Third-Party Compliance Archives - Compliance Chief 360

The Complete Guide to Vendor Risk Assessment

AuditBoard — Wed, 20 Nov 2024 21:52:14 +0000

Vendor risk assessment and vendor risk management are crucial aspects of any business, especially in today’s interconnected world. Fill out the form at right and hit “Submit” to get the report.

As companies increasingly rely on third-party vendors for various services and products, it becomes essential to assess and manage the risks associated with these relationships. A robust vendor risk assessment program can help organizations identify potential risks, mitigate them, and ensure the security and compliance of their vendor network. In this comprehensive guide, we will dive deep into the world of vendor risk assessment, covering everything from the basics of vendor risk management to best practices for third-party vendor risk assessments and steps to take in case of a vendor breach.

FILL OUT THE FORM AT RIGHT TO DOWNLOAD THE REPORT >>

The Complete Guide to Vendor Risk Assessment

Complete the form to receive an email with a link to the Report.

Please enable JavaScript in your browser to complete this form.

Name

First

Last

Business Email

Name Job Address

Company or Organization

Job Title

Address

Address Line 1

Address Line 2

City

State / Province / Region

Postal Code

Country

Phone (optional)

The post The Complete Guide to Vendor Risk Assessment appeared first on Compliance Chief 360.

Compliance Lessons from Wells Fargo: Four Questions to Ask Your Payment Solution Provider

Anna Fron — Thu, 31 Oct 2024 16:12:43 +0000

ells Fargo’s recent disclosure of regulatory investigations related to its anti-money laundering (AML) and sanctions programs and agreement to “work with U.S. bank regulators to shore up its financial crimes risk management” serves as a timely reminder of the ongoing importance of robust compliance measures in the financial sector.

These events underscore the need for vigilance at all levels of the industry, from major institutions to smaller financial companies, and further highlight the critical role of due diligence in selecting and monitoring payment solution providers for compliance officers, risk practitioners, and internal audit executives.

To that end, here are four essential questions to ask when evaluating potential partners, informed by the latest industry developments:

1. How comprehensive is the BSA/AML compliance program?

A robust Bank Secrecy Act and Anti-Money Laundering (BSA/AML) compliance program is vital to any financial institution’s risk management strategy. When evaluating a provider’s program, look for well-defined internal policies and controls. These should include a documented BSA/AML policy that outlines the organization’s approach to identifying, assessing, and managing money laundering and terrorist financing risks.

The policy should encompass clear customer identification procedures, risk-based customer due diligence processes, and transaction monitoring systems. Additionally, it should detail suspicious activity reporting procedures and record-keeping practices that meet or exceed regulatory requirements. Equally important is a defined process for staying current with regulatory changes and implementing updates promptly.

A dedicated compliance officer should oversee these efforts. This individual should possess relevant experience in BSA/AML compliance, appropriate certifications, and have direct access to senior management and the board of directors. They should be empowered to implement necessary changes across the organization.

Another crucial element is ongoing, comprehensive training. Look for providers that offer role-specific training tailored to different departments, annual refresher courses for all staff, and ad-hoc training to address new regulations or emerging risks. The training program should include testing to ensure comprehension and retention of key concepts, with all activities documented for audit purposes.

Finally, the provider should conduct rigorous auditing and monitoring. This includes regular internal audits of all BSA/AML processes, periodic independent third-party audits, and continuous monitoring of transactions and customer activity. There should be a straightforward process for addressing and remediating audit findings, with regular reporting to senior management and the board on audit results and program effectiveness.

2. Who comprises the compliance team?

The expertise of the compliance team is crucial in navigating complex regulatory landscapes. Look for a diverse team with a mix of legal, financial, and technological expertise.

A well-rounded team might include a chief legal & compliance officer, corporate counsel, senior compliance analysts, a finance settlement manager, information security leaders, and an operations director. This diversity helps ensure a comprehensive approach to compliance and security, reducing the risk of oversight that could lead to regulatory issues.

3. How does the organization embed compliance responsibilities across all departments?

Compliance should not be confined to a single department but should be integrated throughout the organization. A company-wide commitment to compliance should be evident through clear statements from leadership emphasizing its importance, inclusion of compliance objectives in departmental and individual performance metrics, and regular compliance updates in company-wide communications.

Training should extend beyond the compliance department. Look for providers that offer role-specific training illustrating how compliance impacts different job functions. Scenario-based learning can help employees identify and respond to potential compliance issues. The use of multiple training formats can cater to different learning styles, ensuring comprehensive understanding across the organization.

Clear communication channels for reporting potential issues are essential. This includes an anonymous whistleblowing hotline or reporting system, a defined escalation process for compliance concerns, and protection for employees who report potential violations. Regular reminders about these reporting channels reinforce the importance of speaking up.

A culture of compliance is characterized by the incorporation of compliance considerations into all business decisions and processes. This might include recognition for employees who demonstrate strong compliance behavior, zero tolerance for willful non-compliance regardless of an employee’s position, and regular compliance “town halls” or Q&A sessions to foster open dialogue about compliance matters.

4. What is the approach to regular internal audits and regulatory examinations?

In light of increased regulatory scrutiny, regular, independent audits are crucial. Inquire about the frequency and scope of their audits, including how often internal audits are conducted, what areas they cover, and how findings are categorized and addressed.

The provider’s relationship with regulatory bodies and sponsor banks is also important. Ask about their interaction with regulators outside of formal examinations, participation in regulatory outreach events or industry working groups, and their track record with past regulatory examinations.

A strong provider will have a formal process for reviewing and acting on audit and examination findings. This should include tracking and validating corrective actions, measuring the effectiveness of implemented changes, and sharing learnings across the organization.

Staying updated on regulatory changes and industry best practices is crucial. Look for providers that subscribe to regulatory update services, have relationships with outside counsel or consultants for complex regulatory matters, and participate in industry associations or forums.

Finally, inquire about their approach to continuous improvement. This might include using data analytics to enhance compliance programs, conducting regular risk assessments to identify potential gaps or emerging risks, and benchmarking their practices against industry peers.

Proactive Compliance in a Complex Regulatory Environment

The recent Wells Fargo disclosure reminds us that compliance is an ongoing process requiring constant attention and proactive measures. For compliance officers, risk practitioners, and internal audit executives, this underscores the importance of thorough due diligence when selecting and monitoring payment solution providers.

By asking these four key questions and critically evaluating the responses, you can significantly mitigate risks and ensure a more secure financial ecosystem for your organization. Remember, in today’s regulatory environment, compliance isn’t just about meeting minimum requirements—it’s about fostering a culture of integrity and security that permeates every aspect of your operations.

As you evaluate potential payment solution providers, look for partners who share this philosophy and demonstrate a commitment to excellence in compliance and security. In doing so, you’ll not only meet regulatory requirements but also build a foundation of trust with your customers, stakeholders, and regulators—a crucial asset in navigating today’s financial landscape.

Anna Fron is Chief Legal and Compliance Officer at Dash Solutions, a platform that provides digital payments and engagement program management to thousands of customers.

The post Compliance Lessons from Wells Fargo: Four Questions to Ask Your Payment Solution Provider appeared first on Compliance Chief 360.

FINRA Fines UBS for Its Failure to Monitor Customer Fund Transfers

Jacob Horowitz — Thu, 11 Jul 2024 20:32:54 +0000

The Financial Industry Regulatory Authority announced that it has fined UBS Financial Securities $850,000 for the brokerage’s failure to monitor the transfer of customer funds to third parties and respond appropriately to any red flags indicating potential private securities transactions. The penalty stems from UBS’s failure to detect that one of its brokers sold securities to his clients that were offered by a third party, an entity formed by the broker’s college friend.

According to FINRA’s order, the broker “facilitated at least 30 UBS customers’ investments in private securities transactions totaling over $7.2 million.” From 1997 to 2021, the UBS representative sold to at least 30 of his UBS customers a “fixed annuit” product offered by an entity formed by the rep’s college friend and business acquaintance. FINRA claims that although the UBS customers believed they were investing in a “fixed annuity” product, they were actually investing in riskier private securities.

FINRA is holding UBS responsible for the broker’s fraudulent practices on account for the fact that its supervisory systems were not reasonably designed to achieve compliance with the firm’s obligation to monitor transmittals of customer funds to third parties. Although the firm automatically flagged for heightened review wires that met certain criteria (e.g., the wire was the customer’s first domestic wire in six months), its automated system did not detect and monitor for instances in which multiple, unrelated customers transferred funds from their UBS accounts by check or wire to the same external party.

UBS Failed to Investigate the Private Transactions

FINRA also notes that UBS should have systems better designed to flag private securities transactions. For at least 17 of the wire transfers to the third party, the reason the customers provided for the wire transfer request was “investment.” UBS flagged the wires for additional review and approval but did not investigate why the representative’s customers were wiring money to the same external, non-UBS entity for an “investment.”

UBS also failed to reasonably investigate several instances from September 2010 to July 2021 in which at least two customers wired money to the third party within the same 30-day period. As an example, in March 2021, two unrelated customers wired a total of $47,000 from their UBS accounts to the third-party entity within eight days of one another. Although UBS flagged both wires for additional review and approval, the firm did not investigate why two of the broker’s customers were wiring money to the same external party.

As a result of UBS’s failures to monitor its customers’ wire transfers, the firms violated NASD Rules 3010 and 3012 and FINRA Rules 3110 and 2010. When the scheme was uncovered, it was discovered that the customers lost most of their funds and UBS repaid the customers more than $17 million in restitution.

Jacob Horowitz is a contributing editor at Compliance Chief 360°

The post FINRA Fines UBS for Its Failure to Monitor Customer Fund Transfers appeared first on Compliance Chief 360.

Achieving Compliance Efficiency Through Automation

Camilla Yellets — Tue, 09 May 2023 18:50:57 +0000

GUEST BLOG
Effective due diligence is critical to establishing relationships with customers, suppliers, and other third-parties that drive strong revenue generation.

How can businesses, including banks and finance companies, balance effective anti-money laundering (AML) efforts, know your customer (KYC) workflows, customer due diligence (CDD), and third-party risk rating workflows with the levels of efficiency that today’s competitive market and contentious geopolitical climate demand?

The answer can be found through automation. Automating critical due diligence activities helps center a financial compliance program at the intersection of efficiency and effectiveness.

Converging Challenges Are Complicating Compliance

Businesses are dealing with a convergence of due diligence challenges stemming from digital acceleration, geopolitical volatility, and renewed regulatory focus. Resource-strained compliance teams also face increased budget scrutiny as the global economic outlook increasingly reflects inflation pressures, supply chain problems, and the impact of Russia’s invasion of Ukraine.

Regulators and enforcement agencies are also increasing activity levels. Enforcement actions from the Financial Crimes Enforcement Network (FinCEN), for example, were edging back up in 2022 and some recent fines are retroactive. FinCEN is showing little tolerance for anti-money laundering programs that do not pair business growth with compliance capabilities.

Zero tolerance equally characterizes today’s digital consumers whose expectations for instant transactions are at an all-time high. Due diligence delays and productivity lags at onboarding can quickly add up to consumer abandonment and lost revenue.

The unprecedented volume, velocity, and scope of sanctions and regulatory actions stemming from Russia’s invasion of Ukraine add another layer of complexity and resource demands to due diligence workflows. It is an understatement to say doing much more with less is turning into a daily compliance struggle for many organizations.

The Marriage of Efficiency and Effectiveness

An efficient due diligence workflow is meaningless if it doesn’t underpin a highly effective, risk-based approach to compliance. However, effective due diligence shouldn’t erode the speed of day-to-day business operations or customer experience. There are many ways automation can help answer the efficient and effective conundrum.

Automation tools and technologies, such as application program interfaces, machine learning, and artificial intelligence, can help accelerate risk assessment and decisions at key points in due diligence workflows. It is important to evaluate the operational advantages a business can achieve with automation within the framework of regulatory requirements and expectations. These include:

Automating the collection of the documentation needed during onboarding. This reduces workflow delays while also contributing to effectiveness by raising the level of process consistency and providing a way to record and prove the collected documents as needed.
Automating AML and KYC screening enables a business to prioritize accounts that need further investigation or enhanced due diligence and provides a higher level of traceability to help demonstrate the effectiveness of risk-based policies.

Automation helps businesses segment workflows more effectively. Organizations can redeploy human capital resources to focus on higher value compliance decisions and activities by automating more routine due diligence processes.

Finding Balance on the Risk/Control Continuum

Digital acceleration and today’s rapidly evolving regulatory climate are creating dynamic due diligence risks. Static due diligence approaches, siloed functions, and disparate data limit an organization’s ability to outpace risk. Missed status changes in customer and supplier relationships can be detrimental in today’s real-time economy.

Leveraging automation to support a continuous approach to risk-based due diligence helps better align enterprise resources to support the execution of internal policies around customer risk rating and ongoing monitoring. Automation facilitates the ability to capture a more holistic and end-to-end view of due diligence risk that enables an organization to responsively manage the inherent customer and supplier risks in a controlled framework. The technology fueling automation also underpins improved compliance effectiveness by providing a clear framework to document, demonstrate, and defend compliance policies and risk controls.

Using automation to integrate due diligence intelligence across core enterprise processes delivers time savings and cost efficiencies while contributing to a more responsive compliance program.

Perfecting the efficiency and effectiveness equation can result in a due diligence workflow that respects an organization’s risk appetite and reflects evolving market and regulatory realities.

Camilla Yellets is director, financial crime compliance, at LexisNexis Risk Solutions.

The post Achieving Compliance Efficiency Through Automation appeared first on Compliance Chief 360.