Although UK credit unions are different from their Australian counterparts, the UK Financial Services Authority has published a report on its review on AML/CTF compliance by 32 UK credit unions which is of interest.

Some key points:

• staff were not clear about who was responsible for what AML issues;
• staff often relied on trust and personal knowledge rather than formal policies and procedures;
• In some cases the credit unions used formal money laundering reporting forms to update the MLRO, others used informal notes;
• some credit unions still rely on personal knowledge of new members and do not make adequate identity checks. Checks on junior savers were inadequate in a number of cases. Some credit unions did not perform any checks at all on juniors;
• training in all aspects of anti money laundering controls and financial crime
  prevention was weak;
• data security varied: "For example, paper files should be locked in secured cabinets with the keys locked in a safe or other secure place; we did see instances where keys were simply left on top of the cabinet…We saw examples during visits where passwords were shared..Some credit unions visited did not know what levels of access had been agreed for third parties needing to interrogate customer records, be it paper or IT based. ..In some instances credit unions had not considered the secure disposal of electronic data and the need to review systems regularly to dispose of records that are no longer relevant."

The FSA also has examples of good and poor AML practice.

Your compliance framework needs to have a designated officer as the primary contact for dealing with your regulators.

You may have other staff who deal with regulators on a day to day basis but your CEO and other senior managers should have an ongoing relationship and dialogue with key regulators on current matters affecting your organisation.

Who are the key regulators for financial service mutuals?

• prudential supervision: APRA
• AFS licensing and consumer protection: ASIC
• competition and fair trading: ACCC and State Fair Trading Offices
• AML and sanctions: AUSTRAC
• Privacy and credit reporting: Privacy Commissioner

Depending on your size and areas of business you’ll also deal with RBA (payment system including purchased payments such as smart card etc) the ATO and other regulators (such as PHIAC for health funds).

Whilst credit union and mutual websites are generally good at disclosing product information, a review of websites shows that the amount of corporate information disclosed (usually under the  "About Us" link) varies.

Information typically ranges from only recent newsletters  to copies of annual reports and, less frequently, disclosure of corporate governance policies and director and management information. ADI’s are now required to report on their capital adequacy and credit risk exposures.

APS 330 (pdf) requires locally incorporated Australian -owned ADI’s, including credit unions and building societies, to report by 25 November 2008 on their basic capital information for the quarter ending 30 September 2008 and then within 40 business days after the end of each subsequent quarter. (see Attachment B for reporting details).

The disclosures required in Table 15 of Attachment B must be published (if the ADI is not listed on a stock exchange) on an annual basis as soon as practicable after the lodgement date for the ADI’s annual financial reports as required under the Corporations Act 2001.

The reporting requirements include:

• An ADI must publish its Prudential Disclosures on its website, in full in a clearly identifiable location.
• An ADI, in making a disclosure, must decide which Prudential Disclosures are material. An ADI is not required to make a Prudential Disclosure if the matter to be disclosed is not material. Information is regarded as material if its omission or misstatement could change or influence the assessment or decision of a user relying on that information for the purpose of making economic decisions.
• the ADI will not have to disclose those specific items that are proprietary and/or confidential in nature subject to APRA’s prior written approval . However, it must disclose more general information about the subject matter of the requirement, together with the fact that, and the reason why, the specific items of information have not been disclosed.

To ensure appropriate accountability, an ADI’s Chief Executive Officer must attest to the reliability of the Prudential Disclosures in the ADI’s annual declaration to APRA required under Prudential Standard APS 310 Audit and Related Arrangements for Prudential Reporting.