News

Recent enforcement actions and national assessments of anti-money laundering efforts point to persistent concerns about potential over-reliance on an old compliance mainstay: third-party audits.

Over the past five years, intergovernmental bodies have identified at least three instances of jurisdictions purportedly leaning too heavily on compliance reviews conducted by outside firms. The critiques have roughly coincided with three New York state settlements in which officials accused consultancies of knowingly whitewashing compliance reviews.

Last month, the Council of Europe’s Moneyval said it remained “very concerned” about Andorra’s almost exclusive reliance on external audit reports to monitor the country’s financial institutions and its failure to further investigate vulnerabilities noted in the reviews, a criticism that the organization first made in a March 2012 mutual evaluation report.

The otherwise positive October assessment came on the heels of the Financial Crimes Enforcement Network’s proposal in March to designate the country’s fourth largest private financial institution, Banca Privada d’Andorra, as a primary money laundering concern under Sec. 311 of the U.S. Patriot Act.

In a mutual evaluation of Liechtenstein published last month, the regional body also cited the jurisdiction’s “over-reliance on external firms to conduct onsite inspections.”

Germany’s anti-money laundering (AML) supervisory regime depends “heavily” on annual external audits by independent accounting firms appointed by bank shareholders, the Financial Action Task Force said in 2010. The group, known as FATF, characterized the quality of some of the audits as questionable, but said onsite visits of high-risk financial institutions mitigated the issue.

Citing a country solely for its delegation of supervisory duties “isn’t a fair criticism,” according to an individual who has conducted national AML assessments for an intergovernmental group.

Groups like FATF should evaluate such arrangements on a case-by-case basis, and consider the scope and depth of the external audit processes from country to country, said the individual, who asked not to be named.

Most countries rely to some extent on private firms as a practical necessity, said Bob Pasley, former assistant director of enforcement at the U.S. Office of the Comptroller of the Currency examiner, and a former AML assessor for the International Monetary Fund.

“But total or near-total reliance is a terrible idea, because how critical can you expect to be when your paycheck is involved,” said Pasley. “Independent audits only work well if the regulator is also periodically examining the bank and checking its findings against the consultant’s,” he said.

That U.S. regulators depend on audits to fulfill their own oversight responsibilities is reflected by their increased willingness to penalize firms for submitting inaccurate reports.

In August 2012, the New York State Department of Financial Services (NYSDFS) reached a $10 million settlement with Deloitte Financial Advisory Services LLP for purportedly doctoring the results of its 2009 compliance work for Standard Chartered Bank.

Two months earlier, international advocacy group Global Witness accused the consultancy Kroll Inc. of improperly vouching for Kyrgyzstan-based Asia Universal Bank’s compliance program over the concerns of Russian officials and the institution’s previous consultant.

NYSDFS last year temporarily banned PricewaterhouseCoopers from securing new business with New York-regulated banks after finding the consultancy scrubbed negative findings from a review of Bank of Tokyo Mitsubishi’s transactions submitted to the agency. The ban came as part of a $25 million settlement with the firm.

In August, Promontory Financial Group agreed to pay the state $15 million to resolve allegations that it too had whitewashed findings on Standard Chartered’s compliance program.

U.S. regulators have also, at times, dismissed or refused to consider the results of third-party audits. A Treasury Department sanction of FBME Bank issued in July dismissed purportedly positive reviews of the Cypriot and Tanzanian lender’s AML program submitted by PricewaterhouseCoopers to the Central Bank of Cyprus.