Protiviti’s Joshua Heiliczer on Helping Asia’s Financial Institutions Face up to Risk & Compliance with Confidence

Joshua Heiliczer is Managing Director, Head of Risk and Compliance for Hong Kong and Financial Crime Compliance for the APAC region. He believes in the firm’s mantra that there is no point in trying to change the way people work, but instead try to evolve the way they think about their work and their business challenges, explaining that this is core to smart risk management and compliance practices for private banks and other wealth management organisations. Protiviti, he told Hubbis when we ‘met’ recently, is all about harnessing intelligent data, new technologies and digital tools to provide financial sector clients with the right solutions across the firm’s two core areas of expertise, Internal Audit & Financial Advisory, and Risk & Compliance. For this latest discussion with Hubbis, he focused on the risk management and internal audit aspects, which he explained are especially important after the recent spate of significant AML-related fines imposed by the Hong Kong Monetary Authority on several banks for transgressions dating back some years. The fines might be the tip of the iceberg, he cautions, and as they relate to historical contraventions, there are plenty more potential past and current pitfalls waiting to be uncovered. Protiviti, he says, has the necessary weaponry to help defend banks and other financial institutions from these types of unexpected transgressions, at the same time helping those clients to future proof their systems and protocols against further calamities ahead.

Joshua explains that Protiviti is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to help leaders confidently face the future. “Our key area of expertise is our advisory work around risk issues that clients must address from risk and compliance perspectives,” he explains. “We have the processes and the technology to truly advance the science for financial institutions. And we also have the ability to create some different types of technology to assist them with the monitoring of risk and important compliance issues.”

He reports that the firm has more than USD1.2 billion of global revenues and over 4,500 people serving clients through the network of Protiviti and independently owned ‘Member Firms’ in more than 80 offices in over 20 countries. “We have served over 60% of Fortune 1000 companies and some 35% of Fortune Global 500 companies,” he reports.

Building confidence within compliance

He explains that their consulting solutions span critical business problems in technology, business process, analytics, risk, compliance, transactions and internal audit. “We are committed to attracting and developing a diverse workforce of professionals that share the common value of collaboration,” he says. “As an organisation, we believe that by teaming together, with each other, and our clients, we can see beyond the surface of the changes and the problems organisations face in this fast-changing world and thereby to help discover opportunities others might miss and as a result face the future with greater confidence.”

For the purposes of this particular conversation, he zooms in on risk management and internal audits. He points to the recent fines in Hong Kong that were levied on four banks for anti-money laundering issues.

HKMA ups the AML ante

The Hong Kong Monetary Authority (HKMA) in late November announced it had issued fines totalling HKD44.2 million (USD5.7 million) to four banks for historic anti-money laundering breaches. Swiss bank UBS, the Industrial and Commercial Bank of China (ICBC), China Construction Bank and the Taiwanese bank CTBC were found to have not met their obligations to monitor ongoing customer relationships and maintain effective compliance procedures under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), which came into force in 2012. The failings were reportedly between 2012 and 2016.

“These fines were far larger at one shot than we have seen in the past,” Joshua reports. “It reinforces our view that it is really important to have a risk assessment conducted and go through in considerable depth the high-risk clients, to make sure that you don't have any of the issues, particularly one of them being systems issues that were highlighted in some of these fines, for example not screening politically high-profile or exposed people, when they should be screened thoroughly.”

Insight from Joshua Heiliczer: “Everyone talks about AML and KYC issues being a bottleneck within the private banking and wealth management space. It's so difficult to get your clients on board. Once they're onboard, whether it's annually or every two years or three years, you have to refresh the information. Ultimately, it's more than obtaining information about ownership and IDs, those traditional considerations, but more nowadays about source of wealth, the single client view, and transaction monitoring.”

Failings can be avoided or spotted in time

He explains that is it is clear that there were many failures in terms of getting that screening conducted properly, failings in transaction monitoring systems that otherwise should have identified these issues and created alerts.

“Having that testing done to make sure that you're getting the right results is vital,” he says. “That is something that can be done from an internal audit perspective to uncover whether or not the systems are functioning in the appropriate way. And then you can conduct a risk assessment particularly focused on your higher risk accounts. This helps identify whether you have the right level of detail to approve the risk and the control associated with that, the ensuing senior management approvals, and to make sure that the right level of documentation is created and is auditable.”

Dangers lurk

The danger of failure to conduct these vital steps and make sure the right checks and balances are in place is that more and larger fines are levied. “I think the highest recent fine was around USD3 million on one institution, but we expect these fines to escalate beyond that in Asia, perhaps not to the levels seen in Europe or the US, but certainly more fines and higher fines. Moreover, the remedial consequences and costs that ensue are usually triple quadruple the amount of the actual fines.”

Joshua says this is a key area in which Protiviti can help clients. “This is of course a key area where we consult with clients, coming in to do risk assessments around their own client bases,” he says. “We will look at the documentation associated with high-risk clients, we will benchmark some peer banks in the private banking space and in the wealth space to make sure that the controls are at the level that the regulator as well as their peers expects. And we can also conduct a system type analysis to determine whether or not the alert functionality and the rate flow from a fee perspective are working properly.”

Insight from Joshua Heiliczer: “There is never a worse client experience within the private wealth space than asking for KYC and other AML information. Of course, you must ask these questions for compliance, but the clients never like the process, so the more that you can obtain from other data points, the better off you're going to be from a client experience perspective. You can target some of the ongoing monitoring that you have to do as well. A lot of clients have difficulty with transaction monitoring too, because you end up asking them for questions and more information, but if you already know that information because of their wealth profile, because of the information you've obtained elsewhere, then you don't have to continue to go back to them and ask for more information. In these ways, you can minimise the client disruption around these areas.”

Continuous vigilance

The lessons must be learned continuously from these developments. “These banks and other organisations realistically need to invest more resources in these areas,” he comments. “Right now, all of the reviews are dealing with somewhat dated activity.  So, going forward, I think adding people to the function, making sure that your systems are being constantly tested, and also that you're optimising their performance to detect potential suspicious activity, especially for those banks that might have exposure to higher risk issues such as politically exposed persons, or sanctions-related issues.”

And this is ever more essential, he explains, not necessarily because regulation is tightening any further – and it has already come a long way in recent years – but because AML and KYC and ongoing activities are being charted and enforced in a more robust manner.

“The regulators are clearly more focused on ensuring that the right processes and documentation are there, they are likely to be knocking on the doors more frequently,” he reports. “Moreover, I think the regulators also are very focused on making sure that there isn't a systematic issue that's uncovered, so they are trying to get ahead of all this and will penalise more punitively and more actively for any transgressions.”

Insight from Joshua Heiliczer: “We have an outstanding template for conducting source of wealth reviews, looking at it from the different types of sources of wealth, whether it's real estate, inheritance, employment, or other sources. Secondly, we also understand from a transaction monitoring context what the regulators need and what the risk factors are within the private banking space. In reality, most of the transaction monitoring systems on the market that the private banks are using are not geared towards private banks and not geared towards their customers. But as we focus heavily on the single client view, we can help our clients gain a real holistic view of the relationship, and work with them to ultimately enhance those relationships.”

Waving the red flags

Joshua adds that Protiviti’s work with clients also involves using different types of visualisation technologies to analyse these areas. “We have developed a highly effective series of alerts to capture multiple red flags that otherwise with that client and perhaps their counterparties might go unnoticed if they are just looking at some of the surveillance, or if there are some of the risks hidden away in different silos,” he explains.

What this all means, he elaborates, is that Protiviti can bring the risks together in a more visible manner through one lens with an institutional perspective. “We can also help clients potentially look at this from a particular relationship manager or banker perspective,” he reports. “So, there are different ways that clients can now visualise and view the data to identify and understand the problem at an institutional level, or to consider the problem at a relationship manager or branch level, or even at the end-client level, and also if a number of clients are transacting with the same external counterparty.”

His final comment is that there is nowhere to hide from these responsibilities and issues, and that the equation has shifted markedly in favour of the regulators these days. “The regulators are increasingly vigilant and have ever more tools and increasing skills at assessing where there are issues with certain financial institutions that supervise,” he says. “These are issues that must be addressed and on which we at Protiviti have a wealth of experience. Do not brush these matters under the rug, that is dangerous and unwise practice. Grasp these challenges head-on and you can face the future with far greater confidence.”

Getting Personal

Joshua Heiliczer is a highly educated and skilled individual who has enjoyed an impressive career thus far. He hails originally from New York, where he studied through to completing his degree in politics at New York University, after which he went on to qualify as a lawyer at the Benjamin J. Cardozo School of Law, also in New York.

His first job in 2006 was at Goldman Sachs in New York, working in their anti-money laundering team, where he says he learned an incredible array of important lessons and skills that have helped him in his career. He moved to Hong Kong in 2010 with Goldman, before subsequently joining Citi, and later Merrill Lynch/BoA, all the time out of Hong Kong. Before taking on his current position at Protiviti in August 2020, from 2014 he had been a Partner in the Ernst & Young (EY) Financial Services Practice with a focus on Anti-Money Laundering and Counter Terrorism Financing (AML/CFT).

Joshua is married with two children of nine and two and in his spare time loves both hiking and playing chess, both of which pastimes are ideally suited to their life in Hong Kong.