We’ve all been irritated at having to show an address proof to get anything done. Technology promises to solve all problems, but the Know-Your-Customer regime remains resilient. After the 9/11 attacks on the World Trade Centre in the United States, it was felt that if the authorities followed the money, they could curb and control money laundering and terrorism financing. The Financial Action Task Force required tracking all money flows and identifying each participant in the chain. How well does tracking cash flows through the formal financial system work? While the world ponders this question, India should move towards a risk-based KYC regime.
Does it work?
How well has “following the money” worked in fighting terrorism? Peter Neuman, professor of Security Studies at Kings College London, has argued that small terror attacks do not require large sums of money. Even when they do, “trading in oil, antiquities and works of art, kidnappings and ransoms, extortion, and human trafficking” seem the preferred channels—most of which do not interact with the global financial system. In any case, the challenge is to identify and thwart money flows before an event—the chance of this is like finding a needle in a haystack. In fact, the more difficult it is to access the global system, the more money will be driven underground.
The cost of this, however, is paid by private institutions and citizens. Whether it is something as simple as opening an account or transacting through it, customers need to jump through multiple hoops. If one lives in a blacklisted country, receiving remittances for food and shelter through formal channels becomes a challenge. Financial institutions also come under the scanner, they must make sure all money flows are checked and all customers are verified. They incur expenditures for maintaining detailed records and accessing them when asked for by regulators. Such records would exist regardless of the requirements, but they’d be tailored as per the needs of the institution, not the regulator.
A recent survey of global banks found that a review costs between $1,501 and $3,500 – if a bank is onboarding 10,000 new clients every year, the cost of KYC alone can run into millions of dollars. As a paper by Ronald Pol, an anti-money laundering researcher, shows, FATF-based intervention has less than 0.1 per cent impact on criminal finances. Compliance costs exceed recovered illegal funds more than a hundred times over, and banks, taxpayers and ordinary citizens are penalised more than criminal enterprises. The world of underground finance may thrive even with legitimate businesses that want to escape the complexity of the formal financial system. The global system needs to take stock of the costs and benefits of the current system. Osama bin Laden is long gone. But we seem to be stuck on the high-cost arrangement of society forever.
Also read: How Sitharaman can live up to her Budget promise of KYC simplification
Surveillance state
Less talked about are the costs of surveillance. Researchers Rishab Bailey, Vrinda Bhandari and Trishee Goyal suggest that the FATF framework does not balance the competing interests of law enforcement and civil liberties. It places greater emphasis on the flow of information to combat terrorism or money laundering over the privacy interests of customers. As a result, governments have been able to get access to detailed identity information about their citizens and their financial transactions. It is almost as if the FATF has given legal sanctity to mass surveillance.
Many will argue that they have nothing to hide, and hence, what is the problem if financial institutions and, consequently the government have access to their data? The argument is fallacious because it equates privacy with secrecy. It also underestimates how seemingly unrelated actions can be put together to create a complete individual profile without the person’s consent. Eventually, how governments can use (often misuse) this is a function of the strength of data protection laws and the independence of the judiciary.
Also read: Make it easier for nominees & heirs to access money left to them, RBI-appointed panel suggests
Risk-based KYC
If KYC’s compliance and surveillance costs are high everywhere, one can be assured that India will adopt the most convoluted form possible. The requirements of the Indian KYC in the banking sector are higher than those imposed by the FATF. Banks collect all manner of data from all customers. The extent of data collected at onboarding and once again at the time of updates to KYC goes beyond just verification and could potentially be used for “profiling” the customer. It gives little pause to the actual probability of a particular customer being involved in money laundering/terrorism finance, or to how collecting as much information as one can help law enforcement. The ease with which one can open a bank account in the US or buy a SIM card in the UK even as a tourist is unimaginable in India.
The FATF does make allowances for countries to adopt a risk-based approach. That is, governments can create their framework to identify the risks they face and take appropriate measures based on their assessment. Banks need to consider various factors to assess their risk, including what their scale is, what the target market is, what customer category they are serving, transaction size of the customers. Why have banks in India not yet been able to adopt a responsive risk-based approach to their KYC? One of the core areas of reform for the financial sector in India will be establishing risk-based and proportionate data collection measures consistent with the FATF.
Renuka Sane is research director at TrustBridge, which works on improving the rule of law for better economic outcomes for India. She tweets @resanering. Views are personal.
(Edited by Theres Sudeep)