One of the great bugbears of Know Your Customer (“KYC”) is checking whether a potential customer is associated with any negative reporting in the media. On the face of it, this would seem to be fairly straightforward: check whether any court decisions have been published stating that your customer, their owners or controllers, had been found guilty of a criminal offence and if nothing exists, job done.
Not so fast.
The last few years have seen countless cases where “bad news” was published about a customer went unseen by a business. The question would always be asked: How could you have not known? It was there in the news!
And so, for several years now, businesses required to comply with Anti Money Laundering/ Combating the Finance of Terrorism (“AML/CFT”) regulations have been trying to find ways in which to monitor the media and other sources of information in an attempt to identify whether any of their customers has “broken bad” ( Apologies Jesse Pinkman). It’s also proven to be an essential element of mitigating reputation risk, scanning the media horizon for information that might prove detrimental to a business’s share value and corporate image.
Financial crime regulators have long expected regulated businesses to incorporate adverse media checks into as part of their KYC processes. But deciding what types of media to base those checks on is becoming ever more complicated.
In 2016, it was estimated there were 4.66 billion websites on the internet, with that number constantly fluctuating as sites become defunct and others are launched. Additionally, you have regulator websites, well known newspaper websites and advocacy research conducted by amazing groups such as the Organized Crime and Corruption Reporting Project and the International Consortium of Investigative Journalists, revealing nefarious financial criminals and their attempts to conceal their identities and activities.
Add to that the information on the deep web that includes that not indexed by well known search engines such as Google, social media websites, consumer blogs and other sources deliberately generating “fake news” to disparage political opponents, for example, and the simple task of an adverse media check becomes a whole lot more complicated.
The European Banking Authority (“EBA”) is currently consulting on the proposed revisions to the Risk Factor Guidelines, a set of guidance that accompanied the 4th Anti-Money Laundering Directive. These revisions are intended to supplement the changes introduced in the 5th Anti-Money Laundering Directive.
The guidance suggests that when deciding whether a source of adverse media about a customer is found, it should be assessed as to whether it is reliable and credible. Determining its credibility should be based on the quality and independence of the source of the information on which its based and the persistence with which they are reported, “among other considerations”.
The devil, as they say, is in the detail. The description makes clear that the onus is on a business to show how it determined and on what basis it decided whether to rely upon, or dismiss, adverse information about one of its customers. And one size may not fit all. While some jurisdictions may have great transparency and allow extensive reporting freedom, others may be run by government regimes who strictly control their media outlets. Businesses will also need to evidence how they decide whether a source of information is sufficiently “independent” and thus reliable.
The guidance also notes that it is not sufficient to dismiss adverse media on the basis that it is only an allegation of criminal wrongdoing – in other words, just because the customer is not yet convicted of a financial crime, will not be sufficient to dismiss those allegations of wrongdoing. They must be considered and decided whether they should be relied upon in deciding whether to start or continue a business relationship with a customer.
Acting on adverse media is now a tightrope walk for AML/CFT regulated businesses. Apply it too strictly and end up with customers who could commence legal action against them for denying them services based on unsubstantiated information. Apply it too loosely and end up undertaking business with customers involved directly or indirectly in financial crime.
It’s a highwire act that no regulated business can afford to get wrong. Time must be invested in strategising about both the criteria it will apply in selecting sources to rely upon and then how it will respond to the information contained within them.
The EBA’s consultation provides an opportunity for businesses to share with it the challenges they encounter in trying to undertake appropriate and effective adverse media checks and how these might be addressed through revision of the current wording in the Risk Factor Guidelines.
Want to learn more? Listen to our webinar discussing European Banking Authority’s (“EBA”) revised Risk Factor Guidelines: