MAS Publishes Insights on Enterprise-Wide Assessment of ML/TF Risks

The thematic inspections of selected banks were conducted in the first quarter of 2020. The inspected banks generally have established frameworks and processes to conduct the EWRA, in accordance with the requirements set out in MAS Notice 626 and the Guidelines to MAS Notice 626. Robustness of the risk assessment was, however, uneven across the inspected banks. Some banks have established good practices, such as utilizing good quantitative analysis tools to detect ML/TF risks, that the industry can emulate. Others have room to enhance the rigor of management oversight of the risk-assessment processes, the robustness of risk-assessment methodologies, and the effectiveness of risk-assessment implementation. Banks have taken, or are taking, remedial actions to improve their frameworks and processes. MAS will continue to engage financial institutions to promote best practices and maintain high anti-money laundering and countering financing of terrorism (AML/CFT) standards in the industry.

As part of the supervisory expectations, MAS expects the board and senior management of institutions to demonstrate good understanding of the underlying objectives of the EWRA, and set the appropriate tone from the top to instill an appreciation of these objectives among staff. MAS also expects the board and senior management to ensure that the EWRA frameworks and methodologies are sound and implemented effectively to meet the underlying objectives of the EWRA. While the paper is based on MAS’ thematic inspections of banks, the desired outcomes and good practices are relevant and applicable to other types of financial institutions. The paper presents the following desired outcomes based on key observations:

• Banks’ senior management maintain active oversight of EWRA frameworks and processes, including ensuring compliance with the relevant MAS Notices and Guidelines.
• Banks have sound and systematic frameworks and processes to assess inherent risks, control effectiveness, and address residual risks for each business line.
• Banks perform adequate and accurate qualitative and quantitative analyses in assessing risks.
• Banks assess effectiveness of controls, taking into account policies and procedures, control testing results, and insights from the banks’ assessments of their cultures.
• Banks have systematic processes to establish and implement control measures to address areas for improvement identified from the EWRA exercise.
• Banks have structured processes to perform gap analysis against guidance papers and incorporate lessons learned and good industry practices in their own processes.

Keywords: Asia Pacific, Singapore, Banking, ML/TF, AML/CFT, Enterprise Wide Risk Assessment, Operational Risk, Compliance Risk, Governance, Basel, MAS