LEGAL
The due diligence process has long been an integral part of the risk landscape. In the last few years, even more emphasis has been placed on proper information gathering and screening processes. Enhanced Due Diligence (EDD), as a regulatory obligation forming part of a wider Know Your Customer (KYC) requirement, now has become more conspicuous as institutions have implemented a risk-based approach into their compliance programs.
Managing the risk
Conducting appropriate levels of investigation and fact finding is a fundamental part of any robust KYC policy. Third-party due diligence is also an essential part of any effective anticorruption program implemented with the aim to minimize the risk of getting involved in corruption through third parties. Last but not least, the EDD process is built into corporate risk strategies for growing businesses – expanding business and investing in emerging markets requires a comprehensive and detailed analysis of the new markets and business partners in order to understand and to manage the reputational, operational, and legal risk linked to expanding the business into new territories. Every business should take "doing their homework" seriously.
The consequences of getting things wrong are grave: from substantial financial losses, failed investment, and tarnished reputation, to high financial fines and personal liability of the management for failing to implement adequate KYC and anti-bribery-corruption (ABC) procedures.
Risk-based
A risk-based due diligence process, as the current best business practice of AML/ABC policies, and also the Financial Action Tasks Force recommendation, is made up of a number of steps. It starts with the initial assessment of third parties or clients' risk based on factors such as geographical risk, business sector risk, political connections, value, and type of relationship or type of product. This initial assessment then determines what level of fact gathering is needed. For subjects with minimum risk associated with them, a low level of black list and sanctions screening may suffice, while for subjects of higher risk association, an EDD exercise should be conducted. After the analysis of an EDD report, the managerial approval step needs to take place and the process should be repetitive in order to remain current and effective. This article concentrates exclusively on the fact-gathering stage of a comprehensive due diligence process, which can be conducted in-house or subcontracted to an external due diligence provider.
What are the choices?
Many international consultancies and small boutique advisors offer assistance in the fact finding part of the due diligence process. But what exactly is good EDD research? What challenges does a due diligence team face? What questions can you ask your EDD provider and how can you avoid easy pitfalls in the process?
A thorough process of EDD, that is both fact finding and verifying of the information disclosed by the client, will among others include checks against: international sanctions lists, politically exposed persons (PEP) lists, international press archives, local court databases, and local news archives. Information should also be collected from corporate registries available online or in person. It is recommended that the high-end EDD process also includes the gathering of reputational risk assessment from sources close to the subject and located where the subject operates, mapping relationships beyond geographical limitations and drawing logical conclusions based on facts. Collecting data from such diverse sources globally can only be time and cost efficient if completed by an established and experienced team.
Languages: parlez-vous francais?
There are a few characteristics that distinguish a good EDD research team. The lack of knowledge of various languages is often a first hurdle for a small in-house compliance team doing the checks themselves. Without a diverse set of language speakers, research through publically available sources, verification of documents, analysis and translation of information are simply impossible at a sufficient level. Relying on real or automated translation services comes with significant risks such as important information omission, lack of knowledge of useful sources and databases unavailable in English, and last but not least, inexact translation of information. These factors can lead to incorrect risk assessment.
Skillset for success
Pure knowledge of a language alone is also not enough to qualify one as a good researcher. Without a combination of the right knowledge, skills, and talents, one cannot provide a comprehensive, detailed picture that each growing business leader and each compliance officer need to do their job. To be successful, a good EDD research team needs a combination of specific skills: analytical minds, legal knowledge, logical thought, and naturally enquiring minds.
A team working on complex EDD assignments needs to question what they see on the surface. Information obtained through national press archives can be impacted by the political situation in the country, culture of a given region, or even censorship – accepting things at face value means not getting the full picture of the situation; they need to be analytical and scrutinize all the information, which can be inconsistent or even conflicting at times. They need to be open to discovering and testing new ways of finding information. They also need to act similar to lawyers, to understand and exercise an ethical way of conducting thorough investigations and be familiar with the local environment, including legal restriction to data access and data protection; and they have to demonstrate the "inner child" each day by continuously asking "why?" and have the ability to put all of the pieces of the puzzle together.
Data transparency and accessibility
With a state-of-the-art international research team in place, there are still a few other hurdles each business and the regulators need to be aware of. First of all, higher risk locations usually come with less transparency of commercial data. There are also locations with less developed systems and no online accessible sources – so a physical presence is necessary to get the required documentation. Good understanding of a retrieval process at national and regional level and a team's global presence are key to overcoming these obstacles. Nevertheless, there are other factors that sometimes make the information simply legally unobtainable. For example, the secrecy laws, especially prevalent in jurisdictions with lax tax regulation, do not require disclosure of the shareholders at the stage of registering a corporation. Not to mention the requirement to disclose the ultimate beneficial owners of a legal entity.
Obtaining the beneficiaries' names is becoming a challenge to European compliance officers with the 4th EU Money Laundering Directive, which will require the institutions to take appropriate action to find who the beneficiaries of all their customers are. It should be understood that, as even law enforcement agencies struggle with data gathering on some investigations, a commercial due diligence provider will face those hard stops too. An ethical EDD service provider should make the client aware of any such restriction and assist in managing the particular case. What can sometimes help in such a situation is to look into various other sources, like courts' rulings and investigative journalists work. A state-of-the-art research team will have a detailed understanding of the accessibility but also limitations in each country.
Knowledge is the key
A small in-house compliance team can find it difficult to always be current with local law changes all around the globe. For example, while the global trend, especially for emerging markets, is to increase the transparency of commercial information, in 2012 Azerbaijan restricted public access to information about the registration, ownership structure, and shareholders of Azerbaijani corporations. In Canada and the USA, surprisingly, multiple courts and corporate databases and federal systems make it difficult to gather information on a national scale. On the other hand, in Kyrgyzstan, the country's first judicial database was recently created, making corporate lawsuits records easily searchable online. Only a large, international, cutting-edge research team would be able to have such awareness and knowledge.
Making sense of it all
The abundance of online information sometimes makes efficient fact finding a mission impossible. The more information there is available, the harder it is to get to the right information. Conducting a search on any search engine for specific information actually requires an understanding of that search engine's specifications, including the algorithms it operates and the limit of sources it covers. Over-reliance on one or two dominant search engines will lead to serious omissions and an imperfect research outcome, such as possibly missing what could be important business connections, influential associations, and even past relationships of the subject of the EDD investigation.
However, the more news aggregators, databases, and search engines we have available, the more difficult it is to stay on top of the changes they introduce – and using all is simply neither time nor cost effective. Google changes its search algorithm 500-600 times each year. Most times the changes are minor and do not impact the research process, but the results of some changes require its users to adjust search techniques, connectors, stoppers, and search strings. A professional EDD research team should have a specialist team that understands and monitors the development in the information and technology sectors. This knowledge can then be effectively transferred to the researchers who can concentrate on finding facts, have access to most current sources and are trained on the newest search techniques.
Conclusion
EDD processes create a big challenge to corporations' and financial institutions' compliance teams. The investigations have to be appropriate to the risk-based approach, use all reasonable sources to satisfy the regulatory requirement, and provide relevant knowledge for an informed business decision. For the fact-finding and analysis process to be efficient, the research team conducting the checks needs to have very specific skillsets, a global presence, and local knowledge and experience. A good EDD team should also know where and why some information may not be obtainable and with no exceptions adhere to the highest ethical standards of conducting investigations. A seasoned EDD team will deliver to their clients the required information and with that peace of mind.
-->
