Deutsche Bank's "Glitch" and Lithuania's "Pitch" - a week in AML

In this week's episode we talk about the glitch that was discovered in Deutsche Bank's transaction monitoring system (and a couple of other Deutsche Bank related news stories) as well as Graham's recent visit to Lithuania and their pitch to be a global centre for FinTechs (along with the fallout from the Troika Laundromat and much else).

Transcript

spk_1:   0:10
hello. Welcome to the sixth episode of Season two of Dark Money files, which we shine a light into a murky world. Ray Blake, With Me is my co host friend and business partner, Grand Barrow. Hello, Graham.

spk_0:   0:24
Love us right

spk_1:   0:26
now, I take it That's a somewhat failed reference to your recent trip to Lithuania. Grain.

spk_0:   0:30
It wass and sad to say, Ray, it's one of the few Lithuanian words I can say with any reasonable degree of confidence.

spk_1:   0:37
It's certainly a bit easier than some of the company's we've been talking about lately, but we'll come back to you visit later, if that's okay, because it's been another busy week for new storeys.

spk_0:   0:47
Yes, it has. I believe in some of them are rather interesting, aren't they?

spk_1:   0:51
Very much so. You managed to see than that

spk_0:   0:53
or what? Just in passing. But there were a couple of interesting developments. I think I saw a Deutsche Bank this week.

spk_1:   1:00
There were one relating to their transaction monitoring that particularly called the eye.

spk_0:   1:05
Oh, God Will.

spk_1:   1:07
Well, apparently they've just discovered a couple of water referred to his glitches in one of their transaction monitoring systems, which means that two of the parameters used to look for red flags were incorrectly set.

spk_0:   1:19
Oh, that's not good

spk_1:   1:21
for 10 years.

spk_0:   1:24
Oh, that's really no good, right? Just in case we have listeners who don't work in that part of the business and know you might have about that sounds, do you want to explain what we mean when we talk about transaction punishing and specifically automated transaction monetary?

spk_1:   1:40
Yeah, of course. Andi. It's possible that people interpret this raise differently, but for me, there are two elements that are involved in the oversight of payments, monitoring and screening. Screaming is a real time process, which seeks to identify payments that could be in contravention of global sanctions with the U. N us, you or UK specific or from someone on banks own internal watch list.

spk_0:   2:05
Okay, so these are payments which were they processed, could cause the bank to be in breach of local or international laws or regulations.

spk_1:   2:14
Exactly that transaction monitoring, on the other hand, may well be done in real time or near real time, although lots of banks will still be doing it solely in retrospect, but which also involves looking both of individual payments and at least some level of the history of payments over time to establish patterns of activity that might indicate money laundering, terrorist financing or some other financial crime. So while screening on the one hand is a proactive measure, monitoring on the other is off necessity, more reactive.

spk_0:   2:48
Okay, and we should say that these terms are not applied prescriptive. Lee and others may well use slightly different definitions, but essentially it will be something close to that.

spk_1:   2:59
Yes, so we have screening very much is the preventive control. And then we have transaction monitoring as the detective control after the fact. The news then the Deutscher has mis calibrated two of its parameters for transaction monitoring is a bit worrying,

spk_0:   3:19
Yes, but is it went unidentified for 10 years?

spk_1:   3:22
Exactly. It suggests that they weren't running test files to provide assurance that the system wass working. Probably

spk_0:   3:30
true and once again, right. You want to explain what we mean by running a test file.

spk_1:   3:35
Of course, given the importance of both screaming and monitoring on the fact that it is, at least in the big banks, largely automated, it's considered good practise to run test files through the system on a regular basis to ensure all is working well for screening. This would cover, for example, both perhaps an SD ends or sanctioned individuals and entities by including a predetermined set of such individuals within an overall file of note to ensure that within strictly defined limits, that software correctly identifies those people.

spk_0:   4:08
OK, so you say strictly defined limits, right? What do you mean by that? Exactly?

spk_1:   4:13
Well, grand. There are four possible outcomes of the screening cheque. A true positive, a true negative of false positive under false negative. Let me run briefly through before what I actually mean. So true. Positive means that the system alerts and that it's right to alert because it's found a bad guy. True, negative is where the system doesn't alert, and it's quite right that it doesn't alert because there genuinely is no bad guy President are false. Positive is when the system alerts. But on investigation. There's no bad guy involved, so it shouldn't have shouted on a false negative is possibly the worst of all worlds, which is where the machine doesn't alert you. However, there is actually a bad guy involved, so it ought to have alerted

spk_0:   5:04
on DH in an ideal world, or to get only one your system to churn out True positives and true negatives are buying a result that stays for every client, be the individual or entity that they are definitely, or they are definitely not a paper or on the sanctions list.

spk_1:   5:22
But we don't live in an ideal world grown. So there are likely to be many clients with similar names to others who are Pepes or or who are sanctioned on DH. They will also trigger alerts

spk_0:   5:35
on these are the false positives.

spk_1:   5:37
Exactly. Firms use some form of fuzzy logic to try and minimise these, but has anyone working in this field will know they vastly outnumber the true positives, which makes the whole process quite time consuming and expensive

spk_0:   5:52
Right on DH. False negatives.

spk_1:   5:55
Ah, now that's where the real jeopardy lies. That's where the system says that someone or some entity is not sanctioned and not a pet when actually it is that could well breach international laws or regulations and put the firm in a whole load of trouble.

spk_0:   6:11
Okay, so firms have to err on the side of caution with their fuzzy logic in order to avoid the potential for force. Negatives on Guy should explain, by the way, that by fuzzy logic, we mean the application of one or maybe many algorithms. When you think to cheque, whether a particular word or words falls within a predetermined range of potential variations on by the signs of deterministic outcome yes or no or a probabilistic outcome. It's that, say, 85% likely that they match. So, for example, a first name mochas built Dimitri D I m I T R Y, but to very many common variants are Dimitri de m idea while Dmitry d I am rtr I on I could come up with a lot more from

spk_1:   7:03
Andi. I think listeners will probably spot the Connexion with also correct on their phones, which benefits from exactly the same technology. And he's every bit as fallible.

spk_0:   7:17
Yes, race of the textile upset in my life. Yes,

spk_1:   7:22
I have read some of the crime and you're absolutely right. But yes, this means that the stricter you make your logic. The higher proportion of positives will be true positives. But then the greater the possibility there is of false negatives. The why do you cast your fuzzy logic and more inclusive you make it, the more likely you are to catch everyone, but you're also going to increase your false positives as well, increasing the overall workload. Now that's not Ah boo hoo. You've got to doom. Or when you increase the overall workload, it means that you're way less likely to see the wood for the trees. One of the great hopes from the current huge upsurge in wreck tech companies is the hope that a lot of these false positives Khun be weeded out through artificial intelligence and machine learning

spk_0:   8:16
right on DH. Therefore, I guess the same logic applies to transaction monitoring.

spk_1:   8:22
In essence, yes, the transaction monitoring your looking for patterns of behaviour so perhaps payments above or below particular amounts. Payments of actual specific amounts on brother typology is indicative of the various ways of laundering money. They're often deterministic, based purely on data points, but we are seeing an increase in probabilistic network white monitoring, which seeks to contextualise payments rather than look at them in isolation. Getting all those different settings right is very important in generating good quality of hurts,

spk_0:   8:59
yes, or or indeed, any alerts

spk_1:   9:02
well yes, which is why the Deutsche Bank issue is such astonishing news and why running test files is so important.

spk_0:   9:09
Okay, so they were also in the news, I think, for a couple of other things as well. This week

spk_1:   9:16
they were apparently grown. The New York Times has been made aware of allegations that alerts that the system had generated in relation to both Donald Trump and his son in law, Jared Kushner. We're not action by senior management despite them being escalated. Of course, it's impossible to know the truth of this, at least for the time being. But there was one rather amusing quote provided by the Trump organisation,

spk_0:   9:43
which wass

spk_1:   9:44
on. I'm quoting here. We have no knowledge of any flags transactions with Deutsche Bank, so into which the only response would be, of course you wouldn't. Tipping off is a criminal offence.

spk_0:   9:56
Oh, dear. On the third thing, they really useful

spk_1:   10:01
the announcement that they were going to merge parts of the compliance and I am l functions.

spk_0:   10:05
Okay, whilst I imagine that many of our listeners will know the difference, Do you want to just confirm just what that difference is?

spk_1:   10:13
Of course, compliance is the department that cheques people in the bank of following the rules, and that doesn't just mean the rules around financial crime. It will also include, for example, the conduct rules and the extent to which the bank treats his customers fairly in its advertising, for instance, in how it charges phase and how it deals with complaints. Thie AML function, on the other hand, is dedicated to the bank's prevention and detection of money laundry. It will typically be responsible for setting the systems and rules that compliance. Then cheques are being followed properly.

spk_0:   10:46
Okay, so kind of like a parliament making the rules and then the police enforcing them.

spk_1:   10:51
Well, that's exactly right. Although in reality there's a little bit more to it than that.

spk_0:   10:56
Yeah, Okay, so why would Deutsche her or anyone else come to that want to merge the two functions

spk_1:   11:03
on the basis that it will cut out duplication, save costs and improve controls? It says here

spk_0:   11:09
Okay, they do sound like rather competing to Mae Ana, and I'm really not sure how well that will be received either by the people working in those functions nor indeed made by the regulators around the world who are already very concerned with the slow pace of improvements. Tell me from the bank

spk_1:   11:28
on them or so in a week when their transaction monitoring was identified as being faulty for 10 years and they were alleged to have suppressed alerts which staff believes should

spk_0:   11:36
have been escalated to know they're not the happiest of storeys coming from a bank where I'm going to say some of the nicest people I've ever worked with continue, at least for the time being, to be employed.

spk_1:   11:46
Yes. Here. Should we move on to Lithuania, then?

spk_0:   11:50
Well, yes. Let's. And what a lovely country. And what lovely people. I could not have been made more welcome.

spk_1:   11:58
Just give us a bit of background to your visit.

spk_0:   12:00
Yeah, I was invited by Transparency International in If you, Rayna to attend a two day set of workshops exploring the implications of the troika Laundromat. Given that a substantial number of the count's identified in that scheme were held. Yukio banking deaf you Rayna. And in fact, it was also called the Yukio Weeks.

spk_1:   12:20
Well, who did you meet while you were there?

spk_0:   12:22
Well, on the first morning, I was one of a set of six speakers who were covering a wide range of expertise. 1st 1 up was a guy called Vlad Lavrov, whose own O CC r P who we mentioned often staff reporter reasoning from Ukraine but now faced in Riga. And he gave an overview off the troika Laundromat case.

spk_1:   12:43
Hmm, interesting

spk_0:   12:44
it wass. Each has only had 10 minutes in the morning, so of necessity. These were quite high level overviews, but Husbands International were very keen to initiate a conversation in Lithuania rather than trying to solve all the issues on one day or in one day. So I think that was the right approach

spk_1:   13:01
On day after flat.

spk_0:   13:04
Well, then we heard from the Lithuanian Financial Intelligence Unit. We heard from the head of AML regulation of the Bank of Lithuania. We heard from the deputy Director General of Transparency International in Russia on we heard from the president of the Lithuanian Banking Associate

spk_1:   13:20
and from you?

spk_0:   13:22
Well, yes, and may I think I was there to provide the international context in general, but also to go into a bit more detail around the role of UK entities, which is we know only too well do tend to be central to these laundromats Ski?

spk_1:   13:37
Yes, that's a comprehensive set of speakers.

spk_0:   13:40
Well, it wass on DH. Then in the afternoon, we visited the Lithuanian Baking Association's headquarters and we had a private session with some representatives from a few of the banks in Lithuania, some of whom I know because they told me, are avid listeners to the dark money Falsone. So I need to say a big hello or rather love us to all our listeners in Lithuania

spk_1:   14:04
That's brilliant. On Day two grown

spk_0:   14:07
well, another packed day, Ray, in the morning I kicked off with having the pleasure of being interviewed for a magazine which is not the one probably most people up is the foremost monthly political and business magazine in Lithuania. S. O. I believe that interview will be published in the July issue.

spk_1:   14:25
Oh, what's it to cover?

spk_0:   14:26
There was a look at what exactly the Laundromat schemes are and how they work and howl if you only have fitted in with these schemes.

spk_1:   14:34
Well, I look forward to reading it.

spk_0:   14:37
Oh, good. You might just need a bit of help from Google. Translate.

spk_1:   14:41
Well, I need a bit of help from Google Translate. Most days Graham

spk_0:   14:45
made Teo Yeah, okay, I'm straight. After that I met with a pretty large group of Lithuanian journalists who were keen to understand how better to investigate and report on financial crime storeys

spk_1:   15:00
based on the fold out of troika.

spk_0:   15:02
Yes. I mean, I think as was the case in Denmark with Danske Bank, the Lithuanians are really embarrassed and pretty upset that their country, which they genuinely thought was not a haven for money laundering, got caught up with such a central player in the troika Laundromat Storey. I think they came to see if there are other storeys which now need to be followed up

spk_1:   15:24
on and you were able to help?

spk_0:   15:26
I think so. I'm not going to say too much on their cause. That would rather signal to those from the other side of the fence what our intentions are. But yes, I've promised to provide some hopefully useful tools and information to the Iranian journalist to help kickstart some of those investigations where their local knowledge will be

spk_1:   15:44
processing. So that's Ah, watch this space outcome.

spk_0:   15:49
Yeah, definitely. But then in the afternoon, I spent a very productive couple of hours with the ML and compliance team's at the Bank of Lithuania, who are responsible for supervising all the banks and other financial institutions which operate in Lithuania.

spk_1:   16:03
On what came out of that

spk_0:   16:06
well, I think they found the wider context I was able to bring. And Ray. Much of it is based on a lot of the work you and I have done across the broad range of different banks across a broad range of jurisdictions, extremely helpful. We had a very useful discussion about what information to focus on, to help them better understand where to target their resources Most effectively

spk_1:   16:28
did you get a sense of what is seen as the priorities right now in Lithuania?

spk_0:   16:33
Well, I did many of the countries emerging from a fairly recent post Soviet past. They don't always sit together very comfortably. Go on Well, they're very keen to grow their economies to ensure stability for the population. They want to find a clear identity for themselves, but they also don't want to get a reputation for allowing the wrong people in the business in their country or to use their institutions for criminal intent. I said I think they're very conscious of what's happened in Latvia and you know, the other unfortunate reputation. It's going recently for facilitating money laundering through a few of its banks, but at the same time, it doesn't want to hold back its own economic development.

spk_1:   17:18
I'm any specific areas. It's identified for growth.

spk_0:   17:21
Well, yes, it wants to become a global Finn, Tex. And

spk_1:   17:24
on S O I C That dichotomy you are alluding to a potentially high growth, but not necessarily low risk.

spk_0:   17:33
Well, no. And one well known example is revolution, which has been granted a Lithuanian banking licence rather than just any money licence on DH that's unfortunately attracted a fair bit of negative media lately,

spk_1:   17:47
which, oddly, brings us back to where we started. As one of the issues that revolution has had to deal with was the fact that they reportedly suspended at least part of their transaction screening software due to the alleged prevalence of too many red flags, which, it seems to me, is a little bit like disabling you far along because it keeps going off too often.

spk_0:   18:07
Well, yes, indeed. Good point. So that was the challenge that the Bank of Lithuania which, along with so many others are facing. How do you make your country of friendly and inviting place to do business without compromising the effectiveness of your regulatory regime?

spk_1:   18:27
Absolutely Anything else to mention grown

spk_0:   18:30
Well, you're one more thing. I think the Lithuanians are pretty concerned about the departure or the potential departure of some of the really big Scandinavian banks, which which frankly, dominate the retail banking market. Their dance Karen Handelsbanken are leaving on DH. Nadia has sold its stake in Luminol, which is one of the biggest banks in the region, to Blackstone.

spk_1:   18:52
So that's de risking a country level.

spk_0:   18:54
Yes, and once again it highlights the problems of getting the balance right between effective controls on DH costs. We do need profitable banks with good controls because in their absence, the business Khun well goto smaller, less effective banks with less effective controls. And that's not a great album.

spk_1:   19:14
No, I know from my own experience that getting the right levels of competence and experience in our people, together with good quality systems, is vital for a robust controlled environment. But neither of those things is easy to achieve.

spk_0:   19:31
No, they're not. So hopefully our continued work right with some really exciting wreck. Tech startups will play dividends sooner rather than later.

spk_1:   19:41
I agree. So maybe it's about time we did an episode on technology Grand.

spk_0:   19:47
I think it is right. And frankly, trying to do that in one episode might be a bit ambitious. We've had lots of people get in touch. I know you have, and I have asking for an episode on the block chain in Crypto on you say there's much to talk about in the wreck tech fintech space. So maybe next week we should do with introductory episode to a sequence of the dark money files. Looking to the future of all this extraordinary computing power, access to the house and artificial intelligence, my brain. I'm looking forward to thank you for listening to this not bloody violence. Weigh. If you would like to listen to future episodes, please subscribe through iTunes, Spotify or your normal podcast provider.