Ongoing Monitoring is a requirement under FATF Recommendation 10. This includes a requirement for businesses to conduct Ongoing Due Diligence including scrutiny of transactions to ensure consistency with their knowledge of the customer. This requirement is embedded into each regulators AML/CFT Section 15 of the GSC’s Gambling (Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (“the Code”) details the requirements for Isle of Man licensees.
On the blog, we explore what, when and how Ongoing Monitoring is conducted and why it will benefit your business and the market as a whole.
Ongoing monitoring process involves collecting and analysing data from various sources such as transaction records, customer profiles, and external databases. This data is then evaluated against predefined risk indicators and patterns to identify any unusual or suspicious activity. Ongoing Monitoring involves performing (at risk based intervals) a review of policies, procedures and testing of their implementation to ensure they are:
Reviewed at least annually by senior stakeholders, i.e. the Board of Directors (where necessary)
The Code details that “appropriate scrutiny of transactions and other activities to ensure that they are consistent with –
Transaction monitoring is the process of monitoring a customer's transactions such as transfers, deposits and withdrawals. Transaction monitoring will seek to identify suspicious behaviour which could indicate money laundering or other financial crime occurring and therefore it is critically important that there are systems in place to monitor and detect activity that deviates from the norm, and where unusual activity cannot be reasonably explained, it is important that any suspicion is reported. Such monitoring is even more important when dealing with a transaction or relationship that poses a higher risk of ML/PF/TF and therefore it is important that Customer Risk Assessments are ongoing to and risk based thresholds/triggers are in place ensure that the appropriate level of scrutiny in terms of customer activity is performed.
When performing such monitoring, it is important to ensure that decision making is consistent with: -
Political Exposed Persons (PEPs) are high-risk individuals, including government officials and political party members, due to their increased opportunities for acquiring assets through illegal means such as bribery and money laundering. Therefore, PEPs must be identified and screened in financial institutions because of their risks. Identifying PEPs and determining their risks is generally referred to as PEP List Screening. It is an essential screening for the best implementation of AML compliance programs, especially in financial institutions.
Sanction List checks are a critical aspect of compliance for businesses today. Financial crimes such as money laundering, proliferation financing, fraud and terrorist financing are constantly evolving and pose a significant risk to businesses of all sizes. With the rapid development of technology, financial crimes have become more sophisticated and diverse, making it challenging for businesses to detect and prevent them and therefore it is critical that licence holders not only screen customers for sanctions risk, but third parties too, and ensure that appropriate jurisdictional blocks are in place and effective.
On an annual basis, or as a result of a risk trigger, operators must ensure that their policies and procedures not only reflect the regulatory obligations, but are reflective of the current activities, and due consideration by the Board of Directors in terms of key policies and risk assessments (including the AML/CPF/CFT Policy and BRA) must be evidenced.
To ensure the effectiveness of policies and procedures it is important to periodically test their implementation and effectiveness. Most notably for B2C operators, dip sampling of customer accounts is an essential element of ongoing monitoring. Dip sampling should look to ensure that onboarding, CDD and EDD procedures have been followed effectively, and that necessary scrutiny, assessments and decision-making (which may include a SAR) has been made in accordance with the timelines detailed. Where deficiencies are noted and unusual activity is detected, transaction monitoring thresholds and triggers should be reassessed as this may indicate that they are not calibrated appropriately.
If you identify unusual activity while undertaking Ongoing Monitoring, you must review and scrutinise the activity at the earliest opportunity. This is likely to involve you utilising your Enhanced Due Diligence (“EDD”) Policy and Procedure. For example, if you are uncertain about the customer’s Source of Funds (“SOF”) and affordability you may choose to request payslips for the month(s) in which the spending took place. If this is not forthcoming or the information provided adds to your initial concern, you should then consider filing an Internal Disclosure (Suspicious Activity Report “SAR”) and escalating to the MLRO so that they can determine if onward reporting the local FIU is required.
How often you undertake Ongoing Monitoring should be a risk-based decision. When determining how often to review a customer you should review the relevant risk assessments i.e., customer and BRA. The recommendation is that if there is a greater risk, the frequency of the reviews should be more frequent.
Ongoing Monitoring can be done manually but often when considering Transaction Monitoring it is more efficient and effective to utilise technology. Whichever technology you decide upon you must ensure that a TRA is undertaken before the technology goes live in your business. Additionally, you should ensure that people who have a solid awareness of the business are involved in the integration so that they can ensure all applicable rules and thresholds are “switched on” so that customers flag for review at the appropriate times. Similarly, it should have the capability for the reviewer to document the review, what steps were undertaken and what the outcome was of the review.
Learn more
To sum it up, ongoing monitoring in the context of Anti-Money Laundering (AML) is crucial for gaming operators and software developers to detect risks, ensure compliance with evolving regulations and safeguard their reputation.
Amber Gaming is a specialist gaming consultancy business providing multi-jurisdictional licensing, regulatory compliance advice and professional support to clients across all areas of the gaming industry.
We also provide specialist training (both online and face-to-face) through our Compliance Academy for roles related to these functions.
If you are interested in learning more about ongoing monitoring or discussing your licensing or training requirements, please feel free to reach out to us via the Contact Us form.