Lessons Learned as a BSA Officer – 1998 to 2018: Presentation to SoCal ACAMS Chapter, March 8, 2019

Lessons Learned as a BSA Officer – 1998 to 2018

“I didn’t say it was your fault, I said I was blaming you” – Winston Churchill

Topics Covered

  1. All the Cooks in the AML Kitchen aka Stakeholders
  2. All the Resources Available to You
  3. The 5 Dimensions of Risk – Up, Down, Across, Out, and Within
  4. FinTech versus Humans
  5. The 7 Cs – What Makes a Good Analyst/Investigator
  6. Tall, Dark and Handsome – Words and Punctuation Matter!
  7. SMEs v SMEs – Subject Matter Experts vs Subject Matter Enthusiasts
  8. Is Transaction Monitoring a Thing of the Past?
  9. The Importance of Courage
  10. Takeaways

All the Cooks in the AML Kitchen – There are more stakeholders than you realize …

To most risk professional, stakeholders are shareholders, directors and senior management, and perhaps regulators. But there are many more than that, and they all have different perspectives, even competing interests, when it comes to how you do your job as a risk professional:

  • Shareholders and Directors
  • Team Members – or employees … as opposed to … Team Mates – those who report to you, who you report to. Where you sit in an organization has a big influence on how you see the organization and your job.
  • Senior Management – however that is defined in your organization, this is the “Top” from where the “Tone” comes from in “Tone from the Top”
  • Middle Management – again, however this is defined in your organization, this is where a lot of tone deaf people reside. A G30 report from a few years ago on financial institutions and risk management referred to middle management as “the Blocking Middle”. We’ve all seen that.
  • Regulators – those you interact with, and who interact with you. I call those “your regulators”, which is different from the Regulators – the people in DC setting policy
  • The Media and Social Media (two very different stakeholders)
  • Physical communities where you operate, and online and virtual communities
  • Your trade associations (such as ACAMS)
  • Customers and Clients
  • Politicians – local, state, federal
  • Law enforcement and Prosecutors – local, state, federal
  • Family, friends … and Yourself

These stakeholders all have their own interests and perspectives. You can balance different perspectives, but you need to juggle competing interests, and even choose one or more stakeholders over others. Good risk management brings these views together as different perspectives, and balances the interests of stakeholders: bad risk management treats them as competing interests, and ignores the interests of stakeholders.

Ask yourself in each situation … which stakeholders’ interests are you preferring over others? How are you communicating with those stakeholders? But realizing you’ve got 20 or more “Cooks in the Kitchen” is helpful as you think about decisions you need to make.

Resources – The classic question: “do you have enough resources to do your job?”

In answering that question, most people start with the number of people they have. In fact, that might be the LAST thing to consider when it comes to all the things that you actually have available to you. The resources you actually have available to you, in order of importance, are:

  1. Relationships – both internal (evidenced by your stature, authority, and independence in the organization, access to senior management and the board, access to junior management in the businesses) and external (with your regulators and law enforcement). A key aspect of relationships is trust – do your regulators trust you? Does senior management trust your judgment when you stop a new business initiative, or do they fight you every step of the way?  Relationships are the critical resource you have, or don’t have. Which takes you to the second most important resource …
  2. Data – does your institution have the necessary customer and transactional and other data necessary for you to run your program? If so …
  3. Technology – does your institution have the ability to keep that data current, and to get it to you? If so …
  4. Tools – do you and your teams have the right tools to use that data? By the way, this is where machine learning and AI come in … without good relationships, great data, and better technology, investing in ML and AI is like buying a high speed train without having the tracks to run it on.
  5. Policies and Procedures – Policies tell what needs to be done, and by whom; procedures tell how it gets done, and by whom. Avoid policedures. And remember the “Dress Appropriately” concept …
  6. Time – time is, arguably, your greatest resource. If you’ve ever had to remediate a program under tight audit or regulatory time constraints, you know what I mean. And this leads us to the last resource you have available to you …
  7. People – the number of people is the LAST consideration you should have when it comes to people. Your first concerns are: (1) are they well led? (2) are they well placed in the organization? (3) are they well “fed” (compensation, benefits, opportunities)? And 4th and finally … Do you have enough of them?

Although People are the last resource to consider, they are your most precious resource!

Managing the Five Dimensions – Our professional lives are all about trying to balance five dimensions

  1. Managing UP – to your boss, senior management, the board
  2. Managing ACROSS – to your peers within your organization, as well as peers across the company
  3. Managing OUT – to your industry peers, trade associations, regulators, prosecutors, media, law enforcement
  4. Managing DOWN – managing your team … but this is more about LEADING your team … and not just your direct reports, but your entire team
  5. Managing WITHIN – managing yourself, your family and personal obligations

So consider all five dimensions, and ask yourself the following questions:

  • Which direction am I best at managing? Why?
  • Which direction am I worst at managing? Why?
  • Which direction do I like the best? Why?
  • Which direction(s) do I dread the most? Why?
  • Which direction(s) do I avoid dealing with? Why?

You’ll probably never be in balance … so find and embrace your equilibrium.

FinTech vs Humans – “A computer lets you make more mistakes faster than any inventions in human history – with the possible exceptions of handguns and tequila.” Mitch Radcliffe (1998)

  • Machine Learning has its place in financial crimes, and has had a place in financial crimes since at least 2010: it’s just that the hype and marketing around it is hitting the mainstream.
  • Artificial Intelligence? I’m not convinced we are there yet. I’ve written on this: see www.regtechconsulting.net/news. In one article I quote Mat Velloso, who tweeted: “If it’s written in Python, it’s probably machine learning: if it’s written in PowerPoint, it’s probably artificial intelligence.”
  • And unless and until FinTech can bring intuition, empathy, judgment, common sense, and courage into the financial crimes environment, us humans will always have the most important role and machines will remain tools, not solutions.

There are no technology solutions. Only tools. Humans behaving well, and with good technology and better data, provide solutions.

What about those humans?

The Seven Cs – What makes a great analyst/investigator

  1. Capable – in anything. It doesn’t have to be financial services. Military veterans are great examples of people that can make great analysts without any financial services background because they are invariably capable people.
  2. Computer Savvy – Yep, it goes without saying. And I’m not talking about “I know how to use Excel” savvy: I’m talking about two computers, three screens, and typing faster than you talk. We all know those people …
  3. Curious – this is one of the big qualities. As I’ve said, I’ve directly or indirectly hired thousands of AML analysts over the years … and was one myself. If there is any attribute that separates a good analyst from a great analyst it is an insatiable curiosity to learn more, turn one more corner, to think differently about a problem.
  4. Creative – this is the trait that allows an analyst to think about what is not in the data that should be, to realize that it is not what is in the case that makes it suspicious, but what is not in the case that should be there that makes it suspicious …
  5. Cynical – you have to be a little cynical to be a great AML analyst. As I mentioned above, where bankers see every new customer as a GREAT customer, only possibly a nuisance, and certainly not a problem, every good AML analyst sees every customer as CERTAINLY a problem, clearly a nuisance … and only possibly a great customer. But that cynicism needs to be balanced by …
  6. Compassionate – You need to be compassionate and caring to take the time to understand different cultures and religions (when banks are open in a country will impact fund flow patterns), how and why different migrant communities live and work (and remit money home to family), what the word “hawala” means, naming conventions from different cultures, etc. And I want analysts who care for their teammates, and have compassion for those that aren’t as fortunate. And last and foremost:
  7. Courageous

An analyst/investigator needs to have all 7 attributes in order to look for, find, and explain (1) what is there that should be there, (2) what is there that shouldn’t be there, (2) what is not there that should not be there, and (4) what is not there that should be there.

Tall, Dark, and Handsome – Words (especially adjectives and adverbs) and punctuation matter!

  1. Write simply and clearly

“We know all too well that drugs are killing record numbers of Americans – and almost all of them come from overseas.”          Former AG Jeff Sessions, August 2018 speech

This is a good example of a poorly written sentence that is begging for clarity. The phrase “almost all” means very little: at least 51% and less than 100%. Second, do “almost all” drugs come from overseas, or do almost all Americans come from overseas? And finally, Mexico is the source country for 90% – 94% of heroin entering the US, and the final transit country for 90% of the cocaine entering the US. Mexico isn’t actually overseas from the US.

  1. Use Adjectives and Adverbs Sparingly, if at all

Most modifiers are unnecessary. Whether necessary or not, as a risk professional you should be very aware of both your use of adjectives and adverbs, and when reading others’ use of adjectives and adverbs. When confronted with any modifier, ask yourself (i) why is that modifier being used? (ii) is it being used correctly? (iii) does it change the meaning of the sentence in a way that is unintended? (iv) is it being used consistently with other modifiers? And (v) could it limit or prevent us in the future?

  1. Watch out for Red Flag Words and Phrases

Intended, Primarily, Pilot, Agile Development, shall versus may, Artificial Intelligence, Machine Learning

SMEs vs SMEs – Subject Matter Experts versus Subject Matter Enthusiasts

The Subject Matter Expert is just that. She has:

  1. talent and training,
  2. subject matter knowledge,
  3. environmental knowledge, and
  4. years of experience (and not just one year of experience many times over, but many years of experience).

The true Expert doesn’t see herself as an expert, will rarely call herself an expert, probably doesn’t see herself as an expert, but she possesses those traits, or enough of them, to truly be, and be seen as, a Subject Matter Expert.

The Subject Matter Enthusiast, on the other hand, often:

  1. calls himself an Expert when he isn’t, or
  2. thinks of himself as possessing enough of as many of the traits needed to pass himself off as an Expert.

The Enthusiast overcomes his lack of true expertise with just enough confidence, hubris, and (frankly) enthusiasm to move a project ahead or design a monitoring system just long enough to allow auditors, regulators, and prosecutors to catch up … and then for the true experts to bail him (and the project or monitoring system) out.

What’s the trick? Understanding where your expertise ends and your enthusiasm begins … understanding who are the experts and who are the enthusiasts, having the right blend of experts and enthusiasts … and taking the best of both, bringing them together, and building a highly effective team.

Is Transaction Monitoring a Thing of the Past? – Customer and Counter-Party Interaction Surveillance is the way of the future

Last year I posted on my website the “AML Scenario Builder” I first put together almost 20 years ago. It still applies today. It includes the eight essential data elements needed to do customer risk assessments and to build a relationship-based interaction monitoring and surveillance system:

  1. Customers/Clients/Others … with or without
  2. Products and Services … doing
  3. Interactions and Transactions … through
  4. Delivery Channels … at
  5. Locations/Geographies … sometimes involving
  6. Amounts … while considering
  7. External Factors … and
  8. Internal History

Twenty years ago we had moved away from Transaction Monitoring. Now, in full disclosure we kept a TM system running, and it spit out alerts that we had to deal with. But it was our least efficient, least effective, and one of the smallest sources of alerts we had at all banks I worked at. If TM hasn’t been dead for 20 years, it’s been on life support.

The Importance of Courage – “Courage is the single attribute upon which all other attributes depend” – Winston Churchill

After the September 2001 terrorist attacks, the 9/11 Commission was set up to look at what happened, and why. In its final report issued in 2004, they concluded that the US government’s failures could be grouped into four major categories: failure of policy, failure of capabilities, failure of management, and failure of imagination. And they concluded that the “most important failure” was a lack of imagination.

I believe that all four of those failures – of policy, of capabilities, of management, and of imagination – have one thing in common. A failure of courage.

What do I mean by courage?

  • Courage to speak freely – but respectfully and fairly
  • Courage to walk away when your principles are compromised
  • Courage to change
  • Courage to listen
  • Courage to compromise


  1. Be aware of all of your stakeholders … particularly your friends and family
  2. Recognize all the resources you have available to you … particularly your people
  3. Appreciate all the directions you’re being pulled in … and try to find an equilibrium that works for you
  4. Technology is important … but people are crucial
  5. Look past CVs and focus on whether someone is compassionate, curious, creative, and courageous
  6. Write carefully … and listen more carefully
  7. Identify and embrace the best of your experts and enthusiasts
  8. Be courageous