EMEA COMPLIANCE SUMMIT 2017 Denise Medea, EMEA AML Discovery Analytics Program, Citi

Mohamed Fathy, AML Targeted Review Officer, Global Investigations Unit, Citi

Citi Academy for Financial Institution Professionals | 4 – 5 April 2017

EMEA AML Discovery Analytics Program

Objectives • Pro-actively, identify, measure, monitor, and control potential

new and emerging AML / TF risks within each business sector.

• Keep Senior Management informed of the levels of new AML /TF risk

• Perform ad-hoc reviews in response to specific events

EMEA AML Discovery Analytics Program

Data Analytics The process of examining raw data with the purpose of drawing conclusions about the information

Data Visualisation The creation and study of visual representation of data

Data Mining The process of data exploration, in search of patterns / relationships (scenarios) between variables

Data Extraction The act or process of removing data out of data sources for further processing, cleaning or storage. Must was coding (SQL) to extract data

ADA Workflow

EMEA AML Discovery Analytics Program

User Interface (UI)

“Front end”

Database

“Back end”

Data Extraction

User Interface Extraction

Advantages Disadvantages

• Easy to access • No coding required • Widely available

• Narrow search facility • Cannot normally search

using a pattern

Database Extraction

Advantages Disadvantages

• Broad search facility • Search by patterns • Less time consuming

• Coding skills needed • Technology teams

must provide the access.

Data Access / Query

Citi Confidential

EMEA AML Discovery Analytics Program

Global Typology on Not For Profit Clients

• This typology focuses on the potential risk of NFP clients who have accounts across the ICG business line in the facilitation of terrorist financing. According to the Financial Action Task force (FATF) report, Not For Profit organizations are at risk of being misused to finance or support terrorist activity or assist money laundering.

• Review the cash, wire and MI transactional activity of NFP clients who have accounts booked in Middle East and Africa countries across ICG business line during the period of November 2015 to October 2016.

Citi Confidential

EMEA AML Discovery Analytics Program

Typology Evolution Classification of customers and accounts into NFP

segments using the North American Industrial Classification codes

Identification of accounts that has demonstrated inconsistency activity using interquartile range analysis*

Filter out the wire transactions and accounts that have transacted with high risk geographies or countries known

to support terrorist activities. *IQR analysis can identify any transactional activity that appears unusual in comparison with the

account’s typical activity

Citi Confidential

EMEA AML Discovery Analytics Program

Typology Evolution

Citi Confidential

For customers that matched the criteria additional steps were used: • Volume and value analysis for each NFP segment • Large cash deposits and withdrawals for each account within each NFP

segment. • Multiple cash deposits in small amounts in an account followed by a large

wire transfer to high risk country • Multiple small amounts to the same counterparty • Intercompany transfers. Particular attention was given to service activities such as housing, social services, education or health care which have been identified by FATF as most vulnerable

Also funds going to and from high risk jurisdictions particularly Kenya.

EMEA AML Discovery Analytics Program

Citi Confidential

447 NFPs

279 NFPs

265 NFPs

245 NFPs

4 NFPs

Identified as having 3,580 accounts based in Middle East & Africa countries

Identified 1,431 accounts that had transactions during the review period

Identified 1,129 accounts as a result of IQR analysis

Identified 851 accounts as a result of filtering out the wire transactions with HRG

Identified four accounts and NFPs for further review by GIU

NFP customer / Account overview

EMEA AML Discovery Analytics Program

Following a transactional review, four accounts and customers were identified for further review for the following reasons:

• NFP 1

• Received intercompany wire transfers of $5M from five different accounts every month and the average time period among the payments was 20 days

• Received an intercompany wire transfer of $6M from two different accounts in two payments one of $5M from XXX and one approximately of $1M from XXX on the same day

• This NFP activity, social services, has been identified by FATF as vulnerable.

NFP 2

• Received a wire payment of $1.38M from XXX and the exact amount was withdrawn 49 days later .

• This NFP activity, social services, has been identified by FATF as vulnerable.

Citi Confidential

EMEA AML Discovery Analytics Program

Continued…….

• NFP 3

• One large cash deposit of $522.8K which is above the average deposit of $47K

• Two large wire payments of $1.15M and $994.4K from XXXX which are above the average of $99K

• This NFP activity, social services, has been identified by FATF as vulnerable.

NFP 4

• 10 cash deposits and 38 cash withdrawals aggregates to $1.28M

• Two cash deposits of $100K and $116.47K, which are above average of $51K

Citi Confidential

TRO Overview Flow Chart

11

External Risk Research

• Identification of ML/TF typologies according to risk event/trends in financial crimes associated with EMEA countries by AML TRO through own research, liaising with AML and Sanctions teams.

Evaluation of Impact

• Communication with technology to conduct initial scoping of potential exposure to risk through Citi’s client base.

Transaction Assessment

• AML TRO uses the intelligence gathered to conduct data mining across specific client parameters to reveal possible unusual behaviours and define review population.

• Despite no risk identified, information will still be stored in a Central Intelligence Repository for possible future relevance.

TRAINING AND COMMUNICATION

AML Discovery Analytics (ADA) refers projects to reveal possible unusual behaviours.

Risk

Monitoring

GIU Complex/multi-jurisdictional

investigation opened

Update/develop new

MANTAS scenarios

AML TRO produces briefings on AML risk

identified and coordinates Citi’s response

for communication with AML, Compliance

and business leads.

Assessment Process

Review Discussion Level 1 Investigation Level 2 Investigation File Manual Case

REFERRAL PROCESS

Require Additional L1 Investigation

Discuss the list of

accounts for

Assessment

TRO

Conduct Level 1

Investigation on list

of accounts for

potential suspicious

activities

GIU Analyst Investigation

GIU

Conduct International Level

2 Investigation on list of

accounts for potential

suspicious activities

Meeting

with

TRO

ADA Review &

Analysis Deck

ADA Review Package

• Targeted Review Deck

• Cust/Acct/Transaction Files

• Statistical Calculations

Extract

suspicious accounts for

Level 2 investigation

s

File SAR

Dispose the

case with no

suspicious

activity

Deep dive investigation to

identify suspicious activity

No

Yes

Recommend

SARs

Schedule meeting

to Review and

share ADA analysis

AML TRO Feedback

1) # of Cases Opened/Closed 2) # of Cases Filed SARs

Four NFP’s recommended for further Review Nigerian NGO: Is an organization dealing with agricultural products in Africa.

Founded in 2006.

No negative news and/or sanctions.

Intercompany transactions raise no concerns.

Concerns:

1. Multiple significant wire transfers to MSB (a subsidiary of another MSB with

allegation of financing Al-Shabab Terrorist Group).

2. Multiple significant payment to companies and individuals that couldn’t be

justified.

Q&A

14

Citi Confidential

All views, opinions and estimates expressed in this communication (the “Communication”) (i) may change without notice, and (ii) may differ from those views, opinions and estimates held or expressed by Citigroup Inc., its subsidiaries and branches thereof worldwide (together “Citi”) or other Citi personnel. This Communication is provided for information and discussion purposes only and does not constitute legal or other advice. Unless otherwise expressly indicated, this Communication does not constitute an offer or recommendation to purchase or sell any financial instruments or other products and does not take into account the investment objectives or financial situation of any particular person. Recipients of this Communication should obtain advice based on their own individual circumstances from their own tax, financial, legal and other advisors before making an investment decision or taking any other action and only make such decisions on the basis of the recipient’s own objectives, experience and resources and on the basis of the recipient’s own tax, financial and legal advice. The information contained in this Communication is based on generally available information and, although obtained from sources believed by Citi to be reliable, its accuracy and completeness cannot be assured, and such information may be incomplete or condensed. It has not been prepared by research analysts, and the information in this communication is not intended to constitute “research” as that term is defined by applicable regulations. Furthermore, the information in it is general, may not reflect recent developments and was not intended and must not be considered or relied on as legal, tax, financial or any other form of advice. Please contact your legal counsel and other advisors if you have any questions or concerns about the matters addressed here. No liability is accepted by Citi for any loss (whether direct, indirect or consequential) that may arise from any use of the information contained in or derived from this Communication. IRS Circular 230 Disclosure: Citi, its employees and its affiliates are not in the business of providing, and do not provide, tax or legal advice to any taxpayer outside of Citi. Any statements in this Communication to tax matters were not intended or written to be used, and cannot be used or relied upon, by any taxpayer for the purpose of avoiding tax penalties. Any such taxpayer should seek advice based on the taxpayer’s particular circumstances from an independent tax advisor. Citi specifically prohibits the redistribution of this Communication in whole or in part without the written permission of Citi and Citi accepts no liability whatsoever for the actions of third parties in this respect. Copyright © 2017 Citigroup Inc. and/or its affiliates. All rights reserved. CITI, CITI and Arc Design, CITIBANK and CITIGROUP are trademarks and service marks of Citigroup Inc. and/or its affiliates and are used and registered throughout the world