Why banks should not be responsible for KYC and anti-money-laundering

This is a guest post by Tobias Baer.

AML, short for Anti-Money Laundering, refers to rules and practices that prevent people and businesses from disguising illicit funds as legal income. It includes a framework of regulations and procedures to identify, control, and report financial activities associated with money laundering and other unlawful financial practices, including terrorism financing. Businesses and financial institutions must adhere to AML guidelines, which involve monitoring transactions, confirming customer identities, and reporting suspicious activities to regulatory bodies.

First of all, the cost of KYC and AML backfires against the poorest members of society. The operational cost of KYC and AML (often involving significant manual labor) is no problem for a profitable banking relationship with an affluent customer and therefore generally not even mentioned in public debates of KYC and AML; for the world's poorest half of customers, however, the fixed cost of KYC and AML checks can make any banking product either highly unprofitable or prohibitively costly. Today's KYC and AML requirements therefore directly undermine financial inclusion, a stated goal of most governments: bank accounts and other banking products either are not at all available for the many poor people that don't meet certain minimum volumes that are needed for a bank to break even on its cost, or customers pay horrendous fees, for example for international money transfers.

And to make things worse, for very affluent customers and other highly profitable transactions banks obviously have a strong conflict of interest. When high-profile money laundering scandals reveal that transactions amounting to hundreds of millions of dollars have skirted AML checks, it obviously is not a problem of the economics of the transactions not having allowed for more thorough investigations.

Moreover, some regulations are simply absurd. The absurdity of KYC regulations is well illustrated by the requirements that were faced by the South African subsidiary of a multinational bank that issued fuel cards – credit cards with a tiny limit of less than US$ 50 for the exclusive use in gas stations – to tens of thousands of truck drivers of a corporate customer. The bank's Western European regulator insisted that for each cardholder the bank verifies the residential address through two utility bills. Unknown to posh regulators, most South African truck drivers live either literally on the road or in a slum. Neither place of living comes with the luxury of running water or electricity for which a utility bill could be sent. Asking these customers for a utility bill is as sensible as a billionaire president commissioning a new "public" university that is only accessible by helicopter.

The stricter the regulations, the more often a bank will find the financial risk of an outsized penalty to be larger than the value of a particular transaction or relationship – I know two large banks (each one of the top 4 in their respective Western European market) that illustrate the gravity of the problem well: both have been threatened by the regulator to have their banking license revoked if infringements on KYC regulations were found. As a result, more and more innocent customers will find themselves locked out of the banking system because a bank simply errs on the side of caution. Just read the negative reviews of Revolut on Trustpilot.com to hear the tales of many small businesses who found their entire working capital frozen for weeks on end because Revolut's AML scoring system – a probabilistic estimate – had flagged them as potentially engaging in money laundering.

However, if a bank is charged with hunting down criminals, it not only is executing a quintessentially sovereign function – it also denies citizens the carefully balanced rights of due process. If a citizen directly deals with a government official, there are binding rules and regulations as well as a functioning legal system where you can take the government to court if you believe that you are unfairly or illegally denied freedom (e.g., if you have been arrested without a proper warrant or other valid cause). You also have a right to obtain certain information on your case, as well as the protection from legal restrictions on what you can be asked to provide (e.g., the Miranda rights).

By contrast, if, say, a UK bank suspects a customer to launder money, it is prohibited by law to discuss the matter with the customer (denying thus the customer any possibility to argue his or her innocence), and at any point in time the bank can make use of its contractual right to end the banking relationship even if it is just a matter of convenience.

Lastly, if private sector institutions must execute sovereign duties such as hunting down criminals, they will find themselves in one of two equally disturbing spots: Either they have government-enabled access to such a wealth of information that a customer's privacy is violated, or their efforts to identify criminals are stunted by a lack of information.

AML and jurisdictions

In some jurisdictions, the government grants AML investigators in banks access to a vast network of databases, including government-proprietary databases and a person's detailed transaction data with other banks. You don't want to think about what such an investigator might get up to if he's falling out with a romantic partner or is hired as a spy by a rogue regime.

And where no such access exists, today's KYC and AML checks at times can be outright laughable. Imagine a Western bank scrutinizing utility bills of an individual residing in Asia – how would they make sense of a Chinese electricity bill? The standard process is to have a certified translator conduct the translation into the Western language – however, neither the translator nor the bank has any means or skill to verify that the original utility bill is authentic. Asian banks have developed very deep skills, but only their most specialized staff will be able to identify well-done forgeries, e.g., by detecting tiny inconsistencies in stamps or haptically flagging inauthentic paper.

How could KYC and AML be restructured?

A more sensible approach could combine a greater use of materiality thresholds with a government-led KYC and AML process that allows banks to outsource a large part of the investigative work to a dedicated government service center.

Just as we pragmatically accept that a drug dealer could send $50 in cash in an envelope by the postal service without facing any AML scrutiny (sparing the post office the effort to rip open every single letter and to verify whether my love letters contain any hint at illegal activities), regulations could exempt accounts and transactions with immaterial amounts in order to support financial inclusion and keep transaction cost down for the poorest. As transactions are electronic, it doesn't appear to be particularly difficult to set thresholds at aggregate levels, thus preventing larger transfers from being broken down into a million micropayments to skirt regulations.

At the same time, banks could forward the information they collect for KYC and AML purposes to a specialised government service center. They can even refer customers directly to the center and let customers submit their paperwork there. That center could not only liaise with sister organisations in other jurisdictions but also apply truly best practices, leveraging all government resources. For example, such a center could verify identities using often confidential databases where all passports and ID documents issued by the government are registered. In this case, if a Western European or US bank receives a Chinese electricity bill as proof of address, the center could send the bill (or a picture of it) to the government's embassy (or a KYC service center) in the respective country in order to have a specialised local caseworker verify its authenticity.

I recall a fraud case when I was an intern in a German bank branch – we opened an account for an African customer who had forged a passport by inserting his picture in a stolen passport. Not only did we lack the expertise to detect the doctored picture (and the equipment to make a useful photocopy – the photocopy we filed showed a large black blot instead of the man's face as shown on the passport photo). Nobody even didn’t know that the (African) first name shown in the passport was a female one. Clearly, the German embassy in that country would have been able to spot this crucial inconsistency!

There is, of course, a lot of precedence for such center - most law enforcement and criminal investigations today are run by government units such as the police or specialized investigative units searching for, say, labor, environmental, or fire hazard violations, and organizations such as Interpol allow for intergovernmental cooperation. Even if you buy a gun, the government issues the license and the gun shop only checks if you have a license!

Such a government center would also ensure that every customer is offered the protections of due process. If this is funded by the taxpayer (i.e., by the general budget as opposed to usage fees for specific account openings or transactions), it would greatly improve the economics of banking products aimed at the poorest members of society. Government, know your customer!

Tobias is a consultant and scholar focusing on the intersections of data science, risk management, and psychology. He has over 25 years of global experience in financial services. Tobias is a former McKinsey partner, who built the company's credit risk analytics capabilities. Further, he has pioneered data science in the design of risk management processes. He supports a small number of Fintechs/Start-ups as Senior Advisor. In cooperation with the University of Cambridge, Tobias pursues psychological research. He also writes regularly on risk management (including a book on Algorithmic Bias he published recently).