Calibrating the Crosshairs

Step 1: Assess the Applicability of Red Flags

When red flags are published, a financial institution should assess the applicability of the red flags taking into consideration:

• What is the applicability of each red flag to the firm’s client segments, products and geographies?
• Is the red flag already part of the compliance program for other illicit finance risks such as anti-money laundering or terrorism financing?
• Does the firm have the data required to identify the red flag? And if not, should it?
• How “distinctive” is this red flag for illicit activity?
• At which control points within the compliance program can this red flag be implemented?

Let’s look at some example red flags to understand how to apply these questions.

Clients, products, and geographies

While no financial institution should consider it has no exposure to financing unlawful trade, a financial institution’s client base, products, and geographies will influence the relevance and risk associated with each red flag. To provide a straightforward example: a domestic bank that provides only transaction banking services to domestic retail customers will be lower risk compared with a global bank that finances international trade to corporate clients including those in the defense, electronics, and aviation sectors – products which are some of the targets of illicit procurement networks.

Some red flags will be most relevant or only applicable to specific products. For example, red flag 🚩Parties to transactions listed as ultimate consignees or listed in the ‘consign to’ field appear to be mail centers, trading companies, or logistics companies (Alert 004) could be applied to trade finance products because the financial institution is more likely to have documentation that specifies the consignee, whereas for other products this information is unlikely to be available.

Other red flags will be applicable to all clients, products, and geographies, and may already be part of a firm’s existing financial crime compliance program. For example, red flags 🚩IP addresses that do not correspond to a customer’s reported location data or 🚩Use of shell companies (Tri-Seal Alert) are applicable across all clients, products, and geographies. These are already likely to be implemented as control elements to identify money laundering, terrorism financing, sanctions evasion, or other illicit activity.

“Distinction” and data

Some red flags may be very broad, meaning they are not “distinctive” indicators of unlawful trade or the data may not be available to enable filters or searches. An example would be 🚩Transactions related to payments for defense or dual-use products from a company incorporated after February 24, 2022 [Russia’s further invasion of Ukraine], and based in a non-GECC [Global Export Control Coalition] country (Alert004). Data should be collected and readily available within a financial institution on the date and country of registration of corporate clients. However, where payments are made using wire transfers, it is unlikely that the firm will have data on the products being financed. Without this data, any search on companies “incorporated after a specific date in all non-GECC countries” would return a very large number of results – and very few may actually be involved in illicit procurement of defense or dual-use products.

However, this doesn’t mean that these broad or “non-distinctive” red flags are not useful – they may still be valuable depending on when and how they are applied. In our example above, while the red flag may not be suitable to be implemented as part of an automated control or as an initial filter for high-risk clients, it could still be valuable when analyzing a specific client. For example, if a specific client is undergoing enhanced due diligence or is being investigated, an analyst can investigate the detailed characteristics of the client, their transactional activity, customer profile and other information, and manually acquire new data to assist in their assessment. In this context, more information is available and the red flag may form a valuable indicator of potentially illicit activity.

If a firm is not already collecting the data it needs in a readily usable format, this would be a good time to review and implement changes.

Controls and the compliance program

The final step when assessing applicability of red flags is to consider the appropriate control point at which the red flag can be implemented. We can use some of the “critical red flags” in the BIS New Guidance as examples.

🚩Client refuses to provide details about the transaction could be implemented as a control in client-facing teams. For example, Relationship Managers could be provided with training on the types of questions to ask clients during onboarding and throughout the client lifecycle to identify if there are any export control red flags that require further investigation.

In contrast, 🚩The name of a party to the transaction is a match to a restricted-party list could be implemented as a control within automated screening tools similar to the methods already used for screening against financial crime adverse news or sanctions designation lists.

The above are some examples of how red flags can be implemented at different control points, and each institution will need to make its own decisions on the most appropriate implementation of export control compliance requirements.

Step 2: Document the Red Flag Assessment and Decisions

The outcomes of the red flag assessment should be recorded. This will ensure the decision-making process is available should it be required by a regulator or internal governance process. For example, the assessment could be a detailed table showing each red flag, the applicability assessment by client/product/geography, the reasons for each decision, and – for those red flags that have been implemented – the applicable compliance control.

Step 3: Obtain Governance Approval for the Proposed Approach

Given the importance of red flags and the increasing focus on financial institutions’ export controls regimes, it may be appropriate to have the proposed approach to red flags approved by a governing body. The governance requirements will vary based on factors such as the size of the institution, its export control risk profile, and the risk appetite set by its board. Institutions with higher export control risks – clients, products, or geographies – or those with previously identified weaknesses in financial crime compliance controls, would require more stringent governance, compared with those with a low risk profile and effective controls.

Where governing body approvals are necessary, they could be provided by a senior member of the Financial Crime Compliance team or a Compliance Committee. It may also be appropriate to communicate the decisions made “for information” to a Board Risk Committee as part of regular reporting.

Step 4: Communication and Training

When the approach has been finalized on how each red flag will be implemented into the institution’s compliance control program, this must be communicated to teams with new or modified responsibilities. There may also be training required, particularly since export controls are relatively new for financial institutions. Training on red flag controls and processes should form part of broader training on export controls to provide context.

Step 5: Integration with Existing Controls and Processes

The new and enhanced controls and processes for export control red flags should be fully integrated into existing processes and workflows.

An example of a modified process would be: if export control red flags are identified during the client lifecycle, this may prompt a change to the client’s risk rating, a trigger due diligence review of the client, or other actions – just as it would for other financial crime red flags such as adverse financial crime news or the client expanding its business into higher risk markets.

For the four critical red flags, the BIS Guidance specifies that if these red flags are identified and cannot be satisfactorily resolved, BIS recommends the institution should not conduct further transactions.

Step 6: Ongoing Review of Effectiveness of Export Red Flag Controls

Having assessed export control red flags and implemented them into its compliance program, a financial institution should regularly review whether the controls are working as intended and take action accordingly.

For example, if a post-transaction review identifies a potential violation of export control regulations, a review should be undertaken of the red flags to identify whether they could have been identified earlier in the client or transaction lifecycle – and if so, to recalibrate the red flag controls and remediate control weaknesses.

Conclusion

While export controls are still an emerging responsibility for financial institutions, taking a structured approach to red flags will improve a financial institution’s likelihood of remaining compliant and minimize the possibility of financing unlawful trade and drawing regulatory consequences.