Florida International Bankers Association · Florida International Bankers Association 2012 AML Conference ... Examples‐Merchant‐issued gift cards, prepaid long ... Multiple Accounts

1

Florida International Bankers Association

2012 AML Conference

AML Issues in Emerging Payment SystemsFebruary 23, 2012

Speakers

• Joseph Cachey, III, Senior Vice President, Western Union

• James Currie Senior VP BSA Compliance BBVAJames Currie, Senior VP, BSA Compliance, BBVA Compass

• Benjamin Floyd, Senior Director & AML Compliance Officer, Wal‐Mart

• Timothy P. Leary, Senior Special AML Examiner, Federal Reserve Board of Governors

• Malcolm Rowe, Director AML Technology, , gy,PriceWaterhouse Coopers

• Robert Rowe, VP & Senior Counsel, American Bankers Association (moderator)

2

Prepaid AML Typologies

AML Typologies Utilizing ‘Prepaid Access’

February, 2012

Malcolm RoweDirectorPwC Financial Services Regulatory Practiceg y

Prepaid Cards and Money Laundering ?• US National Drug Intelligence Center: “Prepaid stored value cards – a product experiencing explosive growth‐ provide an ideal money laundering instrument to anonymously move monies associated with all types of illicit activity, without fear of documentation, identification, law enforcement suspicion, or seizure. Therefore, it is very likely that drug traffickers and criminals alike are exploiting and will increasingly exploit the convenience and anonymity of prepaid stored valued cards to launder and move funds associated with their illicit enterprises”cards to launder and move funds associated with their illicit enterprises

‐ “Prepaid Cards a Potential Alternative to Traditional Money Laundering Methods”, US Dept of Justice, National Drug Intelligence Center, October 2006

• FATF: “Anonymity, high negotiability and utility of funds as well as global access to cash through ATMs are some of the major factors that can add to the attractiveness of NPMs for money launderers”

‐ “Money Laundering Using New Payment Methods”, October 2010

4

• FinCEN: “The proposed changes are intended to address regulatory gaps that have resulted from the proliferation of prepaid innovations over the last ten years and their increasing use as an accepted payment method. If these gaps are not addressed, there is increased potential for the use of prepaid access as a means for furthering money laundering, terrorist financing, and other illicit transactions through the financial system”

‐ “Prepaid Access ‐ Notice of Proposed Rule Making”, June 2010

3

Prepaid Cards – Two Main Types & CharacteristicsClosed Loop Open LoopLimited Purpose ‐ Closed system prepaid cards can be used for only a limited number of well‐defined purposes and their use is often restricted to specific points of sale or for specific services.

Broader Purpose ‐ Open‐system prepaid cards can be used across a broader range of locations for a wide range of purposes. May be used on national or international scale but may sometimes be restricted to a certain geographical area.

Examples ‐Merchant‐issued gift cards, prepaid long distance service, and mass transit system cards.

Examples ‐ Payroll cards & general purpose “cash cards” for individuals without bank account or credit card.

Limited Reloadability ‐ These cards may either be limited to the initial value posted to the card (non‐reloadable) or may allow the card holder to add value (up to a certain limit) and reuse the card (reloadable). The issuer of the card or its service provider typically operates the network on which the cards can be used.

Not limited to one person ‐Multipurpose cards may be used by the person who purchased the card or by someone else.

Can be Linked to an account ‐ The value on the cards generally is linked to a prepaid account established by

Not always linked to an account ‐ Some issuers do not require the cardholder to have a depository account

5

generally is linked to a prepaid account established by the issuer or service provider. Transactions are processed in a similar fashion to transactions involving debit or credit cards

require the cardholder to have a depository account. These cards are distributed by merchants, depository financial institutions, and money/value transfer (MVT) systems for a variety of purposes. Most are reloadable.

Link to payment networks – These are usually associated with a card payment network, such as Visa or MasterCard, which permits them to be used in same manner as a debit card to make purchases or to get cash from an automated teller machine (ATM).

Prepaid AML - Risk FactorsTypes of risk factors by category

1. Customer Due DiligenceAnonymity

Third Parties

Non Face to Face Contact

5. Geographical LimitsCross Border Functionality

Global ATM Access

Non Face to Face Contact

Verification of Customer Identification

Multiple Accounts

2. Record keepingCustomer

Account

Transaction Records

6. Usage LimitsUsage limits

Negotiability/Utility

Funds Withdrawal (ATM / Cash Back / IPS / Mobile to Prepaid

3. Value limits 7. Segmentation of services

6

3 a ue tsHigh / no limits

Jurisdictions

Seg e tat o o se cesUse of Agents

Multiple parties

4. Methods of fundingAnonymous Funding

Cash Funding

Indirect Funding

Digital Exchangers

4

Prepaid Typologies

Prepaid typologies can be broken down into 4 types:

• Third party funding

• Exploitation of the non‐face‐to‐face nature

• Complicit prepaid providers or their employees

• Cross‐border transport of prepaid cards

7

Prepaid Typologies / Cases

Case 1: Repatriation of drug sale proceeds from U. S. to Columbia

• In 2006 a Dallas‐based firm know as Virtual Money Inc, provided stored value cards to individual who then assisted a Columbian drug trafficking organization in moving more than $7 million to Columbia over a period oforganization in moving more than $7 million to Columbia over a period of three months. Colombia‐based accomplices later used the cards to withdraw pesos from ATMs in Medellin, Colombia. These cards were repeatedly refilled and then emptied.

• The President of Virtual Money Inc has been indicted though remains a fugitive.

Source: Associated Press

8

Typologies Utilized:

‐ Exploitation of the non‐face‐to‐face nature

‐ Cross‐border transport of prepaid cards

5

Case 2: Alleged Assassins Utilize Prepaid Cards

• In January 2010 a Hamas leader was assassinated in Dubai. It is alleged that the assassination was conducted by a team of up to 27 suspects who

l d d d f h d h ld h d


utilized prepaid cards to pay for their expenses and shield their identity. It is alleged that these pre‐paid cards were issued by a US Bank and were charged by the suspects through a NY based company.

Source: Various news articles

Typologies utilized:

‐ Third party funding

9


‐ Complicit prepaid providers or their employees


Case 3: Laundering illegal gambling proceeds via prepaid cards • In 2007, a number of defendants were charged with facilitating illegal gambling. The

organization involved onshore agents in the United States who recruited gamblers, collected losses, and distributed winnings, and an offshore organization that


operated an Internet site that processed bets and set odds.

• Among the methods used to transfer the illicit gambling proceeds between the onshore agents and offshore organizers was to open and load U.S. prepaid card accounts and then send the card information (card number, expiration date and card verification value) to the website operators. The cards themselves were not sent out of the country. Instead, the offshore organizers would use the card accounts to make online or phone‐based purchases. The online gambling operation earned about USD 100 000 a month.

10

Source: FATF




6

Case 4: Payment for drugs using prepaid cards

• In 2009, a number of defendants were charged with running a drug trafficking ring in a US federal prison and receiving payment outside the


trafficking ring in a US federal prison and receiving payment outside the prison through prepaid cards. Gang members outside the prison allegedly established prepaid card accounts in the names of the defendants, who allegedly instructed their customers — their fellow prisoners — to pay for the drugs by having family members outside the prison deposit payments into the defendants’ prepaid card accounts.

Source: FATF

T l i tili d

11


‐ Third party funding


References

1. “Prepaid Stored Value Cards: A Potential Alternative to Traditional Money Laundering Methods”, National Drug Intelligence Center, U.S. Department of Justice – October 31, 2006

2. “Report on New Payment Methods”, FATF – October 13, 2006p y , ,

3. “Money Laundering Risks of Prepaid Stored Value Cards”, Australian Institute of Criminology – September 2008

4. “Market Insight: The Outlook on Mobile Payment”, Gartner – May 10, 2010

5. “Prepaid Access ‐ FinCEN Notice of Proposed Rulemaking”, FinCEN – June 28, 2010

6. “Money Laundering Using New Payment Methods”, FATF – October 2010

12

7. "US and Mexican responses to Mexican drug trafficking organizations” – US Senate Caucus on international narcotics control, May 2011

8. “Prepaid Access – FinCEN Final Rule”, FinCEN – July 29, 2011

9. “Guidance on Prepaid and Stored Value Cards”, Wolfsberg Group – October 11, 2011

7

Prepaid Products

• Ben Floyd– Prepaid access from the provider/seller’s perspective

– Outline of the new prepaid access rule

Prepaid Products

James Currie Jr

SVP/Director of Bank Secrecy Act Compliance

BBVA Compass

Houston, Texas

8

Prepaid Access

• Closed‐ended: one‐time, non‐reloadable. Think: gift cards

• Open‐ended: reusable reloadable• Open‐ended: reusable, reloadable

• Closed‐Loop: open‐ended but usage limited to issuer. E.g. Walmart.

• Provider of Prepaid Access: Who Law Enforcement will request information from

• Seller of Prepaid Access: if non‐bank, now included as MSB

AML Risks

– Who owns the risk: Primarily the issuer/seller

– Placement: where is cash coming from for cash loads to– Placement: where is cash coming from for cash loads to open‐ended? (Consistent with expected normal behavior?)

– Layering: who really is in possession of card once issued? Where is card being used?

9

Who Gets the Card?

• Existing deposit customers (does this undermine debit and credit card product?)credit card product?)

• Non‐customers

– What do we know about them?

– CIP and Verification?

Limits

• Customer v Non‐customer

• Resident v Non‐Resident• Resident v Non‐Resident

• How many cards per customer? Per account? Per household?

• Max balance and load limits

• By load channel (cash, ACH, internal transfer)

• IMPORTANT: Can you really limit? Whose system enforces limits – in‐house or vendor? Are limits hard or soft? Real‐time or Lag?

10

Transaction Monitoring

• What do transactions look like in monitoring system – unique transaction codes?

• Can you differentiate between channels, e.g. cash load v ACH load or teller cash W/D v ATM?

• For non‐deposit customers, how do you conduct an investigation?

• Geography important: load at branch in State A followed quickly by W/D in State (or Country!) B?

Resources

• July 29, 2011 FinCEN Final Rule: Federal Register, Vol. 76, No. 146, pp 45403‐45420146, pp 45403 45420

• FinCEN Frequently Asked Questions for Prepaid Access final rule: http://www.fincen.gov/news_room/nr/html/20111102.html

11

BSA/AML Compliance Issues –Emerging Payment Systems

Timothy P. Leary

Senior Special AML Examiner

Board of Governors of the Federal Reserve System

hWashington, DC

Key Concepts

• BSA/AML compliance responsibilities attach to institutions (e.g., banks), not products.(e.g., banks), not products.

– Accurately assessing risk (e.g., due diligence, 3rd‐party relationships)

– Suspicious activity monitoring (“by, at, or through the bank”)

– OFAC

12

Assessing Risk

• As when introducing any new product, banks should ensure their risk assessment is updated to accurately

/reflect BSA/AML risks associated with a new payment system.– Existing or new customers?

– Online capabilities and non‐face to face transactions?

– Existing or new geographies?

3rd parties?– 3rd parties?

Assessing Risk

• Understand the specific product/program.– How will the bank and the partners manage the program?

– Responsibilities, checks, and controls.

– Usually contractual (pros and cons).

– How will the bank’s name be used?

– Who has what information?

– Who sets limits and who enforces them?

– Involvement of other third parties.

13

3rd Party Due Diligence

• Program Managers, Independent Sales Organizations, Agents, Marketers, Processors– Company reputation? References?

– Financial information, banking relationship

– Ownership, principals, structure, beneficial owners

– Location of operations? Web‐based? Site visit?

– Related parties? Other companies?

– Internet, open source information

– Who performs the due diligence?

– Limited or negative information

Suspicious Activity Monitoring

• Fraud, discontinuing access to bank’s systems

• Across multiple processors or programs?• Across multiple processors or programs?

• Volume, compatibility of data

• Average loads, balances

• Common elements (address, TIN, e‐mail)

• Transaction locations, types, velocity

• Series of transactions over time

• MSB registration (provider or seller of prepaid access?)

14

2010 Exam Manual Updates Related to Payments Issues

• Prepaid cards (Electronic Cash)

• Remote Deposit Capture (Electronic Banking)

• Cover payments (Funds Transfers)

• International Automated Clearing House Transactions (ACHs)

• Feedback or ideas for next update?

Conclusions

• As electronic payments volume, new products, and entry points continue to increase, financial institutions must have effective and comprehensive policies, procedures, and processes to identify, measure, and limit risks associated with these activities.y, ,

• Open, consistent, and effective interaction between operations, business lines, and compliance is critical to identifying and managing the risks associated with processing payments.

• Financial institutions that process payments for third parties, including payment processors and high‐risk merchants, must implement enhanced risk management practices to protect p g p pagainst BSA/AML compliance and fraud risks.

15

Closing Thoughts

• The highest BSA/AML/OFAC risk is not necessarily in the program with the greatest number of cards or outstanding balancesoutstanding balances

• “The issuing bank maintains ultimate responsibility for BSA/AML compliance whether or not a contractual agreement has been established.” FFIEC BSA/AML Examination Manual (2010) at 236.

Contact Information

Timothy P. Leary

Board of Governors of the Federal Reserve System

(202) 452‐2428

[email protected]

www.frb.gov

Infobase: www.ffiec.gov/bsa_aml_infobase/default.htm

16

Mobile Payments

• Joe Cachey & Ben Floyd

• AML considerations for new mobile products – focus on• AML considerations for new mobile products – focus on practical tools and issues (risks) for companies planning to enter the market

FIBA 2012 Conference February 23, 2012

M bil P tMobile PaymentsE-cash/Digital Cash/E-Wallets

Joseph Cachey IIISenior Vice President & Associate General

CounselCounselWestern Union

©2011 Western Union Holdings, Inc. All Rights Reserved

17

Mobile to Mobile(Mobile Send)

A Mobile Remittance is submitted through a mobile phone in Country A and routed to a mobile phone m-wallet account in Country B WUmobileOperator A Operator B

Mobile Channel Variations

Cash to Mobile(Mobile Receive -

Mobile to Cash(Mobile Send)

A Cash Remittance is initiated at a participating Western Union Agent in Country A and directed to a receiver’s Mobile phone m-wallet

A Mobile Remittance is submitted through a mobile phone in Country A and available as cash at a Western Union Agent in Country B.WUmobile

WUmobile

Operator A

Operator BAutomatic Delivery) account in Country B.

Cash to Mobile(Mobile Receive -

Pickup)

A standard Will Call transaction is initiated by a Western Union Agent in Country A. The receiver in Country B can “pull” the money into the m-wallet account by entering the MTCN on the handset menu, or the cash can be picked up at a Western Union Agent location.

WUmobile Operator B

Mobile – What does it take to add operators?

• Promote Service• Enroll Subscriber• Validate Identity

Western Union partners with operators to market “mobile money transfer” service and enroll & maintain subscribers.

PARTNER: Mobile Operators / Service Providers New Markets…1

2Western Union certifies m-wallets, m-banks and mobile devices to act as the new phone-based “source of funds” for remittance.

Balance: $100

> Send Money Western Union

You Received: $100.00 from Western Union

Western Union accepts mobile remittances originating from “contracted, certified & connected” partners.

CONNECT: Mobile Services Gateway

CERTIFY: Mobile Platforms / Device Man. 2

3

Modified Host-to-Host Interface

Western Union

Same Platform…

WU mobile

Send Receive

• Process MT• Run Compliance• Settle MNOs

Western Union’s internal MT systems fundamentally unchanged. Company maintains sole control over compliance, legal / regulatory and risk.

REMIT: Global Money Transfer Platform

Same MT System / New Trxn. Profile

4

18

Process for MNO EnrollmentWhat should be considered? Why?

MNO AML Compliance due diligence Need full understanding of the MNO’s (or partner bank’s) KYC and CDD for account holders (See AML Mobile Questionnaire on Sharepoint)

Transaction and velocity limits Western Union sets its own systematic transaction, daily and monthly limits, but these may be higher or lower than the MNO limits. The lower limits will prevail.

Compliance data The Western Union INT template will be replaced by a MOB template, but the MNO will be asked to provide (at a minimum) name, address, mobile phone number, ID number and DOB.

Regulatory reporting requirements Reporting requirements ( affect compliance data collection, but with the Compliance data requested the fulfillment of reporting requirements should not be an issue

MNO authentication procedures In addition to appropriate KYC process upon enrollment for the mobile phone, MNO should have a secure process (such as a password or PIN) to enable its customers to enroll in and accesspassword or PIN) to enable its customers to enroll in and access mWallet accounts

Any blocked corridors High risk or legally blocked corridors

Product codes Used for separate monitoring/tracking

Internal and external legal input To understand any legal requirements

Regulatory outreach Is there regulatory approval needed for the service?

What is country’s geographic risk index score? If it is a high risk score, this should be considered with the controls necessary.

Customer Enrollment / Account Activation Process

1. Customer presents their WU Loyalty card to FLA when picking up remittance

2. FLA cross-sells an E-wallet account• Provides a product information packet• Non-personalized prepaid gold MC with new

loyalty #• Acct. instructions / KYC reqs

3. FLA links new loyalty # to existing loyalty profiley y g y y p4. Customer takes product packet with them and returns

with completed paperwork4. FLA scans documents into system5. FGB (banker) reviews documents 6. Banker approves/declines acct

7. If approved: Banker completes opening process and activates account (acct. is ready for use).

8. If declined: Banker explains why and what steps are required for approval.

9. Customer sets up preferences• Set up SMS notifications (IVR or Web)• Sign up for SMS balance inquiry (IVR or Web)• Create online profile in order to access online

banking features10. Customer begins using account features

19

Risks• Non‐ face to face transactions

• Reliance on Third parties for Customer Identification

Common Risks & Controls

• Data inconsistency issues which affects comprehensive product monitoring

Controls• Transaction amount and velocity limits

• Subject to Country rules

• Enhanced Due Diligence on Partners and Vendors

• Consumer/Transaction authentication process

• Ongoing monitoring and reporting

Remote Deposit CaptureIssues and Regulators

Robert Rowe

Vice President & Senior Counsel

American Bankers Association

20

FFIEC Guidance

• Issued January 14, 2009

• Designed to help identify risks evaluate controls and assess• Designed to help identify risks, evaluate controls and assess risk management practices

• “When properly managed, RDC can reduce processing costs, support new and existing products by financial institutions, and accelerate the availability of customers’ funds.”

FFIEC Guidance

• Risk management principles parallel those for other forms of electronic deliveryelectronic delivery

– Not a new product but a new delivery system

– Should be compatible with the institution’s business strategy

• The board of directors should approve and receive regular reports on the program

• Risk varies with the roll‐out of the program

21

FFIEC Guidance

• All applicable risks and regulatory requirements should be consideredconsidered

– Particularly BSA concerns

• Operational Risk includes responsibility for the equipment used, image quality, destruction of physical checks, authentication of user (layered security)

• Customer due diligence is an important factor, including customer training and oversightcustomer training and oversight

FFIEC Guidance

• If a third‐party processor is involved, appropriate due diligence for selecting and implementing the program isdiligence for selecting and implementing the program is necessary

• Contracts with customers enrolled in RDC and with vendors are critical and should outline all duties and responsibilities, including fees, reports, data security and business continuity

– Should address applicable law

Should include provisions for termination– Should include provisions for termination

22

FinCEN Study of Remote Deposit Capture (RDC)

• Published in The SAR Activity Review, Trends Tips & Issues,Issue 20, released October 2011Issue 20, released October 2011

• According to FinCEN, two penalties (March 2010 & February 2011) highlight the risks

• Common elements:

– Failure to identify and assess risks

– Inadequate internal controls

– Insufficient automated transaction monitoring systems

FinCEN Study of RDC

• January 1, 2005 through July 31, 2011– 1017 SAR filings on RDC (~0.1% of all SARs)

• “a miniscule portion of all check‐related bank SARs”a miniscule portion of all check related bank SARs– Increase noted after penalties announced– “At most, the choice of RDC deposit channel may have facilitated certain schemes”

• Double presentment of checks• Counterfeit/altered checks• Typologies generally mirror those of traditional check fraudfraud

– Often characterized by immediate attempt to withdraw funds

23

QUESTIONS??

Documents

Florida International Bankers Association · Florida International Bankers Association 2012 AML Conference ... Examples‐Merchant‐issued gift cards, prepaid long ... Multiple Accounts