Business Process Management: Tackling Fraud, AML and Compliance
The world has changed over the past decade. The proliferation of communications channels has made available new opportunities for criminals to pump their illegal funds back into the system. The emergence of electronic forms of communication, such as the Internet, has made it easier for such criminal activity to take place. Today’s banking and financial services marketplace, like many other sectors, now faces unprecedented generic and industry-specific regulatory pressures, designed to protect vendors and customers alike from unfair and unscrupulous activity.
As the economic environment changes at an ever-faster pace, so criminal activity refocuses itself. So, for example, a by-product of the property boom in the UK and US has been an increase in fraud in the consumer loans and mortgages arena. And, in turn, financial scandals and fraudulent activity at both a corporate and individual level have forced the regulators to step in and introduce new measures to protect shareholders, companies and customers.
The net result of all this has been to increase the level of risk management and regulatory reporting by ensuring a greater degree of transparency and control within the business.
From a business perspective, we have seen a great deal of momentum in recent years around monitoring for compliance, money laundering and other risk events. New technologies have been developed and existing solutions fine-tuned to identify such risk points and as a result, businesses are being empowered with the ability to identify potential criminal activity at an unprecedented level of resolution.
However, this very success has presented a new challenge – namely, how to efficiently qualify these newly identified alerts without disrupting the business. In the US, for example, an increase of more than 25% a year in the number of potentially suspect events identified over the past decade is now putting pressure on the back office risk operations, fraud investigations and anti-money laundering teams to manage and process these appropriately and weed out the genuine errors from more questionable activity. For each suspicious activity report that is ultimately filed therefore, there may be two to three times that number of alerts that have been qualified, dispositioned, and validated – with substantial growth in the numbers dealt with at each stage of the process.
In short, though banks may be getting smarter at identifying risk, this is now negatively affecting their ability to maximise loss avoidance, hurting operational efficiency and increasing cost in the back office.
Even more disturbing: the impact of fraud, AML and other compliance activities often extends beyond the back-office to affect deals with new customers, for example. There is an overriding commercial imperative to bring new clients on board faster, yet the level of due diligence, back-checking and validation is in fact slowing down the process of new customer acquisition and revenue generation. So while rigor and consistency upfront helps protect against potential criminal activity, efficiency accelerates revenue generation.
In order to ensure compliance and risk management, banks and other financial institutions have been primarily concerned with detection up until now. The key issue therefore has been to identify the problem, which has been different in each case, depending on the channel, product or line of business. In response, over time vendors have come to the market with advanced, specialised knowledge of how to detect individual crimes in each area, offering essentially proprietary solutions targeted at individual activities such as illegal wire transfers or credit card fraud.
The core competency of each solution therefore – and each vendor – has been its detection capability. Though each may have some form of case management or investigation functionality on the back end, this is typically a secondary, and inherently more rudimentary, ‘bolt on’ to the specialised detection engine.
In order to improve the speed, efficiency and accuracy of the whole process therefore, what is required is a single, centralised and automated case management and investigation capability which is able to take and manage feeds and inputs from disparate, specialised detection engines.
This offers a number of benefits:
Today, we have cutting-edge detection systems capable of flushing out sophisticated fraudsters at the touch point of the business. Until recently, the follow-up has been more fractured and essentially manual in operation, yet it is now possible to install an enterprise-wide case management platform that can also rapidly be adapted to the new – and as yet unknown – frauds of tomorrow.
As a result, it is now possible to seize these different suspicious events and enter them onto a centralised depository. The enterprise investigation backbone then enables the relevant staff to gain a holistic view of the suspicious activity, work the case and determine the appropriate action.
With the previously manual case management and investigation system, one of the pain points banks have had to address has been at what level to set the detection filter. Set it too low and the bank runs the risk of failing to meet both regulatory and internal risk management imperatives; but set it too high and the investigation teams cannot scale, becoming overwhelmed with the number of events to be processed. And this becomes more important as the level and pace of change in the pattern of criminal activity increases.
Another problem has been the complexity of the investigation process itself. Following preliminary data re-entry and first-line review, the event will be pushed through to risk investigators who will examine the transaction history, talk to the relevant relationship manager or branch, and retrieve information from other systems across the organisation, in order to make an assessment.
By contrast, by automating much of this time-consuming, multi-phase data entry and record retrieval – and applying business rules to each stage of decision-making – this enables the business to scale more effectively, by freeing up the investigator’s time to undertake more value-added activity.
The best of today’s automated systems incorporate a number of key elements designed to support each step of the case management and investigation process. First, the infrastructure must be able to capture the event data and create a virtual folder which, unlike a document management approach, effectively digitises the case and enables it to be pushed automatically across the enterprise.
Once the event is in the system it can then be enriched by secondary and tertiary data, as the virtual case folder is populated and built up with information relevant to that event from other data sources across the enterprise.
On completion, business decisions can then be applied – in effect, a second level application of business rules, now that more information has been made available. With the benefit of powerful rules technologies, many decisions can be taken automatically at this stage, de-duping and removing those events, which are deemed to be acceptable.
The next step in the case management process is to get the event to the right investigator with the appropriate level of urgency. Thus, a high-value event in a high-risk environment from a high-risk country and for a high-value client will be automatically pushed through as top priority – and flagged up if this is not achieved within pre-set timescales.
The investigation’s backbone will then support the investigator in each case with a full set of screens, data and functions, to facilitate a fast and accurate analysis, including links to other potentially related events, for example demonstrating common country of origin, customer or event type. All the necessary subsequent back-office administrative work can similarly be undertaken automatically and the complete end-to-end process wrapped around with a full set of forensic-quality audit controls.
Investigations typically take some time to complete and individual investigators will have a number of cases underway at any one time. As part of a service level agreement (SLA) therefore, the case management solution will manage the caseload in order to ensure that time constraints in reporting to the relevant regulatory body are strictly adhered to.
Finally, it has to be recognised that all this takes place in a highly dynamic financial environment, in which regulatory pressures and criminal threats are constantly evolving. By adopting a ‘build for change’ rules-based approach to case management and investigations, banks and financial institutions will also retain the essential agility to respond rapidly to new external developments, both known and unknown. As ever, the successful business is that which is one step ahead, and not one step behind.