Context
Speech by Sarah Pritchard, FCA Executive Director of Markets, and Executive Director of International, focusing on financial crime controls.
Key points to note
Ms Pritchard discusses some topics about the work of the FCA in responding to threats and poses questions to the audience/readers regarding financial crime controls:
- If you work in the first line of defence, how often do you review the threats and risks to your customers and the controls you have in place to mitigate against those threats?
- Do you ask yourself how your company identifies potential threats to your customers?
- Is there feedback between your customer call centres where they may be reporting potential scams or fraud?
- Are you updating and revisiting your controls in light of these changes in threat? Are you raising customers’ awareness to the risks and how they can spot scams? How do they tell a genuine email from your firm versus a phishing email?
These are important questions to ask because, in doing so, they will ensure that the firm is effective at adapting to changing threats of financial crime. And this is important, because at the heart of this is ‘confidence.’
The speech also touches on sanctions systems, noting that most firms appear over-reliant on their third-party providers, and are not properly making sure their systems are tailored to meet business requirements. While some systems were unable to generate alerts against known names on the sanction’s list issued by OFSI, most firms were able to demonstrate that their systems incorporated some form of fuzzy matching logic that took into account different variables but this was with varying degrees of success in generating alerts. In some other firms systems generated a high percentage of false positives, making the process inefficient and raising the risk of errors.
However some firms demonstrated that they had controls in place to measure the effectiveness of their systems parameters and threshold through sample testing and tuning. These firms had more effective systems and controls – capable of adapting to changing risk. The systems that work are not just plug and play – they are calibrated to the customer base and risk, with regular fine-tuning.
Next actions
None – for information and awareness.