Never Miss a Red Flag: Is the Standardisation of Due Diligence the Way Forward?
Due diligence roundtable from James Swenson, Sylwia Wolos, Laura Austin and Eddy Leviten
Due diligence has long been a thorny issue for the investment migration industry, with scandals reported in the media repeatedly suggesting that the depth and breadth of checks on applicants, their family members and the origin of their funds vary significantly. In 2019, the Investment Migration Council, in coordination with BDO, Exiger and Refinitiv, formed a Due Diligence Working Group to examine to explore the potential for minimum standards across the industry. The working group published two reports which aim to address the issues that arise from a lack of harmonised standardised and can be downloaded from the IMC website. The experts agree: The best due diligence is not only about gathering information and data, it is also about harmonising the system of checks and balances that different stakeholders in the investment migration industry have in place.
How would you describe the current state of play of due diligence in the investment migration industry? And what would you highlight as the most important recommendations of the due diligence reports published by the IMC?
JS: There is a dire need for more uniform application of due diligence across the industry. We all know there are certain programmes that are doing a lot in terms of vetting; but there are also numerous ones that do little to nothing. In my personal view, these issues are exasperated by the sheer lack of transparency amongst many programmes, especially residency-by-investment programmes. All programmes should be transparent about the level of due diligence they undertake and how the results are used to make informed decisions. Until this happens, critics will continue to assume no due diligence is done. For the first time, the two reports started to define the roles and responsibilities of agents, government programmes, and third party due diligence providers in safeguarding the integrity of our industry. This is critical because we have traditionally assumed the responsibility of due diligence sits only with the government programmes, but there are other gatekeepers along the way, like agents, who can weed out bad actors from the very beginning through standard know-your-customer (KYC) checks.
SW: To me, the most important takeaways from this project and resulting publications are the need for increased transparency, the need for clarity of roles and the need for practical solutions. It’s important that data and facts-based information is provided to external stakeholders so that they can comprehensively understand what the due diligence processes within some CIUs are. In terms of the clarification of roles, we need to understand that while the application approval responsibility lies with the governments, each of the stakeholders engaged in the process carries responsibility for managing financial crime risk exposure. It’s the first time these various roles have been clarified in the sector. The second report provides a very tangible, practical set of tools and recommendations, making it much easier to build the risk management process or review and improve an existing one.
LA: The central theme of the two reports is the necessity of uniform minimum due diligence standards for both government programmes and agents. Uniform standards, coupled with strong governance and transparency into the measures being taken, will lead to a more secure industry, a more even playing field for industry participants, and will significantly contribute to the industry’s perception and reputation issues. The reports provide detailed guidance for minimum due diligence standards, including five-step processes for both government programmes and agents. While government programmes are the ultimate decisionmakers, the suggested added level of responsibility and involvement for agents is a further sign of the industry’s desire to implement strong governance and oversight. Although implementation and regulation of the standards outlined in the two reports remain the subject of further debate, the reports are a significant and cohesive step in the right direction, and the first of its kind within our industry and across providers.
The reports argue that both RBI and CBI programmes should implement the same due diligence standards based on a five-step process. However, there is no supranational body regulating the investment migration industry, and it falls on governments to ensure that minimum standards are met. What are your thoughts and opinions on this matter? Will we see greater harmonisation in the years ahead?
JS: While there may not be a supranational body regulating the industry, there have been some significant developments regulating how “golden visa” applicants should be treated. The 5th EU Anti-Money Laundering Directive stipulates “Golden Visa” applicants should be classified as “high risk” which in turn, requires enhanced due diligence. This is an important step in institutionalising the level of due diligence that needs to be applied. But ultimately, what would really move the needle is industry self-regulation. We should use the recent scrutiny on the industry to selfpromote the importance of uniform application of due diligence across agents and governments. We will only address the criticism through standardization, otherwise lax controls in certain programmes will adversely affect the whole industry.
SW: The agents and banks processing the application payments and opening applicants’ accounts in many jurisdictions already need to follow Anti-Bribery and Corruption (ABC) and Anti-Money Laundering (AML) regulations and apply the verification procedures under their Know-Your-Customer (KYC) policies. These, however, vary from one jurisdiction to another and so cannot be fully relied upon by the investment migration sector. Because of the legal implications of citizenship or residency status as independent state matters, the industry needs to rely on standards driven by associations such as IMC. The lack of supra-national oversight is somehow replaced in the sector by the scrutiny and attention that the press, NGOs and civil society give. This, in turn, drives an increased reputational and political risk for those governments who do not adhere to risk management best practices.
EL: The programmes with which we work all demand a high level of documentation and substantial paperwork to support the application process. We apply the same degree of due diligence to all CIUs and pride ourselves in our professionalism and high standards. There is scope to introduce a minimum standard across the board, but the responsibility also lies with the due diligence provider to highlight any areas lacking that will result in ineffective due diligence, on a case by case basis. Technology could offer some effective solutions to harmonise some areas, including standardising forms and templates and allowing for digital IDs and security features to be built in at an early stage.
LA: Regulation of minimum due diligence standards, both at the agent and government levels, remains a challenge and topic for further discussion. At the agent level, similar to the banking industry, there is the possibility of implementing measures such as fines and/or bans, but without an industry-specific regulatory agency, infractions are difficult to investigate, and enforcement is seemingly impossible. The question of enforcement and regulation becomes significantly more difficult at the government level, as the autonomy and decision-making ability of the nation states is an undeniable factor. Industry regulation and compliance is ultimately possible, but it is going to take further exploration and solution-seeking. Ultimately though, the agents and government programmes that choose to subscribe to the minimum standards outlined in the reports will also hopefully follow guidance from the reports around increased levels of transparency, which serves to better the security and reputation of the industry. Regardless of the regulation in place, all stakeholders in this industry have a vetted interest in its continuation and success, and it is our desire that these reports serve as a catalyst for industry progress.
How has the covid-19 pandemic affected due diligence operations and particularly your ability to verify information?
EL: We had planned ahead to ensure our business was resilient and we migrated our staff to home working with no disruption to our clients. In respect of our verification processes we did encounter some delays to checks in-country, where government offices were closed and where travel restrictions impacted on checks made on properties and locations in certain territories. However, we have not had to curtail nor change the way we verify information and have been able to continue to deliver reports to clients within acceptable timescales. Inevitably, also, given the political and social instability within some of the territories in which we conduct verification we are constantly adapting our processes to ensure we can deliver the most effective results for clients without compromising the accuracy of reports.
SW: Early on Refinitiv decided to move the entire company to a virtual office environment before lockdowns were mandated by many governments. We’re also fortunate to have robust and flexible technology. We had upgraded our suite of collaboration and communication tools recently, meaning we had access to teamwork applications, and the transition to virtual office was relatively easy for us. As for data retrieval and verification of information, of course, we observed some delays in the retrieval of information from official sources in countries with lockdown measures, especially those with less advanced digitised databases. When it comes to local human intelligence, since most of the industry source queries are within our existing network, it has been possible to maintain a high rate of on-time delivery, as telephone interviews replaced face-to-face meetings partially.
LA: Covid-19 has had an impact on industry operations around the world, and the due diligence industry is no exception. Proper due diligence is comprised of information garnered from public and proprietary data sources, as well as local, in-country intelligence, comprised of human source information, manual records searches, and in-person access to official government ministries. In this way, much of our most valuable intelligence was at the mercy of jurisdictional regulations and restrictions. As Covid-19 intensified, most jurisdictions closed nonessential businesses, implemented lockdown mandates and banned public gatherings. These initial measures undoubtedly impacted, and in certain cases temporarily halted, aspects of our due diligence process, most significantly in the verification of documents and credentials, reputational inquiries and site visits; all of the areas requiring in-person interaction and contact. Fortunately for due diligence operations, most countries experienced some degree of lockdown measures at the same time, and only for a short period of time, during which we all—providers and clients alike—took a bit of a step back, got our new at-home worlds in order, and then resumed operations at a time when most of the essential aspects of our due diligence were able to proceed with some semblance of normalcy and without delay.
JS: When the pandemic intensified, we internally transitioned to 100% remote work overnight across all of our locations. While working from home was a relatively new concept for most of our researchers, the transition has been remarkably seamless. Most digital sources have remained unaffected during the pandemic though some in-person and telephone verifications have been impacted by remote work. At the beginning of the pandemic, there were some delays due to government shutdowns, but we have recently seen a normalisation of lead times on most verifications.
The coronavirus accelerated the adoption of digital technologies by most Citizenship by Investment Units (CIUs), which started to accept online applications and are requiring fewer documents to lodge applications and start the due diligence process. While this has made the application process easier for investors, do you have concerns from a due diligence perspective?
JS: The due diligence process relies heavily on the review and verification of documentation provided by the applicants. As long as these are transmitted to the due diligence providers in a secure environment, there should be no concerns. In fact, if the pandemic has taught us anything, is that virtual environments can facilitate the process and potentially reduce the turnaround times without compromising the quality of the due diligence.
SW: This pandemic indeed unlocked so many new opportunities people didn’t think of or were not bold enough to implement. We see a lot of innovation happening in the client onboarding processes—within the investment migration sector but also in the banking sector. The lower level of document requirements should, however, be balanced with a robust verification process and with independent opensource information collection. While some documents may not be critical, others—like those proving the legitimate origin of the applicant’s sources of wealth (SoW) and Sources of funds (SoF)—remain critical to ensure that CIUs do not accept illegitimate funds. Common sense and a risk-based approach need to be applied and adhered to in the application-vetting process.
LA: The changes implemented in light of Covid- 19 showcase the adaptability of the CIUs, and in many ways are another great example of positive progress emerging from the pandemic. From a due diligence perspective, the more comprehensive information and documentation we have at the start of an investigation, the better and more comprehensive the output will be. However, this is in no way positing that comprehensive and high-quality due diligence cannot be conducted without the comprehensive set of required documents in hand. In reality, due diligence, when conducted properly, only partially relies on the documents and information reported, while equally relying on intelligence and information that was not disclosed. Additionally, it is worth noting that to date, we have not seen a significant number of files submitted to us with missing documents. Certain of the documents we have received have not been notarized, as notaries in many countries were not available during lockdown periods, but with the exception of a few jurisdictions, the lack of a notary stamp does not typically impact our ability to confirm the document with official in-country sources. There is rightfully a concern on some level about an impact to the due diligence process if, for example, a significant number of documents are absent at the time the diligence is initiated, but this has not been our experience to date, and we are confident that the CIUs will continue to apply adequate standards when it comes to the documents received and the initiation of the due diligence process.
EL: We support the adoption of technology to assist both applicants and the CIUs. Whilst supplied documentation is, of course, fundamental to the process, it does not tell the full picture and our checks online and in-country enable corroboration of genuine information and discovery of false or misleading information. We work alongside the CIUs when conducting verification, and if a perceived issue or threat is identified, we would always liaise with the relevant CIU and request further documentation to alleviate concerns. As technology develops, we believe that the application process can be streamlined and, potentially, allow for verification to be more transparent.
How do you expect the due diligence practice to develop in the next five years?
SW: I think there will be further significant improvements in the process of risk assessment and lower-risk application vetting, driven by technology and automation. As more data becomes available in digital format and Machine Learning and Artificial Intelligence tools become smarter and more available to practitioners, the vetting process will become faster and more seamless, particularly for low-risk applicants. However, where the risks remain high—either because of lack of transparency, lack of documentation, remote location in high-risk perceived countries—local and human based intelligence will remain the sine qua non of effective due diligence.
JS: Hopefully we will start to see a more uniform adoption of due diligence for agents and governments across the industry. This is especially critical for the Western European residency programmes that deal in high volumes but seemingly do very little due diligence. Ideally, these Golden Visa programmes would adopt the minimal due diligence standards outlined in the IMC-coordinated reports, publicly outline what level of vetting takes place at the applications stage and whatrisk-based approach is taken when making decisions.
LA: Technology will continue to play a significant role in the evolution of the due diligence industry, both in internal process enhancements and end-user offerings. We expect significant advancements in internal technology solutions that allow for added efficiencies in record retrieval, analysis and reporting, leading to improved turnaround times, increases in capacity, and more sophisticated levels of risk-based analysis. For end-user solutions, we also expect enhancements to risk rating and post-investigation monitoring tools. External to enhancements from providers, the next five years promise to bring additional data privacy measures in a number of jurisdictions, including increased use of anonymization and pseudonymization in records. As enhanced data privacy restrictions are enacted in jurisdictions around the world, due diligence processes will have to adapt accordingly, and, in some jurisdictions, it will be necessary to find alternatelegal methods of obtaining meaningful intelligence.
EL: With ever greater scrutiny on programmes by the media and policymakers, it has become vital to ensure that every application has been checked and all sources verified. Digital passports and IDs will change the way we all verify our identities, both at home and when travelling. That will inevitably alter the way in which verification for citizenship takes place and should allow for better initial checking. We also support the IMC’s work to establish best practice in due diligence and that will help to allay the fears of some on the quality of citizenship granting.
