Engaging the ASP

Lack of a robust assessment of ASPs prior to engaging the ASPs. In particular:

• several CMIs did not have a formalised approach to assess the suitability and ability of ASPs to perform the required AML/CFT control functions; in some instances, due diligence was ad hoc in nature, with considerations overly geared towards cost considerations or the perceived reputation of the ASPs;
• many CMIs did not have a good understanding of ASPs' actual AML/CFT practices and failed to ensure they were in line with CMI's own policies and procedures and MAS' requirements; and
• lack of attention to contractual terms resulted in significant differences between the actual scope of AML/CFT control functions outsourced to the ASP and the CMI’s intention.

The Board and Senior Management to set the tone in requiring a robust assessment of ASPs as a crucial first step, which includes:

• implementing a formalised approach and a structured process with defined criteria to assess the suitability of ASPs to perform the required AML/CFT control functions (reputation, skill, experience and ability to comply with regulatory requirements and resources to perform the required functions);
• understanding the ASP’s actual AML/CFT practices, and conducting a gap analysis to ensure ASP practices are in line with the CMIs’ own policies and procedures and MAS’ requirements;
• understanding observations from recent audits of ASP's AML/CFT programmes and ensuring the ASP has implemented appropriate rectification measures;
• screening and other due diligence to ensure probity of the ASP;
• ensuring a well-defined outsourcing agreement which:
  • sets out the roles and responsibilities clearly, prescribes performance, operational and controls standards,
  • confers a right to audit the ASP and access relevant records of ASP, and
  • ensures that the ASP implements controls to safeguard customer data; and
• ensuring proper documentation of assessments and approvals are kept, including basis for appointment and the timeframe for re-performance of due diligence

CMIs had no monitoring mechanisms to oversee their ASPs’ implementation of key AML/CFT control functions:

• inadequate regular monitoring: ASPs were not expected to provide regular management reports on execution of key AML/CFT control functions and money laundering and terrorist financing (ML/TF) risk issues, such as status reports on outstanding CDD and periodic reviews;
• no established escalation process: CMIs merely relied on the ad-hoc escalation of issues by ASPs of their own accord, without clearly-defined escalation process for ASPs to surface specific ML/TF issues such as sanctions hits or material changes to ASP's processes;
• CMIs did not conduct regular sample reviews to ensure effective implementation or arrange regular discussions with ASPs to ensure performance and control standards are met; and
• CMIs did not have a formalised approach to conduct regular post-appointment reviews of ASPs.

Board and Senior Management’s involvement to strengthen regular oversight over ASPs and to manage outsourcing risks through a combination of measures, including:

• an active role by the CMI’s AML/CFT compliance officer to ensure outsourced control functions are being performed as intended, and to note and regularly report key control issues to the Board and Senior Management;
• regular monitoring and defined escalation mechanisms to include:
  • defining clear roles and responsibilities,
  • status reports on the implementation of AML/CFT control functions, including status on periodic reviews due to be completed, remediation of any gaps identified, and
  • escalation procedures on significant ML/TF issues, such as persistent delays in obtaining required Customer Due Diligence documents, changes in the ASP’s AML/CFT policies and procedures, and screening hits; and
• regular reviews, and properly documented, with defined metrics and ASP self-assessment questionnaire; quality assurance reviews or periodic on-site visits and timely follow-up with the ASP on agreed remediation actions.