Smart Crime, Smarter Compliance: AI and the Future of AML

Transcript

I would like to um just say a couple words about our IML working group uh in Crypto Valley. Uh please sit down. Okay. Please come. I can I can stand. No, no, no. Please, please, please. Yeah. Nice. So, we uh in crypto have a lot of u working groups and uh one of them are very active. Fitz working group and I think Alexandra is very active member and Chris is co-chair with me and also we have Maria here. Maria just show yourself. Yes, thank you. uh and uh we meet at least once a month and we discuss a lot of IML uh topics and we

help each other because this industry is very difficult and we never have all answers even we have regulation and I'm really excited to manage um to moderate this session for with my great panelists today because AI is something which can really help us in the future but it also will cut off a lot of jobs and uh it will improve the quality and we can do it faster. Just imagine if now your on boarding takes uh day, months, maybe it can take seconds. Uh so and this is what I would like to uh suggest as a discussion point. What will be the future? Can we um completely

uh avoid human interaction in the future in compliance and what the role in of EI is and I suggest that we first introduce um um you you introduce yourself and then I will ask you exciting questions. Yes. Hello everyone. My name is Militz. the deputy head of the Swiss FIU, the moneyaundering reporting office Switzerland and I'm heading the international department. My name is Chris McAteer. I'm head of financial crime and digital compliance at six group. My name is Tommo. I'm co-founder of uh chainaware. We can predict everything when we get your wallet

address. See it as uh in the movie uh minority report. So 10 versus preox it's a good predict and we predict what an owner of address will do as a next is it fraud scam buying selling defi etc. We know everything my name is Alexander Lloyd and I'm the head of anti-moneyaundering at uh Hodler. Great. Um I think it's a good good combination of panelists so we can uh really debate a bit. Uh Amra I will start uh with you and um I think you work a lot with web three uh projects uh

and uh what do you think uh is the main challenges uh from regulatory point of view? Do we really see that regulation at the moment is for clients or it's for uh the regulator and how we can improve it using technology like AI? Um yes I I ask you okay but okay we start with Alexander. Yeah. Um so I think uh that sorry um I think it's been designed for a long time anti-moneyaundering um regulation and it's having to evolve very quickly with the pace of web 3 and

AI. So my my opinion is that we are still little bit in history. when we take uh web two versus web three there are uh big differences in web three we can't revert transactions first and second to set up a structure where I overplay algorithms which are currently used in AML it will take me not seven weeks like in web two it will take me two seconds and uh this is the situation that we have currently The web three is kind more complex and uh if we ask how

to protect now customers how to protect C so the customers don't fill the reports by police statement etc and never gets their money back something has to be changed it's my opinion yeah I think uh AI and agentic AI is um is going to be introducing a lot of very useful tools for the compliance community. Um but I think that uh like everything is going to need some proper governance, some transparency and uh human touch along the way.

Um, what do you what do you what do you think u in terms of emer uh um if you don't know what embro is is um regulatory body uh which uh control uh so we report uh to embro all the uh illicit activity on suspicious activity in Switzerland and it's great you are with us here but from regulatory point of view if you uh receive uh the reports from the AI uh tool not from the human. How do you see it in the future? Is it possible that regulator or controlling bodies will uh use uh technology and accept that technology control the uh

all all the transaction and suspicious activities. So like you said we received the suspicious activity reports. there's like an FAU in every country and we've so we are not the regulators we just work with the things that come out with the outcomes um and uh here I can say is we see the results so we don't see has this report been AI driven or was it made manually because it's all being handed in by an own system that we have so but what we can see is uh and there is a sometimes in with some financial inter there is a trend that they do some automated

report systems. Uh what I have to say here different to many other countries we are suspicion based reporting office. So for us we should not receive or we do not receive reports just because they overgo a threshold with us the financial intermediary that who reports really has to have a suspicion on that. So if it's been AI generated or human based for us it makes no difference just the result that comes to us if we can work with it or not and then I have a question uh how often uh for example you receive uh reports from Swiss entities for example um yeah we receive so last year we

received around 7,000 uh 17,000 reports so also for us I think uh the workload the data load food and the quantity is something we also have to handle and we struggle with. I wonder you need AI here for this. No, but and that's why we are really reliant on good reports. So whatever the financial inter uses in beforehand before sending it to us we don't see it uh we can kind of think what they did but yeah we just get the number the quantity and then we have to go work with it. So what what I can hear that uh we don't have any hindrance to start using more tools uh and if it's

efficient uh uh from your point of view is also you know for you it's important we report but the way we do it is technology neutral from a from an FYU point of perspective yes because uh we need to see what did the financial intermediary think of when he did the investigations and where is the suspicion where is because we working on a crimebased approach there needs to be a crime behind it. Uh and also with terrorist financing, it does not help if we receive a report. Okay, there is suspicion go for it and look after yourself how you can. So we really depend on that how they get it. It's up to the financial intermediary. Very very interesting. It is like uh it it has to

show that uh something already happened. But in in crypto, my opinion is we have to prevent transactions before something bad is going to happen. That's the ideal world also for us because then we wouldn't receive the the reports. Yes, those are the reports. We don't receive all your reports. You want to put her out of a job. So we received the reports when the the transaction happened or when somebody tried to open an account and they refused to open it. So those are the two possibilities. But in general we don't receive reports and say we did everything right because if you take our technology we can say you this address with this probability is going to do as next whatever. Yeah we can say

he's going to do scam or fraud or rpool or good stuff. And the the issue is we we do transactions and then after transactions oh something bad happened it's too late and we have to stop it before it happens and uh the issue is not just that we have a compliance and regulators it's about users we if new buyers come to the sector and uh they face this uh kind of uh engineered fraud they leave the sector and then we are surprised why crypto is not growing.

It's not growing because we don't offer protection mechanism to customers. I'm not talking about um financial intermediaries. I'm talking about customers. Well, I absolutely agree what you say the prevention is the best thing that it has to be stopped before but in an that like you say that I think that's an ideal world. It's never going to happen. There's no fraudulent payment or no uh criminal payment. But then it's our job when it's being detected that we go after Titan and Yeah. And what do you do? You you saw something bad happened. What do you do afterwards?

Well, that would be a very long discussion. I think we only have 40 minutes. Um but uh yeah, I I think we focus on the preventing and uh recording the um not right behavior and then it's will be maybe uh you have a seminar, right? You have a workshop with us. Yeah. crypto symposium in November just yes and uh we we can go into more details another session but because uh now we have a statement that we can prevent uh future transactions Alexander and Chris it's question to you you have a quite big organizations where you have to report a lot of list activity where you see the challenges to implement or if you already implementing something

like this um well one thing certain because we are systemically important. We are you know we have a duty to take a look at it but we also have to be very careful when we roll out new technology. We have um very robust um you know testing systems governance around any kind of software or any kind of new processes or procedures that we would implement. So of course we're looking at AI AI agents. We're really interested in it. um everybody's very excited about the possibilities of improving transaction monitoring of facilitating onboarding and all these different elements but I think we we are also at the same time as we're looking at what can we do with agents we're also looking

at what does good governance look like how does governance have to change how do we ensure that whatever model be it an let's say an agent how do we make sure that the agent is very clearly explainable and that uh the the compliance user can understand the logic of the decision that was given or rendered and so can a regulator or an auditor. So we are um considering all the the the different aspects of um of rolling out but essentially where we see the biggest use case is is certainly um in in a bit the the middleware layer because we have um embedded quite a few different SAS

softwares. I think just myself on the crypto side um to process a transaction we can use anywhere up to eight different SAS tools and some of them speak to each other some of them have API connections between themselves and they are aggregated but otherwise a lot of sometimes the data points are siloed so having sort of an agent come come on top of that and um and aggregate and create a narrative for the compliance officer to then execute or make a decision a little bit easier uh is definitely something that we're excited excited about and we're looking into um but also at the sort of more micro level um just getting the the team to to to think about how to use AI on a day-to-day basis to make their jobs

easier that doesn't have to be like a big sledgehammer. It could be just a little little knife for example um you know we know that the first line has a hard time not hard time but doesn't always give us the fir the best quality documentation for onboarding. So putting together an FAQ based on the repeated questions um can help them, you know, better understand the work that they have to do. So just getting our our team to think about where can I use AI effectively um without having to roll out um a whole system is is another option that we're exploring as well.

Chris, may I ask a question? How important is for you to explain what uh why a transaction is bad or why you reject central? You cannot rule out a a system that you don't understand how it got to that answer. And what do you do if you can't answer it? you can't use this system with with the way that the regulations are set up, with the way that people expect to be treated with the AI act um and with data privacy law, humans have a right to understand how a decision was made if it's been automated. And also just from an internal point of view, um you wouldn't take on a new employee who

can't tell you any of the thought process that went into their decision-making to blocking a customer's account or freezing their funds. If you're cheating an agentic AI as your new employee, you have to have that explanability, that XAI built in. You can use systems for feedback if there wasn't, but you definitely couldn't use it to make the ultimate decision. I mean many of us are operating. It's not the AI use is novel in compliance or AML in financial industry or crypto. Many of us have already been using pattern recognition AI or AI to detect um uh deep fake imagery, AI in in validating documents, AI in transaction monitoring

or just plain automation. So it's not the AI the use of AI is novel the use of a agentic AI which can make decisions based on aggregating that data. It's really crucial to have explainability at least as well especially when you're operating in the Swiss environment and the EU environment and most of us are we see sorry we see a really good example of that already in practice when we think about blockchain analytics. We may not understand the proprietary algorithms and detail of chain analysis and elliptic and TRM. Um but we do know that we you know if they come up with a risk we have to be able to say that we played a role in generating that risk. So that means that we've worked with that company. We've gone through the the risk different

elements. We've given our we've reflected our own risk appetite as an institution into the model to be able to say okay uh if you're getting exposure to um to human trafficking or if you're getting exposure to casinos we want this result. So when we get u a 98% or a very high risk for a particular address we have a sense of where it's going and we can explain it even though we don't understand all the intimate details of how the algo works. And it's the same thing with aentic AI. You have to be able to say okay uh it's detected suspicion in this onboarding. What's the reason? Do I agree with it or not?

Yeah. Um my my impression by aentic AI is that we require uh from aentic AI more than from traditional banking platforms that we have in Switzerland. Is it from UBS, Venova, Teros or Ravaloc or smaller ones? Reality is that in this huge banking platforms if somebody ask how the transaction is processed answer is we don't know and now when we take uh AI then from AI we suddenly require that AI has to be explainable but in our legacy banking platforms which is the base for all Switzerland to

explain a transaction processed We don't know. And and here I I see it like we we set too high uh requirements or too high um restrictions for new technologies and we don't consider our legacy banking platforms. I I would say that and Michaela can correct me if I'm wrong here, but if uh if I was working not at a crypto platform and at a bank and as the head of anti-moneyaundering, I could not explain to her or anyone at FINMA or MROS how the system worked, I would be in quite a bit of trouble and probably facing some hefty fines. Welcome in the cloud. But um I do think that it's the advantage of AI and this is something

that's being built in is that much the same way when I was still working as a designer I put pockets in every piece of clothing I designed to increase the utility. You can design the AI with explanability in mind. Like it's mathematical proofs. It's not necessarily I mean obviously at a certain point it has to be translated into human but it's just asking the AI to leave an audit trail of its decision- making and if you are a reg provider building an AI that should be a fundamental design like framework of your design that is something that is going to be requested of you because a there's still a a high

level of distrust in AI we You hear about, you know, Bank of America being fined millions for their anti- fraud detection system falsely alerting and and freezing the c the bank um accounts of many customers like that. This is not some sort of far-off scenario. Even just using their the LLMs, we hear of false positives, hallucinations. So there's an element that it's irresponsible to leap into such a new technology without having that we we can't go into it trustless at this point in time. We need to know that there there is biases being trained into AI there. So and these can

be magnified with algorithmic um uh with increase of those original biases. We need like without knowing the training data because we can't ask that of our providers. you need to at least be able to follow the decisions unless you're developing it inhouse which I would say is not going to be the practical and efficient model many of us relying on more and more service providers uh and it makes sense because they're specialists and here when you talk that it's better to have a decision which is um like you can uh just implement which is already existing not create from scratch your own Here I have the question about data transfer and

attic ethic of the you know because you the other um program and platform collect your data how how about it how you will uh solve this situation uh with privacy and u may it's question for all of you. Yeah, privacy in blockchain is very simple. You are anonymous. Uh when you are anonymous and data is public uh all this legislation don't apply. It's you. So what you're saying we don't uh have any issue with data transfer. Uh when data is public data, you can uh calculate you can do you can

uh but we're talking about web three, right? Yes. In our real world, how we can manage it with uh you know like six accepting payments or uh holder accepting payments uh which are just uh uh they need to know the transaction and it's uh still web web two uh environment. Uh is it still possible or to use AI in in this regards? Absolutely. it is uh you need a different legal entity who is uh doing calculations and uh then it's all legal uh yeah maybe I would like to a bit turn our discussion to the way of efficiency um we are in Switzerland

let's talk a bit about uh of Swiss way to doing crypto business and compliance u do we really report enough in Switzerland uh this illicit activity or we uh how How is about other uh countries where we are in this um uh global landscape? Yeah, we had this pre discussion was about discussion. Um well uh some of you might have read it. There is this national risk assessment on crypto. Uh we did an analyszis on the Swiss market and based on like the numbers with quite a lot of VASPs in Switzerland. I think

we agree on that and based on the numbers compared to our let's say neighbor countries the number is quite low why we don't we don't know there might be several explanations I don't want to just say this is the right one and this is the wrong one um like what I I just maybe want to come back and break it down maybe also for a nonIT specialist the in the discussion that you had before um for me this AI based information uh gathering and everything when you are a compliance office in a bank correct me if I'm wrong you got an information you got an information package you got a oint research an open source intelligence research you got newspaper articles and

then you get many more things and this may be one of those things but then in the end there's some professional judgment that says okay we report we do not report for the moment I would assume I would say so that's for the most of us um if there's anyone in the room who doesn't do it I'm very interested to talk afterwards Uh so but that was something that interested me a lot to to breaking it down a little bit to a very basic level or in the end there has to be someone who says press the button this is going to be reported over a system that works for everyone. Um so that was just uh why I was very curious about that information. Concerning the reporting in quantity, what I can say is um we received around 250 reports which is based to around 17,000 quite a low

number. Um the number I just took it out today from the system is not appearing to be much higher by the end of this year unless uh something's going to um change. uh but what we see is like only VASPs related reporting but what we see is the number of reports that include cryptocurrency payments they go out quite a lot so there we had over 1,000 and that's what we see in the neighboring countries and those who also have vasp in a similar setup um they have quite a lot of a high number and it doesn't mean that's what I also want to say it's not that it's a bad place only because a lot of reports arrive at an FIU. This is also it has to be made

clear. And another thing what I heard before I just want to say it if a report if an account is being reported it's not being blocked. That might be because I heard it and not that anyone goes out of here and thinks as soon as a report is uh a bank account is being reported to the FAU it's being blocked. No, it's it's not because otherwise it will be a tipping off then. Yeah. One of the one of the elements that we discussed um you know in the in the preparation for this this panel was was exactly this topic and and I was just telling Michaela that I that I really appreciate that we that we can have this discussion because this is something that um you know context matters and and

details matter. I think if you look at the surface and you and you say why are Swiss FASPs reporting or not reporting um you know it may be easy to look at um at neighboring countries and and sort of make a comparison but the the reality is that we've had a framework for crypto for quite some time. So we all know or anybody in the compliance space would know that the FATF came out with definitions in 2018. They came out with guidance in 19. um FINMA adopted that guidance in in its its its own guidance uh quite quite a few months later. So basically as of August 2019 um VASPs within Switzerland had the obligation very clearly to implement quite a few um control mechanisms um within the

compliance space and the enforcement of that came not much longer um not much later sorry about a year later. If you wanted to apply for membership at an SRO, you had to be able to demonstrate compliance with FINMA's guidance for um for VASPs specifically as it relates to transaction monitoring. So um for example, you had to be able to showcase that you had a system in place for the travel rule and that you were able to identify um private wallets and that you were doing due diligence on private wallets. And this is quite some time ago already in 2020. We've been talking about this. We've been implementing all of these elements and this is very relevant because you know you're doing this due diligence at the front end.

You're doing it Excante. You're really taking a look at the transactions. You're whitelisting the addresses. You're doing a risk assessment of the address even before you make the transfer. Even before you make the transfer, you're also transmitting the information via travel rule to the counterparty who's doing their assessment, etc., etc., etc. So, a lot of the bulk of due diligence happens even before the transaction takes place. And then just let me finish. Yeah. So then once once that's done then you can have more certainty that you are not going to engage in risky business. But the converse um situation has happened in our neighboring countries where a lot of VASPs have had maybe some compliance um processes and procedures in place for

onboarding. They've been doing transaction monitoring expost, but they haven't done the bulk of the transaction or the compliance due diligence before the transaction takes place. And this is why we have within our VASPs for the for the large part. I'm not saying it's a perfect system, but generally speaking, our VASPs, our systems, um, our services are very robust from a compliance perspective. And this is what we've also been trying to convey globally when we try to attract new business to Switzerland. Yes, we have a regulatory hurdle that's higher than other jurisdictions. So, at the first glance, it may seem like it's a deterrent, but actually we've been able to create um an environment that's that's quite robust um and and where investors um can be

certain that the infrastructure is is um sound. Sorry, this is beautiful what you say that uh by prevention we do it before it happens and this is what uh cleans up the crypto ecosystem that we can protect the end users. So we we we have to check transactions before they happen and not afterwards. It's beautiful. Yeah. Well, if yeah uh if I can just add here the thing is not about that. I think that there's a little bit of misunderstanding that you think if you if the vast would report more they would be worse than they are now. I think that's not the point because also

banks they also do their job but still the number of reports is raising. I think uh as Switzerland is very neutral when it comes to technology or they all follow the same rules and as Switzerland is part of the whole global network, the risk is still there because the payments come in and out from outside and even if you have countries where the standard may not be high, it comes in then we have the same risk imported or then exported. So I think this should be just kept in mind and this is something we just take a look at uh when we look at why are numbers lower, higher or raising or not raising. Yeah, I agree. Agreed.

Um I think we also have to bear in mind that um obviously we're talking from a crypto mindset as we are at this conference here in the crypto valley conference, but actually um and and I've seen this in a lot of u of rooms with complant talking with compliance professionals in the space. Um, a lot of the actual suspicious activity is is no longer or not or happening on chain at least for the centralized FAPS um and CASPs dealing with fiat currency. I would say a a large like proportion and at least from the discussions is happening in traditional finance in in stolen card details in you know um card details scraped off the internet in the

and sold on dark marketplaces. It's actually happening. You have a transaction that's fully three-factor authenticated and by all means comes from the bank has been okayed and then later you get a charge back. you receive a charge back from the bank in instead of a fraud claim which is s slightly um um incorrect filing. But uh this this is happening more and more or you see just traditional um scams that are happening on the like before it's even come on chain. And so it the use of agentic AI while it's great that we can use platforms like yours to um to examine behavior on chain and wallets on chain the use of aentic AI is really powerful

when it comes to looking at on boarding profiles scanning that for how old the addresses of um the email addresses are have they been made in the same day as the account and this sort of profiling because this off-chain behavior which is the point at which in many cases the scam is actually taking place. We have no visibility on. The power of blockchain is that we have chain analysis, we have elliptic, we have TRM, we have chainawat, we can we can see which uh addresses have been sort of marked as tainted, we have um uh uh started coming together as a community to kind of share this information in a way. And the advantage of blockchain is that we can do it in a

semi- anonymized way where just the wallets are shared. When the European data protection authority now saying that wallet addresses themselves are PII will make that more interesting but so what I can hear we uh we do use AI and AI but we do it fragmental we use it fragmentally at the moment. So it can be on boarding. It's classical standard on boarding. It can be for transaction monitoring somehow or even for reporting maybe in the future we can just press a button and we don't need to do all this paperwork because it's just go automatically to embro for example. The question is uh from starting from today let's say next two three years or five

years how you see the developments where we will see the most changes and how it will influence uh what type of the employees we have to what type of professionals we have to have in the organization. maybe a couple advice to our audience uh where to look for you know what we should expect and where we need to focus in next uh let's say two three years uh you uh knowing that uh there is a AI revolution going on and because we have only four minutes left I I suggest each of you just give a bit of uh summary uh your advice uh to how we should use the technology in the future.

and where we see the risk or advantage. I'll go first. Um so I think the the answer is that I hope in the next few years we've talked about the fragmented systems. Um the power of a Genti is that it can combine these predictive AI models, these these validation models, these um large language models to to generate um requests and and that we should see the systems get less fragmented hopefully while still retaining some level of explanability so that when I'm sending a report to Michaela about my suspicion that I can actually outline to her what my suspicion actually is. Um but the key for this is going to have to be

standardization. Um we need to have we there's severe like ethical implications um in handling people's data and and blocking their financial access um and in in using this. So we need to come together as an industry with um ethical experts, legal experts, engineers, um architects, every all the stakeholders we can manage to really start building frameworks especially because in at this stage we have we've already experienced the chaos of different regulations just even in the AML and crypto space. It's only going to get more complex as we start introducing different regulations in the AI space. So we really need to at

this moment where we're at the sort of inception baby stage even though it's actually been going on for 20 30 years at this point we really need to come together as an industry or as multiple industries even to discuss okay where is it appropriate to use AI where is it inappropriate where can automation be used instead uh AI has a much higher cost here to discuss as industry I don't think we should create new assessation just focus on AI CDA can uh lead the way we We can handle it please. For Swiss financial platform, all Swiss financial platform, the sooner we start using AI agents for compliance which integrates all these different information sources,

the stronger our financial platform gets. It can become a competitive advantage for the Swiss financial platform. So, let's do it. I would say that we we can't ignore it. it is is it's here and we need to adopt it. Um but I would encourage um especially the larger larger regulated um institutions to um consider the various options that are available in terms of types of of AI solutions. You don't have to use an agent. you can really use some of the, you know, more easily accessible solutions just to make the the life of the compliance officer that much easier and uh especially the life of our first line of defense and sales teams um that much more efficient.

Um and maybe switch compliance eventually um and hopefully step by step from a a cost center into um you know a business promotion um and value adding center. Yeah. So uh for us as I said at the beginning we rely on the quality of the reports come in. So whatever good work is being done before no matter how uh is good for us. So we are also looking forward to the improvements and the developments and whatever is coming up here. But we the last hires we had is data analyst just to say because you said what do we have to look for also for us it's getting more and more. Yeah.

Great. So you have open job positions probably now. Yeah. Yes. but not for data analysts at the moment. Okay. Okay. Fairfield. Daniela, Chris, Tamro, Alexander, thank you so much. Um, I think we have 30 minutes 13 seconds left. If anyone have questions to us, uh, we're open. Um, please, I would like to transaction, your access to apps, your access to bank account. Tell me how much over 500.

I'd like to ask you why you not taking away your freedom of being. Who would like to answer? Why don't we meet for coffee afterwards? Sounds good. Okay. Thank you so much everyone.