Risk-based approach Briefing to AML Seminar 10 May 2011 Paul de Weerd Financial Supervision Commission

Session Objectives Briefing on: Feedback from CSP/TSP visits Approaches to implementing the risk- based approach

Overview Four themes: Preparation Risks specific to the business Client risks Monitoring and review

AML/CFT risk v. other risks The AML risk rating under the Code is distinct from financial, legal, regulatory etc. risks under rule 8.6 The two can draw different conclusions, e.g. on unmanaged business

Part 1 - preparation: review typologies Available online through FATF

Risk rating Ratings and how to apply them should be understood by staff Ideally, simple, consistent and easy to apply Targeted and relevant

Part 2: Identify the specific risks for your own business Typologies provide examples not answers Consider: Types of business undertaken Sources of business

Identify the risks in business acceptance Core part of addressing risk First line of defence Reliance on others? Structured approach

Identify control risks Lack of control over client entities and reliance on third parties Registered office or registered agent only and “Split” boards Powers of attorney

Record your actions What the risk is Mitigation or controls to be applied Action plan

Part 3: Risk assessment of clients Identify client-specific risks Apply additional safeguards to PEPS and other higher-risk clients

Develop a recording mechanism Develop and apply a suitable mechanism for recording your view of client risks Allow for different grades of risk Record additional steps taken Understood and used by staff

Part 4: Monitoring and review To make the process work in practice Monitoring of client relationships Review cycle

Monitoring Effective monitoring is essential Review cycle(s) Update ratings for new information Sign and date Track action points

Effective review procedures Part of corporate governance and effective oversight: Learn from experience Update both licenceholder risks and client risks