With the event focusing on Compliance Convergence: Where Fraud, ESG and Corruption Intersect, Emily participated in the panel to explore how compliance professionals can navigate the evolving regulatory landscape. Among others, the discussions highlighted the growing importance of supply chain due diligence and the need for a dynamic approach to managing emerging AML and ESG-related reputational risks.

Along with her expertise, Emily shared insights and use cases from Sqope Intelligence’s experience to highlight the importance of supply change due diligence.

The investigation came just one year after the WSJ initially reported on the US Federal Reserve’s scrutiny of that bank’s methods for investigating its high net worth and ultra-high net worth (HNW and UHNW) foreign clients and a half year after the newspaper reported that this investigation expanded to include the US Securities and Exchange Commission (SEC), Office of the Comptroller of the Currency (OCC), and other Treasury Department offices.

The bank, which acknowledged having weak AML controls, marked 24% of its wealth management accounts as high risk for money laundering. Furthermore, as early as 2022, an internal risk team found that 60% of international accounts that advisers tried to open had errors, including missing documents and overstated income.

The issue was clearly systemic – the bank did not invest adequately into its AML procedures and prioritized the speed of onboarding new clients over proper vetting practices.

Beyond the documentation issue mentioned above, this was further evident in the lack of Spanish speakers within their vetting staff and low pay for temporary Spanish speakers working in the Baltimore office despite the number of customers in high-risk Latin American jurisdictions being onboarded and courted.

In addition, according to the WSJ, the bank had significant bottlenecks in their AML procedures, which led to the delays in the proper approval processes for thousands of accounts, witht which the bank proceeded regardless of insufficient and delayed vetting. Even basic Google searches — which should be considered a bare minimum requirement for due diligence checks especially for higher risk clients — were not conducted.

Although it’s difficult to determine the number of individuals onboarded by the bank amid the AML failures, the WSJ highlighted the cases of (1) an al-Qaeda (AQ) linked individual, and (2) a Canadian national claiming to be a Romanian princess with a net worth of over USD 5 billion.

Both accounts were open despite glaring red flags and, considering some of the high risk jurisdictions from where the wealth management branch’s clients hailed, there were likely countless other customers that should have never been permitted to open accounts.

To the bank’s credit, since 2022 they have clearly taken significant strides in order to course correct. Indeed, they placed various restrictions on at least ten types of clients, shuttered thousands of accounts in mid-2023, pulled back from high risk business in Latin America, and, in July 2024, announced that they recruited a new head of global financial crimes. Finally, the bank is also investing heavily in technology to increase their efficiency in conducting KYC checks and to address the relatively easily fixable issue of paper documentation that helped contribute to some of the AML inadequacies.

While this particular story focuses on one bank, they are certainly not alone in facing hurdles in properly vetting HNW and UNHW clients, particularly those with foreign nationality and especially those connected to higher risk jurisdictions. Such individuals pose unique challenges, including the breadth of language skills that a compliance team must have for adequate vetting, poor access to official records pertaining to related businesses, or even the inability to independently confirm the veracity of such documents.

These individuals often have an increased likelihood of exposure to multiple jurisdictions with extensive personal and business networks that often include other high profile individuals. In other words, they are at higher risk of exposure to sanctions, corruption, political connections, and even organized crime or terror financing. Of course, alongside these difficulties, compliance teams also face internal pressure to expedite the process so that the client can be onboarded.

It is precisely these sorts of challenges that outsourcing due diligence solves. An experienced enhanced due diligence consulting firm has the trained, expert analysts with the language skills, regional and local understanding, and vetted global sources necessary to provide a comprehensive, 360-degree picture of an individual or company.

A firm like Sqope Intelligence provides the intelligence you need, particularly on complex, difficult cases for which internal teams often lack the experience, time or other resources. With over 15 years of experience, a team of highly trained and experienced analysts who speak over 20 languages, our own proprietary source database and a network of nearly 100 investigators globally, we have the ability to paint a clear picture of your client or prospect, allowing you to make an informed decision on who you want to onboard.

The list of 24 countries includes three others from the Middle East and North Africa (MENA), namely, Yemen, Syria, and Algeria, the latter of which was also added in October during FATF’s plenary session.

Lebanon’s addition comes just under a year after FATF’s Mutual Evaluation Report, released in December, that specifically commented on the risks from Hezbollah, although it wasn’t named and, instead, referenced as a “major local paramilitary organization”.

The report also noted high-level corruption, tax evasion, trade based money laundering risks, illicit trafficking, and smuggling, among others that are intimately connected with the terror financing risks associated with Hezbollah. Indeed, I discussed exactly this during my recent presentation alongside Baker Regulatory in the Channel Island of Jersey.

It further listed various gaps in Lebanon’s regulatory framework.

This includes the scope of coverage of money laundering predicate crimes, a lack of regulatory independence, poor monitoring for financial crimes, a commercial registry with no requirement for criminal records checks on company founders, and a lack of disciplinary measures against Designated Non-Financial Businesses and Professionals.

The report addressed deficiencies in enforcing existing AML/CFT laws due to a lack of resources, as well as ineffective beneficial ownership identification and poor international cooperation, especially with regards to terror finance and other financial crimes.

Lebanon also faces systemic issues arising from banking secrecy, which is in turn facilitated by the cash-driven economy.

This is not to say that the FATF hasn’t acknowledged the efforts made by Lebanon to address the above and also the significant challenges faced as a result of the ongoing armed conflict with Israel.Indeed, it granted Lebanon two years, instead of one, in order to address the issues raised during the grey listing.

While all such listings impact a country’s financial sector through various means, including damaging its reputation and investment prospects, raising transaction costs due to additional compliance requirements, and causing losses in correspondent banking relationships, among others, we anticipate that the impact on Lebanon will be particularly strong. This is in light of the financial crisis that the country has been facing since 2019, which already impacted its global reputation, reliability, ease of doing business, and other metrics. Furthermore, the conflict with Israel, as well as the high risk for terror financing exposure when conducting business with Lebanon, has served to deter foreign investment.

This, along with the political stalemate and lack of resources, indicates that there is a high risk that Lebanon will struggle in addressing its shortcomings, something well recognized by the global financial sector and demonstrated by FATF granting Lebanon that additional year to address its gaps. Despite this leniency, the international community will likely see Lebanon’s prospects as too low and begin even further reducing business and investments there.

Our main takeaways include:

1. Different terror groups and types embrace varying modus operandi when raising funds across the Middle East and Africa. Institutionalized groups are challenging to detect and use financial institutions to channel funds internationally.
2. Far-right extremism in the UK and Europe is on the rise. Such extremists, for example, utilize social media to circulate information to UK rioters with the aim of promoting violent disorder.
3. Financial institutions need to closely monitor client onboarding and transactions for terror financing red flags. Stringent, systematic, and enhanced due diligence is essential to mitigate this risk.
4. Companies need comprehensive training to identify the warning signs from those funding terror groups and acts, an appreciation of how such groups are spending their money on, and knowledge of how to spot it.

A critical component of customer due diligence (CDD) today depends upon search engine results obtained by compliance via manual keyword searches or tools that conduct similar searches at scale. This reputational check relies heavily on media coverage, database indexing, and the efficiency of search algorithms to provide the connection between what the user is searching for and what the content creator was trying to transmit.

That said, over the past decade, this research has been complicated by “filler content”, especially ads, paid content posing as “articles”, broken links, dead landing pages, fake and misleading content, but also – and particularly important for due diligence professionals — amateur journalism that can also appear as social media posts, blog posts, as well as AI-generated content pieces.

Search engine results use a combination of perceived relevance (due to the prevalence of keywords) and popularity of sources (due to their “click-rate”) in order to decide on the hierarchy of listed results.

This situation creates a feedback loop of self-reinforcing rankings, as higher results obtain more clicks, thus remaining highly ranked. In response to the Search Engine Optimization (SEO) business, due diligence specialists have to leverage their OSINT expertise in order to filter through to less elevated content, while simultaneously identifying when individuals or businesses are generating positive content to misrepresent themselves or other red flags.

What are the Red Flags for Manipulated Media?

In the past, curating an online persona or manipulating one was time-consuming and costly, with those seeking to do so often using PR companies with the expertise to monitor sentiment, make a realistic persona, and ensure it be at the top of the search results.

AI tools for generating content becoming widespread at a low cost has made this process easier while allowing for increasingly complex attempts at manipulating KYC screening tools and methodologies. Indeed, AI offers the possibility to create large quantities of tailor-made content in increasingly plausible tones — as their imitation of humans improves with every prompt from their users — something that human-led PR companies could previously do only with extensive resources and costs.

AI-created “news” or social media posts can serve to raise doubts as to the true identity of the individual. For example, when investigating connections between a wealthy individual and their discreet investments in the Persian/Arabian Gulf, abundant AI-generated content could “flood” the internet with reports of their passion for “Persian cuisine” the individual’s review of “Prince of Persia”, or even their purchase of a Gulfstream private jet, thus curating the results . This might sound bizarre but such simple approaches are not uncommon and the fast generation of content can easily outsmart the capacities of screening tools or even smaller compliance departments with more limited resources and funding.

Fake personas

The majority of private financial and government institutions use screening tools designed to automatically filter out individuals based on identification data, name variations, and declared jurisdictional exposure (countries of residence, company registration information, business sectors, etc.). Such tools rely on pattern recognition and, therefore, can often be misled by even expected variations in identification information, including variations on names and name spellings, including transliterated versions and date, such as differing formats or slight adjustments to the month or year, as well as by the above discussed purpose-driven content intended to mislead the algorithms.

One clear indication of suspicious activity manifests as results involving several individuals with identical or similar profiles, including name variations, professional backgrounds, country and/or city of origin, and so on. The purpose of what can be largely fake profiles tailor-made to match any negative online content is to create plausible deniability for the real subject of the search query.

One example would be Irish citizen James Bernard Smith, who was wanted in the US in 1990 for drug trafficking. AI could be used to create personas with the same or similar name, which would make it unclear who was the actual person on the wanted list. In other words, instead of being James Bernard Smith, it could perhaps be Jim Smith, Jimmy Bernie Smith, or other variation mentioned in in intentionally misleading blog posts, social media accounts, forums, or even less legitimate news articles criticizing Washington’s “War on Drugs”, calling for legalization, alluding to their criminal records, or even pretending to solicit the purchase of drugs online.

Such entirely fabricated posts can and are used to confuse KYC checks, which is obviously also much easier when one has a more commonly used name. Thus, someone like James Bernard Smith can use fake online personas to create doubt and claim misidentification in the database or negative news, which, if sufficiently convincing, could prevent further digging.

Moreover, in extreme cases, the above type of media manipulation can be taken one step further and can be used as part of the legal justification for why there is sufficient doubt vis-à-vis the allegations levied against the individual. In other words, evidence from manipulated media can be utilized as part of an affidavit claiming, for example, that a person was never in a particular country despite evidence or allegations to the contrary. Indeed, such affidavits can sometimes be deemed sufficient to overcome good faith KYC checks in jurisdictions with less stringent regulations and requirements.

Unflagged Promotional Content

Another way of passing through the cracks of automated screening and the “first line” of defense is via legitimate positive or neutral publicity of business activity or other innocuous reputational context, including related to philanthropy, family news, and interviews by an individual with an otherwise negative media profile. This is meant to skew the proportion of search results in favor of positive coverage, as well as to create doubt about the objectivity, accuracy, or credibility of the negative information. In this context, the positive publicity need not be false, as many mainstream or specialized outlets offer the possibility of paid marketing space for promotional or “op-ed” content.

Moreover, the credibility or popularity of such outlets lends credence to the promotional content disguised, with the exception of an often-time small disclaimer at the end, if it is present at all, as news and outweighing or at least balancing out the negative. Most targeted by such efforts are business and economic news outlets . Taking an analytical look at the tone of the “article” and the identity of the author can help highlight paid material, which is useful both to recognize bias in a day-to-day setting and for analysts digging into the media profile of a particular individual.

Who might undertake these activities and why?

Capital flight has always been common in the context of fluctuating geopolitical fault lines, leading high and ultra-high net worth individuals (HNWIs and UNHWIs) to move their assets and funds towards jurisdictions deemed safer or more tax friendly, such as Switzerland, the UAE, the British Virgin Islands, Cyprus, and Panama. Thus, HNWIs and UNHWIs from places facing political instability, insecurity, or even increasing regulatory pressure and public scrutiny look to move their funds to more opaque but “safer” jurisdictions.

Such individuals who also have questionable activity in their pasts are the most likely to engage in such disinformation in order to reinvent themselves as transparent and legal and increase the likelihood that they will be onboarded. . Indeed, regulatory frameworks across the globe, including in the common and above-mentioned destination countries, are tightening. Thus, individuals who recognize that they may be rejected sometimes look to manipulate their reputational profile, ranging from the above-discussed tactics to even changing their names, using alternative spellings, or employing aliases in order to put distance between themselves and their past.

Nonetheless, the compliance and due diligence industries have also adapted to tackle these and other attempts at tampering with reputational verification, as well as the innovative and increasingly complex methods used. Keeping up-to-date with the tactics employed and challenges faced, as well as the best ways to identify and address them is essential. Combined with a risk-based approach, compliance and due diligence professionals should aim to balance screening tools with human expertise and in-depth analysis to identify the kind of red flags that tech can continue to miss. Indeed, with increasing such examples seen in recent years, professionals rely on Sqope Intelligence with these precise scenarios, trusting our team to help identify the facts and support their KYC process.

The first event was held on May 29 in Geneva with Managing Director of Europe Roi Lavi and Intelligence Manager Matthew Walker and the second occurred on July 2 in Monaco where CEO Ilana Krancenblum joined Roi and Matthew.

With Sqope Intelligence discussing KYC tools to identify exposure, including case studies and direct solutions for regulated professionals, our partners from De Gaulle Fleurance covered the legal aspects and impact for the Monegasque sector.

The grey list includes 20 other countries, with Monaco being the third European country to be added to the list alongside Bulgaria and Croatia.

The FATF announcement comes as no surprise and follows a January 2023 report from the Council of Europe’s AML body, MONEYVAL, which assessed Monaco’s compliance with FATF recommendations made after a March 2022 on-site visit to the country. The recommendations led Monaco to adopt new laws and regulations to strengthen its AML and CFT measures, including new reporting rules for banks and other financial institutions, as well as improved information sharing between domestic regulatory authorities.

While MONEYVAL and FATF recognized Monaco’s significant progress and its efforts to address the gaps highlighted by FATF, the country ultimately fell short of its goals and failed to make adequate changes to prevent illegal financial flows, with the country often viewed as a destination for such activity.

In response, and in order to be removed from the grey list, Monaco created a reform schedule to be implemented by January 2026, with milestones in May and September 2025. Some of these planned reforms include enhanced investigations and prosecutions, confiscation and recovery of illicit assets, further strengthening supervisory systems, and additional improvements to the sharing of information both domestically and internationally.

When it comes to reactions to the grey listing, these vary significantly from country to country. Much of this list is comprised of developing nations with some even in the midst of armed conflict, of which many ultimately remain grey listed long term due to inadequate steps taken to achieve removal. As a result, statistics regarding the negative economic impact of this designation doesn’t accurately apply to Monaco, which represents a stable and safe financial hub that attracts ultra-high net worth individuals (UHNWIs).

Thus, while countries with this designation often see a changed perception of risk among international investors, with a decline in confidence leading to a reduction in investment and demands for higher returns to compensate for this perceived risk, the economic impact on Monaco will be mitigated, much as it was in the case of the UAE during its own, albeit short tenure on the grey list.

Also like the UAE, the fact that the Principality has already made notable strides to address the FATF recommendations and has concrete plans and deadlines to close the remaining gaps further suggests that investor confidence will not be significantly harmed to a point of the country losing business.

That’s not to say that the Principality won’t feel any impact of the grey listing and particularly the enhanced scrutiny that comes hand in hand with such an FATF designation. This is liable to manifest in higher operational costs and additional procedures for local and international financial institutions operating in or transacting with Monaco. Likely examples include an increased need for actors there to apply enhanced due diligence (EDD) to comply with MONEYVAL recommendations and for external parties to apply similar EDD processes to address differing requirements for grey listed countries. At the same time, penalties from Monegasque authorities for non-compliance will also intensify.

Perhaps most importantly, Monaco will need to demonstrate that it is actively working to improve its AML and CFT policies, including by meeting its stipulated deadlines for implementing reforms, in order to preserve what we assess to be the initial and limited impact of the grey listing.

FIs/NBFIs operating in offshore jurisdictions have the more onerous task of KYC for pre-existing and new clients that are predominantly not domiciled in the same country and therefore come with their own unique context-specific risks.

Notable triggers for KYC refresh projects stem from a myriad of factors, including the implementation or removal of sanctions, changes to regional PEP designations, and mandated reviews on “riskier” customers, to name a few. Operationally this continues to be the norm; but external pressures for ongoing maintenance are made more complex by politics, an increase in customers with a more “universal” level of exposure, and/or stemming from riskier countries.

With sizeable market shifts in the wake of the current sanctions’ climate, customers’ commercial activities have been forced to pivot and diversify in response.

As an example, those that had sizeable exposure to Russia pre-2022 or even pre-2014 have largely faced reputational and regulatory pressure to shift assets or divest resulting in new sectoral and regional exposure that may not have existed at the time of their onboarding or last review.

In this vein, customers with such exposure also likely require ongoing monitoring to ensure that any continuing operations or connections in or to Russia are within regulatory law and are not proxy to other interests. Indeed, conducting targeted and periodic due diligence reviews on such clients is necessary to demonstrate compliance to regulators.

Sanctions exposure and the risk of sanctions circumvention is only one such factor. Geopolitics can similarly affect the risk profile of clients. In just 2024, there are unprecedented incidences of elections in 64 countries and multiple changes to governments are predicted. As a result, reviews on pre-existing customers are critical to ensuring their respective risk profiles are up to date, their political exposure assessment remains accurate, and possible knock on effects that result from political changes are considered in a customer’s geographical risk evaluation. In particular, an understanding of public and private sector interactions in places with weaker oversight is paramount to fully grasp the risks associated with individuals that have notable political exposure, whether they are PEPs themselves or are unflagged but regularly interact with government agencies, state owned enterprises (SoEs), or other entities that have political links in the countries in question.

A new phenomenon, particularly in UK offshore jurisdictions (Channel Islands and Crown dependencies), is similar and rising oversight from regulators as onshore locations. In this vein, FIs/NBFIs domiciled in offshore jurisdictions face their own unique challenges, namely, balancing compliance requirements while remaining attractive destinations for complex ownership structures and trusts. The result is an elevated need for beneficial ownership identification, which can be cumbersome in terms of the often sizeable operational costs and manpower required to perform a comprehensive review.

Due to their diverse client base, offshore FIs/NBFIs are largely conducting KYC on clients with connections to countries that may be more unfamiliar to employees with compliance functions. This is of particular concern in reference to political exposure and PEP designations in more opaque jurisdictions and can have implications on the accuracy of KYC refresh projects when one “doesn’t know where to look” and significant risk indicators can be missed.

Barring the challenges related to jurisdictional and sectoral exposure, attempting to ascertain source of wealth in areas with less access to information poses multiple risks, including in the form of proxy holdings and illicit sources of funds. Data transparency remains an area of concern, with opaque low- and middle-income countries (LMICs) now producing more high net worth individuals (HNWIs) than ever before. Areas without a centralized commercial registry or more limited press freedom hampers accurate identification of corporate holdings and informed reputational risk assessments.

Given the nature and complexity attached to KYC performed by offshore institutions, it is not feasible for FIs/NBFIs to hold targeted expertise in every region, particularly around countries’ unique risks vis-à-vis data transparency, political environment, and the robustness of AML frameworks. Internal KYC processes may not be effective or contextually cognizant of risk indicators connected to a customer’s commercial activity and geography, referring back to the above-noted challenges of jurisdictional and sectoral exposure. Additionally, a client’s global exposure is often not immediately obvious and can be difficult to discern, even after gathering documentation from the customer, which can lead to a misclassification or underestimation of a customer’s risk profile.

Indeed, the ongoing and persistent need for KYC remediation processes can be burdensome on resources to FIs and NBFIs, particularly amid the ever-changing political situations, increasing globalization of assets and activities, and the related complexity and context that requires niche understanding. This can be mitigated by increasing the knowledge of those engaged in the first line of defence and having robust options for outside expertise on the variety of complexities, from jurisdictional risk to sanctions and money-laundering typologies to implications of political exposure within the local context. This can significantly alleviate operational and reputational risks that could ensue if KYC remediation projects are not carefully conducted.