FRAUD RISK: AN EXAMPLE OF OPERATIONAL RISK ASSESSMENT

SUMMARY

The client, a crypto-currency exchange, has requested Avantage Reply to assist with an ongoing project around fraud risk. As the regulation around virtual asset service providers is not yet mature, the measurement of new and non-traditional operational risks is not an easy exercise. In fact, several players in the industry have recently found themselves being vehicles for the continuation of various financial crimes, including fraud. In the client landscape, scammers and individuals with malicious intentions have exploited the weaknesses of decentralized finance (DeFi) and have misappropriated even millions of dollars from their victims through first party or third party external fraud.

Fraudulent events represent a considerable threat for final customers who become victims of sophisticated scams and eventually experience a financial loss. However, such events also constitute a relevant risk for the crypto-exchange itself, in terms of reputation, relationship with the supervisors and partnerships with banks that carry out charge-backs to reimburse the client.

Avantage Reply has been appointed to approach the issue from a risk management perspective and to coordinate the efforts of various departments towards a better reaction to fraud while starting to draw valid preventative measures. The project has been developed through workshops across multiple departments (ranging from Operations to Compliance), the right documentation of all the measures in place and, finally, the application of the Risk and Controls Self-Assessment (RCSA) methodology.

CUSTOMER GOALS

The client’s two main objectives were:

• Performance of risk assessment across all the internal business chain, i.e. the identification of potential risk scenarios across all the streamline, from customer onboarding to crypto/fiat transactions.
• Translation of the current operations from reactive to preventative - given the actual severe threats on the market, the client needed to provide its existent infrastructure with a preventative orientation.

CHALLENGES

The project has required an intense research on new market “waves” of financial crime related to fraud. Moreover, the lack of regulatory guidance on the topic (besides AMLD5 which has constituted a good step ahead for crimes with the features of money laundering) has worsened an already difficult research. If a system can be made reactive via multiple initiatives, pro-activity and prevention require the definition of the right tools to address future instances in a timely manner. Finally, the correct risk assessment needed a detailed understanding of all the roles played across multiple departments.

SOLUTION

In order to achieve the goals, Avantage Reply has assisted the client in the following way:

• Performance of risk assessment: all the imaginable weaknesses have been identified and assessed with reference to their likelihood and their impact on the business. As next step, the control measures currently in place against the specific events have been described and their impact over the gross risk management has been assessed. Finally, the resulting net risk has been evaluated against potential improvements and external threats landscape, observing all the issues experienced by competitors in the industry.
• Translation of the current operations from reactive to preventative: a number of new measures have been proposed in order to timely spot new “waves” of financial crime, before these may have turned into damage. Plenty of the proposed measures have led to the preparation of an action plan to let such actions be concretely implemented.

The main outcome of the project, the fraud risk assessment, has been provided with a first clear picture of where the overall organization is more vulnerable. More importantly, it has allowed a fluent and efficient communication across departments, by including comments gathered across multiple stakeholders, and by making these last aware of the risk points under their control, as well as the potential damages to the whole business. Therefore, the risk assessment has constituted the basis for the prioritization of the following steps, together with the adoption of a new pro-active strategy under the coordination of the risk department.