National Risk Assessments have again been the topic of the week for me in the AML/CFT world with presentations and discussions galore.
One of the highlights was listening to Richard Walker at the GACO presentation discussing Guernsey’s NRA in more detail. Richard, who is the Director of Financial Crime and Regulatory Policy for the Policy & Resources Committee and an excellent speaker, was able to provide a very interesting update. As some of you were not able to attend, I thought I would summarise the bits I found most illuminating.
Unlike the IMF and MoneyVal visits, the NRA is considered to be a different type of evaluation of a country’s AML/CFT risks and controls and it is up to the country to decide how best to complete the task. Guernsey has chosen to ask the IMF to support the process unlike other jurisdictions who may have chosen to go it alone or use the World Bank. Richard then proceeded to explain why it had been agreed that either the World Bank or the IMF’s involvement was necessary and then why the decision had been made to chose the IMF.
Whilst there is enough experience in the jurisdiction to decide upon the risks, it was felt that there would be disagreement on the methodology which should be used. It was also felt that, as we will be under a great deal of external scrutiny to show the NRA was not open to bias, an independent evaluator would do the trick. So, rather than spend too much time on the question of who does what, it was agreed that either the IMF or the World Bank would be asked to help.
The IMF was chosen despite the extra initial expense because it was felt the World Bank’s methodology was not suited to a jurisdiction like Guernsey but more suited to the bigger countries where corruption was the main concern. Whilst the World Bank model could and was adapting to be relevant to the type of business we have on Guernsey, the IMF’s methodology was already able to deal with trust and company services, cross border issues and e-gaming to name a few.
Richard went on to say that the World Bank’s methodology did not separate the three elements of risk – threat, vulnerability and consequence – so not clearly dealing with the impact. The IMF methodology is considered much simpler and more structured and we are advised that it already has resulted in the need to spend less time on the work in Guernsey reducing its cost.
Having amassed a great deal of information from many sources such as annual returns, MLAs and STRs, the process moves from the on-island agencies to the completion of a survey by 65 firms. Those being asked to participate are from a broad cross-section of business and international NPOs whose activity is funded in the Bailiwick. The surveys are completed on an online platform used by the IMF and anonymous. The pattern of the responses has been analysed and already the results have proved interesting. Richard gave the example that the survey is saying that businesses think there is a threat from the UK, US and Russia yet up until now information had only indicated a high level of business from Russia but not an equivalent level of threat. It is felt that, using the IMF, is showing that an independent evaluation methodology is proving its worth.
The survey is not an easy task – apparently some have said it is impossible to complete. However, using Francis Galton’s 1906 proposition of collective wisdom, Richard believed that, overall, the survey will be a useful measure of Guernsey’s AML/CFT risk.
So after the survey and the analysis will be further discussions and IMF workshops with authorities. It is hoped that there will be two separate NRAs, one looking at the risks of money laundering and one at terrorist financing, and they will be issued in the autumn of 2017. The reports will also include an annual statistical digest and will need to be reviewed every few years.
To be of value, it is essential that those risks identified in the NRAs filter down into the business and relationship risk assessments completed by firms. Together with the new combined Handbook due out for consultation later in the year, it will result in a large body of work for you and your compliance teams. That work can start now as the basis for the changes are already in the public domain. As I have said, understanding the FATF Recommendations, reading the EU 4MLD and knowing your own business and customers thoroughly will be half, if not most, of the battle.