Money laundering supervision: focus on money laundering risk analysis and complex structures (2023)
In the course of its on-site supervisory reviews, FINMA revealed shortcomings in the area of money laundering risk analyses. It used this as an opportunity to review the risk analyses at more than 30 banks in spring 2023. It emerged that a large number of the risk analyses reviewed did not meet the principal requirements (see chart below). In particular, in some cases there was no adequate definition of the money laundering risk tolerance, which forms the limiting framework for robust risk analyses by means of defined limits. Various structural elements that a risk analysis requires were also missing.
Money laundering risk analysis is a key tool in the strategic management of banks and other financial intermediaries. They use it to identify and mitigate money laundering risks and define the risk criteria relevant to the financial institution’s activities. Money laundering risk analysis additionally determines which money laundering risks do not match the institution’s risk tolerance.
FINMA released its Guidance on money laundering risk analysis on 24 August 2023. This created transparency regarding its observations and experiences from its supervisory practice.
FINMA’s initiative in this area is designed in particular to
positively influence risk management at banks by clearly defining risk tolerance and eliminating very high risks or mitigating them with sufficient compliance measures and resources;
clarify the responsibility of the most senior management bodies in determining risk tolerance (“tone from the top”);
improve the quality of risk analysis so that it constitutes an effective control instrument for the most senior management bodies.
On-site supervisory reviews: supervised institutions with complex structures
Complex structures can facilitate money laundering. FINMA examined the way in which complex structures are managed during on-site supervisory reviews in 2023 and demanded corrective measures.
Weaknesses in the documentation of the reasons why a domiciliary company is used in accordance with the FINMA Anti-Money Laundering Ordinance (Art. 9a AMLO-FINMA) were frequently identified in the area of complex structures. However, being able to document these reasons is key to recognising a risky structure under money laundering legislation at an early stage, such as frequent transfers between various accounts
In particular, some of the institutions reviewed did not provide a sufficient description of the expected transactions within a particular structure that would reveal unusual movements, or no comparisons were made between the transactions actually executed and the documented transaction pattern expected by the institution. FINMA required the institutions to rectify these shortcomings.
The way in which warnings are dealt with in transaction monitoring must be improved
When it comes to transaction monitoring, FINMA found during its on-site supervisory reviews that some institutions leave inappropriately long periods of approximately 60 days before they perform their initial analysis of transaction alerts, and do not apply a risk-based approach to managing these alerts. FINMA expects institutions to perform an initial analysis of transaction alerts promptly. If increased risks are subsequently identified, clarification of the economic background must be initiated without undue delay (Art. 20 para. 3 AMLO-FINMA in conjunction with Art. 17 AMLO-FINMA). The institutions must define appropriate deadlines for initial analysis and establish a process to ensure that the defined deadlines are met.
Group money laundering supervision at insurance companies: due diligence requirements often not met
In 2023, FINMA also performed on-site supervisory reviews as part of its group money laundering supervision at insurance companies (Arts. 5–6 AMLO-FINMA) that are subject to its consolidated money laundering supervision.
In the course of the on-site supervisory reviews, a considerable need for improvement in core areas of anti-money laundering due diligence was identified at many institutions. Specifically, the risk classification of business relationships and transactions and their ongoing monitoring were not harmonised at the foreign entities. As a result, there was no effective global monitoring of money laundering risks. On various occasions, the classification of high-risk business relationships and transactions was not sufficiently risk-based in the group standards, and in some cases was inconsistently defined or not defined clearly enough. There were also gaps in the reporting of high-risk business relationships and transactions to the group. For instance, some institutions had not defined thresholds as of when a transaction had to be reported to the group, and the deadlines for the corresponding reports were not always adequately defined. There was also a need for action at several institutions when it came to the regular reviewing and updating of client data, as well as in the case of internal controls to establish whether the foreign entities were complying with group standards on consolidated anti-money laundering supervision. FINMA demanded corresponding improvements.
(From the Annual Report 2023)
