A few weeks back, I had a call with the board of an impact fund trying to get the heads around “financial crime.” They’d been managing anti-money laundering (AML) risks for a while. Their regulator was obsessed with “the origin of funds.” This fund is backed by development finance and large sustainability-minded institutional investors. Ticking boxes to confirm that a Nordic government’s funds are okay is a good use of everyone’s time. The regulator was much less concerned with the fund’s investments. Odd, as that’s where all the risk lies. The fund invests in emerging market scale-ups in renewables, education, and microfinance.
Wearily, the COO asked me if my work (around anti-corruption, fraud prevention, and associated areas) would require the same box-ticking. “No,” I thought and then said. But I needed to back up that assertion.
What came out of my mouth next formed my thinking. “Some elements of compliance will be tedious. It’s ticking boxes so leaders can sign off on annual reports, and regulators can pretend they do their jobs. Most of that work usually fixates on elements within your control. It’s the bits you can’t easily control where the risk lies.”
Now, I had to back up my sweeping pronouncement. When organisations get mega, they become like huge municipal buildings. Everyone needs a badge and signs telling you what (not) to do adorn every inch of wall and door space not occupied by toxic beige wallpaper (thanks, Danielle, for that lovely phrase). This fund is not mega. They know where their funding comes from. They know it’s not from El Chapo or Putin. They don’t collect loads of personal data. Their “vendors” are mainly office supplies and professional advisors. In other words, the money laundering, sanctions, anti-trust, data privacy, and third-party sustainability questions could be addressed with minimal fuss. Tick boxes quickly and efficiently. We looked at ways to do that.
Anti-corruption and fraud risks in emerging markets impact investment are substantial. I remember speaking to a Nordic impact investor in Vietnam in 2011. His firm had made eight investments and been able to exit… None. Why? Each time a bidder did their due diligence, they found dirt (fraud mainly). The joke then (still valid and unfunny now) was, “There are three sets of accounts - the ones the firm takes to the tax office, the ones they show investors, and the real one, which exists only in the owner’s head.”
Fraud and corruption - especially within third-parties (investments, in this case) - are much more about what people do to or for you. Focusing our efforts on risk reduction in those two domains made much more sense to the fund’s leadership team than a tour of bribery prohibitions and regulations.
We (the fund and I) worked on a risk-based framework to sift out the more problematic potential investments. Post-transaction, we’ve also put together a framework to improve governance in the investee, along with guardrails around monitoring, confidential reporting, and investigation—a blend of carrot and stick.
There is nothing especially new here, but I’m still amazed how many organisations’ risk frameworks don’t delineate between what I discussed in an earlier newsletter, shark and mosquito risks. Fraud is always a mosquito. Sanctions is a shark. We obsess about sharks when most staff never get in the water. We skim over mosquito risks despite living in the tropics. You get the picture.
How do you balance regulatory performance with actual risk management?
Sometimes, we CAN say, “I did my best.”
In risk, things will go wrong. You can give the best instructions, training, guidance, and support. People will still do dumb stuff.
This week, I stumbled across a thread where people went off-script with recipes and then complained. It’s a fantastic read. Below are just a couple of snippets.
We are not alone…