CCV Fined €2.65 Million Over Transaction Monitoring Failures

Key Takeaways

• DNB Imposes €2.65 Million Fine: The Dutch central bank penalized CCV for failing to meet its continuous transaction monitoring obligations under the Wwft.
• Monitoring Gaps Lasted More Than Two Years: CCV’s system was not fully and promptly supplied with all merchant transactions during the period identified by DNB.
• Merchant Profiles Were Missing for 23 Months: CCV failed to properly load transaction profiles for 4,200 merchants, or about 8% of its merchant base.
• Alert Handling Fell Short: CCV inadequately reviewed many alerts, provided insufficient reasons for closing others and sometimes closed transactions in bulk without further justification.
• Prior Noncompliance Influenced the Penalty: DNB increased the basic fine because CCV had previously violated the same Wwft provision, then reduced the amount to reflect the recovery plan CCV is implementing.

Deep Dive

The Dutch central bank has fined payment institution CCV Netherlands €2.65 million after finding that deficiencies in its transaction monitoring system persisted for more than two years, leaving thousands of merchant profiles improperly processed and potentially suspicious activity inadequately examined. De Nederlandsche Bank announced the penalty Monday, saying CCV failed to adequately and continuously monitor transactions as required under the Netherlands’ Anti-Money Laundering and Anti-Terrorist Financing Act, known by its Dutch abbreviation, Wwft.

The failures extended beyond a malfunctioning system. DNB found that CCV did not sufficiently investigate many of the alerts the system produced, sometimes closing them in bulk without explaining why. Other alerts were forwarded to a department that did not review them. The result, according to the regulator, was that relevant financial-crime risks went insufficiently examined.

“Failure to adequately monitor transactions increases the risk of criminal money flows going undetected,” DNB said in a summary of its decision.

For more than two years, CCV’s monitoring system was not fully and promptly supplied with all transactions conducted by its merchants, DNB found. The company also failed to properly load transaction profiles for 4,200 merchants into the system for 23 months. Those merchants represented about 8% of CCV’s total merchant base.

Transaction profiles are meant to help payment institutions distinguish ordinary customer activity from behavior that may warrant further investigation. Without complete and timely transaction data, or properly configured profiles against which that activity can be assessed, monitoring systems may fail to identify suspicious patterns—or produce alerts that investigators cannot evaluate in their proper context.

DNB said its review of CCV’s alerts uncovered broader weaknesses in the company’s ongoing monitoring. In many of the cases examined, CCV did not adequately document why an alert had been closed. Some alerts were sent elsewhere but never reviewed. Transactions were also closed “in bulk” without further justification, the regulator said.

Dutch law assigns payment institutions a gatekeeper role in the financial system. Once a customer has been accepted, an institution must continuously monitor transactions conducted by or on that customer’s behalf. It must also detect unusual transactions and report them to the Netherlands’ Financial Intelligence Unit without delay.

These obligations are intended to prevent payment services from being used to move or disguise money derived from criminal activity. DNB said that a failure to meet them undermines the integrity of the financial system. The regulator determined that CCV’s conduct violated Section 3(2) of the Wwft. It increased the basic fine of €2.5 million because CCV had previously been fined for violating the same provision. DNB then reduced the penalty to account for a recovery plan that CCV submitted and is implementing.

The €2.65 million fine is not yet necessarily final. Interested parties may object to the decision within six weeks of its date. A decision on that objection may then be appealed in court, with a further appeal available before the Netherlands’ Trade and Industry Appeals Tribunal. The penalty becomes irrevocable if no objection or appeal is filed within the applicable deadlines.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.