How to prepare for ML/TF challenges from the Afghanistan situation?

Let’s not go into the political side of this discussion as there are several experts on this topic who can share their opinion on what went wrong or right. The fact of the matter is we, across the world, are in a difficult situation and have to deal with the consequences. In this article I would like to grab your attention and think along, how can you prevent your Financial Institution for being misused during this crisis. I will be focusing only on the post fact monitoring aspect of things (i.e. monitoring activities of your existing “good customers”) and not on the sanctions side.

Such kind of drastic turmoil in the region and anything which comes next, requires a lot of financial backing. Just imagine how many sleeper cells will be active across the world to channel required funds for “the cause”. These sleeper cells, in most cases, are nothing but “good customers” you may have on-boarded several years back and who probably have been under the radar or even dormant in some cases. In our area of work, it’s always challenging to find that needle in a haystack, but looking at the current turn of events there will be many needles moving much more rapidly than the haystack and hence I will try to highlight some signs you should take into consideration while monitoring or investigating suspicious activities.

Hawala activity

If you are not already aware of this method of money transfer, it's high time you spend some quality time understanding it! To give you some basic understanding, say someone wants to send 10K from country A to country B. This person will reach out to a Hawala operator in country A, pay the 10K and provide details of the beneficiary. The Hawala operator in country A will give a "call" to the counter-part operator in country B and "instruct" to pay 10K to the beneficiary. The Hawala operator in country B will pay this 10K (from their reserve) without the funds moving cross border. On the other side, if someone has to move funds from B to A, the same process will work the other way around. Then the operator from country A will use the 10K funds he received in the previous transaction to pay out the beneficiary on their side. There are lots of different methods but I hope you get the overall picture. In this region, it's one of the most prominent method, still used, for moving funds from one country to another as it provides a lot of anonymity. If you are a bank, pay special attention to the MSB' or crypto exchanges in your book as these will be heavily used for such activity. Moreover if you notice a lot of unknown counter-parties interacting with your customer, it's a big red flag! On the other hand, if you are a MSB, try focusing on payments which are within same region and do not make much sense (e.g. funds transferred from Netherlands to Germany of France etc.).

Non-residents

The obvious risk imposed by non-resident customers is that they are far away from your local law enforcement agencies. This is what the shady ones like and hence may use their accounts for unlawful activities. You should pay special attention to any increase in domestic activities on their accounts because if these customers are real non-residents, ideally they should not be active domestically. Moreover this can also indicate they may be active as a virtual hawala operator locally (with funds moving in/out domestically, without leaving the country). You may already have monitoring rules around dormant activity. I will highly recommend to make your thresholds etc. a bit lenient while monitoring non-residents the shady ones might have kept their account for precisely these situations.

Login locations

This is something which can be a bit tricky. Pay special attention to customers who are logging in to their bank accounts from regions which are nearby to the troubled region. This kind of activity falls more in the TF space so keep that in mind too. On the other hand, if a majority of your "good" customers whose known area of activity is in region A, but are regularly logging in from a far away region, followed by unusual fund movements can raise some flags. These are just ideas to put in this public space, but the emphasis I would like to put is on where they are active from!

Trade via nearby ports

If you are in the Trade and Commodity Finance business, you should be extra cautious. Not only for the current crisis, but also in normal times, criminals have become smart. They won't use an obvious culprit port to export goods but will prefer to move inland and then use ports from nearby regions. During my consulting days I introduced a concept of country vs. commodity on what kind of commodities are expected to be imported/exported from certain countries. This way you can easily identify whether certain commodities are originating, not from the expected country but a nearby country and it's port. I will suggest not to immediately implement monitoring rule in the TM systems, but try updating the work instructions for your front office staff from the TCF teams, as possible red flags. If they notice too many occurrences, then you can put a more structural monitoring in place.

To/from nearby countries

Without name a particular country, I can tell you a real life incident I came across. I was having discussions with business users from a particular bank in a country which was neighbor of a sanctioned country. What I was told is that lots and lots of cash was moved out of this sanctioned country, by road, and was deposited in multiple branches of several banks of this non-sanctioned country. So please put emphasis on funds originating or being transferred to nearby countries to Afghanistan. There will be many cash couriers on ground over there who may be helping in moving the funds.

Unusual buyers

Last but not least, PSP's are the new kid on the block and hence are the most vulnerable at this moment. Some so called "good" merchants will be waiting for this day to arrive and start facilitating funds movements for "the cause". Pay special attention to the buyers location, specially who are logging in from the region. You can also start analyzing your merchants web traffic to figure out users from which region are visiting. For example there may be some hidden high value product on your merchant website which is only visible for people associated with "the cause" and hence launder money by purchasing such hidden products.

Conclusion

The ideas I have shared above are just to kick-start your thinking brain as the threats from this situation in Afghanistan can confront you in different shape or form depending on the products and services you offer to your respective customers. The key is to act fast. Either funds will be moving towards or in some cases outside of the region at this volatile time. If we from the ML/TF prevention community are not fast enough, it will be a bit too late and a regret to not act fast will not be an option!