Managing Financial Crime Risks in Digital Payments

Image

The emergence of innovative Financial Technology (FinTech) has spearheaded rapid growth in the digital payments sector. In recent years, global payment revenues exceeded valuations of $2.2 trillion, with a steady Compound Annual Growth Rate (CAGR) expected in the next five years.

There is no denying the convenience benefits that the digital transformation of payments has brought consumers and businesses. With the help of mechanisms like digital wallets, bankless cards, and secure real-time transactions, Payment Service Providers (PSPs) have become huge players in a fast-evolving global financial ecosystem.

However, despite these innovations, risks like fraud, money laundering, and terrorism financing still linger. While there may have been a recent decrease in FinTech cybercrime as per UK Finance’s latest report, it is far from a clear road ahead, specifically as far as digital payments are concerned.

Digital payment innovation is not all sunshine and rainbows

While there are plenty of reasons to celebrate innovation in this space, malicious actors still find ways to exploit systems and make it harder for PSPs (and their customers) to uphold Anti-Money Laundering (AML) processes and Combat the Financing of Terrorism (CFT).

Financial cybercrime itself is experiencing an evolution in its own right, with the threat landscape proving harder to navigate for businesses with insufficient controls and poor resilience. As far as finances are concerned, businesses need to remain constantly vigilant about their activities that could potentially expose them to cybercrime, which can manifest at numerous endpoints. Many businesses, for instance, delegate financial administration tasks to free up resources and improve efficiency. Still, if a third party lacks vital cyber awareness, it could put the firm’s assets at risk.

In turn, businesses with poor cyber hygiene are more susceptible to financially motivated attacks, and thus, compliance and public trust quickly become eroded when news of their compromise reaches the public eye.

Assessing the financial crime threat landscape

Underestimating the severity and ‌potential of financial crime is unwise; this type of criminal activity threatens everybody, from end users to intermediaries, financial institutions, and economies worldwide.

The LexisNexis Risk Solutions True Cost of Financial Crime Compliance Report shows that financial companies are shouldering a global compliance cost of $206 billion.

However, assessing the threat landscape involves far more than looking at global costs and addressing security gaps. PSPs are facing a more fragmented regulatory landscape compared to traditional financial institutions like banks. Given the lack of objective, independent regulators in the FinTech space, digital PSPs are more vulnerable to criminals who can easily circumnavigate online terrain.

Banks, for instance, are increasingly expectant for PSPs that operate within their networks to adopt similar AML, CFT, and fraud prevention strategies. PSPs have an advantage given their access to technological infrastructure that avoids banks; however, the somewhat lacking control measures are presenting dire implications for PSPs.

Behind the scenes, malicious actors are similarly using technological advancements to exploit digital payment products and services while masking their criminal activities. Often, they can exploit vulnerabilities and flaws in solutions primarily designed to maintain end-user satisfaction, convenience, and accessibility.

PSPs must constantly assess risks across products, channels, and geographic locations to stay abreast of emerging threats. The negative effects of improper or lax risk management can be profound for their customers.

Top financial crime risks in the digital space

An unavoidable side-effect stemming from the digital payment sector’s growth is the increase in financial criminal activity. One such example includes micro-structuring payments into multiple smaller transfers between accounts (also known as smurfing), to make it less obvious that illegal funds are being laundered. Indicators of micro-transactions are very hard to spot in an industry with such a huge amount of funds transferring across accounts, and with no paper trails to fall back on, illicit funds are harder to trace back to their sources.

Malicious actors may leverage networks of associates (otherwise known as money mules) to transfer illegal funds to and from multiple accounts across borders, often in locations without much banking infrastructure or regulations to detect and combat money laundering.

Another example is the anomaly of methodical digital identity theft, in which financial information stored in a secure cloud platform is exploited through targeted phishing, malware, or ransomware attacks. These can bilaterally cause organizations to face compliance challenges due to their compromise and the subsequent violation of consumer and stakeholder privacy laws. As such, victims may be subject to hefty regulatory fines.

Mobilize and manage financial crime risks in the digital era

Managing financial crime starts from the top down, with businesses applying uniform policies, processes, and strategies bespoke to their infrastructure.

As PSPs consider their approaches to managing financial crime risks, businesses relying on their services should maintain a core focus on the following:

1.   Adapt your Know-Your-Customer (KYC) processes

Companies in the financial sector are no strangers to KYC processes, but it’s clear from the statistics that current policies and procedures aren’t always enough. Organizations should focus efforts on improving the quality of collected data to make more informed decisions about customers’ risk profiles and transaction histories.

Rather than periodically reviewing customers and assigning them arbitrary labels associated with their risk levels, companies should consider switching to real-time monitoring and automation. This will reduce operational overhead costs and improve efficiency, and while human oversight and intervention are still crucial, false positives will be fewer, and better judgment can be cast.

2.   Prioritize strategic outcomes over ‘check-box’ exercises

The current threat landscape shows that criminals continue their malicious activities, and this trend is set to continue. Compliance also continues to be a major concern, particularly for companies that are subject to heavy regulatory scrutiny. Fundamentally, however, both of these issues cannot be overlooked as simply check-box exercises. Fortunately, revitalizing their compliance procedures and risk mitigation strategies can simultaneously address both concerns.

Companies should focus on outcomes rather than outputs, implementing continuous real-time monitoring, threat detection, and vulnerability management solutions as part of their overall risk management strategy. The outcomes obtained can then be leveraged to drive ‌companies’ priorities and efforts for the years ahead and align compliance programs accordingly.

3.   Invest in enterprise-grade AI solutions to outmaneuver cybercriminals

Artificial Intelligence (AI) has paved the way for another wave of technological innovation. It’s also proven to be at the epicenter of many significant cyber attacks on networks and infrastructure this year alone. However, rather than simply accepting their fates and falling behind, companies should seriously consider investing in AI and Machine Learning (ML) technologies, embedding them firmly at the heart of their financial crime prevention and threat detection strategies.

Human oversight is still crucial when deploying this technology, and false positives are still going to slip through the cracks invariably, but the efficacy of financial crime detection will be far more reliable with augmented teams. If fraud prevention professionals are given enterprise-grade AI/ML solutions to assist them, their organizations’ attack surfaces will be noticeably reduced.

While the above guidance should provide inspiration for leaders tasked with addressing emerging cybercrime challenges in digital financial services, we must remember that threats are evolving by the day. Leaders at all levels should proactively assess threats and implement resilient controls, automate processes where possible, and maintain flexibility. Those who can demonstrably and responsibly balance these risks can emerge as trusted pillars in the complex and highly scrutinized digital space.

Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor and do not necessarily reflect those of Tripwire.