Compliance Ninjas: Uncovering Hidden Risks in Real Estate

All right, welcome to another episode of the KYC

podcast. Thank you very much for tuning in. I am super excited to

have Rodney MacInnes joining us today. Rodney from outlier

solutions. Rodney is a compliance ninja. Has been a

compliance ninja for over 15 years now. Is that about right?

Rodney,

oh yeah, I think I'm pushing like 17 or 18

at this point.

There you go. All right. Do you want to tell a

little bit about your background in the credit, money services,

business spaces and stuff, and before we kind of get into our

topic here, absolutely.

So I started out my compliance life in money

services, businesses, I worked my way from kind of a sales

position into a compliance position because I was sick at

doing cold calling on the phone, which really helped me bridge

the gap between kind of the struggles between sales and

compliance. And so I understood what was needed from a sales

perspective, but also from a compliance perspective. And so I

was able to kind of help people understand and streamline the

process. And really I, for the most part, was the liaison

between sales and compliance, because I could speak both

languages. I moved from there into a different role that was

at the time I started an MSB and then morphed into a B lender,

and so we did a lot of mortgages for for new immigrants and

business for self and things like that. So I got to see kind

of many different sides of the real estate space. From there, I

moved to outlier, and that was 10 years ago, and just for

background, the term Ninja is what happens, is when you let

nerds pick their titles. So 11 years ago, when the company

started, our co founder Amber, decided that she had been

referred to as a compliance ninja in her previous role, and

that was what she dubbed herself, was the chief AML

ninja. And the idea is, is that we can go in and execute on a

mission, so do our deliverable, complete the mission, and then

disappear into the night and no one would ever know that we were

there.

I actually quite love the terminja, and I, as much as

I say it with a smile, I think it's actually a really cool way

of looking at what you do. So So that's cool. Wanted to chat with

you, because about a month ago, you and I were talking about

risks and and the importance for businesses of identifying risks

and how those sometimes get hidden, and you had what I

thought was a really neat story. So maybe let's, let's start from

there and see where the conversation leads. If you could

kind of tell the story in as much as you are able to anyway.

So the the fun part of of risk is it is such a

broad spectrum, and the most difficult part of it is not

knowing what you don't know. And that's this, one of the

struggles within the sector and real estate's been like it's

been regulated since day one, since FINTRAC started

regulating, reporting entities, real estate was included,

mortgage brokers. Are more recent. So this is the change in

part of the struggle that we're seeing within that space is,

come September, October, October, mid October, they're

going to be considered reporting entities. But I'm very hopeful

that at that time, we get some quality information from FINTRAC

about what we should be looking for when it comes to the risk

side of things, FINTRAC will produce what are called

operational briefs, and they're kind of a list of what they've

seen from STRS and things like that, that will provide the

industry with information about how FINTRAC looks at

transactions, when they conduct examinations and things like

that. And without that information, this is where you

get into that unknown, unknown area. And so I'm hopeful that

we'll see something that'll be useful for mortgage brokers. And

if not, it's kind of, you know, look at your look at your data,

and try and do the analysis, or refer to someone that has, like,

understandable background in that space.

Yeah, it's funny. I think part of our conversation

then, and I think what's still true is the mortgage sector

already has a bit of an idea on how to manage risks, because, on

some level, they have to. They don't want to have a massive

credit exposure, they don't want to have fraud. They don't want

fraud to happen in their sector any more than anybody else does,

and so from that point of view, they have already some of the

thinking built into into their practices, I suspect, but the

operational briefs that you're talking about, I think, are

going to be really important, because it's a different it's

different characteristics, or different. Indicators that I

think we're looking for all of a sudden, that people may just not

have the language around yet. Absolutely, is that, but a fair

way of reframing the concept?

Yeah, for sure, it's one of those struggles of

this is one thing I've spoken about since I worked in the real

estate industry. And when we sit in examinations with clients and

things like that, is, or perform effectiveness reviews is that

real estate is inherently like, for the most part, operationally

compliant, because you can't do a purchase or a sale without

filling out a litany of legal documents and collecting

identification. And like, there's just things that are

inherent within the operation of how a sale goes about. And so

the this struggle is understanding exactly to your

point. The other side of the equation, that isn't always

first, like first or top of mind, I should say the other

part of this struggle is with regards to money laundering.

There's, there's three stages of money laundering. So placement,

layering, integration, placement being the money going into the

financial sector integration or layering, where it's moved

around to obfuscate the source, the criminal source, of the

funds. And then the final stage is where you get into the real

estate space. So at that point, most of the time, it's already

been integrated and moved around, and it's distance from

that criminal origin. So tracking and finding that you

know suspicious transaction is not as easy as it may be when

you're on kind of the the first stage of money laundering, and

this has been one of the struggles within the sector. But

it it's not an excuse. It's not something that you get to be

like, well, it's really hard for us. We don't have to do anything

fin track. And I want to say 2016 I think, issued one of

their operational briefs that was directed at the real estate

sector that was like, Hey, folks, we've only seen 127 STRS

from you, and there's trillions of dollars flowing through the

Canadian real estate sector. And then, I don't know what, three

years later, we had the Vancouver model happen. And so

these are, these are some of the problems that the industry has

struggled with from day one. And I think we're moving forward in

the right direction, but it still, it still is a long way to

go. And this is, you know, to that risk part of the

conversation. This is where we're constantly trying to get

better data, more information, and things like that, from fin

track, which, which they understand, and they are trying

to produce what they can, but they also regulate a lot of

other industries. And so it's, it's a bit of a struggle, but I

think we're, like, I said, I think we're moving in the right

direction on that. Yeah,

no. I mean, I think two things I want to kind of go

back on the your the first point you made there around how far

into the money laundering process real estate ends is

exactly the reason why I think the sector has really struggled

in in their knowledge, that the amount of times people still

will say to me, well, it's okay. There's no money laundering

here. Nobody shows up at my brokerage with a bag of cash.

And that's like the regular refrain, and it's it just misses

kind of the what might be the most important point of the

whole thing when they say that the I think the what's equally

interesting to me is, yeah, the Vancouver model comes around and

has been pretty widely publicized and talked about, and

books, literally, books written on this topic, literally and and

yet, the number of STRS hasn't really dramatically increased

yet. I'm personally noticing a bit of a shift in the

conversations I'm having with Canadian real estate brokerages,

and seeing more and more of them wanting to file, which is

wonderful. I say wanting to file because, you know, there's that

whole little web reporting not working thing right now, but

that's, that's not a topic for another day. That's

a topic for another day, exactly, yeah, but there are a

number of brokerages who are now seeing how they should be filing

STRS, and that's that's really cool.

Back to your your original question about

kind of situations and things like that. I'm going to tell a

story from when I was a compliance officer at a at a

company, mortgage broker company, and I kept seeing

something that just seemed odd to me, and I couldn't make sense

of it, and it just it rubbed me the wrong way. And as a

compliance nerd, people understand this. Who understand

compliance from a sales side of things, this is something I'm

I'm not as familiar with folks paying attention to or or caring

about as much. For me, it was because I'm signing my name onto

that transaction to say, like, yes, this can proceed. I want to

be certain that it's not going to come back to bite me later.

And so I kept seeing these bank statements that were. Uh, like,

they just, they just looked different. And they didn't look

different enough that it was clear that there was something

obviously wrong with it. They just, they were older. So as you

start to, you know, see bank statements all the time, as

you're funding mortgages and stuff like that, for whatever

purpose, you start to understand that, like, okay, TD actually

just recently changed their font size, and so now the name of the

person is a slightly larger than the address listed on the bank

statement, and you start to understand that what it should

look like. And then when someone produces a bank statement that

doesn't look like that, then it begs the question, why is this

different? Sometimes they pulled it on their phone. That makes

sense. Sometimes it's actually a physical bank statement that was

mailed to their house that makes sense, but you start to

understand and be able to dig a little deeper into what exactly

is going on. And in those instances, was a very simple

explanation. I downloaded it on my phone, or it was mailed to my

house. That's why it looks different. So those, those

simple questions immediately alleviated my concern that said

some of them didn't. There was no, there was no clear response.

The person was just like, I just, that's my bank statement.

That's what was mailed to me. It's like, okay, no problem. So

I took it upon myself to do some some research. And I like,

frankly, I went home, I went on to the dark web, and I did a

search for Canadian bank statements. And it was baffling.

Like, for 50 bucks, I think I could buy any major Canadian fi

bank statement, and it gave me a template, it gave me the fonts I

had to use. There was a how to and it gave me dummy

transactions that I could feed into my bank statement to make

it look legitimate. And I could put whatever information on it

with whatever numbers I wanted to. And then all I do is save a

PDF 50 bucks, and that's a good deal, right until you get your

mortgage for more than you can afford,

right? Yes, there's a bunch of problems with this.

Let's a big problem.

So it was, it was one of those things where

all of a sudden I had this, oh no, we've, we've got, we've got

issues here, and I don't know how to fix it, because they're

like, the quality of these things. It's a it looks exactly

the same. But I found, I found the thing that indicated what

was different between a legit and an illegitimate bank

statement, and it was the print form. So when you get a printed

bank statement from a bank, it's going to have the little kind of

dots and printer logic on the bottom of it that traces it back

to its origin, where it's a PDF from a website. That's a little

trickier, but what we're seeing a lot is folks like saying that

it was a PDF of the online bank statement, right? But it would

have to be like perfectly level, and if it's slightly askew, you

know, that can't be the case, because, I mean, it's a

computer, it's going to be as perfect as it kind of can be

without being true level for all of my Rick and Morty fans out

there. So it's one of those items that once found, then we

had to do a look back, and it resulted in, I think, somewhere

between 20 and 30 STRS at the time on accounts that we had

opened, and we're still like, I mean, these mortgages were

funded. There's not really much you can do at that point. And

frankly, the obligation is to, like, submit that suspicious

transaction report from a credit perspective, that was not my

department, so I can't comment on what happened there, because,

frankly, I don't really know. Once it, once it's kind of

approved, I'm subject to the ongoing monitoring, and that's

where my kind of liability lies. So I want to make sure that the

funds came in consistently from where they said they were going

to, and we're not getting third party deposits and things like

that. But as far as how the credit was handled and the other

factors involved, I don't know, and frankly, it was B lending.

So it was the mortgages were not long, long periods of time. They

were usually a year, maybe two, and they probably went somewhere

else after that.

And by definition, they were a little bit higher

risk to start with. So, you know, yeah, that's an

interesting story. What I what I like I think about that story,

and why I think it was, why I really wanted to kind of have

you back on and talk about that a little bit. Is it highlights

for me that there's no, like, one way that you're going to

identify problems within your business. And I want to say,

like, what you've just told us is a really interesting story

about potential money laundering, but also about just

downright, like, straight fraud that that business probably

would not have wanted to be involved if had they had the

information at the outset. And so the neat thing in my mind

about anti money. Laundering policy and procedures is that

you're actually like, protecting your business as well from from

risk, which is where this all started, I guess, this

conversation and but the the message I really want to pull

out of it for our listeners is the importance of kind of

thinking about things differently, or thinking about

why they're doing what they're doing, rather than just wrote

filling in forms, which is all too often how, certainly in the

real estate sector, people's view fin track where it's well,

we'll fill out the form, we'll be fine. And if that's the view

of a compliance officer in the sector, then it's no wonder

we're not seeing good data, because there is no good data at

that point. So

I think you hit the nail on the head with, you

know, trust me, as a compliance person, I wish there was a flow

chart or a checklist or something that was like, if this

then this equals suspicious. That would make life way easier.

And fin track would have been screaming that from the

rooftops, because that's one of the thing. The other thing we

hear is like, this is fin tracks job. It's like, no fin tracks

job is actually to regulate the entity, like regulate the

industries and take what is produced by the Department of

Finance, because they write the legislation. It's fin tracks job

to interpret it. So for them to go out and do the adjudication

of what's suspicious or not is a like a massive overreach. And as

someone who consults with numerous different businesses

across numerous different industries, I don't on a rare on

a rare occasion, I will sit down with someone, go through a

suspicious transaction or something they think is

potentially suspicious, and talk through it to help them, because

there's a lot of like items and idiosyncrasies between their

business, their customer, their average customer, the

information that they have on file, the the amount of time it

takes them to explain to me enough information for me to

make a rational determination, or at least help them make a

rational determination, like when I do that, it's never me

that gets to make the final decision. I'm talking that

person into their decision. I'm helping them get to the final

endpoint. And so this is one of one of the items is that, yeah,

there is no clear determination. And for the most part, one

single indicator is enough to make your gut go. That feels

off. When you get a second indicator, you're not like,

okay, we're getting close to like, with this needs to be

escalated to compliance for an investigation. And in those

instances like I was referring to before, where the bank

statement was just it just didn't look what I expected. I

asked, got an answer, and I moved on. It was, it was really

that simple, instead of what happened later when I realized

that we actually did take a bunch of bank statements that

may not have been legitimate, and honestly, I have no idea.

There's nothing concrete that says that it was or it wasn't.

It just looked suspicious, and that's all that need. That's all

you need to file a suspicious transaction report. Is

reasonable grounds to suspect. You don't have to know, you

don't have to believe. You just have to like suspect it looks

odd. I'm gonna tell FINTRAC about it. And

if there's another string to pull on all of that,

it's that it didn't negatively, directly impact your business.

You didn't have to stop doing business with these people.

Quite the contrary. In fact, you couldn't. In those cases, they'd

open the mortgage. You're doing business with them, whether you

like it or not. And I think that's the other fear that I've

certainly heard from from people, typically in a sales

capacity, where you know their their livelihood is based on

making the sale, or on processing the deal, on whatever

industry that is, and there's no requirement to stop working

while there is okay if you want to get technical, the

terrorists, not sure, okay. But for the most part, there's no

requirement to stop working with. I'm

also going to throw another caveat on that, if

your customer is like, I'm just about to launder this half a

million on this condo. So I just need you to get this go through.

I'm not going to give you any other information, and then my

money is laundered. I'm going to sell the condo, and I'm good,

don't do that transaction. When you that's when you know there's

a money laundering offense involved, without a doubt. Don't

do that transaction. But where something is suspicious, or

you've got a customer that's presenting as high risk, nothing

says you can't do that. It becomes a risk based decision

within the entity to say that, yeah, this one's a little higher

risk based on the information that we have, but I don't have

anything here, which blatantly tells me this is related to a

criminal offense, actual money laundering, terrorist property,

terrorist financing, something along those lines. And so that's

where in those circumstances. You want to do that what is

referred to as enhanced due diligence, which is basically

something that you do that you don't do for every other

customer. So it's something you do above and beyond. So besides

the identification, besides all the KYC information that you're

collecting, maybe I'm going to do a Google search. Let's go

Greg dent scam, or Greg dent crime. And if I don't see

anything, then I feel better about that. And so those are,

those are the things that FINTRAC is expecting you to do,

is, is something else. So it's not enough to just say, Well,

yeah, they're high risk, but we're okay, we're we're not risk

averse. Let's, let's just plow ahead. You got to do something

else. So you need that, that little bit of extra. And so

where, you know, back to the bank statement thing, where you

just ask the question that meets enhanced due diligence

requirements. So it's really prescriptive on, or it's not

prescriptive, sorry, on what you have to do. It's really based on

the situation. So if somebody gives you an ID, and you look at

it and be like, that doesn't look anything like you can you

give me another piece of ID and they say, Sure, no problem. You

know, I put on 100 pounds during covid. Like, okay, that makes

sense. Your passport looks nothing like your driver's

license, but you look like at least one of them. Boom, that's

enhanced due diligence right there. Like, it doesn't have to

be complicated. It's really meant to either help you

mitigate the risk or or understand the risk or not. And

then the situations where it's not, then you get to have the

conversation with compliance, or frankly, compliance gets to make

the decision on whether it's actually suspicious and triggers

a reporting requirement. Yeah,

no, that. That all makes sense and super helpful.

And for listeners who want to learn more about adverse media,

which is one of those enhanced due diligence things, we do have

an episode of this podcast specifically about that, so feel

free to look that up. Yeah. So, yeah. Thank you. I think this

has been really a useful dive into risk and kind of the meat

and potatoes of what an AML policy and procedure really

ought to be about. Is there anything else that you think

that we really should have talked about through the course

of this that we've we've missed out any big, big takeaways that

we haven't touched on

one item that you just mentioned recently. So

the the industry is really focused on, you know, the

transaction, because sales is driving, you know, is driving

the transaction with a commission at the end of the

line. And so there's an inherent incentive to complete the

transaction. Otherwise, frankly, you're not getting paid and and

this is one of the struggles that we see, is that folks are

kind of like, I'm just going to pretend I didn't see that,

because I want to get my commission check. And it's

trying to drive home the understanding that just because

you see something that isn't a clear path to you know, a

closing of a transaction doesn't mean that it's not going to

happen. It's just it's an extra step. And like as a brokerage,

you're looking to help your staff understand the

implications of not doing what needs to be done in those

situations. And if you looked at any fin track penalty that has

occurred within the last two years, a huge focus on that is

around unreported, suspicious transactions, those are deemed

very serious under the proceeds of crime, money laundering,

terrorist financing regulations specific to administrative

monetary penalties, which are the penalties that FINTRAC gives

out. They are non punitive. They're meant to encourage

compliance. But at the same time, if you've seen some of the

numbers that have come out, they're not small, basically

punitive

to those businesses, I can assure you,

yeah. But like, look at the US or Australia or

things like that. Like that, like you want to see punitive

those are punitive measures when you're looking at, like,

hundreds of millions of dollars. Anyways, it's one of those

things that you really have to underscore with with staff and

train on what to do in those situations and what to look for.

So back to the beginning of the conversation about the

information that is provided from FINTRAC. That is what

FINTRAC is going to look for when they come in. So staff need

to understand that these are the things you need to be monitoring

for, and where something just seems off like it's hard to

convey how much better things will be if you just say

something, yeah, I don't know this happened, and it seemed

kind of weird, and I'm not sure what to do. Well, why don't you

ask them where they got their bank statement? Oh, it was not

from printed online. It was mailed to them. That makes

sense. I'm good. Suspicion alleviated. And like on top of

that, it is understanding within your business, the team members

that are there and you know, folks that maybe require a

little more oversight, and things like that, or additional

training and things that, to that nature is, is one of the

items when we do an effectiveness review, is we do

staff interviews, which can happen in a fin track exam. Fin

track may pull certain. Staff and just ask them general AML

questions. So in order to test the effectiveness, when we do a

review, we do that as well. One of the conversations I have with

the compliance officer before I do that is, do you have any

problem children? Is there anyone that you may want me to

ask? And most of the time, the answer is no, but every now and

then someone's like, actually, so and so is always lagging on

doing their training. I have to push them and they wait right

until the very last day to get it done. If you could just

include them in that questionnaire that would, that

would be perfect. And so it's, it's understanding, you know,

we're talking risk. It's understanding the risk inside

your business as well. So not only the external risk that your

customers or clients are presenting, but the internal

risks that you're maybe not aware of, and this is one of

those big, big you don't know what. You don't know items and

you know, interacting with your staff, looking at transactions,

reviewing the data that's being produced, and things like that,

will really help drill down into what may require a little more

attention. That's a, that's

a, I mean, I that's a great way of phrasing. And I

think, you know, when I look at most of the people I talk with

within the real estate sector, the the two places where I can

almost always get people to say, Oh, well, maybe we aren't in a

great place. Is when I asked them, what would your How would

your agents know to make a other than low risk determination?

What criteria would they use? What what evaluative measures

would they have for that? And normally, the compliance officer

says to me, I don't know. I mean, if they're from a country

of of higher risk would be the only reason, and that's like,

the better ish answer. So I guess my my point on all of this

is, I think that that training piece that you're talking about

and and making sure that training piece is across the

sex, across the whole organization, so that you don't

have that problem child, because that's where, that's where your

business has a has a risk that you may not be aware of. It may

and you really don't want in your business. It doesn't

even have to be a problem child like the other

issue you look at is consistency. So where Rodney,

the compliance nerd, says this is suspicious, but also do sales

sometimes. So where I'm looking at a transaction, I say this is

suspicious, and we file an STR on it, and Greg looks at a very,

very similar situation and is like, this is fine, and moves

forward and doesn't file an str. When FINTRAC comes in, they're

going to say, Okay, why do you file on this customer, but not

on this customer? Explain this to me, and that is a really,

really difficult conversation to have. And so this is where you

know, back to that training piece is extremely important for

folks to understand those red flags that you're looking for,

because if you're seeing similar red flags, and you decide to

report on one, you should probably be reporting on the

others. And so that's the other is like, if you've, if you've

done some recent reporting, maybe as part of your ongoing

monitoring. Let's go back through the last month, three

months, six months, depending on how many transactions you're

doing, and just like, double check to see if those red flags

were present in any other of your files. Because from a

record keeping perspective, you should have reasonably enough

information to kind of look for those things, but also it's like

an easier mind situation, that if FINTRAC calls, you're not

wondering, oh no, was there one of those in the background that

I missed? Yeah, which is always, you know, a looming fear as

someone who's been in that position, staying on top of of

the ongoing monitoring of the transaction that's going through

and on the training with your staff will help calm you down

when it comes to time for a fin track exam.

Yeah, lovely. Well, thank you so much for taking the

time. I've really appreciated the chat. I hope our listeners

will appreciate the the in depth thoughts around risks and the

the importance of creativity in determining risks and in

examining risk and examining your your business, I think, is

probably how I could best summarize this conversation. So

thank you so much for trusting your gut. Yeah,

no problem. Thank you for having me.

Have a wonderful rest of your day.

Yeah, you as well.