From banking to compliance: what (not) to expect

Introduction

Can you explain your experience in banking and your career path?

I have been working in banking since 1991, with the last 30 years within international banking. In that time, I have held various positions: I started in IT, then worked in operations, finance, product control, market risk, and markets and treasury. These were always relatively short assignments of 3 to 4 years.

My role typically involved overseeing changes, such as introducing new products, launching new activities, or leading improvement initiatives. This allowed me to gain a deeper understanding of how a bank operates, providing me with a comprehensive view of the various departments. While my work primarily focused on the bank’s core functions, I also indirectly engaged with compliance matters.

Looking back, my role was a blend of interim management and consultancy. In addition to overseeing change projects, I also managed departments. What I particularly enjoy about change projects is working towards a tangible result. Once that goal is achieved, you can move on to the next challenge.

What can you tell us about your most recent switch?

Since October 2023, I switched to Financial Economic Crime (FEC) Compliance. While I had dealt with FEC indirectly in the past, the focus on it was not as intense as it is now, largely due to the increasing stringency of laws, regulations, and oversight.

FEC at Rabobank, like other banks and financial institutions, is attentive to developments among our customers. In the Netherlands, for example, online payments are increasingly made through Payment Service Providers (PSPs) such as Adyen and Mollie. Crypto is also a growing trend. In one of my projects, for example, I am working on managing these dynamic risks.

Another project I’m involved in, drawing on my practical experience in international banking, focuses on strengthening FEC controls within the international banking sector. In my current role, I can use my expertise to help detect and prevent financial economic crime, making a meaningful contribution to the client, the bank, and society as a whole.

From banking to compliance: observations and surprises

What struck you about the transition to FEC Compliance in terms of working methods, culture and communication?

The commercial and FEC sectors operate in separate worlds, each with its own terminology and perspectives. For example, when the commercial side refers to a “transaction,” they mean the agreement or contract, while FEC refers to the settlement or the actual execution of the payment. Although the same word is used, it’s often mistakenly assumed they are discussing the same thing, when in fact, they are referring to different aspects of the process.

Another difference is that the operational side often settles for an 80% solution, planning to address the remaining 20% later. In contrast, FEC typically strives for a 100% solution, possibly due to a lower sense of urgency or, more likely, the need to fully mitigate all risks. Any risks left unaddressed continue to pose a problem.

Based on my experience, fostering greater collaboration between FEC and the commercial side of the business is crucial. FEC staff often work in their field for extended periods and may lack in-depth knowledge of the broader banking business. Conversely, it can be challenging to attract individuals with a banking background to FEC positions. Ideally, there should be cross-fertilization and knowledge transfer, with professionals rotating between FEC and business roles to enhance understanding and cooperation on both sides.

FEC primarily requires logical thinking to identify risks, such as money laundering or fraud. If you understand business processes, interpreting these risks becomes straightforward. However, I’m still getting accustomed to the specific terminology used in FEC. While the bank is already heavy on abbreviations, FEC adds another layer, which can complicate internal communication between departments. For instance, those in Commercial may not know what a SIRA is (a Systematic Integrity Risk Analysis required by the Dutch central bank DNB to assess financial-economic crime risks). On the positive side, FEC terminology is standardized across banks, so I can easily discuss topics like SIRA with FEC Compliance departments at other institutions.

In retail banking, a lack of business knowledge is less problematic because the products are simpler and people are generally familiar with them through their personal banking experiences. However, in international banking, this issue is more significant due to the complexity of products, the global nature of operations, and varying regulations or processes across different foreign branches.

Can you give examples of areas of improvement for FEC departments, besides working on the knowledge gap?

I believe there is potential for better collaboration. In my experience, FEC often identifies a risk and seeks to address it independently, rather than consulting with other departments to find the best bank-wide solution. They tend to view FEC risks as solely their responsibility. However, many of these risks can be managed earlier in the value chain, though this can be more challenging to measure and demonstrate. While FEC can address risks at the back end, such as through transaction monitoring, it’s important to evaluate the cost/benefit ratio. Some residual risks may be minimal and could be accepted temporarily, or it might be more effective to implement controls earlier in the process.

One aspect that plays into this is risk tolerance. Who determines risk tolerance?

Risk tolerance is determined in several ways: driven by laws and regulations, bank policy and who is (ultimately) responsible for what. At Rabobank, that responsibility is vested at board level, with Rabobank also having a board member solely responsible for FEC. Ultimately, risk tolerance will be determined by the respective board members (commercial and FEC).

Learning from banking: closing the knowledge gap

You mention that there is too little cooperation and cross-fertilization is needed. How can FEC and operations work better together?

Communication is key. For example, there are instances where the commercial business may assess risks as higher than FEC does. FEC, with its regulatory expertise, can better evaluate the implications from a regulatory standpoint. By sharing perspectives—explaining how each party views the risks, the potential impact on customers, and the regulatory intent behind specific rules—we can develop the most effective approach for both the customer and the bank. Collaborative learning between FEC and the commercial business will enhance our ability to serve both clients and the bank more effectively.

I think it would be good to involve FEC more and early in commercial consultations. That way, FEC gets a better feel for the business and customers, and the business better understands the rules. Early collaboration prevents later delays. We can explain potential FEC risks and determine together how to mitigate them. Not every theoretical risk requires a separate FEC control; sometimes an existing business control suffices or the probability is too low. If certain products are only offered to e.g. a few blue-chip companies, is it necessary to set up a separate FEC control? Or can the risk be covered as part of the product provision, or included in the periodic customer assessment already in place?

What could be the cause of the mismatch between theory and practice?

FEC issues and solutions vary between retail and international banking. For instance, cash-related risks are more pertinent in retail banking than in international banking. Retail banking deals with high volumes and standardized solutions, while international banking, with its fewer clients and complex products, benefits from personal discussions and tailored approaches. This necessitates a practical, client-specific approach, such as using knowledge of internal controls at particular clients to assess risks related to bribery involving counterparties.

A sense of urgency and commercial awareness

How does the difference in “sense of urgency” between business and FEC affect operations? For example, how is success measured?

Banks are bound by the rules of the law. FEC performs the “gatekeeper role” on behalf of the bank: preventing abuse of the financial system, such as money laundering and terrorist financing. This requires monitoring and enforcement of rules. The business also wants to comply with these rules, but it also sees the commercial opportunities and consequences of not acting on time.

In my view, the difference in approach lies mainly in compliance with rules and guidelines. Do we go for a 10 or is a 6 sufficient? By discussing specific cases with each other, we can bring both parties closer together. With understanding and knowledge of each other’s position and background, it is easier to find a jointly supported solution.

How would you raise awareness that FEC is an extension of the bank?

In my view, FEC activities should be integrated into the bank’s value chain. This involves evaluating each step in both the commercial and administrative processes for FEC risks and collaborating with the business to establish the necessary controls to mitigate these risks. By doing so, we can optimize processes for both the bank and its customers while ensuring compliance with regulatory requirements.

International challenges

How does a complex international domain deal with FEC activities?

The legal structure of an institution—whether it has a banking license, operates as a branch, or functions as a representative office—can significantly affect regulatory oversight. For instance, representative offices may be subject to less stringent supervision or, in some cases, may not be supervised at all. The size of the institution within a specific jurisdiction can also impact regulatory scrutiny.

From an FEC perspective, the risks are generally consistent across countries. Legislative and regulatory frameworks are increasingly harmonized, such as through the EU’s AMLR and AMLD6, which facilitate central management of FEC activities. However, central bodies must avoid the pitfalls of over-centralization. Local expertise remains crucial, especially when local legislation imposes additional requirements or when local regulators have specific expectations. For example, while EU and Dutch money laundering regulations are comprehensive, U.S. regulations, such as FinCEN’s 314(a) legislation, have additional local requirements that necessitate localized implementation due to confidentiality constraints. The challenge is to balance global and local approaches, ensuring compliance without unnecessary duplication.

Conclusion

What would you like to say to your readers?

Firstly, stay practical and avoid purely theoretical approaches to FEC. Secondly, focus on proactive risk management by raising awareness about FEC challenges within the business and collaborating on potential solutions. Thirdly, prioritize automation for large-scale or time-consuming manual controls to keep employees engaged with more complex tasks. For instance, implement E-KYC (Electronic Know Your Customer) to streamline and expedite verification processes. Techniques like text analysis and automated public source screening can help identify risk factors. It’s crucial to minimize friction in these processes and ensure that sharing information is easy for customers. Additionally, AI techniques currently used in retail transaction monitoring can be adapted for international banking, improving efficiency and effectiveness in monitoring.