They say that if you can’t be a good example, then aim to be a dire warning instead. And this is always the spirit in which I have read reports of “findings” – the more palatable term for regulatory punishments. Regulators vary in the detail they publish with – for once – the UK doing rather well in this department: the Financial Conduct Office (FSA-as-was) goes into very useful specifics when it hauls someone out in front of the class for a ticking-off.
Whenever possible, when I am delivering training – particularly to more senior staff – I try to include recent findings. Ones from the same jurisdiction are good, ones from the same sector are helpful, but to be honest most of the failings that they reveal are so high-level, so core, that the principles they address apply to anyone in the regulated sector. For such audiences, I go through the finding or final notice or regulatory release or whatever it’s called, and pick out the main issues that have been highlighted. Often these go in waves; a couple of years ago in the UK, for instance, we had a rash of cases of firms failing to spot high-risk clients or, having spotted them, failing to know what enhanced due diligence might be appropriate. But every one has choice and juicy nuggets of learning material. For the beauty of the finding is two-fold (three-fold if you count schadenfreude). First, you can check the identified failings against your own AML policy and procedures to check for any similarities. And second, you are given a handy hint about where the regulator is focussing at the moment. (If any UK regulated entity is still failing to do EDD on high-risk clients, they are skating on very thin ice.)
So how can the MLRO best profit from this free training information? I would suggest that there are three things he can do. One: keep a note of all relevant findings so that he can refer to them in his annual(ish) review of his AML regime, thus showing that he is au courant with recent developments. Two: go through them with a fine-tooth comb looking for any identified weaknesses that he has to admit are in his own regime. And three: shove them under the noses of his directors or similar senior people and insist that they discuss them as part of their review of their business risk assessment. Regulators are losing patience with those who will not learn, and if one firm has been punished for a shortcoming, they expect everyone to learn the lesson.