With one in three bank staff now employed in compliance, and financial institutions groaning under the pressure of an ever-increasing regulatory burden, 2018 is set to be the year that RegTech rides to the rescue, stripping out huge cost from banks’ processes.
In the same way that nimble start-ups introduced FinTech to the financial sector, the stage is now set for the same tech-savvy entrepreneurs to apply the latest technology to help tame the regulation beast.
The challenge is even more pressing now, with the arrival of an alphabet soup of blockbuster regulation including GDPR, MiFID II and PSD2, which will stress institutions like never before.
What is RegTech?
Deloitte has set high expectations for RegTech, describing it as the use of technology to provide ‘nimble, configurable, easy to integrate, reliable, secure and cost-effective’ regulatory solutions.
At its heart is the ability of ‘bots’ to automate complex processes and mimic human activity. And RegTech start-ups are already using robotic process automation to translate complex regulation into API code using machine learning and AI.
The holy grail of RegTech, however, is to strip out huge layers of cost and dramatically lower risk by developing and applying complex rules across all business processes in real-time, automating what can otherwise be an expensive and highly labour-intensive job. Simply put, RegTech promises to do the job faster, cheaper and without human error.
Behavioural analytics
Just like its FinTech cousin, RegTech is already being used for a surprisingly wide range of applications, for example banks are using behavioural analytics to monitor employees, looking for unusual behaviour patterns that may be a tell-tale sign of misconduct.
Brexit will also present a golden opportunity for agile RegTech start-ups whose tech solutions can adapt and transform quickly according to the new regulatory landscape, while traditional institutions struggle with the pace of change.
Unlike FinTech however, which has largely been focused on B2C solutions, RegTech start-ups have to work much more closely with traditional financial institutions. That’s because capital markets are a highly complex, regulated area, where institutions are cash-rich and where access to funding is critical if vendors want to disrupt.
Bespoke solutions
Traditional institutions are also more likely to need solutions that are specifically tailored to the challenges they face, rather than the one-size fits many approach developed by FinTechs. For example, they rely on many different data systems, and this torrent of data often makes it difficult to compile reports to deadline for regulators – a perfect challenge for a RegTech start-up.
RegTech could well be the cavalry, riding in to save the investment management industry from the increasing amount of data being produced that financial regulators want access to. A significant amount of this data is unstructured, making it difficult to process, which adds a greater level of complexity. The flow and complexity of this data is only going to increase, and with it the challenge for banks.
Financial institutions are increasingly pulling out all the stops to crunch data and meet the regulator’s next deadline and in this high-pressure environment teams are not necessarily developing the strategic overview needed to streamline their IT architecture in order to reduce operational risk.
Compliance at speed
RegTech promises to automate these processes, making sense of complex interconnected compliance rules at speed, making compliance more cost effective, while reducing the chance of human error.
It also promises to dispense with the current time lag between a period end, the collection of data by the institution and assessment by the regulator – a process that is always backwards looking.
Under the RegTech model, powered by data analytics and AI, information is in real-time and self-correcting to ensure the regulatory process remains dynamic and relevant.
The scale of the advantages promised by RegTech, are such that banks successfully harnessing its power will strip out huge amounts of cost from their processes, which can then be invested in business-critical innovation, giving early adopters a clear competitive advantage over the rest of the market.
-
John Cooke, Managing Director
Black Pepper Software
In July 2014 FBME Bank Ltd's Cyprus branch (FBME) was resolved by the Central Bank of Cyprus (CBC). This is a very interesting case for several reasons, as it touches on the nature of legal powers conferred on financial regulators in the area of Anti-Money Laundering and Combatting the Financing of Terrorism (AML/CFT), on the use and misuse of these and other powers, on the openness of proceedings and on the rights of response and redress of their targets. Robert Lyddon, international banking expert, explains for Finance Monthly.
There is also a perspective around the application of legislation unevenly across large and small banks, with small banks suffering resolution and even closure, and large banks escaping with impressive-sounding fines that do little to inhibit their ability to carry on business as usual.
CBC's intervention came immediately after FBME had been served with a Notice of Finding on 17th July 2014 citing FBME as an institution of "primary money laundering concern" by FinCen, the Financial Crimes Enforcement Network of the US Department of the Treasury.
Under its own governing laws, FinCen only needed to have "reasonable grounds" for its concerns, and the evidence of there being such grounds was confirmed by a judge sitting "in camera". This is not the same as having those allegations proven in an open court of law, with recourse to courts of higher instance. A lower level of proof was required in order for a sanction to be imposed which had a devastating effect on the target bank and its depositors.
FinCen proposed the imposition of its "fifth special measure": this precludes US banks from running a US$ account for the target bank or handling its US$ payments via intermediate correspondents, thus de-banking the target bank in the USA and cutting it off from the international banking system. This is tantamount to putting the target bank out-of-business.
Similarly the designation of certain categories of financial institution - Money/Value Transfer Networks - as "high risk" by the Financial Action Taskforce (FATF) has resulted in these institutions being de-banked and unable to operate. The evidence upon which FATF came to this conclusion is opaque, and there is no public forum for their designation to be challenged, FATF itself being the ultimate source of AML-related legislation.
In the case of FinCen’s notice on FBME, FBME had 60 days in which to file a response but the subject’s prudential supervisor – CBC – denied them this by resolving the branch and immediately offering it for sale to another local bank.
Allegations of AML infringements would have needed to be put through a legal process in Cyprus involving the Cypriot financial crime intelligence unit (MOKAS) as well as the AML supervisor (CBC itself), and would at most have resulted in sanctions such as fines, after due process had been gone through. It is unusual that CBC as a central bank be both the "competent authority" for matters relating to AML Directives and the "prudential authority" for bank capital and liquidity adequacy: in the UK these powers are separated.
Instead CBC cut off any due process by using, against FBME, the Law on the Resolution of Credit and Other Institutions of 2013, which was passed to resolve Cyprus' two largest banks - Bank of Cyprus and Laiki Bank - within the context of the €10 billion bailout of Cyprus by the so-called "Troika" of the European Commission, European Central Bank and International Monetary Fund.
CBC misused these powers as FBME was not a case of a bank failure. The preconditions for resolution are cumulative and are that an institution must have a shortfall of capital and of liquidity, and be systemically important i.e. its failure must do harm to the country it is in. FBME did not meet these tests: it had adequate capital and liquidity, and it was small and did not have a significant number of Cypriot depositors.
FBME was, however, an irritant to the Cyprus authorities: it was involved in challenging - commercially and in the courts - the high interchange fees applied by indigenous banks to card transactions, thereby disrupting the income stream of the major local banks.
The interconnection of FBME's case to the 2013 bailout is important because - as a quid pro quo - the Cyprus authorities agreed to remedy concerns about Cyprus' AML regime. These concerns were documented in a report dated 24th April 2013 by MoneyVal, the inspection and evaluation arm of the FATF. MoneyVal interviewed a large part of the Cypriot banking sector: 13 out of 41 banks, holding 71% of deposits and 76% of loans in the system, and including the 7 largest banks.
The 2013 MoneyVal report pointed to substantially the same issues as it had noted in the 2011 report on its Fourth Assessment Visit to Cyprus: that report's findings included that "the main risks emanate from the international business activities at the layering stage, money laundering activities usually taking place through banking or real estate transactions". These were sector-wide issues, not confined to any one bank - let alone just one small foreign bank. FinCen raised its own concerns about the AML regime in Cyprus direct to CBC in 2011.
Cyprus received the Troika's €10 billion but there is no evidence of the cessation of the state of affairs described by MoneyVal in 2011 and again in 2013, commonly termed the "Cyprus business model": Cyprus features in several schemes disclosed in the "Panama Papers", the "Paradise Papers", and the "Russian Laundromat" that post-date the bailout.
Instead FBME has been removed from the marketplace, ostensibly as a scapegoat for the allegations levelled against the Cyprus banking sector as a whole. FBME conveniently fitted the bill, and could be attacked in an area where the evidence against it need not stand up in court, and indeed where there was no open court in which FBME could defend itself.
Was the punishment inflicted as an example to the remainder of the Cyprus banks to warn them to remedy their AML deficiencies? Or was it a signal to the Troika and the US authorities, to lead them to believe that Cyprus was delivering on its side of the bailout bargain and cleaning up its act on AML?
Whether CBC had the legal power to resolve FBME, or conveniently mixed its usage of powers - applying its powers as prudential authority to an AML case where it happened also to be the competent authority - is a matter of ongoing dispute.
Of equal concern is whether financial institutions can be resolved or otherwise put out of business through the application of powers conferred on financial regulators for AML/CFT matters where the burden of proof is lower and where a subject institution's rights of appeal are inadequate. Once FinCen has issued a notice against an institution or once FATF has classified an institution into a "high risk" category, the institution is de facto out-of-business, and these authority bodies are not subject to detailed and open scrutiny as to whether their determinations are proportionate, objective and non-discriminatory.
