December 28, 2016
Happy New Year (a bit early)! 2016 was quite an exciting and busy year with many personal and professional transitions that left little time for blogging. However, I’m back with insights as the financial services and authorities work throughout 2017 to implement the AML/CTF and data protection legislation and agreements for 2018.
Before I discuss recent developments in the field, I’d like to comment on the release of my SWIFT Institute-sponsored paper on US-EU AML/CTF & Privacy for Multinational Banks,* which was published in August (download here). The Institute also invited me to speak about it at Sibos in Geneva, Switzerland in September (download slides here).
My experience with the Institute has been fantastic. A sincere thank you to Peter Ware and Nancy Murphy for their kindness, professionalism, and support for independent research that allows academics to reach practitioners with meaningful analysis.**
19 AML/CTF & Data Privacy Compliance Conflicts Graphic from the Paper (Caution: Not as Impressive as SWIFT’s interactive graphic!)
I highly recommend that you visit the Institute’s fabulous interactive graphic for an overview of the 19 compliance conflicts (view here).
Don’t forget to read the last section of the paper that covers Profiling! It lives in all 19 issues and impacts every single AML/CTF compliance function.
About the paper:
The paper is a primer for financial institutions and policy-makers to identify 19 legal conflicts that may affect a multinational’s ability to comply with the AML/CTF and privacy regimes. I hope that this information enables private actors to understand how their internal processes may expose them to regulatory risk; for public actors, I hope it provides a better understanding of the challenges the private sector faces in multi-jurisdictional compliance, but especially how these issues affect the quality of data that private corporations ultimately provide to authorities to achieve the end goal – combating financial crime and political violence.
As one can imagine, there was not enough space for an analysis of all the dimensions or actors involved, so a few things to note;
- The US Terrorist Financing Tracking Program (TFTP) demands a paper of its own due to developments regarding the development of an EU TFTS.
- I shelved an anonymous AML/CTF & Privacy survey due to an insufficient data sample. I will conduct the survey again, but the preliminary results demonstrated a clear US and EU divide. Respondents did highlight AML/CTF and data protection concerns when dealing with high risk third country areas.
- Section 3.2 on Public-Private cooperation could have been a paper onto itself (and may appear as a forthcoming chapter). Multinationals face tough decisions when they operate in multiple countries where they must comply with data requests from authorities.
Despite the difficulties ahead, in the paper’s conclusions, I state that the financial services should be acting now to align their data protection obligations in 4AMLD to the GDPR.
4AMLD and the GDPR consistently refer to ‘safeguards’ for data processing, but these safeguards are ultimately left up to EU Member State law, so the diversity among EU Member State law will continue. The GDPR formally calls for cooperation among industry associations to formulate “codes of conduct” to set the technical and organizational standards outlined in the Regulation. Article 38 (40 and 41 in final version) outlines the codes’ provisions, which are broad enough to accommodate compliance’s risk-based regime, including secure systems and fair and transparent data processing for legitimate interests.
The private sector should work with Member States to create AML/CTF & privacy-centric ‘codes of conduct’ that harmonize with these developing national safeguards .
I’ll be posting updates on those efforts as I become aware of them.
Have a healthy and safe 2017!
Want to learn more? Join me on 22 February 2017 for a webinar on Nomoneylaundering.com
NOTE: Paper referrals to EU legislation predate the final version of the GDPR and the articles and recitals may have changed. The text is the same and thus the analysis has not been impacted.
**This blog represents my personal opinions and does not represent LexisNexis Risk Solutions. My research is my personal intellectual property and has been in no way influenced by any member of the financial services community or by government officials.