Hacker News Reader

Comment by krn | Hacker News Reader

The CFO resigned only after the documents passed to The Telegraph by a whistleblower showed that for three months in 2018 Revolut switched off an automated system designed to stop dubious money transfers[1].

[1] https://www.telegraph.co.uk/technology/2019/02/28/revolut-fa...

View on HN

Maybe that system was low quality and blocked valid transactions?

Maybe it was, but that's not a good excuse. "We wrote some software to prevent money laundering but it was crap so we turned it off"

That seems like an entirely reasonable response in isolation. Sometimes you write new software and find it just doesn't work in production. Were they not doing anything else to prevent money laundering?

> We attempted to write some software to prevent money laundering but it didn't work. So we turned it off.

What are you talking about, that's completely reasonable.

Or "We wrote some software to prevent money laundering but it worked properly and blocked heaps of profitable transactions, so we turned it off"

I saw that but it wasn't clear as far as I remember who did this - it may be the CFO took responsibility for some one else's actions.

> it may be the CFO took responsibility for some one else's actions

CFOs of financial services companies are typically senior AML officers. All AML actions are their actions, and AML liability for AML officers is almost strict liability. If something happens and if best practice wasn’t followed, the AML officer(s) are personally and criminally liable.

If someone could turn off the entire AML scanning system with the CFO’s prior knowledge, sign-off, and ex post facto notification, that’s a deficient AML policy.

I'm not saying this is definitely the case, but it could be why he left. Could you imagine if you were criminally liable for something like this, and found out that the monitoring for it was disabled without your knowledge? I'd want to get out of there ASAP.

It wasn't the entire system. It was some of the rules. They were rules which weren't very accurate, were leading to lots of unhappy real customers, and not catching many fraudsters.

For example, the rules stopped large numbers of women who had bank accounts or their passports in maiden names from transferring money to themselves. Revolut would see an incoming payment from supposedly the same person, but with a different name, and lock the whole account down until documents could be provided proving why that happened.

That means if you top up your Revolut account on saturday to buy some McDonalds, you are now going to be locked out of all financial services for probably 1+ week while you get official documents proving the name change. A marriage certificate isn't enough. If your salary is paid into Revolut, you might default on loan payments, loose your house/car, etc.

All that to stop only the stupidest of money launderers. Smart money launderers know to use business accounts where the name of the account holder isn't checked by any bank.

> Smart money launderers know to use business accounts where the name of the account holder isn't checked by any bank.

I don't quite follow - can you elaborate and explain the scenario?

In Germany at least, when you order a transaction you have to specify recipient account holder name and IBAN. Recipient bank checks if the name on the IBAN matches with the one in their records (after normalization to reduce error rates e.g. from umlauts) and if there's an obvious mismatch reject the transaction.

Business accounts however are not checked as tightly as people often enough either outright mis-spell the company name, use outdated company names, specify departments in the name and not the comment field, ...

If a human moves money from "Bob smith" at bank1 to "bob smith" at bank2, they can avoid many of the money laundering checks, because money laundering laws only apply when money is changing ownership.

If a business does the same, and claims they're moving their own money about, the name checks aren't applied, so they can work around many of the checks.

In a typical bank, AML is not part of the CFO responsibility (instead directly subordinate to CEO), and no sane bank will have a CFO whose experience is chiefly AML.

Reply on news.ycombinator.com