Report on AML/CFT Regtech: Case Studies and Insights

AML/CFT Regtech: Case Studies and Insights January 2021

AML/CFT Regtech: Case Studies and Insights

Contents Foreword 4 Executive Summary 6 Section I: Introduction AML/CFT Regtech: Finding the Right Tools for the Job 8 Section II Case Studies in AML/CFT Regtech Adoption 12 Section III Thematic Insights 26 Conclusion Looking Ahead 44 References 46 Acknowledgments 47 2

AML/CFT Regtech: Case Studies and Insights 3

AML/CFT Regtech: Case Studies and Insights Foreword The challenges facing the banking industry in 2020 have been unprecedented and reminded us all of the importance of adaptability and embracing change. One positive change has been the increasing use of regulatory technology ("Regtech"), which has played a key part in helping to keep vital banking services available in rapidly changing circumstances. In particular, the challenging operating conditions brought about by COVID-19 have triggered accelerating Regtech exploration and adoption since the first Anti-Money Laundering and Counter-Financing of Terrorism ("AML/CFT") RegTech Forum in November 2019.i This is particularly true for the provision of remote services. About 90% of all retail banks have either launched or plan to launch remote on-boarding for individuals using Regtech solutions and there has been strong growth in testing remote customer on-boarding initiatives for corporates through the Hong Kong Monetary Authority ("HKMA") Fintech Supervisory Sandbox. The same is true for the groups of banks we have been working with over the last 12 months: 80% of Accelerator banks — those at an early stage of the adoption cycle — are now using or planning to use AML/CFT Regtech solutions, while 77% of Enabler banks — which had explored implementing machine learning in transaction monitoring and screening — are now either using it, conducting proofs of concept (PoC), or have concrete plans to do so. Encouraging as these results are, there is still more to be done. Throughout 2020, the HKMA, working with Deloitte, has been engaging industry stakeholders to better understand the factors and dependencies affecting AML/CFT Regtech adoption and, more importantly, considering how we should respond. This is the first time that we document and share comprehensive hands-on experience from banks that have implemented or are implementing AML/CFT Regtech, and forms part of the HKMA’s overall Regtech promotion initiative. Involving multiple stakeholders in AML/ CFT Regtech adoption is essential if we are to capitalise on the benefits. Banks that have already done this emphasise a number of key insights: • the importance of early and continuing stakeholder buy-in; • the need for interdisciplinary adoption teams with broad perspectives; • the value of forums to share views and experience; and • the ability to track and measure success. The adoption of Regtech for AML/CFT will continue to be a strong focus in the HKMA's supervisory engagement with the industry as well as individual banks. We will undertake further initiatives, working closely with all stakeholders, in the coming year to support our vision for AML/CFT Regtech in Hong Kong. Arthur Yuen Deputy Chief Executive Hong Kong Monetary Authority 4

AML/CFT Regtech: Case Studies and Insights 5

6 AML/CFT Regtech: Case Studies and Insights

AML/CFT Regtech: Case Studies and Insights Executive Summary THE KEY TO THE FUTURE IS COLLABORATION In its 2019 Mutual Evaluation Report on Hong Kong , the Financial Action Task Force ("FATF") recognised the efforts and contribution of the HKMA and the banking sector as a key part of the AML/ CFT ecosystem in Hong Kong.ii Building on that assessment, and like other similar international financial centres, we must stay agile in responding to the risks and opportunities resulting from new and emerging technologies. The steps that the HKMA is taking reflect international AML/CFT developments and broadly follow two parallel tracks: changes to our supervisory activity to make it more proactive, targeted and collaborative; and promoting responsible innovation and Regtech adoption for AML/CFT purposes in our banks.iii Despite the unprecedented challenges posed by COVID-19, significant results have been achieved in both areas. In September 2020, the HKMA shared its vision and roadmap for becoming more data-driven and technology-enabled in its AML/CFT work through the use of supervisory technology (“Suptech”).iv And since the AML/CFT RegTech Forum in 2019, which brought together stakeholders from both public and private sectors, the HKMA has continued to collaborate and coordinate efforts through various means, including for example a knowledge and experience-sharing workshop on network analytics with member banks of the Fraud and Money Laundering Intelligence Taskforce (“FMLIT”).v There are already examples where some of the techniques described in this report are delivering improved outcomes , such as neutralising mule account networks linked to face mask scams. The aim of this report is to sustain these developments and support coordination and collaboration across the ecosystem by sharing insights from early adopters of AML/ CFT Regtech with those that are currently planning their own initiatives. By focusing on industry case studies, the report illustrates various approaches that different banks have taken to AML/CFT Regtech adoption to address a number of common themes across the experiences of early adopters. FINDING THE RIGHT TOOLS FOR THE JOB This report is not meant to be prescriptive. Rather, it describes industry practices and insights that all banks can use to assess how the changing technology landscape in financial services will impact their exposure to money laundering and terrorist financing ("ML/TF") risks, and whether AML/CFT Regtech applications are right for them now or in the future. The modernisation of supervisory activities should go hand-in-hand with the adoption of AML/CFT Regtech by the private sector.

AML/CFT Regtech: Case Studies and Insights 7

—

Key Observations LOOKING AHEAD Over the coming year, data and technology will continue to be a key focus in our 2021 AML/CFT supervisory programme. We will continue to prioritise the use of Suptech to supplement and enhance our risk-based approach ("RBA") to AML/CFT supervision. Our promotion of responsible innovation and the adoption of AML/CFT Regtech will also continue through a range of events, including experiential labs, publications and other avenues to engage the industry. ACKNOWLEDGMENTS This report would not have been possible without the active participation of banks, technology providers and others, who generously offered their time and expertise during these historically challenging times. We are sincerely grateful to these professionals, for their support of our vision of collaboration. STAKEHOLDER BUY IN & EXECUTIVE SUPPORT Secure buy in and support early and throughout the Regtech adoption journey. Ensuring management expectations were aligned to the proposed approach have helped many early adopters build credibility with management especially for more complex and larger scale deployments of AML/CFT Regtech. CROSS FUNCTIONAL & INTERDISCIPLINARY TEAMS Diversity broadens perspectives and enables banks to comprehensively evaluate third party Regtech vendors, identify any additional benefits / uses for a solution, anticipate and address potential barriers to implementation, and secure the buy in. The trust and relationships formed across these teams also carry forward to future AML/CFT Regtech initiatives. FORUMS TO EXCHANGE VIEWS & EXPERIENCES From exchanging operational techniques using innovative technologies and analytic methods to crowdsourcing answers to implementation challenges, many early adopters especially those that are part of large banking groups — found creating forums to share and exchange ideas and experiences had accelerated AML/ CFT Regtech adoption. FOCUS ON DATA READINESS Data is often where the “rubber meets the road” for AML/CFT Regtech initiatives. Do not underestimate the time, effort and support required to source and prepare essential data. Early adopters stress the importance of starting discussions with data owners early and planning ahead. WORKING WITH THIRD PARTIES When assessing opportunities to partner with third parties, early adopters have looked at compatibility (“does it work with our systems and meet our needs?”), scale (“can the solution or vendor perform beyond a pilot deployment?”) and sustainability (“what do we expect the vendor to look like in three to five years’ time?”). CONSIDERING A HOLISTIC DEFINITION OF VALUE In tracking and measuring success, efficiency and effectiveness are naturally important elements of the return on investment. Many early adopters of AML/CFT Regtech look beyond immediate financial and operational benefits and include the people impact through experiential learning and cross functional collaboration, the customer impact, and adaptability in terms of further uses. 7

AML/CFT Regtech: Case Studies and Insights Section I Introduction AML/CFT REGTECH: FINDING THE RIGHT TOOLS FOR THE JOB If we go back only a handful of years, few financial institutions were discussing the potential application of emerging technologies, such as graph database models and machine learning techniques, to AML/CFT efforts. Today, it is difficult to imagine a conversation on the future of AML/CFT practices without at least some consideration of the many questions concerning the possibilities, risks and challenges introduced by these innovative technologies. Nevertheless, while the central role of data and technology is clear to all, the way each institution should approach and engage these emerging technologies may not be. Put simply: how can our institution get started with AML/CFT Regtech adoption? On this question, building on the well￾established RBA principles, AML/CFT Regtech adoption should be about defining a tailored approach for the unique characteristics of each institution. The volume of technology applications or the adoption of newer or more sophisticated technologies doesn’t necessarily indicate maturity or translate into efficiency and effectiveness gains. Despite transformative advances in capability, technology remains a tool (or, at best, an assistant or a partner), and finding the right tools for the job with a well￾defined governance model for responsible use should be the overarching objective of any AML/CFT Regtech adoption initiative. While the most cutting-edge technologies may not be for every institution now, all banks should carefully assess how the changing technology landscape in financial services will impact their exposure to ML/ TF risks, and whether AML/CFT Regtech applications, such as those involving elements of machine learning, are right for them now or in future. RAISING AWARENESS, LOWERING BARRIERS AND ENCOURAGING COLLABORATION To understand how the HKMA and other members of Hong Kong’s AML/ CFT ecosystem could help banks, in June 2019, the HKMA partnered with Deloitte to begin collecting data on how and to what extent banks were using innovative technologies and techniques in their AML/ CFT programmes. The survey found that about one third of the 196 respondents were using one or more of the eight technologies included in the functional definition of Regtech. 8

AML/CFT Regtech: Case Studies and Insights REGTECH DEFINITION Our understanding of Regtech will evolve along with the technology landscape. Our current functional definition was: applications or solutions used within AML/CFT programmes that leverage one or more of the technologies below. A detailed look at the response data led to some interesting observations. First, adoption was much lower among institutions with under one million customers. Second, institutions fell into three maturity groups according to the technologies and techniques adopted: those that are non-adopters, those that have adopted Robotic Process Automation ("RPA"), and those that have adopted or are adopting more sophisticated technologies and techniques such as network/graph analytics and artificial intelligence ("AI") (e.g. machine learning, natural language processing). And third, adoption rates among banks with retail customers were comparable to those among non-retail ones. These observations led us to set up conversations with local and regional representatives from the AML and financial crime risk, compliance, technology and operations functions of around 40 banks— both adopters and non-adopters—to better understand how some were approaching Regtech as a means to enhance AML/CFT processes; why others Robotic Process Automation (RPA) Optical Character Recognition (OCR) Cloud Computing Facial / Voice Recognition had not adopted any Regtech applications; challenges encountered prior to and during adoption; and what internal and external support banks felt they needed to better understand current technology applications and their potential. The main takeaway from the conversations was that early adopters were eager to share their knowledge and non-adopters were eager to learn. As one of the participants from the November 2019 event put it: “banks can compete on everything, but if we compete on the effectiveness of our AML/CFT controls, then we all lose.” It is easy to see why collaboration makes sense: AML/CFT is a team effort that involves banks and other stakeholders from across the ecosystem. As the application of innovative technologies in financial services accelerates, institutions that don’t adapt risk being vulnerable to exploitation—often referred to as “displacement risk”. These banks could also find it increasingly difficult to participate in sector-level initiatives, such as future data and intelligence sharing partnerships, which could detract from maximising the utility of sector-level AML/CFT analytic Network / Graph Analytics Natural Language Processing / Generation (NLP/NLG) Machine Learning Distributed Ledger Technology (DLT) techniques that are beginning to emerge overseas. For these reasons, we decided to focus this report on building awareness, and lowering the real and perceived barriers to AML/CFT Regtech adoption by sharing case studies drawn from a diverse set of early adopters, who have first-hand knowledge of common themes associated with AML/CFT Regtech adoption. 9

AML/CFT Regtech: Case Studies and Insights 10

INDUSTRY CASE STUDIES & INSIGHTS ON ADOPTION In addition to early adopters’ eagerness to collaborate, we also learned through the conversations that many AML/CFT professionals were looking for two things: the experiences of peers who have been involved in the adoption of innovative technologies into their institution’s AML/ CFT programmes; and insights into how these early adopters overcame common challenges. The following sections aim to address these points. In Section II, six banks offer unique perspectives into possible approaches for AML/CFT Regtech adoption. The goal is to show not only the real possibilities of innovative technologies in AML/CFT, but also that successful deployment is not limited to the largest, most complex financial institutions. As the HKMA has advocated, there is no one￾size-fits-all approach to AML/CFT Regtech adoption. In Section III, insights from interviews with practitioners from the six banks and technical experts from the industry are provided on five themes that were identified during the 2019 AML/CFT Regtech Forum as those often encountered by early adopters in their pursuit of AML/ CFT Regtech adoption: approaches to getting started; data and process readiness; third-party vendor relationships; people, talent and culture; and how to measure value and success. The use cases and themes discussed here represent only a fraction of a much larger industry discussion around the use of innovative technologies for AML/CFT, let alone the use of innovative technology in banking and financial services generally. The topics for this report were selected with the immediate aim of making AML/CFT Regtech as inclusive as possible by raising awareness and fostering collaboration. Section II Case Studies in AML/CFT Regtech Adoption Section III Thematic Insights

AML/CFT Regtech: Case Studies and Insights 11 “Given the dynamic nature of risk, and the volume and speed of data that banks are monitoring, screening and analysing, there is an obvious role for technology and Regtech to help in this process. The HKMA is committed to supporting the banking sector in its use of Regtech for AML work.” Carmen Chu, Executive Director (Enforcement and AML), HKMA. From the closing remarks of the HKMA AML/CFT RegTech Forum, 22 November 2019.

AML/CFT Regtech: Case Studies and Insights

Section II Case Studies in AML/CFT Regtech Adoption Our engagements with many early adopters of AML/CFT Regtech in Hong Kong and the Asia Pacific region showed that, while many institutions share an interest in similar technologies or approached Regtech adoption with similar goals, the actual adoption journey has been unique for each institution. For example, while Bank B began with a technology—RPA—and explored ways to apply it to legacy AML/CFT processes, others began with an existing challenge, such as managing operational efficiency, and explored using technologies such as RPA to address it. Is one approach better than the other? If you speak with representatives from each of these institutions, they will tell you it depends. It depends on the size, scale and complexity of your organisation, as well as the short, medium and long-term expectations and objectives you’re placing on the technology solution. The following section, therefore, aims to describe, rather than prescribe, a set of best practices. By highlighting approaches and experiences that have yielded positive results for institutions with varying characteristics, readers may find case studies that resonate with them. Bank A p.14 Network Analytics and Non Traditional Data Elements for Investigations A Bank B p.16 RPA within Name Screening and Adverse Media Searches B Bank C p.18 RPA within Transaction Monitoring Alert Investigations C Bank D p.20 Data Warehousing and Proactive AML/CFT Data Analytics Reviews D Bank E p.22 Machine Learning and NLP/NLG for Name Screening E Bank F p.24 Network Analytics for Fraud and Trade Based Money Laundering Investigations F 12

AML/CFT Regtech: Case Studies and Insights 13

LEGEND Find the case studies that are relevant for your institution by referring to the following icons. TECHNOLOGIES IN USE RPA Network Analytics SUGGESTED AUDIENCE Accelerators Institutions at an early stage of the AML/CFT Regtech adoption journey. Cloud & Data Storage Solutions NLP / NLG Enablers Institutions considering adopting machine learning and other cognitive technologies. Machine Learning Collaborators Mature adopters and members of FMLIT.

AML/CFT Regtech: Case Studies and Insights 14 1 2 3 4 5 Bank A Bank A is a Hong Kong subsidiary of a global bank offering a wide range of services, including retail products, in multiple Asia-Pacific markets. Building on the experiences of its group head office and other regional hubs, Bank A is a fast-follower in applying Regtech for AML/CFT. CONTEXT & BACKGROUND In 2020, Bank A in Hong Kong established an internal taskforce on AML/CFT Regtech, chaired by the Money Laundering Reporting Officer ("MLRO"), to identify opportunities to enhance the bank’s AML/CFT processes and controls through deployment of Regtech. One of the ideas picked up by the taskforce early on was to explore an emerging trend across peer banks and public sector agencies to incorporate non-traditional AML/CFT data elements, such as IP addresses, to identify otherwise undisclosed networks of relationships between customers. The use of network analytics and IP addresses was new to Bank A in Hong Kong, but not entirely new to the wider group. Financial crime risk specialists in other regions had attempted to form networks using IP addresses as an attribute. However, these experiments failed to produce meaningful insights that could be actioned by the relevant Financial Intelligence Units ("FIU"). The early lessons from their overseas peers led the taskforce and the Head of the Hong Kong FIU to take a more incremental, use case-driven approach for their initiative, which in retrospect was a key success factor. REGTECH APPLICATION Once Bank A defined the high-level purpose of the experiment—to identify hidden suspicious relationships using non-traditional data elements—they needed to determine the relevant entities and attributes for the exercise, and the methodology for aggregating and analysing the data set. Working off of insights generated from analysing suspicious transaction report ("STR") trends, Bank A focused on a group of around 50 customers based in the Asia￾Pacific region. They also defined a network ontology that included several attributes, including: basic demographic details, such as customer name and residential address; transactional data; and—most interestingly—data relating to a customer’s digital footprint, such as information concerning login attempts to their online banking account (date, time and location). Working across various databases and data owners, the taskforce prepared the data for analysis and compiled it on a Microsoft Excel workbook. Generating this initial data set for analysis took the taskforce around two months, much of which was spent working with data owners to explain the purpose and secure buy-in. Subsequent extracts took significantly less time, averaging around two weeks per request. Once the data set was ready for analysis, the taskforce was able to visualise the data and run queries to establish a number of interesting patterns and relationships. Noteworthy observations included: undisclosed clusters of relationships identified from multiple customers with the same IP address, email / correspondence addresses attempting to log into online banking accounts at the same time; and multiple attempts within a short (24 hour) timeframe to log into a single online banking account from IP addresses associated with multiple jurisdictions.

AML/CFT Regtech: Case Studies and Insights 15 TECHNOLOGY SPOTLIGHT | NON-TRADITIONAL DATA ELEMENTS FOR AML/CFT INVESTIGATIONS What happens when you increase the level of integration between data traditionally associated with different domains of risk, such as AML/CFT, anti-fraud and cybersecurity? Institutions experimenting with this approach are finding that breaking down traditional silos and applying innovative analytic techniques can yield meaningful insights for risk detection, management and prevention. For example, in addition to IP addresses, AML/CFT investigators are also experimenting with analytics using other non￾traditional data elements, such as data associated with private and public network access points (e.g. WiFi hotspots), HTTP cookies and local shared objects ("LSO"), as well as WHOIS registration information (e.g. individual, company or address associated with the registration of a website domain). STRATEGIC IMPORTANCE End-to-end, Bank A’s experiment applying network analytics to customer data involving non-traditional data elements took around one year. The experiment, according to the chair of their taskforce and the Hong Kong Head of FIU, yielded three key takeaways for Bank A. First, invaluable lessons were learned concerning the practical challenges of running a Regtech PoC / experiment and shared with other regional AML/CFT teams and FIUs within the group. Key lessons include the importance of communications and securing buy-in and support from internal stakeholders such as data owners, the time and effort required to ensure sufficient data quality and completeness, and limiting scope and clearly defining purpose at the outset to avoid being overwhelmed by the countless possibilities down the road. Second, network analytics (as used by Bank A in the PoC) and the use of non￾traditional data elements are more useful for intelligence-led investigations, rather than for passive monitoring. It can be a Last, and perhaps most important, the chair of their taskforce noted the “learning journey during the process and staff development” were just as, if not more valuable than the short-term results generated by the PoC. As IP addresses and other non-traditional data elements evolve and become more information-rich, Bank A hoped the analysts involved in this PoC have learned “thinking outside the box” and that approaching investigations with a spirit of possibility and trial-and-error can lead to real, tangible results. valuable tool for inquiry, rather than a tool to generate alerts.

AML/CFT Regtech: Case Studies and Insights 16

1 2 3 4 5 Bank B Bank B is a Hong Kong bank that is part of a larger regional financial services group. It offers a range of services across retail, corporate and private banking to a medium-sized customer base. While its group has pursued Regtech adoption for a number of years, Bank B has been advancing Regtech adoption in its Hong Kong operation since 2019. CONTEXT & BACKGROUND Unlike banks that began their Regtech adoption journeys by identifying existing pain points as possible use cases, Bank B began with an interest in the possibilities of RPA as a technology. Because its group was a mature adopter of RPA, Bank B was able to learn the underlying requirements and expected benefits of deployment across AML/CFT processes. Based on these exchanges, Bank B’s Head of Financial Crime Compliance ("FCC") viewed RPA adoption as a secure stepping stone for the team in Hong Kong to gain valuable experience and become better positioned to adopt more advanced Regtech solutions, such as those involving machine learning, in the future. REGTECH APPLICATION In mid-2019, working with their internal office focused on wider Fintech adoption, which facilitated internal experience sharing and provided advice, Bank B began a broad review of processes to identify those that would be suitable for automation using RPA. The review was guided by a framework that looked for processes that are manual (operated by a human analyst), repeatable / high frequency (the process is repeated often enough to generate efficiency gains), structured (minimal variance between cycles of running the process) and deterministic (one set of inputs will always produce the same outputs). The review identified name screening and adverse media searches for correspondent banking profile reviews as ideal candidates for automation. Bank B explained these legacy processes were unnecessarily manual and time-consuming. For example, analysts would have to manually retrieve ownership information from third-party data sources online, copy and paste the information into a name screening system, and review any search results. The same names would also need to be entered and searched online for adverse news. Not only were these processes repetitive and time-consuming, Bank B also found the nature of the work led to analyst fatigue and burnout, which appeared to correspond with increases in the risk of human error and poor judgment. After receiving internal approval, Bank B worked with the RPA vendor servicing group head office over 15 months to implement the solutions in Hong Kong around name screening and adverse media searches. The Head of FCC noted that this was longer than first anticipated. In retrospect, the longer timeframe was due to underestimating the knock-on impact any changes to existing internal systems would have on the new RPA solution. For example, the bank did not realise a change to a system’s interface design (e.g. moving the location of a button on a webpage), would require a corresponding change on the RPA solution so that it could continue to function as expected. During the system development, user acceptance testing ("UAT") and even production rollout stages, there were updates and enhancements to the various internal systems involved in the automation effort, and each round of RPA updates required a fresh UAT. Despite the unanticipated challenges, by September 2020, Bank B had implemented RPA across their name screening and adverse media searching processes for correspondent banking customers.

AML/CFT Regtech: Case Studies and Insights 17 TECHNOLOGY SPOTLIGHT | LOW-CODE / NO-CODE PLATFORMS Low (or no)-code application development platforms allow business users without a deep technical background or ability to code to rapidly prototype and create software in a visual, drag-and-drop environment. These platforms, which many RPA vendors on the market offer, could make technology solutions to AML/CFT challenges more accessible to a wider population. We spoke with an analyst who has been using low-code platforms to prototype software solutions to describe their experience. Below is an excerpt from our conversation. ANALYST A Years of Industry Experience: 5+ Programming Experience: Limited (MATLAB at School) Academic Background: Economics When did you start using low-code platforms? ”Around 5 years ago. Most of the applications I have worked on have been regulatory compliance based applications, one of them being a case-management tool that can help clients to ensure that they are compliant with AML/CFT-specific regulations.” How have low-code platforms changed the way you work? “The biggest benefit of a low-code platform is that anyone is able to pick it up. The drag-and-drop interface allows developers to learn, and fix mistakes, quickly. When writing detailed queries in SQL, I've literally spent hours combing through my code looking for why the script might have failed. With low-code it's much easier to see where things are going wrong and drag-and-drop means much of the large chunks of code are already written”. What are the major benefits of a low-code platform? “Another big benefit is that we are able to develop applications in a short time frame. As we work in a dynamic environment, the flexibility of the platform allows us to work with our stakeholders and develop solutions in a more efficient and effective manner. There are a number of visualisation features built into the platform that allow easy creation of usable management information ("MI"), without having to move data between systems”. STRATEGIC IMPORTANCE With the RPA solutions in production, Bank B is currently evaluating opportunities to apply more sophisticated Regtech tools involving machine learning techniques to their name screening and transaction monitoring ("TM") processes. The year￾and-a-half experience of deploying RPA provided Bank B with a number of lessons and experiences that carry forward to future Regtech initiatives, such as use case identification, scoping, business case development, as well as vendor selection and performance monitoring. The year-and-a-half experience of deploying RPA provided Bank B with a number of lessons and experiences that carry forward to future Regtech initiatives.

AML/CFT Regtech: Case Studies and Insights 18 1 2 3 4 5 Bank C Bank C is a Hong Kong subsidiary of an Asia-Pacific financial services group, offering a range of products and services locally for retail and institutional customers. Bank C is a relatively new adopter of AML/CFT Regtech, launching its first initiative in 2019. CONTEXT & BACKGROUND As part of a larger financial services group, the adoption of Regtech for Bank C can be organised into two general categories: group-wide solutions driven by head office, and locally driven solutions that do not impact systems or processes outside Hong Kong. At the group level, since 2017, Bank C’s parent has piloted a number of AML/CFT Regtech solutions, including two that use machine-learning techniques to enhance TM alert investigations. In Hong Kong, Bank C established a four-person FCC Transformation team within the AML/CFT function in 2019, tasked with identifying opportunities to enhance local AML/CFT capabilities using innovative technologies. REGTECH APPLICATION One of the first enhancement opportunities identified by the team involved deploying RPA across its TM alert investigation processes—namely, various data retrieval and routine analytic tasks, including: • Customer information (demographic, account and product information) retrieval from the core banking system. • Transaction data retrieval and basic routine analysis (e.g. identifying counterparties with the highest transaction volume). • External database searches (e.g. identifying any adverse / negative information from news media databases). According to the head of the FCC Transformation team, these legacy processes fit the criteria for RPA deployment in many ways: the process involved many manual steps across a number of systems; led to clear, deterministic outcomes; and The team selected these processes over other common enhancement areas, such as Know-Your-Customer ("KYC") / Customer Due Diligence ("CDD"), because of their relative simplicity. As first-time adopters, their logic was to start small, and reduce project complexities by minimising their dependency on other departments and systems. In total, end-to-end automation of the data retrieval process took six months. The first three months were spent understanding the user requirements, defining the process and interviewing RPA service providers. Once the underlying requirements were agreed and the vendor was selected, the team worked with the vendor’s engineer to script, test and refine the sequences followed by the software robot. was repeated frequently.

AML/CFT Regtech: Case Studies and Insights 19 TECHNOLOGY SPOTLIGHT | ATTENDED & UNATTENDED RPA RPA has been one of the most common technologies adopted by banks in Hong Kong for AML/CFT purposes (roughly 65% of adopters according to our 2019 survey), but the potential for automation extends far beyond the use of RPA. Unattended automation refers to automation that significantly reduces manual human intervention. By integrating more cognitive technologies, such as machine learning and NLP/NLG, automation efforts that started with RPA can move closer to unattended automation. Automation not only allows human analysts to focus on their comparative strengths in problem solving, it also creates a wealth of structure data and metadata on which analytics can be applied. STRATEGIC IMPORTANCE The RPA solutions supporting Bank C’s TM alert investigations have been in production since July 2020. While post-implementation impact assessments remain ongoing, an initial review highlighted a number of early benefits and lessons. The teams at Bank C are better able to handle periods of higher alert activity, and they have learned a number of lessons around the importance of anticipating and programming for exceptions that don't hinder humans, but could easily cause robots to malfunction or crash. Bank C’s logic was to start small, and reduce project complexities by minimising their dependency on other departments and systems.

AML/CFT Regtech: Case Studies and Insights 20 1 2 3 4 5 Bank D Bank D is a Hong Kong subsidiary of a large overseas bank offering wealth management, asset management and investment banking services. Bank D and the global functions that support the group’s operations have been upgrading their technology infrastructure and adopting Regtech solutions for over five years. CONTEXT & BACKGROUND Whereas many of the banks profiled have focused more on the processing abilities of AML/CFT Regtech, Bank D began by focusing on how AML/CFT-related data is captured, stored and accessed. The initiative to modernise their AML/CFT data repository began over five years ago as part of a wider initiative to standardise the IT infrastructure supporting the bank’s global wealth management business. Prior to this initiative, downstream AML/ CFT systems such as name screening, adverse media searching, and transaction monitoring were each fed by multiple upstream KYC and product systems that held customer, transaction and trade data. Stand-alone requests for data, for instance as part of an FIU investigation, would also need to be made to an ad hoc reporting team. The silo-ed architecture and manual processing of data requests translated into operational inefficiencies and cost. Fulfilling one of these ad hoc data extracts or reports, for instance, could require a dedicated team two or more weeks to produce. REGTECH APPLICATION Over two years, Bank D upgraded its data infrastructure to address many of these inefficiencies by focusing on aggregation and access. It created an intermediary data repository between the upstream and downstream systems that aggregated over eight billion data points covering KYC, transactions and trade data from the various upstream systems. The intermediate data repository, while continuing to feed the downstream AML/CFT control systems, also provided users, such as FIU and AML/ CFT analytics teams, direct, near real-time access to the data for ad hoc requests and ongoing reporting. The creation of this intermediate data repository allowed AML/CFT specialists to directly pull data extracts from the repository and perform proactive data analytics reviews. The initial reviews conducted by the AML/CFT specialists were described as “look across” exercises, where the team would explore the data to see if a risk pattern identified by their FIU in one instance could be identified in others within the customer data. When the repository went live, the team performed three exercises. Within 18 months, the team was able to run 10 reviews, which also began producing findings that led to STR filings to law enforcement. Example: RIGHTS OF REPRESENTATION "LOOK ACROSS" REVIEW An FIU identified a suspicious client group where parties held "rights of representation" (e.g. authorised signatories; power of attorney) across multiple client relationships despite not being beneficial owners. The upgraded data infrastructure allowed Bank D's financial crime risk￾focused data analytics team to carry out a "look across" exercise to see if this type of pattern existed across other client groups. This exercise identified a number of other suspicious client groups, which were escalated to the FIU for further investigation. Controls were designed based on the identified typology and implemented across the bank.

AML/CFT Regtech: Case Studies and Insights 21

STRATEGIC IMPORTANCE In addition to the immediate efficiency gains that came from various users’ direct, near real-time access to data, the highly aggregated data storage solution also allowed Bank D to test AML/CFT Regtech solutions involving more advanced data intensive technologies using AI. For example, Bank D is currently testing a combined name and media screening application utilising machine learning algorithms, an AI￾enhanced approach to TM, and a network analytics tool that can assist the bank’s FIU in exploring undisclosed or less obvious relationships between entities involved in their casework. TECHNOLOGY SPOTLIGHT | LOW-TECH INNOVATION Many early adopters are finding that with AML/CFT Regtech, the best solutions are not necessarily the most sophisticated. Today, many of the questions asked by analysts during the course of an investigation can be answered by pairing the analyst with the right data and a colleague who can translate the question into a data query using open source programming languages, such as Python or SQL. Take for example an incident like the Panama Papers from 2016. In the immediate days and weeks following news of an event like this, AML/CFT professionals at banks may want to know if there was any suspicious customer activity in the weeks immediately preceding the news. Using open source analysis tools in Python, such as “pandas”, along with visualisation libraries such as “Matplotlib”, an analyst could go through transactional data to group the original dataset and see summed transaction values across the defined period. Example 1: going through thousands of rows of transactional data and calculating daily transaction values. Input: grouped_data = dataset.groupby('Transaction_Date'). agg({'Transaction_Amount':['sum']}) grouped_data Output: Transaction_Amount sum Transaction_Date ... ... 04/04/2016 24,095,377 05/04/2016 48,015,002 ... ... Example 2: plotting the results visually on pandas using Matplotlib. Input: plot = grouped_data.plot(kind='line', legend = False) plot.set_ xlabel("Date") plot.set_ylabel("Amount") Output:

AML/CFT Regtech: Case Studies and Insights 22 1 2 3 4 5 Bank E Bank E is a Hong Kong subsidiary of an international bank offering a wide range of services, including retail products, in multiple Asia-Pacific jurisdictions. Bank E has been studying and applying data and technology-driven approaches to AML/CFT for over a decade. CONTEXT & BACKGROUND Bank E has applied a range of technology solutions to enhance a number of its AML/ CFT processes. One of the areas where Bank E applied an AI-aided Regtech tool is in name screening. Prior to deploying their Regtech solution, Bank E had over 300 analysts working on name screening cases. With alert volumes increasing year-on-year due to corresponding increases in watchlists and customer volumes, Bank E—like many peer multinational institutions—strived to enhance operational efficiency and optimise resource allocation associated with name screening. The previous manual approach to name screening also exposed the bank to potential errors resulting from a number of factors. Analysts, for example, who spent much time reviewing and clearing hundreds if not thousands of alerts (many of which are deemed “false positives”), could possibly overlook some data or fail to document all the relevant details. REGTECH APPLICATION In 2017, when Bank E began solving for these challenges, introducing Regtech solutions into the name screening processes was not new. Some financial institutions were using attended RPA to automate the data entry aspects of the name screening process, while others were beginning to experiment with machine learning-enabled solutions that would “score” alerts based on the likelihood that they were a positive match before introducing them to human analysts. What set apart Bank E’s ambition was the desire to find an automated solution that would issue explainable recommendations to escalate or close, instead of just assigning probabilistic scores to alerts that would still require human review. The bank wanted a tool that would reduce human effort in clearing alerts, while still meeting the same rigorous control standards applicable to human decisions. Unsurprisingly, Bank E could not find a solution readily available in the market that met these criteria and the bank ultimately chose to partner with a third-party vendor specialising in AML/CFT applications of machine learning to co-develop one. Bank E and their vendor trained their machine learning models on training data, which mainly comprised previous name screening alerts and corresponding decisions made by human analysts. As the iterative process of training the model began to yield positive results, Bank E ran an internal PoC with the goal of validating that its machine learning solution could solve alerts for several sample jurisdictions. The bank set an ambitious success criterion for the PoC: solving a minimum of 25% of alerts without making errors, and with sufficient explanation on how the model arrived at its decisions. The PoC was a success, and 12 months after the launch of this initiative, Bank E was able to take the pilot into production. The majority of this time was spent developing and rebuilding the internal processes and controls and completing more exhaustive testing across more complex markets. Although this resulted in a lengthy implementation process, Bank E felt it was the right decision as it helped build confidence with internal stakeholders across the bank in terms of model risk, AI governance and audit, as well as external stakeholders, such as regulators in applicable markets.

AML/CFT Regtech: Case Studies and Insights 23 TECHNOLOGY SPOTLIGHT | EVOLVING OUR RELATIONSHIP WITH REGTECH The relationships we are forming with Regtech tools are changing. Regtech tools today can certainly help us complete tasks we don’t necessarily want, or are not best suited, to do. Think of tools like RPA automating repetitive data entry for name screening; these automation tools in many ways are our assistants. As banks enrich their data landscapes and adopt more cognitive technologies—such as machine learning-aided solutions— Regtech tools have the ability to grow from assistants handling processes, to something closer to partners solving problems. They can help us complete critical tasks better by mimicking us when we are at our best, and point out potential errors or make recommendations, much like Bank E’s name screening tool. Further afield, Regtech leveraging more advanced applications of AI has the potential to help us approach problems for which we are ill-equipped, like suggesting new and emerging money laundering typologies across vast pools of data before they are identified and codified by humans.vi The Assitant Takes care of routine, easy-totrain tasks, but requires direction. The Coach Keeps an eye out for possible improvements within defined boundaries. The Partner A team mate that works alongside you to think outside of the box and find solutions to problems. STRATEGIC IMPORTANCE Bank E and its third-party vendor’s machine learning-powered name screening solution yielded a number of immediate and second order benefits for the institution. As an immediate benefit, the machine learning tool improved the overall effectiveness of alert investigation by ensuring all alerts were reviewed consistently against all available sources. It also improved the efficiency of investigations by reducing the number of manual alert reviews by approximately 35% across multiple jurisdictions (as high as 50% in some), and increasing the time available to review higher value alerts. The machine learning-enabled solution increased the consistency of review quality, reduced the number of manual alert reviews by approximately 35% to 50% across multiple jurisdictions and increased the time available for analysts to review higher value alerts.

AML/CFT Regtech: Case Studies and Insights 24 1 2 3 4 5 Bank F Bank F is a subsidiary and regional head office of a large global bank offering a wide range of services, including retail products, across Asia-Pacific. Bank F has been studying and applying data and technology-driven approaches to AML/CFT for over a decade. CONTEXT & BACKGROUND Among its many AML/CFT Regtech initiatives, Bank F has been using innovative technologies to address challenges associated with commercial fraud involving trade products and trade based money laundering ("TBML"). As banks providing trade finance services know all too well, identifying possible fraud and money laundering within cross-border trade has been challenging because it often involves several parties across multiple jurisdictions, and is either extremely data intensive (documentary trade) or data poor (non-documentary trade). Identifying indicators of common fraud and TBML typologies, such as round tripping and multiple invoicing has often required analysts and client relationship managers to manually retrieve, prepare and analyse data from various internal and external sources to uncover hidden relationships between trade partners or discrepancies in underlying data and documentation. Not only were these approaches prohibitively time and resource intensive, their efficacy was also often limited by the silo-ed way the data was typically held across internal and external sources. Adding to these challenges were the substantial losses related to trade-based fraud and money laundering. Commercial loan defaults, and resolving disputes, litigation and regulatory actions tied to adverse incidents have led to significant costs.vii REGTECH APPLICATION Bank F had been studying potential applications of network analytics (also known as graph analytics) since 2008. In 2013, as the first of several applications involving network analytics, Bank F implemented a solution in Hong Kong that identified high-risk customers and transactions based on a variety of internal and external data, including: wholesale client data, correspondent banking data, trade data, payments data, and other external data such as company registries, internet domain registries, and adverse media databases. An example from 2015 will help to illustrate how network analysis was used to enhance Bank F’s ability to identify a network demonstrating high ML/TF risk. As mentioned, one of the key challenges for Bank F was bringing together parties across multiple jurisdictions. In this case, a relationship manager gathered intelligence regarding TBML related to a drug cartel in one account, and used the connected￾parties functionality within the bank’s customer relationship management ("CRM") tool to link this to another account. Prior to the introduction of their network analytics tool, this and other even more manual approaches to reviewing documentation for signatories were the only means to make these connections. By introducing the network analytics tool, Bank F was able to identify additional companies that were linked to the first two parties by using linked phone numbers and email addresses. Further analysis of account activity determined money laundering concerns related to some of the companies now established within this network.

AML/CFT Regtech: Case Studies and Insights 25 TECHNOLOGY SPOTLIGHT | NETWORK ANALYTICS & GRAPH DATABASE MODELS Many network analytics applications today are establishing and analysing relationships using data that is still stored in relational databases, where entity data that have been stored in tables of rows and columns must be linked through a separate set of operations (JOIN Table or Lookup Table) that establish their relationships. These “non-native” applications of network analytics are costly and inefficient compared to their “native” counterparts, which build applications on top of database models that store relationships between data alongside the data itself (or “graph database models”).   

Relational Database Using table joins to gather transactions on a particular account could become inefficient at scale. Graph Database Doesn’t require table joins to find relationships between the data because graph data is structured so that all nodes (data rows) are linked directly by their relationships. AML/CFT programmes, especially at larger financial institutions, consume massive amounts of data in a fast paced environment. For network analytics to perform under these conditions, users are increasingly looking at graph database modelling and native applications to remove legacy impediments to cost and efficiency.ix Suspicious Party #1: Company A. Triggering financial crime concern: Reliable intelligence on cartel activity that “a suspected money launderer coordinated money transfers to … Company A”. Suspicious Party #2: Company B Company B was identified by the Relationship Manager to be in the same group (same directors, authorised signatory) as Company A. Machine Identification Human Identification Phone Number Email Address Suspicious Party #3: Company C Network analytics tool uncovered an additional company, Company C, which was only linked to Company A through phone numbers and email address. Account reviews for Company A, B and C revealed potential money laundering concerns. STRATEGIC IMPORTANCE By 2016, three years after the initial deployment in Hong Kong, Bank F had scaled up their use of the solution to cover their Top 20 commercial banking sites globally, and around 80% of their entire trade lending book. Since deployment, the tool has led to the review of around 100 customer relationships for AML/CFT reasons. These customers held around USD 500 million in clean or unsecured exposures. Even if 10% of this exposure was unrecoverable, the tool contributed to around USD 50 million in savings for the group in terms of fraud loss. The returns on Bank F’s investment into the development and deployment of this tool were not limited to the immediate impact on anti-fraud and AML/CFT efforts. The preparation work on the bank’s data, the familiarity with network analytics gained by users and decision makers and other lessons learned through the tool’s deployment all helped Bank F secure management buy-in for a new, more advanced tool that is currently being piloted across a number of different markets. This subsequent tool was launched on a global platform, built in partnership with a vendor that provided more advanced capabilities in entity resolution and network analytics.viii The goal was to enable Bank F to process data in a manner that provided a detailed but holistic view of its customers and their networks on a robust and scalable platform. The new solution is now in production across multiple jurisdictions and leverages a data lake with over 40 billion rows of data. It is being used across multiple lines of business as part of ongoing efforts to move to a more intelligence-based approach to AML/CFT in general. It has enhanced transaction monitoring capabilities in Hong Kong and other key markets with high volumes of data and continues to evolve and scale today.

AML/CFT Regtech: Case Studies and Insights          

  

Section III Thematic Insights The approach and timing for adopting AML/ CFT Regtech will be different for every bank. A bank branch expecting to maintain a relatively small footprint, for example, may find the costs outweigh the expected efficiency benefits of automating certain manual repetitive tasks. What is important is that management’s decision on the extent to which to adopt AML/CFT Regtech should be based on an informed, holistic consideration of the risks, benefits and costs.  Our conversations with MLROs and other representatives from non-adopter institutions since 2019 found that too often decisions concerning AML/CFT Regtech adoption were heavily influenced by vague or inaccurate perceptions: “[Regtech] applications are too expensive and resource intensive for us”, “this is over-engineered for our needs”, or “artificial intelligence applications are too much of a ‘black box’ for us.” In some cases, the focus on technology and the perceived effort required to make sense of AML/CFT Regtech seemingly ended the conversation before it ever had a chance to begin. So when we started speaking with early adopters, we were particularly interested in asking MLROs and other AML/CFT practitioners, who did not have a deep background in data or technology, how they began their own journeys into AML/ CFT Regtech, how they experienced and overcame obstacles to adoption, and— knowing what they know now—what they would suggest to others who are considering getting started. At the highest level, we found that AML/ CFT Regtech adoption has been less of a sprint for many of these early adopters, and more of an exercise in orienteering. It has been less about advanced software and tooling, and more about the clarity of the institution’s AML/CFT vision and objectives, its willingness to begin a potentially long, arduous and uncertain journey, and its ability to encourage and empower its people to innovate throughout. In this section, we look at how different banks worked through some common barriers to AML/CFT Regtech adoption to provide perspectives to those encountering these issues today, and considerations based on actual experience for those discussing adoption in the near future. Getting Started p.28 Data & Process Readiness 2 p.32 Third Party Vendor Relationships 3 p.36 People, Talent & Culture 4 p.38 Performance Metrics & Indicators 5 p.42 1 26

AML/CFT Regtech: Case Studies and Insights 27

AML/CFT Regtech: Case Studies and Insights 28

Getting Started THE CHALLENGE Figuring out where and how to get started can feel overwhelming, especially for leaders without a data or technology background. EARLY ADOPTER INSIGHTS You’re beginning a marathon, not a sprint. Secure management buy-in early and throughout to build credibility; avoid working in silos (gain perspectives through diversity); and accelerate the adoption process by learning from the experiences from others both within and outside your organisation. QUESTIONS FOR CONSIDERATION • Have we thought through the tradeoffs between the possible paths forward? • Are management expectations aligned to the approach we’re proposing to take? • Do we have a forum to share AML/ CFT Regtech adoption experiences across our organisation? For those leading their institutions’ adoption of AML/CFT Regtech, the journey ahead can feel daunting and complex. Defining the business case, understanding the data and technology requirements, standing up and running change programmes, securing investment and buy-in, liaising with regulators….the list goes on. Couple this with the reality that most banks must deal with multiple teams and accountable stakeholders, often in multiple jurisdictions, and even starting the journey, let alone organising and governing it effectively, can be a tall order, even for the most seasoned executive. Throw in the competing pressures of Business-as-Usual ("BAU") and uncertainties that must be managed as they arise, and one can quickly see why the most common questions from non-adopters since 2019 were: where and how do we begin? IS THERE A RIGHT WAY TO BEGIN? One of the debates on Regtech adoption centres around scale and focus. Is it better to start smaller and scale up or to plan and prepare so that you can go big? Is it better to start with a focus on a specific use case or on a specific technology (or technologies) that can service a range of future demand? We learned from the early adopters profiled in Section II that all of these approaches can (and have) yielded positive outcomes. Bank A identified unusual customer activity through their point-in-time use of network analytics. Bank D’s multi-year investment in large-scale transformation of their data architecture opened up countless downstream opportunities for their FCC and FIU teams. What is more interesting than the ability of these different approaches to yield results is this: the outcomes aligned to the original expectations going into the adoption initiatives.

AML/CFT Regtech: Case Studies and Insights 29 Starting with a specific business or risk outcome and executing any technology, data, process or people changes around this end goal. Starting by investing in data, systems and/or infrastructure changes that could lead to a large number of downstream benefits across multiple use cases. Planning and preparing for a multi-year investment to achieve wider organisational impact and transformation in the long term. A focused investment into a discrete initiative to achieve a measureable set of short term outcomes or proofs of concept. • Easier to explain expected outcomes for sponsors; • Likely to yield earlier benefit; • Easier to benchmark against other AML/CFT initiatives in the market; • Can be specific when requesting time and input outside of immediate teams; • Easier to anticipate sponsors and stakeholders to manage at the outset; • Earlier exposure of the technology to AML/CFT teams (or end users). • Easier to define and request technical expertise; • Multiple downstream benefits / use cases often unlocked; • Often drives general improvements to the data environment, which pays dividends during future Regtech initiatives; • Often facilitates general upskilling of end users on the data environment, which again can lead to efficiency and effectiveness gains during subsequent Regtech initiatives. • Larger scale programmes, once signed off, will often provide priority status to requests compared to ad hoc ones; • Likely to formalise working relationships across functions / disciplines; • Steady pipeline of downstream benefits / use cases; • Can often entail transformative benefits, such as improved access to and aggregation of data. • Lower cost and commitment, often easier to seek approvals, particularly locally; • Shorter time to hands￾on activity; • Can, but not guaranteed to, integrate into wider solutions or initiatives; • Shorter value cycles, benefiting sponsor /stakeholder management; • Often easier for AML/ CFT teams to appreciate and maintain focus / momentum. • Securing support if sponsors sit across multiple functions with competing priorities; • Requests (e.g. data extracts) often less of a priority compared to those for large-scale programmes; • Scalability of the solution when/if expanding to further use cases; • Integration of solution into strategic operating models. • Securing buy-in without “overpromising” at the outset and miss￾managing expectations; • Outcomes and timing of outcomes can be hard to forecast; • Experimentation is key from a programme expectation perspective, but challenging from a BAU and stakeholder management perspective; • Solutions are evolving at a rapid pace so shelf life and relevancy can be difficult to manage. • Harder to get approval, longer path to starting (consider also: shelf-life of solutions); • Expectations and scrutiny on outcomes and benefits will be higher and omni￾directional; • Harder to “steer the ship” due to size, stricter governance and oversight; • Investment outside of data and systems (e.g. people and org. design) required to fully realise benefit. • Lack of awareness can lead to duplicated efforts across the business; • Time required to raise support versus shelf-life of the outcome; • Realising value beyond the immediate time horizon (or the expectation from sponsors to do so). Bank A Non-traditional data points to spot suspicious activity. Bank D Focus on compliance data storage solution. Bank F Focus on network analytics technology. Bank E Transformation of name screening process using machine learning. Bank D Large scale transformation of their compliance data environment. Bank A Timeboxed experiment with IP addresses and network analytics. Bank B / Bank C RPA as a stepping stone for considering other more mature technology solutions. Use-Case- Led Solution-Led Large Scale Small Scale Nature of Approach Scale of Approach Description Expected Benefits Expected Challenges Examples

AML/CFT Regtech: Case Studies and Insights 30 HOW DO YOU EFFECTIVELY ORGANISE YOURSELF AROUND AML/CFT REGTECH ADOPTION INITIATIVES? Most if not all AML/CFT Regtech adoption initiatives will involve more than one function within an institution. In many cases, it will require coordination with teams in overseas jurisdictions. If, for example, an investigative function serving a region out of Hong Kong adopts a solution involving cognitive technologies, as Bank E did, then the markets that rely on that regional function will need to understand and evaluate the solution’s impact on their ability to meet their local AML/CFT regulatory requirements. The involvement of multiple stakeholders is as essential as it is difficult. The early adopters we interviewed shared a number of lessons they learned throughout their journey. Three key lessons on getting started are worth highlighting: the criticality of early and ongoing stakeholder buy-in; diversifying perspectives by building interdisciplinary adoption teams; and creating forums to share views and experience across jurisdictions. CONSIDERATION 1: SECURE BUY-IN EARLY AND MAINTAIN THROUGHOUT Several banks highlighted the criticality of obtaining and maintaining business support for any AML/CFT Regtech adoption initiative. Bank B in particular described how they spent a month before launch engaging with senior management to ensure they understood and bought into the underlying problem statement and detailed cost-benefit of the proposal. Senior executives and business sponsors may not be as familiar with AML/CFT processes and controls (the value that is obvious to you, may not be obvious to them), so starting early and getting sponsors to a place where they can explain the value of a proposal in their own words to other stakeholders, such as board members, is important. Leaders from early adopters also highlighted the importance of early and accurate cost estimation. Bank E and others warned that first-time adopters run the risk of underestimating development, deployment and especially maintenance costs, and overestimating the immediate and long-term benefits of the solution. On the other hand, Bank A and Bank F emphasised the value of maintaining enthusiasm and buy-in throughout the implementation initiative. The longer￾term value of both banks’ early investments in network analytics was that it established the general arguments for applying these tools to AML/CFT in their organisations. This broad foundation of understanding and support has allowed Bank F to progress to deploying network analytics in various aspects of AML/ CFT. CONSIDERATION 2: BUILD CROSS-FUNCTIONAL, INTERDISCIPLINARY TEAMS Bank E, Bank F, and other mature adopters of AML/CFT Regtech cite the importance of diversity in the teams that lead AML/CFT Regtech initiatives, as well as the FCC and FIU functions these solutions ultimately support. Diversity in this context often means bringing together subject matter experts in financial crime, data, technology and the institution’s products and business operations, with functional experts who possess skills around change management, programming and engineering, design and communications. This diversity broadens perspectives and enables institutions to achieve things such as evaluating third-party Regtech vendors, identifying secondary benefits / uses for a solution, anticipating potential road blocks to implementation, and securing the buy-in discussed previously. The principle of building interdisciplinary teams applies to even early-stage AML/CFT Regtech initiatives involving relatively straightforward applications of RPA. Bank B, for example, established a Fintech committee to govern all Fintech-related initiatives, including those under the umbrella of Regtech. The team comprised senior management covering project management and technology transformation, end-user perspectives (AML/CFT professionals), systems development, key business-level decision-making and third-party vendor management. With support and oversight from Bank B’s local board of directors, this committee helped those leading the AML/CFT Regtech initiative challenge and shape the business case, and obtain broad-based support for implementation.

AML/CFT Regtech: Case Studies and Insights CONSIDERATION 3: SHARE EXPERIENCE TO ACCELERATE ADOPTION Finally, for institutions with group operations spanning multiple markets, creating forums to share and exchange ideas and experiences can accelerate AML/CFT Regtech adoption. Bank A’s use of network analytics in 2019/20 is an example of this. As described in Section II, Bank A’s internal peers overseas had previously tried and failed to obtain meaningful results using IP addresses. Lessons from these failed experiments subsequently led the bank to take a more surgical approach, limiting the scope of the exercise. What made this possible was a culture and organisational set-up that allowed the exchange of information and experience. Bank A has forums at the local, regional and group levels where AML/CFT Regtech is discussed. Most recently, the Hong Kong AML team’s use of network analytics and IP addresses was presented at the local bi-monthly forum chaired by the Hong Kong CEO and attended by senior leaders from across the business. Regionally, the use case was shared with the leads/representatives of FIUs from each of the Asia-Pacific markets, and a seminar was conducted with over 100 investigations team members on the use of non-traditional data elements, such as IP addresses, and the applications of AML/CFT Regtech more broadly. As one of the leaders from Bank A noted: “using both ‘top-down’ and ‘bottom￾up’ approach[es] can be quite effective on the collaboration with regional/global partners.” 31

AML/CFT Regtech: Case Studies and Insights 32

Data & Process Readiness THE CHALLENGE How did early adopters prepare their data and processes for adopting RPA and network analytics? EARLY ADOPTER INSIGHTS Anticipation is a key to success. Anticipate situations that could throw a wrench in the robot’s path, or the data owners who may need a little more convincing to participate in the experiment (or prioritise your request). Manage expectations; allocate sufficient time for preparation. QUESTIONS FOR CONSIDERATION • Have we thought through “unhappy path” scenarios for the process we want to automate? • Do we have performance data on the process we want to automate as a benchmark? • Who “owns” the data we need to run our network analytics experiment? Banks have been collecting, storing and using data for AML/CFT for years. Driven largely by legal and regulatory requirements, they have been investing in technology to collect and store their customer and transactional data, as well as analytics to monitor and understand their customers’ behaviour. The same applies to AML/CFT policies and procedures. Banks have spent decades engineering and re-engineering the frameworks and protocols that guide their staff on how to comply with laws and regulations, and manage the risks of financial crime. So with decades of experience on AML/ CFT data and processes, out of the 40+ institutions we interviewed over the past year, why did so many raise data and process as roadblocks to AML/CFT Regtech adoption? One possible explanation lies in the nature of the technologies underlying the Regtech solutions that are becoming available today. From data quality to process documentation and metadata, the standards that were sufficient for yesterday’s solutions may no longer be sufficient today. This section therefore focuses on how early adopters have prepared their data and processes for AML/CFT Regtech adoption. Specifically, we look at readiness in terms of RPA and network analytics — two forms of Regtech that have gained interest amongst Accelerators (those beginning their AML/CFT Regtech adoption journeys) and Enablers (those who are beginning to approach more sophisticated and cognitive applications of AML/CFT Regtech).

AML/CFT Regtech: Case Studies and Insights 33

HOW DO WE PREPARE OUR MANUAL PROCESSES FOR AUTOMATION? The majority of banks in Hong Kong that have begun to adopt AML/CFT Regtech have done so through automating existing manual processes. Two reasons for RPA’s popularity are: first, that it is a relatively non-invasive solution — the robots act like an ordinary user, replicating functions currently done by humans to extract and retrieve data — and, second, the main value statements of RPA — cost takeout and resilience — are attractive and easy to understand. For many AML/CFT programmes that have seen the number of processes and headcounts balloon over the years, the opportunity to lower cost and increase quality (not only of the outputs, but of their staff’s state of mind) through technology was a welcome challenge. For institutions considering the use of RPA in their AML/CFT programmes, Bank B and Bank C offer valuable insights from their recent experience deploying the technology across a number of AML/CFT processes. CONSIDERATION 1: PROCESS COMPLEXITY Bank C approached adoption by thinking about RPA as a simulation of user activity that was highly repetitive and required limited human judgement. This made their target processes involving TM alert investigations attractive for RPA. However, looking back, Bank C also encourages banks to consider if the user activity is the correct activity in the first place. In other words, could you enhance, streamline or standardise the process before deciding on whether to automate it using RPA? Avoiding this step could lead to unnecessary project delays and cost. In Bank C’s case, because the various systems involving TM alert investigations that the robot interacted with were not updated prior to RPA deployment, subsequent changes to the systems required stopping and updating the RPA solution. CONSIDERATION 2: DOCUMENTATION & DETAIL Is there sufficiently detailed understanding / documentation of the processes being automated? At Bank B and Bank C, documentation of high-level procedures was in place but both banks had to invest time in developing the detail around their target processes. Bank C had to define keystroke-level procedures to provide the required input to the developers (in this case external vendors), for example, down to the location of a button on a webpage that had to be clicked to initiate a search. Bank B had to think through and define how human analysts would respond when things didn’t go right (or what are called “unhappy path scenarios”). If the third-party database containing ownership information was down, what should the analyst do? Without designing for these contingencies, Bank B learned, the robot would either shut down or errors would need to be identified after the fact in log files by humans. Lastly, Banks B and C were primarily looking at customer, transaction or negative news data, all of which was digitised. Any paper-based or non-readable formats would need to be considered in the context of investment and cost versus benefit. CONSIDERATION 3: PROCESS DATA & METRICS Tying into the overarching theme of stakeholder buy-in and measurable outcomes, Bank C highlighted one of the challenges associated with RPA: how do you measure the benefits if you don’t have the data? For instance, on average, how many adverse / negative news searches does a human process in a day? What is the error rate? Measurement is not limited to quantifiable measures. The impact of a solution on your people and their reaction should also be considered. For example, do analysts running name screening searches feel the searches are a valuable use of their time and talent? Investing the time and effort upfront to create data around processes targeted for automation will provide leaders with an edge in crafting their narrative and securing ongoing support for AML/CFT Regtech initiatives.

AML/CFT Regtech: Case Studies and Insights 34

HOW DO WE PREPARE TO START USING NETWORK ANALYTICS? The art of establishing relationships and identifying patterns in a sea of data has been a fundamental pillar of AML/CFT investigations since before the emergence of graph databases and network analytics. The appeal of these technologies to those involved in investigations involves at least two aspects. First, the visual interface of these technologies brings clarity to how investigators interact with data sourced from various internal and external databases. Without underemphasising the data preparation work involved, the ability to toggle criteria and explore how entities are connected across multiple attributes exponentially increases the productivity of investigators, who otherwise would have had to spend days and weeks manually pulling together the data and creating the networks. Second, more advanced applications of network analytics that involve AI (e.g. deep learning algorithms for graphs), allow investigators to access machine-generated insights drawn from data volumes that far exceed the reaches of human cognition. Bank A as well as Bank D, Bank E, and Bank F, are all using or experimenting with network analytics. These banks shared a number of considerations for banks exploring network analytics as a possible tool for their AML/ CFT programmes. CONSIDERATION 1: DATA SOURCING & DATA GOVERNANCE Bank F, which has been using network analytics at scale for over five years, emphasised the criticality of having data of sufficient quality. “Network analytics is particularly vulnerable to data weaknesses…which can drive accidental linkages and missed risk factors.” Once the desired application of network analytics is agreed, one of the first priorities must be the high-level identification of systems that contain the data required to run the requisite scenarios, data quality checks, cleansing, formatting and remediation as required. Bank A, which piloted a much more limited application of network analytics, echoed Bank F’s sentiments. Despite their more targeted ambition, the data they required for their pilot were stored in various systems managed by different teams. It took them around two months to receive relevant data from internal partners, who had to manage competing priorities to deliver the extracts. The data they received then had to be massaged for analysis, which also required time. Bank F, which invested in standardising the practice of cleansing and formatting data during their initial deployment of network analytics, highlighted how this decision reduced the time required to get future deployments of network analytics up and running. Bank D and Bank E, which also use network analytics, addressed this challenge by spending the first few years of their Regtech adoption journey on data transformation and laying a strong foundation for future applications. CONSIDERATION 2: INTERNAL & EXTERNAL APPROVALS Because one of the benefits of network analytics lies in its ability to provide investigators with much richer context in which to lead their inquiries, the more contextual data you can feed into the system, the better. The challenge, as alluded to by Bank A and Bank F, is not only sourcing the data from the various upstream systems, but also getting the commitment and approvals to do so. Building a clear communication and execution plan around obtaining necessary external and internal approvals (including system owners) for moving data to a single location from different jurisdictions and systems was therefore critical for these banks. System development teams should recognise that as network analytics requires data from multiple systems, it can take time to secure approvals and build feeds to source systems. If a bank already has standardised cleansing and formatting processes, this will significantly reduce the time it takes to start running network queries. The more significant time taken is to implement at scale through the use of large datasets, using the chosen platform and the subsequent build of the network analysis. It is at scale that the true benefits of network solutions will be seen. In anticipation of this scale, cloud-based solutions, or horizontally scalable solutions must be considered early, so that there will be enough computational power to demonstrate the interconnectivity interactively.

AML/CFT Regtech: Case Studies and Insights 35

AML/CFT Regtech: Case Studies and Insights 36 Third-Party Vendor Relationships THE CHALLENGE How to assess potential AML/CFT Regtech partners, especially those that show promise but are relatively new to the market. EARLY ADOPTER INSIGHTS The criteria used by many early adopters can be distilled down to compatibility, scale and sustainability. Unless you’re only looking at a vendor for a point-in-time initiative, consider what the relationship could look like across scenarios spanning a multi-year time horizon. QUESTIONS FOR CONSIDERATION • Can the vendor demonstrate they truly understand our unique needs? • Will the vendor (or their solution) remain valuable beyond an initial PoC? Can they perform at scale? • Does the vendor’s financial situation allow them to make the best possible decisions from our perspective now and in the foreseeable future? AML/CFT Regtech adoption will usually take one of three forms: in-house development of tools; procurement and implementation of off-the-shelf, third-party tools; or co￾development of tools with third parties. These options are no different to how banks have been selecting and adopting legacy systems, such as those used for case management, name screening or TM. There are, however, three significant changes that have led banks to revisit their approach to AML/CFT Regtech adoption, particularly in relation to how they work with third parties. First, many third-party AML/CFT Regtech solutions today involve one or more technologies that banks feel they lack the in￾house expertise to properly evaluate. While this is often associated with more cognitive technologies and what is often referred to as the “black box” problem, in interviewing a number of non-adopter banks, we found that a lack of expertise (or perhaps lack of confidence) has prevented some institutions from considering even more proven technologies, such as RPA. Second, the marketplace for AML/CFT technology has changed. Compared to when well-established, multinational conglomerates offered all-encompassing platforms that claimed to service most if not all AML/CFT technology requirements, today the market features hundreds of newer, smaller vendors that each claim to solve for a specific issue. The risks and advantages of partnering with one of the incumbent platform providers are different from working with an AML/CFT Regtech startup. This has led banks to revisit how they go about screening and evaluating their technology third-parties. Finally, AML/CFT technology is becoming much less proprietary with the growing popularity of software developed under various open source licenses. Contributing to and benefiting from open source software development initiatives requires a mindset change in many institutions. Institutions that are currently considering procuring from, or partnering with, an AML/ CFT Regtech vendor are therefore asking: how do we assess, select and partner with a vendor in a responsible and productive way?

AML/CFT Regtech: Case Studies and Insights 37

HOW SHOULD WE EVALUATE POTENTIAL THIRD-PARTY REGTECH PARTNERS? The hesitation of non-adopters, especially institutions with a smaller organisational footprint in Hong Kong, to consider newer AML/CFT Regtech vendors using emerging technologies is not entirely surprising. The perceived effort required to assess the vendor and its risks — from information and cyber security to operational resilience and regulatory compliance — may feel like it negates the potential benefits. However, the experiences of early adopters thus far show that others have found it possible to find an effective balance between being open to relatively new third-party AML/CFT Regtech vendors and performing due diligence. Representatives from Bank F, Bank E and Bank B shared six questions that helped them gain comfort with newer third-party Regtech vendors. “Adopting new technologies through more open source mediums represents a significant change from thinking of knowledge as intellectual property and a competitive advantage.” QUESTION 1: DOES THE VENDOR UNDERSTAND THE BANK’S NEEDS (OR DOES THE VENDOR’S SOLUTION MEET THE INTERNALLY DEFINED REQUIREMENTS OF THE BANK)? One of the reasons Bank E was able to define a path towards co-developing its name screening solution is because it did not compromise on its internally defined problem statement, and scrutinised vendors that claimed their solutions met their requirements. Bank E and Bank F found it helpful to be a “sophisticated shopper” and rigorously define what you are looking to buy, before engaging the market. QUESTION 2: HOW WELL DOES THE VENDOR UNDERSTAND THE PRODUCTS, PROCESSES AND REGULATORY REQUIREMENTS OF THE BANK? For Bank B’s adoption of RPA across its name screening and adverse media search processes, it sought out a vendor that understood the context underlying the processes. As a first-time adopter of the technology, Bank B found it useful to partner with a vendor that could not only automate but also advise on options for re-engineering the target processes based on similar work performed for peer institutions. QUESTION 3: HOW COMPATIBLE IS THE SOLUTION WITH THE BANK’S EXISTING SYSTEMS? Bank B and Bank E also sought to minimise the friction between existing internal systems and the third-party solution. Not only could friction translate into cost, certain loopholes and workarounds built for third-party solutions could also manifest as security threats. QUESTION 4: IS THE VENDOR ABLE TO MEET THE BANK’S SCALE REQUIREMENTS? This question ties back to earlier insights on aligning a bank’s expectations with its approach. Bank F cautions against an assumption that solutions which yield positive results in a PoC or pilot market can yield similar benefits at scale. Managing expectations and evaluating a vendor’s delivery capacity (e.g. headcount, market presence, financials, portfolio) are important steps to take prior to moving forward with an adoption initiative. QUESTION 5: HOW MATURE ARE THE VENDOR AND SOLUTION ON OFFER? Past experience is not a proxy for measuring current or future ability. However, Bank B and those that are new to AML/CFT Regtech adoption generally prefer vendors that can act as guides throughout the journey from a place of experience. Asking about past failures and lessons learned could prove more insightful than asking about well￾rehearsed success stories. QUESTION 6: WHAT IS THE FINANCIAL STATE OF THE VENDOR? Considering the sustainability of an AML/CFT Regtech vendor is more urgent for startups than most traditional platform vendors. Bank F highlighted the importance of understanding a vendor’s financial health and ownership, as both could have a direct impact on the vendor’s decision-making. Startups may need to operate on shorter time horizons, for instance, or they may get acquired midway through a project by a competitor. Open, transparent conversations on sustainability are critical for banks seeking to form longer-term partnerships with AML/CFT Regtech startups.

AML/CFT Regtech: Case Studies and Insights 38 People, Talent and Culture THE CHALLENGE Identifying the skills required to advance AML/CFT Regtech adoption, and those required to lead a culture of innovation. EARLY ADOPTER INSIGHTS Knowing strong communicators are just as valuable as those with critical technical abilities. Creating an environment where diverse backgrounds and perspectives are represented, and staff are encouraged by leaders to ask and act up the simple question: what if? QUESTIONS FOR CONSIDERATION • How diverse is your AML/CFT team? Or the team specifically looking at AML/CFT Regtech? • Is innovation within AML/CFT functions allocated with sufficient resources, bandwidth and support? • Is innovation something that is tangible for AML/CFT team members? Having the right talent is seen by many as a challenge to AML/CFT Regtech adoption. Around 20% of non-adopters selected “talent constraints” as one of the reasons for not adopting AML/CFT Regtech in the inaugural industry survey. Even among adopters many identified talent as an obstacle to advancing the use of emerging technologies in the field. In follow-up conversations, a number of non-adopters pointed to their lack of “data scientists” and the prohibitive costs of hiring them. Similar to the catch-all persona of the “IT person” in earlier generations, the “data scientist” has grown to mythical proportions in the minds of many as almost the gatekeepers to AML/CFT Regtech. Data scientists or other highly trained specialists are without doubt essential to the adoption of certain AML/CFT Regtech solutions. However, a number of early adopters emphasised that these specialists are often not required until institutions begin experimenting with more advanced technologies, such as algorithms that go from classification and association, to actual insight generation. Moreover, we learned that even in situations where data scientists and other specialist skills are required, successful adoption depended less on the individual performance of specialists, and more on their ability to create value within a team of AML/CFT experts, data managers, system developers, and operations specialists. Therefore, in our discussions with Bank A, Bank D, Bank E and Bank F, we focused on identifying universal skills that are valuable for most AML/CFT Regtech adoption initiatives, and things AML/CFT leaders have done to encourage innovation and adoption of new and emerging technologies / techniques by their FCC and FIU teams.

AML/CFT Regtech: Case Studies and Insights 39

---

WHAT KNOWLEDGE, SKILLS AND EXPERIENCE ARE USEFUL FOR AML/CFT TEAMS EXPLORING THE APPLICATION OF INNOVATIVE TECHNOLOGIES & ANALYTIC TECHNIQUES? Bank A and Bank D have both found success applying a concept we have called “low-tech innovation”, or finding innovative uses for the data, technology and skills you have on hand before developing or procuring new solutions. Bank A’s use of non-traditional data elements and network analytics in its investigations, for example, wasn’t dependent on cutting-edge graph-native software, it was all run off of Microsoft Excel workbooks. Similarly, although Bank D’s data warehouse solution provided downstream analysts with the convenience of data aggregation and access, the actual analysis often is done using queries or algorithms written in open source programming languages, such as SQL, R or Python. Training and development approaches for AML/CFT team members are also evolving. At Bank D, for example, FCC and FIU team members are pursuing learning opportunities to become more self-reliant in accessing and analysing data. They are learning to use tools like BusinessObjects to extract data from the data repository, and undertaking their own studies to develop analytics skills utilising R and Python. More broadly, the curriculums for FCC and FIU teams at these banks are evolving to build awareness around emerging AML/ CFT Regtech tools and innovative analytic techniques, such as Bank A’s seminars on the use of non-traditional data elements for advancing intelligence-led investigations. A problem oriented approach that encouraged creative, out of the box thinking. Prioritising the problem statement to find the shortest possible path to solutions, not the most advanced or elaborate. Creating an environment that gets people to raise their hand and say: “what if…?” Effective partnerships between people with different skillsets. In both Bank A and Bank D’s experience, much of the value came from the synergy that emerged from partnering seasoned AML/CFT practitioners with data managers and those with analytics expertise. This allowed the AML/CFT practitioners to expand the horizons of their “art of the possible.” Communication and project management skills. For Bank A, communication and project management skills were crucial to bringing the idea to life. Effective, influential communicators are needed to explain the value of the experiment to data owners and secure their buy in. An iterative mindset (i.e. “trial and error”). Bank A, Bank D and several other early adopters highlighted the importance of experimentation and iteration. As a leader from Bank E summarised: “it is important to identify areas of improvement, take incremental steps and try new approaches, instead of expecting a silver bullet to solve problems.”

AML/CFT Regtech: Case Studies and Insights 40 HOW DO YOU LEAD A CULTURE OF INNOVATION WITHIN AML/CFT FUNCTIONS? After the successful completion of their use of IP addresses and network analytics, one of the leaders from Bank A reflected: “we [the FCC / FIU teams] developed a culture and a mindset…that in order for innovation to be achieved, there should always be the encouragement of the spirit of creativity, open-mindedness, collaboration as well as trial-and-error among stakeholders.” It’s certainly one thing to know the potential power of innovation, and another to know how to unlock it within your team. Building on some of the insights shared by early adopters, there are three additional considerations on what leadership looked like at banks that were able to tap into their team’s creativity and innovation. "We developed a culture and a mindset...that in order for innovation to be achieved, there should always be the encouragement of... creativity, open￾mindedness, collaboration as well as trial-and￾error." CONSIDERATION 1: MAKING IT REAL During the 2019 AML/CFT RegTech Forum, panellists representing banks and Regtech vendors voiced the message: “don’t be afraid to just get started.” This message is as powerful as it is simple because it follows a core principle of driving behaviour change through culture, which is aligning “the talk” with “the walk”. Bank A didn’t just talk about innovative uses of non-traditional data in an online training course; it gave its staff an opportunity to experiment with it. Bank E allocated a small budget to support four staff, initially part-time, to dedicate time to strategy and innovation, starting with research to see what technologies were becoming relevant to AML/CFT. The team's scope eventually extended to exploring application of these technologies to everyday processes of the bank's FCC and FIU teams. By fighting the fear of failure and taking that first step, institutions can begin to build credibility around their message of valuing technology and innovation. CONSIDERATION 2: BUILDING SOLUTIONS WITH, NOT FOR THE USER The adage, “the destination is never as rewarding as the journey” tells us something about AML/CFT Regtech adoption. When we asked leaders from Bank E and other early adopters for advice they would give aspiring AML/CFT Regtech adopters, many mentioned the importance of bringing everyone along on the journey—not just handing them the shiny new tool. Not only does this advice help with a common Regtech challenge of getting users to adopt new tools and behaviours, from a cultural perspective, by building governance structures around AML/CFT Regtech adoption that ensure users are part of the journey, leaders can help to create routines / rituals and stories among staff that reinforce an institution's values around creativity and innovation. Stories about how a junior name￾screening analyst’s opinion was factored into the final design of an interface, or routines such as weekly feedback sessions with FCC / FIU teams, can all end up paying dividends across future AML/CFT Regtech initiatives. CONSIDERATION 3: COURAGEOUS DECISION-MAKING Bank F, with over a decade of experience in applying innovative solutions to AML/CFT challenges, shared the wisdom they gained through this experience that “innovation requires courageous decision-making—both to start projects, and to stop them.” While phrases such as “fail often, fail fast” speak to innovation’s need for leaders to overcome the paralysing fear of failure, the wisdom shared by Bank F brings a more practical perspective that leading innovation is also about credibility. If off-the-shelf solutions offered by vendors do not meet internal requirements, such as Bank E’s experience with name screening, or if development teams—both internal and third-party—are unable to keep up with changing user requirements, then leaders need the courage to avoid massaging the narrative, and pausing or stopping the initiative altogether. A culture of innovation, like any culture, is an accumulation of decisions. Showing the courage to not compromise on the desired outcomes, while painful in the short term, can help leaders add credibility to their leadership of innovation in the long term.

AML/CFT Regtech: Case Studies and Insights 41

AML/CFT Regtech: Case Studies and Insights 42

Performance Metrics & Indicators THE CHALLENGE How are institutions defining and tracking value and performance for their investments into AML/CFT Regtech? EARLY ADOPTER INSIGHTS It depends on the approach, but going back to the concept of a marathon, in many instances, early adopters are looking beyond financial, operational and risk indicators to try and capture the less tangible, but equally valuable experiential learnings generated by AML/CFT Regtech initiatives. QUESTIONS FOR CONSIDERATION • Have we considered benefit in the broader context of our institution’s Regtech or Fintech strategy? • The performance of a solution will change over time. Is the time horizon appropriate to measure value? • Are development and culture being measured as part of value? Building a consensus around concepts like “value” and “success” for AML/CFT Regtech initiatives can be difficult. Depending on how an institution approaches Regtech applications for AML/CFT uses, stakeholders from across an organisation could each bring varying levels of awareness, vision and priorities. Heads of FCC / FIU and other leaders of AML/CFT Regtech initiatives may need to navigate these at times competing stakeholder interests and priorities, negotiate the criteria for evaluating the value and success of a proposed initiative, and manage the narrative throughout the project. For those sponsoring or leading AML/CFT Regtech initiatives, aligning stakeholder expectations early on could be the difference between facing an encouraging audience or a sceptical one later on. We asked Heads of FCC/FIU teams and their business counterparts (such as COOs and Line of Business Heads) from early-adopter institutions what went into their institutions’ definition of value and performance. “Achievements should not be measured by short term results, but through the learning journey during the process and staff development.”

AML/CFT Regtech: Case Studies and Insights 43 HOW ARE INSTITUTIONS DEFINING AND MEASURING THE VALUE OF THEIR AML/ CFT REGTECH INITIATIVES? For Bank F, one of the key factors that enabled them to scale up their use of network analytics from problem statement to PoC and to where it is today, was being able to quantify and communicate the potential return on investment ("ROI"). Bank F split the metrics, indicators and outcomes used to assess the benefits from a technology, such as network analytics, into three categories: For risk mitigation, for example, Bank F demonstrated how their network analytics solution could consume more data at a higher efficiency than analysts and relationship managers to identify high￾risk customers and transactions. Other banks, such as Bank B and Bank C, which adopted RPA, highlighted the management of risks associated with repetitive manual processes, such as human error. Another key factor, cost efficiency, was considered by Bank F in terms of both the expected losses from commercial loan fraud, for example, and how the solution would impact operational budgets. On this latter point, while the network analytics solution was more efficient than legacy manual reviews, Bank F pointed out that a more efficient and effective solution could lead to increased full-time equivalent (FTE) costs in other areas, such as the experienced investigators and commercial bankers required to review and manage the newly identified risk. A number of other banks also cautioned against equating technology with immediate cost efficiency. In many of these cases, FTE cost was not necessarily taken out, but either reallocated to hiring for different roles (e.g. more experienced staff), or spent on staff who needed to be retrained to serve other functions (e.g. name screening analysts who require more advanced training). In terms of customer experience, Bank C and Bank F both noted how almost all technology initiatives in their institutions, not only AML/CFT applications, are evaluated in terms of the impact on the customer. For AML/CFT applications, such as Bank F’s network analytics tool or Bank C’s RPA solution, the customer touchpoints considered include, for example, reducing delays to customer transactions due to AML/CFT reviews, or reducing friction that could affect customer experience. In addition to these three dimensions, two others were highlighted by a number of the banks. First, Banks C and F both raised flexibility (or adaptability) as a means of measuring the value of a particular AML/ CFT Regtech initiative. For example, one characteristic of Bank F’s network analytics tool was its ability to evolve from focusing on commercial trade-related fraud to other types of fraud and money laundering. Second, Bank A and Bank E both underscored the importance of considering less tangible sources of value, such as the impact of an initiative on a team’s culture, or even the growth of individual team members participating in the initiative. While these benefits may be difficult to measure or articulate in the short term, for institutions planning on investing in Regtech in the long term, they can be invaluable to key determinants of success.

AML/CFT Regtech: Case Studies and Insights

Looking Ahead While adoption of Regtech solutions for AML/CFT is generally more mature than in some other risk disciplines, the HKMA believes there are significant opportunities for banks to further adopt established solutions in AML/CFT, and to explore new solutions as they emerge. To continue supporting its roadmap to accelerate adoption in the banking sector, the HKMA will keep Regtech as a key focus in its 2021 AML/CFT supervisory programme. This will include sector-wide activities and engagement to stimulate adoption, based on some of the practices outlined in this publication, to build industry acceptance of key technologies and create the conditions for all banks to explore and use Regtech in AML/CFT work.x Activities specific to the Accelerators, Enablers and Collaborators groups from the first AML/CFT RegTech Forum in 2019 will form a central aspect of this engagement. Taking Collaborators as an example, the HKMA has already completed work in 2020 with ten banks involved in the information sharing public-private partnership to build out a common set of fundamental requirements around data, analytics, information delivery, collaboration and skills and expertise, which will form the basis for thematic work later in the year. To boost wider awareness about the use of data analytics techniques for AML/CFT across FMLIT Collaborator banks, the HKMA also hosted a knowledge exchange event in December 2020, during which three of them shared respective experience in the use of tools and techniques in network analytics. These collaborative efforts are already bearing fruit, delivering better outcomes such as strategic, tactical and operational intelligence on COVID-19 related criminal threats, including mask scams, into the AML/ CFT ecosystem. For Enablers, the HKMA will host interactive “lab sessions” to experiment with more advanced technologies and methods such as machine learning for transaction monitoring and screening. The HKMA will also continue to reaffirm its focus on promoting Regtech development by continuing to share Regtech-related expectations and guidance. Improving the HKMA's own capabilities will also aid its evaluation and engagement with industry on topics such as Regtech adoption and data analytics. The recent circular on “AML/CFT Supervision in the Age of Digital Innovation” sets out how the HKMA intends to transform its AML/CFT supervision to a more data-driven and technology-enabled approach, and the changes this will result in for the industry in 2021 and beyond.xi Looking forward, the HKMA will continue to monitor global developments and work closely with the banking industry to adhere to international standards in AML/ CFT efforts. This report is a reflection of the HKMA's commitment to remain agile to emerging international good practices. For the wider AML/CFT ecosystem in Hong Kong, the technologies and analytical techniques highlighted in this report will also bring tremendous opportunities to become more effective in advancing the principles and standards set out by the FATF, deliver a cutting edge response to current and future ML/TF risks, and continue to offer a customer-centric banking experience. 44

AML/CFT Regtech: Case Studies and Insights The HKMA will keep Regtech as a key focus in its 2021 AML/CFT supervisory programme. Presentations on the use of network analytics during the knowledge exchange event in December 2020. 45

AML/CFT Regtech: Case Studies and Insights

References i Hong Kong Monetary Authority, Hong Kong Monetary Authority (HKMA) fosters a diversified ecosystem for Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) Regulatory Technology (RegTech), 22 November 2019. (https://www.hkma.gov.hk/eng/news-and-media/press-releases/2019/11/20191122-4/) and Hong Kong Monetary Authority, HKMA AML/CFT RegTech Forum: Record of Discussion, December 2019. (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2019/20191223e1a1.pdf) ii Hong Kong Monetary Authority, Financial Action Task Force (FATF) and Asia/Pacific Group on Money Laundering (APG) Praised the Work of the Hong Kong Monetary Authority (HKMA) and the Banking Sector in Combating Money Laundering and Terrorist Financing Risks, September 2019. (https://www.hkma.gov.hk/eng/news-and-media/press-releases/2019/09/20190904-4/) iii Hong Kong Monetary Authority, HKMA AML/CFT RegTech Forum: Record of Discussion, December 2019. (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2019/20191223e1a1.pdf) iv Hong Kong Monetary Authority, AML/CFT Supervision in the Age of Digital Innovation, September 2020. (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20200929e1a1.pdf) v FMLIT was established in May 2017, in line with international standards and practices in other financial centres. FMLIT consists of law enforcement, the banking supervisor and ten retail banks in Hong Kong. vi See for example: Guszcza, James, Harvey Lewis and Peter Evans-Greenwood, Cognitive Collaboration: Why Humans and Computers Think Better Together, 2017. (https://www2.deloitte.com/us/en/insights/deloitte-review/issue-20/augmented-intelligence-human￾computer-collaboration.html) and Babic, Boris, Daniel L. Chen, Theodoros Evgeniou and Ann-Laure Fayard, (July-August 2020). A Better Way to Onboard AI. Harvard Business Review, pp. 56-65. vii For additional information on trade products and TBML, refer to: Hong Kong Association of Banks (HKAB), Guidance Paper on Combating Trade-based Money Laundering, 1 February 2016. (https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/ aml-cft/Guidance_Paper_on_Combating_Trade-based_Money_Laundering.pdf) viii For an introduction on entity resolution and network analytics, see: Getoor, Lise and Ashwin Machanavajjhala, Entity Resolution: Tutorial, 2012. (https://users.umiacs.umd.edu/~getoor/Tutorials/ER_VLDB2012.pdf) ix Illustrations used with the permission of Neo4j. For more on the differences between relational data modeling and graph data modeling, see for example: Neo4j, Model: Relational to Graph. (https://neo4j.com/developer/relational-to-graph-modeling/) x Hong Kong Monetary Authority, Moving the Needle: Driving Improved Outcomes in Anti-Money Laundering – The Role of Regtech, 28 September 2020. (https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/aml-cft/HKIB_Slides_2020.pdf) xi Hong Kong Monetary Authority, AML/CFT Supervision in the Age of Digital Innovation, September 2020. (https://www.hkma.gov.hk/ media/eng/doc/key-information/guidelines-and-circular/2020/20200929e1a1.pdf) 46

AML/CFT Regtech: Case Studies and Insights Acknowledgments This report was made possible by the active participation of the following banks, technology providers and other subject matter experts who generously offered their time and expertise during historically challenging times. We would also like to thank our Deloitte sponsor for this report, Tony Wood, our co-authors, Yuichiro Mitsutomi and Anir Bhattacharyya, as well as research and design support from Ronan Martin, Angel Mirano, Josh Plant, John Owens, Chang Liu and Magdalena Maksiak. Deanna O'Reilly Chris Johnston Earth To Bank of America Bank of America Bank of America Clement Ho Cyril Mak Stephen Ma BOC (Hong Kong) BOC (Hong Kong) BOC (Hong Kong) Cecilia Xie Rickover Duan Edward Chiu CCB (Asia) CCB (Asia) Chong Hing Bank Matthew Lam Edgar Ma Winnie Chiu Chong Hing Bank Citibank Citibank Richard Yiu Thomas Chan Clive Liu Citibank CMB Wing Lung Bank CMB Wing Lung Bank Sally So Fiona Tam Peter Kwok CMB Wing Lung Bank CMB Wing Lung Bank Dah Sing Bank Sunny Chiu Samuel Wong Yee-man Chan Dah Sing Bank DBS DBS Ohwen Yong Ian Liew Joseph Lo Deloitte Dina Kamal Nisal Samarakkody Wael Alalwani Deloitte Omnia AI Deloitte Omnia AI Deloitte Omnia AI Paul Jevtovic Kristen Patel Anthony Hope HSBC Abby Tam Tracy Law Wesley Tam OCBC Wing Hang Bank OCBC Wing Hang Bank OCBC Wing Hang Bank Anthony Lau Praveen Jain Paul O'hara OCBC Wing Hang Bank Standard Chartered Standard Chartered Faith Bhaseen Stanley Wu Andrew Barker Standard Chartered Standard Chartered UBS Jason Wong Angie Fung Olaf Schwarz UBS (in alphabetical order by institution) 47

Hong Kong Monetary Authority 55/F Two International Finance Centre, 8 Finance Street, Central, Hong Kong Telephone: (852) 2878 8196 Fax: (852) 2878 8197 E-mail: hkma@hkma.gov.hk www.hkma.gov.hk For more information, please contact us at aml@hkma.iclnet.hk © 2021 For information contact Deloitte China (www.deloitte.com/cn/en)