Anti-Money Laundering, Counter Financing Terrorism and Cybersecurity in the Banking Industry : A Comparative Study Within the G-20

Despite massive investments in mitigation capabilities, financial crime remains a trillion-dollar global issue with impacts that extend well beyond the financial services industry. Worldwide, there are between $800 billion and $2 trillion laundered annually with the United States making up at least $300 billion of that figure. Although it is not possible to measure money laundering in the same way as legitimate economic activity, the scale of the problem is considered enormous. The cybersecurity landscape is always shifting, with threats becoming more sophisticated all the time. Managing risks in the banking and financial sectors requires a thorough understanding of the evolving risks as well as the tools and practical techniques available to address them. Cybercrime is a global problem, which requires a coordinated international response. This book outlines the regulatory requirements that come out of cyber laws and showcases the comparison in dealing with AML/CFT and cybersecurity among the G-20, which will be of interest to scholars, students and policymakers within these fields. Felix I. Lessambo is Adjunct Associate Professor at Fordham University, USA, where he teaches Corporate Tax and Audit & Assurance Services. He was an Associate Professor at Central Connecticut State University School of Business where he taught Financial Statements Analysis, Global Financial Reporting, and Law & Finance. He has practiced international tax, transfer pricing, and alternative investment management where he structured and advised on hedge funds and private equity cross-border transactions Acknowledgments Disclaimer Contents Acronyms List of Figures 1 Money Laundering and Combating Finance Terrorism 1.1 General 1.2 Money Laundering 1.3 Money Laundering Cycle 1.3.1 Placement 1.3.2 Layering 1.3.3 Integration 1.4 Combating Financial Crimes 1.5 International Money Laundering organizations 1.5.1 Financial Action Task Force 1.5.2 The Office of Foreign Assets Control 1.5.3 The Financial Crimes Enforcement Network 1.5.4 The Asia/Pacific Group on Money Laundering 1.5.5 The Egmont Group of Financial Intelligence Units 1.5.6 The International Association of Insurance Supervisors 1.5.7 The Association of Certified Anti-Money Laundering Specialists 1.5.8 ComplyAdvantage 1.6 The Failure of the Current System 2 The Cybersecurity Counteroffensive 2.1 General 2.2 History of Cybersecurity 2.2.1 1920s 2.2.2 1930s 2.2.3 1940s: The Time Before Crime 2.2.4 1950s: The Phone Phreaks 2.2.5 1960s: All Quiet on the Western Front 2.2.6 1970s: Computer Security Is Born 2.2.7 1980s: From ARPANET to Internet 2.2.8 1987: The Birth of Cybersecurity 2.2.9 1990s: The World Goes Online 2.2.10 2000s: Threats Diversify and Multiply 2.2.11 2010s: The Next Generation 2.3 Types of Cyberattacks 2.4 Cybersecurity Risk vs. Traditional Risk 2.4.1 Application Security 2.4.2 Cloud Security 2.4.3 Infrastructure Security 2.4.4 Internet of Things (IoT) Security 2.4.5 Network Security 2.5 Cybersecurity and the Banking Industry 2.6 International Cooperation 3 AML/CFT, Cybersecurity and International Organization 3.1 General 3.2 AML/CFT International Organizations 3.2.1 The Financial Action Task Force on Money Laundering (FAFT) 3.2.2 The International Money Laundering Information Network (IMoLIN) 3.2.3 Financial Action Task Force on Money Laundering in Latin America (GAFILAT) 3.3 Cybersecurity in International Organizations 3.3.1 The Council of Europe: Action Against Cybercrime 3.3.1.1 Mutual Legal Assistance 3.3.1.2 Direct Cooperation with Service Providers 3.3.1.3 Trans-border Access to Data 3.3.1.4 Human Rights Safeguards 3.3.2 International Criminal Police Organization (INTERPOL) 3.3.3 International Telecommunications Union (ITU) 3.3.4 United Nations Office of Drugs and Crime (UNODC) 3.3.5 The Organization of Economic Cooperation and Development (OECD) 3.3.6 G8 24/7 Cybercrime Network 3.3.7 The Internet Society (ISOC) 3.3.8 The International Cyber Security Protection Alliance (ICSPA) 3.3.9 International Association of Insurance Supervisors (IAIS) 3.3.10 International Organization of Securities Commissions (IOSCO) 3.4 An International Strategy 3.5 Cybercrime Conventions 3.5.1 The International Cybercrime Treaty 3.5.2 The UNDOP International Treaty on Cybercrime 3.5.3 African Union Convention on Cyberspace Security and Personal Data Protection 4 AML and Cybersecurity in Banking Industry: Challenges 4.1 Overview 4.2 AML and the Banking Industry 4.3 Cybersecurity in the Banking Industry 4.4 Core Cybersecurity Risks in the Banking 4.4.1 The Compromising of Confidential data 4.4.2 The Compromising of Data Availability or Systems 4.4.3 The Compromising of Data Integrity 4.4.3.1 Personal Security of Individual Members Accessing Their Accounts 4.4.3.2 Security of the Tools to Access Their Clients’ Accounts 4.4.3.3 Internal Team Control as They Access Your Back-End Servers and Internal Network 4.5 Ensuring Cyber Security in Banks 5 AML/CFT and Cyber Security Laws in the United States 5.1 General 5.2 AML/CFT Laws 5.3 AML/CFT Legislations 5.3.1 The Bank Secrecy Act (aka the Financial Recordkeeping of Currency and Foreign Transactions Act of 1970 5.3.2 Money Laundering Control Act (1986) 5.3.3 Anti-Drug Abuse Act (1988) 5.3.4 Annunzio-Wylie Anti-money Laundering Act (1992) 5.3.5 Money Laundering Suppression Act (1994) 5.3.5.1 Section 402 5.3.5.2 Section 404 5.3.5.3 Section 405 5.3.5.4 Section 406 5.3.5.5 Section 407 5.3.5.6 Section 408 5.3.5.7 Section 409 5.3.5.8 Section 411 5.3.5.9 Section 412 5.3.6 Money Laundering and Financial Crimes Strategy Act (1998) 5.3.7 Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act) 5.3.8 The USA Patriot Improvement and Reauthorization Act of 2005 5.3.8.1 Section 352 5.3.8.2 Section 326 5.3.8.3 Section 312, 313, and 319 5.3.9 The National Defense Authorization Act for Fiscal Year 2021 (NDAA) 5.4 Cybersecurity Laws 5.4.1 Comprehensive Crime Control Act of 1984 5.4.2 The Computer Fraud and Abuse Act of 1986 5.4.3 The Electronic Communications Privacy Act of 1986 5.4.4 The Health Insurance Portability and Accountability Act (HIPAA) of 1996 5.4.5 Intelligence Reform & Terrorism Prevention Act (2004) 5.4.6 The Cybersecurity Act of 2012 5.4.7 Cybersecurity Enhancement Act of 2014 5.4.8 The Infrastructure Security Services Act of 2015 5.5 Federal Cybersecurity Laws in the Banking Industry 5.5.1 Federal Cybersecurity Laws 5.5.1.1 The Gramm–Leach–Bliley Act (GLBA) 5.5.1.2 The Sarbanes-Oxley (SOX) Act of 2002 (SOX) 5.5.1.3 Payment Card Industry (PCI) Data Security Standards (DSS) PCI DSS 5.5.1.4 Cyber Events and Cyber-Enabled Crime 5.5.2 Cybersecurity State Laws 5.6 Federal Government Agencies 5.6.1 Department of Justice‒Division of Computer Crime & Intellectual Property Section (CCIPS) 5.6.2 U.S. Secret Service 5.6.3 Immigration & Customs Enforcement (ICE) 6 AML/CFT and Cybersecurity Laws in the European Union 6.1 General 6.2 AML/CFT in the EU 6.2.1 Fifth Anti-Money Laundering Directive 6.2.2 General Data Protection Regulation (GDPR) 6.2.3 The Second Payments Services Directive (PSD2) 6.2.4 Sixth Anti-Money Laundering Directive 6.3 Cybersecurity in the EU 6.3.1 Budapest Convention on Cybercrime (2001) 6.3.2 EU Network and Information Security (NIS) Directive 6.3.3 Proposed EU General Data Protection Regulation 7 AML/CFT and Cybersecurity Laws in Germany 7.1 AML Laws in Germany 7.2 Cybersecurity Laws 7.3 Cybersecurity Laws and Regulations 7.3.1 Federal Data Protection Act (BDSG) 7.3.1.1 IT Security Act (ITSG) (2015) 7.3.1.2 IT Security Act 2.0 7.3.1.3 Telecommunications Act (2014) 7.4 Cybersecurity Laws in the Banking and Financial Sector 7.4.1 Comprehensive Information and Security System 7.4.2 Well-Established Information Network 7.4.3 Regular Controls 7.4.4 Employee Awareness 8 AML/CFT and Cybersecurity Laws in France 8.1 General 8.2 AML/CFT Laws 8.3 Cybersecurity 8.3.1 Cybersecurity Laws and Regulations 8.3.1.1 The Data Protection Act (1978) 8.3.1.2 The Godfrain Law (n°88-19 of January 15, 1988) 8.3.1.3 The Law for a Digital Republic n°2016-1321 of October 7, 2016, Amended by the Law Transposing the GDPR (Law n°2018-493 of June 20, 2018) 8.3.1.4 The Network and Information Systems Security Act (“NIS Act”) 8.3.2 Cybersecurity in Banking 9 AML/CFT and Cybersecurity Laws in Italy 9.1 AML/CFT Laws 9.2 AML/ CFT Legislations 9.3 Cybersecurity Laws and Regulations 9.3.1 Prime Ministerial Decree of 17 February 9.3.2 Italian Legislative Decree No. 65/2018 9.3.3 Italian Legislative Decree No. 105/2019 9.3.4 Italian Legislative Decree No. 82/2021 9.4 Cybersecurity in the Banking Industry 10 AML/CFT and Cybersecurity Laws in Spain 10.1 General 10.2 AML/CFT Laws 10.3 Cybersecurity Regulations 10.3.1 Article 197 10.3.2 Article 248 10.3.3 Article 264 10.3.4 Article 256 10.3.5 Article 270 10.3.6 Article 273 10.4 Cybersecurity in the Banking Industry 11 AML/CFT and Cybersecurity Laws in Switzerland 11.1 General 11.2 AML/CFT Laws 11.3 Cybersecurity Laws 11.4 Cybersecurity Laws in the Banking Industry 12 AML/CFT and Cybersecurity Laws in China 12.1 General 12.2 AML/CFT Laws 12.3 Cybersecurity Laws in China 12.3.1 The Chinese Cybersecurity Law 12.3.2 The “Cybersecurity Multi-Level Protection System 2.0” or “MLPS 2.0 12.3.3 Cybersecurity Protection of Critical Information Infrastructure (GB/T 39204-2020) 12.4 Cybersecurity in the Banking Industry 13 AML/CFT and Cybersecurity Laws in Japan 13.1 General 13.2 AML/CFT 13.3 Cybersecurity Laws 13.3.1 The Basic Cybersecurity Act 13.3.2 The Unauthorized Computer Access Prohibition Act 13.3.3 The Specially Designated Secret Protection Act (Act no. 108 of 2013) 13.3.4 The Basic Act on the Formation of an Advanced Information and Telecommunications Network Society 13.3.5 The Act on Electronic Signatures and Certification Business 13.3.6 The Act on the Protection of Personal Information (APPI) 13.4 Cybersecurity in the Banking Industry 14 AML/CFT and Cybersecurity Laws in India 14.1 General 14.2 AML/CFT Laws 14.2.1 The Prevention of Money Laundering Act, 2002 14.2.2 The Conservation of Foreign Exchange and Prevention of Smuggling Activities Act, 1974 14.2.3 The Benami Transactions (Prohibition) Act, 1988 14.2.4 The Indian Penal Code, 1860 and Code of Criminal Procedure, 1973 14.2.5 The Narcotic Drugs and Psychotropic Substances Act, 1985 14.3 Cybersecurity Laws 14.3.1 The Information Technology Act of 2000 (IT Act) 14.3.2 The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules—“Privacy Rules” 14.4 Cybersecurity in the Banking Industry 15 AML/CFT and Cybersecurity Laws in South Korea 15.1 General 15.2 AML/CFT Laws 15.2.1 The 1995 Act on Special Cases Concerning the Prevention of Illegal Trafficking in Narcotics, Psychotropic Substances and Hemp (ASPIT) 15.2.2 The 2001 Proceeds of Crime Act (POCA) 15.2.3 The Prohibition of Financing for Offences of Public Intimidation Act (PFOPIA) 15.3 Cybersecurity Laws 15.3.1 Act on the Protection of Information and Communications Infrastructure Information and Communications Network Act 15.3.2 Personal Information Protection Act (PIPA) 15.4 Cybersecurity in the Banking Industry 16 AML/CFT and Cybersecurity Laws in Indonesia 16.1 General 16.2 AML/CFT Laws 16.2.1 Indonesia OJK Regulation No. 12/POJK.01/2017 16.3 Cybersecurity Laws 16.3.1 Electronic Information and Transactions Law 16.3.2 MoCI Regulation 20/2016 16.3.3 GR 71/2019 16.4 Cybersecurity in the Banking Industry 17 AML/CFT and Cybersecurity Law in the UK 17.1 General 17.2 AML/CFT Laws 17.2.1 The Economic Crime (Transparency and Enforcement) Act 2022 (ECA 2022) 17.3 Cybersecurity Laws 17.3.1 Computer Misuse Act of 1990 (Amended in 2006) 17.3.2 The UK Data Protection Act of 1998 (as Amended in 2018) 17.4 Cybersecurity in the Banking Industry 17.4.1 The NatWest Case 17.4.2 The HSBC Bank Plc Case 18 AML/CFT and Cybersecurity Law in Canada 18.1 General 18.2 AML/CFT Laws 18.3 Cybersecurity in Canada 18.3.1 Personal Information Protection & Electronic Documents Act (PIPEDA) (2005) 18.4 Cybersecurity Laws in the Banking Industry 19 AML/CFT and Cybersecurity Law in Australia 19.1 General 19.2 AML/CFT Laws 19.3 Code 19.3.1 The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 19.4 Cybersecurity Laws 19.4.1 Telecommunications (Interception and Access) Act 1979 19.4.2 Privacy Act 1998 (Amended 2017) 19.4.3 Assistance and Access Act (AA Act, as Amended in 2018) 19.4.4 Consumer Data Right 19.4.5 The Security of Critical Infrastructure Act 2018 (SOCI) (Amended in 2021) 19.4.6 The Consumer Privacy Protection Bill (CPPA) (2022) 19.5 Cybersecurity Laws in the Banking Industry 20 AML/CFT and Cybersecurity Laws in Russia 20.1 General 20.2 AML/CFT Laws 20.3 Cybersecurity Laws 20.3.1 The Federal Law No. 152-FZ Dated 27 July 2006 “On Personal Data” (the “Data Protection Law”) 20.3.2 The Labor Code of the Russian Federation (for Personal Data of Employees) 20.4 Cybersecurity in the Banking Industry 21 AML/CFT and Cybersecurity Laws in Turkey 21.1 General 21.2 AML/CFT Laws 21.2.1 Law No. 5549 on the Prevention of the Laundering of the Proceeds of Crime 21.3 Cybersecurity Laws 21.3.1 The Constitution of the Turkish Republic 21.3.2 The Data Protection Laws 21.3.3 Internet Law No. 5651 of 2007 21.3.4 Law on Electronic Communication No. 5809 (“Law No. 5809”) 21.3.5 Turkish Criminal Code No. 5237 21.4 Cybersecurity Laws in the Banking Industry 21.4.1 Banking Law No. 5411 22 AML/CFT and Cybersecurity Laws in Brazil 22.1 General 22.2 AML/CFT Laws 22.2.1 Law No. 12,683, of July 9, 2012 (‘Law 12,683/12’) 22.3 Cybersecurity Laws 22.4 Cybersecurity in the Banking Industry 23 AML/CFT and Cybersecurity Laws in Mexico 23.1 General 23.2 AML/CFT Laws 23.3 Cybersecurity Laws 23.3.1 The Mexican Constitution 23.3.2 The Data Protection Law 23.4 Cybersecurity Laws in the Banking Industry 24 AML/CFT and Cybersecurity Laws in Argentina 24.1 General 24.2 AML/CFT Laws 24.2.1 Resolution 30-E/2017 on AML/CFT 24.3 Cybersecurity Laws 24.3.1 Privacy and Data Protection 24.4 Cybersecurity in the Banking Industry 25 AML/CFT and Cybersecurity Laws in Saudi Arabia 25.1 General 25.2 AML/CFT Laws 25.3 Cybersecurity Laws 25.3.1 The Anti-Cybercrimes Law of 2017 25.3.2 The National Data Governance Interim Regulations of 2020 25.4 Cybersecurity in the Banking Industry 26 AML/CFT and Cybersecurity Laws in South Africa 26.1 General 26.2 AML/ CFT Laws 26.2.1 The Financial Intelligence Centre Act, No 38 of 2001 (The FIC Act) 26.2.2 The Prevention and Combatting of Corrupt Activities Act, 2004 (PRECCA) 26.2.3 The Protection of Constitutional Democracy Against Terrorist and Related Activities Act, 2004 (Amended in 2021) 26.3 Cybersecurity Laws 26.3.1 The Protection of Personal Information Act 4 of 2013 26.3.2 The Cybercrimes and Cybersecurity Act (2021) 26.4 Cybersecurity in the Banking Industry 27 AML/CFT Compliance and Audit 27.1 General 27.2 AML Compliance 27.3 CFT Compliance 27.4 AML/CFT Audit 27.4.1 Internal AML/CFT Audit 27.4.2 External AML/CFT Audit 27.5 The AML/CFT Compliance Index (AML/CFT CI) 27.5.1 Basel AML Index 27.5.2 The Global Organized Crime Index 28 International and Regional Cooperation 28.1 General 28.2 Cooperation and exchange of information in AML/CFT 28.2.1 In the Authorization Process 28.2.2 In the Ongoing Supervision 28.2.3 Regarding Enforcement Actions 28.2.4 Confidentiality Treatment 28.3 Cooperation and Exchange of Information in Cybersecurity 28.3.1 The OECD Approach 28.3.2 The International Telecommunications Union (ITU) 28.3.3 The European Union Agency for Network and Information Security (ENISA) Glossary of Terms Bibliography Index