Sometimes words enter your vocabulary and you can’t remember where or when you first heard them but suddenly they’re there and you’re hearing and using them all the time. I’m not talking about “lock-down” or “social distancing” or “flattening the curve” – I’m talking about “cumulative risk”. A great deal of work in the sphere of AML requires risk assessment. At the start of a relationship with a client, you have to decide whether they fit your firm’s risk appetite, and if they do, you do an initial risk assessment to determine the level of take-on CDD that you will do. And then you review their risk rating periodically – and the level of risk of everything they do during your relationship with them – to decide whether you need to alter the level and frequency of monitoring that you apply to them. It’s very reiterative and very important. And in the last year or so, regulators have been pointing out that cumulative risk must be taken into account at all stages.
In short, cumulative risk is the risk that results as a result of the presence of a combination of risks. For instance, being a heavy drinker might increase your chance of death each year by 0.1%. And being a reckless driver might also increase your chance of death each year by 0.1%. If you’re both a heavy drinker and a reckless driver, your increased risk of death might be not 0.2% (the simple sum) but perhaps 0.5%, because your heavy drinking makes your driving even more reckless (and because you’re so relieved to survive your crazy drive to the pub that you down even more than usual).
In AML terms, we have this week seen the perfect example of cumulative risk at work. On 8 May 2020, the former CEO of Garuda Indonesia, a gentleman called Emirsyah Satar, was jailed for eight years for bribery and money laundering. In short, he accepted bribes over a decade for placing orders for Airbus planes and Rolls Royce engines. Anyone doing CDD on Mr Satar might have spotted an accumulation of risks. He was CEO of a company that is 60% owned by a government – making him a PEP. That company is an airline, and the aviation industry has often been ranked high risk for corruption. And the company and the PEP are in Indonesia – a jurisdiction considered high risk in many of the indices beloved of MLROs. Like my daily intake of chocolate biscuits, it all adds up to something quite alarming.