AML Culture: How to Effectively Measure & Manage it

We are fixated with AML/CFT/CPF regulations, but even the most comprehensive checks and controls cannot work if a firm has a poor culture. In this context, I am using the term “culture” to mean the attitude of a firm’s leadership and wider employees, to the prevention of money laundering, terrorist financing or proliferation financing.

Culture determines how people act when no one is watching

Banks and financial institutions around the world have broadly similar regulatory rules, yet some seem to slip on every banana skin they see, this is more down to their individual cultures rather than bad luck!

After Danske Bank’s Tallinn woes, which resulted in fines amounting to $2bn (and a clear out of their Board) and Credit Suisse’s slow-motion demise (after a string of financial and compliance failings) culture has never been more important!

Baker Regulatory, Jersey based compliance experts, are hosting a webinar on 30 March to disucss how firms can assess their AML culture. To register, click here.

1. How to Assess AML Culture

The big question is whether a firm’s AML culture be assessed and, if so, can it be objectively measured?

Culture is a very wet bar of soap, the tighter you grab it the more it slips away

Culture cannot be directly “measured” since it cannot be quantified, but we can identify indicators of culture which are measurable, for example firms with a good culture generally have less sick days, lower staff turnover, fewer customer complaints and less regulatory scrapes.

2. AML Culture Proxies

Focusing on AML, at Dynamic-GRC, we have found that cultural proxies can be broadly grouped as follows:

• Board Oversight – knowledge, interest and engagement
• Planning – quality of risk identification and mitigation planning
• Resourcing – experience, expertise, number of people, technology and data
• Implementation – monitoring AML checks/controls and issues management/resolution
• Training – identifying training needs and delivering training relevant to employees
• Openness – whether people can raise AML issues without adverse outcomes

3. Cultural Perspectives

Firms are not homogeneous; everyone has an opinion and opinions tend to vary according to a person’s position.

Front office personnel often see AML as being “business prevention” and think their firm is overly cautious while people with a pure compliance role tend to see regulatory problems everywhere they look. Neither perspective is “wrong”, but they show the importance of surveying a whole firm to build a comprehensive 360° assessment.

When speaking about a firm’s culture with Board Directors they often assume their firm’s culture reflects their own. But believing everyone in a firm shares the same commitment to AML can lead to serious failings, especially if people are rewarded solely on financial performance without reference to operating good AML risk management practices.

4. AML Surveys

In recent years firms have begun to use survey tools to better understand their customers and employees. Using a survey tool is a great way to get an insight into a firm’s performance.

Focusing on a firm’s AML culture, using anonymised and well crafted questions, can tease out valuable information which management can use to identify weaknesses and challenges, as well as areas of strength.

At Dynamic-GRC we add propriety “risk scores” to the questions in our AML 360° Assessment which means that the results which easy to objectively assess.

5. Culture Scoring

While assigning risk scores to questions is judgemental, at Dynamic-GRC we believe it is better to start with a simplistic methodology which is explicitly disclosed as part of a final assessment.

Once an firm has adopted culture scoring it is possible to finesse the methodology to aid the understanding of current culture, assess how the culture is changing and the best methods to drive improvement.

As firms become more familiar with assessing and scoring their culture, they can introduce more complexity to draw out information as required.

Anonymity in most staff surveys is critical. If respondents know their answers are going to be shared with their management, the whole assessment will be compromised.

Surveys have to be anonymous if firms want respondents to answer truthfully, and the best way to ensure anonymity is preserved is to engage with external experts.

6. AML Culture Assessment

Modern analysis tools, like MS PowerBI, Qlik and Tableau are excellent at presenting managers with data in a meaningful way. Multiple columns of data are impossible to “see”, but put the same data in a chart/graph and information jumps off the page.

Charts and graphs give culture assessments a “colour” and ensures the results jump off the page.

Once the cultural assessment charts and graphs are available they can be used to refine the data, for example, senior management might want to ask additional questions, change risk scores or focus on other topics.

7. And Finally...

In future articles we will explain why a firm’s AML culture can render even the best AML control framework ineffective?and explore how firms can promote better compliance through cultural change.

For more information on how to assess your firm’s AML Culture, do contact Barry Faudemer (CEO of Baker Regulatory Services) or me, Adrian Pay (Director of Dynamic-GRC).

Webinar: Assessing AML Culture

To register for Baker Regulatory’s webinar on How to Assess Your Firm’s AML Culture, click here.