ACI Worldwide provides electronic payments solutions to the world’s top financial institutions, retailers and payment processors.

ACI in the News

Back
Bookmark and Share


Keeping the money safe

July 2009


Published in Banking Technology, July 2009

For many years, fraud and anti-money laundering activities, where they existed, were separate functions for most banks, operating with different parameters and with little interaction.


Increasingly, though, global regulations on AML and the international nature of modern financial crime are pushing them together under one banner. In turn this is leading to calls for greater international collaboration


The widespread use of internet banking and the global travel industry mean that it is easy for the villains to skip between locations.


"Two of the hot topics for us, and I expect that it is much the same in the UK, are card and internet fraud, or e-crime. We've certainly seen in card-skimming that people are coming over here to do it, and Australian cards are being used in Europe, so it is a global problem," says Marty Latimer, executive manager, financial crime at Suncorp, Australia's fifth largest bank. "Most of our time is spent on cards and internet banking. To keep a card system churning over does take a lot of focus: my analysts are looking at the rules and performance daily, and make changes daily. Internet banking has become another major fraud topology that offenders are using because of the anonymity."


A former fraud investigator, Latimer sits on several industry bodies in Australia, including the Financial Crimes Steering Group and the Australasian Card Risk Council. He has taken on AML responsibility since the implementation of Australian laws last December.


"For card fraud there are solutions on the market. We use ACI's PRM, which alerts suspicious transactions," he says. "It's probably fair to say that all banks use a system like PRM to highlight unusual transactions to enable us to provide a service to customers and stem financial loss by allowing us to get to the transaction quicker."


Getting to the suspicious transaction quicker is central to the systems vendors' approach says. Colin Day, vice president of SunGard's compliance and financial crime solutions business." It is ever-moving goalposts, which is where software has a part to play. No vendor in their right mind would turn around and say that a solution like the Ambit AML software is the be-all and end-all to a bank's AML programme - it's a component thereof," he says. "What we are offering are the tools to equip the bank's staff to highlight the initial set of customers or the initial set of transactions that have breached normal behaviour thresholds and require further investigations. We are not replacing the risk officer - it is their gut instinct that will spot things - but we are giving them the magnifying class so that they can identify the needle in the haystack."


Another factor is that the financial crisis has increased the amount of crime committed by opportunist criminals - disorganised crime, if you like.


Jackie Barwell, director of risk and fraud at First Data, says that the financial crisis has prompted the organised criminals to return to older modus operandii. "What we are seeing is that the fraudsters are taking the financial situation and looking for windows of opportunity that they have exploited in the past, but the other thing that we are seeing because of the financial environment, and again it's not brand new, is the opportunistic crime. When times are bad these kinds of activity surface - they could have been going on for years," she says.


Typically this is the kind of person who wouldn't normally a dream of committing a crime, but they are financially stressed: this can be something along the lines of querying transactions on a credit card, and has spread from the insurance world where consumers often feel that it is legitimate to exaggerate a claim, says Barwell.


On the organised front, what the industry is seeing is the increase in phishing attacks - not just against banks, but any source where you make a payment and there is a rich source of account data.


They also are taking advantage of the uncertain financial climate by playing on consumer fears. Barwell says that when the Icelandic banks ran into trouble last year, the number of phishing attacks against them increased dramatically, along with attacks against other institutions. "Whenever a bank was in the headlines, the attacks would increase."


The banks need to increase their capability to challenge claims, and be clever about how things are questioned, which is a training issue.


But there are limitations to the systems approach, and in some areas there is precious little deployment of it in any case, according to Jyotsna Ayyagari, head of global AML for 3i Infotech.


"Basically if you are looking at the countries where national identities existed and there was some sort of automation in the banks then it's definitely not a problem, but in large parts of the world KYC didn't exist five years ago so the whole idea of AML has brought huge changes in the way that the customer is accepted into the financial system," she says. "In Africa, the Middle East, large parts of Asia - we are talking about huge areas - money is being sent without the beneficiaries, or even the sender in many cases, being identified earlier [in the process]. The whole awareness of money-laundering and automation has brought in a fair amount of change in these areas. Now cash transactions are definitely being tracked and certainly that element of it has been plugged."


Ayyagari agrees with Barwell that there is a tendency for criminal activities to cross boundaries within the financial services industry, which is a problem in itself. "Banking is more or less covered - most of the banks across these countries have a fair amount of systems in place," she says. "But the broking industry doesn't - though in most countries cash transactions aren't allowed directly into the broking industry there are ways in which it can enter just outside. If a broker can't accept cash for trading, he accepts it into his own account and then from there he can get it into the banking transaction. Situations like that exist in broking and insurance; banking to a large extent has been sealed."


"What banks need to do is be as connected as the fraudsters from an intelligence gathering point of view," says Barwell. "As First Data, we have a huge network of banks across the world, and we also have a huge network of merchants and merchant acquirers. What we are doing right now is joining one set of customers with another from a fraud intelligence perspective." The company has set up fraud user groups in various regions and is actively promoting the sharing of information. "It takes time to create that common bond and trust, but it works: we have open and frank discussions on trends in fraud and they discuss ways of tackling it, especially if it is a new form of fraud."


New forms of payment technologies are increasingly taking the fraudsters out of the reach of bank systems, says Ayyagari. "Money transfers are the next thing to plug, and then you have the prepaid smart cards and top-ups, and you now have mobile banking coming with more and more transactions without involvement of financial intermediaries, that is going to be a new challenge - customers benefit from the automation, but so do the launderers."


Because the great majority of financial crime is unsophisticated, she is sceptical about the use of sophisticated techniques like predictive analysis, and neural networking, artificial intelligence. "A banker is not a policeman and you have to ask, how much is enough? Simpler and cheaper rules-based systems can be better than very, very expensive real-time systems. A launderer can spend years sleeping and then start pumping: launderers are very tech savvy and clever, and they want to spend time building an effective profile before they move."


Michelle Weatherhead, manager of EMEA Risk Solutions at ACI Worldwide, says that it is more than simple thresholds. "The way our rules solution works is that it enables customers to create quite complex scenarios to alert on. It could be the entire modus operandi of the fraudster that is deployed within the rules - alert me to a transaction in Malaysia at this time of day, where there has been some internet testing transactions on a particular IP address, and so on till it is complex."


Weatherhead, who was formerly with ANZ in New Zealand before joining ACI Wordwide, says that a characteristic of that region is the level of co-operation between institutions. "Australia is quite advanced in the way that people analyse fraud trends and work together as an industry to share intelligence, compared to the UK and Europe," she says. "The UK has industry bodies like APACS and Cifas for fraud and AML transaction reporting, so there is industry collaboration, but it is not as direct and it's not as real-time as it is in Australia."


She says that in Australia, as soon as one bank identifies a new or variant modus operandii, emails are sent to other banks and they can often have the rules changed and the vulnerability removed on the same day. The central reporting approach used in Europe might mean that it is not reported till the end of the week and the information is not actively disseminated.


Latimer confirms this. "We are constantly reviewing the rules," he says. "I've been asked a few times whether fraud experiences are different in Australia. On the face of it, no; fraud is pretty global, the difference we have in Australia at the moment is this collaboration. It's a very open collaboration: if a bank gets hit by something then the other banks are the first to know and can adjust our rules accordingly and that way we can keep on top of it very quickly."


He says that much of the work is routine and the bank has constantly to balance its needs against its capabilities. "It is more about keeping resources fluid: Suncorp is nowhere near the size of Abbey or Barclays, so I look after all the fraud, which allows me to keep the resources fluid and we can move them to where we are being hit. In larger institutions fraud can be siloed: you have a card section and a cheque section, and never the two shall meet. It is an advantage to be able to take a holistic view."


At Suncorp, that holistic view arises from the scale of the bank, but it is something that many larger players in Europe are working to achieve through integration of the existing silos that have grown up, says Weatherhead. "I'm working with a number of Europeans that want to create a single department to monitor fraud, financial crime and AML. The difficulty is that it is such a big beast."


There is a disparity of motives too: fraud and financial crime is a direct assault on the bank, and costs it money, but money laundering does not necessarily. "That's certainly been the case in Australia, and it is reflected in the models that banks have chosen to go with," says Latimer. "Generally fraud has been handled by a fraud team and AML has been handled by a compliance team because of the regulatory need. What we did at Suncorp specifically was said that money-laundering is just a financial crime, so we'll take the transaction monitoring and the looking for suspicious money laundering events into our fraud team, and the regulatory part can sit in compliance.


"I certainly felt that I didn't want compliance putting a team on monitoring transactions that had no experience in looking for suspicious activity, and I've found this to be quite a good result for us. The outcome of AML legislation is that you'll submit a report of suspicion and what I didn't want was a compliance team finding something suspicious that in fact could have been fraud and did nothing about it other than put a report in."


The compliance factor does seem to be driving reporting towards a degree of international standardisation, and on top of this, it could be expected that cooperation will come on the back of that.


"If you look at uniformity across countries, in terms of capacity building and awareness - in terms of the typologies and red flags, in terms of the mechanisms for reporting, and in terms of the international collaboration - across the globe there seems to be a standard that is evolving," says Ayyagari. "Where there is a real difference is in the level of automation that can be achieved. Where all banks have a core system then adding an AML system is relatively easy and starts showing results. In most countries where the real challenge lies - Nigeria, Sri Lanka, Pakistan, Bangladesh - then in many cases the banks themselves are only just moving into core systems automation. Though the seriousness of intent is there, there is a time lag because of the automation.


"It would be utopia if we could get global co-operation," says Latimer. "To some extent we have some inklings of that because of globalisation of financial institutions - in Australia, besides the domestic financial institutions we have, of course, the global banks like Citi and HSBC, and they have intelligence coming from the US and Asia. We also work closely with the card schemes, so we do have intelligence coming from worldwide, because Visa, MasterCard and American Express are all heavily involved in protecting their payments systems. We're not at the level where I get emails from America and India yet though."


Days says that the Egmont Group, consisting of international Financial Information Units, is making some inroads into this area, but there are issues of over reporting standards, for instance, that have to be sorted out. "If the industry could focus on getting a common standard for reporting of suspicious transactions, that would naturally lead on to how a legal framework could be put in place to enforce the sharing of information. Money laundering isn't a problem for one government or one country: it's a worldwide problem that will take a worldwide effort to eradicate."


As well as banks and government bodies, there is considerable scope for financial infrastructure organisations to play a substantial part in the fight against financial crime. "The single biggest thing that can be done is to stop people entering the financial system without leaving a footprint. Once that is done, the focus should be on the larger entities where consolidated information is available - the exchanges, the payment gateways, the transmission agencies and so on, says Ayyagari. "Link analysis needs to be happening at the level of clearing house rather just at the banking level. That would, I think, make a huge difference: it wouldn't be a huge technology impact for them, and they wouldn't have to change their methodologies. That kind of collaborative approach would be much more useful, and it is happening in some areas, but they are the exception."




Bookmark and Share


Press Contacts

Americas

Ann Cunningham
Tel: +1 402 778 2323
E-mail Ann

 

EMEA

Catherine Eyres

Tel: +44 1923 816393

E-mail Catherine


Asia Pacific
Jennifer Lim
Tel. +65 67808362
E-mail Jennifer





Visit ACI Worldwide's Payment Industry Media Centre for more information, news and commentary.



Go to media centre



Site Map  |  Privacy Policy
© 2010 ACI Worldwide, Inc. All rights reserved.
All products are trademarks or registered trademarks of their respective companies.