Regulators step up their role to disrupt illicit financial flows

Regulatory directions related to illicit finance in the fourth quarter of 2023

Illicit financial flows (IFFs) refer to the movement of money across borders that is illegal in its source (e.g., corruption), or its use (e.g., terrorist financing) and often enabled by politically exposed persons (PEPs). 

During the last quarter of 2023, we observed regulators focusing on IFFs by enhancing their anti-money laundering and counterparty terrorist financing (AML/CTF) regimes, strengthening standards for beneficial ownership information (BOI) and refining risk assessments of PEPs.

Firms are strongly recommended to rely more on data analytics and automation in order to gather and analyze customer data and identify beneficial owners faster and more efficiently. 

Regulators are tightening (AML/CTF) regimes:

AML/CFT regimes across jurisdictions are focusing on supervision and enhanced due diligence for high-risk clients, while crypto asset service providers (CASPs) are under the microscope.

·     In Europe, a provisional agreement was reached on parts of the AML package to strengthen supervision. As such, a new European anti-money laundering authority (AMLA) will directly supervise certain types of credit and financial institutions (FIs). These firms will need to apply enhanced due diligence (EDD) measures if business relationships with high net-worth individuals involve large amount of assets, or – in the case of occasional transactions – involve high-risk third countries. AMLA will, in addition, directly supervise CASPs if they are considered high-risk or operate across borders and will require them to conduct due diligence on their customers, which includes reporting suspicious activity.

EU regulators are also aligning AML requirements already applicable to FIs with regulation of the crypto sector. The AML/CFT guidelines will apply from 30 December 2024 to CASPs, ahead of the Markets in Crypto Asset (MiCA) regulation, which is effective mid-2024. In addition, the travel rule guideline is expected to require CASPs to collect data on transactions.

·     The US is addressing illicit finance and corruption with implementation of the Corporate Transparency Act. Effective 1 January 2024, many domestic and foreign companies are required to report their beneficial ownership information (with exemptions for companies created on or after the effective date). A notice of proposed rulemaking (NPRM) is expected to address illicit finance risks in the commercial real estate sector in early 2024 and another NPRM is expected to extend AML/CFT requirements, including new suspicious activity reporting obligations, to certain investment advisers in the first quarter of 2024.

·     The Financial Intelligence Units of several countries have established a task force to support global anti-terrorism efforts and collaborate with FIs to identify and stop terrorist funding channels.

Regulators are strengthening standards for BOI to ensure greater transparency:

With the rise of shell companies and fraudulent accounts, knowing the identity of customers and beneficial owners has become more vital. 

·     In the US, the Financial Crimes Enforcement Network (FinCEN) issued the “access rule”, which establishes a framework for access to and protection of BOI. FIs can request BOI to facilitate their compliance with customer due diligence requirements under applicable law but must implement administrative, technical, and physical safeguards reasonably designed to protect BOI as a precondition for receiving BOI.

·     In Europe, provisions related to BOI have been strengthened. Beneficial ownership will now be based on two components – ownership and control and firms will need to analyze both to identify all the beneficial owners of a legal entity or across types of entities (e.g., non-EU entities doing business in the EU). The agreement also lowers the threshold for reporting companies’ beneficial owners to 25%. In addition, rules applicable to multi-layered ownership and control structures, as well as data protection and record retention provisions were clarified.

·     Jersey, Guernsey, and the Isle of Man committed to provide FIs access to information held in their beneficial ownership registries by the end of 2024, if they can demonstrate a legitimate interest and put in place appropriate safeguards to effectively manage any interference with privacy rights. The countries will present proposals on the definition of legitimate interest to their parliaments by Q4 2024.

In light of these new and/or enhanced beneficial ownership reporting obligations across jurisdictions firms should ensure their risk assessment capabilities are designed to effectively reveal entity owners and non-owners, who have a certain degree of decision-making authority over the entity.

Regulators foster proportionate risk assessments of politically exposed persons (PEPs):

It is getting increasingly important for firms to be able to monitor and adjust customers’ risk profiles on an ongoing basis to avoid individuals being unnecessarily excluded from financial products or services. As such, firms should continue to ensure their systems and processes can not only identify but also classify risks from PEPs throughout the business relationship.

·     Jersey aligned with international best practice in providing the ability to declassify politically exposed persons.

·     The Dutch Banking Association (NVB) published a new risk-based standard for screening PEPs. It describes risk indicators that banks can use to conduct customer due diligence to avoid unnecessary in-depth investigations of PEPs. 

·     In October 2023, the Parliament of Ukraine amended a bill with regards to PEPs. While high-ranking officials will now have lifelong PEP status, compared to three years previously, the regulators also aim to prevent unjustified refusal of financial transactions and/or of establishment (extension) of business relationships.

·     The UK Financial Conduct Authority (FCA) announced to perform a review on how firms assess domestic PEPs, their families and close associates and how EDD and ongoing monitoring are applied in line with the identified risk. A report is expected by the end of June 2024 and the FCA announced to act, if any significant deficiencies are identified. In addition, as of 10 January 2024, the status of UK PEPs is different to overseas PEPs. Domestic PEPs are still subject to EDD but must be treated as lower risk than overseas PEPs, unless enhanced risk factors apply. Firms should consider amending their policies and procedures to make clear that domestic PEPs are subject to lower EDD standards.

·     Meanwhile the Isle of Man regulator has updated its AML/CFT Handbook with a focus on business risk assessments and source of wealth requirements for PEPs.