The priority for Transaction Monitoring will always be to make sure that you cover the risks you face today.
But to have meaningful durability your plan should also anticipate future risks.
Will your Transaction Monitoring still cover those risks in three years, once the business has launched new products, added customers and started moving money in new ways?
Look at your TM plan for the next year. Count the activities that have been driven by an audit finding, a vendor renewal or a question from the regulator. Those items give you a good idea of where your TM needs improvement today, but they may say little about where the business is going.
The Money Laundering Regulations 2017 expect firms to plan ahead. Regulation 19(1)(b) requires firms to review and update their policies, controls and procedures on a regular basis. Regulation 19(4)(c) requires firms to assess and, where necessary, mitigate the money laundering and terrorist financing risks arising from new products, new business practices (including new delivery mechanisms) or new technology, before and during implementation.
We use five questions to build a TM plan which reflects what the business needs - today and in the near future.
Question 1: Where is the business going?
Start with the business plan. Look for likely changes over the next three years which alter what monitoring needs to see:
-
Products and services you will launch
-
Customer segments you will target
-
Countries you will enter
-
Payment rails and partners you will add
-
Expected growth in customer numbers and transaction volumes
Run each change through the TM risk assessment (TMRA). Which financial crime risk typologies does the change introduce or increase? Does TM need a role in detecting them? A new business banking proposition might bring invoice fraud, trade-based money laundering and higher cash volumes. A move into international payments might raise the inherent risk of sanctions evasion and cross-border layering.
The output is a forward-looking TMRA. The TMRA shows the financial crime risk typologies you expect to face, the business changes which introduce or increase them, and the priority each typology will carry.
Question 2: Where are you starting from?
Before deciding what needs to change, establish where you are today. If you worked through the four validation steps in our previous article, you already hold most of the baseline: coverage gaps, data quality issues, control weaknesses and validation outcomes for today's high and medium priority financial crime risk typologies.
Add the operational picture:
-
Alert volumes and their trend over the last two years
-
Age of the alert and case backlog
-
Quality assurance results
-
Average time from alert to decision
-
Open findings from internal audit, the regulator or a skilled person review, with committed dates
Then record the constraints. When does the vendor contract end, and what notice period applies? Will the platform handle double today's volumes? Which data feeds rely on systems the business plans to retire? Which skills sit with one or two people?
Expect the baseline to show gaps against growth the business has already approved.
Question 3: What needs to change, and in what order?
Compare the forward-looking TMRA with the baseline. The difference is your work list. Group the work into five themes so people outside the TM team can follow the plan:
-
Risk coverage: new or redesigned scenarios for the financial crime risk typologies which planned business changes introduce or increase
-
Data: new feeds, fixes to existing feeds and the reconciliation proving each feed works
-
Technology: platform capacity, upgrades or replacement
-
People and operating model: analyst numbers, skills and team structure
-
Governance: ownership, change control and management information
Three factors should set the order of your work list.
Dependencies come first. Don't design a new scenario before the data reaches production. Don't redesign scenarios six months before a platform change. Sequence the work so each piece supports the next.
Business dates come second. If a product launches in 18 months, design, build and test the monitoring well before launch day.
Priority comes third. Put work tied to high-priority financial crime risk typologies and open regulatory findings first.
Question 4: Do you have the resources?
Plan for two kinds of capacity: operational and change.
Operational capacity covers the analysts working alerts. Alert volumes grow with customers and transactions, but not in proportion. A new product or customer segment often generates more alerts per customer than your existing book until you tune the rules. Forecast alert volumes against the business plan. Convert the forecast into analyst numbers. Add the time needed to recruit and train new investigation analysts.
Change capacity covers the people delivering the plan. The people who know your rules, data and platform best usually run TM every day. Give them a major programme on top of their current work and delivery slips. Decide early where you need extra resource. Secure the resource before work starts, through backfill for current roles or external support.
Put a cost on the plan. Senior management needs three answers to weigh TM investment against other budget demands: the cost, the benefit and the impact of deferral.
Question 5: How will the plan stay current?
If you write a three-year plan once and file the document, the plan will be out of date within a year. Products launch early or change scope. Business priorities change. New threats emerge after sign-off.
Give the plan a named owner and take the plan to the committee which controls budget for approval. A plan with senior sign-off is harder to deprioritise when budgets tighten. Review the plan at least once a year alongside the TMRA, and report progress in the management information your committee already reviews.
Build the plan into the firm's change process. When someone proposes a new product, payment rail or major technology change, ask what the change means for TM and whether the plan needs updating. This control does more to keep TM aligned with the business than an annual review.
Record what the plan excludes. If a known risk sits outside the current plan, document the reason, the person who accepted the decision and the date for review.
What good looks like
Every major initiative in a good TM plan should be traceable back to a reason:
-
A financial crime risk typology the business is introducing
-
A coverage gap
-
A data issue
-
A regulatory finding
Show that planned business changes have been assessed before go-live, and how monitoring is being delivered in line with the updated TMRA. Explain the order of the work, the owner of each piece, the cost and how capacity keeps up with growth.
Anyone looking at your TM plan and your business plan should see that they relate to the same firm. When the business changes direction, TM should change with the business, before the new risk arrives.
Sources
1. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, Regulation 19(1)(b) and Regulation 19(4)(c).
