Finally decided to do a mini-series on the Anti-money laundering (AML) regulations + KYC. This will be the first cast going over high-level regs + some examples to understand basics

Crypto | Custody | Serial Amateur
📍Dostoevsky’s Piano

AML regulation is annoying with its checklist of acronyms, so I will start with a couple of definitions here:
- Bank Secrecy Act (BSA) | AML framework in USA. The main point of reference here
- Know your customer (KYC) | Common term for customer identification and ongoing risk management. Included within the term AML

At a high level, AML regulations are basically the same everywhere you go. Yes, there are slight differences, but the pillars don't change:

- KYC
- Transaction monitoring
- Sanctions

A simple example of customer identification is that in the USA, by law, all affected entities must collect:
- Name
- Date of birth 
- Address
- SSN
- A way to verify identity via a document (license) or a non-documentary method (3rd party provider)

Contrasting that with Hong Kong, they require everything that the US does + some way to verify the person's address. Verifying an address is another piece of overhead the USA decided not to adopt, but the meat is the same

Since we know that AML regimes are 95% the same, we also need to understand the principle that underpins all of it, the Risk-Based Approach®. This is the most essential principle to understand AML and can be best described as a ~vibe~

Calling it a ~vibe~ sounds dumb and oversimplified, but it's true. In other banking regulations like SOC-2 or the loan A - Z regulations, 90% of the rules are defined and 10% are left to some interpretation of risk. A mortgage client needs to sign X sheet or be informed of Y change in Z timeframe. Straightforward stuff

For AML work, it is more like 50/50, which differs from most other auditor work. Because of this variation, the ~risk-based vibes~ come into play more often.

But how do we assess the ~vibes~? Let's break this down into 3 examples with varying granularities.

#1) The simplest high-level example is comparing JP Morgan to a small farm bank in Nebraska. JP Morgan has significantly more risk for money laundering passing through them because they cater to an international consumer base, have super complex financial products, and their products are most likely international

The farm bank in Nebraska doesn't worry about 99% of that stuff. They don't do international business, they don't have complex financial products and candidly, they probably know most of their customers by name. Inherently, there is less risk for money laundering within the Nebraska bank

#2) Diving another level down, let's swap out JP Morgan for a larger regional player with ~$26 billion in assets compared to our lowly farm bank which only has $450 million. As I previously said, there are some basic KYC data points that an entity needs to collect, like Name and Date of Birth

However, there is also a clause in the BSA related to "Customer Due Diligence". It is additional information you get on someone besides their required KYC. How do we come up with what additional data should be collected?

~Vibes~

As an example, if our farm bank onboarded a business they are going to collect information such as:
- Description of the business
- Maybe some expected activity 

Since they are small and have monetary constraints, they can only collect limited client data points

Using a ~risk-based approach~, as an auditor, I would not expect them to have robust processes. I wouldn't flag that as an issue to regulators

However, our regional Bank would need the following otherwise I would flag an issue to management:
- Everything the farm bank collects +
- Expected usage of products such as wires, checks, etc.
- Industry code + self-identification as a "high-risk business"
- Expected volumes of inflows and outflows on accounts

Why would I require that? Because of their size, they have more risk (and more resources) and must manage it. KYC is a prime example of ~vibes~ for applying risk because NOTHING in the above is a regulatory requirement. Still, I can promise you this is de facto required.

If an auditor saw a bank of that size that wasn't collecting that, that is an immediate issue on an audit report

Lastly, let's examine how Banks approach quality control (QC) on their KYC processes. As we all know, errors happen. You will never be 100% accurate in collecting KYC because the frontline is poorly trained or incompetent. So what do we do about it?

The Farm Bank could perform QC once or twice a month with a checklist on a sample of onboarded clients. I would expect little here. They don't have the resources or the risk profile to tackle this efficiently

But for our regional Bank? They better have a robust quality control process that reviews this periodically. I want to know:
- What is the sampling methodology for QC?
- Are you just QC'ing the required data points or all data points?
- How often do you perform QC?
- Who does it? 
- What happens when you find errors?

Once again, quality control is NOT explicitly part of the regulation. At the size of ~$20 billion, I know the ~vibes~, and that is what regulators expect. 

But where do the ~vibes~ come from?

The ~vibes~ can only be picked up from working on AML audits for a decent period, reading other regulatory reports, and talking with management. I know, for example, that around ~$10 billion in assets is when regulators start to care about having a quality control process and fleshing it out. How do I know this?

My managers did this longer than me and told me it was a rough marker to watch for.

Another marker is that around $2 billion in assets, a Bank needs to start collecting more quality data points to understand a client's business as part of KYC. These are optional, but having read enough reports and learning from management, that is the expectation

These markers and guides form dense network effects across the industry (since most people are lifers). Because of these tight network effects, the goal is always to "evolve the program". Read: burden the business with more busy work in the spirit of the regulation

As you can guess, the ~vibes~ never go backward. You always say something is necessary as an auditor or regulator. This is the first major adverse incentive in AML regulations that I personally have an issue with.

Independent auditors like my former self can't say, "Yeah, you don't need that". We are incentivized to always find things, even if they are minimal. If I walked out of an audit with no findings to report to management, I didn't do my job

Overall, the ~vibes~ are important and underpin everything. They are built through shaky incentive structures that propagate from person to person through dense feedback loops.

The Risk-Based Approach is a good idea at a high level but, in practice, can lead to inconsistent application and broadening of workload on an affected entity

I was an independent auditor for AML + Sanctions regimes across a litany of entities such as small farm banks, international FinTechs, Crypto companies, and large regional banking firms. I have seen every type of program you will encounter and done it across different countries. aka I know what I am talking about

paulwebb/ × Architech × Excessively Black × East Coast kid on the West Coast × building the Neue Internet @ neuenet.com / registry.neuenet

This also focused on Banks, the most regulated institutions :) 

I'll do another thread on why FinTechs + Crypto companies get off easier

Wow, what a comprehensive thread. In summation, if I want to do something that requires KYC, I hire someone like you.

What a headache.

Acting Director of Galactical Onchain Customs Agency (GOCA) - Now Hiring Recruits!

Ahahah getting flagged at a casino is pretty tough, you're more likely to get kicked out for making too much money first

But its possible Canada has a stricter regime on Casinos than the USA

I use to work at a casino and usually had couple people get flagged by FINTRAC every one and then. But pretty sure most of them got away as they knew how to play the game, they were not stupid.

Some solutions are more obvious than others:
- ZK could be used to preserve privacy against third parties such as auditors and internal compliance employees. But at some point, those groups need to quality control some sample of the results
- By aggregating more transactions on chain, you could standardized data better

Apart the basics, how do you think the flywheel of redtape could actually benefit from signatures, smart contracts, ZK and such?

Still thinking about this days later
500 $degen for the quality breakdown