'Threat Actors'

As part of these efforts in 2024, regulators will scrutinize:

• Data Traceability: Abilities to demonstrate, and report on, the traceability of data at both the  customer and transaction level, as well as across business processes, systems of record, and  systems of origin.
• Transaction Monitoring: The quality of transaction monitoring and surveillance systems,  processes, and controls, with expectations for increased accuracy and consistency, as well as  better and more efficient outcomes via automation. Regulatory focus in areas such as BSA/  AML/CFT, trading activity, and KYC/CDD and beneficial ownership monitoring will continue  along with attention to preparations for implementing risk-based compliance programs in  these priority areas.
• Expanded Threats: The adequacy and continual improvement of threat detection, monitoring,  and response capabilities, including the reliability of processes (e.g., due diligence, access, safeguards) and coverage of novel and emerging threats and vulnerabilities (e.g.,  virtual currencies, sanctions evasion, malware/ransomware, human rights/forced labor,  organized crime).

Expect regulators to focus on:

• Safeguards: Risk and fraud model management and controls related to existing and  new products, services, customers, and geographic operations, including consumer  protections from fraud, identity theft, and other scams.
• Consumer Treatment: Fair processing and treatment of consumer complaints, claims,  and disputes within the fraud and investigation processes, as well as the clarity of  consumer communications. Areas of focus will include data sharing (e.g., large data  models, data sharing with third parties and affiliates, customer permissioned sharing),  payments authentication procedures (e.g., P2P), model development and validation,  account holds and freezes, and ongoing oversight and monitoring of synthetic identity fraud.
• Crypto & Digital Assets: Continued investigations and enforcement of non-compliance  with existing regulations (e.g., unregistered offerings or sales of crypto asset securities  or derivatives products, false statements, market manipulation, red flag indicators).

As part of their role to safeguard public trust and confidence in the financial services industry,  expect regulators to focus on:

• Threat Detection and Monitoring: The presence of:
  • Continual process improvement to identify, adapt, monitor, and respond to changing tactics  from threat actors, as well as to timely remediate issues, as necessary.
  • Mature insider risk programs, inclusive of behavioral models and scenario analysis, to reduce  the likelihood of insider corruption and financial crime risk (e.g., authentication/access  management, synthetic identity fraud).
  • Surveillance programs to monitor use of digital devices, third-party messaging platforms, and  e-communication social tools.
• Compliance Culture: A culture of compliance and “individual accountability,” including  incentives for ethical behavior and culture commitment (e.g., cooperation with supervisors,  proactive identification of misconduct, self-disclosure, timely remediation), disincentives for  misconduct (e.g., compensation “clawbacks”), and business practices that place the interest of  customers first (e.g., avoidance/disclosure of conflicts of interest).