Encik Abu Hassan Alshari Yahaya: Results of the National Risk Assessment on money laundering and terrorist financing

Speech by Mr Encik Abu Hassan Alshari Yahaya, Assistant Governor of the Central Bank of Malaysia, at the International Conference on Financial Crime and Terrorism Financing (IFCTF) 2014, Kuala Lumpur, 8 October 2014.

It is my great pleasure to be here today to discuss with all of you the results of the National Risk Assessment on money laundering and terrorist financing (or the NRA). First, allow me to thank the Compliance Officers Networking Group (CONG) and the Asian Institute of Finance (AIF) for organising this conference and inviting me to this morning session.

I also would like to extend my special appreciation to Mr. Roger Wilkins, the President of the Financial Action Task Force (or FATF) for delivering his keynote address and to the delegates from FATF namely Mr. Rick McDonell, the Executive Secretary of FATF, Mr Liu Zhengming and Mr Young-Han Byun, members of the Steering Committee of FATF for attending this morning session. It is an honour to have with us Mr Wilkins and delegates from FATF, and to get an update on the latest development on AML/CFT directly from the FATF President. Mr Wilkins and the delegates are in Malaysia as part of the FATF high level mission to meet the senior Ministers, government officials and key agencies such as the Royal Malaysia Police, the Attorney General's Chambers, Malaysia Anti-Corruption Commission, Royal Malaysia Custom and the Inland Revenue Board to assess the level of the country's commitment in implementing the FATF standards to combat money laundering, financing of terrorism and proliferation of weapons of mass destruction. As the Competent Authority under the AMLATFA, we appreciate the opportunity given by the FATF to demonstrate our commitment in ensuring that our AML/CFT regime is effective.

This International Financial Crime and Terrorism Financing (or IFCTF) Conference is the 6th public and private partnership initiatives conference conducted by CONG and the AIF. In the past 5 conferences, important building blocks have been put in place to raise awareness, develop understanding and nurture the commitment from the financial industry on pertinent areas in contributing to an effective anti-money laundering and counter financing of terrorism (AML/CFT) in Malaysia. As we are aware, an effective AML/CFT regime requires strong collaboration and mutual trust between the public and the private sectors. Therefore, this conference provides the value added platform for the regulators, supervisors, industry players, government agencies and the public to build trust and greater understanding on latest development and initiatives, key issues and regulatory expectations on AML/CFT. As I understand from the organiser, this year's conference has a fairly diverse audience comprising more than 400 participants from the financial sector, government agencies and the public including participants from other countries. This reflects the strong level of interest and commitment by all parties involved in AML/CFT.

Money laundering is a serious global problem. At the global level, the International Monetary Fund (or the IMF) estimated the extent of money laundering to be at 2% to 5% of global GDP. According to the United Nation Office on Drugs and Crime (UNODC), this translated to 800 billion to 2 trillion US dollars in current GDP. Whilst the UNODC acknowledged that the margin between those figures is huge, even at the lower estimate it underlines the seriousness of the problem and the devastating impact that it would bring to any country.

In Malaysia, for the year of 2011 and 2012, the law enforcement agencies investigated serious crimes involving a total amount of RM13.1 billion. This is the amount that has the potential to be laundered through our system. We recognized that the actual extent of money laundering is difficult to measure. As it is widely acknowledged internationally, for every 10 crimes committed, only one will get reported. Certain types of crime may not be reported, let alone be investigated. For example, in the case of corruption, if both the giver and taker are willing parties, the case will not be reported unless there are reports from the third party.

The growth in international trade, inter-linkages of the global financial system and advancement in technology have presented both the risks and opportunity to the private sectors. From the business perspective, this development provides for greater access to the wider global market. From the money laundering perspective, this also means that criminals have greater means and tools to launder their illegal proceeds into a form which appears to be legal. Using the tools provided via the advancement in technology such as the internet banking and wire transfers, these proceeds could subsequently be transferred out and layered into another transactions either in Malaysia or abroad.

Changes in the business and economic landscape present a challenge to law enforcement agencies, financial regulators and supervisors. To ensure that we are effective in protecting the financial system and the broader economy from the threats of money laundering and terrorist financing, cooperation and collaboration is not an option but a vital requirement. In this regard, there must be strong working partnerships between all the law enforcement authorities, regulators, supervisors and the private sectors. Without that, our efforts will be futile.

In terms of the legal framework, concerted efforts have been taken to ensure that our AML/CFT law and policies are comprehensive. On this note, I am happy to inform that the main law governing the AML/CFT has been passed by the Parliament and gazetted into a law on 29 August this year. The amended law is now known as "Anti-Money Money Laundering, Anti-Terrorist Financing and Proceeds of Unlawful Activities Act 2001" and has come into effect on 1 September this year.

As for the private sector, particularly the financial institutions and key gatekeepers such as lawyers, changes brought about in the operating environment demands greater need for the private sectors to be more vigilance in fulfilling their AML/CFT obligations. Compliance with AML/CFT law and regulations require high commitment from all levels of the staff, particularly the front-liners or staff facing the customers. Around the world, non-compliances with AML/CFT obligations are seriously dealt with. At the international level, we have witnessed banks been penalised to the tune of billion of dollars for their failure to comply with AML/CFT law and regulations. In Malaysia, we have taken and will continue to take strong actions on financial institutions and other reporting institutions that failed to comply and implement AML/CFT law and regulations.

Another key element for an effective AML/CFT eco-system is the effective financial intelligence and enforcement. The important source of financial intelligence come from the suspicious transactions reports (or the STRs) submitted by reporting institutions to the financial intelligence unit (FIU) in Bank Negara Malaysia. Overall, the STR submissions had increased on average of 20% over the past 5 years. In terms of disclosure made to domestic law enforcement authorities (LEAs) and foreign FIUs, the numbers of proactive disclosures made had increased steadily over the past 3 years with an average increase of 33% annually. Notably, the number of STRs disclosed in 2013 has also increased by three times as compared to the previous years. This is mainly contributed by disclosures relating to large network of subjects suspected to be involved in tax/duty evasion, scam/fraud activities and corruption. Proactive disclosures made to the LEAs had also recorded positive feedbacks. Based on the feedback that we received from the LEAs, the STRs submitted have provided leads to their investigation and have resulted in the number of joint initiatives. More than 70% of the STRs disclosed to the enforcement agencies have resulted in the opening-up of Enquiry Papers or Investigation Papers. The remaining of the information disclosed will be is used as part of the database for future investigation.

Understanding of money laundering and terrorist financing risks is the foundation to which our legal framework, preventive measures, financial intelligence and enforcement, and cooperation will be based on. Since 2012, the National Coordination Committee to Counter Money Laundering (NCC) has given the mandate to its 16 members to carry out a comprehensive assessment of our money laundering and terrorist financing risks.

Background on National Risk Assessment (NRA)

The National Risk Assessment, which is conducted under the ambit of the NCC, seeks to enhance the country's collective understanding of the money laundering and terrorist financing risks facing the country and draws upon principles set out under the FATF's International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. The FATF Standards requires, amongst others, that countries and financial institutions identify and assess their money laundering and terrorist financing risks and apply AML/CFT measures that commensurate with the identified risks.

Therefore, the two main purposes of the NRA are:

  • Firstly: to identify, assess, and understand key money laundering / terrorist financing threats and vulnerabilities facing the country; and
  • Secondly: to apply appropriate control measures to mitigate the risks.

The identification of money laundering and terrorist financing risks would enhance our understanding of the specific money laundering and terrorist financing threats in Malaysia, in particular the scale, sources and methods of money laundering and terrorist financing, and identify vulnerabilities and risks across the various sectors. This, in turn, will provide guidance to the authorities and reporting institutions in allocating and prioritizing AML/CFT resources efficiently and towards areas that present the highest risks and impact. Results of the NRA will also serve as input in applying the appropriate national AML/CFT strategy and policy response proportionate to the identified risks, such as, the AML/CFT Strategic Plan, amendments to the law, revision of guidelines/policies, guidance to reporting institutions, manpower review and budget allocation.

Understanding of risks form the main principles in the FATF revised standards and methodology. Riskin the context of money laundering and terrorist financingis a function of three factors: threat, vulnerability and consequence, and the money laundering and terrorist financing risks assessment involves making judgments about these 3 factors.

A threat is anything, be it people, object or activity with the potential to cause harm to the country, society, or the economy. In the money laundering and terrorist financing context this includes criminals, their criminal activities, terrorist groups and their facilitators, their funds, as well as past, present and future money laundering or terrorist financing activities. Identifying the threat is an essential starting point in assessing money laundering and terrorist financing risks. It provides an understanding of the nature, size and volume of the predicate offences and proceeds of crimes and an understanding of the environment in which these offences are committed and the proceeds are generated.

The concept of vulnerabilities used in risk assessment comprises those factors that can be exploited by threat or that may support or facilitate its activities. In the money laundering and terrorist financing risks assessment context, vulnerability is distinct from threat because vulnerabilities are the factors that represent weaknesses in certain features of a country, or in the AML/CFT systems or controls. They may also include the features of a particular sector, a financial product or type of service that make them attractive for money laundering and terrorist financing purposes. By assessing the country's threats and vulnerabilities, we are actually putting the risks assessment in the context of our country's situation in terms of materiality of these threats and vulnerabilities in our country's structural elements, and other factors that form important features of our country.

Consequence refer to the impact or harm that money laundering or terrorist financing may cause and includes the effect of the underlying criminal and terrorist activity on financial systems and institutions, as well as the economy and society in general. Contrary to the impact of other type of risks such as credit or market risk, the impact of money laundering and terrorist financing risks are difficult to quantify. For the purpose of this NRA, we used perception surveys conducted among reporting institutions, supervisors, regulators and LEAs as our sole data-point of assessing the impact or consequences.

In summary, the key point in conducting the NRA, is that whatever the approach is, it should be able to distinguish the extent of different risks to assist with prioritising mitigation efforts. Findings of risk and more importantly the effectiveness of risk mitigation measures is key to our mutual evaluation reports and the ratings.

Scope of the NRA

Based on the understanding of what the NRA entails, the scope of this NRA is broadly categorised under 2 broad elements; i.e. threats and vulnerabilities. In assessing threats, the extent of money laundering and types of prevailing crimes in Malaysia were analysed based on statistical data provided by law enforcement agencies and intelligence data from the FIU. The purpose of this analysis is to understand the extent and types of prevailing crimes that pose money laundering threat in Malaysia, gauge the level of the country's attractiveness to money laundering, and identify methods and origins of the proceeds of crime, in particular whether the proceeds are generated domestically or abroad.

In assessing vulnerabilities, the country's features or systems, in particular the characteristics of Malaysia's economic, legal and geographical environment that make Malaysia attractive to money laundering activities were assessed. Vulnerabilities in the financial and non-financial sectors and their attractiveness to money laundering arising from the structural risks inherent in the sector/industry, such as, the size of the industry, volume turnover, the products and services offered and the types of clients served were also assessed. The sectors assessed under this NRA are the financial institutions, the designated non-financial businesses and professions (DNFBPs), the non-profit organizations (NPOs) and the legal persons (body corporate or unincorporated).

Terrorism Financing is assessed on its own and broadly covers its specific indicators of threats and vulnerabilities. Given its unique characteristics, factors associated with terrorist financing are vastly different from those of money laundering. For example, the source of funds for money laundering activities has to come from criminal proceeds, whereas funds used for financing of terrorist activities may come from either criminal activity or legal sources. Another difference is that, transactions associated with TF may be conducted in very small amounts, which when not viewed in the TF context could be the very transactions that are considered as low money laundering risk. Therefore we have chosen to assess money laundering and terrorist financing risks separately.

Methodology of the NRA

The methodology used in conducting this NRA is loosely based on factors used in the World Bank's NRA tool and the Asia and Pacific Group on Money Laundering (APG) Strategic Implementation Planning Framework. The NRA is largely a combination of quantitative and qualitative assessment. It draws together statistical information from across key government ministries, supervisory and regulatory authorities (SRAs) and LEAs. Statistics on the mutual legal assistance requests received from other countries and the types of matters to which the requests relate to, and the financial intelligence requested or disclosed by the foreign FIUs are used as indicators as to the level of foreign proceeds of crime being laundered in Malaysia. This is complemented by qualitative information sources such as perception surveys involving respondents from officers of the LEAs, reporting institutions and foreign FIUs, intelligence insights, independent and external studies and public information on current and emerging threats to form a consolidated picture of the country's money laundering and terrorism financing environment. The findings were then validated through a focus group involving subject matter experts from amongst the NCC members.

Result - Relationship between threats and vulnerabilities

Based on the analysis and methodologies employed, our assessment concluded that there are 5 types of crimes that pose high money laundering risk threat to the country. Those crimes are:

  • Fraud (which comprises fraud-related offences, for example cheating offences under the Penal Code, illegal investments schemes offences under the Financial Services Act, Capital Market and Services Act, Direct Sales and Anti-Pyramid Scheme Act, and Companies Act),
  • Drugs trafficking,
  • Corruption and bribery,
  • Smuggling offences (including evasion of customs and excise duties), and
  • Tax crimes.

Based on data from LEAs, except for corruption and bribery, the number of investigation conducted and the amount involved in the investigation on these types of crimes are high. This finding is in line with the results of perception survey and feedback from other LEAs. It also conforms to various credible independent international and external reports.

In terms of vulnerability to money laundering and terrorist financing risks, sectors that are most vulnerable and attractive to money laundering and terrorist financing risks are the banking and money services business in the financial sector and casino in the non-financial sector. Key factors contributing to the vulnerabilities of these sectors are size of their institutions, high volume of transactions, high exposures to cash-based transactions, high geographical coverage, multiple channels of deliveries, and high exposures to cross-border transactions. Based on statistics, there are high numbers of STRs reported by and on these sectors, and there are also high numbers of investigation carried out by the LEAs on customers or transactions originated from these sectors.

Vulnerabilities could also come from the country's economic and geographical elements, as well as our legal framework. As a highly open economy, there are certain economic factors that contribute to the attractiveness of money laundering risk in the country such as the high integration with international markets, cash-based economy, high existence of non-bank remittance transfer, exposure to international trade, high percentage of informal economy and large volume of physical movement of currency.

Vulnerabilities in the country's geographical elements that may contribute to the attractiveness of money laundering risk is the country's long and porous border. In the case of drugs trafficking for example, Malaysia position that is close to the "Golden Triangle" and within the route of "Afghanistan Opium" make our country vulnerable to trafficking of drugs from these areas. In the case of human trafficking, our country's proximity to conflict areas such as Myanmar, makes us vulnerable to smuggling of migrants and trafficking of persons from Rohingya areas. Although in most cases Malaysia is not the final destination, we are the favourite transit points for these refugees.

The NRA highlights the money laundering and terrorist financing risks faced by Malaysia, and areas that warrant more resources and attention. Some of the targeted mitigation measures undertaken by the authorities include:

  • Intensified joint investigation efforts by the LEAs to effectively combat money laundering and terrorist financing. This is reflected in the increased number of raids, arrests and prosecutions related to money laundering and terrorist financing and predicate offences;
  • Another effort is the enhancement of the structure of the individual LEAs, which includes the formation of dedicated AML/CFT unit within the LEAs and increase in manpower focusing on money laundering and terrorist financing investigations;
  • Another response by the government is the amendment to the Anti-Money Laundering and Anti-Terrorism Financing Act 2001 (AMLATFA) which is aimed at strengthening Malaysia's AML/CFT framework against criminal activities. The amendments would provide clarity on reporting obligations so that preventive measures can be implemented more effectively, such as requirements to submit STRs related to terrorism financing, tipping off provision and CDD requirement;
  • The intensity of enforcement actions against financial institutions that failed to comply and implement AML/CFT programs is also increased. In 2013 and 2014, BNM has compounded banks for various failures to implement effective compliance programs. With the coming into force of the amendments to the AMLATFA on 1 September 2014, the maximum penalty for various provisions was increased. For instance, maximum penalties under general offence have been increased from RM250,000 to RM1 million. While for more serious offences such as tipping-off and opening of account in false name would trigger maximum penalties of RM3 million or imprisonment of 5 years or both.

Targeted mitigation efforts also mean higher expectations on the reporting institutions. The reporting institutions are expected to have proper policies and procedures in providing investigation supports to the LEAs and play proactive roles in deterring and detecting money laundering threats. For example, Bank Negara Malaysia and the Royal Malaysia Police are currently exploring the possibility of sharing the names of suspected mule account holders that facilitate illegal activities. This initiative aims to help the financial institutions to prevent their account facilities from being misused for criminal activities, especially by account renting syndicates. Another initiative is to assist financial institutions in developing and detecting suspicious activities related to high risk crimes. For this purpose, we are proposing for the establishment of working groups comprising the financial institutions and the LEAs in developing red flags related to high risk crimes identified in the NRA, including terrorism financing.

Before we move into what is expected of financial institutions with the understanding of the risk, let me share with you the heat map of the threat of the other serious crimes in the country. This classification is based on similar methodologies that I explained earlier. Based on that, the following crimes are classified as medium threats to money laundering situation in Malaysia:

  • Organised Crimes
  • Human Trafficking & Migrant Smuggling
  • Forgery
  • Theft and Robbery; and
  • Counterfeiting of Currency

Human Trafficking and Migrant Smuggling, although currently assessed as medium threat is also seen as an emerging threat for Malaysia as this criminal activities is believed to generate substantial proceeds and may be further pursued if not enough enforcement actions are taken by the law enforcement agencies. If left unchecked, this type of crime may have the potential to pose high risk threats to the country from money laundering perspective.

The following crimes are classified as low threats from money laundering activities:

  • Sexual Exploitation
  • Arms Trafficking
  • Counterfeiting and piracy of products
  • Insider Trading and Market Manipulation
  • Murder
  • Environmental Crimes
  • Extortion
  • Kidnapping
  • Sea Piracy

Terrorism Financing threat is classified as medium risk taking into consideration the following factors:

  • Insignificant number of terrorism and terrorism financing incidents in Malaysia
  • Primary groups (such as Jemaah Islamiah (JI) and Kumpulan Mujahidin Malaysia (KMM) have been dismantled)
  • Evidences so far indicate self-financing by individual terrorist.

Let us now look at the heat-map for vulnerabilities of Financial Sectors to the risk of money laundering. The findings identify the following sectors as Medium risk. Again, let me stress that this is looking at the inherent risk of the sector and not taking into consideration of the control measures put in place by such sector.

  • Fund Management Companies
  • Unit Trust Companies
  • Offshore Banks, given that they are not allowed to accept cash; and
  • Non-Bank Deposit Taking Companies
  • The following institutions are classified as low of money laundering risk:
  • Stockbroking
  • Leasing and Factoring
  • Life Insurance
  • Money Lenders
  • Non-bank cards issuer
  • E-money providers; and
  • Development Financial Institutions.

For the non-financial sectors, the following sectors are considered as medium to the risk of money laundering:

  • Lawyers
  • Offshore trust
  • Real estate agents; and
  • Trust companies

And the following sectors are considered low to the risk of money laundering:

  • Gaming companies
  • Jewellers
  • Accountants
  • Pawn Brokers; and
  • Notaries

Besides looking at the vulnerabilities of the sectors that may be exploited or used as conduit to launder proceeds of crimes, we also conducted separate assessment on money laundering risk posed by legal person (i.e. companies or legal entities that are established either in Malaysia or in Labuan). Based on the assessment, legal entities are rated as "medium risk". Taking into consideration experiences from the investigations conducted by the LEAs, there are various instances where legal entities have in the past being used to facilitate laundering activities by the criminals.

Similar assessment was also conducted for the Non-Profit Organisation (or the NPO), especially from the perspective whether these NPOs are being used to facilitate financing of terrorism. Although, based on the LEAs investigations there are no known NPO involve in the terrorist financing activities, minimum supervision on the NPOs makes the sector vulnerable to be used by criminals or terrorist.

The NRA on its own has no meaning unless the results are used to facilitate greater understanding among all stakeholders involved, including the financial institutions to better understand the money laundering and terrorist financing risks in their own sectors, as well as other sectors that they have dealings with. This will allow financial institutions to better assess the adequacy of their internal AML/CFT controls in mitigating the risks identified and to strengthen these controls where necessary. As the country gathers its understanding of money laundering and terrorist financing risks through the NRA, similar expectations are also incumbent upon the financial institutions.

The financial institutions are expected to identify, assess and understand the money laundering and terrorist financing risks at the institution level and the Financial Institutions' leadership and senior management need to be involved and be engaged in the risk assessment process. The institution's risk level assessment can be leveraged through thematic money laundering and terrorist financing risks assessment conducted at by the institution or periodic reporting by compliance department such as updates on STRs submissions, investigation orders received or findings from internal auditors. By getting the leadership and senior management involved in the risk assessment process, the institution would be better informed in making business decisions, such as when venturing into new markets, services or geographical areas, especially when the new area is vulnerable or attractive to money laundering and terrorist financing risks. In addition, having a complete understanding on the risks will assist the institution in allocating resources for the compliance function, including recruitments of competent personnel and investment into management information system.

The communication of money laundering and terrorist financing risks identified is equally important. The risks identified should be shared throughout the organization especially with key business units and the front liners. The risks identified shall also act as a guide in coming up with policies procedures and training needs requirements and its robustness for different business units. In return, the business units should be able to provide feedback to the compliance or risk management departments on any new or emerging risks that they face or encounter in their daily business operations. The feedback loop that exists would enable the institutions to keep the money laundering and terrorist financing risks assessment current and relevant. Finally, this in turn would be a source of valuable information to the authorities in conducting the national level money laundering and terrorist financing risks assessment.

Comprehensive understanding of money laundering and terrorist financing risks should be translated into a comprehensive risk controls and mitigation. This is key in applying a risk-based approach in the implementation of preventive measures, where more focus should be channelled to high risk areas identified. The controls and measures should be applied across the overall compliance program, including oversight by management, customer due diligence, staff trainings and suspicious transactions reporting. Equally important, the risk controls and mitigation developed should be executable and applied religiously. To complement this, the policies and procedures should be tested and monitored, by independent parties to ensure its effectiveness and relevancy.

Let me conclude my presentation today. The NRA is an important tool to facilitate our understanding of money laundering and terrorist financing risks facing the country. Understanding of risks is important as it set the foundation upon which our AML/CFT regime is implemented. For an AML/CFT regime to be effective, it has to target the resources and AML/CFT initiatives towards areas that pose the greatest risks.

At the end of the day, the test is on how good we are in achieving the ultimate objective of an effective AML/CFT regime. That is to ensure that the financial system and the broader economy are protected from threats of money laundering and the financing of terrorism and proliferation, thereby strengthening financial sector integrity and contributing to safety and security of the country.

In relation to the Mutual Evaluation that will be undertaken from 13 to 25 November this year, I wish to inform that some of you will be called to meet the assessors during the on-site assessment in November. The purpose of the meeting is for the assessors to assess how effectively have AML/CFT measures been implemented by the reporting institutions. We have identified several potential institutions as per the criteria given by the assessors. If your institution is being selected, you will receive formal notification from us in due course. Of course, there are possibilities that the assessors may request to meet other institutions during the on-site assessment.

Malaysian leadership and authorities are fully committed and unrelenting in the efforts to address money laundering and terrorist financing risks. For the country, an effective AML/CFT regime is critical to:

  • Reduce the overall crime in the country;
  • Increase government revenue and reduce leakages in the economy;
  • Preserve the integrity and reputation of our financial system;
  • Create conducive environment for businesses and investors, and support the Government's economic transformation agenda; and
  • Strengthen Malaysia's reputation as a country committed to combat money laundering and terrorist financing.

On that final note, I would like to once again thank CONG and AIF for organising this conference. I wish all of you a successful and productive conference ahead.