Compliance: KYC, AML, screening and limits

The compliance module covers knowing your customer, money-laundering risk, sanctions and watch-list screening, suspicious activity, separation of duties and approval limits, and the record of terms and of who looked at sensitive files.

Knowing your customer

The customer's page has a Compliance section: nationality, registration number and industry for companies, source of funds, whether they are a politically exposed person, and their risk.

• Identity documents (the Identity tab on the customer): passports, ID cards, company registrations and so on, with expiry dates. Each is verified by a method: seen in person, video call, electronic check or certified copy. A person becomes verified with one valid, verified identity document. A company becomes verified with a verified registration document and its owners recorded, each owner of 25% or more and each director identified by their own document.
• Beneficial owners (the Owners tab on company customers): shareholders, directors, people who control the company otherwise and signatories, with their share. Each is screened when added.

Compliance > Overview shows customers by risk, the highest-risk customers, reviews due in the next 30 days, open privacy requests and the customers with a policy in force whose identity is not verified yet.

Money-laundering risk

Every customer is given a score and a rating (low, medium, high) from points for: being or having an owner who is politically exposed, a screening match, links to a higher-risk country, a cash-intensive business, unknown owners, large cash payments in the last year, a large premium, identity not verified, and a policy cancelled soon after it started. The reasons are shown on the customer.

Compliance review on the customer records a periodic review and rates them again. The next review is due after 12 months for high risk, 24 for medium and 60 for low; the compliance team is told each Monday of customers due.

Screening

Compliance > Watch lists holds sanctions, politically exposed persons and your own blacklist. Import a list loads a CSV (name, aliases, date of birth, country, reference); Add a name adds one.

The official sanctions lists

Four official lists are downloaded from their publishers every Monday morning and loaded into your watch lists, replacing the previous week's copy:

List	Publisher
US OFAC SDN list	US Treasury, Office of Foreign Assets Control
UN Security Council list	United Nations Security Council
EU financial sanctions list	European Commission
UK Sanctions List	UK Foreign, Commonwealth and Development Office

Official lists on the Watch lists screen shows how many names each list holds and when it was last downloaded. Untick a list your regulator does not require and choose Save and update now: it is removed, and the ticked lists are downloaded again in a few minutes. If a download fails, the earlier copy stays in use and the screen says why.

Vessels and ships are left out, as you insure people and companies here, not ships by name. Expect some possible matches on common names: they go to To review like any other.

Names are screened:

• when a customer or beneficial owner is added, or a customer's name or date of birth changes;
• before a claim payment or a refund is made, and for each payee of a payment run;
• every Monday, every customer again against the current lists;
• on demand with Check a name.

Matching ignores case, accents, punctuation, word order, titles (Mr, Dr, Sheikh) and company endings (SAL, SARL, LLC), and tolerates small spelling differences; all the words of a short name found in a longer one also count. A matching date of birth makes a match stronger. Compliance > Screening lists each check. A possible match goes to To review: mark it confirmed or not the same person. While a match is open or confirmed, refunds and claim payments to that name are stopped and the payment is held in payment runs.

Suspicious activity

Compliance > Suspicious activity is the register of concerns. Some are raised automatically:

• a large cash payment, or several cash payments just under the threshold within 30 days;
• an overpayment refunded soon after;
• a policy cancelled within 30 days with a refund.

Anyone with access can Raise a concern by hand. A report is taken or given to someone, then decided: reported to the authority (with its reference) or closed with the reason. The register is visible only to those with compliance access, and every time a report is opened it is logged.

Separation of duties

On Accounting > Overview > Separation of duties, three rules can be turned off, though they are on by default:

• The person who approved a claim settlement cannot pay it.
• The person who issued a credit note cannot refund it.
• The person who prepared a manual journal cannot post it.

Supplier bills and payment runs always need a second person. The main account holder is not bound by the rules, so a company of one can still work.

Approval limits

Compliance > Approval limits sets the most a role or a person may approve for: discounts (percent), refunds, write-offs, credit notes, claim settlements, claim payments, manual journals and payment runs. A person's own limit replaces their role's; the main account holder has no limit. Above their limit, a user is stopped with a message saying so. Where an approval chain is set for the action, the request goes to the approvers, and each approver's own limit is checked when they approve.

The record of terms in force

Compliance > Terms in force shows, for any date, the wording, prices, rules and notices that applied then: product versions and coverages, clauses, rating rules, underwriting rules, email, SMS and document templates. Each change to these is kept as a revision with who made it.

Who opened sensitive records

Customers can be marked sensitive (a public figure, a staff member). Every opening of a sensitive or politically exposed customer, their claims, any health claim, a suspicious activity report, a privacy request, an identity document or a beneficial owner, and every privacy export, is written to Compliance > Access log with who and when.