Credit union executives who skimmed reports about the Federal Trade Commission fining Western Union $586 million for lax fraud prevention procedures and assumed there was no connection to CUs, should think again, according to one expert.
Cindy Williams, vice president at Des Moines, Iowa-based compliance solutions provider PolicyWorks, told Credit Union Journal it is likely there are credit unions that are completely unaware they are even doing business with money services businesses – also known as MSBs – which opens up credit unions to compliance risks.
Williams offered the example of a mom-and-pop grocery down the street. If the store offers money transfer services from Western Union – or any other similar company – and the owner of the store is a business member of a credit union, then the CU would need to follow MSB procedures.
“The concern for credit unions is if they have members that were offering Western Union services,” Williams said. “If so, then regulators might look at them with more scrutiny due to the recent enforcement action. Businesses that offer Western Union money transfers are considered MSBs. If a credit union has one or more MSBs as members, there needs to be a level of monitoring to keep examiners happy.”
The FTC’s action against Western Union was “such a big enforcement action,” she said, “There is a potential for this to roll downhill.”
Earlier this year, documents filed in connection with Western Union’s settlement revealed how certain agents for the global money transmitter enabled extensive fraud and money laundering.
The company, which operates in more than 200 countries, allegedly had lots of information about particular agents who were enabling illicit transactions but did not do enough to weed them out.
“Even when faced with clear evidence that many of its agents were committing fraud, Western Union kept taking people’s money,” the Federal Trade Commission
The Western Union case highlights a couple of important points about the government’s zealous efforts to crack down on money laundering and other illegal uses of the U.S. payment system.
First, the dense web of controls that is designed to thwart criminals and terrorists is only as effective as its weakest links.
Since 2012, Western Union has apparently made significant strides. But before that time, the company appears to have represented a large hole in the anti-money-laundering net.
Second, for all of the recent focus on how digital currencies can be used to move illicit funds, an enormous amount of criminal conduct has been relying on an older, far less fashionable mechanism for moving money.
Western Union was founded in 1851, 14 years after the invention of the telegraph. Today it is a publicly traded firm with more than 500,000 agents across the globe.
Compared with banks and credit unions, where operations are typically tightly controlled, Western Union operates in a decentralized manner. The firm signs contracts with agents, who then enroll subagents, who offer Western Union money transfers at retail locations.
Western Union’s internal reports identified certain locations where large percentages of the transactions — more than 75% in at least one case — involved confirmed fraud, potential fraud or other suspicious activity, according to an FTC complaint filed in January.
The lesson for credit unions, according to Williams, is that they need to establish special monitoring programs, starting with identifying any members that own businesses that are considered an MSB.
“That is where many credit unions are deficient – they don’t even know they have MSBs as members,” she advised.
Regulations for MSBs fall under the Bank Secrecy Act, Williams explained. As such, there are guidelines credit unions could look at to determine if a business is an MSB. Most states follow BSA guidelines, but she warned some have “small tweaks,” so credit unions need to check state regulations concerning MSBs, as well.
‘Expected Activities’
After credit unions have identified MSBs, Williams said the next step is to establish “expected activities” from a business. This is simply asking questions: How many wire transfers do you expect to conduct in a month? How many deposits? How much cash activity do you expect in a month?
“These are not questions that have right or wrong answers, this is just information gathering,” she said.
Credit unions then will need to monitor monthly activity and determine if the reality matches up with the business’ stated expected activity. The last step is monitoring for unusual or suspicious activities.
“There is not an expectation by the regulators that the credit union know what every transfer is for,” she clarified. “The expectation is that the credit union will identify suspicious activity.”
For example: a business opens an account and says it expects $20,000 in wire transfers each month. For the first four months the activity is right around $20,000 each month, but then in month five the amount of transfers jumps to $100,000. At that point, Williams said, the credit union would need to do some investigative work.
“They might look at some reports they have available in their system to see if there are trends as to where the wire transfers are going, or they might simply contact the member and say, ‘We see a big change in your activity. Tell us about that.’ After investigation, the credit union needs to decide if the answers seem appropriate. If so, continue monitoring. If not, then they likely will file a Suspicious Activity Report to FinCEN.”
If the unusual or suspicious activity continues over a period of time, the credit union will have to make a decision about that account, Williams said.
“MSBs are not inherently bad, they just pose a higher risk because there is more monitoring required due to the types of activities they are engaged in.”
Many credit unions have made a decision to not be in the business of serving these types of accounts due to the amount of monitoring needed. Those that do are pricing these services appropriately. “If a credit union is considering getting into this business, it needs to price by the amount of work they will have to do for all that monitoring,” Williams said.
