Third Party Risk Management Quiz

Crane Capital Risk & Compliance Training

• Date: February 2025
• Agenda:
  • 2025 Crane's Key Risk & Compliance Focus
  • Policies, Procedures and Guidelines
  • Third Party Risk Management Program
  • Anti-Fraud, Corruption, Money Laundering and Terrorism Financing
  • Data Privacy and Cybersecurity Hygiene
  • Business Continuity and Crisis Management
  • Incident Reporting
  • Quiz
  • Closing Remarks

2025 Crane's Key Risk & Compliance Focus

• Reinforce Compliance Commitment
• Foster a Culture of Accountability
• Strengthen Internal Controls
• Adapt to Evolving Risks
• Enhance Crisis Management and Resilience
• Cybersecurity and Data Protection

Third Party Risk Management Program (TPRM) - Lifecycle

• Onboarding: Risk Assessment and Due Diligence, Procurement and Sourcing, Vendor Creation
• Ongoing: Performance Monitoring, Re-assessment and Due Diligence, Renewals, Vendor Maintenance, Governance Oversight and Accountability, Documentation, and Reporting, Independent Review
• Offboarding: Termination, Exit Strategy, Third Party Closure, Vendor Monitoring

Third Party Risk Management (TPRM) - Workflow

• Third Party (Non-Exhaustive List): Joint Venture Partners, Outsourced Service Providers, Commercial Agents/Sales Representatives, Consultants/Advisors, Contractors/Sub-Contractors, Vendors/Suppliers of Services, Insurance Brokers, Service Providers
• Third Party Assessment - Determine whether a service provider is already provided by Crane Capital, Outsourcing.
• Applicable Due Diligence Policies and Procedures- Outsourcing Policy, Outsourcing and Materiality Assessment, Procurement Policy, Vendor Management Policy, Supplier Code of Conduct.
• Tools: Online Adverse News Search, Initial Due Diligence Questionnaire, Outsourced Service Provider Assessment, Ongoing Performance Monitoring, Third Party Risk Rating and Due Diligence, etc.
• Other Relevant Risk and Compliance Requirement: Conflicts of Interest Declaration, Related Party Transactions, Non-disclosure agreements (NDA).

Money Laundering Red Flags Indicator in Real Estate

• Use of Third Parties: Buying property as legal owner (using a friend or family member to purchase property on their behalf)
• Manipulation of Property Values: Buying and selling property at prices above or below market value
• Large Deposits (avoiding reporting thresholds): Paying large deposits for property with checks from multiple banks
• Use of Tenants for Commingling Funds: Using a "tenant" collaborator to combine funds to cover rent payments
• Illicit Funds for Renovations: Using illicit funds to pay for unnecessary renovations and improvements
• Shell Companies/Trusts: Using shell companies, trusts, and company structures
• Overseas Investment: Foreign criminals investing in real estate
• Excessive Renovation: To distance from criminals from the property they own

Real Estate - Prime Target for Money Laundering

• Ease of Cash Purchases
• Disguising Ownership
• Investment Stability
• Increased Market Value

Sector Specific Fraud Tactics - Real Estate and Property Management

• Increase in Rental Application Fraud: Exploiting digital systems to forge documents, leading to higher eviction risk and bad debt.
• Rise in Title Fraud: Criminals altering property ownership records using stolen identities, securing fraudulent loans, or selling properties they don't own. Remote transactions risk this fraud.
• Luxury Real Estate as a High-Risk Target: Rental fraud is especially prevalent in the luxury market where fake documents often go undetected.

Gifts Declaration

• Submission: Gift requests through Concur before purchase.
• Value Limit: Gifts below US$100 are allowed; gifts exceeding US$100 need justification.
• Recipient Specification: Recipient company and individual names/amounts in gift request.
• Prohibited Acts: Offering gifts/hospitality for undue influence, during a tender/contract renewal, exceeding thresholds, using vouchers, etc.

Prevention Measures within Crane Capital Policies and Procedures

• Fraud Prevention: Information Technology Policy, Multifactor Authentication, Biometric authentication, Segregation of Duties, Invoice and Cash Management, and Whistleblower Protection
• Bribery & Corruption Prevention: Travel & Expense Policies, Gift Requests, Third Party Risk Management.

Notable Fraud, Bribery, Corruption, AML/CFT in 2024

• Evergrande: Accused of $78 billion fraud.
• MAS Imposes Composition Penalty: On Swiss-Asia Financial Services for AML/CFT breaches.
• TD Bank Fine: $3 billion fine over drug cartel money laundering.
• UK Engineering Firm Scam: Arup falls victim to a £20 million deepfake scam.
• Deepfake Musk Scam: AI-powered version of Elon Musk appears in thousands of inauthentic ads, creating billions in fraud.

Strengthening Cyber Resilience

• Zero-Trust Security Models
• Multi-Layered Encryption
• Biometric Security Systems
• Voice Recognition Technologies
• Generative AI Defenses

Principles of Data Protection (1/4)

• Data Protection: Embraces technologies/processes/workflows needed for the availability of data when needed.
• Data Security: Safeguards data against theft, corruption, or unauthorized access throughout the data lifecycle.
• Data Privacy: Understanding the collection, use, management, and monetization of sensitive data.

Principles of Data Protection (2/4)

• Data Minimization: Collect only necessary data.
• Principle of Least Privilege: Authorized users are granted the minimum access required for their work.

Principles of Data Protection (3/4)

• Data Classification and Encryption: Classifying data by sensitivity and importance (e.g., Personal, Work - Unprotected, Work - Protected, Confidential, Highly Confidential) and protecting it via encryption.

Principles of Data Protection (4/4)

• Password Vault: Store passwords centrally and protect them with encryption to eliminate the need to memorize multiple passwords.
• Data Storage and Backup: Secure methods for storing data and proper disposal of no-longer-needed data.
• Prevent unauthorized access: Preventing unauthorized access, breaches and data leaks.

Cybersecurity Hygiene (1/2)

• Common Cyber Hygiene Problems: Weak Passwords, Ignoring Updates, Clicking on Suspicious Links, Not Backing Up Data, Sharing Too Much Online.

Cybersecurity Hygiene (2/2)

• Prevention Measures: Regular Software Updates, Strong Password Policies, Phishing Awareness, Secure Wi-Fi Practices, System & Network Security, Regular patching, Secure third-party access, Monitoring for unusual activity.

Business Continuity

• Business Continuity Planning: Ensure Crane Capital can continue operating during and after a crisis.
• Disaster Recovery: Processes for restoring IT infrastructure, data access, IT resources after a disaster.
• Crisis Management: Focus on responding effectively to unexpected events.

Business Continuity - Recovery Strategy

• Recovery Strategy for Office premise compromise, IT equipment destruction, and other scenarios.

Crisis Management - Crisis Classifications and CMT

• Crisis Classification Levels: RED (imminent threat), ORANGE (moderate risk), and YELLOW (low risk) based on impact.
• Crisis Management Team (CMT): Key contact persons responsible for crisis response, including alternate members.
• CMT Responsibilities: Ensuring Crane Capital can operate during and after a crisis, planning for uninterrupted operations, coordinating crisis response, allocating resources, and monitoring communication protocols.

Crisis Communication

• Crisis Communication Plan: Focus on minimizing damage when responding to unexpected events.
• Crisis Communications Coordinator: Contact numbers available for different departments in Hong Kong and Singapore.

Incident Reporting

• Introduction: Crane Capital's formal process for managing incidents to protect its reputation and operations.
• Key Elements: Incident Types (e.g., fraud, theft, cyber threats), Response Strategy (e.g., notification to crisis management team, investigation, validation), and Incident reporting form /process (5W1H)
• Incident Notification: Report incidents to the CMT as soon as possible (ideally within 1-3 hours).
• Incident Investigation: CMT validates and determines whether further investigation is required.
• WSIB Reporting: Reporting escalated incidents to WSIB (if applicable).
• Incident Closing and Following-Up: Incident Resolution, Communication, Corrective action, Internal control verification and Incident closure.

Information Security Incidents

• Examples: Unauthorized disclosure of sensitive information, theft/loss of device, virus/malware outbreaks, denial of service, attempts to gain unauthorized access, compromised user accounts due to phishing.
• Contact Methods: ECI (External Cyber Incident) Security Operations Center (SOC) Contact - Primary Method (email - [email protected]) and SOC Hotline Numbers for different regions (US, UK, HK, SG).

Closing Remarks – Reminder on Ethics Standard

• Reduce Risk: Helps reduce the likelihood of misconduct, regulatory violations, legal actions and reputational harm.
• Promote Ethical Culture: Fosters a workplace culture that prioritizes integrity, honesty, and transparency.
• Employee Engagement: Engage employees who understand the importance of ethics and compliance.