Upbeat intro music
Rebecca Archer
Welcome back to Beyond the Numbers with Grant Thornton – a podcast unpacking marketplace shifts in today’s dynamic business landscape.
I’m Rebecca Archer, and today I’m joined by Neil Jeans – Partner and AML/CTF expert.
Proliferation financing and sanctions compliance are rapidly emerging as core components of modern financial crime frameworks. In the past, organisations treated AML/CTF, sanctions and export controls as separate but increasingly, regulators and international standard setters expect businesses to assess and manage these risks holistically through their broader financial crime programs.
Australia’s AML/CTF reforms have been progressing for quite some time now, with much attention provide to the Tranche 2 entities required to report from 1 July 2026.
However, sanctions and proliferation financing obligations introduced through the reforms have received less focus. Amid heightened geopolitical tensions and increased regulatory and FATF focus on proliferation financing and targeted financial sanctions, organisations need to recognise how sanctions and proliferation financing risks are becoming increasingly integrated into AML/CTF frameworks.
Welcome, Neil!
Neil Jeans
Good to be here.
Rebecca Archer
So first off, should organisations look at integrating proliferation financing risk frameworks into their work?
Neil Jeans
Well, I think the simple answer is yes.
It is now a legal requirement under the AML/CTF Act to consider proliferation finance and the risk that poses to your business. However, it is a risk-based approach. So not everybody has to have the full suite of controls for proliferation finance because proliferation finance is a relatively specialised area impacting particular businesses and particular sectors of industry, but you need to do that initial consideration of whether my business is impacted by that or could be impacted by proliferation financing.
Once you undertake that risk assessment, if the risk is more than low, for example, medium, high, or whatever, but not low, then you're required to undertake a more fulsome risk assessment and start to think about how your controls, the processes you undertake, can limit the exposure to that particular risk.
So again, it's one of those things you should think about carefully, but everybody has to think about it and then in certain circumstances move through. A couple of things you should think about really is, you know, who am I doing business with? Are there jurisdictions that are vulnerable to proliferation finance? And I'll quote a couple: Iran, North Korea, and Russia.
And people may be going, well, I'm not doing business with those, but the complexity is it's not necessarily who you're doing business with, it's who your clients potentially are doing business with as well. So, it expands the jurisdictional issues.
In addition to that, also think about the types of goods and services my clients are manufacturing or providing or undertaking, because ultimately they could be dual-use goods and get used for proliferation.
Rebecca Archer
And can you explain where AML, CTF, and sanctions overlap?
Neil Jeans
This is a development of the legislation which went live in March and July, depending on what type of business you are, and effectively the sanctions regime has been left outside the AML regime up until that point.
Effectively, what's happened is that sanctions have been brought under the regime, so therefore under the regulation of AUSTRAC, and this means that you've got to undertake a number of activities to be compliant with the AML/CTF Act to address the new sanctions requirements.
The first and most clear one is customer onboarding. When you're onboarding new customers, you need to identify those customers, but you also need to see whether they are sanctions partied and involved in sanctions. There's also the ongoing monitoring.
So, because the world doesn't stay stable and you've got to look at what you're doing for those customers or clients and seeing whether that is unusual or a relatively high-risk behaviour that could involve potential sanctions non-compliance.
You've also obviously got to look at this not only from an individual perspective but also from a jurisdictional perspective but also from an entity's perspective, and we've seen the sanctions world change recently with some of the sanctions that have come out of the US as a result of the Iran war, the D-Day sanctions as they're referred to, where effectively, the US is pushing its extraterritorial reach into not only your customers, but your customers' customers.
So, you could be caught by US sanctions, not because you have evaded sanctions, but you're dealing with somebody that is evading sanctions. So again, it's getting more and more complicated, and this is really a due diligence uplift.
The last bit is really the reporting. So, obviously breaching sanctions is a crime, and therefore if you have somebody that you suspect may be breaching sanctions or is attempting to use you to breach sanctions, then that is something that you should be reporting to the authorities, reporting through to DFAT, but also potentially reporting through to AUSTRAC as an unusual or suspicious matter.
Rebecca Archer
Neil, what exactly is causing this shift?
Neil Jeans
Well, from an Australian perspective, there are really 2 factors that are driving this.
One, which is very, very Australian perspective, is the fact that we've got the Financial Action Task Force (FATF) undertaking its mutual evaluation. They're on site in late November in Australia, and in order to demonstrate compliance with the international standards that the FATF set out, we need to have these things in place.
Separate to that, we're seeing, and as I mentioned from the US, an increased geopolitical risk. So, sanctions are being used as – some refer it as a tool – I to a certain degree refer it as a weapon of diplomatic activity, because effectively it's being used to further particular political or diplomatic ends by applying sanctions to people and applying sanctions in particular ways, and this is not only the US, we're seeing this in Europe and other places as well. And again, Australia is keeping pace with those and clearly monitoring the international arena, but certainly I don't see this diminishing. All I see this is basically becoming more and more complex and a focus that people need to deal with.
Rebecca Archer
We obviously also live in a world where AI is being used more and more. We're hearing about it on a daily basis. How does this present in proliferation financing?
Neil Jeans
Again, look at it from both sides of the coin would be my advice.
Firstly, how criminals can use AI. You know, we're all aware of fake documents and fake identities that can be used through AI. Obviously, the use of AI to undertake phishing attacks to generate funds.
So, a lot of the AI work in proliferation finance is the ability to generate funds that can be used to fund proliferation finance. Obviously, that includes potentially creating avatars, concealing beneficial ownership, obviously using AI for fraud, and there's been recent reports that a lot of the scam factories that are set up in Asia are actually now using AI and reducing the number of people and actually are 400 times more likely to be successful in a fraud because the AI is so sophisticated.
So, we're seeing AI developing, and it's true of most things, you know, criminals are usually early adopters of innovation and technology.
On the flip side, from a reporting entity and prevention perspective, AI can also help you as well. Again, these transactions are usually complex, and really AI is getting very good at identifying complex transactions where the human brain can't do the gymnastics, basically.
Obviously, identifying hidden connections in vast amounts of data is something that AI is used for currently. Again, looking at large amounts of information, including media, and screening it for particular things, and obviously then potentially also thinking about alert prioritisation and identifying things that you really should be looking at better than the current systems do.
So, whilst there are the risks on one side and the criminals will undoubtedly continue to use AI, I think on the side of the good, you can also use AI to help you do a better job, basically.
Rebecca Archer
What are some of the other key risks, opportunities, or challenges that organisations may not have fully considered here?
Neil Jeans
Well, I think I touched on that a little bit when we talked about the D-Day sanctions.
Again, the sanction risk is expanding exponentially. So, I think one of the big mistakes or risks is that organisations say, think about proliferation finance, which is very niche. It's about weapons of mass destruction, and go, “Yeah, my business could not possibly be involved in weapons of mass destruction. That's just completely ludicrous.”
However, it's not only banks, defence contractors, and government agencies that should think about this. It's a much broader industry because effectively the proliferation finance is about generating funds and generating funds that then can be used. So, you may not be buying the centrifuges or all the things that are used for proliferation finance, but you may be involved in generating, generating funds.
A good example of that, there was some research done by a UK think tank where they identified North Korea using real estate and the rents from commercial real estate that they acquired to generate funds that were being used for proliferation finance.
So, it can be a broad level of industries that can actually be used, and I think basically some of the key risks I see, there's direct exposure, but that's usually relatively rare because the activities tend to want to conceal themselves. I think you've also got to think about dual-use goods and if you're involved in dual-use goods, and one of the other things we're seeing, particularly around North Korea, is North Korean IT workers.
So, using AI, they create fake identities and obtain remote employment for legitimate activities. So, there's a lot of work been done in this space where actually North Korean IT workers are actually, you know, you think you're employing somebody from Asia, from another country, but actually you're employing somebody in North Korea who's doing the work for you, and actually you're paying them for that legitimate work, but that is then being used to finance proliferation.
So again, it's a complex web that we need to understand, and that also involves front companies, complex payments arrangements, and opaque ownership structures. So again, this is all about knowing who you're doing business with, how your supply chain works, and that's not just the one step, it's actually multiple steps, and you have to, for want of a better phrase, peel the onion more diligently when you're doing the due diligence to understand who you're doing business with or who you're doing business with is doing business with, basically.
The other thing I would suggest is also that this risk extends beyond sanctions because particularly, you know, once you're doing business with these people, you expose yourself to potentially increased cybersecurity threats, theft of intellectual property.
So again, this is not only an AML prevention or sanctions compliance issue, this is actually understanding the risks that my business faces as well.
Rebecca Archer
It sounds to me extremely complex, and as, as you're describing this, you know, it's really quite obvious that the rabbit hole goes very, very deep.
Neil Jeans
Very much so.
Rebecca Archer
I imagine uncovering this is extremely time-consuming and something that perhaps even takes years. What chance do businesses have of being able to get to the bottom of this? Where should they even start, I suppose, is the question?
Neil Jeans
That's a good question because it is; it is a deep rabbit hole. It is complicated. It does take time. It does take diligence, and you're dealing with an adversary or a party that is very careful and very good at concealing itself.
So, in my experience, it's usually a hindsight issue, and that's something that organizations need to think about. So, it's not necessarily whether you have been abused to breach sanctions or proliferation finance, it's have you done enough to prevent it?
So, no organization, not even the big banks, will have enough resources to be able to look at every transaction in the level of detail to reduce the risk to zero. What you've got to realise is that there is a risk, and I've then got to put in place a series of controls and a series of approaches that, for want of a better phrase, will give me plausible deniability.
So, if something does go wrong, I can demonstrate to the authorities both here but also internationally that I did all I possibly could. I wasn't blind to this risk and therefore didn't react to this risk appropriately. So, this is protective to a certain degree and preventative because you're going to make it harder for them to use your services, but in all reality, like money laundering, you're never going to stop them using your services.
You've got to get to a level where you say, “I've done all I possibly can.”
And a good example of that is I worked for a very large bank in Australia. And when I joined them, my first meeting with the Board was I asked them a direct question: what was the risk of money laundering that they accepted? And the answer from the Board was, we do not accept any risk of money laundering. My response was pretty clear then.
So that's great. We'll just close every bank account then, because that's the only way I can address that risk appetite. We then had a conversation which obviously we came to the right conclusion, which is we're not knowingly going to be involved in money laundering.
So, we're going to put a control environment in place that prevents that as much as we possibly can, and it's the same here. You do not want to be knowingly involved, or should we say blindly involved in these type of activities.
So therefore, it's put in place controls to allow you to be able to say, look, I did all I possibly could, even though these guys are sophisticated, they use all the latest tools, but we're doing all we possibly can, and I think that sort of talks about some things to really consider from a risk perspective.
Think about risk from a sanctions-lens and proliferation finance lens, as we've really talked about. Think about how you're reviewing your customers, how you're looking at third parties, and how strong and robust is your due diligence process, but with an eye to pragmatism and proportionality.
Obviously, think about how you're doing your screening. Is it sophisticated? Are you tuning your screening regularly to make sure that it's keeping pace with the changes? And they're not quite daily changes, but certainly weekly and monthly changes of the way these approaches are being addressed.
Again, think about onboarding controls, again, particularly around staff, particularly around overseas staff, and you may be using them for small pieces of work, very technical pieces of work, but understand who they are and make sure that you're comfortable with that. Understand your supply chains, and I think supply chains is becoming an increasingly important area, not only for proliferation finance but also for that sanctions and the risk that your supply chain can give you around that, and last but not least, training of staff. Make sure staff understand what they should be doing. Make sure you have a culture and an environment where they're more than comfortable to escalate things to you, because it could be that just one innocuous thing that ultimately gives you the window into the world that you need, basically.
Rebecca Archer
Are there any key warning signs that an organisation is actually at risk? What sorts of things do you see?
Neil Jeans
So, look, it's things that don't add up, and it's hard to give you a laundry list that is accurate because these guys keep innovating. These guys keep changing on a daily, regular basis.
You know, they're looking for weaknesses in the system to exploit those, but things to think about is unusual ways of doing business, unusual trade routes, things that don't make sense, and when I talk to organisations, you know what makes sense usually? It's things that just don't make sense. Why are they using this or why are they doing that? Obviously using transshipment routes through high-risk jurisdictions. Why are they using that? Does it make sense? Opaque ownership structures. Look, we know people have opaque structures for various reasons, including tax and asset protection, but understand and rationalise why they're using those. Does it make sense that they're using those, or is it for another reason?
Obviously, requests using dual-use technologies – very, very important and increasing area, and Australia has a significant industry in dual-use goods, so that is something to think about, and if you're involved in those, understand what the supply chain is.
Customers being evasive and giving you inconsistent explanations, you know, using your skill and knowledge to go, well, that doesn't make sense, or actually you told me something different last week, and ultimately, you know, think about those jurisdictions. You know, there's a limited number of jurisdictions that have proliferation finance concerns, and that would be a big red flag.
You know, if you're doing business or your customer's doing business with Russia, North Korea, or Iran, that is a very, very big red flag. The challenge we've got with the sanctions is that you've got a country like China who's just introduced legislation that actually says it's illegal to comply with sanctions in other jurisdictions.
So, we're, we're going to get an interesting geopolitical situation evolving pretty soon where you've got the US pushing out sanctions and requiring the world to comply with its sanctions, and it quite frankly is a, you know, you're either with us or against us position that the US are taking, and you've got, particularly with it in relation to Iran, and you've got somebody like China, who we know does business with Iran, particularly around oil, that has actually made it illegal in their country and for their businesses to actually comply with those sanctions.
So, I think there'll be some head-butting going on in the sanctions space in the next couple of months, I suspect.
Rebecca Archer
Certainly sounds like it, and it's not going to be dull.
Neil Jeans
Yeah, I think it's getting more complicated, and the risk is going up, and that's why I think it's important that organisations start to think about these issues so they can start to get prepared.
Rebecca Archer
Neil, thank you so much for sharing this today and coming on the program. I think that what we've talked about is extremely relevant, very, very timely, and, you know, we might need to check in again and see sort of the lay of the land, you know, 12 months from now even, because things are changing so rapidly.
Neil Jeans
Absolutely. Definitely. Thank you. Thank you for the opportunity to speak to everybody.
Rebecca Archer
If you enjoyed this episode, make sure to follow Grant Thornton Australia on Apple Podcasts or Spotify so you never miss new insights.
Do you have a burning question or a challenge keeping you up at night? Drop us an email. We’d love to hear from you. Our experts are here to break down the business, tax, advisory and consulting landscape, so you can focus on building your business.
Thanks for listening.
Upbeat outro music
