Taking a decisive stand against money laundering and terrorism financing

Boards and senior management should clearly communicate their risk appetite and an emphasis on AML/CFT as a priority throughout all three lines of defence. They must also ensure that these three lines of defence are appropriately staffed with qualified personnel.

• The first line of defence consists of the business units, which are crucial for identifying, controlling, and assessing money laundering/terrorism financing risks. This is because they directly interact with customers
• The second line encompasses AML/CFT compliance and support functions, such as operations and human resources, who should work collaboratively to ensure the ongoing effectiveness of AML/CFT controls. 
• The third line constitutes internal audit, which provides an independent evaluation of the organisation’s AML/ CFT framework for compliance with regulatory requirements, as well as internal policies and procedures. 

Organisations must establish and implement an AML/ CFT policy along with operating procedures governing customer due diligence, screening and transaction monitoring. These policies and procedures serve to instruct and guide employees to ensure adherence to established policy standards. The AML/CFT policy and procedures should also align with and comply with relevant regulatory requirements. It will also need to be clearly articulated and communicated across the organisation.

The board of directors should have a clear understanding of their company’s AML/CTF risks. Hence, an enterprisewide risk assessment (EWRA) forms a proactive evaluation of an organisation’s inherent risks associated with its business activities, such as the products and services offered, distribution channels and the locations of customers. Although inherent risks cannot be eliminated, they can be mitigated through implementing controls.

An effective EWRA framework gauges an organisation’s inherent risks, evaluates the effectiveness of its mitigating controls, and determines the residual risks that persist despite control measures.

Before establishing business relations with a natural person, the organisation must identify and verify the individual’s identity. For legal persons, the organisation must identify and verify the identities of the ultimate beneficial owners and connected parties. Where the customer presents higher risks, the organisation should also understand the source of the customer’s wealth and funds.

Customer due diligence should not only be performed at onboarding. Rather, information should be updated for changes periodically at a frequency reflective of the customer’s risk rating. Boards should check with senior management on the onboarding process of new customer types with high-risk profiles. 

To understand risk factors associated with new customers, third-party vendors, or business partners, such as Politically Exposed Persons (PEPs), targeted financial sanctions and adverse information, the organisation should screen customers, ultimate beneficial owners and connected parties against lists provided by the Monetary Authority of Singapore. They should also perform Internet searches. 

In addition, screenings should be conducted during onboarding and at regular intervals thereafter, as there may be changes to a profile post-onboarding. For instance, there may be the emergence of adverse news or situations that involve an individual meeting the criteria as a PEP or being placed under financial sanctions. 

Organisations should monitor customer transactions for suspicious activities, and be aware of any red flags relevant to the nature of their business relations with customers. If transactions appear inconsistent with customers’ profiles, the organisation should seek clarification and assess the reasonableness of explanations provided by the customers. It is important to assess if monitoring thresholds have been statistically calibrated.

Existing legislations make it mandatory that everyone – including, but not limited to, landlords, property developers, financial institutions and corporate service providers – report suspicious transactions.

In cases where an organisation has established that the transactions undertaken by a customer are suspicious, it will need to promptly file a Suspicious Transaction Report (STR) with the Suspicious Transactions Reporting Office, which is part of the Commercial Affairs Department, within the stipulated timeline. An organisation should designate a Money Laundering Reporting Officer to oversee and facilitate the filing of STRs.

Additionally, it is worth highlighting that reporting cash transactions is mandatory for precious stones, precious metals dealers, and pawnbrokers in Singapore.

Regular training related to AML/ CFT will also be key. The board, senior management and other employees of the organisation should undergo training for AML/CFT compliance to ensure that they are updated on any changes in requirements, current regulatory expectations and emerging trends. Employees should also have access to tailored AML/CFT training in relation to their functional areas.

During the hiring of new employees, background checks, screening and bankruptcy searches should be performed. Companies should consider whether they have an employee due diligence programme that documents how employees and contractors will be screened and rescreened for money laundering/terrorism financing risks.