Suspicious Transaction Reports (STRs) and collaborative financial intelligence with the FIC

With today’s anti-fincrime scaffolding being complex and involving many parties, the quality of a financial institution’s data can be ‘make or break’ for kickstarting genuine, actionable investigations. For too long, the submission of Suspicious Transaction Reports (STRs) has been an aching, mandatory form-filling requirement not prioritised by banks, who remain conduits for advancingly sophisticated criminals. 

Now however, STRs need to be seen as documents that can lead to widespread enforcement becoming a reality, using rational, evidential financial intelligence. Understanding the STR submission process helps clarify and maintain standardised practice for the crucial reporting aspect of a financial crime prevention framework. Altogether, STR best practice can provide a formidable defense system against organised criminal networks.

The growing role of financial intelligence units

For the information included in any STR to be reviewed and actioned, jurisdictions are prioritising the role of financial intelligence units (FIUs). These are national agencies that act as data centres that analyse and disseminate submitted intelligence reports, with critical insight into money laundering, terrorist financing, and other financial crime. 

The Financial Intelligence Centre (FIC) acts as South Africa’s FIU, to which all accountable institutions (outlined in the FIC Act) must be registered with as a regulatory obligation, and where their STRs must be submitted for enhanced investigation. FIUs can then determine how such data is shared, domestically and internationally, with worldwide units of FIUs increasing collaborative capacity, including the Egmont Group.

The role of goAML for compliance

Maintaining regulatory oversight may be a requirement for South African firms overseen by the Financial Intelligence Centre (FIC) Act, but a traditionally unstructured AML framework has created disparity between those with robust processes and those without. This gap will continue to get knottier given how diverse financial products and services are today, and the breadth of financial and non-financial businesses being made responsible for sharing their efforts into monitoring potential proceeds of crime to the FIC.

In an attempt to curb this disparity with standardised reporting mechanisms is the UNODC-designed goAML function: a secure and integrated electronic tool for streamlining the collection, management and analytics of vital customer and transactional data. The platform is reportedly used by FIUs in over 70 member states and counting, including Kenya, Nigeria, and the United Arab Emirates – providing steps to trace suspicious activity across nations’ regulated industries.

Likewise, the FIC’s primary STR reporting process (run through its AML portal) has since upgraded to goAML software to battle “advance-fee scams” and address customised local reporting requirements to comply with global AML standards. This matters greatly for institutions, granting them a lifeline to demonstrate AML reporting proactivity, even down to identifying unique emergent risks within their regions and customer bases. 

Common STR failures

The value of an STR cannot be understated. Although, a quality STR will be one that is able to provide detailed, contextualised information around a suspicious fund movement. This may involve the entities involved, source of funds, destinations, applications, and why they passed risk thresholds, such as stemming from high-risk jurisdictions or being a transaction behaviour incongruent with usual patterns. 

A poor STR will provide very little useful intelligence, or even none at all, to determine why a transaction has been flagged, and the parties involved. Many STR mistakes include: 

• Vague or missing narratives on a fund flow for targeted investigation.
• Focusing on the transaction itself, and not the ‘full picture’ of risk: the geographies, industries and persons involved.
• Failing to utilise relevant internal data, often housed in siloed systems.
• Poorly configured risk-based AML systems that produce large amounts of false positives, and therefore inaccurate STRs. 
• ‘Defensive’ filings to avoid regulatory repercussions, overwhelming FIUs with large volumes of low-value STRs.

Failing to supply ‘proper’ STRs is a breach of the FIC Act, and can provoke action – billion-dollar fines and restrictions, which result in further reputational damage in the all-important eye of the consumer. These are major contributors to devastating business risk, for Tier 1 banks down to growing fintechs; real-world scandals for poor monitoring and reporting protocols have implicated Danske Bank and led to the downfall of Wirecard in recent years.

Making the shift to simpler reporting

Considering its explainable step-by-step documented framework, goAML can appear simple. However, as with any part of a fluid AML workflow, the tool’s accuracy relies on the quality of the data provided. Namely, an STR report will contain such details as nature or type of suspicious payments; series of transactions; clients and conductors; accounts and entities; and a description of goods or services, if required. 

Swiftly compiling such information relies on tracked and audited transactional data, where manual error and fragmented AML systems makes this nigh-on impossible. Depending on the age of an institution’s onboarding and monitoring tools, as well as their synchronicity and automations, this may cause distinct faults in the real-time, contextualised transactional data required by the FIC for targeted further investigations.

A cultural shift toward a people-and-platform framework is becoming more commonplace through regulatory technology (RegTech) partnerships. By setting up collaborative deployments, the maturity of an institution’s transaction monitoring and reporting capabilities can be assessed, vital systems and data integrated, and industry-specific risk factors accounted for, based on payment types a business facilitates, which jurisdiction they operate in, etc. for STR reporting.

When compliance teams can strategically leverage their AML systems to identify strange behaviours as and when they occur – including ‘smurfed’ small monetary amounts, rapid fund movements and increasing volume from dormant accounts – this shortens the timeline toward STR submission, and increases the likelihood that accurate reports will be impactful on eventual enforcement.

Steps for effective STR submission

Pre-submission

Adopting a centralised system ensures that institutions can be confident before submitting any STR, using the correct necessary information at their fingertips, as follows:

• Ensure customer information is accurate: when risk profiles are only updated periodically according to low- or high-risk, suspicious behaviours may be missed due to incomplete real-time customer information, slowing investigations that matter.
• Provide evidence for suspicion: there must be clear rationale for what constitutes anomalous or unusual transactional activity, to provide the FIC with context around a payment, and to fast-track genuine high-risk behaviour rather than vague statements.
• Compile supporting documentation: relevant risk profiles and adverse media can help clarify given information may be needed, and so should be well organised to retrieve them quickly.

goAML best practices

Poor quality and vague reports can delay regulatory review. Establishing internal workflows, besides the frameworks given by the FIC, ensures that STR submissions become a repeatedly powerful tool within an AML risk management programme:

• Document processes and ‘owners’: creating a structure of who gathers the information (and where), who reviews the information, and who is responsible for submitting STRs contributes to the speed and accuracy of finished reports. 
• Train up staff: all compliance professionals should understand existing and emerging payment threats within their organisation, with regular guidance on how suspicious behaviours evolve, and updates to regulatory shifts.
• Adopt flexible technology: RegTech-assisted AML platforms can integrate onboarding, transaction monitoring, screening and reporting tools to reduce human error, track payments in real-time, and provide a ‘single source of truth’ for all STR reporting credentials.
• Monitor STR trends: beyond single reports, patterns within archived STRs may reveal any systemic vulnerabilities that must be remedied.

Post-submission

Uploading a report to goAML is an initial kick-off, to which the FIC will review in order to request any additional information. While there is no fixed or formalised review timeframe for STRs, prioritisation is based on the level of risk. 

Fast reviews are not guaranteed, but quality data and well-structured and detailed STRs will be actioned faster, as quickly as a few days in urgent cases (such as terrorist financing and large-scale fraud).

Institutions should not rest of their laurels, but be prepared to substantiate any findings if follow-ups occur:

• Centralise submitted STRs: logging all reports categorically improves the ability to locate any information necessary for subsequent data-gathering, particularly for multiple STRs in the review stage.
• Track report progress: institutions can stay updated on their obligations via the goAML Message Board, and structure a cadence for next steps.
• Learn from shortcomings: gaining insights from the FIC creates a feedback loop that helps refine internal risk management controls and resolve any gaps in information.

The more that institutions improve their data for monitoring and submitting detailed financial intelligence over time, the greater the chances of meaningful engagement with the FIC. This helps the STR process to improve continuously and lead to legal enforcements doing more to battle genuine crime.

Gaining the STR advantage

STRs are clearly not just log-lists of potential wrongdoing; instead, they’re the very backbone that underpins collaborative, data-driven AML compliance nationwide, and beyond. Fortunately goAML adoption continues at pace, presenting South Africa’s accountable institutions a clear opportunity to instill excelling STR conduct, so long as their AML systems are up-to-date. 

Auditable data is paramount to one institution’s quality of fincrime reporting; ever-important to being cross-referenced swiftly by the FIC, the FIU that’s helping to establish a more collaborative anti-fincrime ecosystem. RegTech solutions serve to instill intelligence-first compliance around standardised STRs, to prevent organised crime from holding the reins in the digital age, making STRs the game-changer the entire compliance world needs to fight them.

To see how goAML can be embedded into a unified AML workflow – from data capture through to STR submission – explore how it’s being integrated into modern compliance platforms.