RISK MANAGEMENT THOUGHT LEADERSHIP Advance to Boardwalk: Building an AML Risk Management Program Monopoly Style By Shannon Bennett, Director of Financial Crime Control Strategy and Consulting, Risk and Compliance, Wolters Kluwer Financial Services “You have been elected Chairman of the Board, pay each player $50.” “Bank activities can save you from the headache of unwittingly taking on additional error in your favor, collect $200.” Sound familiar? Who among us didn’t grow risk as well as keeping you ahead in the game. up playing Monopoly or, depending upon your age, a themed version of it? If you have played the Monopoly game and understand its rules, it’s easy to The AML View of the Monopoly Game see how Hasbro has been able to make different variations of the same game using a standardized model to address different topics (i.e. Monopoly Disney With the game board as your framework, starting at GO, each group of Edition, Monopoly Star Wars Clone Wars Edition, CityVille Monopoly). properties represents a different phase in the development of your risk management program—from building your risk assessment to creating This approach of repurposing a standardized model can be applied to risk policies and procedures, identifying your controls, capturing your management and the different compliance functions within a financial deficiencies, performing testing, producing documentation, providing institution. For the purposes of this paper, the focus will be on the original oversight, carrying out training and finally ending with updating your risk version of Monopoly as a model for building a BSA/AML risk management assessment. Some of the topic areas, such as training and documentation, program, using the game board as the framework, as well as its playing are strategically placed on the game board to provide ongoing support of pieces and CHANCE/Community Chest cards when discussing different your program. aspects of the program. The game pieces are symbols for different elements of your business—the Setting up the Game player tokens represent customers, the property title deeds represent geographies, and services such as hotel stays represent products and Let’s talk about the Monopoly game board and how it translates into services. These will be incorporated into the discussion as appropriate to implementing and maintaining a strong BSA/AML Risk Management building a risk assessment. Program. In this game, you and all the other Monopoly players are compliance or risk officers of competitor banks. As compliance or risk Mediterranean to Boardwalk—Understanding Your Risk officers, you start on the same GO space, with the same rules, and are all provided the same budget by your bankers (Board of Directors), who then Step one of your strategy will typically consist of building your AML risk send you and the other compliance officers on your way to build an AML assessment. It should comprise the same methodology and principles that Risk Management Program for your institution. How you use that money as have been used in your other areas, hence using a standardized game board, you move across the game board will determine how effective you are as a identifying your players, following the formal game and finally a risk ranking Monopoly player. practice that provides you with a consolidated view of the risk across your organization. Your success will be determined by how you move strategically around the board, reacquainting yourself with the rules and knowing the other By using the Monopoly risk management model, four properties are used to players. First, understanding the steps you must take to build an effective represent the risk assessment. We’ll address the other two properties later program is essential. Second, you need to safeguard that you are up to date in the game; however, the first two properties (Mediterranean and Baltic) with regulator expectations when addressing your risk profile, familiar with symbolize the first steps you take when starting to build your risk assessment new guidance and understand the formal rules. Finally, understanding the as the foundation of your program. There is not much investment initially other players and their moves is important. For example, are you keeping and you can also see that their placement on the game board reinforces the up with what is happening with other institutions in regard to regulatory low risk attributed to those properties. actions, such as cease and desist orders or civil money penalties? Are you To create an AML risk assessment, your first step should be to identify those aware of decisions neighboring institutions are making, such as if they have customers that may bring a higher level of risk of money laundering due to quit offering certain services or changed their fees? Staying on top of peer the nature of their activity, occupation, or type of business. Understanding 1 Wolters Kluwer Financial Services and identifying the risks associated to customers is the first essential part Place through Virginia Avenue represent your procedures. As any avid of your risk assessment in determining a risk-based approach. Similar to Monopoly player knows, when you invest in both sets of properties, the the Monopoly game, where Hasbro has supplanted some of the original rewards are bountiful. Keep in mind, that as with Monopoly, some of your tokens (iron and cannon) with different ones, and most recently added the rules (procedures, controls or processes) that have always been there cat, based on public feedback, the perception of risk associated to some can either now be missed or deliberately changed due to time, staff or a customers has changed over time based on regulator feedback. Due to that misinterpretation of their intention. Many of us grew up with having to land feedback, customer profiling has evolved and the reasons behind a decision on the actual space before having an opportunity to buy a property, however to accept or reject a prospective customer has changed over the years, and the actual rules provide a different scenario altogether. In the actual rules, if these reasons are all based on shifting perceptions of risk. As with the other the player landing on the property chooses to pass on purchasing it or simply tokens that have been removed, the cat may at some point be deemed cannot afford it, the property is auctioned off to the highest bidder. undesirable for Hasbro, as not all Monopoly game buyers like cats or feel it’s an appropriate token. Just as with money service businesses, which were In relation to BSA/AML, the approach of staying on top of the current rules deemed high risk, causing many banks to stop providing services to them. and best practices in order to understand the best way to win makes sense. In the older version of Monopoly that many of us played, the winner truly Let’s move to the geographies associated to your institution within your risk was most often left up to CHANCE by what you happen to land on or if you assessment. The property title deeds represent your geographies using this picked up the right card. For those of us that happened to start playing the framework. Based on the placement of the property spaces on the game game at the age of eight, we were certainly at a disadvantage to those more board and their value, one can deduce that the risk is tied to the location of seasoned players that had the upper hand at understanding how to win them. The value and risk of Mediterranean is very minimal, in comparison to the game or apply the rules in their favor. Going back from time to time to Boardwalk, which, when housed with a hotel, can bankrupt a player. Similar reevaluate your rules (policies, procedures and controls) to identify any gaps to Monopoly, regulators and law enforcement have provided quite a bit of ensures that you are managing your game to your risk profile. Just like the insight into which geographies are deemed riskier based on location and Monopoly game, any time you pick up a card (policy or procedure) from the activity associated to them. Some of this information includes jurisdictions Community Chest or CHANCE, it needs to tie back to the game board (risk identified by Financial Action Task Force (FATF), countries subject to OFAC assessment). sanctions, countries identified in the International Narcotics Control Strategy Report (INCSR), or by the Director of the Office of National Drug Control Picking up the “You have won second prize in a beauty contest. Collect $10” Policy (ONDCP). This information should be incorporated into your risk has always seemed out of place, and who wants to come in second? Having assessment when identifying the geographies of your institutions, which your examiners see how your policies and procedures address your risks with jurisdictions your customers conduct transactions and where your customers the proper controls is critical and when they don’t, or if they see a policy or reside when evaluating your geographical risk. procedure that doesn’t make sense, it is no different than throwing in a card similar to the beauty contest winner, that doesn’t tie back to the game. Finally, the products and services provided by your institution are comparable to the game’s services of motel/hotel stays, rides on the Never leaving anything strictly to CHANCE also means that your business railroads, utility payments or those bank fees when picking up a Community units should have procedures specific to the risks that are managed in that Chest card. As with the Monopoly game, the cost and frequency a service is department with clear processes to how they share information throughout used or landed on will be a factor in determining its risk.