How do products, services and delivery channels affect ML/TF risk?

Part of every risk assessment is reviewing the products, services and transactions a firm offers, new and existing, to see how they could be misused for laundering or terrorist financing. Three questions do most of the work.

Transparency: how far does the product let the customer or beneficial owner stay anonymous, or transact with little oversight by the firm? Bearer shares, offshore shell companies, trusts, nominee shareholders and complex structures all reduce transparency. Complexity: does the transaction involve several parties or jurisdictions, or payments from unrelated or unknown third parties, and does the firm fully understand the risk of an innovative product? Value or size: is the product cash-intensive, does it encourage high-value transactions, are there caps on values or premiums, and can large volumes move quickly?

The law's indicative lists point the same way. Potentially higher-risk factors include private banking, products or transactions that may favour anonymity, payments from unknown or unassociated third parties, new products and delivery mechanisms, and transactions related to oil, arms, precious metals, tobacco, cultural artefacts, ivory and protected species. Lower-risk factors include life policies with low premiums, and pension insurance policies with no early surrender option that cannot be used as collateral.

In wealth management, requests for large amounts of cash or precious metals, very high-value transactions, lending secured on assets abroad whose title is hard to confirm, trusts and private investment vehicles that obscure the beneficial owner, and arrangements spread across several countries or providers raise the risk. In investment firms, transactions that are unusually large for the customer's profile, non-standard settlement arrangements, mirror trades, products that make it hard to identify the customer, and third-party payments do the same.

For investment funds, a fund designed for a few individuals or family offices is riskier, as is one that allows quick redemption without significant cost, or whose units can change hands without the fund knowing. Subscriptions involving several jurisdictions or unexpected third-party payers add risk. A fund that bans third-party payments, or is open only to small investors with capped investments, is lower risk. The FATF's securities-sector guidance adds funding from unexpected third parties, penny or microcap stocks, bearer instruments and omnibus accounts that obscure underlying clients.

Delivery channel risk is about how the customer obtains the product: how far the relationship is conducted without the customer being physically present, and whether an introducer or intermediary stands between the firm and the customer. It is not about who the customer is, so a politically exposed person is a customer factor, not a channel factor.

For a customer who is not physically present, the firm asks whether it verified identity remotely in a reliable way, for example through electronic identification with proper safeguards. For a customer introduced by another group entity, it asks how far it can rely on that introduction and whether the group entity applies CDD to EEA standards. For a third-party introducer, the firm must be satisfied that the third party applies CDD and keeps records to EEA standards, is supervised for compliance with comparable obligations, and will provide copies of identification and verification data immediately on request; a third party established in a high-risk third country cannot be relied on, except that the supervisor may allow reliance on branches and majority-owned subsidiaries of EU groups that fully apply group-wide policies. CySEC-supervised firms may rely on third parties only at the start of a relationship. For a tied agent, it asks whether the agent gathers enough information for the firm to know its customer and how involved the agent stays over time. Even when it relies on a third party, the firm remains responsible for CDD.