purposes. The dangers of this were shown in 2019 when an unnamed British energy firm was scammed out of USD243,000 through the CEO’s voice being an AI generated deep-fake.

“It was harder to do such deep-fakes a few years ago, now it is way more accessible, and will become more mainstream in the criminal world,” said Collard.

Bypass anti-fraud measures

ChatGPT has also made computer programming easier by being able to write code, which could be used for hacking and developing malware. Europol noted that “for a potential criminal with little technical knowledge, this [ChatGPT] is an invaluable resource. At the same time, a more advanced user can exploit these improved capabilities to further refine or even automate sophisticated cybercriminal modi operandi.”

Volovik said such knowledge can be useful for cyber criminals to make purchases with stolen credit cards. For instance, anti-fraud measures on shopping platforms assess whether a buyer is a real card holder by checking an account’s history, such as the reading of reviews, writing comments or comparing similar merchandise.

“ChatGPT can create scripts to emulate human behaviour, such as a unique browsing experience to bypass certain anti-fraud measures,” he said. Criminals can also use AI to monitor whether a website’s cyber security software has detected the malicious code used to infect a system. “ChatGPT could monitor any changes in the anti-virus systems on certain pages, or how pages were set up, to give a warning to the cybercriminal,” said Volovik.

AI can be valuable

On the flipside, ChatGPT can be used to detect whether AI is being used maliciously in a system, or whether a call is a deep-fake, an email is genuine or if there are any security glitches. “The more advanced these AI systems become the easier it will be to decipher what is real and what is not, or if someone misleads you. ChatGPT can be a kind of assistant,” said Volovik.

Dr Michelle Frasher, a US-based independent financial crime and technology consultant, noted that the financial crime compliance industry has been exploring the use of and developing machine learning and AI tools to add another layer to screening, and sift through data and spot suspicious transaction behaviour. Such systems are constantly being improved. “An emerging trend is to see what is potentially criminal; AI’s emerging ability to process these trends is valuable,” she said.

As for ChatGPT’s potential use by criminals, Dr Frasher questioned how prevalent it may be. “There are tonnes of corners of the internet that have information [criminals could use], and there are still problems with AI’s accuracy. Right now, ChatGPT summarises information, and sometimes it doesn’t even do that well,” she said.

Better regulation

But the fact remains that as ChatGPT and other LLMs become more accurate, the risk of them being exploited for criminal purposes is real and this is one reason why there are growing calls in certain jurisdictions to better regulate AI.

The European Parliament is developing an Artificial Intelligence Act to establish a central AI authority that classifies AI systems by risk, and to strengthen rules around data quality, transparency, human oversight and accountability.

Such regulatory moves are expected to improve content moderation policies on ChatGPT and other prominent LLM models such as Vicuna, Koala, GPT4All, and Dolly2.0.

However, open-source AI is developing fast and could operate under a regulator’s radar, noted Volovik. Such systems may out compete more prominent systems, while scalable personal AI is increasingly easy to develop, with advanced users able to set up such a system in an evening.

“How will we fight this? With another AI system. The question is, who’s AI is better? This will become more important as we see more attacks come from the likes of ChatGPT,” said Volovik.

Lit fuse – proliferation finance & compliance for containment

Money Laundering Bulletin, 17 May 2023

North Korea, already nuclear, is working on ever more powerful weapons; Iran remains set on acquiring the capability; and both may, with others, be building chemical and biological arsenals: the stakes could not be higher and so funds are on offer to match. The incentive to circumvent export controls and sanctions, often with state support, and the vast range of dual-use components in scope make, writes Paul Cochrane, for the most complex investigative and preventive threatscape.

Counter Proliferation Financing (CPF) is becoming an increasingly important third goal of international policies and programmes designed to attack and reduce illicit financial movements. With concerns about the development of nuclear weapons by sanctioned regimes in North Korea and Iran growing, governments have been focusing on how to implement Financial Action Task Force (FATF) guidance on CPF, which has been deepening since the global anti-money laundering and terror finance body in 2020 amended Recommendation 1, and its Interpretive Note, to require countries and entities to identify, assess, understand and mitigate their PF risks. (1) CFP also covers other chemical and biological weapons that could cause mass casualties.

In 2021, FATF updated its guidance on PF risk assessments and implementing mitigation measures, while certain countries have carried out their first national risk assessments (NRAs) on PF; they include the UK, the USA and Australia. (2)

In regulator's sights

“A main focus of the industry over the past several months has been PF and sanctions, with the regulators having taken a key interest on the back of national implementation of CPF requirements, including PF risk assessments, being assessed in the next round of FATF mutual evaluations,” said Dr Noemi També, a Luxembourg-based financial crime consultant and associate fellow at the Royal United Services Institute (RUSI). 

Third pillar

This move to frame CPF alongside AML (anti-money laundering) and CFT (combating the financing of terrorism) has been fuelled by the changing geopolitical landscape of an increasingly unstable world. Since the ratification of United Nations Security Council Resolution 1540 in 2004, the United Nations has required countries to prevent the proliferation of weapons of mass destruction (WMD) to and by non-state actors. (3) Governments have responded by tasking AML/CFT obliged entities to look for proliferation finance and sanctions evasion by North Korea and Iran: the former has been able to develop nuclear weapon with little or no cooperation with other UN member states or engagement with the International Atomic Energy Agency (IAEA). Iran, meanwhile, denies developing a bomb: in 2003, Supreme Leader Ayatollah Khameni issued a fatwa banning use of nuclear weapons, although he is 84 and may not remain in power much longer – what will happen after his death is unknown.

Under amendments to the UK’s Money Laundering Regulations in 2022), the UK Financial Conduct Authority (FCA) now expects all financial services businesses that it regulates to carry out risk assessments and monitor and report suspicions of PF. Dr També said the deadline was tight: revisions to the MLRs were announced in September 2022 with any changes in controls to be implemented by 1 April 2023. There was “no honeymoon period ...to get up-to-speed" she said, adding that more practical and detailed guidance would be helpful.

Invasion fallout

The heightened regulatory focus has further sharpened with the imposition of sanctions on Russia following its invasion of Ukraine in February 2022: the US, European Union (EU), UK and others have sought to limit Moscow's procurement of sensitive technologies and materiel that could assist its prosecution of the war machine. (4)

Louis Reitmann, Research Associate at the Vienna Center for Disarmament and Non-Proliferation (VCDNP), told MLB that the invasion has raised concerns around proliferation finance: “Over the past 20 years, only a relatively small expert community has looked into PF, specifically on North Korea and Iran. The wider community has only really woken up to sanctions and exports controls as being significant tools for non-proliferation in the context of the war in Ukraine, and in how quickly the [sanctions] regime [on Russia] developed, as such regimes usually take years to be put in place.”

The result has been quite a scramble lately by obliged entities to understand the PF risks, typologies and the red flags to look out for, with RUSI taking an active role through its CPF Technical Assistance Programme. (5) “A lot of the financial industry needs guidance and support about PF, as many are struggling to understand how it differs from sanctions regimes and how to leverage existing anti-money laundering (AML) and counter terrorist financing (CTF) frameworks. Counter proliferation finance (CPF) is not black and white - you can’t expect a traditional compliance analyst to necessarily understand the technicalities of dual-use goods,” said Dr També.

FATF has tried to lay down basic definitions, as a result, saying that weapons of mass destruction (WMD) proliferation refers to the “manufacture, acquisition, possession, development, export, trans-shipment, brokering, transport, transfer, stockpiling or use of nuclear, chemical or biological weapons and their means of delivery and related materials (including both dual-use technologies and dual-use goods used for non-legitimate purposes).” The financing of proliferation refers to the “risk of raising, moving, or making available funds, other assets or other economic resources, or financing, in whole or in part, to persons or entities for purposes of WMD proliferation.”

Knowledge state

The training need was highlighted by a joint RUSI-ACAMS (Association of Certified Anti-Money Laundering Specialists) survey on attitudes and understanding of proliferation finance in the global financial industry, published in 2020. (6) It found that international banks had greater understanding of PF risks than smaller financial institutions, with 57% of international banks being familiar with these issues, compared to 35% of regional banks, 32% of national banks and 35% of non-banking respondents. Only one-fifth of respondents said they received sufficient guidance from governments on PF risks.

On the plus side, 60% of respondents worked for an organisation with a compliance function that incorporated CPF, with that figure higher in international banks (76%). The majority (66%) however did not conduct standalone PF risk assessments. “Large financial institutions, in particular hubs, have specially designated teams for PF, which you wouldn’t typically see at smaller institutions as they have less of an international footprint and less resources,” said Dr També.

The RUSI-ACAMS survey showed that certain regions were more aware of PF risks than those in other regions: with 70% saying they were aware of proliferation red flag and typologies, compared to 60% in Asia, 58% in Europe, 51% in the USA, and 53% in the rest of the Americas. Also, 59% of Middle East respondents said they had read the latest FATF guidance on PF (2018) compared to 51% in Asia, 50% in Europe, 56% in Africa, 42% in the USA, and 45% in the rest of the Americas. Unsurprisingly, 63% of Middle East respondents said they were uptodate on the latest PF advisories and guidance related to Syria and Iran, compared to 29% in Africa, 38% in Asia, 44% in Europe, and 51% in the US and the rest of the Americas.

Synergies – useful and dangerous

PF bears comparison with terrorist financing techniques, said Dr També, in that it involves raising funds, disguising and then placing these in the financial system for use. The particular challenge lies in the potential for PF activity to appear completely legal. Funds may derive, for example, from a restaurant or a fishing business, for example, support by government agencies subject to sanctions.

“The moment there is a nexus with North Korea the activity is illegal and violating UN sanctions,” she noted. “The challenge is obviously establishing the connection with North Korea, as proliferators are very good at making sure every issue is disguised and geographically divorced.”  

This is the cross-over with traditional AML measures, such as identifying the ultimate beneficial owner of a company. “The North Koreans find facilitators to circumvent sanctions - incorporation service providers that create seemingly legitimate front companies to trade in sanctioned goods, and to buy maritime vessels,” said Reitmann.

A more particular challenge is identifying dual-use goods. “Even though there are export contol lists and sanctions lists to be checked, dual-use goods can be in a gray area, whether for peaceful purposes or weaponisation,” said Emad Kiyaei, Director of the Middle East Treaty Organisation (a coalition of civil society and disarmament activists) and co-author of a ‘Middle East Free of Weapons of Mass Destruction: A New Approach to Nonproliferation’.

Nuclear ambitions are only one concern. “There is a huge biological and chemical industry worldwide that is dominated by non-state actors, so that changes the whole game,” said Kiyaei. The Chemical Weapons Convention, which banned the development, production or stockpiling of chemical weapons in 1997, ratified by 193 states, has been difficult to enforce as the toxins and chemicals listed are used in many key industries: “Non-state actors can make a dirty chemical weapon from chlorine, which is easily accessible,” Kiyaei observed. (7) Efforts to counter the proliferation of biological weapons are also complicated by rules on access: “Private laboratories are hard to enter due to privacy and intellectual property right laws, so it is difficult to know what they are doing and who is funding them,” he said.

The 1972 Biological Weapons Convention, ratified by 184 states, provides for voluntary national assessments, with no obligatory compliance. (8)

Bear and dragon

While North Korea and Iran remain the focus, Russia is also a current concern. “What Moscow is doing in terms of evading sanctions is using third party intermediaries in countries that have not applied sanctions, like the United Arab Emirates, Turkey, and Uzbekistan, so the same type of tactics used by North Korea and Iran for many years,” said Reitmann. The Financial Times, in May 2023, reported that Russia’s FSB spy agency was using smuggling rings to acquire sensitive European technology. (9) The country's ‘Serniya network' was accused by the US Department of Justice of undertaking “highly sensitive and classified procurement activities” for the FSB, including for its Directorate for Scientific and Technological Intelligence, known as ‘Directorate T'.
An October 2022 report by the Centre for a New American Security further noted that Russia was turning to “grey imports via the black market or through a chain of companies designed to conceal the end-user”. (10)

In the export control space, while Russia is the immediate threat, China is the longer-term concern, said Reitmann. “China is perhaps less of a focus in CPF, but definitely in export controls. The US is working very hard, and lobbying partners in Asia and Europe to adopt coordinated controls in the technology space, responding to China’s civil-military fusion strategy.” 

NOTES: 

1 - https://www.fatf-gafi.org/publications/financingofproliferation/documents/statement-proliferation-financing-2020.html 

2 - https://www.fatf-gafi.org/media/fatf/documents/reports/Guidance-Proliferation-Financing-Risk-Assessment-Mitigation.pdf 

3 - https://www.rusi.org/explore-our-research/publications/rusi-newsbrief/strengthening-role-unscr-1540-countering-proliferation-financing 

4 - https://ofac.treasury.gov/sanctions-programs-and-country-information/ukraine-russia-related-sanctions

https://www.consilium.europa.eu/en/press/press-releases/2023/02/25/10th-package-of-sanctions-on-russia-s-war-of-aggression-against-ukraine-the-eu-includes-additional-87-individuals-and-34-entities-to-the-eu-s-sanctions-list/

https://www.gov.uk/government/collections/uk-sanctions-on-russia

5 - https://www.rusi.org/explore-our-research/projects/counter-proliferation-financing-technical-assistance-programme;https://rusi.org/explore-our-research/projects/proliferation-financing-risk-assessment#aims-and-objectives 

6 - https://www.acams.org/en/media/document/18566;and https://www.acams.org/en/resources/acams-insights/counter-proliferation-financing-insights 

7 - Egypt, South Sudan, and North Korea have not ratified the Chemical Weapons Convention. Israel has signed by not ratified the convention - https://www.aljazeera.com/news/2021/4/29/visualising-chemical-weapon-attacks-in-the-middle-east 

8 - https://news.un.org/en/story/2022/11/1131097 

9 - https://www.ft.com/content/bf892731-2f1c-4c52-b90b-b44ca1911263?accessToken=zwAF-vCjPFcokdO_iScxLxxMUtO5C7RMoZESYw.MEQCIAeix8HnvitU8Fq2CGOmAOGfifyypKkdEVKJC974LttHAiBJM5nkWSevvgApkx-mAj0yUO5yt70TnHk0dn-3cHxqAQ&sharetype=gift&token=a126d782-d8cb-44b9-a8cf-4e7ee604d362 

10 - https://s3.us-east-1.amazonaws.com/files.cnas.org/documents/CNAS-Report-RussianTechnology-Oct22-TSP.pdf?mtime=20221019171136&focal=none