Hacker News Reader

Comment by saddlerustle | Hacker News Reader

PayPal compliance is a very different problem to social media moderation. Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so. And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word, so for a consumer service like PayPal the only real option is to block the transaction. In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high.

View on HN

Well completing Know Your Customer checks and audits is sort of their job, isn’t it? They provide a service, saying that they will process payments unless the payment is prohibited by government sanctions. But instead of carrying out actual due diligence, they just block anything remotely related and put the onus and cost of doing their own job on their customers. At least they should have a better process to start proper diligence once a customer complains about overreach of their blacklist, to avoid improperly sanctioning innocent businesses.

What if an arms trader used the name “Tickets Limited”? Would they block all payments mentioning tickets? Surely not, as it would hurt their business, clearly illustrating that their conduct is not at all due to “compliance with mandatory laws and nothing we can do about it” but “we did the math and we feel we can screw you over in this case.”

I suspect there's a false positive rate on some teams's dashboard and it's kept at an acceptable level that won't require raising transaction fees or incurring too many more OFAC fines.

How would they know what transactions were true positives vs false positives? That would require them to know whether a transaction is bad or not, which as we know, is a hard problem

Random sampling, Monte Carlo methods, statistical inference, etc

>saying that they will process payments unless the payment is prohibited by government sanctions

if they say that they will process payments unless prohibited by government sanctions and then do not process payments that is not prohibited I guess they would be getting sued for those payments.

evidently not given the downvotes, but then I don't understand, if their terms of service say we pay out unless the payment would be of type X and then they keep from paying out on payments of type Y they have violated their terms of service and thus would be open to being sued.

PayPal can pretty much always refuse to process any given transaction. They are not keeping anyone’s money, they are just refusing to accept a transaction request. There’s no money to “pay out.”

Of course, that makes sense, reading the parent comment I thought it implied that they were letting some money in and not letting it back out. In fact I could swear I've read about PayPal doing that - letting money in, not letting it out.

PayPal DOES do that frequently, mostly if you trigger some risk threshold on your account. But, then again, so do regular credit card processors.

>They are not keeping anyone’s money, they are just refusing to accept a transaction request.

Wrong. Assets under U.S. jurisdiction that are owned by or being transferred to persons or organizations on the Specially Designated Nationals and Blocked Persons List must be frozen. Furthermore, the Department of Treasury has a right to seize these funds without due process.

Please read the article. These are people trying to buy tardigrade-themed items from an online store. PayPal is not taking and then freezing their funds, they are just refusing to process the transaction.

Yes they would, the fines are up to 250,000 per incident. If you share a name with someone on the AML list, good luck opening up a financial account anywhere and if you do manage to get an account, being able to fund the account from another source.

You're not comparing like with like there. If you share a name with a suspicious group, yes, that's a hard problem to solve. That's not this. This is a _product_ with the same name as a suspicious group. It's categorically irrelevant.

It doesn't matter. The searches are based on the same methodology. Scanning fields for the banned entity or individual. Also if you spell it phonetically, it should get blocked as well. Even if you can raise to the compliance officer, they aren't going to change it. There's are also criminal penalties that enforce AML.

No, aggressive filtering is the rational move here. The risks are highly asymmetric. A false positive gets you a frustrated customer that, as in this case, you can work with to modify the product description. Annoying.

A false negative can get you a fi ne of $250,000 and criminal penalties.

This isn't an issue of ( or not just an issue of) "not solving scale". Even if filtering issues if this sort were 99.9999% solved the risk asymmetry would still come down on taking an abundance of caution on nation-state levels of "oh crap" if you miss something.

There is precious little "working" with PayPal. We had an unauthorized transfer of $1000 out of our bank account by PayPal, and they have a completely useless circular IVR, their chat bot is nigh non-functional, and their support documentation is woefully out of date. We ended up detecting the odd activity early enough to redirect the funds before someone (who added an unknown number to the account) did anything with it, but we started a dispute and chargeback just-in-case. Further business being cut off be damned.

I've worked in fintech/self-banking institutions. PayPal is a mockery of the entire industry. The example of the literal worst implementation anyone can think of and which leaves everyone scratching their head at how they manage to get away with running as fast and loose as they do.

Is there any way to access this list so I don't end up naming any product, service or company with something on there?

https://www.treasury.gov/ofac/downloads/sdnlist.pdf

Or you can do searches.

https://sanctionssearch.ofac.treas.gov

You're right but I think you'd perhaps be surprised how international sanctions monitoring works.

Example, I know one of the largest banks in Europe used to have payments they sent to one of their South American branch offices blocked from time to time because their address in Brazil or Argentina or something was on a street called "Avenue de Cuba".

But PayPal specifically isn't under banking laws which is how they cover their ass normally (like if you have money at PayPal and they terminate your account you never get your money , which there are thousands and thousands of cases of PayPal doing which would be illegal for an actuall bank), so banking law has nothing to do with PayPal.

in the EU they are an actual Bank based in Luxembourg.

In the US, the PATRIOT act, and thus KYC laws, apply to money service businesses. This includes PayPal.

This is the kind of thinking that lead to the TSA putting infants, and even a US Senator, on the US no-fly list because their names matched those of "known terrorists."

The Washington concept of NATIONAL SECURITY<tm> is a brain-eating parasite that seemingly renders compliance managers unable to tell the difference between categorically different things, such as US Senators and IRA terrorists, or Serbian companies named Tardigard and products, sold by companies completely unconnected with Serbia, with descriptions that contain the word tardigard.

> seemingly renders compliance managers unable to tell the difference between categorically different things

Because it renders them liable. The whole system will turn against you if you give it an opportunity to nail you for using discretion.

And this happens everywhere in society after a certain size is reached due to the need to hold people accountable without actually being able to fully evaluate who or what is to blame (due to the situation being too complex or not having all the facts/data). But politically, someone(s) has to go down.

Only if there was some sort of cohort of people who would be able to judge actions to see if they are liable.

Perhaps we aren't scaling the judiciary system propley & allowed it to become overly complex so that only a certain subsect of the population can navigate it efficiently and an even smaller portion of that can litigate for others.

For some ideas, see http://www.daviddfriedman.com/Legal%20Systems/LegalSystemsCo...

Perhaps. Maybe if the same cohort of people who practice said laws weren’t incentivized to challenge existing laws and to make more laws there would be more resources to help judge.

Or because a false positive doesn't render them liable, or if it does, the punishment isn't harsh enough.

This would be a more compelling explanation if there seemed to be particularly high levels of holding people accountable.

It seems to me we build big opaque structures that prevent accountability. Your national internet provider rips you off? You'll probably be able to reverse the transaction, but good luck getting any information at all about what happened.

> Because it renders them liable.

Yep.

This is how you tell the difference between financial crime that the authorities don't care about and financial crime they do.

Look for personal liability.

> […] because their names matched those of "known terrorists."

As Bruce Schneier (IIRC) observed: these people are 'too dangerous' to let fly, but not dangerous enough to arrest.

Safe enough for firearms as well:

> In a 2010 report, the Government Accountability Office noted that "Membership in a terrorist organization does not prohibit a person from possessing firearms or explosives under current federal law," and individuals on the No Fly List are not barred from purchasing guns.[25] According to GAO data, between 2004 and 2010, people on terrorism watch lists—including the No Fly List as well as other separate lists—attempted to buy guns and explosives more than 1,400 times, and succeeded 1,321 times (more than 90% of cases).[26]

* https://en.wikipedia.org/wiki/No_Fly_List

Stopping gun rights being taken away from No Fly people is the one time the NRA seems to potentially be of any use

I would think the weirdness is because there are constitutional Due Process requirements to being able to arrest somebody, charge them with a crime, or take away their gun rights. But the Feds can easily lean on the airlines to not let people they don't like board a commercial airliner. That'll maybe make us question a few things.

But then I think another part of the reason is that most of the international terrorist types that were originally expected to be blocked by the No Fly List were generally not in the US, and so not subjects to US Gov charges or even gathering evidence.

Our six month old was on the list. It was a shock when we went to the airport, and they asked that he be taken aside for an interview with a TSA agent. We wrote a letter explaining the situation, and got a letter back acknowledging that our information had been received. They stopped asking 3-4 years later.

That they even requested that a 6 month old be taken aside is absolutely insane

Not only that insanity, but... you need a thing called "ID" these days. ID to fly.

If you can fake ID, and you're on some list, why on Earth would you use the same name? And if you can't fake ID, then it will be linked to, you know, ID numbers, birthdays, and more.

I can't even imagine how "just names" ended up on that list, as a match requirement. How many John Smiths are there?

Very, very strange. I don't get it.

But for regular banks service to private citizens is also compulsory, so they can't just choose the easy path by blocking a transaction based on keyword filters, they must do the intended auditing. So for them there is a balance, for paypal there isn't.

I would say it’s not much different with regular banks in the US, as they can and do refuse service with no recourse if you do something they seem suspicious.

> But for regular banks service to private citizens is also compulsory, [...]

Depends very much on jurisdiction. PayPal is active in many jurisdictions, too.

>But for regular banks service to private citizens is also compulsory

what country is that? AFAIK in the US most businesses can refuse to do business with you for any reason, except a very limited set of reasons related to discrimination[1].

[1] https://en.wikipedia.org/wiki/Protected_group

Better citation is “No Duty to Deal”

https://www.ftc.gov/tips-advice/competition-guidance/guide-a...

Whole EU, per directive 2014/92/EU

> 44) Consumers should be guaranteed access to a range of basic payment services. Services linked to payment accounts with basic features should include the facility to place funds and withdraw cash. Consumers should be able to undertake essential payment transactions such as receiving income or benefits, paying bills or taxes and purchasing goods and services, including via direct debit, credit transfer and the use of a payment card. Such services should allow the purchase of goods and services online and should give consumers the opportunity to initiate payment orders via the credit institution’s online facility, where available. However, a payment account with basic features should not be restricted to online usage as this would create an obstacle for consumers without internet access.

> Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so.

Unfortunately, PayPal's advanced KYC and AML verification process is hilariously incompetent and rigid.

Some months ago, they asked me to provide charity information for my personal account, and subsequently limited my receiving/sending privileges.

Phone calls to them trying to sort this out have always ended up at some call centre in the Philippines, where the agents can only tell their users that the account limitation is "for their safety".

That account of mine is still limited.

They've also limited the personal account of a friend of mine (who was interestingly enough ex-PayPal) before, also asking for charity information.

> And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word

In the US, which is presumably where the sanctions trigger originates (the company is on OFAC's list), a review of a transaction is just that. Even opening an account doesn't require a review of your customer's entire financial history, merely that, for a business account, you understand the nature of your customer's business.

> In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high.

There is, however, good reason to do an actual review and not outright block transactions. The advice PayPal gave its customer, "change the wording on your website to prevent this from happening," is exactly what competant regulatory training tells you not to do. Changing the wording of a transaction to obviate the need for a review is in itself a red flag. PayPal is utterly incompentant.

The only company I’ve ever seen take these requirement seriously is Transferwise. I have a very common last name and similarly common-ish business name and they had to have me say I wasn’t related to a bunch of politicians I’d never heard or nor associated with a bunch of similar companies.

This keyword stuff is no kind of protection for them, especially if their own reps are advising people to just circumvent the list, which itself probably is a TOS violation.

Reply on news.ycombinator.com