Editorial & Advertiser Disclosure Global Banking And Finance Review is an independent publisher which offers News, information, Analysis, Opinion, Press Releases, Reviews, Research reports covering various economies, industries, products, services and companies. The content available on globalbankingandfinance.com is sourced by a mixture of different methods which is not limited to content produced and supplied by various staff writers, journalists, freelancers, individuals, organizations, companies, PR agencies Sponsored Posts etc. The information available on this website is purely for educational and informational purposes only. We cannot guarantee the accuracy or applicability of any of the information provided at globalbankingandfinance.com with respect to your individual or personal circumstances. Please seek professional advice from a qualified professional before making any financial decisions. Globalbankingandfinance.com also links to various third party websites and we cannot guarantee the accuracy or applicability of the information provided by third party websites. Links from various articles on our site to third party websites are a mixture of non-sponsored links and sponsored links. Only a very small fraction of the links which point to external websites are affiliate links. Some of the links which you may click on our website may link to various products and services from our partners who may compensate us if you buy a service or product or fill a form or install an app. This will not incur additional cost to you. A very few articles on our website are sponsored posts or paid advertorials. These are marked as sponsored posts at the bottom of each post. For avoidance of any doubts and to make it easier for you to differentiate sponsored or non-sponsored articles or links, you may consider all articles on our site or all links to external websites as sponsored . Please note that some of the services or products which we talk about carry a high level of risk and may not be suitable for everyone. These may be complex services or products and we request the readers to consider this purely from an educational standpoint. The information provided on this website is general in nature. Global Banking & Finance Review expressly disclaims any liability without any limitation which may arise directly or indirectly from the use of such information.

THE CHALLENGES OF MULTIJURISDICTIONAL REGULATORY COMPLIANCE AND ENTITY DATA MANAGEMENT

By Andy Mantzios, VP Client Success, APAC

Fenergo’s Andy Mantzios discusses how the lack of regulatory and data standardization is continuing to cause issues with implementing a best practice approach to compliance. With Asia Pacific, in particular, presenting unique challenges in this area, Andy proposes a number of solutions that can be implemented to overcome these issues.

In an unprecedented recent move, 11 industry associations from across the EU, US and Australia came together to call on regulatory bodies to harmonize derivative reporting requirements across borders and to promote the development, proliferation and adoption of global data standards (click here for more information on this).

For any financial participant engaging in international or global business, the lack of data and regulatory uniformity across markets can be crippling, not only in terms of cost but in their ability to efficiently and fully meet regulatory compliance in accordance with jurisdictional-specific requirements. With many financial institutions struggling to truly understand all of the nuances of regulatory and data requirements in foreign markets, this exposes them to a lot of unnecessary risk and potential of incurring astronomical fines.

As the idea of KYC industry utilities matures, many financial institutions are exploring ways in which they can adopt an internal shared service approach to KYC compliance. One of our clients has recently implemented this model across its international operations – with three core teams providing KYC services across 21 different business units based in different jurisdictions. There is certainly a concerted movement towards this model by a lot of financial institutions given the benefits that can be accrued from it.

Andy Mantzios
Andy Mantzios

However, lack of regulatory and data standardization is continuing to cause issues with implementing such a best practice approach to compliance. The presence of in-country data and privacy restrictions impacts the ability of global financial firms to provide KYC services or share regulatory data across borders. This also poses problems for compliance with regulatory obligations that require the sharing of client and counterparty data such as global OTC derivative reforms, the Foreign Account Tax Compliance Act (FATCA) and the Common Reporting Standards (CRS). Furthermore, regulations that dictate risk aggregation (e.g. AML 3 in Australia, 4th EU Money Laundering Directive and BCBS 239) will obligate financial institutions to be able to aggregate risk exposure across all relationships, legal entities, accounts, transactions, products, services and jurisdictions – but may well conflict with local data protection laws.

Asia Pacific, in particular, presents unique challenges with respect to local data privacy requirements. There are many reasons for this. In contrast to Europe which has an overarching regulatory framework which must be transposed into local, in-country law, APAC has no super regulatory framework or body to oversee regulatory compliance obligations across different jurisdictions within its region. In APAC, regulators pretty much operate completely independently of each other, with little or no overlap. This, in itself, poses significant problems for financial institutions engaged in cross-border business (e.g. investment banks, capital markets firms, wealth management firms, corporate banks etc.). This lack of uniformity across APAC markets is compounded further by the fact that the regulations are not always available in English.

Moreover, some regulations pre-date modern web-based technology and may specifically dictate that all data must be physically held within the jurisdiction. For this reason, APAC markets may not be able to comply with international regulatory requirements such as FATCA, CRS which are heavily dependent on data sharing obligations.

This is further complicated where the same client can have multiple relationships across different bank entities, especially when it comes to identifying and ensuring compliance with all associated relationships to an entity (e.g. directors, shareholders, beneficial owners, who may be based in restricted jurisdictions).

Unfortunately, until regulatory and data harmonization takes place (and we all know that moves at a glacial pace), there really is no silver bullet to overcoming these multijurisdictional data challenges. However, there are a number of potential solutions that may be tried in tandem to at least alleviate the issues associated with them.

Data masking or operating a federated data model

This involves de-identifying sensitive data in-country and using the aggregate of this data as a measure of risk exposure for international risk measurement. While this strategy enables financial institutions to legally comply with in-country specific regulatory rules around data privacy and achieve a rolled-up view of the risk measurement, caution should be exercised. The presence of masked data may indicate a level of secrecy, which may prompt data to be sourced elsewhere. Related to this is the opportunity for tactical storage of some data (not all). For example, generic KYC results (high, medium or low) that do not identify individuals or entities but provide an aggregate view of each category of risk as it is presented to the financial institution.

Technologies that promote jurisdiction-based entitlements

Financial institutions can safeguard themselves by using onboarding and compliance technologies that only provide users with particular entitlements to access particular information. For example, a user in the US office of a financial institution will not be able to see details of a client in South Korea due to entitlement permissions.

Store data in a physical location or off-platform

For data that presents cross-border sharing challenges, a simple solution would be to store this data in a physical location or off-platform, ensuring that it cannot be accessed from anyone outside of the immediate jurisdiction.

Capture additional contractual client consents

Financial institutions can also seek to capture additional consents from clients during the new client / product onboarding or KYC compliance review process.

While there are definite baby steps being made to get regulators to work together to standardize requirements (whether compliance or data related), more needs to be done in this area. In the absence of a formal arrangement between APAC-based regulators, it is possible for financial institutions to adopt a more collaborative approach to dealing with the multi-jurisdictional KYC and regulatory issues prevalent in the region. As our own Client Advisory Board has proven, there really is little or no competitive advantage to interpreting and implementing regulations but a lot to be gained to presenting a united regulatory front. Therefore, an informal consensus and common approach in dealing with these matters is prudent.

For more information on Multijurisdictional Data and Regulatory Management, please email [email protected].