Adverse Screening vs Positive Screening

Tim Parkman • June 27, 2025

Friday 27 June 2025

Upon leaving his position as Europol’s Director in 2018, Rob Wainwright said:
 
"We have identified 400 top money launderers who are running billions through the European banking system with a 99% success rate."
 
It's unlikely this has changed in the last seven years. The statement, almost comedic in its frankness given the international effort lavished on AML regulation over the last 35 years, begs a big question; Why is it apparently so easy for them?
 
I’d like to suggest that one reason may be the over-emphasised focus on blacklist, greylist, PEP, adverse media and jurisdictional screening as a supposed means of preventing "bad actors" from entering the financial system. A bit like the allied air-planners during WWII who initially focused on strengthening the most bullet-ridden parts of the planes which returned from missions, before someone pointed out to them that what they should be strengthening was the undamaged sections (see image), because those were the areas which suffered catastrophic damage on the planes which they never saw, because they never returned…
 
Think about it. Say you are a professional launderer for the Russian mob (or whoever). Your clients know where your daughter goes to school, so Rule 1 for you must be that you don't go anywhere near anyone or anything which is going to blink red on a sanctions, PEPs and adverse media screening tool. Likewise, wherever you can, you'll try to avoid having anything to do with the 'high–risk jurisdictions' which are being monitored so closely.
 
So, you're going down the lower risk jurisdiction route and, for greater volume, you'll need to use "legitimate businesses". Next quandary – acquire an existing, genuine business and use it as a front company? Or create something out of nothing and make it look real enough to fool the system? There are pros and cons to both. 


Genuine businesses being used as fronts have no difficulty in providing a footprint of normality because that's what they are – normal, legitimate businesses. Put one or two people you can trust/control in key positions and they can provide powerful engines for laundering, particularly in the import/export space where transaction volumes and frequency help make price and shipment manipulation difficult to detect.
 
But trying to use genuine businesses for laundering in so-called lower risk countries has its own complications. Employees in the UK, France, the US, Singapore etc may be concerned about losing their jobs if they blow the whistle on something suspicious, but they're not usually concerned about being poisoned or thrown out of a window. All it takes is one nosy-parker to notice the strange new customers and suppliers, the trebling of volumes and the generous pay-rises awarded to all the staff and to report it, and you have a problem.
 
It may be better to take a new or newish company operating in a stock/inventory–free sector such as business services, consulting or software development. Having sailed through the rudimentary questions which most banks ask about companies in the SME space during onboarding, and taken care to ignite all the green lights in the adverse screening process (nothing to see here…), you're then free to start selling and buying services to and from a range of "clients" and outsourced service–providers, many of whom may have profiles similar to your own company - few staff, premises in serviced offices, minimal web presence, little or no discernible marketing activity. By increasing the account turnover at a suitably rapid pace (these are high growth sectors, after all), but not one that is suspicion-inducing, by the time your bank's transaction surveillance system spots anything anomalous (if it ever does), you could have laundered quite a bit and moved on.
 
We should be identifying these types of companies and scrutinizing them more closely before they are allowed into the system. But many banks take a minimalist approach during onboarding, trusting that their surveillance systems will pick up any trouble as and when it occurs. This is in contravention of FATF R10 and its interpretative notes, which state that at the commencement of a business relationship, banks should:
 
…understand and obtain information on the purpose and intended nature of the business relationship.

 

and that in the case of legal persons they should:

 

…identify and verify the customer and understand the nature of its business. (my underlining.)
 
This means that, in addition to corporate and UBO identity and expected account activity information, we should at least have an understanding of an SME's business model, asking, and obtaining answers to questions such as:


  • What do you sell? (Goods, services, both?)
  • Where do you sell it and to what type of buyers? (home, abroad, B2B, B2C?)
  • How do you market and sell it? (premises, online, face-to-face?)
  • What's your pricing model? (Contract, subscription, pay as you go?)
  • How do you get paid? (Transfer, card, payment service, cheque, cash?).
  • Who runs the business day-to-day and what's their career background?
  • Who’ll be your major suppliers?


Once we have the answers to these questions, we should then be testing the overall picture against information and data from the real world, with a view to answering the Golden Question, namely “How likely is it that this business is performing, or intends to perform, the economic role which it has described for itself?"
 
Many banks will balk at the feared costs of such an exercise, arguing that this is effectively enhanced due diligence and that the resources required for such an effort are only warranted if PEPs, high risk countries or traditional high-risk businesses such as a CIB's, DPMS's, MSEs, etc and others are involved. But that ignores the reality of how launderers will want to avoid such channels. And it also ignores the role which AI can play in performing the necessary tasks– and in seconds, not weeks.
 
NLP enabled question protocols during onboarding can attempt to elicit information about business models from applicants and raise silent red flags where they detect dissembling or reluctance to provide information. Once this information is obtained, the same engine can conduct "smell tests" using structured and unstructured public data. Depending on the quality of their preparation, fake or semi-fake businesses being used for laundering may possess features which can be exposed with some AI-driven cyber-digging:


  • poorly constructed, overly brief or generalised websites;
  • beyond-random similarities between the websites of the company and its stated main intended customers and suppliers;
  • common officers and employees;
  • the absence of typical marketing activity such as blog posts, articles in trade journals;
  • the absence of staff presence on the internet e.g. no staff profiles on LinkedIn or profiles with fake indicia or indicating no experience in the sector;
  • a lack of responsiveness to email enquiries presenting potential business opportunities to the company;
  • others


We may think of this process as 'positive screening' - an automated attempt to determine the likely genuineness of an entity customer. Applicants who "fail" this smell test should be reviewed by (human) KYC analysts and rejected where there's a serious risk that their actual or expected economic profiles are not genuine.


Financial exclusion and the encouragement of economic growth are important issues. But there is a world of difference between, on the one hand, denying a bank account to, say, an unemployed worker because their account won't be profitable and, on the other, refusing to provide services to companies which may otherwise be used to help "launder billions through the banking system with a 99% success rate."

< Older Post

Why Don't We See It Coming?

By Tim Parkman • June 19, 2025
The Danish philosopher, Søren Kierkegaard, wrote that "Life is lived forwards, but understood backwards". By which he meant, I guess, that sometimes we have to make our own mistakes before we can hope to understand why we made them. If that's true, then it's cold comfort to investors now scrambling to try and get something back from Indian electric vehicle maker BlueSmart Mobility , but it's worth remembering that we've definitely been here before. It was back in 2008 that financial journalist Alex Dalmady stuck his neck out and did what so few had done before. Risking potential bankruptcy and ruin (or worse...) he publicly called Stanford International Bank (SIB) as a fraud before the ponzi scheme there had been discovered. And he did so using his 'Duck Theory' - as in 'If it looks like a duck, and it quacks like a duck, then it probably is a duck!' The Duck Theory had four main indicators which applied to SIB, and it's instructive to see now how they slot not only into more recent cases such as FTX but also into many of the other fraud “classics” of the last few decades: 👉 "It's too good to be true." - FTX, so youthful, was sponsoring major sporting events and venues costing hundreds of millions. Just as SIB and Sir Allen Stanford did with international cricket. 👉 "It can do what no-one else can do." - FTX was offering returns at significantly above-competitor rates. Just like Bernie Madoff and his ‘elite-only’ funds. 👉 "There are only a few people, or one person, overseeing everything." - FTX management - and financial management (in a complex business) - was tightly controlled with limited genuine external oversight. Just like Nick Leeson and Barings (remember them, Old-Timers?) all those years ago. 👉 "There are very few incentives for whistleblowers." - Well, are there ever? But with massive investment rounds, huge celebrity endorsements, stunning growth multiples and a Rockstar CEO, based and regulated in an easily-impressed offshore jurisdiction and pumping cash (real, fiat cash) into good causes, who wanted to analyse the actual chemical contents of such a punch bowl? Sub-prime mortgage/CDO scandal, anybody? Of course, (and as Kierkegaard may have known), the problem with these types of 'red flags' is that whilst they are commonly found in frauds which have occurred, in themselves they cannot accurately predict fraud because they are too widespread, i.e. they can be found in businesses and situations where fraud and cheating have never been discovered because they have never existed. As an example, I have waited for years for 'explosive revelations' about how the New Zealand All Blacks manage to score so many points in the final quarter of a game. But no, just a lot fitter and more determined it would seem than most teams that they play. At most, these red flags can help us by telling us where to look more closely. And it is there that we encounter the real problem in all this - that the most common fate of those who shine a light and report a problem is... To be ignored. Consider; there were warnings - in some cases multiple warnings over several years - of trouble afoot in Wirecard , Danske Bank , The sub-prime mortgage market, the Madoff Funds , Enron , WorldCom and many more. These warnings came from informed, educated, not-obviously-insane people, in many cases insiders with a deep knowledge of the industries and sectors concerned. Yet no meaningful action was taken. Why? The full chains of causation for each are unique, but in seeking to 'understand backwards' so that we can at least try to 'live forwards' in a more savvy and alert way, it's worth remembering some truths about human nature that I would go so far as to say are profound - i.e., inescapable. We are overly optimistic - 'Optimism bias' in humans is well established in the literature of psychology (e.g. see Optimism Bias ). Maybe it's nature's saving mechanism for our species which, uniquely, (so far as we can tell) is self-aware of its own mortality, but we sure do like to look on the bright side. It may happen to others, but it won't happen to us. At senior levels within organizations this can translate into an unwillingness to believe that the worst is possible. "Nothing to see here. Everything's going to be OK, trust me!" We don't like to receive bad news - or deliver it - 'Shoot the messenger' is an instinct as old as bad news itself. In a 2019 study series , a team from Harvard found that participants generally saw the person who delivered negative information as less likeable. And the more unexpected the bad news was, the more upset the participants were. It's not hard to see the application of this in corporate settings. "I really wish you hadn't told me that. Why do you always have to do this?" We seek out data which confirms what we already believe - And we ignore or explain-away data which contradicts it. Confirmation Bias is another apparently universal trait established in multiple experiments. In a world teeming with information, it's essential that we have mechanisms for shutting out 'non-essential' data. But where corporate malfeasance is a possibility, a capacity to pay special attention to information which doesn't fit with existing 'hunky-dory' assumptions is not only advantageous, it's essential.  We don't like being the 'odd-one-out' - The trait of 'conformity' is another one that's been well established ever since Solomon Asch conducted his 'stick-length' experiments which showed people's preparedness to answer simple questions incorrectly in order to 'fit in' with the group - despite the evidence of their own senses. "Why take the risk of appearing panicky and credulous in the face of dire warnings, when no-one else appears to be doing so?" And "How am I going to explain why we chose not to make an 80% investment return, when so many others did?"

Financial Crime Compliance: Developments of Interest - June 2025

By Tim Parkman • June 14, 2025
13 June 2025 The financial crime compliance landscape continues to evolve, with regulators tightening enforcement and businesses adapting to new risks. Below is a summary of recent developments across key areas of financial crime compliance. 1. Anti-Money Laundering & Counter-Terrorist and Proliferation Financing The Financial Action Task Force (FATF) has updated its recommendations, reinforcing measures to combat money laundering and terrorist financing. The UK government has also enhanced AML training requirements, ensuring businesses remain compliant with evolving regulations. Additionally, the latest AML Supervision Report highlights the importance of risk-based monitoring and cooperation between financial institutions and regulators. Read more: FATF Recommendations , HMRC AML Training , UK AML Supervision Report 2. Anti-Bribery & Corruption The C5 International Anti-Corruption Conference in London brought together global experts to discuss enforcement trends and compliance strategies. Meanwhile, UK Finance has identified three key priorities for anti-corruption efforts in 2025, including corporate liability for fraud and enhanced regulatory oversight. The Economic Crime and Corporate Transparency Act is set to reshape corporate compliance, making it easier to prosecute companies for bribery and corruption. Read more: Anti-Corruption Conference , UK Finance ABC Trends , Economic Crime Act 3. Anti-Fraud The UK Finance Annual Fraud Report reveals that fraud losses exceeded £1.1 billion in 2024, with Authorised Push Payment (APP) fraud declining but remote purchase fraud increasing. The Economic Crime & Corporate Transparency Act (ECCTA) introduces a new corporate offence for failure to prevent fraud, requiring businesses to implement reasonable prevention procedures. Compliance experts are advising firms on how to prepare for these new fraud prevention measures before enforcement begins in September 2025. Read more: Annual Fraud Report , ECCTA Fraud Prevention , Failure to Prevent Fraud 4. Ethics & Codes of Conduct The ICAEW Code of Ethics has been updated, introducing new provisions on professional behaviour, technology risks, and role expectations for accountants. In Scotland, the Police Ethics, Conduct & Scrutiny Act is set to enhance ethical oversight within law enforcement. Meanwhile, corporate compliance programs are being strengthened, with businesses updating their Codes of Ethics to align with evolving regulatory expectations. Read more: ICAEW Code of Ethics , Scottish Police Ethics Act , Corporate Ethics Code Lessons Learned Lessons Learned works with multilateral institutions, private sector corporations and NGOs to help promote and embed best practice in financial crime compliance and business ethics and integrity through leadership, governance, policies and training. For more insights, visit Lessons Learned or follow us on LinkedIn .