On the Oct. 14, the Cayman Islands launched the process for conducting their first national risk assessment.
Under the watchful eye of the premier, the minister for Financial Services, the attorney general, and the managing director of the Cayman Islands Monetary Authority, representatives of the private and public sectors gathered at a hotel for a two and a half day workshop.
The audience included members of the police, the DPP, the Solicitor General’s Office, the Financial Reporting Authority, the Department for International Tax Cooperation, CIMA, Customs, the stock exchange, the Chamber of Commerce as well as a variety of professional associations that met to discuss possible money laundering risks in the Cayman Islands and what could be done to mitigate them.
Risk and effectiveness – a targeted approach
The direct reason for undertaking the national risk assessment is to be in compliance with the revised international standards. Under the 40 Recommendations promulgated by the Financial Action Task Force (FATF) in 2012, countries should “identify, assess and understand” their risks and take action to ensure they “are mitigated effectively.” Not coincidentally, it is Recommendation 1 of the revised standards because it is the cornerstone of all further national AML/CFT action.
Doing a national risk assessment, however, should be about much more than simply complying with international standards. In essence it is about ensuring that a country makes the most effective use of the manpower and expertise at its disposal to fight money laundering and terrorism financing. Government and private actors should devote their resources in proportion to risk. The ultimate aim of these risk assessments then is to increase the effectiveness of a country system.
In fact, a risk assessment is a precondition to be able to even talk about effectiveness. If there is no benchmark against which to measure how a system is performing, all talk of effectiveness is meaningless.
It is only in determining levels of risk, that one establishes the benchmarks to measure effectiveness. Under the new round of assessments which started this year, the emphasis is therefore both on the determination of risk and measuring effectiveness: To what extent is a country’s AML/CFT system actually making a difference?
Whereas in the past countries were called upon to implement certain rules and regulations without particular regard to specific national issues which lay them open to greater risk, under the new approach there will be close scrutiny of the assessed risk and the way in which a country is mitigating it.
The World Bank National Risk Assessment tool
There are different ways a country can do its risk assessment. It can decide to build its own tool, with all the time and investment that entails, or it can decide to use an already existing, tried and tested, tool.
The World Bank is a market leader in this area, currently assisting 40 jurisdictions with a waiting list of almost 40 more. We are very happy and grateful the Cayman Islands chose our tool – every new country provides greater validation of the concept but also gives us the opportunity to rethink, reshape and improve it.
The World Bank’s tool is a self-assessment designed to elicit quantitative and qualitative information on the risks of a country. Risk is the result of a threat – an actor or group of actors intent on laundering funds – and the vulnerability that that actor can exploit to make the threat real. Vulnerability in turn is the result of the inherent vulnerability of a product, service or sector to being used for money laundering purposes, and the control measures put in place to reduce that risk, whether intentionally designed for that purpose or as an accidental side effect.
So, if one were to evaluate the vulnerability of the insurance sector for instance one is basically trying to answer the question: How easy is it to launder funds through that sector? Is it easy to place proceeds of drugs crimes or fraud in insurance products and to get them out again?
And in so doing one would take account of the fact that any funds going into an insurance product always have to first pass through a bank or other account (i.e. that there would be a prior point at which the provenance of the funds would be scrutinized – a mitigation measure but not explicitly for AML purposes) and that insurance institutions themselves have AML obligations (a mitigation measure explicitly designed to fight money laundering).
Expert working groups – the process
This discussion takes place in a working group setting among national experts with particular knowledge of, in the above example, the insurance sector – i.e. representatives of the sector and supervisors, with possibly one or two others with special knowledge in this field, such as academics or Financial Intelligence Unit staff. A list of criteria helps guide the discussion and ensure that the group considers all possible points of relevance.
Our role as World Bank is not to lead these discussions, but rather to explain the use of the tool and the different criteria, to challenge any overoptimistic conclusions, and from time to throw in some food for thought. We certainly do not provide the substantive input for the discussion. We’re not the experts on a country’s risk – country authorities and its private sector are.
Each relevant sector evaluates its vulnerability which then serves as input for the working group on national vulnerability. That working group, in dialogue with each of the sectoral groups, then aggregates all these sectoral vulnerabilities at the national level, with each sector being weighted to express its overall importance. There is one working group for all “designated non-financial businesses and professions” which evaluates the possible risks in the real estate sector, casino’s/gambling institutions, dealers in precious metals and stones, the legal and accountancy profession and the trust and company services sector. Certainly in a sophisticated financial center like the Cayman Islands that group tends to have a very heavy workload.
There is no scientific method for determining the weighting of each of the sectors and each jurisdiction can determine how it does this, but generally speaking both the contribution of the sector to the jurisdiction’s overall economy and its vulnerability to money laundering will be factors in determining that weighting.
Overall sectoral vulnerability is then combined with the “national combating ability”– i.e. how good is the jurisdiction at fighting money laundering and organized crime and how well do its different enforcement and financial intelligence agencies function – to determine national vulnerability. National vulnerability is then in turn combined with the national threat, which is evaluated on the basis of proceeds of crime and criminal data and known typologies of money laundering in the jurisdiction, to give one a rating of the national money laundering risk. See figure 1
The national threat working group, generally consisting of prosecutors, law enforcement, FIU representatives, tax authorities, and typically also a few regulators, also evaluates any specific terrorism financing threat.
The follow up
Of course the above model is just that: a model, and as such always a simplification of the complex reality that makes up the risk of money laundering in a country. It cannot hope to do justice to all a country’s specificities, but we have found that it provides a very solid basis for starting the national discussion about risk. And it does more than just start the discussion; it sets the wheels in motion by convening all the necessary players in an arena where, having identified their national risks, they can identify the follow up actions needed to mitigate their exposure.
One of those follow up actions tends to be the more systematic collection of data. Frequently a country will find it has no information on some of the crucial areas: It does not know which sectors are involved in money laundering; it has no data on the predicates of the money laundering offences being prosecuted; it has little information on incoming and outgoing flows of funds and more of such “unknowns.”
Thus, having used the tool, a country will often put in place more systems for collection of that type of information, enabling it to keep a closer track of what is going on and what effects government interventions are having. That will also include reaching out to private sector participants, by way of questionnaires, interviews or otherwise, to gather information on what they perceive to be the greatest vulnerabilities and how well authorities are addressing them.
So if you are a financial services professional reading this, don’t be surprised if one of these days you receive a questionnaire asking you for your views. Please be frank, the quality of the whole exercise depends upon it.
Fundamentally though, the real objective of the NRA exercise is to move a country towards a more effective allocation of resources, ensuring more focus on higher risk areas and less on lower risk.
However well-endowed a system may be, manpower and time is always limited. Therefore decisions will need to be made: Does one license (with all that entails) or merely register an institution? What low risk products or services merit simplified due diligence?
What areas should on-site supervisory focus on?
How should supervisory time be allocated and do all entities deserve the same amount of time and attention or are some more important than others? Interestingly most countries find it fairly easy to identify areas of higher risk and to determine what they think they should do more of. The harder part is identifying what is less important from a risk perspective and where resources could be redirected elsewhere. The real art of the risk assessment is in a proper prioritization, in acknowledging that some areas are more important than others and as a consequence deserve more attention.
We wish the Cayman Islands well in this exercise and look forward to giving continued support during the next phases and to a final, properly prioritized, action plan to improve the effectiveness of its AML/CFT regime.