Westpac AML / CTF Failures: What Went Wrong?
Westpac AML / CTF Failures: What Went Wrong?
3 1
Paragraph 55 Judgment, CEO of AUSTRAC v Westpac Banking Corporation, [2020] FCA 1538
Background
3
Anti-money laundering and counter terrorism financing
In the agreement statement of facts Westpac
made the following admissions:
4
AUSTRAC had originally sought a finding against In December 2019, the Australian Prudential
Westpac’s Board, alleging in its November 2019 Regulation Authority (APRA) began a separate
Statement of Claim: investigation into Westpac’s risk governance
as a result of the AUSTRAC allegations.
"Systemic failures in its control
This investigation was delegated to Australian
environment, indifference by senior
Securities and Investments Commission (ASIC).
management and inadequate
Despite the work which the Bank had undertaken
oversight by the board." under the guidance of AUSTRAC, APRA, in
December 2020, remained concerned
Following this allegation, the Bank’s former CEO by the Bank’s progress in remediating compliance
and Managing Director, Brian Hartzer, stepped weaknesses across the organisation. APRA
down in November 2019 and the former Chairman, commented that the culture, governance and
Lindsay Maxsted, brought forward his retirement accountability program, which began in January
from December to April 2020. 2019, lacked sufficient momentum.6 APRA
determined that the Bank had an:
Ultimately, the allegation of Board indifference
was not pursued by AUSTRAC. The statement of
"immature and reactive risk
facts recorded that:
culture,unclear accountabilities,
"At all times the Westpac board and capability shortfalls and
senior management sought to ensure inadequate oversight." 7
that Westpac would comply with
Westpac's CEO Mr King issued a statement
its obligations under the AML/CTF conceding:
Act…Where issues were identified,
the board and senior management "While we have made progress in
sought to ensure these issues improving our standards, we have
were addressed." 4 much more work to do, and this
must be done at pace." 8
However, AUSTRAC and Westpac agreed that
some areas of money laundering and terrorism APRA agreed to a Court Enforceable Undertaking
financing risk were insufficiently understood (EU) from Westpac pledging to substantially lift its
in key areas of Westpac, compliance and risk efforts to address risk governance deficiencies.
management functions were inadequately ASIC concluded its investigation in December
resourced, and there was insufficient speed 2020. It did not take any enforcement action either
in addressing problems when they arose. against Westpac or any of Westpac’s employees. `
Between 2018 and 2020 Westpac worked In March 2021 APRA, after considering the results of
with AUSTRAC in order to assist in reporting, the ASIC investigation, closed its own investigation.
investigation and remediation of identified issues.
Westpac accepted that between 2013 and 2019 its
4
systems, controls, processes and resources were: Paragraphs 358 and 361, Statement of Agreed Facts
and Admissions
5
AUSTRAC's allegations
1. Failure in IFTI reporting specific bank. Again, these failures were not
brought to the attention of senior management.
The Act provides that every time funds are
transferred in or out of Australia, Westpac must The Group Money Laundering Reporting
report these transfers to AUSTRAC within 10 Officer only became aware of these issues
working days. Westpac have to provide the in May 2018 and reported them to AUSTRAC
identity of the payer, their address, the size of CEO in August 2018.
the transaction, what the payment is for and the
payee name and address. AUSTRAC alleged During the period October 2018 – September
that Westpac failed to comply with these 2019, Westpac reported 72% of all incoming
obligations in millions of instances. IFTIs late to AUSTRAC. 18 of the IFTI reports
which were lodged late with AUSTRAC related
As far back as 2013 the Bank was aware that to seven customers with which Westpac
its reporting functions of IFTIs were not had identified transactions indicative of
satisfactory. In 2013 AUSTRAC had queried the child exploitation and 19 related to suspect
Bank’s compliance with reporting requirements. transactions of 12 identified customers.
Westpac’s CTF/AML division prepared a report
looking into the efficacy of the IFTI reporting. The Bank traces its failings back to resource
The report identified that there were a number of: constraints when Westpac was changing and
upgrading its IT system in 2009. In 2011/12
"gaps… present in Westpac’s the Bank lost an entire team to another bank
structured IFTIs, ranging from responsible for the implementation of this
data quality, incorrect usage of program. These people were not replaced
XML tags, incorrect information because of resource constraints. 10 Simply put,
those who knew how to work the relevant IT
populated in XML tags and
systems left and there was a lacuna of the
incorrect definitions of
specialist knowledge that led to errors in
reportability." 9 implementation. There was no effective
review of the project after its implementation
However, it did not pick up on the fact that to check that it worked.
some IFTIs simply were not being reported.
Under the Act Westpac is required to
In July 2013 AUSTRAC recommended that keep records for seven years of each transfer
Westpac review payment instructions which instruction passed on to it by a correspondent
had not been reported to AUSTRAC. The bank. The Bank failed to do this in over 3.5
Bank duly did this and reported in June 2014. million instances. The simple reason was that
Again the review did not identify omissions the back-up system at Westpac wasn’t properly
in reporting. A management action plan was configured and as a result records were not
prepared by the Bank to address issues which retained and some lost. Again, Westpac did not
had been identified. The action plan also did have adequate assurance processes to pick up
not identify non-reporting as an issue. on this IT failure.
6
2. Failure to conduct adequate risk of the correspondent banking due diligence
assessments and due diligence assessment processes. These flaws could have
been addressed earlier had Westpac had:
assessments of correspondent
banking relationships
"stronger first line testing, second
Westpac had correspondent relationships line oversight and assurance and
with sixteen foreign banks. The risks of these third line audit coverage." 12
particular relationships are considered higher
by AUSTRAC as they involve the flow of money The Bank accepted it had not been compliant
across borders and incorporate jurisdictional risks. with the Act since 2013. Westpac accepted that
There is or can be a vast difference between the in some cases it did not appropriately assess the
AML/CTF processes and regulations in different jurisdictional risks of the correspondent banking
countries. There can also be a lack of transparency relationships and did not assess the impact of
in the identity of the customer and source of funds. higher ML/TF risks on banking services provided
by Westpac to the correspondent banks. It put this
Westpac had allowed offshore banks to use its non-compliance down to limitations in processes
domestic infrastructure to process Australian and procedures, failure to adhere to those
dollar payments to avoid transaction costs on processes and procedures in some cases
international transfers. AUSTRAC alleged that the and perhaps most interestingly
Bank was dealing with high-risk institutions which
were known to have relationships with sanctioned "reliance placed on a particular
countries such as Iraq, Lebanon, Ukraine, Zimbabwe
operational team to perform
and the DRC. AUSTRAC described the risk in the
functions that were critical to
following terms:
those due diligence process when
"The risk posed to Westpac was that role would have been better
that these high risk or sanctioned suited to those with particular
countries may have been able to financial crime expertise." 13
access the Australian payment
Westpac reports it has made the following
system through these nested changes to its due diligence processes:
arrangements, unbeknownst
to Westpac." 11 a. Enhanced the thoroughness of assessment
of the existence and quality of any AML/CTF
Prior to proceedings Westpac believed that it regulation in the correspondent bank’s
was compliant with the Act with respect to its country of domicile or that of its parent;
obligations for due diligence on correspondent
b. Off-loaded a large number of correspondent
banks. It had received confirmation in 2012 from an
banking relationships since July 2017 which
external review that its processes were compliant
do not meet its risk appetite or strategic
and that they were operating as they should. In
commercial objectives;
2016 AUSTRAC conducted an assessment of
Westpac’s compliance with obligations and made c. Conducted preliminary risk assessments and
seven recommendations to the Bank. AUSTRAC due diligence of all correspondent banks.
did not identify any non-compliance. The Bank
took steps to address the recommendations,
11
The Global Reach of US Coercion, Economic
however these steps were not adequate, the Court
coercion: Boycotts and sanction – preferred weapons
found. Westpac had engaged in relationships of war, David Uren, October 1 2020.
and transactions which were beyond its own risk
12
appetite. The Bank did not follow appropriate Paragraph 123, CEO of AUSTRAC v Westpac Banking
Corporation, [2020] FCA 1538
monitoring of these matters. The Court found that
there were flaws in the design and implementation 13
Overview of Westpac’s AML/CTF Compliance Failures
related to AUSTRAC statement of claim
7
3. Failure to adopt and maintain an anti- Whilst Westpac’s Part A required ML/TF risk
money laundering/ counter terrorism assessments for all new products or variations
to products, it didn’t include provision to update
financing (AML/CTF) program
those risk assessments in line with new or
emerging ML/TF risks.
As the October 2020 Judgment sets out, the
AML/CTF program is the principal document for
The Court found that Westpac’s transaction
setting out the risk-based systems and controls
monitoring program was seriously deficient. The
that are required to ensure compliance with
Judge criticised Westpac’s risk management
the Act and the Rules. Risk assessments are the
systems saying:
foundation of the obligation to identify, mitigate
and manage the ML/TF risks related to services
offered by the Bank. In order to appropriately "Clearly, this system failed to
manage and mitigate any ML/TF risk, the Bank properly identify, mitigate and
has to first identify and assess those ML/TF manage the money laundering
risks that it faces. AUSTRAC alleged that the and terrorism financing risks…
Bank failed to adopt and maintain adequate further Westpac’s transaction
AML/CTF programs. The Part A of the program
monitoring program was
relates to the Bank identifying, mitigating and
managing the risk of getting involved in, or
seriously deficient, that had
facilitating money laundering or CTF or other ramifications for monitoring
serious crime. AUSTRAC alleged shortcomings international payment flows
in the program and that Part A did not comply concerning billions of dollars
with Rules under the Act. AUSTRAC alleged that that had higher money
there were inadequacies in the Bank’s financial laundering risks including
crime system Detica and transaction monitoring
risks associated with child
and that remediation of the system had not
been adequate, timely or prioritised. The Part
exploitation and tax offences." 14
A Program did not include an appropriate level
of guidance to enable the Bank to identify 14
Paragraph 196 Judgment, CEO of AUSTRAC v
all relevant ML/TF risks stemming from new
Westpac Banking Corporation, [2020] FCA 1538
‘designated services’ offered to customers.
8
4. Failure to conduct appropriate AUSTRAC identified that there were twelve
ongoing customer due diligence customers on whom that the Bank failed to
conduct ongoing due diligence. Three of the
in relation to 262 customers
customers identified had prior convictions
relating to child exploitation offences and
In 2013 AUSTRAC produced Guidance for
one customer had been arrested in relation
institutions which identified patterns of
to further child exploitation offences since
transactions or ‘typologies’ which could
proceedings began in 2019. The Guardian
be linked to child exploitation. In 2016
reports that one customer made payments
The Commonwealth Attorney- General’s
to someone in the Philippines who was later
Department published information on the
charged with:
same topic. One of the recognised typologies
was that frequent guardirafficking. In December
2016 and 2017 AUSTRAC provided Westpac “live streaming of child sex shows
with methodology briefs detailing the key and offering children for sex.” 16
indicators for the purchase of live-streaming
exploitation material. Another Westpac client, ‘Customer 5’,
reportedly paid $75,000 over four years and
In 2016 Westpac had identified that low-value repeatedly travelled to south-east Asia. 17
payments to the Philippines were increasing
and this represented a risk in terms of child The Bank accepts that it failed to adhere to the
exploitation. As a result, Westpac introduced Guidance produced by AUSTRAC. Furthermore,
a ‘detection scenario’ into a payment channel. those individuals responsible for digesting the
However, this detection scenario failed to Guidance and then applying it to individual
detect any issues and did not adequately reflect situations did not fully understand or take on
the Guidance. The detection tool was replaced board that Guidance.
in 2018 but to only one of its payment channels
and not across all of them. The Bank, according Westpac reports it has made changes to its
to AUSTRAC, continued to fail: enhanced customer due diligences processes
for those customers who have been identified
"to identify activity indicative in suspicious matter reports filed with
of child exploitation risks." 15 AUSTRAC including:
In 2019 a bank teller identified potentially a. Reducing the maximum time permitted
suspicious activity as a result of a face-to-face for ‘exit decisions’ to be made in relation
to those accounts;
encounter with a customer (‘Customer 12’ as
referred to in the statement of facts). The bank b. Blocking certain payments for those
teller raised a red flag in relation to Customer customers who are subject to an exit
12, who had made a number of payments to the decision in the period between the
Philippines. Customer 12 was investigated by suspicious matter report being filed
the Bank and it transpired that the customer and the customer account being closed;
had a previous conviction for child exploitation
c. Additional training for staff in relation
offences. Due diligence had not picked this up
to identifying and monitoring child
beforehand. Customer 12 had had an account
exploitation material risk.
with Westpac since 2001. It took Westpac
2.5 months to close Customer 12’s account.
15
Between raising the red flag and the closure https://theconversation.com/westpacs-panicked-
of Customer 12’s account, no heightened response-to-its-money-laundering-scandal-looks-ill-
considered-127700
restrictions were in place and the customer
made nine low-value transfers of money 16, 17
https://www.theguardian.com/australia-news/2019/
consistent with child exploitation. nov/21/what-is-westpac-accused-of-and-how-is-this-
related-to-child-exploitation-explainer
9
What lessons were learnt?
10
The Report goes on to comment that before d. Monitor AML/CTF compliance;
2017 the Board’s responses to known risks were
e. Observe and learn from global best practice.
slow off the mark. The financial crime team
and leadership within the Bank lacked relevant
international experience. They did not recognise The Bank has made efforts to implement some
global trends in financial crime and enforcement of these recommendations and reportedly has:
activity. This, the Report comments, is perhaps
unsurprising given the largely domestic profile a. Held a training workshop for the Board
of the Australian retail banks and the focus of members on financial crime, and increased
AUSTRAC on tax evasion, welfare fraud, terrorism resources for this area;
and organised crime. It was not until 2010 that
b. Appointed individuals with relevant
AML/CTF became a considerable part of any Bank
international expertise at Board and
risk management agenda. The CBA penalties in
executive level.
2017 sent a shock through Australian banks and
encouraged a change in assessment, management c. Hired hundreds more staff to deal specifically
and monitoring of non-financial risks. with AML/CTF. The Bank’s core financial team
is made up of permanent employees and not
The Three Lines of Defence framework22 which temporary contractors which some staff say
was employed by the Bank had ‘shallow roots’ leads to a cohesive culture;
in the financial crime risk area. The Board
wrongly assumed that the Three Lines of Defence d. Upgraded its technology. The Bank since
framework was sufficiently established and robust. 2014 had spent A$632 million on financial
Directors did not react urgently to reoccurring red crime compliance, including AML/CTF
flags. There was a lag between Board engagement compliance and made improvements to its
with the AML/CTF obligations and the expectations technology platforms, personnel, processes
of AUSTRAC. The Bank accepted that the Three and procedures. However, as above, it would
appear that there is much work still to do
Lines of Defence model was:
on that front;
11
How RiskScreen technology
could have helped Westpac
avoid AML failure
• Effective reporting
12
RiskScreen's award-winning technology
13
About RiskScreen
14
15