Transforming Compliance to Competitive Advantage

Transcript

[Applause] [Music] so as someone said earlier compliance is a quite expensive hobby and it can either make or it can break your business so today we're going to talk about why it can break your business and what are the main challenges today when it comes to financial crime compliance and what you can do as vasps or as banks in order to manage to mitigate those risks and to achieve a greater efficiency and effectiveness i would like to start by doing a little

bit of myth busting there is a common misconception in the industry that you know crypto is mostly used for illicit activity and if we go back in time in the early days of crypto adoption maybe that was true in a way and at elliptic we are monitoring over 150 different digital assets and what we have observed is that in the early days around 30 percent of all transactions involved some sort of illicit activity so we would see funds coming from dark markets dark forms cyber attacks and so on but moving today

this number has dropped to below 0.5 and that's mainly for two reasons first is regulation if we go back in 2015 we can see that it was more or less the wild west we had the us where they start building a regulatory framework around crypto but everywhere else in the world they were not looking from a regulatory point of view but if we look today in most major financial centers we can see that we have quite robust frameworks so you can see some countries in green those are countries that have robust guidelines and regulatory frameworks

they have adopted the fatf guidelines um and basically they allow crypto transactions but they subject virtual asset service providers to the same requirements as any other financial institution in the region plus some more then we have a few countries in in orange where we have some activity that is allowed and some activity is not allowed and they are in the process of building their framework but they don't necessarily have a very robust framework yet and finally we have some countries in red which have banned crypto or they're thinking of of banning crypto

the main point is that uh the regulatory landscape around crypto is not the wild west anymore we have good guidelines we have a lot of robust regulatory frameworks uh switzerland is a great example and and more and more countries um are building their frameworks um so you can we have the confidence now in the industry that we can we can operate and we can innovate within crypto but of course we need to always take into account uh the regulation and the second reason the ecosystem has become more fair and and safe is because we have blockchain analytics

like what we offer at elliptic uh and what some of our friendly competitors offer in the industry so basically for those of you who are not familiar with blockchain analytics um as marcus was saying was explaining earlier if you are a vasp or a bank and you are accepting or facilitating crypto transactions then you need to be able to identify the ultimate source and destination of those funds and you need to make sure that your counterparties and your customers are not transacting with counterparties that are dark markets any illicit entities basically or any sanctioned entities so i would say these are the two main

drivers today that are making the ecosystem more fair more safe and allow for adoption and for growth however there are a couple of main challenges that we will be facing going forward and those challenges are around in terms of how we do compliance and efficiency and i will explain what i mean by that if we look at the ecosystem it's becoming more and more complex we see new use cases we have defy we have more participants entering the space so overall the complexity in the

ecosystem is continuously increasing and it's really important for your compliance function to be able to identify any activity that can be associated to to money laundering sanctions evasions fraud activity and so on also we see that cyber criminals becoming more and more sophisticated and because the ecosystem is becoming more complex they are devising much more sophisticated strategies in order to layer their funds and by layering funds we mean obfuscating the source or the destination and finally we have multi-layer monitoring so

if you look in the fiat world and let's say you're a bank and you receive a transaction that transaction is coming from one hope away so you know who your counterpart is by default you don't have to go through complex networks of transactions assess what's your exposure to x entity versus y entity and so on but in crypto a transaction may be coming from 100 hops away the funds may be combined across the way basically you have to do monitoring on the blockchain and see if that transaction appears um to let's say involve any money laundering activity if the

the the car well the person who is sending the funds is trying to structure the funds through different paths and so on but then once you receive the funds you have to monitor your customer holistically at the exchange level you have to look at the customers transactions across a period of time a week a month a year and see if there is any unusual activity for example are they receiving multiple transactions under the reporting threshold do they combine those transactions and then rapidly send the funds uh into to high-risk jurisdiction or convert it into fiat so these are the kind of typologies you have to monitor and you have

to monitor those within an exchange or within a bank but also now because you have this level of transparency on the blockchain you have to also monitor the blockchain in terms of effectiveness what i mean is be able to identify any potential money laundering activity with the cryptocurrency transactions that is increasingly becoming more and more difficult so that's on the effectiveness side let's have a look at the efficiency side if you're a vasp a custodian sorry an exchange a custodian or a bank

and you're familiar with compliance operations you may know that within aml operations depending on the size of the organization and the size of your customer base you may have from tens to thousands of aml analysts investigating alerts and that comes at an extremely huge cost and as we we have seen over the past few years and probably we're going to 10 people within your aml operations and this is over the next two years this line shows you how potentially your alerts may increase over time now your main problem is that with your

existing number of employees you will not be able to investigate those alerts so you will need more people now one thing we see sometimes in the industry both in the crypto industry as well as a traditional financial services is that some will say well i have 10 people i'll change my systems so i get enough alerts for those 10 people that's going to cost you a lot it's called alert suppression and probably is going to set you back several millions of dollars in fines your other option is to try become more efficient and more effective

do all sorts of initiatives i spent most of my career working for very large banks and trying to increase their operational efficiency within aml investigations we would for example change the way they take screenshots bring a new system that will save them five seconds in the process and they would say 500 ftes but those initiatives don't always work but definitely they will drop that line further down so you might need less people but i guess the main point from these from this graph is efficiency and measuring that efficiency is really key it's going to be a problem as transaction volumes grow you can you can be smart about launching

initiatives today in order for you to become more efficient but you also need to start thinking about hiring more people um because at the moment it's quite hard to find good talent in the industry so what can you do so that crypto can make your business sorry compliance can make your business and not break it i think the first point is to think about your target operating model and how you're going to change that operating model and what sort of technologies you're going to bring in but it's not just about technologies it's also about processes and it's about when we think about processes everything starts from

whatever solution you have there that generates your alerts you have to be careful how you go about calibrating those solutions how you build your scenarios that detect money laundering or any other kind of illicit activity and you need advanced analytics in order to be able to assess those scenarios to fine-tune them things like above below the line testing and so to make sure that you're not getting too many false positives that will overwhelm your operations and of course you need quality assurance like you generate a bunch of alerts your operations will investigate them but are they doing the right job are they

catching the bad guys and how do they take that feedback and they send it back to your alert generation so that you can fine tune it further and make sure you don't get those false positive alerts again and then if we look from efficiency point of view how do you optimize your investigations how do you change the process how do you provide clarity to your analysts in order for them to be able to to do their work more efficiently faster how for example you take care of of data and of your customers one one of the big problems in the industry when it comes to compliance is customer experience because

very often when an analyst takes a case and they start investigating they realize that half of the kyc profile for that customer has been updated 10 years ago so they will start reaching out to the customer and the customers are not happy when they receive calls asking them about their passports or why they did this transaction or where the funds have come from and finally how do you collect data how do you update the kosc profiles how do you learn more about your customers how do you learn more about their how do you take structured data and you feed that into all the other systems you use within compliance

so that that's about process and when it comes to technology again there are so many different components i'm just going to show you a few here blockchain analytics is one but it's not the alpha and omega when it comes to financial crime compliance within the crypto industry blockchain and analytics is is a component that is necessary by default on the blockchain you don't have information about your counterparty so with blockchain analytics you can get that information and you will know if the funds have come from a dark marketplace or they have come from a legit exchange but you also need to have additional

systems like your transaction monitoring systems your payment screening solutions your case management solutions and so on of course you can use more modern technology like machine learning you can use artificial intelligence become more effective in the way you identify those financial crime typologies it's still early stages but over the past decade i have seen those solutions work better and better every year so i would definitely recommend looking into something like that and then from an efficiency point of view you know once you get to your thousands of

alerts about money laundering what other tools you can use in order to increase the efficiency with which you do the investigation you can use natural language processing and generation in order to speed up the investigation or to read quickly through documents about the customer or negative news and so on you can use robotics process automation remove mundane tasks like having an analyst go through different systems and portals and pull information about the customer and you can use things like behavior on analytics to make sure that you avoid any account takeovers um and you you can be certain that whoever

is transacting and sending those 10 bitcoins out of your vasp is actually your customer and not a hacker and finally people which i think it's probably the most important element within compliance when it comes to people of course you need to have a robust compliance culture within your organization and the best way to to do that is by having a robust policy know what right is and reflected within your policy define your risk appetite statements and make sure that every person in the organization whether they work within compliance or outside

of compliance they are very clear in terms of your risk appetite and your mission and why compliance matters throughout the organization and finally take those policies and convert them into procedures standard operating procedures for personnel within aml operations so that they know what they are expected to do they have an idea in terms of step by step that's the process that's how i need to do it consistency is important when you lack consistency within then it's like opening the compliance pandora's box to increase your efficiency of course you need the right people with the right

skills you have to identify those gaps within your organization so you need to have a good idea of what your organizational model within compliance looks like and what are your gaps at the moment and go out finding those people but when you find those people it's important to make sure you retain them and you help them to constantly grow is ever evolving the crypto landscape is constantly changing i'm new in the industry i've only been for a year and a half uh and you know i think it's impossible to get bored if you get bored of crypto you're kind of bored of life

so so make sure that you constantly invest in terms of upskilling those people and helping them understand not just the crypto side but also the traditional compliance side thank you thank you so much stelios um yes i agree compliance is a pain point for a lot of companies sorry number off this one it's just so nice

[Laughter] lovely do you want to do questions or yeah yeah absolutely if there are any questions happy to answer yeah so basically this is our bread and butter and elliptic that's what we do um we monitor all transactions on the blockchain and we identify those transactions that are coming from illicit entities or high-risk entities and that's the whole idea behind blockchain analytics to identify for example a transaction is coming from a legit exchange or from from the silk

road maybe it's more yeah absolutely i'm not saying that you know this is the bible chart yes please not necessarily if that bitcoin has gone to an exchange then when it comes on the other side it's clean you can trace through exchanges in the same way that you cannot trace through mixers but if that bitcoin is like an

old bitcoin that has never been moved from that unhosted wallet and it has touched any dark market then then you will know that i think all of them actually i mean we have just started scratching the surface in terms of financial crime around blockchain i had an interesting conversation

earlier about where this is going to and i'm speaking with a lot of banks and i'm speaking with a lot of exchanges and what i see is different levels of risk appetite so for example banks may sometimes say that yeah i want to offer crypto but i'm only going to allow my customers to transact with a specific list of entities that i have already done my due diligence and i feel comfortable with so that's one tier and then another tier is crypto exchanges which will still allow customers to transact with or through unhosted wallets and then there will be some participants in the intersection of the two

that will enable funds to flow through those from those exchanges to the banks and these participants will probably be those exchanges or virtual asset service providers that um are trusted by the banks and they they fall into their whitelist so so that's i think probably the next step and then after that in two years time i don't know where this is going to go to be honest i'm i'm really looking forward to find out myself this is a challenge for the industry not necessarily solution there are some

that you can have a little bit of visibility not you're not able to do the full tracing again i think it comes down to risk appetite so you see some participants that will allow other customers to transact in those currencies some others will not i don't i think it would be great if we could do the traceability or for example trace through the lightning network that's another big challenge or trace across chains that's probably the holy grail in blockchain analytics but i don't think that this should be the the primary objective i don't think these are the the main problems we need

to solve as an industry those problems can be resolved indirectly uh through policies through procedures through setting your risk appetite appropriately