Continuous Monitoring Reporting Compliance Fraud Monitoring Banking Sector

Continuous Monitoring & Reporting Compliance & Fraud Monitoring Banking Sector Data 2 knowledge Inc. Andrew Gonczi, CEO Data 2 knowledge, Inc. www. d 2 k. com 16 th World Continuous Auditing and Reporting Symposium Rutgers University, NJ; November 2008

Presentation outline a. About Data 2 Knowledge • Continuous Monitoring Needs • Banking Application • D 2 K Secure, Continuous Monitoring System 16 th World Continuous Auditing and Reporting Symposium - 2008

About Data 2 Knowledge Corporate Overview a. Established in 1999, offices in NJ, UK and Hungary b. Specialized in continuous monitoring and financial data services c. Blue chip corporate clients in US and Europe D 2 K Distil a. Key financial data found and extracted more accurately, faster and for a fraction of the cost D 2 K Secure a. Continuous Fraud and Compliance Monitoring D 2 K Development a. Offshore (Hungary) development and service team; Cost effective, innovative • D 2 K's core extraction engine is also available to be embedded in custom applications and as a SDK to partners. 16 th World Continuous Auditing and Reporting Symposium - 2008

Continuous Monitoring Needs Why is continuous monitoring becoming a must now? a. Advances in technology and increased business dynamics enable businesses to change ever more rapidly, b. Traditional audits and controls are no longer adequate Key drivers a. Past few years’ events (9/11, malfeasance crisis, complex and creative business models) • Subsequent regulations (HIPAA, SOX, Patriot Act, Basel II, Mi. FID, etc. ) • Business needs, competitive development of controls to be matched Benefits • • Immediate notification to management of problems, timely correction Fraud reduction and improved risk management Extensibility across multiple IT systems Independence from operative management 16 th World Continuous Auditing and Reporting Symposium - 2008

Fraud prevention & Compliance needs Key Drivers a. Laws and Regulations b. Direct P&L impact to prevent losses from fraud c. Indirect P&L impact – business reputation, client retention and acquisition Continuous Monitoring Requirements a. To detect fraudulent, unauthorized or money laundering activities, operational systems need to be monitored on an ongoing basis • All systems produce activity/transaction logs, but differing formats • Centralized Monitoring Dashboard gives clear view across all business transaction and IT systems The Audit Trail Imperative • • • Details of finest granularity needed at all times in near real time Drill-down analysis required Data Source Quality, Data Level Assurance Proof for Internal and Public proceedings Transaction level intervention 16 th World Continuous Auditing and Reporting Symposium - 2008

Banking Application Customer a. Large subsidiary of a major European bank b. Market cap. : ~20 Bn c. Employees: 50+k Business objectives a. • • Meet regulatory compliance requirements Reduce fraud losses, especially internal attacks Continuous and pre-emptive controls Expand scope across all business and IT systems Reduce costs compared to highly manual prior processes 16 th World Continuous Auditing and Reporting Symposium - 2008

Banking Application Technical challenges and requirements a. Growth through acquisitions wide variety of disparate IT systems • Data consolidation became a major challenge; multi-terabytes of historical and real time data such as transaction logs, document files, spreadsheets and financial reports stored on Oracle databases. • Security administrators were finding it impossible to monitor these vast reservoirs of data in order to detect suspect usage patterns and identify possible fraud before it was too late. • Non intrusive solution needed to coexist with other IT systems • Independence from other processes to ensure impartial oversight • ‘Events of interest’ are hidden across several system logs and multiple log entries • Identification of suspicious behavior requires establishing profiles and patterns (ex. multiple account of the same person) 16 th World Continuous Auditing and Reporting Symposium - 2008

Banking Application a. Proactively combating fraud & reducing compliance costs a. D 2 K Secure reviews 12 -15 Gb per day of data in order to spot suspicious activity before it becomes a problem a. With automatic querying and real time alerts, the bank can now be truly proactive in the fight against fraud a. D 2 K Secure saves costs every day what previously would take 10 - 15 man days to piece together now takes 3 - 416 hours to run automatically World Continuous Auditing and Reporting Symposium - 2008 th

D 2 K Secure – Continuous Monitoring System Summary a. D 2 K Secure is a flexible and scalable system designed to transform the contents of an unlimited number of audit log files into a single structured database and perform CM on the aggregate dataset a. Security analysts are provided with relevant information with links back to the original audit trail sources • With appropriate reporting modules, the system is capable of generating automatic real time alerts if certain usage patterns are recognized in the logs 16 th World Continuous Auditing and Reporting Symposium - 2008

D 2 K Secure System architecture 16 th World Continuous Auditing and Reporting Symposium - 2008

D 2 K Secure – Key Features a. Modular architecture allows integration with other analytical applications • Combines several complementary methods to provide near 100% matches • Data may be retrieved from any kind of structured or semi structured source, including but not limited to; web pages, entire web sites, document files, text based log files, any type of relational databases and EDI systems • The system can monitor multiple data sources and generate digests or reports from collated real-time or buffered information, based on the requirements of the application • The massively parallel architecture allows simultaneous processing of individual information units, enabling real time processing of virtually unlimited amounts of data with suitable hardware support 16 th World Continuous Auditing and Reporting Symposium - 2008

Sample Transactional log Banking System: Equation 1130 line types, 172 transaction

Log parser - XML configuration Sample (part of the xml file)

Event linking from transactional logs 16 th World Continuous Auditing and Reporting Symposium - 2008

Reporting UI example

Monitored events - AML a. 2 years expired between the current and last transaction and the minimum amount is 8 k EUR b. High amount transactions in a week c. E-bank transactions above 8 k EUR d. Card transactions above 8 k EUR in 2 hours e. Data browsing with no transaction f. Data browsing within 3 days without transaction g. Transaction cancellation above 8 k EUR h. Transactions of the same customer at the same administrator i. Incoming amount over 400 EUR from other bank to worker account j. Incoming >8 k EUR to an account opened with <400 EUR k. Inquiry last 6 months without transaction l. FATF country transactions 16 th World Continuous Auditing and Reporting Symposium - 2008

Monitoring events – Dormant Accounts a. Data browsing of dormant account w/ debit transaction last month b. No host branch c. Multiple debits in 2 hours, 1 months d. Same supervisor access of multiple dormant accounts e. Card initiated requests f. Outgoing transfers g. Trading in own account with government securities 16 th World Continuous Auditing and Reporting Symposium - 2008

Monitored events Summary table Event type Monitored events Money Laundering 13 Dormant account 10 Hold m ail 4 E-channels 2 Internet, E-mails 11 CUA 4 Others 12 16 th World Continuous Auditing and Reporting Symposium -2008

Ad-hoc vs. Continuous Monitoring Summary Monitoring Ad-hoc Continuous Setup time / $$ less more Detection after the fact preventive Learning/profiling limited technology support captured by CMS config Latency was 30+ days 1 day Scaling procedures collapsed w/ growth 15 GB / day works fine Operating costs Data structure changes proportional to data growth minimal after initial setup & query frequency – Not able to scale cost effectively braked time series analysis allows consistent time consistency series analysis across multiple point of changes 16 th World Continuous Auditing and Reporting Symposium - 2008

Thank you for your attention Andrew Gonczi Andrew. Gonczi@d 2 k. com 646 -479 -4496 Data 2 knowledge, Inc. www. d 2 k. com 16 th World Continuous Auditing and Reporting Symposium - 2008