OR 11 – Financial Crime and Fraud

Banks were catching thieving staff and cheating outsiders long before operational risk had a name. Two further risks sit beside fraud: money laundering, handled through anti-money laundering (AML) controls, and terrorist funding, handled through counter-terrorism financing (CTF) controls. A bank can be fined heavily without losing anything itself, simply because it cannot show regulators working controls against criminal proceeds or terrorist payments.

The UK regulatory definition

The Financial Conduct Authority (FCA) in the United Kingdom uses a deliberately wide definition in its Handbook. Financial crime is any criminal conduct connected with money, financial services or financial markets, and it lists four kinds of offence that fall inside it:

The FCA adds a jurisdictional point: an act or omission counts as an offence if it would have been one had it happened in the United Kingdom, so conduct abroad does not escape the definition.

Money laundering and terrorism financing are not losses from theft. They belong to the Basel category “Clients, Products, and Business Practices” (CPBP) because the breach is the firm’s involvement itself: handling criminal proceeds, or money intended for terrorist acts, is a failure of the firm’s obligations to the market and to regulators, whatever the direct financial outcome.

Internal fraud and external fraud are event types one and two in the Basel Committee on Banking Supervision (BCBS) loss classification. Both cover losses from acts meant to defraud, misappropriate property or get around the rules. What separates them is who acts. Internal fraud needs at least one internal party, and its definition also reaches breaches of company policy while carving out diversity and discrimination events. External fraud is committed by a third party and is framed around the law.

Subcategories of internal fraud

Internal fraud is treated here as a whole operational risk type, wider than the financial crime perimeter, and it splits into two subcategories.

Unauthorized activities are deliberate breaches of law or internal policy by an employee, and they need not cost the firm any money. The examples in the original Basel classification of 2001 are transactions intentionally left unreported, trading positions deliberately mismarked, and transaction types executed without authority. Sharing passwords, leaking confidential information and selling unsuitable products to vulnerable clients belong in the same group. Today this subcategory is usually called misconduct, the word the FCA uses in limb b.

Theft and fraud is the more familiar misappropriation of assets: bribery, embezzlement, extortion, tax evasion and the malicious destruction of assets.

Subcategories of external fraud

Unauthorized activity cannot apply to an outsider, so external fraud keeps theft and fraud and adds systems security, which covers hacking damage and stolen information. Digitalization has pushed this subcategory to the front, and cyber and information risk has grown over roughly the last decade into a specialist field of its own, often called information security risk management (ISRM).

The pandemic effect

COVID-19 raised exposure on both fronts. Studies by the American Bankers Association found that fraud attempts had tripled in 2021 compared with the period before the lockdown of March 2020. With staff working from home, wire transfer fraud and e-mail scams rose sharply, and phishing e-mails were estimated to have grown 6- to 7-fold over the first year of the pandemic.

Almost every country prohibits money laundering and terrorism financing by law, and the European Union definition is a clear reference point. The European Parliament and Council directive of 20 May 2015 (EU 2015/949 as printed in the source; the directive is officially numbered 2015/849) updated the rules on preventing the financial system from being used for these purposes. It reaches financial institutions, credit institutions and several other professions exposed to the risk, and its article 1 sets out the definitions.

Four acts that count as money laundering

Every limb requires knowledge that the property comes from criminal activity or from participation in it.

Put simply, anyone who organizes, facilitates or conceals the use or conversion of funds so that their criminal origin is hidden is treated by the authorities as laundering money.

Terrorism financing

The International Monetary Fund (IMF) describes terrorism financing as gathering or supplying funds in any way, whether directly or through intermediaries, with the intention or knowledge that they will be used, wholly or partly, to carry out an act the authorities treat as terrorist. The funds may be perfectly clean in origin; what makes the act criminal is the intended use.

National lawmakers and regulators are expected to prohibit both activities. UK guidance, for example, warns that a bank unable to show effective AML and CTF controls faces fines, limits on its business and possibly harsher prosecution if it turns out to be holding criminal proceeds.

Internal audit historically owned fraud management in banks. Some banks, ING among them, ran a unit inside internal audit called “inspection” that existed to detect, monitor and report fraud, and fraud risk teams still often hire former police officers and other forensic specialists.

Nearly every risk appetite statement claims “zero tolerance” for internal fraud. The phrase promises that every fraudster who is caught will be sanctioned; it does not claim that controls make internal fraud impossible.

The four pillars

The framework below grew out of a financial trading company that set out to overhaul its anti-fraud measures. It groups controls by the stage at which they act.

Selection screens employees, contractors and third parties who will work inside or close to the firm. Tone from the top and shared values belong here too, because a firm that hires people with its own ethical standards finds them far easier to manage. The same screening logic reappears in third-party risk management and in AML.

Prevention holds the core controls. Drawing clear lines around the rights, authority and access of every function is the foundation of fraud risk management.

Detection matters because time to detection drives the size of a fraud, especially one that grows quickly or repeats. Detection also deters: when the chance of being caught is high, the incentive to commit fraud falls. So managers should watch for resentment, disengagement or other suspicious behavior in their teams.

Deterrents are the sanctions announced in advance and applied afterwards. They shift the risk and reward balance that a potential fraudster weighs.

External fraud management reuses most of the internal toolkit but aims it outward, at professional criminals and at customers or business partners who may themselves cheat the bank. The list of schemes is long: identity theft, credit card fraud, check kiting, fraudulent wire transfers and bank robbery. Many institutions also classify misstatements of income, assets or collateral values in a loan application as fraud.

First-party and third-party fraud

Banks often split external fraud by who benefits and who is harmed. In first-party fraud the customer or business partner commits the fraud for their own gain, as when a borrower overstates income to obtain a larger loan. In third-party fraud an outside actor carries out the fraud and the customer may be a victim alongside the bank, as when a criminal uses a stolen identity to open a credit card.

Specialist teams

Because the schemes and actors vary so much, external fraud needs dedicated teams. Company security protects branches and ATMs against robbery and liaises with local law enforcement when incidents occur. Retail banks usually add separate teams for deposit and check fraud and for credit and debit card fraud, and these often work with specialist police units to find and catch perpetrators.

Launderers usually move criminal proceeds through two or three phases before the money looks legitimate. The standard description uses three: placement, layering, and integration (also called extraction).

Placement

Placement covers the techniques that put criminal money into the financial system while hiding where it came from. Typical methods are paying cash into a business, issuing false invoices, routing funds through trusts and offshore companies, and using foreign bank accounts. “Smurfing” belongs here: one large sum is broken into many small transactions so that each stays under the reporting threshold that applies to bank accounts or credit cards.

Layering

Layering combines placement and extraction moves, with changing amounts and changing patterns, so that transactions become as hard to trace as possible and the AML controls are sidestepped. It is the stage that deliberately confuses any investigator following the money.

Integration or extraction

The last stage takes the money back out for use without the police or the tax authorities noticing. Sham salary payments to employees, sham loans and dividends paid to accomplices are common routes.

The AML control framework built on regulatory guidance uses the same four pillars as the internal fraud framework. The parallel is deliberate, since risk organization looks much the same across fraud risks. Useful guidance comes from the Basel Committee’s July 2020 paper on sound management of laundering and terrorist funding risks and from the Financial Action Task Force (FATF), an independent intergovernmental body whose Recommendations are recognized as the global AML and CFT standard. The FFIEC BSA/AML Examination Manual is another complete reference.

Know your customer

Profiling and selecting customers is the first and arguably most important AML control. Checking the identity documents of anyone opening an account is the procedure known as KYC, know-your-customer. For any significant deposit the bank must also confirm where the money came from and that it is not tied to crime, which is how it proves its due diligence was effective before doing business.

The risk-based approach

Regulators and industry bodies recommend a risk-based approach: the higher the risk, the tighter the control, and the reverse. Retail and business customers are rated low, medium or high risk on factors such as industry, country of operation, corporate structure, history with the bank, where subsidiaries, third parties and clients are located, traceability of funds, and the volume and frequency of transactions. Those same factors then drive monitoring. For retail clients, monitoring also checks lists of politically exposed persons (PEP), occupation, transaction volumes and types, history with the bank, and evidence for the origin of funds.

Governance and the MLRO

In most jurisdictions most institutions must appoint a dedicated MLRO accountable for AML management (the title is sometimes expanded as money laundering risk officer, though money laundering reporting officer is the more common form). Written policies, staff training and regular reviews that keep customer data and monitoring systems current complete the governance layer.

RegTech and sanction lists

“RegTech” firms apply data analytics, AML above all, to compliance. Using machine learning, they automate customer profiling, speed up due diligence by scanning documents automatically, and validate identities and photos. The same analytics flag unexplained changes in a customer’s behavior early and check automatically whether customers or related businesses appear on sanction lists or as PEPs. UK challenger banks rely heavily on these tools, and regulators scrutinize their quality.

The US Treasury Department’s Office of Foreign Assets Control (OFAC) publishes a sanctions list covering people and companies owned or controlled by, or acting for, targeted countries, as well as terrorists, narcotics traffickers and other designated parties that are not tied to a country. Any company with direct or indirect US business must make sure its clients are not on this regularly refreshed list.

Challenger banks are fully digital and compete by letting customers open accounts in minutes. The FCA, which in 2022 published the latest update of its review of their financial crime controls, worries that information gathered at such a fast onboarding stage may be too thin to identify higher-risk customers.

The common thread is a control environment that fails to grow with the business. Enhanced due diligence, the deeper review for higher-risk relationships such as PEPs, was applied unevenly because the risk assessment that should trigger it was underdeveloped.

USAA Federal Savings Bank (FSB) was fined $140 million in March 2022 for failing to fix long-standing weaknesses in its AML program. No proven laundering case was needed. Regulators punish an inadequate control environment on its own, in the United States and elsewhere, and banks across Asia, the UK and the EU have paid heavy fines for being unable to show that their AML controls were well designed and effective. In 2020, authorities in the Asia-Pacific region imposed fines totaling $5.1 billion for AML breaches and related misconduct, a seven-fold increase from 2019 according to Thomson Reuters.

What the regulators found

The $140 million came from two separate consent orders, one with the Financial Crimes Enforcement Network (FinCEN) and one with the OCC (Office of the Comptroller of the Currency). Both cited the bank’s “willful” failure to put in place and keep up a compliance program under the Bank Secrecy Act/anti-money laundering (BSA/AML) rules.

Contractors are a common answer to workload spikes and tight deadlines in AML remediation. At USAA the failure lay in the missing training and quality checks, which deepened the staffing problem.

Why alert calibration matters

Automated detection is valuable in AML only if the model is properly parametrized and there is a feedback loop tracking false negatives and false positives that lets the institution and its models learn. Without it, and without keeping pace with evolving financial crime, a bank falls behind its legal duty to keep criminals and terrorists out of the system. Pandemic shifts toward remote transactions made anomalies harder still to spot.

Lookbacks and lessons

Findings and sanctions lead to expensive AML remediation programs, known as lookbacks. Over a defined period the bank re-examines every client file, checks client details again, files suspicious activity reports (the US term) and closes suspicious accounts where needed.

The main lesson is to take regulatory findings seriously and early. Large fines follow years of accumulated failings and delay. Change is uncomfortable, so firms tend to postpone acting on findings until the last moment, and at USAA that proved too late. AML and fraud risk management keep evolving with the external environment, as fraudsters exploit each new business and economic setting, and banks on the front line must keep adapting their control frameworks to match.