Week 2 - Overview of RegTech solutions Complete

docx

School

University of New South Wales *

*We aren’t endorsed by this school

Course

8503

Subject

Information Systems

Date

Dec 6, 2023

Type

docx

Pages

Uploaded by LieutenantFreedom12639

Week 2: Overview of RegTech solutions The terms FinTech and RegTech are heard in the financial news almost every day. This week, we delve into the difference between FinTech and RegTech. We will explore some of the different types of RegTech systems in use and, more importantly, understand the case for RegTech. Why do we need a range of costly solutions, compared with solving the problem the old-fashioned way? Anatoly Kirievsky (Adjunct Lecturer) Week 2 Speech (Transcript) In this week, we're actually going to go into what are the different types of RegTech. We'll, from last week we'll look at compliance risk assessment, we'll look at the compliance framework and the different modules, and how different types of solutions help you to address different modules. But now we also come to the fundamental question of why use RegTech? Why not just use your standard approach of thinking about the issue, coming up with the answers, writing it down, and there you go. To answer that question, we have to think about just how complex and large financial institutions have become. A very simple question of how many laws apply to a standalone financial institution, and you'll be surprised to find that we are talking about tens of different laws that apply, and it's not just specific financial services laws. You've got privacy, information security, cybersecurity, occupational health and safety, taxation. The list of obligation continues to grow. The complexity of financial services themselves grow. Gone are the days where you turn up to the bank with your chequebook, and a very formal clerk with a pen and paper writes down your transactions. We now talk about electronic

banking, where there's multiples of channels, tens of products, different ways, international transactions, domestic transactions, different ways to transact. That all adds to complexities. Modern organisations have trillions of transactions, they have multiple laws. They have terabytes of data being generated, and this amount of data simply cannot be assessed, analysed, and understood in any other way, rather than by using systems to bring it to heat. What do we use RegTech for? It is to reduce that complexity to something that can be seen and understood by the person who is ultimately going to be responsible for managing those risks. RegTech once again, is a tool that we're going to learn about, that will help our accountable people to discharge their responsibilities.  Understand the relationship between FinTech and RegTech.  Articulate the need for Reg Tech solutions within finance and banking.  Analyse RegTech infrastructure.  Articulate the use of RegTech in managing compliance risk.  Understand the different types of Regulatory technology systems. Why is RegTech required to manage compliance risk? The role of RegTech in managing compliance risk.

Purpose This section expands on the size and the complexity of the compliance risk management challenge and the need for RegTech to address it. We revisit the compliance framework described in Week 1 and thus position RegTech to assist in creating solutions. Activity instructions Read the following articles and consider the case for RegTech by completing the following activities. The case for RegTech Compliance, as a dedicated stand-alone function, only started to emerge in the early 2000's in preparation for the revised licensing regime under the Financial Services Reform Act, whereby financial service providers were required by 2004 to apply for an Australian Financial Services Licence. Read the following articles. JP Morgan Chase hires 3,000 new staff in its compliance department The US banking group JP Morgan Chase has employed an extra 3,000 staff in its compliance department during 2013 in its latest attempt to prepare the market for the outcome of negotiations over a $770m (£440m) settlement with regulators over the "London Whale" trading incident. US prosecutors have already accused the bank of a cultural breakdown because of the $6bn losses incurred during activities that became known as the London Whale owing to the scale of the trading positions. In a message to all the bank's staff, the chief executive, Jamie Dimon, said: "Adjusting to the new regulatory environment will require an enormous amount of time, effort and resources. We fully intend to follow the letter and spirit of every rule and requirement." Anti-money laundering (AML) laws have also been a focus of the bank which, Dimon, said was "deploying unprecedented resources, dedicating senior managerial time and prioritising efforts to build and maintain an industry-leading AML programme". He said that since 2012 more than 4,000 extra staff had been assigned to control areas such as risk, compliance, legal and finance and that 3,000 of those had been hired this year. An extra $1bn was being spent on controls and 500 "dedicated professionals and several thousand others" were helping the bank submit its regulatory files on capital to US regulators. Staff had undergone 750,000 hours of training on compliance issues. Anti-money laundering (AML) laws have also been a focus of the bank which, Dimon, said was "deploying unprecedented resources, dedicating senior managerial time and prioritising efforts to build and maintain an industry-leading AML programme".

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

He has already announced plans to pull out of risky areas such as student lending origination and most of the physical commodities sales and trading business. The bank is no longer going to sell identity-theft protection and credit insurance to customers and is conducting an in- depth review of the overseas correspondent banking business. Do derivatives make the world safer? After you have completed the reading, respond to the question below. Once you have submitted your response you will be able to view the responses of other students Benefits of RegTech Review three key benefits of RegTech below. Cost-saving As staff and other costs related to compliance continued to spiral, it became necessary to explore automated solutions through technology. Data volume The sheer volume of data is such that it can no longer be analysed manually. Speed A number of the regulatory requirements have short or near-instantaneous decision requirements: terrorism financing alerts need to be reported within 24 hours; certain over-the-counter (OTC) derivative transactions need to be reported to the exchange within 15 min, and to trade repositories within the next business day; market surveillance is expected to be real- time. The key to RegTech is the ability to analyse data and provide information to management. For a large Australian bank, the equation involves thousands of obligations, tens of thousands of staff, millions of customers and billions of dollars of transactions. The question facing management is: are we in compliance with

our obligations? To answer this, you need to digitise your processes, analyse data, identify exceptions, collate results across the enterprise, and distil this into clear management data. In the next lesson, we look at different types of systems and how they interact with each other. Further reading The article below gives an overview of the global RegTech industry with some facts about how much the industry is growing. The Global RegTech Industry Benchmark Report Where is RegTech used in the financial services industry? An overview of different types of RegTech solutions. Purpose In this activity, we review some of the key areas where RegTech is used within the banking and finance industry and discuss what objectives these systems aim to address. Activity instructions Review the areas where RegTech is used in finance and banking and contribute to the forum. RegTech for financial institutions Significant business opportunities for RegTech arise from the trade-off between the need to stay compliant with ever-changing regulations and the need to cut costs to remain profitable. Accordingly, most of RegTech today centres around solutions for regulated financial institutions, helping them comply more efficiently and with greater certainty with regulations

and improve risk management, while cutting costs. While the market is still developing, the following areas of RegTech can be identified: Compliance (Slide 1 of 5) This is a broad area representing a significant part of RegTech today. Examples include solutions to cover:  regulatory inventory management: these systems allow firms to identify the scope of regulatory obligations applicable to them  regulatory change management: these systems create workflows whereby regulatory changes are notified to the firm, relevant changes are identified, analysed for impact, and tracked through to implementation  communication surveillance: systems to track all electronic communications for non- compliance (offensive conduct, unauthorised disclosure, IP theft)  compliance levels and compliance risk, based on the analysis of operational and other data (e.g., employee monitoring, historical email analysis, human behaviour analysis, trade communication analysis)  numerous other topic-specific solutions can be found; e.g., for cybersecurity (phishing tests), shareholder disclosure (complying with rules that require companies to disclosure large shareholdings and changes thereto), automated audits, etc. ML / CTF (Slide 2 of 5) AML/CTF is a very complex area that generates a significant need for RegTech solutions. Some of the applications include:  customer due diligence /know your customer rules (starting from the basic identification of the customer, and expanding this to having an overall profile of the customer based on all available information to identify their normal behaviour, risk level and any exceptional activity)  identification of higher risk clients requiring enhanced due diligence  identification of suspicious transactions (and generating the corresponding reporting) by incorporating a wide range of scenarios  identification of cash movements (and associated reporting)  identification of politically exposed persons  identification of terrorism financing transactions (and associated reporting)

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

 implementation of global, regional and local sanction regimes (such as sanctions related to North Korea, Crimea or Iran). Risk management (Slide 3 of 5) This area focuses on tools to improve the risk management process at financial institutions by bringing efficiencies to the generation of risk data, risk data aggregation, internal risk reporting, automatically identifying and monitoring risks according to internal methodologies or regulatory definitions, and creating alerts and automated actions triggered when pre- determined risk levels are reached. These solutions may rely on advanced data analytics supported by machine learning or other artificial intelligence applications. Some of the solutions in this area include:  consumer lending: systems designed to check that the lending provided to a client does not exceed their capacity  mandate compliance: checking that the traders do not exceed their trading mandates or position limits  collating data on customer responses: for example, whether customer complaints have been addressed within prescribed timeframes. Regulatory reporting (Slide 4 of 5) Regulatory reporting is a crucial area for supervisory agencies and a central element in regulatory compliance. RegTech solutions help automate and integrate regulatory reporting requirements to cut costs, streamline and increase the accuracy and timeliness of reporting, including making real-time reporting possible. The range of regulatory reporting is ever-growing. It includes ad hoc notifications (changes to officeholders, addresses, company details) to breach and incident reporting, to entire suites of reports that financial institutions need to provide:  APRA requires banks to submit regular Economic and Financial Statistics data in a prescribed format according to industry-wide guidance  ASIC requires derivative and OTC data submission based on localised standards

 as mentioned above, ASUTRAC requires suspicious transaction reports, terrorism finance reports, physical cash movements. Transaction monitoring (Slide 5 of 5) This area focuses on conduct-of-business requirements, and solutions offer real-time transaction monitoring and auditing, such as by using distributed ledger technology (DLT), end-to-end integrity validation, anti-fraud and market abuse identification systems, back- office automation (post-transaction settlement, closing procedures), and risk alerts. The most common application is the monitoring of listed market transactions (stocks, derivatives) to identify potential market misconduct. Read The following article gives a good overview of FinTech and RegTech and also covers how RegTech is used and regulatory reporting. FinTech, RegTech and SupTech: What They Mean for Financial Supervision. Toronto Centre, August 2017 This can be found in the reading directory: 1 - FinTech, RegTech and SupTech - What They Mean for Financial Supervision.pdf Discussion activity Describe a regulatory system that you have encountered at your workplace and discuss the advantages and disadvantages of that system. Once you have submitted your post in the forum, respond to two other posts. ******** Holistic enterprise risk management solution One of the systems I have encountered has been the Protecht System which is a complete risk management solution used by our smaller partners. It includes risk assessment, compliance management, Internal audit, KRI’s, incident and action management as well as custom registers. As these are smaller Financial Institutions, the do not typically have the resources or manpower to complete this function on the same scale as large bank. As a result I was impressed by their keen adoption of this RegTech system, as well as how well they integrated it with their existing systems. Advantages:

 As it is an holistic approach, it allowed them to replace many manual processes with this system  Time and money savings  Less risk of non-compliance Disadvantages:  It only covers some of the Regulatory Compliance requirements a FI has  It is only as good as it’s implementation  The more comprehensive the system, the more costly it can be for smaller players. REPLY Maggie I like your point here that it's only as good as the implementation. The platforms I've worked in in the past which would I imagine be quite similar to Protecht, really are just databases which rely on a lot of manual input in terms of the rules and registers and questionnaires for a human to respond to each month, quarter, year, that certain protocols have been followed. So like all databases, as you say, need to be well design and the quality of data going in has to be good. ********* ********* Trend toward "open book" collaboration between regulator and regulated institutes reading through the materials I was quite excited to see the movement toward "open book" collaboration between regulator and regulated institutes, the movement is reflected by access fo regulator to institutes data, real-time access, real time update of regulation change, share common data structure and template, or by dynamic adaptation from institutes (to regulatory change) or from regulator (to the dynamic changes of institutes or market)...; I think this open book approach (distributed ledger) would really encourage institutes with the best concepts / products to succeed REPLY Hi Tan I agree it looks like a good use of blockchain. As part of the activity to reply to 2 posts, are there any disadvantages you can think of? Cheers Kadi REPLY HI Kadi It's difficult to think of, obviously from the institutes perspective, there will be lots of short term disadvantage, one possibility would be the need to truly invest more on innovation and

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

that require upskill and more costly which might hurt profit short-term; In country where there are protection for industries, this might be open up for attack from new entry. It might also allow consumers for the first time to see what have been happening, which might lead to regulatory challenge from community. Let me think about it more. Any idea you can think of?. Tan REPLY I would look at implementation as a source of disadvantage as it will be disruptive during the process as new things tend to be, and that could include an attack from a new entry, as you suggested, if the process has flaws or not tested sufficiently. REPLY Thanks for the discussion Tan and Kadi - a challenge I have is trying to understand what purposes a business would realistically use distributed ledger technology for. ASIC says it has seen DLT used in "foreign exchange remittance payments, securities settlement systems, debt issuance programs and digital identity initiatives". They also say they expect the purposes to grow exponentially over time - but I can't conceptualise what these are. Thinking through other purposes might help in understanding the advantages and disadvantages (and the appropriate regulatory requirements). Thanks, Alex REPLY Hi Alex, That is a great question. Everyone seems to be talking about the immense power of DLT (incl. blockchain), but unless you have a good grasp of what it is and how it can be used, it will simply be a concept that is implemented without being fully understood. I feel like it runs the same risk most RegTech does, of being adopted without a proper understanding, and therefore not reaching its full potential. REPLY Hi Tan, Good pick up. I reckon this would be a great development if this collaboration approach is adopted by both regulators and businesses. I found the concept of SupTech quite interesting, although after reflection, that makes a lot of sense as RegTech would not only be implemented by one side of the regulatory landscape. ********* Compliance risk RegTech of Visa & advantages and disadvantages

Visa’s Compliance Risk is incredibly challenging and complex. It operates in multi- jurisdictional regulatory environments with high volume transactions and has multiple business models with unique risk profiles. For compliance monitoring Visa chose to use a RegTech compliance platform called ComplyAdvantage instead of implementing an in house system that would be difficult to comply with both Visa’s own high internal standards as well as regulators and be able to continue to devote sufficient tech resources to core business. This solidifies earlier discussed challenges of complexity, staff requirement for manual checks, core business and the associated costs also experienced by JP Morgan & monitoring derivatives institutions and their challenges in the high speed/ volume transaction areas financial institutions exist. Disadvantages of compliance Reg-tech:  Time in meetings to provide relevant information to create a tailored compliance system with RegTech.  Complex rigorous security testing to meet the highest standards of compliance data security and governance.  Implementation complexities and their vital success to maintain banking partnerships, and the risk of it disturbing crucial relationships. Advantages:  Tailored solution to meet complex regulatory requirements.  Implement a proper risk-based approach – not in-house pieced together.  Flexibility to screen specific types of scenarios, increasing effectiveness of monitoring- reducing false positive alerts of a less agile system or manual approach previously utilized as part of compliance risk at Visa.  Flexibility to meet different compliance regimes including Basel for international jurisdiction recommendations.  Continually evolve to changing rules.  Frees up team time to make decisions.  Improve reporting and audit trail capabilities.  REPLY hi Kadi, With the recent move from Visa to allow purchase of crypto currency (which has not been regulated), what impact might this has in relation to risk compliance with regulator? specifically AML Permalink Show parent Reply REPLY Sure, but businesses like Visa still have to answer to regulators for their use of crypto to show they are responsible. The use of crypto in Australia for AML/CTF falls with AUSTRAC's regulations. The KYC and transaction monitoring requirements do have to be met by Visa. AUSTRAC has many regulations that cover the crypto dealings in Australia requiring

businesses to document how they collect individuals information, how they identify politically exposed persons, how they respond to discrepancies once found, and more. Visa will have to comply to AUSTRAC, they will have to be able to present a framework of compliance if it came to legal action and RegTech can help. RegTech businesses have AML Systems that have components to help mitigate the compliance risk Visa will face. Like their customer due diligence, transaction monitoring, watch list filtering, and suspicious transaction monitoring, I expect the RegTech system from ComplyAdvantage has included these typologies to help comply with AUSTRAC and reduce the compliance risk Visa has with the inclusion of crypto into their payments chain. There may be thousands of transactions to assess for visa, but they will have to engage a system that produces the documents, reports and requirements of AUSTRAC- despite it being in crypto. ********* Purpose In the previous activity, we looked at key areas where RegTech systems were utilised in finance and banking. Now we review some of the key types of systems that are available and discuss what objectives these systems aim to address. Activity instructions Review the key types of regulatory systems that are available and contribute to the forum. Governance, risk and compliance systems Significant business opportunities for RegTech arise from the trade-off between the need to stay compliant with ever-changing regulations and the need to cut costs to remain profitable. Accordingly, most of RegTech today centres around solutions for regulated financial institutions, helping them comply more efficiently and with greater certainty with regulations and improve risk management, while cutting costs. While the market is still developing, the following areas of RegTech can be identified: Trade surveillance As soon as you have the development of trading activities, the firm is expected to monitor such activity. There are many different types of misconduct in trading. The first surveillance system in Australia was developed at the ASX and was used by ASX to monitor brokers’ trading activities. It was then modified and provided to brokers for their use. Brokers could use the system to monitor the behaviour of their clients. Trade surveillance requires market data and trading data to be surveyed. The system then has an algorithm in place based on pre-set criteria to trigger alerts. The alerts can be real- time, or post-trade (such as alerts generated after the end of the trading day). Communication surveillance

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Communication surveillance is an important component of the compliance framework. Review of internal communication can detect a range of misconduct: trading misconduct, anti-competitive behaviour, and other types of inappropriate behaviour. A large number of recent examples of misconduct (BBSW, FX scandal, Libor) has been proved to a significant degree on a review of communications. Training Training is delivered using a Learning Management System (LMS). A LMS has a front end, to deliver training, as well as a back end. The back end is designed to link to companies internal identity management systems, to facilitate a single sign-on process. This connectivity allows for training to be allocated to staff based on business unit, reporting hierarchy, position, title or level. The completion of training and test results can then be captured (who completed, when, what score, how long it took, how many attempts were made, etc.). Trade surveillance Incident and breach management Incidents and breaches are taking place at any organisation. What distinguishes good organisations is the ability to rectify issues in a timely manner, learn lessons from them, as well as to report on issues in a timely manner to the right management and regulators. An incident management system is typically a firm-wide system designed to alert relevant stakeholders of issues as they arise. The cross-over of incident management with the compliance framework lies in that some of the incidents have regulatory implications (i.e., indicate a particular control is not operating as intended) or may result in a breach. The target system would have the following functionality:  all incidents are filtered, and those with potential regulatory impact are identified  identified incidents are assessed by compliance and classified as either incidents or breaches  if it is a breach, then it is assessed for reportability to regulators (based on regulatory obligations), and any regulatory interactions and reports are captured  all assessed incidents and breaches are linked to risk themes for further use. Regulatory relations

A significant component of managing regulatory risk is the interaction with regulators. A regulatory engagement system would capture a range of different types of interactions. Specifically:  regulatory changes  regulatory announcements  regulatory notices and enquiries  regulatory exams. Thus, we need systems to:  provide a list of current regulatory obligations (ideally with some classification by industry, sector, client type)  provide a process to identify and notify regulatory changes  provide a process to identify other regulatory news (different from actual changes), such as regulatory speeches, announcements, and enforcement decisions. Regulatory obligations lists tell you what currently applies. Regulatory change notifications tell you what you need to consider and update. Regulatory announcements and enforcement outcomes (such as fines) tell you key priority areas for the regulators. For example, if you identify that in the last 12 months ASIC took action against a number of firms for breaches of client monies rules, and identified client monies as a key topic for attention in multiple speeches and forward looking corporate plan this would tell you that the risk associated with client monies obligations has increased. These systems aim to capture the interaction, link it to the relevant risk type, identify any action items (deliverables) arising, and track completion. Anti-money laundering Anti-money laundering systems comprise a number of components, that together help the organisation manage AML risk. These components include:  customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)  transaction Monitoring  watch List Filtering  suspicious Transaction Activity Reporting  currency Transaction Reporting  trade-based Money Laundering. Not all of these are relevant to all financial institutions; however, the majority of financial institutions are required to undertake CDD and EDD, and identify and report suspicious transactions. Discussion activity Describe a regulatory system that you have encountered at your workplace and discuss the advantages and disadvantages of that system. Once you have submitted your post in the forum, respond to two other posts.

Incident and Breach Management software One regulatory system we've used used to track Operational Risks including Risk events, near misses and potential Op Risk events is Cura Software. This type of Incident and Breach management software is used by both frontline staff to capture all 3 types of Risk Events in capture forms, as well as for line 2 and 3 staff to react in a timely manner. This system would be particularly helpful to those who need to decide whether this could have regulatory implications and how to handle it. Some advantages include the ease of use, accessibility, linking directly to risk decision making and customisation. Disadvantages include human error, complexity that comes with its scale and potential integration errors. thx Maggie. in the event it helps with your assingnment research, I've used a platform called Certus in recent years. It would be configured by compliance (and reconfigured over time to correct anything that wasnt logical).. I'd go in there each month, quarter etc and answer my questionnaire. It had gift registers, training registers, policies were stored in there, no doubt a bunch of other stuff I wasn't really tuned into. https://crscertus.com.au/ Regulatory system of transaction monitoring at Swyftx Swyftx Crypto exchange is a brokerage trading business for over 170 cryptocurrencies and has on & off ramps to fiat bank accounts. It has requirements under AUSTRAC for customer identity procedure to be documented & verified before providing services and to monitor & report suspicious transactions. KYC and knowing the customers typical financial transactions helps make Swyftx aware of any suspicious activity and reduces the risk of AML/CTF. RegTech systems like Swyftx’s transaction monitoring system comprises of several components that help manage the customer due diligence and transaction monitoring to keep the exchange running 24/7 and help compliance under AUSTRAC. Minimum customer and verification requirements allow the customer to transact at different levels. The identification required depends on the type of customer and risk posed by the customer. Generally, the larger the transactions of withdrawal, deposit, fiat, or crypto transaction will determine the level of verification that AUSTRAC requires to be documented and monitored. To comply with AUSTRAC Swyftx runs a 24/7 Transaction Monitoring Program that flags transactions that fall outside a customer’s level of KYC. When the monitoring system is flagged, the regulations require to temporarily hold the transaction till the level of KYC complete. Automatically the customer is alerted with a request to complete the required level. .Disadvantages:  Invasive questioning to customer, may think they are being accused of a crime.  Delays customers transactions Advantages:

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

 Provides an exchange service that is free from fraud and bad actors.  Complies with documented AUSTRAC requirements, reporting and procedures.  thx Kadi. in the event it helps with your assingnment research, I've used a platform called Certus in recent years. It would be configured by compliance (and reconfigured over time to correct anything that wasnt logical).. I'd go in there each month, quarter etc and answer my questionnaire. It had gift registers, training registers, policies were stored in there, no doubt a bunch of other stuff I wasn't really tuned into. https://crscertus.com.au/ Fraud prevention in super Link Group is the administrator for a substantial number of large super funds in Australia, at one point they had something in the vicinity of 10 million super accounts under their administration. They provide much of the infrastructure to manage the accounts of so many Australians during both accumulation and draw down phase and they would adopt a whole plethora of regulatory systems in their business. One such system is their fraud detection system to assess data relating to members taking money out of their super account (often during accumulation phase where they are entitled to access some of their super if they are experiencing hardship). This process in run daily at Link and any exceptions investigated immediately. It is a common occurrence for this monitoring to identify potential frauds. At times, the assessment is inaccurate and the withdrawal legitimate. In my experience where a member/customer is approached to confirm this legitimacy, they are comforted rather than inconvenienced. The monitoring doesn't however 100% percent of fraudulent claims, and I have heard on many instances where it's been the sharp observations of a human in the process to detect fraud. I don't doubt that over time the software/systems can be improved through machine learning to become more accurate. Welcome to the end of Week 2 That’s the end of Week 2. We hope you have enjoyed the topics we have covered and have had time to reflect on them. Self-assess At the end of each week, we will ask you to step through a quick self-reflection about your achievement of the weekly learning objectives.

Week 2 - Overview of RegTech solutions Complete

Related Documents