Written in partnership with

Scandals over recent years have shown that some institutions are still failing to live up to their obligation to minimize the risk of financial crime. In 2020, fines for non-compliance with anti-financial crime (AFC) and related regulations exceeded $14.1 billion. These failures occurred despite many financial institutions spending hundreds of millions to transform their control processes and systems. The persisting and larger problem is not technical but cultural.

Oliver Wyman and the Association of Certified Anti-Money Laundering Specialists (ACAMS) conducted a review of the current state and trends of financial institutions AFC culture based on interviews of a dozen senior executives from both the public and private sector, roundtables of professionals and a survey of nearly 350 professionals.

While our findings confirm that most financial institutions and their senior managers have made clear inroads toward improving AFC compliance over the last decade, the respondents have highlighted a number of key programmatic areas where financial institutions still have limitations hindering the ability to fully embed a robust AFC culture. In particular these items include risk appetite, quality of knowledgeable staff, sizing of technology budget trainings, and incentives.

Most financial institutions have made managing the risk of financial crime a priority over the last decade and invested significantly in addressing this challenge.

As a result, respondents to our survey generally have a favorable view of their organization’s AFC culture. Seventy seven percent agree that their managers, peers, and colleagues lead by example in their behavior, and 73% agree that managers, peers and colleagues would withdraw from a business opportunity due to concerns about financial crime.

Respondents have however highlighted a number of areas for improvement. Only 64% agree that their organization is well equipped to deal with the level of AFC risk it is facing, leaving a further 36% who lack confidence in this. Some areas of particular attention include:

• Financial crime is not explicitly and consistently included in some financial institutions’ risk appetite statements, making it more difficult to factor into strategic decision making about trade-offs between risk and return.
• Although the “tone from the top” has improved, with senior management paying more attention to financial crime, their engagement is too often event-driven rather than strategic. Whilst the survey highlighted that 70% of respondents felt that the tone from the top was clearly communicated by senior management, the participants in our roundtables identified a need to ensure that the message from the top is reinforced by middle management.
• While AFC policies and processes appear clear, and participants feel able to raise concerns and that these will be appropriately dealt with, the consistent global application of these policies is a challenge.
• Discussions with senior AFC professionals implied that the industry may need to do more to incentivize financial crime control. At many organizations, AFC is not yet part of management information or performance management schemes. Only 52% of our survey respondents agree that employees are rewarded for effective implementation of AFC controls which demonstrates there is more work to do for financial institutions in this regard.
• Only 62% agree that there are sufficient skilled and trained personnel for AFC. Financial firms struggle to allocate staff with the proper skills to manage this risk. Only half of respondents believe the AFC training offered by their organization is adequate. And just half believe that training has the required budget allocated to it.
• Only half believe that technology and automation have the required budget.

Some regional differences were apparent in the survey, with European institutions displaying lower confidence than their American peers.

For example, whereas 73% of American respondents believe their institution has a strong “tone from the top”, only 52% of European respondents do. Similar differences are observed in answers in questions pertaining to policies and procedures.

Across the survey questions, senior managers demonstrated a more favourable view of culture than middle managers. There is a similar trend across the lines of defence. Those who identified as the first line of defence had less favourable views on culture than second line staff. This was especially pronounced for questions regarding policies and procedures, which are designed by the second line and used by the first line.

Improving technology (58%) is the highest priority among respondents when asked as to what actions should improve AFC culture.

It can reduce the bureaucratic burden, helping to overcome a tick-box mentality and allowing staff to more genuinely engage with their AFC responsibilities. The regulators we spoke to pointed out that artificial intelligence (AI) and automation could help reduce cost of AFC compliance for financial firms – though it will require investment expenditure, too often compliance is often seen as an “expensive but not always efficient” exercise.

Additional training comes in second place, closely followed by additional resources. Furthermore, an increased AFC budget, reinforced tone from the top and improved feedback loops from law enforcement are also highlighted as key actions. Of the mentioned top six actions, all but two are a direct request for additional budget and resources.

Survey respondents also expect investment across these areas over the next year, more so in technology, and training and resourcing to a lesser extent. There is again a regional difference, with more European and Asian respondents expecting investments than their American peers.

Beyond these investments, regulated entities should embark on systematic programmes to improve their AFC cultures.

The first step is to strengthen the important components of a strong AFC culture, which fall under four broad categories: (1) strategy and risk appetite, (2) tone from the top, (3) accountability and incentives, and (4) training and communication.

Once the target culture is understood, quantitative and qualitative indicators of its various elements should be identified. These can provide the basis of reports on the AFC culture and financial crime risk for senior management and the board. They can also be elements of performance management and incentive schemes for relevant staff. Assessments of the AFC culture should be conducted regularly, with findings translated into actions that will remedy any shortcomings and promote the target culture.