The BCCI Case

The case of the Bank of Credit and Commerce International (BCCI) ⁷ offers the best example of the abuse of the banking sector to carry out cross-border criminal activities of shocking magnitude. Regulators found it to be involved in money laundering, support of terrorism, bribery, tax evasion, and other criminal acts.

BCCI is also an illustrative case of the challenges of access to information faced by law enforcement authorities when the matter involves financial information in multiple jurisdictions. While the facts of this case have been widely publicized and are therefore familiar to most readers, the account presented here will recount only the facts that illustrate the issues of information flow.

The BCCI was specifically structured to evade effective government control. It was made up of multiple layers of corporate entities connected to each other through a complex web of affiliates, subsidiaries, and holding companies. This segmented corporate structure ensured that corporate records were spread worldwide and that the regulation and audit of BCCI was fragmented across different jurisdictions without any single jurisdiction having consolidated access to all the bank’s records.

When the criminality of BCCI was finally uncovered, the New York district attorney had great difficulty in obtaining any documents held outside the jurisdiction of New York. These problems were particularly challenging in relation to documents held outside the United States in the United Kingdom, Luxembourg, Grand Caymans, Panama, and Abu Dhabi. The prosecutor’s main hurdle was the fact BCCI had ensured that most of the important documents were kept in jurisdictions that adhered to strict bank secrecy.

One example of this conundrum can be seen in the attempts of the New York prosecutors to obtain the records that Price Waterhouse relied upon to certify the financial statements and balance sheets that were filed by BCCI in the state of New York. Price Waterhouse at the time of the investigation declined to do so on the basis that the entity that audited BCCI was based in Bermuda and was legally separate from Price Waterhouse U.S. The New York district attorney later lamented, “So here you have financial statements, profit and loss, filed in Washington, filed in Virginia, filed in Tennessee, filed in New York, and audited by auditors who are beyond the reach of law enforcement.”⁸

A Hypothetical Case

To understand the information needs of law enforcement authorities and the challenges that faces them in meeting these needs, consider the following hypothetical case.⁹

An employee of a British bank based in Singapore commits bank fraud in the 1980s and wire transfers some of the stolen money to the United States, where the funds are invested in an account of a brokerage firm in New York. He then instructs the brokerage firm to sell all the securities purchased on his behalf and wire the funds to a bank in a bank-secrecy haven. His lawyer in the bank-secrecy haven then uses part of the funds to purchase a house in Germany, where the perpetrator eventually settles. Singaporean authorities open an investigation in the case with the aim of convicting the offender and recovering the funds in order to restitute the victims.

Tracing the funds is essential for the Singaporean authorities not only to confiscate and repatriate the assets but also to locate the offender, who has gone to live in his new house in Germany. In attempting to trace the assets, the authorities are confronted with the lack of records on the originator and beneficiary of the wire transfers sent out of Singapore to the United States. This case hypothetically occurred prior to the international standards on AML/CFT that included customer due diligence (CDD) for wire transfers.

Even when the Singaporean authorities eventually manage to obtain information on the destination of funds from Singapore to the United States, and later to the bank-secrecy haven, it is still impossible to obtain any information from the bank-secrecy haven, which protects every piece of financial information relating to the perpetrator. Unknown to the Singaporean authorities, the fraudster becomes aware of the investigation into his affairs and liquidates his property in Germany, carries the cash across borders, and establishes himself under false identity in a remote but comfortable country. The process of requesting international assistance lasts five years until it is abandoned without significant results.

To sum up, law enforcement authorities in performing their functions of fighting economic crime are confronted by two fundamental informational challenges: (1) availability and reliability of the information necessary to detect and prove economic crimes, and (2) access in a timely fashion to such information wherever it is around the world.

The next section discusses how AML/CFT measures can build a reliable system for detecting financial flows for law enforcement purposes to avoid these problems.

Parliament

Parliamentarians need to be convinced of the level of priority that should be accorded to developing an AML/CFT infrastructure. Support at this level is critical because a successful regime will depend on the passage of comprehensive and timely legislation and the provision of the resources necessary to make the regime effective. In this regard it would be useful for members of parliament to understand the obligations that arise from the relevant UN conventions, resolutions of the UN Security Council, and other regional commitments. To the extent that countries either directly or through membership in an FATF-style regional body (FSRB) subscribe to the FATF recommendations, there is an increased obligation to develop robust AML/CFT regimes. Government officials should also be aware that a number of governments have shown a willingness to impose various sanctions on other countries that are deemed to be inadequately applying the FATF recommendations. The United States has utilized Section 311 of the PATRIOT Act to designate countries or institutions as “primary money laundering concerns.” Such designations, in conjunction with rules subsequently issued by the Financial Crimes Enforcement Network (FINCEN), will often have the effect of severely restricting the ability of U.S. financial institutions to deal with these countries or institutions.

Government Officials

Government officials will need to understand the various roles they are expected to play in the system and how it relates to other aspects of their work. Regulators, for example, will need to develop methodologies for the integration of AML/CFT oversight into their existing supervisory regimes and determine how much of their resources to devote to the management of this risk. All entities will need to understand the role of the FIU, which will inevitably be a new institution or function within the government’s institutional arrangements. It will be important for all parties within the government bureaucracy to understand the fundamental requirements and protocols that are associated with their new responsibilities. This will be especially important in the arrangements for the handling and processing of information as it flows from reporting institutions through the FIU and on to law enforcement and prosecution authorities.

Reporting Institutions

Even in the best of times, reporting institutions are prone to perceive themselves as being subject to onerous regulatory obligations. The imposition of an AML/CFT infrastructure creates another layer of obligations to which they will be subject. They, like the policymakers, will need to be sensitized to the need to play their important role as the gatekeepers of the system and should also be aware of the sanctions that can arise if they fail to meet their legal obligations. They will need to understand that money laundering and the financing of terrorism will thrive to the extent that there are areas of weakness in the system and that such weak points may either be their own institution or institutions with which they have a business relationship. In countries with a robust sanctioning regime, financial institutions that fail to establish effective AML/CFT regimes face not only reputational risks but may also be subject to heavy fines. In extreme cases of AML/CFT failures, regulators have closed an institution. One of the most severe actions taken by regulators in response to concerns about management of AML/CFT risk was that taken by Japanese regulators against Citigroup in 2004. The Japanese regulators ordered Citigroup to close its private bank operations over their concerns about the failure of the bank’s AML internal controls.¹¹

Public

Perhaps the most difficult stakeholders to bring on board are the members of the public since they are a diverse and disparate constituency. But they are also the stakeholders who are likely to suffer the greatest inconveniences from AML/CFT as they conduct their everyday business. It is therefore important to have a program of public outreach that helps members of the public to understand concerns related to the potential abuse of the financial system by persons engaged in illicit activity and the measures necessary to combat such abuse. A critical issue to address in outreach programs is the importance of providing adequate levels of information to covered persons/institutions because some AML/CFT requirements may be contrary to the general expectations about the privacy of some types of personal information.

Obtaining Information

An AML/CFT regime should establish strong disincentives to the use of the financial and other covered sectors to facilitate illicit activity. To this end, the framework should create an environment that promotes high levels of transparency in the conduct of business by covered entities.¹² A major cornerstone in this regard is ensuring that covered institutions have thorough and pertinent information about their customers and the nature of their customers’ business.

Before discussing the measures that institutions should take to obtain the information necessary to manage AML/CFT risk, it is important to consider the measures that should be taken by government authorities. Measures taken by covered institutions will be built on the frameworks first established by the government. It is important that the framework for the formation of companies and other vehicles used in the conduct of business activity promotes high levels of transparency. There should be arrangements that allow for the identification of all persons who participate in the ownership of corporate entities, serve as directors, or are in positions to exert significant control over corporate vehicles or other entities. It is therefore important for countries to enact legislation that minimizes opportunities for persons to obscure the extent and nature of their participation in corporate or other forms of business activity. A recent FATF paper on the misuse of corporate vehicles reemphasizes the importance of a framework that requires institutions to obtain, in a timely manner, accurate and comprehensive information on the beneficial ownership of companies and to determine who are the trustees, settlors, and beneficiaries of trusts. The paper found that it is less important where such information is maintained, once it is comprehensive, up to date, and readily available to competent authorities.¹³

The other major component for obtaining such information is the action taken by the covered institutions themselves. There is often a perception that AML/CFT requirements place new and onerous responsibilities on covered institutions. While the advent of an AML/CFT regime will indeed impose a number of new requirements, there are a number of objectives that can be satisfied by measures that traditional financial institutions are likely to already have in place. In protecting their own commercial and financial interests, these institutions have a strong incentive to undertake due diligence on a customer, whether it is a bank managing its credit risk or an insurance company understanding a customer’s risk profile before pricing a product offer. This type of information will not be adequate to meet the requirements of a comprehensive Know Your Customer (KYC) regime,¹⁴ but it represents an important starting point as institutions try to obtain information on their customers in line with their AML/CFT obligations. Designated nonfinancial businesses and professions (DNFBPs)¹⁵ are the exception in the context of the responsibilities that are associated with requirements for robust customer due diligence (CDD). In many instances the nature of their relationship with their customers in the performance of their core business activity does not present risks that necessitate the performance of due diligence. This is particularly so for dealers in precious metals and stones and real estate agents. Casino operations are perhaps the one area of DNFBP activity that has traditionally been more proactive in undertaking some forms of CDD, for they are more vulnerable than other DNFBPs to losses through the fraudulent activity of their customers.

There are a number of core questions that covered institutions are expected to ask themselves as they contemplate the establishment of a customer relationship:

• Who is this person?

• What type of activity does this person want to conduct with my firm?

• What type and pattern of activity can I expect?

• Is this person representing a third party?

• How can I verify the information presented to me?

An important standard for an AML/CFT framework is its usefulness in the context in which it takes place. In addressing the issue of verifying a customer’s identity, FATF requires that countries should use “reliable, independent source documents, data or information” and cites the Basel Committee’s “General Guide to Account Opening and Customer Identification” as guidance on the types of documents that would be acceptable for this purpose.¹⁶ The paper suggests that government-issued identification documents such as passports, birth certificates, identity cards, and social security records would be appropriate for verifying identity, but it also points out that other documents “of an equivalent nature” may be used as well. While the use of such documents is clearly recommended in countries where they are commonplace, there are a number of countries where significant segments of the population do not possess such documents. In such instances the legal and regulatory framework should be designed in a manner that successfully bridges the requirements of the standard in way that is reasonable given the country’s circumstances.

There is often a strong temptation to design legal and regulatory instruments and practices in a manner that conforms closely with the standards and best practices in developed societies. If this is attempted in an environment where such conformity is virtually impossible to achieve, there is a danger of establishing legal and regulatory requirements with which most institutions cannot comply, which runs the risk of the framework being ineffective. It would clearly be more desirable to design a system that meets the test of independence and reliability within the local context. One country in which few citizens have state-issued identification has developed a system in which customers are identified on the basis of assurances provided by senior, well-respected community leaders. While this is not an ideal approach, to require government-issued identity documents in this instance would not only exclude persons who lack such documents from the formal financial sector but could also provide an incentive for the development of informal financial activity, which itself could become a source of AML/CFT vulnerability.

A crucial aspect of the CDD process is the establishment of a customer profile that assists institutions in understanding the type of activity that they should reasonably expect to be conducted through the customer’s accounts or facilities. It is only by establishing such a profile at the beginning and in the early stages of the relationship that an institution’s suspicion can be subsequently aroused by unusual or suspicious customer behavior. Such a profile is therefore the foundation for the subsequent function of monitoring customer activity and determining whether a suspicious activity report should be filed.

Maintaining Information

The principle reason to gather information is to ensure that accurate information is held on customers and their activities. This includes not only the information originally obtained on the customer but all subsequent information obtained, particularly information that relates to transactions conducted for or on behalf of the customer. Again, this is not a requirement that arises solely in the context of AML/CFT because there are many incentives, from a commercial perspective, for companies to maintain good records of customer activity and transactions. From an AML/CFT perspective, information needs to be comprehensive enough to facilitate detailed investigations into customer activity and should be easily accessible by the covered institutions and ultimately the competent authorities. The standard establishes minimum periods for the maintenance of identification and transaction records and stresses that records should be maintained for periods beyond these minimums, if specifically requested by competent authorities.

It is important to update the original CDD information on the customer, particularly in instances where information comes to light that can potentially alter some aspect of the original customer profile. The standard requires that where an institution has reason to doubt the accuracy of information held on the customer, it should undertake a new CDD process.

A crucial aspect of maintaining information is the ongoing monitoring of customer activity. This function will initially identify unusual activity, which will be further examined to determine if it meets the test of suspicion. Institutions are challenged to determine what types of monitoring systems are most appropriate for their needs. Factors that will influence their decision are the volume, nature, and complexity of their regular business transactions. In some instances, it is possible that a system based on manual oversight may be an effective monitoring mechanism, but as institutions grow in size and transactions become more frequent and complex, it is inevitable that this function will have to be computerized. The challenge for institutions, particularly those in relatively small and unsophisticated economies, or those who deal with relatively few transactions, is to recognize when they have reached the point where it is necessary to computerize the function. At this stage it is challenging to choose the software that is the best suited to the institution’s needs. A system that generates a large number of “false positives” is not effectively serving the need of the institution or the FIU. It should be the goal of covered institutions to produce a favorable ratio between the number of transactions that are originally identified as suspicious and the number of reports that are eventually filed with the FIU. The use of an automated system should not be seen as a replacement for human judgment and intervention, which are indispensable in making a final determination whether a transaction can be explained in the context of information held or known about the customer or whether it merits the filing of a suspicious transaction report (STR). The bottom line is that regulators will want to be convinced that an institution is able, with a reasonable degree of consistency, to identify suspicious activity that merits reporting to the FIU.

Transmitting Information

A significant feature of AML/CFT regimes is the number of interfaces between various groups or stakeholders, including members of the public, covered institutions, the FIU, investigatory authorities, and the officials who will eventually prosecute cases. Each group has its core functions and specific interests and each has a distinct view of its responsibilities in respect of information in its possession.

One overriding concern is the need to treat information with the appropriate level of confidentiality. In the conduct of everyday commercial and private activity there is an expectation of reasonable levels of privacy by all parties. Customers often wish to limit the amount of personal information they provide to a financial institution or make publicly available, and often have legitimate reasons for wanting to do so. Use of instruments such as trusts, for example, is sometimes driven not only by financial planning objectives but also by a desire to protect information that the settlors prefer to keep out of the public domain. In many instances these vehicles obscure the link between an asset and the person or persons with a beneficial ownership interest in the asset. Financial institutions also place priority on protecting the confidentiality of customer-specific information, and government agencies such as supervisors, FIUs, and prosecutors are no less concerned about the confidentiality of information, especially when such information could be market-sensitive or could be related to a criminal investigation or prosecution. A fundamental challenge to the transmission of information, therefore, is to establish a framework for the sharing of information that is acceptable to all parties and meets reasonable AML/CFT objectives.

Authorities should seek to establish quite clearly that all reasonable expectations to privacy will be respected. This is not only necessary for the efficient conduct of everyday business activity. It should also foster the levels of confidence that will encourage persons, both natural and corporate, to continue their use of the formal financial system. In a number of countries authorities have to balance requirements of AML/CFT legislation with confidentiality principles implicit in data-protection laws. However, notwithstanding the importance of an appropriate framework for confidentiality in the normal conduct of business, it is equally important to communicate to members of the public and the business community that there will be occasions when it will be necessary for persons and institutions to share such information. A major challenge in this regard is establishing a framework that provides for sharing of information while continuing to respect confidentiality to the extent possible.

The sharing or transmittal of information commences at the start of the business relationship. Customers should expect that their ability to initiate a business relationship with a covered institution will depend, in some measure, on the extent to which they are willing to provide information requested by the institution. If a customer is unwilling to provide information that is critical to the CDD process, the law should prohibit the institution from establishing the relationship. There are also times during the course of a business relationship when customers will be required to provide specific information to assist institutions to meet their AML/CFT obligations.

The information required for sending funds by wire transfer is a case in point. FATF Special Recommendation VII requires not only that specific customer information be obtained by the originating institution but also that such information should remain with the transfer throughout the payment chain. If the originating institution cannot obtain the information, it should decline to effect the transfer. Recipient institutions have a similar obligation to ensure that the requirements of the standard are met under these circumstances.

There should also be clear legal provisions indicating the circumstances under which covered institutions have an obligation to provide information to the FIU and other competent authorities and to provide explicit protection against civil and criminal liability for reporting institutions, their directors, and their employees, and obligating such parties to treat all reports in strict confidence.

The sharing of information when reporting institutions file suspicious transaction reports presents specific challenges that require institutions to strike an important balance. Reporting institutions are not expected to perform the role of investigatory authorities, and the test to be met before taking a decision to file a report is that there are reasonable grounds for suspicion on the part of the reporting institution. In making a determination in this regard, it is expected that an institution will review its information on the customer, consider the customer’s general profile, and where possible make discreet enquires that may be necessary to clarify the information being reviewed. The process of making inquiries is a sensitive one because it is important not to “tip off” the customer about the reasons for the enquiries. In fact, it is a requirement that there be an explicit prohibition against disclosing the fact that a report is being made to the FIU.

In attempting to meet their obligations to file STRs, institutions sometimes engage in defensive reporting. This is a practice in which they report all cases where there is the slightest level of suspicion about customer conduct. In taking this action, institutions are driven by a concern that they may be sanctioned if deemed to be failing to meet their reporting obligations. Defensive reporting is in fact counter-productive because it inundates the FIU with information of varying quality and makes the FIU’s job of analyzing the data more difficult that it should be. Reporting institutions are therefore challenged to find the right balance between meeting their reporting obligations and being a responsible partner by providing the FIU with quality data on which to undertake its analysis.

Corporate Governance Infrastructure

As already discussed, many of the measures that institutions are expected to employ in satisfying AML/CFT obligations are not unique to an AML/CFT regime. Such measures can operate in conjunction with an underlying infrastructure that provides general support for the operation of the covered institution. An important aspect of this infrastructure is the institution’s corporate governance framework. AML/CFT requirements will only be successfully executed to the extent that there is a framework of clear and effective policies and procedures, clear lines of accountability, appropriate control mechanisms, and internal and external audit functions. Financial sector regulators have often determined that failures within licensed institutions can be linked to either a failure to establish effective risks-management systems or the failure to adequately use effective systems that are already in place. In a number of instances, regulators have given as a rationale for the imposition of AML/CFT-related sanctions the failure of institutions to maintain critical aspects of their corporate governance.

In December 2005 the Office of the Controller of the Currency (OCC) in the United States fined the Arab Bank US$24 million for failures in its internal controls related to the Banking Secrecy Act and general anti-money laundering compliance. The OCC found that the bank failed to (1) adequately implement a program to monitor funds transfers for suspicious activity, (2) obtain sufficient information about funds transfers to determine if it was necessary to file an SAR, and (3) adequately audit the program established to monitor funds-transfer procedures.¹⁷ The OCC was therefore concerned that the corporate governance arrangements failed not only at the primary level of establishing appropriate monitoring mechanisms but also at a secondary level in relation to weaknesses in the audit function.

In October 2006 the Financial Crimes Enforcement Network (FINCEN) assessed a civil penalty against the Foster Bank in the amount of US$8.5 million. FINCEN found that the bank “failed to implement an adequate Banking Secrecy Act compliance program, including an anti-money laundering program with internal controls, independent testing and other measures to detect and report potential money laundering, terrorist financing and other suspicious activity.”¹⁸

Supervised Institutions

A supervised entity must define its appetite for risk in the context of AML/CFT and develop strategies to manage the risk inherent in the business it conducts. It is therefore expected that institutions will be able to demonstrate that they understand the risk they take on and that they have devised internal mechanisms and controls to manage it. The FATF recommendations have provided some broad guidance in this regard and have identified activities considered to represent a level of risk that is higher than normal. These include businesses with politically exposed persons (PEPS), correspondent banking relationships, and businesses with persons or entities from countries that do not adequately apply the FATF Recommendations. This list is not exhaustive, and institutions are expected to understand their own risk profile and employ the appropriate measures to manage the risks. For example, a number of banking institutions worldwide have made the judgment that providing services to money services businesses is a high-risk activity in the context of AML/CFT and have either reduced services to these entities or have discontinued the business relationships. Six U.S. regulators were concerned enough about this development to issue a joint statement suggesting that a bank’s concerns in this regard “may stem, in part, from a misperception of the requirements of the Banking Secrecy Act and an erroneous view that money services businesses present a uniform and unacceptably high risk of money and other illicit activity.”²¹ The regulators stressed that “a decision to accept or maintain an account with a money services business should be made by the banking institution’s management, under standards and guidelines approved by its board of directors and should be based on the banking institutions’ assessment of the risks associated with the particular account and its capacity to manage those risks.” The action taken by the U.S. regulators underscores the importance of devising risk management strategies that are tailored to the risk profile inherent in an institution’s business lines and customer relationships, and it also highlights the regulators’ concerns that measures taken to manage AML/CFT risk should be proportionate to the perceived risk and should not be unnecessarily disruptive to the conduct of legitimate business activity.

It is permissible, using a risk-based approach, to determine that some lines of business represent a lower-than-average level of risk and accordingly can devote fewer resources to managing the AML/CFT risks. Institutions adopting such measures should be prepared to justify to their supervisor the basis of their analysis of the risks that they perceive to be inherent in their various business lines and customer relationships and the rationale for the choice of measures they have adopted to manage those risks.

The Supervisor

The obligation of the supervisor is to understand and manage the AML/CFT risk that can be posed by all institutions for which it has responsibility. The supervisor must adopt strategies and determine the extent to which a disproportionate amount of supervisory resources may be focused on some institutions. The supervisor’s judgment in this regard will be influenced by a number of factors, including the nature of the business undertaken by an institution and the effectiveness of the oversight regimes to which the institution is subject. A risk analysis might determine, for example, that a branch of a large international bank that has strong internal controls and is subject to rigorous headquarters oversight and independent audit might represent a lower AML/CFT risk than a small, locally owned bank that is neither subject to head office supervision nor comes under the consolidated supervisory responsibility of a foreign supervisor. Another perspective of the relative AML/CFT risks posed by these two institutions might be that notwithstanding the more robust oversight mechanisms to which the first institution is subject, its higher volume of large international financial flows may make it more vulnerable to money laundering and financing of terrorism than a small bank catering primarily to a local market. On issues of risk management, there are no easy answers. However, supervisors are expected to assess and understand the risks to which their licensees are exposed and to make appropriate decisions on the most effective use of their supervisory resources.

FATF Recommendations on Domestic Cooperation and Information Sharing

The key Recommendation dealing with domestic cooperation between competent authorities is Recommendation 31. It states:

Countries should ensure that policy makers, the FIU, law enforcement and supervisors have effective mechanisms in place which enable them to co-operate, and where appropriate coordinate domestically with each other concerning the development and implementation of policies and activities to combat money laundering and terrorist financing.

Recommendation 31 is an open recommendation in that it defines the necessary measure by its objective, which is achieving effective cooperation. In other words, the recommendation does not tell countries what to do; it only guides them to implement effective mechanisms to achieve this objective.

Recommendation 31 does, however, offer some further guidance on the scope and nature of interagency cooperation. It defines the relevant authorities that should be integrated through mechanisms of cooperation. It suggests that countries bring into cooperative arrangements not only the FIU, the supervisory authorities, and law enforcement authorities, but also policy makers and other competent authorities. In the elaboration provided in the methodology for assessing compliance with the standard, it is clearly noted that law enforcement authorities should include customs authorities where appropriate. The involvement of customs authorities is particularly important because the focus on cross-border movement of cash and other negotiable instruments gained more prominence in the AML/CFT scheme with the introduction in 2004 of Special Recommendation IX, which specifically addressed this issue.²³

Policy makers include any agency that has the power to influence or determine policies and practices. The exact scope of this category of stakeholders varies from country to country. Broadly speaking, it may include certain key ministries, such as the ministries of justice, foreign affairs, or finance.

Countries should also consider whether other competent authorities are relevant. For example, in countries where AML measures are not utilized to combat tax evasion, tax authorities may still be relevant because the information they possess may help in conducting financial investigations for the purposes of AML/CFT. A country may consider taking the necessary measures to achieve cooperation with tax authorities on AML/CFT issues, subject to that country’s approach to confidentiality of tax information and the appropriate use of such information.²⁴

Recommendation 31 also distinguishes between policy cooperation and operational cooperation, and requires countries to take measures to achieve cooperation at both levels. Countries should take measures that help achieve cooperation in the development of AML/CFT policies. At the same time, they should have mechanisms in place to secure operational cooperation in carrying out AML/CFT activities such as cooperation in investigating money laundering offenses.

In addition to Recommendation 31, in this regard one should also take note of Recommendation 26, which requires that the FIU have access, directly or indirectly and on a timely basis, to the financial, administrative, and law enforcement information that it needs to undertake its functions. This aspect of Recommendation 26 spells with clarity an integral component of a system of information sharing that is essential for the operational success of the FIU.

A similar requirement is to be found in Recommendations 33 and 34, which require countries to make it possible for their competent authorities “to obtain or have access in a timely fashion to adequate, accurate and current information on the beneficial ownership and control” of legal persons and legal arrangements.

Formal and Informal Mechanisms

Countries have adopted a variety of mechanisms to induce enhanced collaboration and information sharing among the agencies that have a role to play in fighting money laundering and terrorist financing, both at the level of policy making and at the operational level. In addition to the distinction between formal and informal mechanisms, there are four types of formal mechanisms that countries have adopted in order to facilitate interagency cooperation and information flows: legislative stipulation, formal multi-agency committees, interagency memoranda of understanding, and staff exchange arrangements.

Causes of Failure

Collaboration between authorities is not an easy matter. Agencies come into the process with different institutional cultures, mandates, and priorities. But tackling economic crime is nearly impossible without cross-agency effort.²⁶ It is possible to identify the common causes for failure or constraints in interagency information flow.

One of the biggest impediments to collaboration is the overlap of jurisdiction among agencies. This is a problem in many countries, regardless of their level of development or the sophistication of their AML/CFT system. Overlap of jurisdiction often creates turf fights and competitiveness that is detrimental to the collaborative process. This tension and competitiveness is often expressed in the systematic withholding of information from the other agencies, which clearly undermines the flow of information necessary for an effective AML/CFT system.

Turf fights resulting from overlap of mandates occur among competing supervisory authorities as well as competing law enforcement agencies. For example, the AML/CFT laws of some countries assign to the newly established FIU the function of supervising the regulated institutions’ compliance with AML/CFT measures while still maintaining their default supervisory authorities over the same subject matter. In their attempt to protect their supervisory turf, the FIU and the supervisory authorities may withhold from each other information relating to the regulated institution’s compliance, to the detriment of the effectiveness of the AML/CFT regime.

It has been observed, especially in larger countries with complex economic systems, that there is a substantial fragmentation of supervisory and law enforcement functions, which creates difficulties for coordination. One reason is related to the overlap of jurisdiction. Fragmentation of functions often results in ambiguity in the scope of the jurisdiction of each agency, which has the same effect as the overlap of jurisdiction. Fragmentation also increases the number of agencies that need to be involved, which aggravates conflicts of cultures, mandates, and priorities.

The reverse of fragmentation of functions—that is, concentration of functions—can also be problematic. Some country assessments have found that cross-agency cooperation is undermined when all the powers and responsibilities relating to AML/CFT are concentrated in one agency. This may seem paradoxical, for it would seem that if all AML/CFT responsibilities are concentrated in one agency, there would be no need for interagency cooperation. This conclusion would, however, be incorrect, for AML/CFT measures are only means to other ends. They are meant to facilitate the achievement of the wider objectives, including protecting the integrity of the financial system and facilitating law enforcement efforts against all types of financial crimes. Without cooperation and information flow between the agencies responsible for AML/CFT measures specifically and the agencies responsible for these wider objectives, the effectiveness of AML/CFT measures cannot be achieved.

The detrimental effects of concentrating AML/CFT functions could be attributed to the fact that it tends to lower the priority level of AML/CFT issues in other agencies and therefore reduces the level of resources committed to AML/CFT and the level of expertise developed in this area.

Staff turnover also poses a problem in jurisdictions that are small or have an underpaid civil service. Under such circumstances, staff of supervisory and law enforcement agencies tend to leave the service at a high rate in order to pursue better employment opportunities. This affects informal interagency collaboration because it undermines the development of sustainable collaborative relationships between individuals in various agencies.

Some structural factors may also pose challenges for the efforts to collaborate and share information. The sheer size of a country when accompanied by severe resource constraints results in difficulties of cooperation and sharing of information between agencies that operate in various parts of the country.

Finally, each authority is governed by certain rules relating to the use and disclosure of information that becomes available to it. Some of these rules are justified either for operational reasons, such as the success of criminal investigations or intelligence gathering, or for reasons of civil rights and due process, such as the restrictions relating to self-incrimination that apply in certain jurisdictions. Such rules have implications, for example, for the sharing of information between tax authorities that receive voluntary disclosures for tax purposes and criminal enforcement agencies gathering evidence to prosecute a criminal offense.

When confidentiality rules are too strict, they hamper institutional cooperation and information flows. While some of the confidentiality rules are justified, others may be out of date and not in line with the current complexity and magnitude of economic crime, which poses a much higher demand for information sharing. Some confidentiality practices are merely the result of institutional culture as opposed to either legal provisions or operational considerations.

Identified Good Practices

The findings from country experiences also point toward a number of good practices in achieving institutional cooperation and effective information flow. For example, there is strong evidence from country studies that when AML/CFT efforts are led by a strong agency such as a key ministry or other key institutions (e.g, the central bank), cooperation is enhanced. This is particularly relevant in the early stages of setting up an AML/CFT system. When successful, the lead institution, especially when adequately represented, plays an important role in resolving jurisdictional conflicts and facilitating the flow of information.

Multi-agency committees, whether formally or informally constituted, have succeeded in performing the functions of facilitating cooperation and information sharing when they meet regularly and have a clear and realistic agenda. It is also good practice for member agencies to keep a representative on the committee who has sufficient authority to make commitments on behalf of the agency.

It is valuable to designate specialized AML/CFT units within each competent authority or to identify a specific liaison officer. This allows other agencies to easily identify the contact person. It also helps to develop expertise and institutional memory. An additional value is the harnessing of cooperative personal relationships across agencies.

Country experiences lend credence to the argument that the use of existing institutions instead of creating new ones to handle AML/CFT issues can benefit cooperation and information sharing. Building on already existing channels of cooperation where they exist between agencies has also proved beneficial. This does not preclude the creation of new channels, especially in situations where collaboration between particular agencies was minimal prior to the AML/CFT agenda.