Banks find AML "ineffective", propose access to social media
therage.co
therage.co
To detect crime you need detectives to investigate crimes. The transaction record by itself means nothing because the banks have no way to know what any of the transactions are actually paying for. But if you independently know that someone is buying cocaine or selling state secrets then you don't need their financial records to arrest them.
Digging into anybody's Facebook isn't going to change that because posting about your criminal activities on a public forum is already how dumb criminals get arrested. This is nothing but a data grab by the banks.
The actual crimes this is supposed to prevent aren't all that common, and to the extent that they aren't prosecuted it's largely because the perpetrators have political power -- or are themselves nation states -- not because we don't have enough prosecutors to do it. Especially if we would actually put the drug cartels out of business in the aforementioned way.
We certainly don't need more people in prisons -- largest prison population in the world, how's it working?
You don't need to posting about doing crimes for your FB profile to be useful for risk assessment. Your connections or other posts (e.g. about how some emergency means you're suddenly short of cash) could contribute to an elevated score.
The proposal doesn't go into much detail about how they imagine it will work, but it sounds like they're just saying that a statistical model (based on a larger set of data) would be more useful than a set of rules based on a tiny set of inputs. This seems entirely reasonable.
Here is the relevant paragraph:
Input data for MSA platforms should incorporate not only transactional data, customer static data and internal reference lists, but also other dynamic behavioural customer information where proportionate to the risk (e.g. device ID, IP addresses). Using an RBA, input data may also include data from reputable external, publicly available sources, including information on company structures, Ultimate Beneficial Owners (UBO), and watch lists, as well as complementary sources such as market data and verified customer social media accounts. Finally, FIs should establish robust data governance and quality control frameworks.This sounds more like a way to send desperate people into a death spiral by raising interest rates or denying credit availability right at the worst possible moment than any kind of system that would prevent crime.
> The proposal doesn't go into much detail about how they imagine it will work, but it sounds like they're just saying that a statistical model (based on a larger set of data) would be more useful than a set of rules based on a tiny set of inputs. This seems entirely reasonable.
It's implying they want to invade everyone's privacy to set up a hallucinatory black box that destroys lives at random under the guise of... I'm not even sure what this is supposed to do. It's not going to yield anything that would be useful in a prosecution so it's more like opaque government-facilitated denial of service without due process. Far from reasonable, it's total crap.
That's not what the report is about.
Banks and financial institutions are required to file Suspicious Activity Reports (SARs) and Suspicious Transaction Report (STRs). Filing such a report doesn't stop a transaction from happening.
The report suggests that banks think they could improve the usefulness of these reports and reduce the number of false positives, if they had more freedom to choose the criteria.
It kind of does though, because banks are also not allowed to do business with criminals, so if they suspect you of being engaged in criminal activity -- even if they have no real proof -- guess what they do.
Worse than that, they're prohibited from telling you about the SARs, so you have no way to dispute them if they're inaccurate. It's a Kafkaesque absurdity that should simply be abolished rather than attempting to polish the turd with AI pixie dust.
> The report suggests that banks think they could improve the usefulness of these reports and reduce the number of false positives, if they had more freedom to choose the criteria.
Which is bollocks, but the government keeps pressuring them to do something because the system doesn't work (because banks shouldn't be doing it to begin with), so they're proposing to invade everyone's privacy because they want to do it anyway and this is a convenient excuse.
Putting this burden on banks is a thing pretty unique to the US. Not sure why anyone would be surprised to find out this does not work.
And it infects the rest of us. When our friends and colleagues have jobs swinging pickaxes at our societal expectations and standards of privacy, why do we pretend they're morally neutral in the whole thing?
I think it depends. I never use my smartphone for banking purposes and it doesn't make anything difficult for me at all. But I'm in the US and I know there are other nations where this isn't at all true.
Before throwing stones, I knew it was a mistake going in, but I needed a job desperately and I was thinking I will sabotage them, from the inside.
Imagine my surprise when I realised I don't really need to sabotage them - they're doing it already on their own.
Every 6 months we got mandatory AML trainings - watching a couple of videos and answering some fairly basic questions. Every time, the same videos and the same questions - I had colleagues who simply wrote down the correct answers and completed this in 10 minutes.
I had colleagues who were actively helping (low level) drug dealers - taking their cash, depositing it their own private accounts and then transferring the funds to some other 3rd party (fairly low amounts, under 10k).
BaFin (the German banking supervisory authority) is useless (see Wirecard, Solaris, N26) - I personally made reports about another financial institution - got a boilerplate reply after a year that they'll look into it and nothing since then (this was more than a year ago).
I left the banking and fintech world and will never go back (unless I have a real possibility to sabotage them from the inside).
The cherry on top: I sold my car to a private individual and they paid me cash. We, of course, did a (ADAC) contract and the next day went to my bank (Postbank, part of DB) to deposit the funds (around 15k).
The clerk was on the verge of calling police because I had so much money on me. Even showing her the contract, explaining that I work in DB and I know what the AML regulations are etc made no difference. In the end I had to deposit 9.900 in my account and the rest in my wife's account. (you can't retrieve more than 10k, but there is no restriction on deposits, you just need to show ID)
I suspect access to this information won't be limited to fraud detection but loans, mortgages, etc.
What happens to people like me who don't really use social media as well?
I'm afraid we are building ourselves a tech dystopia, not the bright future that most of us have thought.
Hey, now there's a great use for genAI. If we decline to the point where social media use is basically required, I'd totally just set up an LLM to post made-up stuff automatically for me so I won't have to bother doing it myself.
When you read the actual statement it's reporting on, and ctrl+f "social", you find that it is used exactly once.
> Input data for MSA platforms should incorporate not only transactional data, customer static data and internal reference lists, but also other dynamic behavioural customer information where proportionate to the risk (e.g. device ID, IP addresses). Using an RBA, input data may also include data from reputable external, publicly available sources, including information on company structures, Ultimate Beneficial Owners (UBO), and watch lists, as well as complementary sources such as market data and verified customer social media accounts. Finally, FIs should establish robust data governance and quality control frameworks.
In other words, do a thorough investigation based on all of these inputs. If you're looking at potential money laundering through a business, go to Companies House and learn as much as you can about the business to determine how legit it is. When you're looking a potentially fraudulent customer, look at their digital footprint online, including social media to determine how legit they are.
This is standard practice in banks today. What the statement suggests is that in addition to monitoring individual transactions, banks should periodically monitor customers as well.
The statement doesn't call for "access", nor does it even use the word "access" in the main text. It's simply clickbait, which people reading the headline + comments alone have fallen for.
In 8 years, €800 billion of suspicious transactions flowed through Danske Bank Estonia, which is over 5 x Estonian GDP during that period. Five times!
If this does not set off alarm bells, then checking my little transactions is not going to solve anything. Security theatre.
[1] https://en.wikipedia.org/wiki/Danske_Bank_money_laundering_s...
But the solution isn't to increase the surveillance, that won't make it more effective. It'll just add noise that makes it even less effective.
We should change path and move away from the dystopian nightmare, not towards it.
I know why all this is necessary. London remains the financial capital of the world, and launders a lot of dirty money. Monzo in particular has strict limits on cash withdrawals and deposits, because their accounts are often used in the illicit drug trade.
I have no objection to AML and KYC regulations, but it's absolutely crucial that legitimate people who don't fit the usual patterns - people like recent immigrants - have access to the banking system.
The social media aspect of TFA is attention-grabbing, but I think it's a red herring. The more concerning aspect is the suggestion of AI. To what extent will those algorithms be used, and to what supervision will they be subject?
In the 1980s, my father was an 'Automation Engineer' in a bank. He built an 'artificial intelligence system' for assessing home loan approvals. It was one of those fill-out-a-form-and-we'll-tell-you-how-much-you-can-borrow things that are all over the Internet now - entirely deterministic and transparent.
That's how banking needs to work, at least for individuals. Determinism engenders trust.
Modern AIs, on the other hand, are for algorithms that are too complex to be explained. If you've got those controlling people's access to finance - not just loans, but money they've deposited in their own bank account - we have a serious problem.
'Cash is King' is not a solution. Before my Dad worked at the bank, he worked in the payroll department at a soap company. He had to drive to the factory with the paypackets - one for each employee, containing their wages in cash - each week, and hand them out. That's utterly ridiculous.
ATMs often have fees that the bank will pay for. For example, most ATMs have an upsell at the end to "check your balance" that your bank will pay for. On the other hand, card payments generate a small amount of revenue for the bank. Most payments in the UK are card payments or bank transfers.
I'll have to say you're mistaken. Monzo doesn't have limits on cash withdrawal as an AML control.
It's like having a honeypot of easily found money in your home (barely hidden in a sock drawer, etc) so that a potential thief will be satisfied with the find and not dig deeper.
Stories like this only solidify the power of maintaining a controlled social media presence.
The "Social" in the name is nothing to do with social media.
Slowly slowly catchy monkey.
I'd encourage you to draw your conclusions from the PDF rather than the journalist's interpretation.
> However, the Group believes strongly that the explicit focus on the provision of more highly useful information to relevant government agencies, and feedback from them on the information provided, will yield dividends in the form of more effective measures being taken against criminals and their illicit activity.
So they want to superhighway all of your transactions to your government and then let it judge you without any due process. I don't see how that's any good.
https://en.wikipedia.org/wiki/Social_Credit_System
...but they want it to be controlled by large corporations instead of a government.
Though I'm sure there's no shortage of AI snake-oil vendors who promise banks the world over that they can do it but it "just needs more data to train on, 6 months tops, trust me bro".