Assessing'the'exposure'to'risk'and' - PowerPoint PPT Presentation

Assessing'the'exposure'to'risk'and' techniques'to'continually'identify' and'manage'new'risk Kevin&Lindsay Deputy&Head&of&Financial&Crime&Group Authorised2by2the2Prudential2Regulation2Authority2and2regulated2by2the2Financial2Conduct2Authority2and2the2Prudential2Regulation Authority www.smbcgroup.com

Background SMBCE&was&established&in&March&2003&and&is&a&wholly9 SMBC&is&a&top9tier&Japanese&bank,&which&maintains&relationships& owned&subsidiary&of&SMBC.&The&bank&focuses&on& with&over&103,000&companies&in&Japan. corporate&activities&carrying&out&the&majority&of&its& The&history&of&the&Sumitomo&and&Mitsui&companies&date&back activities&in&Europe,&the&Middle&East&and&Africa. more&than&four&centuries,&and&both&were&founded&as&banks&in&the nineteenth&century. SMBC’s&predecessor&banks,&Mitsui&Bank&was&founded&in&July&1876& Ownership in&Tokyo,&and&Sumitomo&Bank&in&1895&in&Osaka. SMBC0100%0(UK0incorporated0subsidiary0of0SMBC) SMBC&was&established&in&2001&following&the&merger&of&the&two Head4office leading&banks:&Sakura,&formerly&Mitsui&Taiyo&Kobe;&and&Sumitomo. 990Queen0Victoria0Street,0London,0EC4V04EH,0United0 Kingdom Head4office Number4of4employees 1O2,0Marunouchi01Ochome,0ChiyodaOku,0Tokyo,0Japan 990 Number4of4employees Network 29,283 60branches:0Paris,0Milan,0Amsterdam,0Dublin,0Prague0 and0Madrid0 Network 4400domestic0branches0(Japan)0 (excluding0subObranches0and0agencies)0 180overseas0branches0 (excluding0subObranches0and0representative0offices) 2 www.smbcgroup.com

Documenting,&,Demonstrating,Controls,that,Mitigate,Risk Firstly1we1need1to1identify1and1categorise1where1our1fraud1risks1lie: External,Fraud, External1fraud1is1unauthorised1activity1by1a1Third1Party1from1outside1of1the1Bank.1Without1effective1systems1and1 controls,1the1Bank1can1be1unknowingly1used1as1a1conduit1for1fraudulent1activity1and/or1become1a1victim. Examples1of1external1fraud1include,1but1are1not1limited1to: ! Fraudulent1or1misrepresented1documents1are1supplied1by1a1Customer1or1Third1PartyD ! Online1systems1are1compromised1by1hacking,1phishing1or1malwareD ! Abuse1of1Bank1products1or1property1by1Customer1or1Third1PartyD ! Customer1is1impersonated1by1a1Third1Party1to1access1funds1or1informationD ! Impersonation1of1the1Bank1to1dupe1Customers1or1Third1PartiesD ! Customer1is1targeted1by1fraudsters1and1instructs1the1Bank1to1pay1away1fundsD1and ! Tax1evasion1and1facilitation1of1tax1evasion. Internal,Fraud, Internal1fraud,1or1fraud1committed1by1Employees1of1the1Bank,1can1have1a1serious1impact1on1both1financial1 standing1and1reputation.1The1types1of1internal1fraud1include,1but1are1not1limited1to: ! Falsifying1expense1claimsD ! Concealment1of1adverse1informationD ! Alteration1or1forging1of1documents1and/or1instructionsD ! Misuse1of1confidential1information1(including1insider1trading)D ! Relationships1with1third1parties1that1are1not1open1and1transparentD ! Theft1(of1cash,1assets1or1information)D1and ! Tax1evasion1and1facilitation1of1tax1evasion. 3 www.smbcgroup.com

Understanding,Where,Risk,Lies,in,a,Dynamic,Environment • Undertake4Risk4Assessments4across4ALL4areas4of4your4organisation. • Understand4delivery4channels44and4risk4of4any4further4channel4development. • Product4development4designing4out4fraud. • Monitoring4transaction4matching4rules4v4activity4– are4the4rules4in4line4with4what4you4are4doing4 have4you4changes44business4strategy4and4has4your4system4kept4up. • Developing4a4IT4security4strategy,4where4are4your4weaknesses?44Threat4analysis. • Conduct4fraud4could4lead4to4fraud,4what4MI4can4be4produced4in4relation4to4staff4behaviours. • Learning4from4others4– fraud4prevention4generally4is4not4a4competitive4issue4and4sharing4best4 practise4and4experiences4to4protect4the4banks4and4the4financial44markets4in4which4we4 operate. • We4do4not4know4everything44I Use4of4external4experts4to4design4out4fraud. 4 www.smbcgroup.com

The$Risk$Drivers$behind$Risk$Factors For-example-if-we-are-looking-at-the-fraud-risk-for-each-customer-– where-would-we-focus-our- attention? 5 www.smbcgroup.com

Mitigating(the(Risk(Factors( How-do-we-mitigate-the-risk-factors-in-a-corporate-relationship? Undertaking-appropriate-due-diligence-that-allows-us-to-focus-on-areas-of-concern-and-identify- potential-“red-flags” Due-diligence-must-add-value-to-our-knowledge-of-the-customer-and-be-of-use-during-the- customer-lifecycle: • Understand-how-the-customer-will-want-to-use-the-products-being-made-available • Understand-the-transactional-activity-to-be-undertaken • What-is-the-jurisdictional-footprint-of-the-customer • Who-are-the-customers-customers 6 www.smbcgroup.com

The$Risk$Drivers$behind$Risk$Factors If.we.were.to.change.our.focus.from.our.customers.to.the.risks.posed.from.an.IT.perspective,. what.key.concerns.may.we.identify: • Phishing.emails.– both.internally.to.our.organisations.and.secondly.to.our.customers • The.ability.to.embed.malware.onto.computers.again.both.internally.to.our.organisations.and. secondly.to.our.customers • The.quality.of.security.security.surrounding.onAline.banking.platforms. But.once.identified.we.can.take.action.to.mitigate.the.risks: • Training.of.staff.surrounding.the.risks.posed.by.opening.external.emails • What.security.points.to.look.for.when.assessing.unusual.email.addresses./.attachments • Embedding.security.screening.to.identify.computers.that.may.be.infected.by.malware.and. more.importantly.ensuring.any.external.computers.cannot.access.our.systems • OnAline.platforms.to.have.multiple.security.features.for.“loggingAon”.combination.of.ID,. Password,.fingerprint.etc. 7 www.smbcgroup.com

Importance,of,and,enterprise,wide,risk,assessment • Document1the1risks1that1you1are1exposed1to1internal1and1externally • Understand1your1areas1of1weakness • Assess1your1controls1objectively • Identify1where1you1have1weak1controls1or1gaps prioritise1your1areas1of1remediation ! it1is1highly1unlikely1that1you1will1ever1be11in1a1position1that1all1weaknesses1will1be1closed ! Response1to1change1in1the1risk1framework1and1environment • Make1use1of1MI1to1identify1changes1in1risk1profile1 • fraud1losses1/1number1trending1from1one1product1to1another ! An1increase1in1internal1fraud1in1one1particular1department ! • Risk1assessments1are1not1a1once1a1year1event1 8 www.smbcgroup.com

Interplay+of+the+First+and+Second+Line • First0line0includes0operations,0front0office0and0HR0– all0pay0a0part • First0line0have0a0key0responsibility0for0the0defence0of0the0risk,0for0example Undertaking0key0checks0when0recruiting ! 4Beyes0controls0within0processing0activities ! Collating0due0diligence0that0supports0the0ongoing0oversight0of0each0customer0 ! relationship0 • Second0line0advise0on0the0risk0and0mitigation0and0assess0the0controls0first0line0put0in0place. • Early0engagement0by0the0front0office Suspicious0activity ! New0product0/0technology0development ! • Training0provided0by0the0second0line • Assisting0the0first0line0to0educate0the0customer0on0the0threats0they0may0face. 9 www.smbcgroup.com

Questions Authorised2by2the2Prudential2Regulation2Authority2and2regulated2by2the2Financial2Conduct2Authority2and2the2Prudential2Regulation Authority www.smbcgroup.com