What will keep chief risk officers and compliance leaders up at night this year?

Bank Automation News spoke with current and former risk officers, and compliance vendors about the risks banks face in the coming year and the role automation will play in managing them. Their concerns include cybersecurity, managing sanction lists and preventing money laundering.

In an ever-expanding regulatory environment coupled with the recent rise in cyberattacks, risk leaders fear missing something important; they and their organizations are exposed if they miss a vulnerability, a trend in transactions, or a sanctioned individual — like a criminal or terrorist — uses their bank for money laundering.

“Ultimately, what keeps you up at night is missing something,” said Adam McLaughlin, a former compliance manager within the anti-money laundering (AML) line of business at JPMorgan in London. “It tarnishes your name as an organization, that you’ve allowed criminals within your organization,” McLaughlin said. “The regulators will come down quite heavy on you for facilitating money laundering or allowing a sanctioned individual to transact through your organization.”

Chief risk officers also face personal liability, added McLaughlin, who is now global head of financial crime strategy & AML at Nice Actimize, an anti-money laundering and fraud solution provider. The company has raised $24 million in funding over three rounds, according to Crunchbase.

“You are personally liable if something goes wrong, especially if it’s found out that it was negligence,” McLaughlin said. “So, if you were negligent, and you didn’t have the right procedures or the right systems in place, and you should, by a reasonable standard, have identified this individual early, but you didn’t, then potentially you can face prosecution as well,” he added.

Cyberattacks surge during pandemic

Cybersecurity is a growing concern for banks, particularly since the pandemic has led to a surge in attacks. This week, the New York State Department of Financial Services (DFS) issued a fraud alert to regulated organizations, warning of a widespread crime campaign to steal consumers’ nonpublic information (NPI) from public-facing websites that transmit or display redacted NPI and use the information to fraudulently apply for pandemic and unemployment benefits. While the reported attacks were on auto insurance rate quotes, the breach is just one example of the increasingly sophisticated and widespread attacks financial institutions face.

Protecting her institution against cyberattacks is the top concern for Lynn Tillman-Cherry, chief risk officer at Greenwood, a brand-new digital mobile bank that plans to open to 525,000 wait-listed customers this summer. The bank, which markets to Black and Latino customers, formed in 2020 and has raised $3 million in one funding round, Crunchbase reports. Tillman-Cherry is in the unique position of being able to build her risk organization from the ground up, and worries that a cybersecurity event could tarnish the fledgling bank’s reputation.

“The biggest thing for me is just the change that we’ve seen throughout the COVID era with the cybersecurity — the repeated attacks on different financial institutions — and how that is going to continue in the long term,” said Tillman-Cherry, who previously served as chief compliance officer for Atlanta, Ga.-based fintech Brightwell, which specializes in global payments and secure money transfers. “It is not going to end when COVID is officially over,” she said.

Since Greenwood is digital and has no legacy systems to contend with, it’s highly automated, Tillman-Cherry said, adding that her focus is automating for better efficiencies. For security, the bank has risk-based authentication built into the flow of its mobile app, as well as fraud detection and prevention measures, such as automated alerts to customers. The alerts can warn of a potential incident or simply remind customers to check their transactions for fraudulent charges.

Managing lists and risks

All banks have a list of screening obligations for onboarding new customers, particularly to assess the risk of the customer. Those obligations can include the requirements of Know Your Customer (KYC) and politically exposed person (PEP) screening, and adverse media screening, which can help reduce reputational risk.

The challenge is to comply with sanction lists and regulations without onerously slowing down customer onboarding, said David Loeser, senior director of product strategy for Accuity. The company provides regulatory and sanctions compliance solutions for financial institutions, and was acquired today by global data analytics provider LexisNexis Risk Solutions.

“It’s all about reducing that time it takes to manage the screening process,” Loeser said. This includes, “how long it takes from when a relationship is started with a potential customer or transaction that comes through the door, how long it takes to assess the risk of that particular relationship, transaction, trade, whatever they may be screening,” he added.

“The number of lists that our customers have to train against is growing; their volumes of source data that they have to screen are growing; the size of those lists is growing,” Loeser said.

While automation of those comparisons is a matter of using a simple rules-based process, it can also lead to a potential problem: false positives. Currently, without AI, false positives must be handled manually.

“Compliance teams suffer from limitations in their ability to trace and explain the compliance controls their teams have in place, since they often use manual compliance-monitoring processes, and need to allocate a significant amount of human capital and time toward remediating alerts,” said Leslie Bailey, vice president of financial crime compliance strategy at data and analytics company LexisNexis Risk Solutions.

Often, compliance teams struggle to justify their screening outcomes if regulators come calling, said Bailey. This can lead to questions about whether teams have successfully mitigated the risk associated with higher-risk customers.

Smarter automation can help solve this problem. For instance, machine learning models that leverage additional data and metadata — name, date of birth, address and other details — can determine whether a hit in the screening process is a true match, Loeser said.

Bailey agrees, saying automation is key to improving how risk managers can balance risk with the digital experience. “Banks and financial institutions that employ automated regulatory compliance solutions are able to better tackle compliance challenges with increased efficiency, effectiveness and explainability,” she said.

Monitoring transactions

Beyond onboarding, banks rely on automated systems to monitor transactions for money laundering. Transactions must be monitored to comply with the Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) guidelines, which require financial institutions to assist the U.S. government in detecting and preventing money laundering, as well as Combating the Finance of Terrorism (CFT) requirements.

The list of regulations outlined in the Federal Financial Institutions Examination Council’s (FFIEC) BSA/AML manual alone has more than 500 pages of guidance and regulations, said Andrew Stines, chief risk officer at the $1.77 billion Coastal Community Bank in Everett, Wash.

Stines formerly spent eight years at the consulting, assurance, tax and transaction services firm EY, where he helped banks revamp their regulatory programs after running afoul of regulations, such as receiving a consent order for a BSA violation. A consent order has the same effect as a court order and can be enforced by the court if a company does not comply with it.

The BSA requires banks to file a suspicious activity report (SAR) with the Financial Crimes Enforcement Network (FinCen) within 30 days from the point of determining there was suspicious behavior. It’s a regulation that has led to major investigations and broken up crime rings, Stines said, adding that lawmakers on both sides of the political aisle take BSA enforcement seriously.

In a BAN podcast this week, Stines outlined where banks go wrong with BSA programs. One problem is that banks don’t always use their automated technology correctly, which can get them in trouble with regulators, he noted. “They’re not getting that model tested by an independent outside party,” Stines said. “Often, if they fail to do that, they find out that their model wasn’t working at all a year later, and they’ve missed all kinds of unusual activity. Therefore, they have a SAR violation.”

Often, detecting problematic transactions relies on a rules-based system, but banks like Coastal Community are increasingly augmenting this process with machine learning and AI. Stine said this allows banks to identify more complex behavior patterns and notice unusual — and potentially criminal — behavior sooner.

Augmenting automation

False positives are also a challenge for detecting problematic transactions, said Guy Cope, product manager for anti-money laundering, transaction monitoring and machine learning at Computer Services, Inc. (CSI). Paducah, Ky.-based CSI provides end-to-end fintech and reg-tech solutions. Cope is currently developing a product that will assist with transaction monitoring for AML. He also predicted a movement away from rules-based systems toward machine learning solutions, which allow even false positives to help a system become more effective as they are fed back into the system.

“The goal is as we move away from learning rules into machine learning models, which require data, we can actually use that to make it more effective over time,” Cope said. “I would call it a combination of automation and augmentation, where you have automation to help you make decisions faster, while also providing more information for your personnel or investigators, so they can make better decisions and augment those.”

Greenwood bank will launch this summer with a rules-based system and plans to scale to artificial intelligence and machine learning. Tillman-Cherry estimates it will take about three months from launch to gather enough information for those models, which she hopes will automate some of the monitoring.

“We have built our products and built all the integrations that we have done, take into account that at some point in the future, we will need to leverage machine learning and AI, because you can only write so many rules to do things,” Tillman-Cherry said.

Bank Automation Ignite, on April 13-14, is the event for inspiring automation initiatives and investment in financial services. At the virtual event, financial services professionals can discover new use cases and technologies that are accelerating automation in banking. Learn more and register at www.BankAutomationIgnite.com.