Ray Blake from The Dark Money Files comments on the FCA financial crime findings
In FinCrime Dynamics’s recent blog entry “FCA financial crime findings highlight the need for better controls”, you may have read the interesting statistics comparing the number of internal unusual activity reports and externally reported SARs (suspicious activity reports). Employing some rudimentary arithmetical skills, you may have concluded that typically UK reporting firms enjoy a 2:1 ratio of internal to external SARs. So for every two suspicions escalated internally to the MLRO, the MLRO - after investigation - decides that one is genuinely suspicious enough to report to law enforcement.
You might well then have looked at your own firm’s ratio - who wouldn’t? - and gained either reassurance or disquiet in the comparison. In this brief piece, we want to help you put that comparison into context.
The first point to bear in mind is a caveat made by the FCA when reporting these numbers, which is this: “The difference between the volume of SARs reported to the NCA and the volume of SARs reported internally to MLROs varies greatly between firms within the sector and this could be reflective of firms’ differing risk appetites.” Then there is our own caveat, which is that we do not gain insight through the report into how many alerts were raised initially and discounted earlier in the process before becoming internal SARs. So overall we would be quite cautious about attaching too much significance to your variance or compliance with this simple average.
With that said, your own ratio is worth considering, but because your firm has a unique set of financial crime risks, systems and controls, risk appetite and so on, any kind of peer comparison is going to be less useful than justifying your ratio on its own merits. It might be more useful to track changes in the ratio over time and understand what is behind them, or to test a number of hypotheses. So here is a checklist of questions that you can answer:
If our ratio is wide (say >3:1) are we worried that either staff might be too eager to report trivial suspicions, or that our MLRO might conversely be too reluctant to file cases that should be filed?
If our ratio is narrow (say <1.5:1) are we worried that staff might be applying too high a bar to suspicion and not reporting things they should be - or conversely that our MLRO is filing with too little investigation to resolve some suspicions that could be cleared?
How recently have we trained all staff on what sorts of suspicions they should be reporting, when and to whom? Has training had an impact on the numbers of reports?
Which departments are most and fewest reports coming from? Does that reflect where we expect to detect issues? Is that breakdown changing, and if so do we understand why?