An urgent USD 8.5 million subscription from a nominee company
Kah Loong is the compliance officer of a CMSL fund management firm. On 20 May, relationship manager Siti submits an onboarding file for Vantage Crest Holdings Ltd, a BVI company, seeking to invest USD 8.5 million in the firm's wholesale fund. The sole director and shareholder is a 26-year-old nominee with no stated occupation; the beneficial owner is a former deputy minister of a neighbouring country who left office three years ago. The funds are already sitting in the firm's subscription account, remitted from a law firm's client account in Hong Kong. Siti notes the client is 'in a hurry' because the fund's quarterly window closes on 31 May, and has offered to send a notarised passport copy 'later'. Siti also mentions that the beneficial owner's nephew is an existing client who has referred three new investors this quarter. The firm's automated risk tool rated the client 'medium' because the company is incorporated in a jurisdiction the tool does not flag. The CEO wants the subscription accepted to meet the quarter's RM25 million sales target.
1. Set out the red flags in the file and explain how a risk-based assessment should have scored this client. Distinguish risks arising from the client, the funds and the distribution channel.
Read the worked answer
The client-level score of 'medium' is not a risk assessment; it is a jurisdiction lookup. Going through the file properly:
Client risk - high. A BVI company whose sole director and shareholder is a 26-year-old with no occupation is a nominee structure with no visible economic rationale. The beneficial owner is a former deputy minister of a neighbouring country - a politically exposed person. PEP status can expire as the person steps back from office, but three years is well inside the window in which family and close associates usually remain elevated risk, and the classification should be high until enhanced due diligence says otherwise. The nephew who refers three new investors in one quarter is a family relationship that also touches the referral channel.
Funds risk - high. A remittance from a law firm's client account in Hong Kong obscures the originator and any intermediate parties. The firm must trace source of funds back to the actual account holder and explain why a law firm's client account was the vehicle; 'pooled client money' is not an answer.
Channel and behaviour risk - high. Urgency tied to a closing date, a passport 'later', and an internal sales target are pressure indicators, not diligence.
Control risk. The tool rated this as medium, which means the firm's risk model is not doing its job. The correct approach is a manual override to high, documented with reasons, and a review of the model itself: any model that scores on incorporation jurisdiction alone will systematically miss PEPs and nominee structures.
2. What should Kah Loong do now - before, at and after the point of decision? Address the funds already received, the reporting obligations and what may and may not be said to Siti and the client.
Read the worked answer
The decision point is not the closing date; it is whether customer due diligence is complete.
Do not transact. Customer due diligence is not complete: the passport is outstanding and beneficial ownership is unverified. The subscription must not be executed and the monies must not be placed in the fund. If the funds are already credited, hold them in the subscription account untouched, obtain legal advice on returning them to the originating account, and document the decision. Do not simply sit on the money and wait for the deadline to pass.
Enhanced due diligence. Verify the beneficial owner and the nominee against independent sources; obtain documentary evidence of source of wealth (business interests, exit from office, asset disposals) and source of funds tracing through the Hong Kong law firm; run adverse media in both jurisdictions; and require senior management approval for a PEP relationship, recorded in writing. If any of that cannot be obtained before 31 May, the answer is no - and the firm should say no on the basis that documentation is incomplete, not on suspicion.
Report. Submit a suspicious transaction report promptly to Bank Negara Malaysia's Financial Intelligence and Enforcement Department, and report to the SC as supervisor in line with the firm's obligations. Do not wait for EDD to finish, and do not disclose the report.
What not to say. Do not tell Siti or the client that a report has been made, or hint at it by asking suddenly for 'source of wealth documents' in unusual detail. The tipping-off prohibition and the relationship manager's reaction both require a neutral, documented request for outstanding documents.
Afterwards. Review the nephew's file and the three referrals for common addresses, devices or funding sources; log the model failure; and record the decision and its basis for retention.
3. The CEO argues that 'nothing is proven, we are about to lose the allocation, and compliance is over-reading the risk'. Prepare the response, including what the board should decide and what should happen to the sales pressure itself.
Read the worked answer
The CEO's framing contains a category error: the question is not whether money laundering is proven, but whether the firm has done enough to know who its client is. A suspicion-based regime is designed to act before proof.
The response.
- The firm cannot lawfully establish the relationship while CDD is incomplete. Accepting USD 8.5 million from an unexplained law firm client account for a PEP-owned nominee company is precisely the transaction pattern that supervisory examinations test.
- The personal exposure is not theoretical: the CMSA's licensing regime and the AML/CFT framework reach senior management and the compliance function, and 'the CEO wanted the target met' is not a defence - it is evidence.
- Losing one subscription is a fraction of the cost of a supervisory finding, an STR that was never filed, or a client whose funds turn out to be proceeds of crime.
What the board should decide. Reject the subscription unless and until full EDD and senior management PEP approval are complete; authorise the return of funds if that is not possible; approve the STR filing; and require a remediation plan for the risk-scoring model within 30 days, with testing against a sample of onboarding files.
The sales pressure. A quarterly closing window plus a sales target plus a relationship manager who describes a client as being 'in a hurry' is a designed conflict. The board should remove AML decisions from the sales line entirely, make it explicit that no one is penalised for losing a deal on compliance grounds, review how targets are set, and require the compliance officer to have a direct reporting line to the board or its audit committee. Otherwise the same conversation will recur next quarter with a different client.