Risk Assessment: Money Laundering & Terrorism Financing (Module 1)

This report analyzes the risks associated with money laundering and terrorism financing, focusing on risk assessment methodologies, vulnerabilities, and control measures. The report examines various risk assessment tools and typologies, including those outlined by AUSTRAC and Australian standards, to determine the vulnerability of financial products and services. It explores the vulnerabilities of online trade financing and offshore entities. The report also discusses the application of risk appetite, monitoring, and review procedures to adapt to changing risks. The report also provides detailed insight into the control of new products and services to identify and mitigate risks within the financial system. The report covers customer due diligence procedures and the importance of knowing clients to identify and mitigate ML/TF risks. The report also includes the vulnerabilities of businesses offering online trade financing and leasing products, as well as the vulnerabilities of offshore entities providing services to New Zealand customers.

Terrorism Financing PAGE \* MERGEFORMAT 1
MONEY LAUNDERING AND TERRORISM TRAFICKING
Module Name
Assessment Title
Student Number
The Date

PAGE \* MERGEFORMAT 21
MONEY LAUNDERING AND TERRORISM TRAFICKING
Task 1
Part 1
Question (a)
i. There are several risk assessment methodologies utilized under different
standards, to determine the vulnerability of financial products and facilities
offered by different institutions. The key business risk highlighted include data,
system and people capacity. Therefore, coming up with a risk plan, it is important
to access the vulnerabilities that data is exposed to and the points of weakness in
the system. For this risk plan, guidelines outlined by AUSTRAC and Australian
standards will be used to formulate the risk assessment methodology required for
the proposed acquisition (Bryans,2014, 441). The document used is the AS/NZS
4360:2004: Standards for risk management (Australian Standards). This
document combines the important aspects from Australian standards partisan to
ML/TF and regulations highlighted by AUSTRAC to produce a comprehensive
methodology for risk assessment and management (Bajada,2006, 12).The risk
categories as identified in ML/TF are four namely customer type ie PEPs,
designated services provided, methods by which delivers designated services and
foreign jurisdiction.
ii. To provide a comprehensive and efficient risk assessment framework, there are
various tools and AUTRAC topologies that will be used in the assessment

PAGE \* MERGEFORMAT 21
methodology such as identification, assessment, treatment and monitoring and
review (Bryans, 2014, 441). The most relevant of the typologies and case studies
is from 2014.example is Case 6 – Accountant jailed for laundering money via
Hong Kong and New Zealand and Case 1 – Suspect used black market website
and digital currencies for drug trafficking 2014 AUSTRAC report. This report
highlights the Australian businesses that have been exploited for criminal
activities such as drug smuggling, tax evasion and even human trafficking.
a. Risk identification. As a reference from, Ferweda & Reuter
(2018), 7, this tool aims at determining the ML/TF risks that are
associated with the business and the products that it offers. Under
this tool, there are two types of risks that are taken into account,
namely: Business and regulatory risks. The business risk refers to
the main ML/TF risks associated with the business operations such
as :
 Product and services provided such as credit cards, private banking
and wealth management and retail banking.
 Customer types for example PEPs(Politically Exposed Persons),
natural persons (individuals) or Legal persons(personal representation created by
law)
 Countries of operation such as transactions to countries known to
have sanctions on trade or regarded as a source of narcotics or/ and reputable
criminal activity are considered high risk.

PAGE \* MERGEFORMAT 21
 Methods of delivery for various services such as the online
services, emailing or third-party brokers.
Regulatory risks refer to risks that are as a result of not adhering to the AML/CTF act, which
is an Anti-Money Laundering and Counter-Terrorism Financing Act of
2006(Choo.2008,363). Such risks include failure to carry out customer verification
accurately, lack of an AML/CTF program in an institution or failure to submit AML/CFT
compliance reports.
b. Risk Assessment. This tool allows for the measure of the quantity
and effect of the risk to be stated. The assessment is done in two
measures: likelihood, which defines probability of the risk
occurring and impact, the damage that the risk would cause. A
product of the two measures provide a risk score or level which
can be low, medium , high or extreme depending on contributive
factors.
c. Risk Treatment. This tool allows for the identification and
enforcement of remedying measures to manage the risk that has
already being identified using previously mentioned tools. Such
measures could include introducing transactional limits or putting
in place processes to deal with high risk costumers or those that
choose to transact with high risk countries among other viable
strategies and policies.
d. Risk Monitoring and Review. This tool is used to keep track of the

PAGE \* MERGEFORMAT 21
risk plan and how it is holding up in the face of changing products,
services and targets customers.
iii.
Industry typologies dictate in a lot of ways the manner in which an institution provides its
services (Freeman,2016, 25). Therefore, the level of risk between for example a retail bank and a
private bank will not be similar because they employ varied policies of engagement for their
customers, provide different services, probably operate in different jurisdictions and use varied
modes of transactions. Therefore, when it comes to using the risk assessment methodology to
produce risk plans for either of these institutions certain vulnerabilities will be high-risk for the
retail banks than the private banks and vice versa (Favarel 2011, 179). In the case of this
particular situation, BSL usually provides face to face transactions while FF uses their online
platform to sell their products. Therefore, a vulnerability such as anonymity will be more
prevalent for FF because online transactions do not demand much background or personal
information from the customer while for BSL the risk will be much less because the face to face
interaction lead to collection of customer information as well as the identification of the account
owner (Gardner, 2007, 337). Examples are Case 6 – Accountant jailed for laundering money
via Hong Kong and New Zealand and Case 1 – Suspect used black market website and digital
currencies for drug trafficking 2014 AUSTRAC report.
iv.
A company's risk appetite refers to a specific amount of risk that the company is
willing to endure as they target certain business goals, as referenced by Harvey, (2015).
In this case, BSL's risk appetite will help to provide the guidance in coming up with

PAGE \* MERGEFORMAT 21
remedy strategies for the risks anticipated. Understanding the risk appetite of the
company will help determine the types of risk that the company is not willing to take, the
risks that will be treated on individual levels as well as the risks that will be delegated to
higher management (Hopton, D. 2016).
v.
In reviewing the ML/TF risk assessment, it is important to understand that risks change
over time due to increase or changes in products and customer types (Sadiq, &Governatori,
and,2009, 165). It is therefore important that a monitoring and review procedure of the risk
assessment methodology be developed to ensure that it can be adjusted accordingly in case it is
not working correctly. It is important that a system for keeping records is determined. Using the
records that are provided, analysis and review of the risk plan will be backed up with
performance data that can be used to adjust areas of weakness in the plan. It is important or the
top management to not that ML/TF risk mitigating cheque account is fact that a fully auditable
trail exists between the payer and the payeee.as a resolution there is no negotiation of each
cheque. ADIs are subject to AML/CTF customers, it has also been noted that the use of bank
accounts introduces illigal money in the currency circulation .
It is also very important to carry out internal audits of the company which allow for the
company to provide AML/CTF compliance reports (Hamin, Kamaruddin and Rosil, 2018, 3)
Question (b).
i.
Vulnerabilities of running a business that offers online trade financing and leasing
products include (Tahiri, 2018):

PAGE \* MERGEFORMAT 21
 It is possible to operate from different jurisdictions and make value
movement to a third party.
 It is possible to aggregate value due to the complex currency exchange
transactions that usually occur multiple times hence value transfer is kept untraceable and
the anonymity of the criminal is concealed.
 Setting up accounts and transactions can be done without face to face
contact.
 Due to the voluminous flow of goods and transactions, it is not easy to
isolate individual criminal transactions and therefore granting opportunity to criminal to
transfer value.
 Limited resources and verification programs exchange between custom
offices in countries make it difficult to detect value transfer over multiple jurisdictions.
ii.
Vulnerabilities of running an off-shore entity/branch that provides products and services
to New Zealand Customers (Spink, 2017, 642)
 Bank secrecy that ae very rigid and therefore do not allow thorough
investigations of suspicious transactions by relevant financial institutions.
 The ability to maintain anonymity during the setting up and transacting of
accounts due to the inadequate information required to set up accounts.
 The product allows for transfer of value from owner to beneficiary without
the requirement of identity disclosure.
 The jurisdiction is considered as a moderate tax-haven hence there is
minimal background information needed, this type of transactions make it difficult for the

PAGE \* MERGEFORMAT 21
authorities to track criminal transactions.
 There is a deficiency in the effectiveness of inter-border intelligence
which makes it difficult to create patterns between criminal transactions that are
connected but conducted in different jurisdictions.
The BSL risk profile suggests acquiring a company that offers online trade financing and
leasing products and also to run an offshore branch to provide its services to an expanded
customer base in New Zealand. Both these strategies increase the company's risk (King, C. 2018,
15-31)). The main source of risk comes from the online platform that allows for full anonymity
of the company's clients in this region. The strategies also offer the option of offering services
over various jurisdiction, which limits monitoring efforts, as well as enabling criminal to mask
their activity in normal transactions among other customer (Mahnken, Weiss, Graboske, and
Whelan, 2004.904). The acquisition involves increase in the product and service selection as
BSL seeks to reach Australians in remote areas. This means the criminals have a source of entry
for their value into the financial system and also have various products that can assist in
disguising their transactions. The company need to improve its control to combat these and other
risks (Loayza,Villa, & Misas, 2017).
Task 2.
Question a (i)
When coming up with the required control for the new product the following assumptions
were made about the model for BSL prior to the acquisition of FF. The leasing benefactor paid

PAGE \* MERGEFORMAT 21
monthly payments to the leasing company upon receiving item on lease. The company also
makes a transaction to the supplier company to pay for the item. Therefore, the model is a
traditional one with the leasing beneficiary in this case being the payer of the leasing fee; the
receiving remitter is the agent/ operator at the company (Ryder, 2012). There is also a transaction
between a sending remitter from the BSL to the supplier who is also a beneficiary of the
transaction (Ryder, N.2015). In its current state, the controls that are in the system will not be
able to handle the online product without some adjustment (Malama,.2010). The controls in this
model are extremely vulnerable to risk associated with online transactions. As it is now, the
model is already high risk in as far as ML/TF is concerned.
The basic role of customer due diligence procedures is to guarantee the revealing element
knows its clients and comprehends their clients' money related exercises. The announcing
substance must set up a structure and report its client due constancy (CDD) methods in detail.
All AML/CTF programs (standard, joint and uncommon) must incorporate Part B. An
announcing element must be sensibly fulfilled that: an individual client is who they guarantee to
be for a non-singular client, the client exists and their advantageous proprietorship points of
interest are known.
By knowing its clients, an announcing element ought to be better ready to recognize and
alleviate ML/TF hazards in the lead of their budgetary exchanges, especially where the action or
exchanges are abnormal or strange. The CDD necessities include: gathering and confirming
client distinguishing proof data. Example instance, records, information or other data acquired
from a dependable and autonomous source recognizing and confirming the useful owner(s) of a
client recognizing, whether a client is a PEP (or a partner of a PEP) and finding a way to build up
the wellspring of assets utilized amid the business relationship or exchange getting data on the

PAGE \* MERGEFORMAT 21
reason and proposed nature of the business relationship.
The basic role of Part A of an AML/CTF program is to recognize, relieve and deal with
the ML/TF chance emerging from the arrangement of an assigned administration by a detailing
element. Components of Part A likewise educate the risks based methodology that is connected
in Part B (customer identification).
( ii & iii)
The stakeholders that are best suited to assist in the determination of deficiencies in the
controls and probable solutions are the project manager and the project team (Parker, 2018, 454)
these are people who are in control of the business for example in positions that are vital for
decision making. The project manager is in charge of the daily operation of any company about
any new project implementation or maintenance of older projects The project manager and the
project team managers play a vital role in influencing the decisions made by the business. It ,
therefore, calls for their involvement in a vital decision such as determination of deficiencies in
controls and any solution to be availed. It is more of their department and therefore directly
affects them.
With some adjustments, the controls in the previous models can be used (Iken,
&Agudelo, 2017, 255-266). The highest risk vulnerability is the transaction from the payer to
the company. Therefore, adjusting the control for the payer will improve aspects of user
identification and even location will go a long way reducing the vulnerability risk. The
transaction from the company to the supplier is also vulnerable but the risk is not as high
(Ross,& Hannan, 2007, 109). It is also of importance to evaluate account holders information
online verify the user details and habits as this pose potential risks. The main risk from this side

PAGE \* MERGEFORMAT 21
would be that the company is running on criminal activity and uses the cash from the leasing
company to clean up their money as they acquire product to lease.
iv.
The Know Your Customer (KYC) control is the first and most important control that
ought to be developed (Madinger, 2016). It will help to reduce risk on both ends of the
transaction. The KYC control would comprise of customer acceptance policy, customer
identification and transaction monitoring. With this control ,the biggest vulnerability for online
bank transfers and payments which is anonymity is removed and transactions can now be
accredited to specific individuals. This assumption is based on either lack of a KYC control in
BSL or an ill performing one that necessitates an upgrade to avoid vulnerabilities. The next
control would be the access control, more specifically logical access control. This control will
limit the network (Ross, & Hanna,,2007, 110) system files and data that both suppliers and
consumers can access on BLS online and therefore allow users to leave a digital footprint. This
type of control also reduces the possibility of untraceable transaction, bank transfers and
payments because all transaction take place on one network.
The final control included would be a clearing control (Ryder,2015). This control will
work effectively for transaction, bank transfers and payments made online from credit cards or
bank account because it allows for verifying of user information and completion of the
transaction will the ability to keep record of all transactions made. The order of priority will be
as the controls have been stated above. The first control that should incorporated is the KYC,
followed by the access control and finally the clearing control. The last two can be installed once
the product has ‘gone live’ since they work when the system is up and running.

PAGE \* MERGEFORMAT 21
v. (transcript of video in (iv.) above.
Question b (i)
The main objective of the KYC control is to be able to acquire potential client
information and using the vetting processes lined up to determine whether the customer is a
vulnerability factor to the company or not. The design will entail prompting first time users to
log in, which entails user identification and verification. The information required at this point is
personal and unique to all individuals (Teffera, Sadagopan,& Nunes-Vaz,,2004., 164) Once the
individual is logged in, the next stage through a series of question will determine the individual’s
source of wealth, perform sanction screenings and a risk scoring. If the individual is deemed high
risk, further due diligence with be required from a manager but a low risk individual with be
accepted into the system and allowed to start transacting. A high-risk individual who is still high
risk after due diligence will be denied membership (Kilcullen, 2005, 609). This is a perfect
systems that will go on to identify Politically Exposed Persons (PEPs) and help the company to
either avoid such people because they draw a high level of attention to themselves or look for a
way in which to manage such people. PEP’s are ranked as high risk factors for money launders;
the launders do not necessarily look for this type of customer but rather look for what such
people possess which include high value accounts that are valuable to any money laundering
business. PEPs can also be corrupt and or have poor history with lending and credit facilities.
Use of such a system as this that verifies customers and allows access and or enrollment to
customers that are approved is a long way in ensuring the taming of money laundering at
registration or intake of customers.
(ii,iii & iv)