Crane Capital Risk & Compliance Training 2025

Crane Capital Risk & Compliance Training - February 2025

• Training Focus: 2025 Crane Capital's key risk and compliance focus

• Agenda Topics:

  • Policies, Procedures, and Guidelines
  • Third-Party Risk Management Program
  • Anti-Fraud, Corruption, Money Laundering, and Terrorism Financing
  • Data Privacy and Cybersecurity Hygiene
  • Business Continuity and Crisis Management
  • Incident Reporting
  • Quiz
  • Closing Remarks

2025 Crane's Key Risk & Compliance Focus

• Focus Areas:
  • Reinforce Compliance Commitment
  • Foster a Culture of Accountability
  • Strengthen Internal Controls
  • Adapt to Evolving Risks
  • Enhance Crisis Management and Resilience
  • Cybersecurity and Data Protection

Third-Party Risk Management (TPRM) - Lifecycle

• Stages: Onboarding, Ongoing, Offboarding
• Components: Risk Assessment and Due Diligence, Procurement and Sourcing, Vendor Creation, Vendor Maintenance (Governance), Vendor Monitoring, Oversight and Accountability, Documentation, and Reporting, Independent Review, Termination, Exit Strategy, Third-Party Closure

Third-Party Risk Management (TPRM) - Workflow

• Processes: Identification of Third Parties, Assessment, Due Diligence, Policies and Procedures, Tools (outsourcing policy, materiality assessment, procurement policy, vendor management policy, due diligence questionnaire, etc), Other Compliance Requirements, Supplier Code of Conduct Letter of Commitment, Procurement Request Form

Money Laundering Red Flags

• Use of Third Parties: Using a friend or family member to purchase property on behalf of the owner, settling differences with undisclosed cash payments, and using multiple banks for deposits to avoid transaction limits
• Manipulation of Property Values: Buying and selling property at a price exceeding or falling below market value
• Use of Illicit Funds: Paying for unneeded renovations and improvements
• Shell Companies/Trusts: Using shell companies or trusts to disguise ownership

Real Estate – Prime Target for Money Laundering

• Reasons for Attractiveness: Ease of cash transactions, stability, and reliability as investment, and the ability to improve property value
• Targeting of Regions: Regions with opaque real estate markets and limited regulatory oversight

Gifts Declaration

• Gift Policy: Gifts to external parties must be under US$100. Any exceeding US$100 requires a valid reason stated in the request and approved by the Managing Partner.
• Company Recipient Specification: Recipient company must be specified in the gift request. If gifts are to individuals within the company, individual names and gift amounts need listing.
• Restrictions:
  • Offering gifts or hospitality may be seen as influence-seeking.
  • Gifts/hospitality offered during tenders or contract renewals to foreign officials.
  • Gifts exceeding company thresholds.
  • Using vouchers/discounts to circumvent rules
  • Donations or sponsorships may appear as undisclosed bribes.
  • Actions disregarding red flags.
  • Actions that are inappropriate in nature.
  • Actions taken during pending business decisions.
  • Violations of laws or regulations
• Prohibited Activities: Crane Capital does not support charitable or political donations.

Prevention Measures

• Fraud Prevention: Information Technology Policy Framework and Procedures, Multifactor Authentication, Biometric authentication, Segregation of Duties, Invoice and Cash Management, Whistleblowing Policy, Whistleblower Protection
• Bribery & Corruption Prevention: Policies for gift allowance, zero tolerance for bribery, due diligence screening for adverse news reports, anti-fraud, corruption, money laundering, and terrorism financing policy and global compliance regulations

Key Fraud, Bribery, Corruption, AML/CFT Cases of 2024

• Evergrande: China property giant and its founder accused of $78bn fraud
• Mas Imposes Composition Penalty: S$2.5M on Swiss-Asia for AML/CFT Breaches.
• TD Bank: Hit with record $3 billion fine over drug cartel money laundering
• UK Engineering Firm Arup: Victim of a £20 million deepfake scam
• Deepfake Elon Musk: AI-generated scams contributing to billions in fraud

Cybersecurity Hygiene

• Problems: Weak passwords, ignoring updates, clicking on suspicious links, not backing up data and sharing too much online.
• Solutions: Regular software updates, strong passwords, phishing awareness, secure Wi-Fi practices, system & network security, regular patching, secure third-party access, monitoring

Business Continuity

• Business Continuity Planning: Ensure Crane Capital can continue operating during and after a crisis, plans for uninterrupted business operations
• Disaster Recovery: Process of restoring IT infrastructure and data access, reestablish access to applications and data quickly
• Crisis Management Response: Focus on responding effectively to unexpected events

Crisis Management Team (CMT)

• Responsibilities: Ensuring continued operations, response-to-disruptions, allocating resources, providing updates to board, coordinating crisis-related tasks, implementation of communication plans with stakeholders

Information Security Incidents:

• Types: Unauthorized disclosure of sensitive information, theft/loss of devices, virus/malware outbreaks, denial-of-service attacks, unauthorized access to systems/data, compromised user accounts from phishing attempts by criminals.
• Reporting Process: Report to the Crisis Management Team (CMT)

Incident Reporting

• Key Elements: Incident Types (fraud, theft, cyber threats, operational disruptions, financial reporting irregularities, etc), Response Strategy (timely notification to CMT, investigation, validation, communication to WSIB), Incident Notification Process (who, when, where, why, how data received, how reported to CMT), Incident Investigation, Reporting (escalation process, reports to WSIB), Incident Closing and Follow-Up

Data Protection Principles

• Data Protection: Technologies, processes, practices for data availability
• Data Security: Protecting data from theft, corruption, unauthorized access throughout its lifecycle
• Data Privacy: Ensuring data users and sources understand data collection, usage, management, and monetization of sensitive data.
• Data Minimisation: Only the necessary data is collected.
• Principle of Least Privilege: Only authorized users get necessary access, reducing compromise risks
• Data Classification: Categorizing data based on sensitivity (personal, work, protected, confidential, highly confidential) for prevention
• Encryption: Protecting data using encryption techniques

Closing Remarks

• Reduce Risk: Reduce likelihood of misconduct, regulatory violations, and reputational harm
• Promote Ethical Culture: Foster a workplace culture of integrity, honesty, and transparency.
• Employee Engagement: Engage employees in ethics and compliance, making them more likely to act responsibly.