Understanding Fintech and BSA/AML: FAQs

When it comes to financial technology (Fintech) companies and BSA/AML (Bank Secrecy Act/Anti-Money Laundering) considerations, there are many key points to understand relating to the overlap between the two from a risk perspective, as well as system processes and cybersecurity concerns. In this article, we examine some FAQs that outline what a fintech company should consider to ensure it remains compliant and continues minimizing risk.

Fintechs often leverage third-party service providers or Software as a Service (SaaS) solutions to support different aspects of the AML/KYC (Know Your Customer) program. This requires sharing customer PII (Personally Identifiable Information) with third-party service providers. As part of the Fintech vendor risk management program, it is strongly recommended that they evaluate the potential AML/KYC vendor’s commitment to security and privacy by evaluating their SOC 2 Type 2 reports as part of the vendor onboarding process. These reports are issued annually and should be requested, reviewed and evaluated by the organization annually as part of its ongoing third-party risk management program.

From a BSA/AML program perspective, Know Your Customer (KYC) compliance will require a Fintech firm to better understand whom they are doing business with through 1) information gathering and 2) conducting customer due diligence. Individual consumers are usually easier than businesses to conduct adequate KYC program reviews because there may be more than a single individual associated with a business. Separately, reviewing a customer’s transactional activities to identify unusual or suspicious activities (Transaction Monitoring) may be more complicated and nuanced when dealing with a business versus an individual customer.

The Financial Crimes Enforcement Network (FinCEN) specifically discusses the need for collaboration between cybersecurity teams and BSA/AML teams. Specifically, the information provided by cybersecurity professionals could provide additional information in the identification of suspicious activity. Business email compromise is a great example of the overlap between BSA/AML and cyber. These attacks can be leveraged to steal or layer funds through a series of accounts.

This is a subjective decision that will need to be made based on a Fintech company’s unique circumstances. Finding the right subject matter expert and developing an effective system to mitigate AML risk isn’t easy, or without cost, regardless of the decisions made. Depending upon the risk associated with the Fintech, adequate mitigation efforts will need to be appropriate to the risk assessment of the company. There are pros and cons of having in-house experts and systems to execute a Fintech’s AML Program versus finding the right outsourced solutions to supplement the company’s internal AML risk monitoring. Whether it’s outsourced, insourced or, more appropriately, a balanced combination of both, the rule of thumb should be that the AML risk mitigation efforts are appropriate and sufficient for the company’s known AML risk posed by its business, customers, activities and its business counterparties.

AI/ML has been the latest innovation and enhancement strategy impacting AML Compliance programs and the Financial Services industry. While there are promising areas where AI/ML can bring efficiency and cost savings to historically manually intensive AML surveillance and investigation processes, the adaptation and regulatory acceptance of the new innovation has not been broad but case by case. Regulatory supervisors continue to monitor and closely examine whether AI/ML enhancements in the AML space are safe and effective.

Without a doubt, new innovations in blockchain technology and machine learning will bring efficiencies and improvements to the way companies have historically conducted their AML programs. The counterpoint to that is money launderers are constantly finding new ways to launder money to avoid new techniques and technologies.

A recent announcement from Google on their AI-driven AML risk mitigation services is the most recent sign that the industry is on its way to adopting AI/ML technology and the resulting efficiencies.

An AML program’s purpose is, in its simplest terms, to ensure that a company is not a party or conduit to money laundering activities and, if appropriate, to satisfy all regulatory requirements. FinCEN is a bureau of the United States Department of the Treasury that collects and analyzes information about financial transactions in order to combat domestic and international money laundering, terrorist financing, and other financial crimes. Their stated goal is to safeguard the financial system from illicit use, combat money laundering and promote national security. FinCEN also serves as the government agency that certain Fintechs who perform money transfer activities must register with as a licensed Money Services Business (MSB). See a recent example of how a state-licensed Trust Company ran afoul of FinCEN through their inadequate AML program and was fined $1.5 Million.

There are many reasons for Fintech companies to institute and execute an effective AML Compliance program:

There are 5 basic ‘pillars’ of an AML program: