Fintechs need stronger internal control to curb money laundering & white-collar crimes

Anti-money laundering (AML) compliance is the biggest challenge for fintech companies in combating financial crimes and maintaining a secure and trusted financial ecosystem.

The rapidly evolving nature of white-collar crimes in the fintech space warrants continuous vigil. The adoption of self-regulatory mechanisms and robust internal controls, coupled with the use of technological advancements and best practices, can greatly combat such crimes and strengthen customer trust in the fintech industry.

According to the Reserve Bank of India’s (RBI) Annual Report 2022-23, the majority of fraud cases were related to digital payments, specifically card or internet-based transactions, payment fraud, phishing, ransomware and money laundering. Anti-money laundering (AML) compliance is the biggest challenge for fintech companies in combating financial crimes and maintaining a secure and trusted financial ecosystem.

Financial fraud can come within the ambit of the Indian Penal Code, 1908 (IPC) and also as a scheduled offence under the Prevention of Money Laundering Act (PMLA). Offences such as impersonation/ identity theft can be tried by the special court under PMLA along with the offence of money laundering. Additionally, such offences are also punishable under the Information Technology Act, 2000 (IT Act).

Technology For Defence

The RBI recently released a report by the Committee for Review of Customer Service Standards in RBI Regulated Entities (REs), to enhance customer service and grievance redressal in these organisations. It highlighted the need for REs to leverage technology for improved customer service. Currently, most technological advancements in REs prioritise the business aspect over customer service.

The committee recommended adopting best practices through technology in service delivery, fraud prevention, grievance redressal, and customer awareness. Utilising data analytics and technologies like artificial intelligence (AI), machine learning (ML), and robotic process automation can mitigate fraud risks and enhance the consumer experience. Advanced fraud detection systems with AI and ML algorithms can detect unusual and suspicious activities in real time, monitoring transactions and user behaviour to promptly raise alerts and take action. To protect customer data, companies should also implement safeguards such as strong encryption techniques, regular security updates, data loss prevention measures, and access controls to prevent unauthorised access.

The regulatory framework for banking and finance frauds is monitored by the RBI’s master directions on frauds and direction on 'Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions’. However, these directions primarily focus on fraud classification, reporting, and customer liability when fraud occurs. The master direction ‘Know Your Customer (KYC) Direction’ emphasises customer due diligence and record management to uphold India's commitment to anti-money laundering (AML) and countering the financing of terrorism (CFT). While these directions aim to prevent fraud, they do not specifically address the requirement for internal controls to address financial frauds.

Focus On Internal Controls

Such platform frauds can be largely mitigated if the companies have robust self-regulatory and internal control mechanisms in place.  These mechanisms may include—

Whistleblower safeguards: White-collar crimes, including financial frauds, often involve internal collaboration within organisations. These crimes are intricate, with layered transactions, making it challenging to gather evidence without internal assistance. In this context, whistleblowers play a crucial role in investigating such financial crimes. Organisations should incentivise whistleblowers by offering them protection and maintaining their anonymity.

Internal investigations: In case the company finds a suspicion of fraud internally, it should start a prompt investigation by engaging third-party forensic investigators including accounting firms and law firms. This will serve a dual purpose — firstly, prepare the company for any potential investigation by any law enforcement authorities, and secondly, act as evidence of due diligence by the company.

Conducting due diligence: Tackling fraudulent transactions and identity theft requires incisive due diligence internally. The fintech companies must ensure compliance with KYC directions and ensure robust identity verification methods such as multi-factor authentication (MFA) during onboarding and for high-risk transactions. Procedures like internal checks and audits, risk assessment, and establishing internal grievance and redressal forums will go a long way to mitigate such issues.

India currently has one of the largest fintech markets in the world, behind only China and the US. Indian financial services, technology and the fintech space have seen remarkable growth, courtesy, the implementation of favourable policies by regulators. In the rapidly evolving landscape of fintech, robust AML compliance measures not only help strengthen the digital finance and banking infrastructure but also provide a seamless linkage for Indian tech and fintech companies with their global counterparts. It is essential for companies to be cautious of regulations and remain committed to internal compliance to prevent fraud.

Anu Tiwari & Sara Sundaram are partners at Cyril Amarchand Mangaldas. Views are personal, and do not represent the stand of this publication.