LSEG REPORT 2024

Global CeFPro® Report

The State of Financial Crime Compliance Programs in US and EMEA September, 2024

Supported by: THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

1

CONTENTS 3

About us

4

4 Key insight and research overview

5

Executive summary

6

Evolving risk landscape: Innovation changing the face of predicate crimes

7

Fast-moving compliance and regulation

8

Capacity versus reality

9

Future-proofing risk strategies: Keeping up with technology & risk data challenges

10

Budget and resource demands

11

Conclusion and key takeaways

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

2

ABOUT US

About CeFPro: The Center for Financial Professionals (CeFPro) is an international research organization and the focal point for the global community of finance, technology, risk, and compliance professionals from across the financial services industry. CeFPro is driven by high-quality, reliable, primary market research. It has developed a comprehensive methodology that incorporates data from its global community that has been validated by an international team of independent experts.

Examples of some of CeFPro’s research include: •

Non-Financial Risk Leaders: the most comprehensive independent study of trends, opportunities, and challenges within non-financial risk

•

Fintech Leaders: an international survey to assess the status of the fintech industry and provide details for informed decisions on technology and business-related matters.

To find out more, visit www.cefpro.com/research

About LSEG: LSEG Risk Intelligence provides a suite of solutions to help organisations efficiently navigate risks, limit reputational damage, reduce fraud and comply with legal and regulatory obligations around the globe. From screening solutions through World-Check, to detailed background checks on any entity or individual through due diligence reports, and innovative identity verification, account verification and digital onboarding services – organisations can trust LSEG Risk Intelligence to help them manage their risk, so they can operate more efficiently, more effectively and more confidently. To learn more, visit www.lseg.com/risk-intelligence.

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

3

KEY INSIGHTS: How well prepared are the risk and compliance functions in tackling new challenges?

As risk & compliance professionals appear overwhelmingly concerned with fraud, emerging technologies, and evolving regulation, how can they stay resilient in the changing world of financial crime risk?

CONFIDENCE IN RISK APPROACH NOW DOES NOT APPEAR TO SUFFICE FOR THE FUTURE

RISK AND COMPLIANCE NEED A RESOURCE RESET

52% believe their organization’s current screening and due diligence processes in identifying and mitigating risks are very/extremely effective but only 35% are very/extremely confident that their organization is equipped to tackle emerging financial crime threats and related risks.

Only 47% said their organization’s overall budget for financial crime compliance efforts increased in the past year.

RISK PROFESSIONALS ARE FACING NEW CHALLENGES 92% of risk professionals identify fraud as a predicate crime that will negatively affect their organization’s business.

83% feel that technological advancements and cybersecurity threats could potentially impact the success of their organization’s financial crime risk management efforts. 41% agree that the inability to keep up with complex and changing regulation is the primary challenge they face in meeting regulatory .standards.

However, a percentage of the risk professionals revealed that they expect to see the highest increase in efforts and resources in the future in the following areas: 68% KYC screening 65% Identity verification 65% Reducing false positives

ABOUT THE RESEARCH: The survey of 120 risk professionals in financial services was conducted by CeFPro, in partnership with LSEG Risk Intelligence, from February 15, 2024 – April 18, 2024; interviews were conducted from April 29 – May 1, 2024. The results provide a benchmark for industry professionals within financial crime compliance, with one Senior Risk Professional from a global bank stating, ‘It’s nice to know that we are within the pack and not an outlier.’ These results provide a snapshot of the industry, including the hurdles and challenges it is facing on the horizon and the progress that stakeholders are making toward increasing the efficiency of programs.

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

4

EXECUTIVE SUMMARY: The research creates a very clear risk management narrative and can be broadly expressed in three parts: 1. The risk landscape evolves: There is an expectation, or perhaps requirement, for effort and resources used across various areas of risk management to increase. This is unsurprising as respondents cited a wide range of predicate crimes and evolving challenges threatening their organization.

Fraud, cybercrime, and the speed of technological advancements were common concerns.

2. Confidence around current risk management strategy and resourcing: Overall, respondents expressed a relatively high degree of satisfaction and confidence in their ability to meet the challenge of managing and containing existing known threats and compliance issues.

3. Hesitation around successfully managing future risks: A far smaller portion of respondents were very or extremely confident in their ability to tackle emerging financial crime threats and related risks. There is a tangible concern that a potent mix of i) an increasingly demanding and fast-changing compliance and regulatory landscape, ii) dwindling real-terms budget allocation, and iii) a reduction in human and technology investment could serve to negatively impact future risk management capability.

Fraud, cybercrime, and money laundering were identified as the top three primary concerns, and only 35% of respondents were either very or extremely confident their organizations are equipped to tackle emerging financial crime risks and threats.

An inability to keep up with a fast-changing regulatory landscape (41%) and lack of manpower (29%) were seen as the primary challenges in meeting regulatory standards for screening and due diligence by respondents. This view is emphasized by the fact that less than half of respondents had not seen any uplift in the budget to address financial crime compliance challenges.

The results demonstrated that organizations are typically at different phases in their risk management approach and strategy. Further, in post-survey interviews, the interviewees identified technology as playing a key part across all phases of preparedness development, with the Head of Illicit Financial Threat at a major UK government agency and a senior risk advisory consultant highlighting the rapid evolution of new technologies as both a threat as well as a management and mitigation opportunity.

Another key feature, though not specifically focused on in the survey but highlighted heavily within the additional interviews conducted with senior risk management professionals, was that of geopolitical risk. Its direct effect on risk strategy and financial crimes was referenced continually, most notably in money laundering. This was also reflected in the survey, with 59% of respondents expecting an increase in allocated effort and resources to sanctions screening. The ongoing conflict in Ukraine appears to be a key driver for many aspects of financial crime; with updates to sanctions listed almost daily, continuous investment in effort and resources is required.

When asked about the expected effort and resources in tackling a range of areas, including KYC screening, politically exposed persons (PEP) screening, sanctions screening, third-party due diligence screening, identity verification, and reducing of false positives, there was a clear expectation of an increase in effort and resources across most areas. KYC screening showed the greatest expected increase (68%), followed by false positive reduction (65%) and identity verification (65%).

Some of the industry experts consulted in the 1-on-1 additional interviews attributed this shift in resources to meeting the demands for new technological advances within the field. They argued that as the industry is shifting towards automation to reduce manual processes and enhance team efficiency, additional focus was expected to be dedicated to financial crime risk mitigation strategies through processes and controls.

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

5

EVOLVING RISK LANDSCAPE Innovation changing the face of predicate crimes The survey highlighted a range of concerns that could impact the success of an organization’s financial crime risk management efforts, not just now but in the future. The top predicate crimes that respondents were most concerned with for their organization were fraud (92%), cybercrime (78%), and money laundering (70%) (Figure A). In interviews, it was flagged that these crimes are being influenced most by fast-evolving technology.

The speed of technological advancements and cybersecurity threats is significantly the leading factor of concern when it comes to respondent’s organizations’ financial crime efforts (83%, Figure B). As interviews further revealed, substantial focus is being placed by organizations on technology and cyber-related risks related to emerging threats and staying ahead of the evolving landscape, and significant work is underway to understand emerging risks and stay a step ahead of events and criminals.

Figure A. What predicate crimes are you concerned will negatively affect your organization’s business? Select all that apply.

Fraud 92%

Cyber crime 78%

It was clear from post-survey interviews that technological advancement is viewed as what one senior Treasury risk manager described as a ‘double-edged sword’. He noted that threat actors were able to utilize emerging technologies to attack organizations faster than those organizations were able to navigate the internal and regulatory compliance policies and processes that would allow their implementation as a line of defense.

Conversations with the risk professionals highlighted how organizations, regardless of how well prepared and financed they are, often find themselves operating in a reactive or ‘second-move’ way; therefore, they face greater pressures to advance their programs, both to stay ahead of developing threats, and ensure that they remain as well equipped as possible to counter existing bad actors.

Cyber security and the evolution of threats remain key risk factors, as organizations face direct financial repercussions if data is stolen or bad actors manage to defraud clients/ users; for example, organizations may be required to reimburse victims under certain scenarios. It was highlighted in additional interviews with industry experts that technology and cyber may have been the respondents’ reported concern due to the high frequency of attacks organizations are under, as well as the costly financial repercussions that each could carry.

Figure B. Which factors are you concerned could potentially impact the success of your organization’s financial crime risk management efforts? Select all that apply The speed of technological advancements and cybersecurity threats

Money Laundering

83%

70%

Terrorist financing

Fast evolving risk and regulatory frameworks 41%

Bribery & corruption 37%

59%

Challenges in integrating risk management across various departments’ existing systems 45%

Tax crimes 31%

Greenwashing 20%

Online sexual exploitation of children 15%

Illegal logging 8%

Wildlife trafficking

Inadequate internal risk management capabilities and resources 37%

Limited access to high-quality and reliable risk intelligence 33%

Lack the internal expertise and tools to identify positive matches 22%

Other 6%

6%

Other 7%

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

6

Fast-moving compliance and regulation

Figure B demonstrates that fast-evolving risk and regulatory frameworks were reported as concerning by 59% of respondents. As the regulatory landscape continues to evolve across all subsets of financial crime, interpreting and implementing required changes are a key concern for organizations who see the speed and resources required to meet compliance challenges potentially limiting the speed of success. Indeed, 41% of respondents saw an inability to catch up with the complexity of evolving regulations as a primary challenge in meeting standards for screening and due diligence (Figure C).

This is particularly salient in the context of sanctions, where changes occur on a near-daily basis; as a result, updating systems to cope with continuous change is an ongoing task.

With further changes expected as the geopolitical landscape evolves and technology continues to advance, it is likely that this field will require additional funding and attention.

As established in the sections discussing budgetary and effort questions, allocating headcount, effort, and budget to advancing technology and adapting to regulatory change is vital.

The survey highlights the work that must be conducted internally to tackle the technology, cyber, and regulatory risks. Change is required to build efficiency and mitigate risk in an appropriate and proportionate way; processes and frameworks must be functional and efficient on an internal level if they are to tackle external threats successfully. Such measures will integrate risk management across the culture of the organization and help develop internal programs to mitigate evolving external threats.

Figure C. What is the primary challenge you face in meeting regulatory standards for screening and due diligence?

41%

29%

16% 8%

5% Lack of manpower

Inability to Inadequate catch up with access to the complexity timely and evolving data regulations

Insufficient training to interpret the data

Other

*Data may not add up to 100% due to rounding

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

7

CAPACITY VERSUS REALITY

The assessment of the current capacity to successfully manage existing risk has shown to differ significantly from the levels of confidence within organizations to accurately and effectively identify emerging risk.

On delving deeper into internal practices and reviewing the effectiveness of screening and due diligence processes to identify and mitigate risk, organizations were again largely positive in the ratings of their effectiveness (Figure D).

Over half (52%) of respondents either saw their processes as ‘Extremely effective’ or ‘Very effective’. As many of the respondents represented large and mid-sized banks, few were expected to be in the early stages of setup, which could indicate a more advanced program with higher effectiveness.

Figure D. How effective do you consider your organization’s current screening and due diligence processes in identifying and mitigating risks?

Extremely effective

As the industry prepares for additional events that could impact financial crime teams, the focus of survey respondents and their parent organizations has expanded into that of potential emerging risks. Figure E investigates how well-equipped organizations feel they are to tackle emerging financial crime threats and risks. Only 35% of respondents stated that they were either ‘Extremely confident’ or ‘Very confident’ in tackling emerging risks. The disconnect between current screening and due diligence vs attitudes toward emerging risks paints a picture of reduced confidence for the future.

Figure E. How confident are you that your organization is equipped to tackle emerging financial crime threats and related risks?

Extremely confident 5%

9%

Very effective

Very confident 43%

Somewhat effective

30%

Somewhat confident 43%

55%

Not very effective

Not very confident

3%

9%

Not at all effective

Not at all confident 2%

2%

*Data may not add up to 100% due to rounding

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

8

FUTURE-PROOFING RISK STRATEGIES Keeping up with technology

Technology is being leveraged across all aspects of financial institutions, but interviews with risk professionals revealed one area where it was being utilized with significant impact, which was in data cleansing for the purpose of analyzing and/or investigating alerts. For example, technology can aid in aspects such as sanctions, KYC, horizon scanning, media scanning, and predictive analytics for future events. Although not specifically referenced in the survey questions, many of the industry experts interviewed highlighted technology as the avenue in which they had seen the biggest allocation of both effort and budget.

While the implementation of technologies can be expensive, the failure to increase budgets and efforts in innovation and technology could prove to be more costly in the long term.

Organizations that do not advance quickly enough to stay ahead of threats and increase their efficiencies in manual tasks may end up harming their customers. Post-survey interviews expanded on this, with some interviewees also identifying an ongoing scarcity of talent and ensuring risk management functions were able to recruit and retain the most skilled employees.

Risk data challenges

The more moderate confidence levels seen in the research when considering emerging risks could also demonstrate that each organization has a different approach, roadmap, and risk appetite; risk intelligence data requirements will vary across the industry. Ensuring the accuracy and reliability of the data is a complex challenge, and only 21% of risk professionals are not very / not at all concerned with the accuracy and reliability of the risk intelligence data they use (Figure F).

Figure F. How concerned are you with the accuracy and reliability of the risk intelligence data you currently use?

Extremely concerned 7%

Very concerned 18%

Somewhat concerned 55%

Not very concerned 19%

Not at all concerned 2%

*Data may not add up to 100% due to rounding

These concerns over the quality and accuracy of existing risk intelligence data (Figure F), together with worries about a perceived lack of resources to manage the increasingly complex and fast-changing nature of compliance and regulatory measures, mean many respondents worry that they will struggle to ‘play catch up’ in meeting future risk challenges with effective strategies. Post-research interviews with risk professionals revealed how testing requirements on data remain stringent; without appropriate technology, data verification is a significant challenge, as are validation approaches. Organizations are increasingly relying on multiple sources to gain a complete picture; current processes often do not include less traditional data. An example was given in interviews with risk professionals of negative news scanning when onboarding customers.

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

9

Budget and resource demands

Figure G. In the past year, has your organization’s overall budget for financial crime compliance efforts increased, decreased, or stayed the same?

A similar trend can be observed when considering the budget for financial crime compliance efforts in the past year generally. While a total of 47% of respondents reported seeing an increase in the budget, 39% reported that they had seen no increase (Figure G). It was observed in additional qualitative research with industry experts that even at a maintenance operation, with the sheer scale of sanctions changes alone, budget would be expected to increase to keep up and ensure compliance with the recent changes.

There is a constant industry drive to build maturity, enhance automation, and develop sophisticated programs.

As the demand for efficiency and a reduction in manual intervention continues, upfront budget is required to develop programs that can be automated. It is possible that those that stayed the same, from a budget perspective, may be further along their technology journey, with systems in place to help alleviate manual load. Organizations want to stay ahead of the curve, and advancing technology is a key tool in doing so. For example, fraud was perceived as the greatest predicate crime facing respondents’ organizations in the research (92%) (Figure A). Our interviewee participants discussed how fraud prevention, as a result, has seen a large influx of budgetary resources with the introduction and development of identification methodologies such as digital recognition and facial identification. This discussion mirrors the increased expectations for resource and budget allocations for identity screening seen in Figure H, with 65% of respondents anticipating this trend.

47% 39%

8%

7% Increased

Stayed the same

Decreased

I don’t know

*Data may not add up to 100% due to rounding

Figure H. Do you expect the effort and resources your organization allocates to tackle the following financial crime risks to increase, decrease, or stay the same?

68%

65%

65% 59%

59%

49%

41% 35%

32%

34%

30%

25%

8% 4%

3%

KYC screening

2%

1%

Reducing false positives

Increase

3%

3%

Identity verification

Stay the same

3%

3%

3%

4%

Third party due diligence screening

Sanctions screening

Decrease

Not applicable / don’t know

3%

PEP screening

*Data may not add up to 100% due to rounding

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

10

CONCLUSION AND KEY TAKEAWAYS: The primary message that the survey responses send is one of concern about the future preparedness of their organizations to effectively meet and manage the challenge of emerging risks around fraud, cybersecurity, and money laundering.

Specifically, those working within the field of risk management believe that an increasingly rapid evolution of the regulation and compliance sector, together with a shortage of the manpower needed to incorporate the expected flurry of measures it will bring, remain the key threat to organizations’ ability and capacity to manage future risk effectively. As geopolitical tensions continue to spill over into compliance, the future remains uncertain. For the most part, organizations appear confident in managing financial crime risk from a practical perspective, and there is relative confidence in the ability to prepare and mitigate emerging risks and in the capacity to leverage risk intelligence data to make informed decisions.

Underpinning all of this is the drive to leverage new and innovative tools and technology to further enhance onboarding, screening, due diligence, and assessment processes, ultimately to reduce false positives and focus on identified risks. Teams continue to grapple with the changing sanctions landscape and adapting daily to new amendments in requirements, another area requiring technological advancement to increase efficiency.

The survey results show respondents anticipate an increase in budgets and resources across key risk areas in the future, highlighting a recognition as to the importance of financial crime risks. Rollout of the use of cloud and other technologies appeared slower but continued budgetary allocation is needed to ensure organizations have the tools and manpower to deliver efficient risk management programs that also meet emerging compliance and regulatory requirements.

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

11

© Copyright Center for Financial Professionals Limited, CeFPro®, 2024. All Rights Reserved.

No part of the Third Party Risk Management publication, or other material associated with CeFPro® or the Third Party Risk Management report, may be reproduced, adapted, stored in a retrieval system or transmitted in any form by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of Center for Financial Professionals Limited, or as trading as the Center for Financial Professionals or CeFPro®.

The facts of the Third Party Risk Management report are believed to be correct at the time of publication but cannot be guaranteed. Please note that the findings, conclusions and recommendations that CeFPro® delivers will be based on information gathered in good faith, whose accuracy we cannot guarantee. CeFPro® acknowledges the guidance and input from the Advisory Board, though all views expressed are those of the Center for Financial Professionals, and CeFPro® accepts no liability whatever for actions taken based on any information that may subsequently prove to be incorrect or errors in our analysis. For further information, contact CeFPro®.

CeFPro®, Fintech Leaders™ and Non-Financial Risk Leaders™ are either Registered or Trade Marks of the Center for Financial Professionals Limited.

Unauthorized use of the Center for Financial Professionals Limited, or CeFPro®, name and trademarks is strictly prohibited and subject to legal penalties.

THE STATE OF FINANCIAL CRIME COMPLIANCE PROGRAMS IN US AND EMEA | 2024

12