Introduction

"If there is a book that you want to read, but it hasn't been written yet, you must be the one to write it."

— Toni Morrison

About This Book

As we all know there is no magical formula for implementing pain-free anti-money laundering (AML) information systems in financial services organizations. And we also know that sharing of knowledge and best practice is critical for compliance professionals in financial institutions (FIs) to combat money laundering and terrorist financing. There have been many books on AML compliance, most of them focus on statutory, legal, regulatory compliance and business subjects but very few (only some consulting firms' white papers, not books) touch the AML information systems (IS) technical implementation in great detail. This has motivated me to write an introductory book about AML information systems implementation, from a practitioner's point of view, to share the germane experience I have gained from my previous AML and other compliance projects/programs, as well as to share the accumulated knowledge I have learned from industry subject matter experts on both compliance side and Information Technology (IT) side. Hopefully this book could provide some practical details to address some pain points in AML information systems implementation for fellow AML compliance practitioners.

In this book, an AML information systems implementation refers to an implementation of brand new or enhanced/updated or migrated AML information systems.

The Target Audience and Scope of This Book

This book is intended for compliance professionals, IT professionals and business stakeholders who are working on AML or Financial Crime Risk Management information systems implementation. And hopefully anyone who is interested in AML or financial crime risk management information systems implementation could also use this book as one of the reference sources.

Most topics discussed in this book are for banks in the United States and Canada, but the principles and frameworks mentioned in the book could also be utilized in AML information systems implementations for insurance companies, asset/investment management firms and securities dealers/ brokers in North America or other jurisdictions even though different type financial institutions have different AML regulatory requirements in different jurisdictions.

In Chapter 2 and Chapter 3, an overview of the most common and important topics in AML compliance and related information systems is provided, but readers are assumed to have some basic knowledge of financial services industry and information technology.

This book focuses on the AML information systems technical implementation, especially the implementation/project planning, and current state, future state, gap analysis as well some technical solutions/ practical approaches. The following three compliance software modules are out of the scope of this book:

1. The implementation or integration of an organization's Governance, Risk and Compliance (GRC) module.

Today, many financial institutions adapt the holistic GRC approach to comply with the numerous statutory, legal, and regulatory requirements. But GRC functions are not necessarily administered by the AML compliance program but rather by the enterprise risk management (ERM) department in an organization. Also, the implementation of a GRC platform is not dependent upon and is not necessary to have been completed earlier than the implementation of AML information systems in financial institutions.

2. The implementation or integration of an organization's AML training module.

Per the regulatory requirements, most financial institutions already have AML training programs in place prior to the AML information systems implementation, and very likely, other department(s) in the organization might own the training software and be responsible for the administration and coordination of training software usage.

3. The implementation or integration of an organization's internal auditing module.

Internal auditing tools are usually not dedicated to AML compliance only. And the implementation of internal auditing tools is very likely not dependent upon the implementation of AML information systems in financial institutions.

The technical discussions in this book are software vendor agnostic and platform neutral. Although the emphasis of this book is on AML information systems implementation, I strongly believe the planning methodologies and solution approaches could also be applied to the implementation of financial crime risk management information systems/ modules in the following areas:

• Anti-Bribery and Anti-Corruption (ABAC) (Foreign Corrupt Practices Act (FCPA) in U.S. and Corruption of Foreign Public Officials Act (CFPOA)/Canadian Criminal Code in Canada)

• Foreign Account Tax Compliance Act (FATCA)

• Fraud (including but not limited to banking fraud, investment fraud, employee fraud, tax fraud, senior/elder abuse, identity theft and other financial frauds)

• Market Conduct

• Cyber security related financial crimes

Of course, each type of financial crime has its own characteristics and red flags, but all of them do share many commonalities, in particular some common information/data elements about customers, accounts, transactions and etc.

How This Book Is Organized

The rest of this book is organized as follows. Chapter 2 provides an overview of AML laws and regulations in the United States and Canada first, and then emphasizes the key components of a sound AML compliance program in a financial institution. Chapter 3 covers an overview of key AML information systems available in the market, and then looks at some common features in two key system components, watch-list screening and transaction monitoring modules. Chapter 4 describes some challenges of AML information systems implementation first, and then proposes a unified implementation planning framework: from stakeholder analysis and the implementation governance model, up to activity breakdown for implementation planning and some other implementation management considerations. Chapter 5 discusses the practical solution approaches in the whole life cycle of AML information systems implementation – pre-deployment, deployment and post-deployment stages. In the pre-deployment part, topics of the current state, future state and gap analysis, business requirements, Commercial Off-The-Shelf (COTS) systems/vendors selection, systems specifications, architecture and design, systems building and testing are discussed. In the deployment part, topics of data loading/migration, configuration settings, production readiness check, information security, business continuity planning (BCP) and disaster recovery planning (DRP), documentation and training are discussed. In the post-deployment part, topics of support and operations,...