Are RegTech Platforms Making AML Feel Safer Than It Actually Is?
Controversial? Maybe – but a conversation that absolutely needs to be had.
On this week’s What’s the Buzz? The Official HiveRisk Podcast Jonny Coleman from First AML talks about whether tech is making us too comfortable when it comes to AML risk.
Covering everything from:
What firms are seeing day to day – the good, the bad and the ugly
Why workflows are guardrails not silver bullets.
How tech, consultants and firms are pieces of the same puzzle.
Transcript:
Eloise: Welcome to this week’s episode of What’s the Buzz, the high-risk official podcast. Today we have a really interesting topic. We are talking about the illusion of control, are Regtech platform’s making AML feel safer than it actually is?
Eloise: And to set the scene, I think Regtech is increasingly positioned as a solution to AML complexity, automating on-boarding, screening, monitoring, we’ve got our audit trails in there. But at the same time, expectations of the regulator are changing, they’re tightening, firms are expected to be more agile, more dynamic. I think there’s potential here for like a tension to be created that we rarely speak about. And it’s where the firms are generally improving their AML outcomes, or whether we’re just getting better at feeling compliant as opposed to actually moving the needle. And on that topic, I am very pleased to say that my guests today from a Regtech background to really get insights from both sides on this is Jonny Coleman from First AML. And Jonny, would you like to introduce yourself?
Jonny Coleman: Thank you, Eloise, thank you for having me. Yeah, so for those of you that don’t know me, my name is Jonny Coleman, I’m the country manager at First AML.
I’m in the very privileged position of getting to speak to a range of law firms and understand how they approach their AML obligations. So hoping to share some insights from what I see in my daily conversations today.
Eloise: Thank you. And I really appreciate it. This topic would be easier to talk about without you guys in the room, right? Cause we’re essentially talking about you and about the role of Regtech. And I think it says a lot about First AML that they were completely game for this topic.
Because I think there is a tension there that we really wanna get into from your perspective inside Regtech.
My perspective as a consultant, obviously formerly in-house and at HiveRisk is we deal with a large variety of firms that use a variety of different tech products. And I think obviously where your product also whilst predominantly working with like the legal sector, you deal with other regulated professional services firms as well. So having an eye on what’s to come on the horizon and what’s changing is really helpful. So I guess to start with that whole compliance theater versus genuine risk reduction. And I think what I see when I go in and I audit firms and I have a lot of conversations around tech is the lack of reference or the lack of consideration that’s often given to what’s in the LSAG when it comes to technology.
Obviously the SRA has guidance, but section seven of the LSAG is so helpful when it comes to the role of technology, expectations in terms of technology. I think what I see and what I worry about is that don’t always understand what their tech is doing.
And when that happens, and I do see this, reasonably frequently how can it genuinely make you more confident in your compliance if you don’t understand what it’s doing, what it sits behind it? So I think do you feel or do you get a sense that there’s the potential there for dashboards, workflows, lovely green ticks to create that false sense of security?
Jonny Coleman: I think it’s an important question to ask when you’re looking at buying technology, but more holistically as well. I think first and foremost, it depends on your compliance model. So centralized teams have, I guess, more natural level of attention to detail, natural curiosity, kind of integrity and decision making. So for those kinds of teams and that compliance model technology only really serves to empower them essentially.
But in decentralized model, yes, I think there is a very real danger that sophisticated workflows and a guided kind of step-by-step tour or process of what needs to be done can lure teams into a bit of a false sense of security and encourage that, I guess that tick box mentality, isn’t it, that we’re trying to move more people away from?
I think when you do have things like workflows, so when you automate things like the collection of documentation and running of screening checks and the audit trail is kind of automatically laid out for you and done automatically, I think, yeah, it can feel like software has solved the problem of compliance, but as we know, a perfect audit trail, kind of showing you’ve unbothered a high-risk client without proving that you’ve escalated it or whatever, it’s not gonna satisfy a regulator or it’s not gonna keep our most vulnerable people of society safe, which is what we’re doing here. What I will say is I think that the way that we should be viewing technology is that it’s there to fight or combat things like administrative fatigue.
So when you’ve got teams like drowning in chasing down UBO number four for their identity verification across, you know, multiply that by a factor of 20 clients that are onboarding, for example, or calculating what is 85% or 42% trying to understand, you know, who the UBOs are, that stuff takes away from, or kind of pulls people in a direction that then takes away things like brain power and time, essentially, which is one of the big issues that we have in law firms, from being able to kind of step back and do that kind of assessment of risk, which is where we want people spending time, essentially. So that’s how I view technology and its role in law firms.
Eloise: Yeah, that’s really interesting. You make a good point on the actual compliance setup, you know, whether you onboard centrally or decentralized or some sort of hybrid model. And I think that is such an important opening question when you’re talking about anything to do with compliance, because I think it does really change some of the requirements, and it creates different difficulties and different obstacles to overcome, depending on how you have that setup working.
And I think there’s still, I personally still see a lot of decentralized onboarding within law firms, although there definitely has been a shift in recent years towards at least a hybrid centralized kind of model. I don’t know if you’ve seen the same.
Jonny Coleman: Yeah, we’ve seen more hybrid models coming out of a strictly decentralized model, which I think makes a lot of sense, right? You kind of want that asset and that resource to be able to support where needed without kind of slowing down operations, which I think is the considerations that firms make when they’re moving from decentralized to a hybrid or a centralized model. So yeah, it’s definitely seen a kind of a similar pattern in the conversations that we have.
Eloise: Yeah, and I think whilst consideration might, and you’ll have more insight on this than I will, consideration might be given to a lot of this at the point of choosing tech or onboarding new tech and the scrutiny, but what I’m keen to get into is whether that really continues on an ongoing basis after the contract signed, the teams are trained, the initial setup is done.
Law firms are renowned for sometimes being a bit averse to change. So quite often once tech is onboarded, it’s there for some considerable amount of time and the ongoing assessment of whether it continues to meet the firm’s needs coupled with the product developments that you guys are releasing really regularly.
Jonny Coleman: Yeah, I think that’s a really interesting question to ask. And I think it’s probably one of the things that we are hoping, first AML specifically here, our technology can enable more of because I think what I found, that ongoing element, that ongoing assessment element of, hey, our PCP has been followed and adhered to and the checks and that zoom out risk assessment taking place historically have been quite difficult to manage and police ongoing.
If you think about how stretched compliance people have been historically in law firms, their ability to check in on if certain things are taking place have been quite limited where with first AML we’re hoping that with having a centralized system, I’m talking about technology here specifically, not the compliance model, will enable certain things to be, I cannot box off, but put in a category that I’m pretty comfortable actually now that that is taking place. And maybe I can now look at a more efficient means or conducting more volume of file reviews, for example, to kind of check in that things are taking place. In terms of like ongoing evaluation of the technology itself, I think it’s real mixed bag. We see some firms kind of coming in and wanting to check that things have been updated in line with new legislation and some not so.
So I think that’s, yeah, kind of still a bit of a dividing question, I would say.
Eloise: Yeah, and I think the resourcing point is really important. I do not underestimate, and I know that you obviously speak to enough people in the sector to not underestimate either the sheer pressure that heads of risk compliance managers are under on a day-to-day basis.
And inevitably in those circumstances, something has to give, right? And I just think kicking the tires on your tech stack, it seems to me, especially from what I’ve been seeing recently is something that in those circumstances does tend to not make it to the top of the list. And I’m finding more firms, they don’t have that written reg tech risk assessment to demonstrate not only when they on-boarded the tech, how and why it met the needs and suitably mitigated the risks that the firm had identified in their firm wide risk assessment, but also the firm risks change. You might have different teams to when you were on-boarded. The changes in the last few years in relation to sanctions, in relation to high risk third countries, all these things are a moving feast. Technology has changed astronomically in the last few years. The product developments, the product updates, and it’s a lot to keep track of.
And I worry that, yeah, maybe sometimes too much confidence is placed in it without anything to back up that confidence. So sort of on that point, do you think there’s a risk that automation in these platforms runs the risk of actually hiding risk instead of surfacing it? There’s an assumption that these automated platforms will surface risk to direct attention and resource, which is limited, where it’s needed most. But actually, is there a risk that it does the opposite?
Jonny Coleman: I think there’s always an element of risk with any technology. I think I always kind of come back to specifically recently around things like the AI revolution that we’re going through. I think there’s probably two lenses to that that I say. I think firstly, there is a risk for technology that you become a little bit over-reliant on it. And that is something that needs to be known, documented, and have strategies to kind of counteract.
I think what I will say though, is that with the rise of AI, I do feel like that we are now getting trained to be a little bit more sceptical about technology. And I’m hopeful that that will then improve that or decrease that reliance on technology, because I know that with AI and its hallucinations and all the other kind of stuff, I’m naturally a little bit more cynical now about what comes out of tech, which is something that I’ve probably not been as much of, kind of historically. So yes, I think there’s a risk. And yes, I think there can be strategies in play to kind of mitigate that risk.
But I do think that, I think we’ll naturally, as a collective, become, yeah, a little bit more sceptical about the results that we’re seeing.
Eloise: Yeah, I do think a lot of over-reliance on tech, and I come at this, not with any judgment and thinking about decisions I made when I was in-house, when I was onboarding tech, especially when I was onboarding tech for the first time, and with the benefit of hindsight, not really suitably equipped to be doing that, because it didn’t have the knowledge or the questions to ask. Sometimes that’s where the overconfidence comes from, actually. I don’t understand what it’s doing, and I don’t really want to admit that I don’t understand what it’s doing, so I’m just gonna put a lot of faith in this vendor.
And I think we’ve seen that tech position move on from workflows to automation to, now obviously, AI. And do you see, we had a really good episode a couple of months ago where I was speaking with Jane Pritchard from Foresight, and we were talking about maybe that terminology sometimes being used interchangeably incorrectly. Is that surfacing on your side of the conversations, or would you say that knowledge in respect of that has actually just increased exponentially recently?
Jonny Coleman: I think it’s evolved quite significantly recently. I actually don’t find them being used interchangeably. I think what I’d probably say the opposite, when AI comes into the conversation, that usually triggers a bit of an emotional response on the other side. And that’s usually because that means there’s even more due diligence required, a more red tape to go through inside of a firm if a tool has AI in it, and rightly so.
So yeah, I think the differentiation between workflows and automation AI definitely separated in that sense. I think, yeah, workflows and automation, for me at least, or at least the conversations that I have, there’s a very clear kind of definition or a line and sand between them. Workflows being your ability to configure something to a particular department or a particular risk level, et cetera, automation being you can remove some clicking of buttons. I find that that’s, yeah, they’re pretty clearly, yeah, pretty clearly understood.
Eloise: That’s positive. Any positives we can take out from all of the AI stories? I feel like we need to latch onto as much as possible. And so sort of on that topic of conversation and something which I’ve had surface very recently is we spend a lot of time talking about false positives and fuzzy matching and all of those conversations that we’ve been having for years now. And we can be quite quick to discount false positives. And sometimes I query whether we’re doing that too quickly and correctly, but conversations don’t really seem to happen around what about false positives?
So how often are passes or green ticks or whatever we’re calling them, how often are those challenged or checked?
Do you have anyone asking you about that? Is that a conversation that comes up?
Jonny Coleman: I do actually, yeah, I’ve seen a real increase in compliance people and professionals in firms wanting to sense check those kind of results. I think historically there’s been like I say, it’s back to that kind of piece around visibility, isn’t it? And being able to actually one, see what’s going on in intricate detail and two, having the time to do that.
And yeah, I’ve seen a real rise in firms kind of looking at false negatives, not just false positives, kind of a little bit more closely now. And the risks of that are significant, right? But I think it comes back to that initial point that we’ve mentioned, which is about relying kind of solely on technology and not being quite critical of the results or sceptical or curious, et cetera.
Jonny Coleman: And I see a lot of firms now kind of complimenting screening checks with a requirement to kind of open source searches as well to kind of compliment those, that kind of triangulation piece kicking in. So yeah, definitely increase in those types of conversations more recently.
Eloise: Yeah, I think that’s really interesting. The regulator has highlighted to us the risks of over-reliance on technology. And this is exactly the sort of thing that they’re talking about. And I have had interactions with firms in recent months where they failed to identify peps and their reasoning for failing to identify them is that the screening result was clean. And I must say here, this was not a first ML screening platform.
But the clues were there. The clues were there in the name that perhaps that clear result was not accurate. You know, there were threads there that should have arguably been picked at to investigate a bit further, as you say, to remain curious. But from a behavioural point of view, and I’m really interested in this side of things that it’s slightly off topic, but the mindset shift required when you’re checking technology or scrutinizing technology and its outputs versus people and their outputs, because I think there’s a real mindset shift with you’ve been given something that’s been drafted by your trainee or your SDR Johnny or whoever it is, versus you are checking something that’s been produced by technology, be that AI or something else. And whether you have almost like a confirmation bias in your brain already. And there’s quite a conscious shift, I think, that people need to make to properly scrutinize that because there’s an assumption that, oh, like the tech’s not gonna be wrong.
Eloise: I think it’s like an over-reliance on clean screens because it’s comfortable, right? And it’s what you want. You really, I mean, arguably you don’t, you want accurate information, but the behavioural element within a human wants the clean screen, the green tick, the no outstanding actions, right?
Jonny Coleman: Yeah, I think that’s the, it comes down to that desire piece, which probably stems back from time and lack thereof again, isn’t it? Like if it’s completely clean, then I kind of want that and I will take it and maybe not scrutinize it as much as I should do. But I mean, you mentioned about kind of clean screens before Eloise, is, yeah, is that something that kind of you see quite a lot in your kind of audit stuff? Is that, I mean, we obviously we get firms that come in and we talk about situations that are trying to maybe move away from or change, but we don’t often kind of see clean screens coming out in the evaluation process, which feels pretty logical actually in terms of it not being a point conversation for us as a tech provider.
Eloise: Yeah, it’s interesting. Obviously a lot of conversations I had around, you know, volume and noise and, you know, I have conversations with firms where I say, well, look, if you treat everything as high risk, nothing’s high risk. Cause you know, you’ve just got this, this swamp of work and what really needs to stand out isn’t standing out because you know, you’re capturing too much. And I think the reverse of that is this clean screens thing. And, and, and a firm, you know, you said to me recently, well, we don’t, you know, we don’t get anything. Don’t get anything, don’t get anything surfaced. Don’t get these flags. That means we’re great. And I was like, does it?
Instantly I was like, I’m not terribly comfortable with that assumption there. Like my mind instantly went to, well, why are you getting nothing? And I wouldn’t expect you to be getting nothing from my experience and what I see and my different interactions with different tech providers. But for the firming question, they don’t have that wider context. So it was only when I started probing them that you could see they were thinking, oh, maybe it’s not good that we have all clean screens because if absolutely nothing is surfacing, that’s no better than everything surfacing. Cause you know, again, there is going to be something in there that’s not, that’s lurking that you’re not addressing.
Jonny Coleman: Yeah, very much. So I think, I think it’s about being realistic as well, isn’t it? And using, using your, your, your professional judgment in a situation like that and not being, yeah, not being kind of lured into that, that false sense of security around, yeah, it’s completely clean and that’s kind of what I want. And, you know, just take, taking that step back and going, actually, is that, is that a good thing that we’re not getting anything here? Maybe we should be getting something.
Eloise: Yeah.
Jonny Coleman: I think just having that level of consistent due diligence, I guess, and curiosity and intrigue applied across, yeah, across not on your whole kind of framework, but also the technology you’re using as well, is something that’s going to be increasingly critical as we move through the next couple of years.
Eloise: Yeah, and I think that’s easy. Being, you know, being realistic and being fair, it’s much easier to see those sorts of things as outside eyes, either, you know, in my capacity as a consultant or, you know, your capacity as a, as a vendor. I think it’s easier for us to, to, to see and raise those flags with firms and say, well, actually, that thing you think is a good thing might not actually be a good thing and have you thought about X, Y and Z? And I think that’s the significant role that, that those in reg tech play in these conversations. And I think you guys have so much value to add because of how much you see across the market, different providers, different firms, different issues that are being encountered and how they’re being challenged.
And that’s where the value really gets, really gets added by the reputable tech providers. And I do want to stress that in this episode, we’re not talking specifically about your product in relation to all of the points that we’re raising today. We’re talking about tech and reg tech generally.
And I’m loathe to criticize LinkedIn because it feels like, you know, criticizing my favorite child. But we do need to be mindful of all of the talk that’s out there in respect of tech and tech providers. And those that say, actually, we know all of the problems that you’re having. And if you could just spare us 10 minutes, we’ll give you a demo on how to fix all of those. And I think we do need to be realistic about some of those messages that are coming out and making sure that the information that we are absorbing from the tech sector is coming from the reputable providers that truly understand and have the experience of working directly with firms and compliance managers and MLROs to address these issues. Because I think, you know, if I turned around to you and how long have you been working in this sector?
And I said, so you know, every firm’s problems, right, Johnny, and you can fix them all with your product and it’s going to be really quick and easy. You know, you’d give me a realistic answer to that.
Jonny Coleman: I would, yeah. I mean, I think that’s another topic altogether about kind of reliance on RegTech providers to inform kind of compliance-based decisions. I mean, not all RegTech providers are created equal, first and foremost. And yeah, you shouldn’t be really relying on what a RegTech provider says in relation to kind of deep compliance questions and areas of like kind of quite rich expertise.
I think there are, and the other side of it is with the RegTech landscape, there’s certain providers that fix or solve certain issues and there’s certain providers that solve other issues. And I think it’s about, yeah, understanding which one fits into the situation and set of problems that you’re trying to solve for, I guess would be a really good kind of starting point for this because I mean, some are really, really relevant for certain areas of law, you know? Some are really great at conveyancing and some are really great at other kind of, other areas completely. And I think it’s understanding at least initially kind of where they fit into that kind of ecosystem would be a good starting point.
Eloise: Yeah, definitely. And I think any reputable provider will welcome the scrutiny and the in-depth questioning and the not taking everything that they say at face value.
Jonny Coleman: Yeah, very much so. And I think that’s a really good point is how firms interact with you when the questions do get kind of rich and deep and going into some real detail. That’ll be a good indicator for firms when they’re evaluating tech companies, how they respond to that, if they’ve got that information readily available, if it takes quite a long time to pull it together, like those will be those kind of, I guess risk indicators, aren’t they? And in every essence of, yeah, how kind of entrenched that company is in the legislation and the world of compliance.
Eloise: Yeah, absolutely. It is risk indicators and it’s for that reason, firms need to be having RegTech risk assessments in place in respect of the vendors that they’re using. So they have that documented audit trail of what the product does, what it doesn’t do, whether it meets the needs of the firms and how and why that decision has been made, where there are any potential gaps in how those might be plugged by additional pieces of tech or manual processes or supplementary requirements that sit alongside the tech. And then keeping that reviewed on an ongoing basis.
And I wanna talk to you about outsourcing of judgment. Okay, so I think, oh, I wonder if there is a perception that responsibility in relation to the adequacy of tech and RegTech, assisting in meeting your compliance obligations, whether there’s essentially been like a shift of responsibility from NLROs, NLCOs firms to the vendor almost, because what I see since moving into consultancy is sometimes there’s that perception that once you’ve got that, and then you have in some ways subcontracted out your legal and regulatory obligations to that third party.
Eloise: And surely there must be like a tech equivalent with that. Do you see that? Do you speak to the people within a firm you’d expect to be speaking to? Do you speak to MLROs and other firms or do you mainly speak to heads of risk? Like how does that relationship build? And do you feel as a vendor that the appropriate amount of weight is handed over to you in terms of this like compliance piece?
Jonny Coleman: That is an interesting question.
Eloise: There was a lot in that, sorry.
Jonny Coleman: There is quite a lot in that. Yeah, I’m gonna try and tackle it as you spoke. Yeah, I’m gonna try and tackle it. I’m gonna tackle it as you spoke it. I don’t think we get the same kind of responsibility handover that you do as a compliance consultant, which I feel is probably quite natural for you to use the experience that more than we do. I’d actually probably go as far to say we probably get more scrutiny, I would say, as a direct opposing position to that.
So yeah, I think we’re probably on the other side of that scale, I would say. In terms of how do these conversations evolve and who do we speak to and who get access to different people in the room, in the last 18 months, I think the, we call them committees, like steering committees or buying committees have increased significantly. So we are now meeting, I’d say at minimum, irrespective of the size firm, there’s kind of five to seven people that we’ll have a conversation with along the way.
In terms of who we speak to more often, I would say it’s probably more heads of risk are the kind of people that we converse with in more detail. MLROs and MLCOs we do speak with, I guess, sometimes, but they’re kind of coming quite later on in the discussions, which I think, I think that makes a lot of sense to me as well. So if like, you know, the outside guidance says that MLROs’ primary responsibility is receiving disclosures and submitting trials, et cetera, et cetera. I think we also couple that with in a lot of kind of mid-sized firms, I think there’s still quite a significant pattern that MLROs are still holding like a full-time fee earning role as well. And because, you know, times about to have time thing as well, it’s incredibly stretched if you’re then asking that person to also evaluate technology and viability and all of the detail orientated conversations that need to take place when evaluating technology.
So yeah, we definitely speak with more heads of risk, I would say. I actually really like speaking with heads of risk. It’s a real benefit to us as a reg tech provider because I think they’ve got more of a wider perspective on things, so they’ve got a wider lens. And they’ve got, I guess that is vision really, isn’t it? To see how things like modern tools can future-proof the entire firm, how it can improve like commercial activities, custom experience pieces, like they’ve got that kind of wider perspective. So yes, speak more with heads of risk, but yes, it’s a good thing for us as a vendor.
Eloise: Yeah, that doesn’t surprise me. And I think, as you say, it’s not necessarily an issue that the MLRO and the MLCO are not involved in those conversations, but I think the outcome of the conversations, the assessment process, the implementation process, the ongoing assessment of whether the product continues to meet the firm’s needs and aligns with the firm’s risk appetite. If you don’t have that written down, what knowledge does the MLRO and MLCO have in that regard? Because you’re not gonna be wanting to go in and have a two-hour meeting and sit down and be like, right, so this is everything that’s changed. That written document can actually front-load a bit of time, but save you time in the long run, I think, and it would capture and address this issue, which I see, and you must see even more, like a lack of understanding as to what a product does and misaligned expectations as to what they want a new product to do.
I sit in front of firms and they’ll say, no, it doesn’t do that. And I think, well, actually, yes, it does. But it’s a set-up issue, or they’ll tell me categorically, it does do something that actually I’m like, no, it doesn’t do that. Do you realize it doesn’t actually do that? And because they don’t have that record from which to build on it, and you probably see that even more when people are comparing products to your product.
Jonny Coleman: Yeah, I think what we see quite a lot is firms that thought a tool either did one thing and then found out that it didn’t a bit later, or they bought a tool for a specific use case and then tried to apply it across a different wider array of use cases. So bought it for convincing and then tried to apply it to a corporate commercial, for example, and found that it broke down in those areas. So I think we probably start our conversations with that, hey, we’ve got this tool and it doesn’t do this and it doesn’t do this and we need it to do X, Y, Z. That’s where our conversations originate, I’d say. I think that document they’re referring to would be a really, really good piece of work for most firms to take on is to have something like physically documented with what it does, what it doesn’t do, one of the risks along with that, what its application, what its use case is today, where it might be applied in future, et cetera, where it might grow and scale to, to give that kind of benchmark. So if you are evaluating, you’ve at least got something to start with, something quite formal and definitive to start from.
Eloise: Yeah, I think that framework, that these guardrails are so important. I think it will make the subsequent assessments and reviews much less labour intensive, because ultimately, when it comes down to accountability, where a reg tech out her fails to meet the standard or becomes under scrutiny, that accountability piece sits with the firm and can they justify that they adopted a reasonable position? And I think it’s really important to remember that it’s impossible to foresee everything that might happen and might change. I mean,
Eloise: I’ve implemented tech solutions, feeling reasonably confident that I had a good handle of what I needed and what issues were gonna arise, but things are a moving feast and they change. And what works for you at the point of onboarding will not necessarily continue to work for you in six months, nine months, 12 months or more, not because there’s a problem with the tech, not because there’s an issue with your firm, just that things have moved and they haven’t remained aligned from when you originally on-boarded and you dealt with your setup. I’m thinking about things like ongoing monitoring alerts. I know when I on-boarded tech, like I massively underestimated how many ongoing monitoring alerts by centralized team we’re gonna get to filter through. Massively underestimated that.
So that was like quite an immediate change to the process that was required after onboarding. Yes, everyone felt better that we had, ongoing monitoring alerts set up, which wasn’t something that we had had previously, but that goes back to that illusion of control point, because they’re not doing anything. If no one’s looking at them and looking at them promptly, fuzzy matching or like, what’s it checking and what is it not checking? What if your risks change and the parameters for escalations need amending?
That’s the sort of thing that these documented risk assessments will set out. And then you can justify either why you’re happy that they continue to meet your needs or why they might need to change. You might have file review data that indicates that actually there’s a problem with this. We’re having more issues than we foresaw we were gonna have. And therefore we need to make a tweak to our setup, our workflows or like the rules in your platform.
And then that decision is justified based on data. And I think with the direction of travel with the regulator and future regulators, that data informed change is gonna be really, really important.
We see things in the press, we hear things at conferences, we obviously, we do things like these, what’s the buzz episodes. And I think there’s a really great dialogue in the compliance community generally, that we share issues. And sometimes you hear something and you might think, oh, that could affect us. We, you know, that might be a gap that we have. And going back and like revisiting these conversations and making sure that everything is still aligned with what you thought it was is really important. And I think that sits with the firms to drive that process. They’re gonna need help from the tech providers to maybe sense check some of it. But I think firms need to be driving that process to be able to justify their confidence that they’ve placed in the product. Do you think?
Jonny Coleman: Yeah, absolutely. I think it’s a really, really critical kind of part but I think there’s a role that Red Tech can play in this space as well, which is making it a little easier for firms to be able to do that. And a lot of that comes with, it’s transparency, I guess, isn’t it? Transparency and detailed-ness of kind of process taken, data sources used, and probably helping some firms along with that. But yeah, I do think firms should hold responsibility for this and start, if not already, creating these documents and these decisions and outcomes and having a bit more of a stable platform, I guess, to continually evaluate, I guess, yeah, suitability or viability of process and the tech within that.
Eloise: Yeah, because we talk a lot, you know, I’ve been delivering training to a firm only this morning and we’re talking around source of funds and client matter risk assessments. And we talk a lot about this, you know, did you adopt a defensible position and can you evidence that?
But that conversation doesn’t always seem to happen in the context of tech. And I think that’s what we’re really getting at here. Is the confidence that you’re placing in the tech defensible? Is it built on strong foundations? And I guess from your perspective, you know, the information, I mean, you might provide it automatically when people are looking at your product, but the information that you provide to both prospective customers and customers on the explain-ability, the auditability, you know, what sits behind what your product is producing for firms, how transparent it is, like, does that come up as an important point of conversation as much as you would expect? Or do you find that you guys are actually, you know, leading with that?
Jonny Coleman: It’s something we lead with. So it’s quite hard to say whether it would come out organically. I imagine it would actually with the firms that we, deal with and work closely with, they’re very detail orientated. I think what we do as a firm is to be as clear and as transparent as we can. So we’ve got a load of like collateral and public facing kind of information on data sources and certain types of checks, what it does, what it doesn’t do. And I think that’s a role that we take on as a responsibility for us to be very forthcoming with. So I think it’s quite hard to answer that question on whether the firms are raising that or whether First ML are kind of prompting the conversation, but one way or another, First ML provides a lot of detail around that. I think the other side of kind of specifically what First ML does, we’ve got robust kind of teams of, you know, onboarding specialists and custom success teams, which, so you’ve got kind of points of contact to support with that element.
I think there’s probably a few things that I would say around, yeah, around that piece, which is if firms or reg tech firms specifically have these kind of processes documented checks that take place, but also like that information surfaced within the tool and in a format where you can then utilize that for defensibility or auditability at later stage. That’s the kind of stuff that you want to be evaluating as a law firm is, you know, do I have this information first-hand before I make the decision? Is that information being surfaced in a way that I can then reference and save and draw down on for defensibility at later stage? I think there’s, yeah, there’s probably responsibility on both parts, both law firms and reg tech providers to ensure that that piece gets covered, whether or not a law firm is the one that instigates the conversation, I would say.
Eloise: Yeah, because that audit trial piece is so important. It’s not just what’s captured and what’s surfaced, what’s surfaced, but why and what sits behind it and what’s underpinned it, you know? And I think that is like just as crucial as it surfacing in the first place, like why it’s surfaced, where it’s, you know, the provenance of the data that’s come to that before you then add in the human layer of what’s happened, why, you know, any mitigation put in place, the decisions made.
I think that’s really important.
Jonny Coleman: Yeah, I agree, I agree entirely. And I think it’s that visibility piece, right, that we spoke about earlier. I think it’s all about kind of transparency and visibility. And I think leading tech providers are supporting that, what is quite a gap at the moment, but what I will say is in a lot of the conversations that we have with firms, it’s visibility or lack of visibility is one of the key issues that come up in the conversations that we have. So you can’t be defensible, you can’t explain anything if you’ve got blind spots, if you’ve got a fragmented view, which naturally creates gaps, therefore you can’t, then evidence said gaps because you’ve got nothing to kind of base that decision. So things like escalation pathways kind of being documented and taking place, you know, meeting with client in person and verifying their ID in person and that taking place outside of a kind of a system that’s all this, well, like, et cetera. I think visibility is probably the kind of foundation in which defensibility is then built upon.
And I think firms are very much recognizing that now that, you know, having four different systems, for example, poses visibility issues, having, you know, varying degrees of identity verification take place, and that being quite open forum across the firm, again, poses gaps. So what I will say is a positive is, I think the general theme of conversations is that the visibility piece has been recognized as a bit of an area of focus for firms. And then if you solve that visibility issue, that’s when you can create robustness and create controls and increase the compliance, kind of, you know, hubs on top of that as foundation, I would say.
Eloise: Yeah, absolutely. I think that visibility conversation is probably one of the most prevalent conversations that has been happening probably since the announcement last year about the proposed change of regulator. I think that really brought the conversation to the fore. And I think once you nail that and you have the data available to you, you can then use that to direct where your resource needs to be spent, your attention needs to be spent, how many escalations are you getting through certain channels? Is that more than you’d be expecting or less than you’re expecting? If that’s less than you’re expecting, or even if it’s more like what tweaks do you need to make?
Is there training issues that are unidentified there? Do you need like an additional escalation layer before it gets to your MLRO or head of compliance to try and do a bit of a triage system, maybe with one of your senior analysts? Like you have the data to push the function forward in an informed way.
Jonny Coleman: Yeah, 100%. And that’s where a lot of this I find is quite difficult for a lot of firms is because you kind of don’t know what you don’t know in some cases. And like going back to that screening is that example that you brought up earlier. The theme that I’ve seen recently is a lot of compliance professionals that actually know what’s going on with the screening. It’s handled by the matter teams. And I actually don’t have like full visibility into the way that they’re kind of remediating screening hits, whether they are false positives, et cetera. So I think that’s becoming a really interesting area which you can then build a very, very kind of robust compliance program on top of. If you’ve got access to where the gaps are, that’s the first step, isn’t it? You kind of understand where things are falling between the cracks. Or maybe I’ll take in place.
Understanding that is first and foremost the first step towards assessing where do I apply my time or where can I fix this process or if it needs fixing it essentially.
Eloise: Yeah, and before I jump into, we’ve got a couple of questions, but before I jump into those, to sort of go full circle as to where we started, I think the question we posed at the beginning, is Regtech giving the illusion of control and confidence? Is it just making us feel more compliant or is it making us more compliant? I think the confidence is not necessarily misplaced, but it’s not defensible in a lot of firms.
They can’t say why they’re confident in their systems, in their tech, in the setup of that tech. Cause I do really want to just stress, it’s not just what you’ve got, it’s how you’ve got it set up and how you use it and how you extract the data from it and use it to push forward your strategy and your compliance and risk function.
Because it can’t be static, risk isn’t static and how you’re dealing with it internally can’t be static. But I think what underpins the confidence is lacking in quite a few firms. And so they couldn’t really explain it. It’s not necessarily that they’re wrong to be confident in the tech that’s there, but they certainly don’t have that documented in a way that would make sense. And obviously when auditors go in and we know the buttons to push and the questions that firms normally struggle to answer, I can predict with relative certainty the ones that are gonna trip people up. Because it is quite a common issue, like that’s what I’m seeing. I don’t say that again with judgment, but I do see firms struggle to explain what their product is doing for them and not doing for them. And occasionally I get very confident answers that are not true.
Jonny Coleman: And it’s the, I guess from kind of a reg tech perspective, what is the solution to that? Like what do these firms kind of need to do in those situations where they’re confident in the technology they’ve got doing one thing and it may be not quite doing what they, what is the solution to that problem?
Eloise: Yeah, I think what I always talk through my friends that have that problem is, to go back to basics, to go back to this, just start off with quite a basic framework of a risk assessment with reference back to the technology section of LSAG, the SRA guidance on technology, and slowly start to build it out. Because once you starting anything like that always feels like the worst step, but once you start it, the questions flow from it and you can start to populate it with reference to your firm wide risk assessment.
Actually it doesn’t do that, but if you look at our firm wide risk assessment, we don’t really have any exposure there. So the fact that that product doesn’t do that isn’t necessarily an issue for us, but we need to bear in mind that if we change to this practice area or this work type, that that would have to be revisited in advance. And I often find that when firms have a visual on that sort of thing, the understanding clicks much better and you have it in front of you and the questions that you need to ask and maybe the additional checks you need to make with your provider become more apparent.
They start to surface themselves. I’m obviously gonna say a risk assessment is always a good idea. But they’re so helpful in like formulating your thoughts, giving structure to what and where you need to be worried. And this isn’t about identifying every single potential possible risk associated with using tech in a law firm. This is where should we be looking and where are we potentially like most exposed?
And it links in nicely actually with the question that we have been, we’ve been posed by the live audience. How often do you recommend firms should meet with their reg tech suppliers to explore, test and challenge how well the reg tech is working?
We probably have slightly different views on this. I don’t know. I’m interested to hear what your like customer journey looks like from a first AML perspective. But I think it will depend on, you definitely wanna be reviewing any risk assessment you have in place once a year.
But you also want to be reviewing it on any relevant changes if there are changes to the LSAC, when there were changes to the UK sanctions list consolidating back in January. Maybe, you know, the government guidance that was updated in relation to reg 28 back in February, where there are relevant triggers, I’d want to be revisiting that document and touching base with my reg tech provider like client contact or whatever they’re called to make sure that your assumptions because that’s what we’re all doing, right? We’re making an assumption that, oh yeah, yeah, yeah, they’re on that. They’ll be all over that. But actually have you checked? Have you got that confirmation and have you documented it? But from your perspective, how does that work? And how does that evolve through the customer journey?
Jonny Coleman: Yeah, I think it’s very similar. The experience is very similar on our side that there’s kind of triggers, certain triggers that which we all are acutely aware of that will dictate when a conversation absolutely has to take place with the reg tech provider, you know, changes in regulations, sanctions, et cetera. We also see annual kind of deep dives as well. And then there’s moving more into kind of fully documented processes now where necessity for a comprehensive document detailing exactly what platform does and doesn’t do and things like that security and privacy and storage, et cetera, all form part of that annual review.
We actually, I guess it changes over the course of the relationship as well. So in the first, I would say, probably the first year during and the 12 months post implementation, there are regular, regular check-ins. So that cadence, that meeting frequency is very, very high for the first, I guess the first 12 months.
That probably then moves to a kind of more monthly kind of cadence as you get familiar with the system and you start to kind of ingrain the knowledge of what it’s doing in certain situations is becoming second nature.
There’s always an element as well on the Regtech provider, at least there is at first ML of like assessment of process and the workflow being taken as well. There’s an element that sits with on this side of that coin to kind of make sure that that’s been used effectively, I guess. But yeah, it’s pretty similar. Trigger events, really, really frequent first year, move to kind of more monthly check-ins thereafter, I would say is relatively common scenario for us in terms of interacting on an ongoing basis.
Eloise: Yeah, and again, that builds in that defensibility of the confidence that you have in the tech that you’re using, not just in terms of what you’re using, but how you’re using it and that your provider understands your firm and your exposure and your risk and your needs and is working collaboratively with you to ensure that those are met on an ongoing basis. That can all be, it’s not outsourcing that responsibility to the vendor, it’s not for you guys to absorb that responsibility, but meeting this from a regulatory perspective and being comfortable with that confidence that you’re being placed in it is gonna be escalate or enhanced with that like really strong working relationship with your provider.
Jonny Coleman: Yeah, absolutely. And I think and hope that it, this conversation, I think that the product will naturally be more frequent anyway, as we move through the kind of regulatory shift that is coming across the UK and the EU of a, and not to mention the AI kind of bits and pieces that are coming in, I think that it will naturally drive and strengthen and increase the frequency of those conversations that take place, looking at things like vendor roadmaps, what’s coming, how we’re gonna meet anything that comes out of the FCA, change over, et cetera. So yeah, very much a needed situation, but I think, yeah, the landscape that we’re in at the moment is probably gonna drive more of those conversations, which I think is only a good thing for both parties in fact.
Eloise: Yeah, and I know we’ve spoken, I mean, a common theme throughout the conversation today has been that like resource time pressure point, which, you know, we’re all too familiar with, but I do think little and often with these conversations actually does save time in the long run, like having infrequent catch-ups with your supplier with a massive long agenda to run through from your perspective, let alone what they might wanna run through from their perspective, or as you say, what’s on the roadmap and then capturing all of that and updating it and working out the, you know, the domino effect of what that impacts. I think that little and often drip, drip, drip will, is more achievable from a firm’s perspective when there is so much we’re dealing with, rather than saving it up and making that really like meaty, meeting and follow up and everything else.
Jonny Coleman: Yeah, very much so. Just two things, and it makes it easier to attend those meetings when there’s not, you know, there’s not 90 minutes worth of formal agenda items that you need to go through right minutes on and take actions from. I think the other side as well is, as well as kind of building a really good kind of working relationship, frequent check-ins kind of do that, that they provide that, you know, that situation for a close working relationship. I think it’s just easier, isn’t it, to talk frequently, but less detailed, because if you, that the repetition of conversations, and you might crawl down, you know, you’re meeting pretty frequently, but the repetitions I think is much easier for things to become ingrained within, you know, within the history bank than a huge long meeting once every quarter, and, you know, the opportunity for things to kind of, maybe be documented, hopefully, after today’s conversation, maybe be documented at least, but maybe not on the forefront of your mind, because it was a 90 minute meeting kind of, you know, nine weeks ago, rather than a check-in every couple of weeks, which is a bit lighter in detail. So yeah, I’m a big fan of frequency, but not as, yeah, not as in-depth would be a good process.
Eloise: Yeah, I just think it’s much more achievable, because what I don’t want any listeners of this to feel is, oh my goodness, I’ve listened to this, and it all makes sense, but now you’ve given me something else that I need to do, and something else that I need to find time for, because that’s, you know, that’s not what we’re trying to do here, it’s just, yeah, finding like a practical way in which to justify the confidence that we’ve got, and I think that’s what I think we’ve established is, you know, is there with our RegTech providers, and you know, especially the trusted RegTech provider, and that pretty much brings us two times. So for anybody in the live audience, the recording will be circulated later today, and it’s available on the hiverisk.com website, and the podcast episode will be available from tomorrow.
Just leaves me to say thank you very much, Johnny, for joining me today. I’ve really enjoyed our conversation, and I’ve enjoyed you letting me grill you on RegTech illusions, and not shying away from those conversations, which I think probably don’t happen as often as they should. So we really appreciate you joining us on this.
Jonny Coleman: Very welcome, it was a pleasure. Thank you, Eloise.
Eloise: Thanks very much, guys. Take care, bye.