The Digitalisation of AML/CFT Supervision: Where Now and What Next

Supported by The Digitalisation of AML / CFT Supervision: Where Now and What Next? February 2024

The Digitalisation of AML / CFT Supervision: Where Now and What Next? AML/CFT Supervision in the Age of Digital Innovation In 2019 the HKMA partnered with Deloitte to address the question ‘how does AML/ CFT supervisory work need to change in the age of digital innovation?’. This question was asked against a backdrop of new and emerging technologies, and the increasingly borderless and fast-moving nature of financial crime. Arthur Yuen, Deputy Chief Executive of the HKMA, at the HKMA’s AML/CFT Regtech Forum on 22 November 20191 , setting-out the HKMA’s approach to strengthening the collaboration between banks and technology companies to foster a more diversified ecosystem for Regtech.

1. The Hong Kong Monetary Authority (HKMA) fosters a diversified ecosystem for Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) Regulatory Technology (RegTech), November 2019 https://www.hkma.gov.hk/eng/news-and-media/press-releases/2019/11/20191122-4/ 02

The Digitalisation of AML / CFT Supervision: Where Now and What Next? Through a consultancy study that looked at the digital transformation journeys of peer supervisors and Hong Kong’s current AML/CFT Regulatory Technology (Regtech) adoption landscape, the HKMA developed a response with two main areas of focus that would be addressed as part the HKMA’s broader Digitalisation Programme: modernising the HKMA’s AML/CFT supervision through technology adoption (Suptech), while in parallel promoting the responsible adoption of Regtech by the industry. The HKMA’s response recognised the interdependence between Suptech and Regtech, and that both must be developed concurrently to improve the overall effectiveness of Hong Kong’s AML/CFT ecosystem. By adopting Regtech, banks and Stored Value Facility (SVF) licensees on the front-line of defence can maximise their use of limited resources to detect and disrupt suspicious activity. Through implementing Suptech, the HKMA can be more proactive and targeted in deploying its supervisory resources, and – in line with the direction of FATF2 – place a greater supervisory focus on AML effectiveness. This paper shares the achievements of the AML Digitalisation Programme over the last four years, looking at how the HKMA’s AML/CFT supervisory activities have become more targeted, data￾driven, and focused on effectiveness and, as a result, how the supervisor￾bank relationship has evolved to become more collaborative and outcome-focused, driven in part by banks’ adoption of Regtech to enhance their AML efforts. The paper also highlights various challenges that were faced, and areas where more work needs to be done. For example, despite progress on AML Suptech and Regtech adoption, criminals continue to seek out vulnerabilities in the financial system by exploiting new technologies. Reflecting on these challenges, the paper sets out ‘what next’, and the need for Suptech and Regtech efforts to deliver yet greater returns in terms of a more effective and collaborative response to fraud and other financial crimes. This will underpin the next phase of the HKMA’s AML Digitalisation Programme. For Digital Transformation to bring value, talent and culture must evolve alongside data and technology. Many Suptech initiatives within the Digitalisation Programme were developed in-house – ensuring that user needs were met, and providing team members with hands-on development experience. AML/CFT supervisory specialists worked with Deloitte to develop customised institution and sectoral level analytics, which can be tailored for different risk hypotheses including geographic exposure, to identify priority areas of concern, as well as providing peer group comparison and trend analysis as part of efforts to enhance the HKMA’s off-site supervisory processes. 2. Effectiveness has moved to the top of the FATF agenda, March 2023 https://www.fatf-gafi.org/en/publications/Fatfgeneral/Effectivenesshasmovedtothetopofthefatfagenda.html 03

The Digitalisation of AML / CFT Supervision: Where Now and What Next? The Evolution of AML / CFT Supervision at the HKMA Based on the recommendations of the consultancy study in 2020, the HKMA’s AML Digitalisation Programme focused on transforming the HKMA’s risk-based AML supervision through Suptech implementation. And, alongside the development of new technology within the HKMA, the Digitalisation Programme also set out to change the HKMA’s talent management and working culture to support a more agile and data-driven way of working across AML supervision. While the HKMA had already been deploying off￾the-shelf Suptech tools as part of its risk-based supervision for a few years, a key principle of the Programme was to self-build, and develop the necessary in-house skills in parallel. The Digitalisation Programme has enabled the AML Division to become more targeted in its supervision. Automation and process re-engineering have led to many supervisory activities being streamlined, replaced, or eradicated completely, allowing supervisors to re-focus efforts on higher-value tasks. A dedicated analytics capability, underpinned by built-for-purpose data infrastructure and access to more granular data, is unlocking richer insights on ML/TF risk across the sector. Finally, a dedicated horizon-scanning capability, along with deeper collaboration with industry stakeholders, supports a more forward-looking approach to threat identification and response. At its core, the HKMA’s AML Supervision comprises a data-driven off-site monitoring capability and an on-site examination regime, where the focus of supervisors working ‘on-the￾ground’ is guided by intelligence and insights uncovered through off-site analytics and research. 04

The Digitalisation of AML / CFT Supervision: Where Now and What Next?

To summarise achievements of the AML Digitalisation Programme, the table below presents an update on what the HKMA has delivered against the objectives set out by the consultancy study: AML DIGITALISATION PROGRAMME Objectives (2020) Progress and Achievements (2024) Data-driven AML/CFT Supervision Significantly enhance the HKMA’s ability and agility to process a wider range of data targeting high risk areas. Augment the capabilities of AML/CFT supervisors with new tools and technologies. Greater efficiency and effectiveness through adopting automation and visualisation tools. Built-for-purpose data infrastructure, including a data submission platform, cloud storage and automatic processing, operated by dedicated AML data specialists, enables the HKMA to collect and process greater volumes of data, without redirecting the effort of AML/CFT supervisors away from higher-value activities. This infrastructure enables richer analysis of structured data. AML/CFT supervisors use visualisation tools to analyse quarterly data returns to identify ML/TF and financial crime risks – a model that can be readily tailored to factor-in new or evolving risk indicators. This analysis has enabled a more detailed and frequent view of sector- and institution-level risk exposures, and more effective off-site supervision. Off-site surveillance is enhanced with a new capability to automatically flag specific potential follow-up areas for AML/CFT supervisors to review based on shifts in the ML/TF risk or controls at specific institutions. Enhanced data analytics also strengthened AML/CFT supervisors’ capabilities to test hypotheses related to banks’ controls and risk areas across normal trends and peer comparisons. Proactive Identification and Management of Emerging Risks Develop a dedicated Horizon Scanning capability to identify early warning signs across the ML/TF threat landscape. The HKMA has implemented a dedicated horizon scanning capability that includes the automatic monitoring of external data for ‘signals’ of new or imminent ML/TF threats both globally and within Hong Kong. Using insights uncovered through Horizon Scanning, AML/CFT supervisors have been able to timely follow-up with individual banks to assess the potential impact of imminent threats. 05

The Digitalisation of AML / CFT Supervision: Where Now and What Next? AML DIGITALISATION PROGRAMME Objectives (2020) Progress and Achievements (2024) Talent and Culture Development Equip supervisory specialists with new knowledge and skills. Introduce digital talent to the AML Division’s supervisory activities. Transform the culture and way of working to be more conducive to digital enablement. Data specialists were recruited to support the AML Division, working with supervision teams and the HKMA’s central Digitalisation Office to develop data￾driven solutions to AML/CFT supervisory activities. AML/CFT supervisors were engaged via product innovation and training workshops to develop bespoke solutions to enhance supervisory activities covering Horizon Scanning, off-site supervision, and ad hoc exploration of new or emerging threats such as digital fraud and those arising from geopolitical shifts. Various AML/CFT supervisors acted as ‘champions’ throughout the Digitalisation Programme, each owning the development of a specific capability, working with Deloitte specialists to implement transformation initiatives. This ownership gave supervisors experience with agile delivery and digital transformation and ensured that implementation efforts were ‘high-impact’ and ‘value-driven’ based on the needs of the AML Division. Regtech Adoption and Ecosystem Engagement Engage the industry to accelerate the adoption of AML/CFT Regtech. Foster meaningful, outcomes-oriented collaboration on AML/CFT efforts. Following the AML/CFT Regtech forum3 in 2019, various industry engagements have been held by the HKMA to encourage and support the industry with AML/ CFT Regtech adoption. Industry surveys to monitor Regtech adoption progress and deep-dive discussions with banks helped make industry engagement on Regtech more targeted, focusing the HKMA’s efforts on institutions, risk domains, and use cases of greatest impact to the overall ecosystem. Industry engagements included a series of AML Regtech Labs (AMLab) supporting peer groups of banks to explore, test and share ideas on Regtech adoption, and case studies publications to share insights on Regtech from adopting banks – all alongside wider HKMA initiatives, including Fintech 2025, that support banks with digitalisation. The focus of the HKMA’s AML/CFT supervisory efforts has transitioned towards effectiveness, for example by encouraging banks to direct resources towards activities with tangible outcomes rather than less productive activities. 3. The Hong Kong Monetary Authority, HKMA AML/CFT Regtech Forum: Record of Discussion, December 2019 https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2019/20191223e1a1.pdf 06

The Digitalisation of AML / CFT Supervision: Where Now and What Next? Macro Analytics In 2023, the HKMA launched a Macro Analytics pilot programme which, for the first time, applies analytics to granular data across multiple Hong Kong banks to generate new supervisory insights which support the HKMA’s ambition to target the effectiveness of AML systems. This programme is part of a phased approach of developing new capabilities that analyse granular data to uplift Hong Kong’s AML system, alongside initiatives such as the FINEST4 bank-to-bank information sharing platform and the ongoing work of the Fraud and Money Laundering Intelligence Taskforce (FMLIT5). The pilot programme focuses specifically on fraud-related mule accounts (although the capability has much broader application), including analysis of some anti-fraud related tools in use by banks, taking a deep dive into how bad actors are exploiting Hong Kong’s financial system so that the HKMA can provide guidance and feedback to the industry. The pilot programme has yielded considerable insights for the HKMA, including an ability to compare the response of multiple banks’ control systems to specific threats, including for example, cases involving mule account networks, and highlighting how information sharing could support banks in better detecting suspicious activity. The pilot programme has also helped to compare the AML responses across multiple banks facing the same threat to identify and share best practices. In one case, suspicious fund flows linked to a scam had been quickly detected, contextualised with further analysis, and reported to the Joint Financial Intelligence Unit (JFIU). The reported activity was investigated by the police, and a number of accounts were closed across multiple banks. The participating banks submit case-relevant data to the HKMA in accordance with a project data schema, which are combined to form a sector-level network, and such are used by AML data analysts working with AML supervisors who are familiar with participating banks’ controls. This process has further highlighted the importance of readily accessible, high-quality and reliable data to effective AML work. Teething issues, encountered during ramp-up of the pilot programme tended to arise from limitations of personnel and skillsets rather than underlying or fundamental shortcomings around data quality or completeness. This further reinforces messaging shared through AMLab and case studies publications that progressive innovation is as dependent on people and culture as it is on data and technology. Looking towards pilot programme completion, further insights will inform both the HKMA’s near-term supervisory efforts as part of its data￾driven approach to AML supervision, and the next steps for Macro Analytics, which will further develop the concept of using a network to defeat a network, by bringing relevant AML data across multiple banks and interfacing this with existing ecosystem’s fraud analysis, including interbank payment data, to provide more comprehensive cross￾bank analysis. This new capability will work alongside, and where the opportunity exists, interface with other developments taking place across the ecosystem such as financial data analytic platform of law enforcement agencies, to deliver increased protection to customers from fraud and an uplift in Hong Kong’s overall AML system effectiveness. 4. Launched in June 2023 by the Hong Kong Association of Banks, with guidance from the HKMA and support from the Hong Kong Police Force (HKPF), Financial Intelligence Evaluation Sharing Tool (FINEST) is a cyber-secured platform to speed up bank-to-bank information sharing. 5. Established in May 2017, the FMLIT is a public-private partnership for information sharing among the HKPF, the HKMA, and 28 banks. 07

The Digitalisation of AML / CFT Supervision: Where Now and What Next? What next? To achieve real progress against financial crime, AML regimes must continue to transition their focus away from regulatory compliance, and towards outcomes and effectiveness. From experience so far, this transition depends on a more effective risk￾based approach – where stakeholders across the AML ecosystem are equipped with more meaningful, actionable insights on priority threats towards which precious resources and attention can be directed. The key to unlocking those insights, while avoiding unworkable volumes of false-positives and prohibitive operational costs, lies in the deployment of innovative technology, supported by a clear strategy on data. The need for this transition underpinned the HKMA’s AML Digitalisation Programme. Over the last four years, the HKMA, banks and SVF licensees have made significant progress along this path through implementing Suptech and Regtech solutions. As this journey continues, technology and data will become even more critical to an enhanced AML ecosystem. For example, the HKMA, , following its successful proof-of-value exercise, will integrate advanced analytics – including Natural Language Processing (NLP) – to further enhance its horizon scanning efforts. The HKMA will also be collecting more granular data from banks and SVF licensees and ensuring that suitable infrastructure is in place across the ecosystem. As data becomes more critical to off-site AML supervision, an even greater focus on data quality and consistency will be necessary across the sector. Many banks have already invested in data and systems which aggregate and structure data to enable advanced analysis and investigation, and this trend will accelerate. Through ongoing digital transformation, the AML Division’s data-driven capabilities will continue to be enhanced in line with international best practice and FATF expectations to exploit additional opportunities to increase the efficiency of AML/ CFT supervisory work, refocusing the attention of AML specialists on areas that warrant supervisory attention or scrutiny. With greater priority on effectiveness, the focus of AML/CFT supervision has already expanded beyond identifying non-compliance, to one that seeks out enhancement areas in AML/CFT effectiveness, potential weak spots based on new or emerging threats, opportunities for improved intelligence sharing, and areas to share experience across the ecosystem. 08

The Digitalisation of AML / CFT Supervision: Where Now and What Next? The next few years will see further significant developments in Hong Kong’s AML/CFT ecosystem, particularly in public-private and private-private information sharing platforms. In parallel, the ability to analyse different and larger sources of data is being developed through the HKMA’s Macro Analytics programme and the financial data analytic platform of the law enforcement agencies. In the next stage of development, Macro Analytics 3.0 will further innovate the capabilities tested in the pilot, with the objective of expediting the interdiction of fraud and mule accounts at greater volume, by combining multi-bank analysis with relevant fraud-related interbank payment data. In order that banks and SVF licensees AML/CFT systems can evolve with these developments and further develop their AML Regtech adoption, in the year ahead the HKMA will provide the latest supervisory insights in practical industry guidance to support the responsible use of Artificial Intelligence in AML work and transaction monitoring in particular; launch a new round of Regtech support including further AMLabs to help banks and SVF licensees deploy and optimise key, high-value Regtech solutions, particularly in the fight against fraud; and roll out the next phase in its Macro Analytics capability. To make the progress expected, even closer collaboration will be necessary among all stakeholders in Hong Kong’s AML ecosystem – the HKMA, law enforcement agencies, banks and SVF licensees, technology providers and other specialists – with a particular focus on tackling the ongoing rise in fraud and scams. Clearly, the pace of innovation required is significant if we are to have the desired level of impact in combatting financial crime. As the last four years have demonstrated, it is a collaborative and co-ordinated approach, underpinned by bold ambitions to transform Hong Kong’s AML ecosystem into an outcome￾focused and data-driven regime, that will deter bad actors from exploiting Hong Kong’s financial system. 09

Supported by Hong Kong Monetary Authority 55/F Two International Finance Centre, 8 Finance Street, Central, Hong Kong Telephone: (852) 2878 8196 Fax: (852) 2878 8197 E-mail: hkma@hkma.gov.hk www.hkma.gov.hk For more information, please contact us at aml@hkma.iclnet.hk