Kyriacos Latzias

Last month July, FATF published the "Horizontal Review of Gatekeepers' Technical Compliance Related to Corruption" "On the surface, the Horizontal Review shows positive results - over half of FATF members have scores over 80%. However, these results are less promising when one considers the context and materiality of the seven FATF members falling below the score of 50%. These jurisdictions represent more than half of the world’s GDP. Although it is a common perception that the legal profession is subject to fewer AML/CFT rules than other gatekeeper sectors, the Horizontal Review found little difference in coverage scores of the four gatekeeper sectors under the scope of the review - lawyers, accountants, trust and company service providers, and real estate agents. " https://lnkd.in/gughnXRf. Alex Oxford Muse Zhou Bryan A. Cheung☁️ JOHN P KAKKATTIL

7

1 Comment

The SRA has just issued fresh Guidance for those facing an Inspection. We have added it to our blog with info about SRA audits or inspections: https://lnkd.in/dM2i_wVk This could be AML, thematic review like Probate or Sanctions compliance. Hope this is of help! #SRA #AML #Audit #lawfirm #legalprofession

8

5 Comments

Audit Scotland has reported a substantial increase in the value of #fraud and payment #errors detected through a biennial #data matching exercise under the country’s National Fraud Initiative - it reports fraud and error matches worth an estimated £21.5m were identified in 2022-23, up from £14.9m in 2020-21. While it is not clear whether the underlying levels of fraud have increased, key messages of the report are that the NFI is vitally important to public sector financial management and that for most participating organisations the governance and follow-up arrangements have been sound. https://lnkd.in/eFi73CAn

1

This is a great framework for firms to be aware of how operational resilience is managed across the UK financial sector. #CMORG #SRF #OpRes #OpertionalResilience #SectorResilience

15

🔓🔓 "Ransomware continues to be the most acute and pervasive cyber threat for UK businesses and organisations" 🔓🔓 - Anne Keast-Butler, Director GCHQ 2024 Norman Broadbent is hosting a breakfast on the 25th June for Chief Risk Officers and senior 2nd Line Risk Practitioners focusing on the Cyber Risk threat. If you are interested in attending this event, or wish to be advised of future events, please do drop me a note. Norman Broadbent Plc #cyberrisk #risk #banking #wealthmanagement #privatebanking #cybersecurity #retailbanking #GRC #assetmanagement #technologyrisk #fintech

30

1 Comment

Covering the exposed: The effects of the FCA’s PEP review on financial compliance This month, the Financial Conduct Authority (FCA) will release its review on the treatment of politically exposed persons (PEPs), as required by the Financial Services and Markets Act 2023. Financial firms must enhance due diligence for PEPs, who are at higher risk for corruption. The review highlights the need for financial institutions to balance strict compliance with fair access to services, utilizing advanced technology for effective PEP management amidst an evolving regulatory environment. Read more 👇 https://okt.to/dG8g2N #Fintech #financial #technology #compliance

3

Looking forward to speaking on the EY webinar tomorrow Tue 11 June and bringing the Wealth and Asset Management angle to the discussion. Do sign up via the link in Heather's post below. #assetmanagement #consumerduty #wealthmanagement

15

Compliance consultants beware the peril of negative assurance. There may be no better example than how the interim report by forensic investigation company, Second Sight, ended up being taken out of context by managers at the UK Post Office in what has now been acknowledged by the UK Government as the 'greatest miscarriage of justice'. For those unfamiliar with this issue and not - like me - glued to the unfolding public inquiry, this stems from a decades-long practice where the Government-owned Post Office prosecuted approximately 1000 of its own postmasters; local citizens who run individual village-level post offices. The charges were theft and false accounting based on 'shortfalls' showing up on the newly-installed Horizon accounting software. Many postmasters had questioned the reliability of the system now known to have been seriously infected with bugs, errors and defects for creating fictitious 'shortfalls' but they were rarely believed. Postmasters were prosecuted, jailed and forced to 'repay' tens of thousands of pounds they never owed. Many were bankrupted. At least three took their own lives. The forensic investigators hired by the Post Office made several preliminary conclusions in July 2013, the first of which was that: "We have so far found no evidence of system wide (systemic) problems with the Horizon software". This statement appeared because it was part of the specific terms of reference for the report. According to evidence given by Post Office managers to the ongoing public inquiry, this phrase was repeatedly used by Post Office managers to justify continued resistance to re-assessing past prosecutions of postmasters even as evidence of system issues mounted. Neither the caveats made in Second Sight's interim report ("there is still much work to be done...") nor the description of at least three errors and several other "shortcomings" reported by Second Sight appears to have had anywhere near the impact of this negative assurance statement. Second Sight's final report would, in fact, suggest that there was a real possibility of unsafe prosecutions. The takeaway - consultants beware. Readers - especially when they buy the service - will take from it what they want.

23

10 Comments

Last week, the FCA published key insights and observations for firms preparing to comply with operational resilience rules by 31 March 2025. Articles like this provide helpful insights into what good (and bad) looks like in the regulator's eyes and where their focus will be for supervisory engagement following the transition period. A few messages that stood out for me: - The FCA has noted that the most effective operational resilience frameworks were embedded within firms' overall enterprise-wide risk frameworks. Even if the initial operational resilience framework implemented was largely standalone, integration with the ERM framework should be considered as the next step in evolution and maturity. - The impact tolerances set for an important business service must align with those of the third-party service providers supporting that service. These tolerances should be enforced through third-party contracts and service level agreements and validated through due diligence and scenario testing. - In line with the FCA's new 'not a once and done' approach, being able to demonstrate continuous improvement and evolution of operational resilience is important. It is a key question for the board to reflect on when reviewing and approving the annual self-assessment. - Response plans are equally important as recovery plans. The FCA has emphasised the difference between the two and wants to see more testing of response plans. - Having processes and controls alone is not sufficient to demonstrate operational resilience. Ultimately, it needs to be substantiated with appropriate scenario testing. Since we have been focusing more on DORA in the last few months, this was another reminder of the fundamental differences between the UK and European regimes. While DORA and the subsequent Level II texts go into incredible detail on policies, procedures, and frameworks required to ensure digital operational resilience, they are very light on setting the foundations when defining critical functions and determining impact (risk) tolerances. Therefore, adopting those concepts from the UK regime would help firms design a stronger framework for DORA implementation, especially for those that operate across the UK and Europe. #operationalresilience #DORA #AshurstRiskAdvisory

41

CPS230 requires APRA regulated entities to uplift operational risk management. 3rd and 4th party service providers will also feel the impact. Planning and pragmatism are essential to ensure a measured and focussed uplift occurs. We covered this in our recent webinar, watch the replay below or reach out to discuss.

16

1 Comment

Thanks for the mention Michael Grimwade. Highly recommend your book - "Ten Laws of Operational Risk". This is a brilliant read for people in ERM / Operational Risk domain. Michael Grimwade is a highly respected expert in the field of Op Risk who has developed some ground breaking frameworks in this risk domain. Ten laws of Operational Risk summarised as a theme throughout Grimwade's book as follows: 1. **Occurrence**: Operational risks arise mainly from human errors, misconduct, or malicious acts influenced by internal and external factors. 2. **Detection**: The frequency of reported operational risks depends on detection controls. Improved detection may increase reports temporarily, while weak detection misses actual events. 3. **Velocity**: The speed at which losses occur from operational risks is influenced by the severity and rapidity of the causes and impacts. 4. **Duration and severity**: The impact of an incident depends on its severity and how quickly it is detected and mitigated. 5. **Lags in settlement**: There are often delays between detecting and resolving operational risk events due to regulatory and economic factors. 6. **Concentration due to internal drivers**: Specific internal factors lead to the concentration of operational risk events in certain areas within firms. 7. **Concentration due to external drivers**: External factors like economic cycles contribute to the concentration of operational risk events. 8. **Risk Homeostasis**: Firms adjust their control spending over time to balance expected operational risk with their risk appetite. 9. **Risk transference, transformation, and conservation**: Operational risks can be transferred or transformed through mechanisms like securitizations, reducing the likelihood of losses. 10. **Active and passive risk taking**: Firms take operational risks both proactively (for income) and passively (as a by-product of activities), with proactive risk-taking being disproportionately risky. https://lnkd.in/di8trDEp

145

1 Comment

Target Professional Services (UK) Ltd mypensionID Have both and individually achieved UKGDPR Certification. It is disappointing that only 39 companies in the U.K. have recognised the importance of taking the lead in Data Privacy & Protection and are able to evidence that they are externally audited to this high standard annually. Perhaps Risk & Compliance professionals have just not heard of it. Perhaps that goes for the U.K. Digital Identity & Attributes Trust Framework and GPG45? The fact is we will all be hearing about it more and more, especially since the new government has committed to building on the work of DSIT to enable both citizens and the economy to enjoy the benefits of re-usable interoperable digital identity world wide.

2

"The need for better data quality and connectivity is a long-standing issue in the anti-financial crime community." SymphonyAI's latest blog on trends in anti-financial crime 2024 , by Charmian Simmons. An important evolution in generative AI adoption in 2024 is the shift towards verticalized large language models (LLMs) which are tailored for specific industries or use cases like AML and fraud management, enhancing the efficiency and effectiveness of AI applications at the enterprise level. Use case - The integration of gen AI copilot technology using verticalized LLMs will significantly enhance productivity and efficiency by expediting data retrieval and analysis processes, particularly in areas like financial crime investigations, streamlining tasks for investigators and facilitating quicker case file completion. #financialcrime #moneylaundering #fraud #cybercrime #dataanalytics #llm #chatgpt #ai #genai

8

Question for my network, what / if any training courses are there for getting someone up to speed on carrying out due diligence / risk assessments on financial organisations? Things like understanding sanctions, UBO risks, suscept business locations / registrations etc etc I have a list of things i look for but I want to get a colleague trained up, any suggestions?

18

6 Comments

Women in Governance, Risk and Compliance Series and GRC World Forums thanks for the fancy banner ⭐ The #RISK awards are getting closer and what a category to be included in with so many talented women ⭐ #WGRC #womenincompliance #compliance #riskmanagement

43

2 Comments

Accountability Sink - that's a new phrase on me but one that resonated at the weekend after our webinar. We have all been there - something needs to be fixed, someone has to make a decision but no one believes they are empowered to do so (or more to the point, they don't want to be blamed when it goes wrong). Have a read at https://on.ft.com/3KJgUzN though I have to admit that I don't believe feedback is the answer... Consumer duty together with SMR to me helps mitigate this in Financial Services firms in the UK as firms will need to clear on who is accountable. And then we can figure out how to address it across UK PLC... #accountability #SMR #SMCR #ConsumerDuty #financialservices Financial Times Tim Harford

5

As the deadline for the first UK FCA consumer duty Board reports approaches (July 2024) it was great to gain some additional insight into what the FCA expects at this seminar #fca #consumerduty #boardreporting #consumerprotection #governance #goodoutcomes #cpd

18

Compliance costs of #financialcrime are impacting mid-tier financial services firms in the UK more significantly than larger organizations. Smaller firms lack economies of scale, making compliance costs proportionally higher relative to their revenues. For these firms, financial crime compliance costs can be as high as 2% of total revenue, while for larger firms, it's less than 0.5%. Regulatory requirements are also tougher to meet for smaller firms due to their size and resources, affecting their profit margins more than larger firms. Coforge provides specialized expertise to make financial crime and compliance processes more efficient and effective. - By automating Customer Due Diligence (#CDD) processes, we help firms further increase efficiency and reduce manual effort. - Our #Quasar GenAI platform leveraging Artificial Intelligence (AI) and machine learning helps handle larger volumes and improve financial crime detection and prevention. - #Orchestrationplatforms to integrate fraud and AML functions, providing for end-to-end solutions, streamline operations and improve risk management. - Strategically sourcing #FCC processes to locations with the optimal balance of cost, quality, and regulatory compliance can reduce compliance costs while providing specialized compliance expertise and flexibility to scale compliance operations up or down as needed. #Coforge #AML #KYC #IDV #FCC #compliancecosts #financialservices #generativeai

23

Good security starts with awareness that is tailored and relevant. The General Code and Cyber Guidance from TPR sets the expectations and requirements for Trustees. It is important these are understood in practical terms.

5