Editor’s note: ACAMS published a white paper in partnership with Oliver Wyman, titled A Global Study of AFC Culture: Have We Come Far Enough?1 This article is an excerpt of the white paper which includes reference to the survey conducted on AFC culture.
Scandals in recent years have shown that some institutions are still failing to live up to their obligation to minimize financial crime risk. In 2021, fines for noncompliance with anti-financial crime (AFC) and related regulatory actions totaled $5.4 billion.2 These failures occurred despite many financial institutions (FIs) spending hundreds of millions to transform their control processes and systems. The persisting and large problem is not technical but cultural.
The joint report conducted by Oliver Wyman and ACAMS examined the AFC cultures of financial services organizations globally, drawing on the findings of an online survey conducted from December 2020 to January 2021, two roundtables as well as interviews with industry executives and regulators. Since its publication, ACAMS has continued to meet with FIs to discuss AFC culture. While significant progress has been made across many organizations in embedding AFC controls, accelerating the culture agenda is not yet top of the list, but it should be. Frameworks to determine what “good” looks like for AFC culture, measuring it and benchmarking it are steps organizations are yet to take.
Specifically, AFC culture remains underdeveloped in certain areas. For example, in many organizations financial crime is not explicitly and consistently included in risk appetite statements, making it more difficult to factor into strategic decision-making about trade-offs between risk and return. If cost to serve models do not account for the AFC controls, organizations may be forced to consider de-risking, especially if they remain under-resourced in proportion to the risks they face. If awareness, incentives and training are inadequate, it is easy for front-line staff to think that AFC is someone else’s responsibility. AFC professionals are at times frustrated by institutional culture in which short-term profit continues to dominate.
What Is Meant by AFC Culture?
Culture can be hard to define. In the context of AFC, strategy and risk appetite are included, the tone from the top—both in words and actions from leaders—accountability, actions and incentives as well as training and communication on AFC are part of the culture that drives positive outcomes for financial crime prevention.
Why Does AFC Culture Matter?
- It sets the foundation for an organization to manage and address risk.
- It enables risk-based decision-making and the escalation of issues is severely impacted.
- It can help reduce the amount of financial crime flowing through the system.
- It can help avoid costly fines and remediation programs for organizations.
The State of AFC Culture
Most FIs have prioritized managing the risk of financial crime over the last decade and invested significantly in addressing this challenge. The survey conducted in 2021 showed a favorable view of AFC culture in some respects. Seventy-seven percent agree that their managers, peers and colleagues lead by example in their behavior and 73% agree that managers, peers and colleagues would withdraw from a business opportunity due to concerns about financial crime.
Respondents have highlighted a number of areas for improvement.
- Controls: Sixty-four percent agree that their organization is well equipped to deal with the level of financial crime risk they face, leaving more than a third of respondents without confidence in this area.
- The “tone from the top”: Although it has improved, engagement is too often event-driven rather than strategic.
- Policies and processes: While AFC policies and processes appear clear, the consistent global application of these policies is a challenge.
- Controls: Only 52% of our survey respondents agree that employees are rewarded for the effective implementation of AFC controls.
- Personnel: Only 62% agree that there are sufficiently skilled and trained personnel for AFC. Financial firms struggle to allocate staff with the proper skills to manage this risk.
What Is Needed to Improve Culture?
In recent years, most institutions have invested heavily in their AFC organizations, notably in staff, technology and reorganization. Still, only about half of respondents feel that AFC is sufficiently well resourced in their organization.
Among respondents, 58% consider that improving technology is a top priority when asked what actions would improve AFC culture. Improving technology is the highest priority because it can reduce the bureaucratic burden, help overcome a tick-the-box mentality and allow staff to engage with their AFC responsibilities.
Additional training comes in second place, closely followed by additional resources. Survey respondents also expect investment across these areas over the next year, more so in technology and training.
Building a Strong AFC Culture
Beyond these investments, regulated entities should embark on systematic programs to improve their AFC cultures. The first step is to place significant importance on the components of a strong AFC culture, which fall under the four broad categories below.
- Strategy and risk appetite—In the long run, profitability and social responsibility require revenue generation to be balanced with risk management. To get this balancing act right, firms must define their appetite or tolerance for risk and ensure that they are embedded throughout the organization.
- Tone from the top—Regulators repeatedly point to “tone from the top” as the most important element of a strong AFC culture. While the CEO and senior management must communicate clear and consistent messages about values and behaviors, direct line managers influence employees the most. Managers must also “walk the talk.” Their actions will be a primary driver in a successful culture program.
- Accountability and incentives—Senior managers must be clear about roles and responsibilities for this complex collective task. They must communicate these responsibilities clearly to all employees, who should understand that they will be held accountable for any of their activity that introduces financial crime risks. The performance management system must reinforce communication to achieve a shift in behavior. AFC indicators should feed into objective setting, compensation and recognition.
- Training and communication—Financial firms must give their staff a sense of purpose around AFC by showing them how they can make a difference to their institutions and to society when they detect and deter financial crime. This requires role-specific training and continued communication about the firm’s AFC framework. And it requires staff to feel empowered to deliver the results for which they are accountable.
Organizations can be effective at preventing financial crime by taking action. The following are four steps that can be taken.
Step 1: Define the Target AFC Culture: Translate the elements of a strong AFC culture into concrete specifications of values, risk appetite, roles and responsibilities, training requirements, procedures, and as well as acceptable and unacceptable behavior. Such clarity is important not only for clear communication with staff but for monitoring the culture and incentivizing staff to exemplify it. It is also worth undertaking a cultural assessment upfront (alongside or even before defining the target culture) to get a clear picture of where the organization is today and to select indicators to measure going forward.
Step 2: Develop an AFC Culture Measurement Approach: A set of measures to assess how well the target culture is being achieved should be developed. Indicators should be both quantitative and qualitative. Quantitative measures may include the number of self-identified “AFC events or breaches,” including audit findings and the speed of their resolution, the latter being a sign of the urgency placed on resolving AFC issues. Other measures include internal suspicious activity reports (SARs), escalations and issues raised. Qualitative measures may include feedback from focus groups, AFC roadshows, anonymous surveys of employees regarding their understanding of AFC processes and as well as controls and how effective they believe them to be. Ideally, these indicators should be combined to provide an overall assessment or score for the AFC culture of the organization.
Step 3: Regularly Measure the AFC Culture: Having settled on a set of measures, they must be used to regularly assess the health of the organization’s AFC culture. The results of these assessments should be recorded in clear and concise reports for the board and senior management. An overall assessment of the state of the AFC culture should be combined with more detail on any identified problems and recommended remedies.
Step 4: Act on the Findings: The purpose of measuring the AFC culture is not simply to understand it but to change and improve selected behaviors. Ongoing monitoring of AFC culture should result in an associated action plan with accountable owners and due dates. It is critical that action monitoring and the tracking of actions are embedded into business as usual governance forums, ensuring a regular AFC culture "health check" is carried out.
Conclusion
Developing an effective AFC culture requires structure, rigor, measurement and concerted effort from multiple channels. These efforts aim to prevent financial crime, which are central to the organization’s purpose, reflected in the risk appetite statements and ever-present in day-to-day operations.
Professionals working in an obliged entity should ask:
- What is your organization doing to measure AFC culture?
- Do you have a good barometer of AFC culture in your organization?
- Is there a benchmark your organization has set to assert the effectiveness embedded on your AFC culture?
An organization’s AFC culture will never stand still; it will evolve and be influenced by many internal and external factors. Starting the journey to understand and measure AFC culture is the only holistic way for creating an effective ecosystem to prevent financial crime. Organizations have already recognized the need to move from "technical compliance" to "control effectiveness." We must evolve further to achieve cultural effectiveness where AFC culture is part of the DNA of the organization.
Shilpa Arora, CAMS, senior director, Anti Financial Crime Portfolio Solutions, ACAMS
Ciara Aitchison, senior manager, AFC Solutions, ACAMS
- “Global Financial Institution Penalties on the Decline,” Fenergo, January 6, 2022, https://www.fenergo.com/press-releases/financial-institution-penalties-on-the-decline-in-2021/
