Afterpay money laundering audit finds breaches came from ‘incorrect’ legal advice

The 300-pages of the Final Report unpack Afterpay’s efforts to comply with Australia’s anti-money laundering/counter-terrorism finance (AML/CTF) laws, dating back to February 2015, when the fintech first began offering buy-now-pay-later services.

In January 2016, Afterpay began due diligence on merchants and retrospectively applied it to the small number of merchants it had existing agreements and finalised its first AML/CTF program in June that year.

But it wasn’t until 4 November, 2016, that Afterpay began to collect the date of birth for new consumers when they registered, and another  20 months passed before Afterpay “undertook retrospective remedial activity” to collect birth dates for pre-Nov 2016 consumers.

In June this year government’s financial intelligence regulator AUSTRAC, raised 12 concerns around buy-now-pay-later venture breaching AML/CTF laws and ordered the audit.

Jeans has been investigating since July and the company announced during its annual results in August that it was withholding short term incentive awards for its senior executives until the final report of the external audit was released.

In a five-page cover letter accompanying the report, Neil Jeans says: “The initial legal advice provided to Afterpay did not reflect Afterpay’s business model”, and the company developed its compliance policies based on that advice and subsequent incorrect legal advice.

“Despite Afterpay having a compliance-focused culture, the consequence of being provided with incorrect legal advice has resulted in historic non-compliance with the AML/CTF Act and Rules,” he said.

The key findings of the Jeans audit include an assessment that Afterpay is a low risk business in regards to its vulnerability to be used for money laundering or terrorist financing.

“Notwithstanding this, the risk controls in place must remain commensurate with business growth. Afterpay must enhance its existing controls to identify Politically Exposed Persons (PEPs) and the risk they may pose. It is noted that Afterpay have commenced a project to address this issue” he said.

The company said in releasing the report that it had not identified any money laundering or terrorism financing activity via its systems to date.

Jeans said Afterpay’s board and senior management oversight and governance has matured significantly as it moved from startup to ASX 100 company and “there is now an appropriate level of awareness and engagement”.

“Afterpay has a strong compliance culture, supported at the highest levels, which is clearly evident based on one-to-one conversations with Directors, Senior Management and key AML/CTF compliance personnel,” he said.

Jeans said Afterpay’s AML/CTF program had also evolved and is now appropriately aligned to the laws, praising the company’s current approach as “now effective, efficient and intelligent” thanks to increased resource allocation.

The problems, he concludes, began with the initial advice.

“Based upon legal advice in 2016, Afterpay initially focused its AML/CTF controls upon merchants. Afterpay’s current AML/CTF controls are more appropriately focused on consumers, given the Designated Service Afterpay provides,” Jeans said.

In its statement to the ASX, Afterpay said it fully accepts and is actioning all recommendations from the Independent Auditor.

“AUSTRAC will now consider the Report and determine whether it will take further action. The Company will continue to fully cooperate with AUSTRAC both in relation to the Report and our AML/CTF compliance more generally,” Afterpay’s statement said.

“The Company has benefited from the independent audit process which has enhanced the Board and management’s knowledge and understanding of Afterpay’s AML/CTF compliance generally.”