Today from Hiiraan Online:  _
A review of Somalia’s national risk assessment on money-laundering and terrorist financing

By Abdi Ali
Sunday June 26, 2022


Somalia government’s recent assessment report, while well-intentioned, is seriously flawed in focus and positively damaging to Somalia’s financial services industry. Here is why.

Towards the end of last month, Somalia’s Financial Reporting Centre (FRC) and Ministry of Finance published the country’s national risk assessment (NRA) on money laundering (ML) and terrorist financing (TF). This is an important assessment that was intended to satisfy the seventh reform milestone of the Completion Point Trigger conditionality for the Debt Relief programme. The NRA, which was initially expected to be drafted by the end of 2020 and took three years to complete, also informs Somalia’s national strategy for anti-money laundering (AML) and countering the financing of terrorism (CFT). The outcome from the NRA and national strategy will then form the basis for the upcoming evaluation by the Financial Action Task Force (FATF) in the third quarter of 2024. The NRA is also published by the FATF, creating wider global visibility.

The whole basis of the NRA is a concept called “risk-based approach” – a risk management parlance of materiality, impact and likelihood of a risk, driving relevant mitigation responses. In essence, risks identified (inherent risk) would need to be assessed against relevant mitigating controls so as to conclude whether any residual risks that remain unmitigated are material enough to warrant additional intervention. In other words, the NRA is not meant to list everything that is wrong in a country, just the materially important items that impact ML and TF.  

The first problem with Somalia’s NRA is one of internal governance and policy-making discipline. Here, an important, and the first ever, government document that is meant to provide authoritative picture of the ML and TF threats facing the country has been published without internal oversight. It should have been reviewed and properly considered by the Council of Minsters (or appointed committee) before publication to ensure proper consideration of its contents, and confirm whether the overall approach could be endorsed. It should also have been laid before parliament, given the strategy to address the risks contained in the report requires significant legislative response and impacts the whole country. However, it is not clear in the NRA who scrutinised the document and who signed it off for publication.  

Second, there are no case studies or other quantitative information, supporting the basis for risk assessment conclusions (be it regulatory summaries or externally published financial information from the financial services firms). This is explained away as being due to a wide-spread industry-regulator mistrust and “known” problems in Somalia, making risk rating conclusions in the NRA impossible to scrutinise. The technical aspect of the NRA also conflates a number of disparate concepts – vulnerabilities, risks, risk impact and likelihood, mitigating controls, adequacy of design and operating effectiveness of regulations / laws. Every vulnerability is not a high risk, and every high risk is not likely to crystallise. Equally, laws might be adequately designed, but ineffectively implemented. All of these need to be considered in relation to specific risk areas. The NRA mixes up apples, bears and bananas and comes up with trees.  

Third, there are 182 recommendations in the NRA to fix everything wrong in Somalia – extraordinary in itself and beyond a risk-based approach. Some of the recommendations are inherently contradictory, most are overlapping, others are open-ended or simply unachievable. As an example of this, the recommendation to develop “beneficial ownership” law for companies is something even the G7 has not done properly and hardly a material risk for Somalia. It is also impossible to distinguish between what is an area for improvement; an unmitigated material risk whose impact and likelihood are high and needs urgent response; a non-material risk whose impact is low or adequately mitigated; a disjointed area that requires policy response; a gap in intelligence capabilities that requires improvement; or an insufficient knowledge about risks in general. Because the recommendations are not specific, it would be impossible to articulate what the relevant policy / legislative response should be. As the government faces competing and difficult priorities, there is no clear prioritisation of critical recommendations against high-risk areas, what intervention the government can make within what timelines; the low-hanging fruits to pick first, and how to measure success. No one seems to have asked how on earth would 182 recommendations help the government prioritise response effectively?

Fourth, the NRA lists a whole range of collaborators and stakeholder participation – from ministries to banking and remittance companies. However, large sections of the report are accusatory in tone, blaming the government, financial services industry, commercial entities and non-bank financial institutions for lack of participation and wilful disregard of their compliance obligations. These remarks are reputationally damaging to both the government and the industry as a whole. It is one thing to outline limitations in participation, inconsistencies in reporting obligations and law enforcement deficiencies, but quite another to paint Somalia as a country whose financial services industry is actively undermining compliance laws, and operating without any national or international standards. Here, the Somali government is blaming itself and the wider industry in a report that the government itself is producing. It is a remarkable feat of incoherence indeed.

Fifth, there is no positive evidence that outlines how Somalia’s financial services industry has gradually transformed over the years; the controls they have in place and their efforts to tackle ML and TF risks; outcomes from the regulatory supervisory reviews by the Central Bank of Somalia (CBS) and FRC hardly get a mention; nor the effectiveness of the regulations that are in place and compliance status. In the absence of this, the NRA is conveying a fatalistic and possibly erroneous view that there are no visible governance standards in the country. The NRA blames banks and remittance companies for not providing relevant information to the FRC (i.e., suspicious activity reports), undermining the FRC’s ability to build an intelligence picture of the risks. What is not mentioned of course is why and, if indeed true, what should be done about it. The point is framing concerns and gaps as risk categories, rather than a defeatist and accusatory tone in a report that has global audience. For instance, there are industry concerns about FRC’s ability to safeguard confidential information; the lack of credible governance structure and expertise within the FRC; regulatory incoherence between FRC and CBS; the absence of appropriate mechanism for sharing information and safeguarding data.    

Sixth, a significant proportion of the NRA is copy and paste from different outside sources - largely analysis based on perception. For instance, some of the information is focused on foreign governments’ views, outlining and how the threat from Somalia is impacting the region; other areas make reference to issues about the 4.5 Qabiil model and how it stops the persecution of crimes; use of outdated information from outside publications is also pervasive in the report; extracts from laws, regulations and audit conclusions are scattered across many sections in the report without cogent contextual explanation. The danger of this is that the NRA has a life of its own, becoming an all-purpose incomprehensive document, veering into areas far removed from its intended scope. It also means it is no longer an evidence-based assessment of risks, but risks perpetuating a collection of narratives that are unrelated to the scope of the NRA.

Seventh, a consequential statement in the NRA is that the banks, remittance companies and other non-bank financial firms do not have basic know-your-customer controls, nor apply the regulations in full; and that their AML /CFT processes are inadequate. For mobile money operators (“MMOs” - which are highlighted as the biggest risk), the NRA claims that the operators are not in compliance with Somalia’s AML/CFT law. If this is factually correct, it means the Somali government is confirming that no entity adequately complies with Somalia’s AML/CFT law; the CBS / FRC are not capable regulators that can take action; and the CBS gives licenses to banks, remittance companies and MMOs even though they do not comply with the AML/CFT law and mobile money regulations. If this is the Somali government’s considered view, it has very significant consequences for the debt-relief programme, the financial services industry and the country as a whole. It is also very damaging for Somalia Plc.    

Policy-making incontinence

Finally, no one doubts the risks facing Somalia. Somalia’s AML/CFT laws are still comparatively new and effective enforcement is still developing; law enforcement maybe disjointed; and regulatory incoherence between the CBS and FRC, as well as political instability, remain overarching constraints, impacting the country’s overall risk mitigation strategies. However, the picture the NRA paints about the financial services landscape is too pessimistic to be plausible. While there are good areas in the NRA that talk about how the regulators are working to address some of these risks, these are entirely lost in the background noise. The overall NRA also appears to be pitched as a request-for-funding exercise, rather than a rigorous assessment and prioritisation of risks. It is why it is published as incomplete and is without action plans.

The NRA also misses other opportunities to highlight the progress Somalia’s financial services firms have made over the years. In this context, there are questions for the government and the financial services firms that are listed in the NRA as collaborators. The government needs to rein in these sorts of policy-making incontinence and design adequate governance framework around the review and publication of sensitive documents that set out official government view. Firms that are central to the conclusions in the NRA need to review the report to ensure the information about their businesses is accurate.

International banks, regulators and investors will have sight of Somalia’s NRA and the FATF will publish it in due course.  This will have significant impact on Somalia Plc and investor perception, sentiment and foreign direct investment flows. The recommendations from the NRA will also be critical to Somalia’s mutual evaluation in two years’ time. That is why the conclusions must be factually accurate, not fatalistic but balanced; risk-based, rather than collection of irrelevant narratives; and have clearly articulated areas of focus. Unfortunately, Somalia’s NRA achieves none of this.

Related Article: Somalia’s Mutual Evaluation Risk (hiiraan.com)


Click here