Across the world, increased concern about money laundering and terrorist financing has led to expanded due diligence requirements for certain industries. While there already existed a strong regulatory environment when it came to Anti-Money Laundering (AML)/Know Your Customer (KYC) programs, recent trends have shown these regulations are only increasing. In the European Union, 2017 saw the implementation of a Fourth AML Directive, which also expanded the scope of requirements for regulated industries. In the United States, the Financial Crimes Enforcement Network (FinCEN) issued the final rule on beneficial ownership that will go into effect in May 2018. As with other KYC research, covered companies, such as brokerages, real estate firms, or financial institutions will need to use creative analysis to properly identify beneficial ownership. 

Take, for example, an online securities brokerage company, which accepts both individuals and entities as customers. While the new rules will have limited impact on requirements for individuals, that online brokerage firm will have to increase its capabilities to meet the floor of FinCEN’s requirements for entities. As a component of its KYC program, the brokerage will need to identify all of those who own 25% of a company (the ownership prong), as well as a single party (the control prong) who exercises significant control of the business.

Customer Due Diligence programmes

When carrying out its Customer Due Diligence (CDD) programme, the brokerage firm must compile certain data from customers, though there are no specific requirements as to what this data must include per the upcoming rules. According to the Association of Certified Anti-Money Laundering Specialists (ACAMS), the brokerage firm should require multiple pieces of information; in addition to baseline CDD documentation, information pertaining to the customer’s occupation or industry, source of wealth, and annual income should also be requested. Researchers can use this information to validate the identities of beneficial owners. While some of this information is available in commercial databases, there is ultimately a limit on the utility of those databases. In addition to false positives, databases do not offer a complete picture. Instead, it is a good idea to supplement database and automated research with deeper dive open web research to strengthen findings. 

There are several tools and sources used for traditional KYC due diligence that are particularly useful for identifying and confirming beneficial ownership. Searches through social media platforms can be particularly useful for identifying the control prong of the beneficial ownership requirement; however, as with everything on social media sites like LinkedIn or Facebook, those shouldn’t be used as an authoritative source of information given the data is self-reported by a user of a profile. Instead, company websites, or even better, Securities and Exchange Commission (SEC) documents, are far more reliable, especially when confirming those who own a significant stake in the company. For foreign companies, the availability of such documentation varies depending on jurisdiction. In the United Kingdom, for example, the Companies House website makes numerous corporate documents easily accessible, though for a company registered in the Cayman Islands, official records are much harder to come by. 

While there is certainly nothing inherently nefarious about registering a company in jurisdictions that offer more privacy, it can increase the difficulty in confirming beneficial ownership. For example, some customers may use the privacy of certain jurisdictions to establish shell companies and mask their ownership of other companies. You may find instances where there does not appear to be a direct link between a legal entity customer and certain individuals; however, these individuals may have ownership stakes two or three times removed. In these cases, the best tool is an investigator’s inherent curiosity and willingness to dig beneath the surface level. 

Simple database checks are not enough

In one such case study conducted by Prescient, an individual had used several layers to distance his ownership from the legal entity customer a client needed to vet. This individual was the sole owner of a company registered in Belize. The Belizean company owned 100% of another company registered in a separate country, whose subsidiary ultimately owned a significant stake in a Russian investment bank that was of interest to the financial institution conducting this particular KYC check. This is actually a fairly common situation, and a lack of transparency is one of the biggest challenges to properly determining beneficial ownership. Using a variety of company documents, including shareholder documents, the analyst working on the case was able to trace this ownership and provide a clear picture of the individual’s stake in this company, as well as several others. In this instance, simple database checks proved insufficient, and the success of the due diligence check was a result of the analyst’s ability to follow the relevant investigative threads. 

In this changing regulatory environment, businesses must be increasingly thorough in identifying questionable activity on the part of their customers. Automated checks and a singular reliance on databases are rapidly becoming insufficient as they typically miss the kind of red flags noted above. Compliance teams, either on their own or with third-party assistance, will need to be even more creative in their approach. While the future of financial regulations is far from certain, it’s important to remember that these regulations are a floor, rather than a ceiling—just as risk increases, so should mitigation.