���㣨Leyu����������

As part of these efforts in 2024, regulators will scrutinize:

• Data Traceability: Abilities to demonstrate, and report on, the traceability of data at both the�� customer and transaction level, as well as across business processes, systems of record, and�� systems of origin.
• Transaction Monitoring: The quality of transaction monitoring and surveillance systems,�� processes, and controls, with expectations for increased accuracy and consistency, as well as�� better and more efficient outcomes via automation. Regulatory focus in areas such as BSA/�� AML/CFT, trading activity, and KYC/CDD and beneficial ownership monitoring will continue�� along with attention to preparations for implementing risk-based compliance programs in�� these priority areas.
• Expanded Threats: The adequacy and continual improvement of threat detection, monitoring,�� and response capabilities, including the reliability of processes (e.g., due diligence, access, safeguards) and coverage of novel and emerging threats and vulnerabilities (e.g.,�� virtual currencies, sanctions evasion, malware/ransomware, human rights/forced labor,�� organized crime).

Expect regulators to focus on:

• Safeguards: Risk and fraud model management and controls related to existing and�� new products, services, customers, and geographic operations, including consumer�� protections from fraud, identity theft, and other scams.
• Consumer Treatment: Fair processing and treatment of consumer complaints, claims,�� and disputes within the fraud and investigation processes, as well as the clarity of�� consumer communications. Areas of focus will include data sharing (e.g., large data�� models, data sharing with third parties and affiliates, customer permissioned sharing),�� payments authentication procedures (e.g., P2P), model development and validation,�� account holds and freezes, and ongoing oversight and monitoring of synthetic identity fraud.
• Crypto & Digital Assets: Continued investigations and enforcement of non-compliance�� with existing regulations (e.g., unregistered offerings or sales of crypto asset securities�� or derivatives products, false statements, market manipulation, red flag indicators).

As part of their role to safeguard public trust and confidence in the financial services industry,�� expect regulators to focus on:

• Threat Detection and Monitoring: The presence of:
  • Continual process improvement to identify, adapt, monitor, and respond to changing tactics�� from threat actors, as well as to timely remediate issues, as necessary.
  • Mature insider risk programs, inclusive of behavioral models and scenario analysis, to reduce�� the likelihood of insider corruption and financial crime risk (e.g., authentication/access�� management, synthetic identity fraud).
  • Surveillance programs to monitor use of digital devices, third-party messaging platforms, and�� e-communication social tools.
• Compliance Culture: A culture of compliance and “individual accountability,�� including�� incentives for ethical behavior and culture commitment (e.g., cooperation with supervisors,�� proactive identification of misconduct, self-disclosure, timely remediation), disincentives for�� misconduct (e.g., compensation “clawbacks��), and business practices that place the interest of�� customers first (e.g., avoidance/disclosure of conflicts of interest).