Fraud Risk Consulting

Subcontractors deliver. But head contractors pocket the cash: The construction industry's dirty secret… The reality: - Construction has the highest insolvency rate of any industry - When head contractors fail, subbies lose everything - Small businesses bear the brunt of payment delays - Families lose homes while directors start new companies The real cash flow pattern: → Client pays head contractor on time → Head contractor holds funds for 60+ days → Small businesses cover payroll from savings → Banks collect overdraft interest while subbies struggle What ethical companies do: - Pay within 14 days of submission - Issue payment schedules promptly - Refuse unfair "pay-when-paid" clauses - Set up project bank accounts But the industry norm? - 60-day payment terms (and rising) - "Lost" invoices near payment deadlines - False statutory declarations - Deliberate invoice disputes to delay payment The unavoidable truth: Construction's insolvency problem isn't because projects fail. It's because cash flow is weaponised. Today's unpaid subbie is tomorrow's bankrupt business. The money you withhold is someone's mortgage payment. Is your company part of the solution or the problem? P.S. LIKE if you think the industry needs a change!

New rule for government contractors: If you’re going to lie about your cybersecurity, at least don’t do it in writing. Because the DOJ just reminded us that spreadsheets with self-assessed scores are exhibit A in a False Claims Act case. Here’s what went down: March 2025 – A Massachusetts contractor (MORSE) proudly submitted a Supplier Performance Risk System (SPRS) score of 104 out of 110. The only problem? An independent audit said it was closer to –142. Yes, negative. One. Forty. Two. Result: $4.6 million settlement. For getting creative with cybersecurity math. May 2025 – A Raytheon subsidiary (now “Nightwing,” because apparently “Ghost Protocol” was taken) shelled out $8.4 million for failing to implement NIST 800‑171 on nearly 30 DoD contracts. Their compliance plan may have existed, in spirit, but not in practice. What this means (aka, What your GC wishes you’d read before hitting “submit”): - “Self-attested” doesn’t mean “make it up.” - That SPRS score? It’s not just between you and Procurement anymore. - The DOJ isn’t waiting for CMMC 2.0, they’re already enforcing cybersecurity misrepresentations under the False Claims Act. Friendly reminder: If your NIST 800-171 compliance plan is still “under review,” maybe don’t claim it’s fully implemented. The government now does fact-checks…with subpoenas. No emoji, just the reality: Cybersecurity isn’t just an IT issue. It’s a contractual one. And if you overpromise and underdeliver, you may find yourself paying for both the breach and the bluff.

This week, James Mwangi, CEO of Equity Bank Limited Bank, fired 1,200 staff after uncovering internal fraud amounting to over KSh 2 billion (~$15 million). It reminded me of something a Kenyan business leader told me over 15 years ago: "My biggest worry isn’t outsiders stealing from me, it’s my own #staff." At the time, in my “youth,” I dismissed it: old man rambling, trust issues, doesn’t want to give up control. But the issue stuck. I dug into the numbers and found a KEPSA report (2019), based on a survey of 1,200 Kenyan businesses: Kenyan firms lose nearly 13% of revenue to #EmployeeRelatedFraud : petty cash misuse, fake invoices, supplier collusion, falsifying books, nepotistic hiring. 👉 85% of businesses report corruption risk in their operations. 👉 30% of respondents had personally experienced corruption. 👉 57% cited fraud as the most prevalent form. 👉 48% cited bribery. Real financial impact: - 22% of businesses report #losses between $1M–50M/year due to corruption - 71% of SMEs lose $10k–15k/year to fraud and bribery. I validated this with a few business leaders and sadly, it still holds true. Here’s the #irony: we complain about #GovernmentCorruption rightly.  But maybe we need to take a long, hard look at ourselves. Globally, companies lose ~5% of revenue to fraud and employee-related malpractice.  In Kenya’s #PrivateSector? 12.85%, more than double the global average. If we can steal from the organizations we work for, that feed our families can we really blame the government for looting the country?

💡 HMRC has published new guidance on common Trade-Based Money Laundering (TBML) techniques — a valuable resource for anyone assessing cross-border risk. The TBML Handbook breaks down how criminals exploit trade finance, customs processes, and international supply chains to disguise the movement of illicit funds. Even without deep trade-finance expertise, the guidance offers clear indicators and practical angles for investigation. 💡 Key techniques highlighted in the handbook: ➡️ Fictitious or “ghost” trading Goods never exist, yet full invoices, shipping documents, and customs entries are created through collusion — enabling seamless value transfer. ➡️ Over- and under-invoicing Manipulating the price of goods or services to shift value internationally. HMRC notes that over-invoicing exports can be particularly effective due to limited scrutiny compared to imports. ➡️ Multiple invoicing Reusing the same shipment documentation to justify several payments across multiple banks — exploiting fragmented oversight. ➡️ Misdescription of goods or services Shipping low-value items while invoicing high-value commodities, or disguising service-based transactions where verification is harder. ➡️ Vulnerabilities in open-account trade With around 80% of global trade conducted on open-account terms, the lack of bank oversight creates an attractive channel for TBML. 🛡️ For professionals in #AML, #Compliance, #FinancialCrime and #FraudPrevention, TBML remains one of the most complex areas of illicit finance — and one where continuous learning helps enormously. I’ve actually put together a full playlist on my YouTube channel dedicated to TBML, if anyone wants a deeper dive into real-world examples and practical concepts: 👉 https://lnkd.in/eVdiM_Sn 🤔 How confident is your organisation in spotting TBML indicators within customer activity or trade flows? #TBML #HMRC #TradeFinance #AML #RiskManagement #Compliance #FinancialCrime #DueDiligence #KYC #CDD

The Wolfsberg Group has issued a new Statement on Monitoring for Suspicious Activity (MSA). The statement recognises that criminal networks “continue to evolve at a rapid pace.” As a result, both national security priorities and financial institutions’ innovation governance frameworks must evolve accordingly. It makes a significant distinction between: ↳ Transaction Monitoring (TM) - rule-based, transaction-focused, and heavily reliant on fixed thresholds. ↳ Monitoring for Suspicious Activity (MSA) - data-driven, outcome-focused, and informed by a broader set of inputs: • customer behaviour • typologies • contextual risk indicators • and transactional activity combined Traditional TM detects pre-defined transactional patterns - such as cash structuring or high-value wire transfers. But many risks cannot be identified through transactions alone. The Wolfsberg Group highlights that real suspicion often emerges when transactions are viewed in context - alongside customer profiles, behavioural patterns, and known typologies. 𝗪𝗵𝗮𝘁 𝗿𝗶𝘀𝗸𝘀 𝗱𝗼𝗲𝘀 𝘁𝗵𝗲 𝗪𝗼𝗹𝗳𝘀𝗯𝗲𝗿𝗴 𝗚𝗿𝗼𝘂𝗽 𝗵𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁? → Financial institutions relying solely on rules-based TM may be missing high-impact risks. → Innovation is slowed by governance frameworks designed for prudential risk, not financial crime. → Low-quality alerts and SARs continue to burden investigators and add limited value to law enforcement. 𝗪𝗵𝗮𝘁 𝗮𝗽𝗽𝗿𝗼𝗮𝗰𝗵 𝗱𝗼𝗲𝘀 𝘁𝗵𝗲 𝘀𝘁𝗮𝘁𝗲𝗺𝗲𝗻𝘁 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱? The Wolfsberg Group outlines a transition framework based on three pillars: 1️⃣ 𝗧𝗿𝗮𝗻𝘀𝗶𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻: FIs should update their approach based on redefined outcomes - not legacy system performance. The goal is to improve precision and relevance, not to replicate outdated alerts. 2️⃣ 𝗕𝗮𝗹𝗮𝗻𝗰𝗶𝗻𝗴 𝗺𝗼𝗱𝗲𝗹 𝗿𝗶𝘀𝗸 𝘄𝗶𝘁𝗵 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗰𝗿𝗶𝗺𝗲 𝗿𝗶𝘀𝗸: AML models should not be governed like credit or market risk models. Financial crime risks require adaptability, and excessive oversight can hinder timely implementation. 3️⃣ 𝗘𝘅𝗽𝗹𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆: Institutions must be able to clearly explain how models work, what risks they cover, and how analysts can use outputs to support meaningful investigations. 𝗪𝗵𝗮𝘁 𝗶𝗺𝗽𝗿𝗼𝘃𝗲𝗺𝗲𝗻𝘁𝘀 𝗰𝗮𝗻 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗶𝗻𝘀𝘁𝗶𝘁𝘂𝘁𝗶𝗼𝗻𝘀 𝗲𝘅𝗽𝗲𝗰𝘁 𝗯𝘆 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗶𝗻𝗴 𝘁𝗵𝗲𝘀𝗲 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀? ✔ Better alignment with law enforcement priorities ✔ Improved quality of suspicious activity reporting ✔ More effective use of data and analytics across the institution ✔ Stronger ability to detect emerging risks - not just known patterns The message is clear: Effective financial crime monitoring is no longer about catching what’s obvious. It’s about uncovering what’s relevant. Is your institution prepared for this change?

Fraud vulnerability is often viewed primarily as a criminal or compliance issue. Increasingly, it reflects something much larger. As economies become more digital, interconnected, and data-driven, the ability to establish trust across payments, identities, transactions, and digital interactions is becoming foundational to operational resilience and economic scalability.     That shift matters. Digital transformation has dramatically increased transaction speed, automation, and global connectivity. At the same time, it has expanded exposure across increasingly complex systems where governance, verification, and operational controls are not always evolving at the same pace.     This creates a growing divide between organizations and economies that can maintain trust as digital systems scale in complexity and those that remain structurally more exposed to operational and reputational risk. Fraud resilience is no longer simply about prevention. It increasingly affects customer confidence, regulatory exposure, and the ability to operate securely at scale.     As AI, digital commerce, and cross-border ecosystems continue expanding, trust infrastructure is becoming a critical competitive layer beneath the surface of modern economies. The question is no longer simply where fraud risk exists. It is which systems are best positioned to sustain trust as digital complexity accelerates. 

The Financial Action Task Force (FATF) has released its Updated Recommendations (February 2025), reinforcing international standards on AML, CFT, and Combating the Financing of Proliferation (CFP). Key Highlights: ✅ Risk-Based Approach (RBA) Strengthened • Countries and financial institutions must continuously assess ML/TF risks. • Proliferation financing risks (linked to WMDs) must now be explicitly assessed and mitigated. • Greater emphasis on data-driven decision-making in risk management. ✅ Stronger Financial Crime Enforcement & Asset Recovery • Enhanced measures to identify, freeze, and confiscate illicit assets, even without conviction-based legal proceedings. • Countries must cooperate more effectively on cross-border investigations related to ML, terrorism, and sanctions evasion. • Expanded legal mandates for regulators to seize cryptocurrency-related assets used for illicit activities. ✅ Enhanced Corporate Transparency & Beneficial Ownership Regulations • Stricter disclosure requirements for companies and trusts to prevent anonymous ownership structures facilitating financial crime. • Introduction of centralized registries for beneficial ownership information, accessible by regulators and FIUs. • Bearer shares and nominee shareholder arrangements are further restricted due to their role in obfuscating ownership. ✅ New Standards for Virtual Assets & Emerging Technologies • FATF mandates stronger oversight on VASPs, aligning AML rules for crypto-assets with traditional financial institutions. • New tech-based compliance controls (including AI-driven monitoring) recommended to enhance financial crime detection. • Stricter regulations for cross-border virtual asset transactions to combat illicit financing and crypto-enabled ML. ✅ Expanded Measures Against Terrorist Financing & Sanctions Evasion • Countries must implement targeted financial sanctions to prevent terrorism and WMD proliferation financing. • NPOS are now required to assess their terrorist financing risks while ensuring legitimate operations are not disrupted. • Greater scrutiny on correspondent banking relationships to prevent facilitation of illicit transactions. ✅ Increased International Cooperation & Mutual Legal Assistance • FATF calls for faster cross-border financial intelligence sharing to prevent criminals from exploiting jurisdictional gaps. • Countries must align with UNSCRs on CTF and sanctions enforcement. Recommandations: 🔹 Implement advanced transaction monitoring using AI to detect suspicious financial activities more effectively. 🔹 Reinforce beneficial ownership compliance 🔹 Strengthen cross-border AML/CFT coordination by fostering partnerships between FIs, regulators, and law enforcement agencies. 🔹 Ensure robust oversight on virtual assets by applying FATF’s Travel Rule to cryptocurrency transactions and monitoring DeFi risks. #AML #FATF #FinancialCrime #Compliance #CryptoRegulation

🧾 Employees using AI to create fraudulent expense receipts 🤖 Fake or otherwise malicious “candidates” using Deepfake to hide their true identity on remote interviews until they get far enough in the process to hack your data 🎣 AI-powered phishing scams that are more sophisticated than ever Over the past few months, I’ve had to come to terms with the fact that this is our new reality. AI is here, and it is more powerful than ever. And HR professionals who continue to bury their head in the sand or stand by while “enabling” others without actually educating themselves are going to unleash serious risks and oversights across their company. Which means that HR professionals looking to stay on top of the increased risk introduced by AI need to lean into curiosity, education, and intentionality. For the record: I’m not anti-AI. AI has and will continue to help increase output, optimize efficiencies, and free up employees’ time to work on creative and energizing work instead of getting bogged down and burnt out by mind numbing, repetitive, and energy draining work. But it’s not without its risks. AI-powered fraud is real, and as HR professionals, it’s our jobs to educate ourselves — and our employees — on the risks involved and how to mitigate it. Not sure where to start? Consider the following: 📚 Educate yourself on the basics of what AI can do and partner with your broader HR, Legal, and #Compliance teams to create a plan to knowledge share and stay aware of new risks and AI-related cases of fraud, cyber hacking, etc (could be as simple as starting a Slack channel, signing up for a newsletter, subscribing to an AI-focused podcast — you get the point) 📑 Re-evaluate, update, and create new policies as necessary to make sure you’re addressing these new risks and policies around proper and improper AI usage at work (I’ll link our AI policy template below) 🧑💻 Re-evaluate, update, and roll out new trainings as necessary. Your hiring managers need to be aware of the increase in AI-powered candidate fraud we’re seeing across recruitment, how to spot it, and who to inform. Your employees need to know about the increased sophistication of #phishing scams and how to identify and report them For anyone looking for resources to get you started, here are a few I recommend: AI policy template: https://lnkd.in/e-F_A9hW AI training sample: https://lnkd.in/e8txAWjC AI phishing simulators: https://lnkd.in/eiux4QkN What big new scary #AI risks have you been seeing?

OIder Americans got fleeced online last year, FBI says, losing an average $83,000 to scams. Here's how to learn from their mistakes Being robbed doesn’t always happen at gunpoint. Cybercriminals can sneak into your home through your computer and your phone — and may make you an unwitting accomplice to your own robbery. It’s a problem for everyone, but if you’re over 60, you’re particularly vulnerable. Last year, losses to cybercrime increased 33% from 2023 to a record $16.6 billion, according to the Federal Bureau of Investigation (FBI) Internet Crime Report 2024. Last year, the FBI’s Internet Crime Complaint Center (IC3) received 859,532 total complaints, of which about 256,000 resulted in losses averaging about $19,000. But these numbers understate the true scope of the problem since they’re based only on crimes reported to the IC3. Why older Americans are being targeted Older Americans tend to become less financially literate and digitally savvy as they age, making them a prime target for cybercriminals. If they’ve been widowed, they may be lonely and more prone to romance or confidence scams. This older demographic reported about 147,000 cybercrimes in 2024, which is a 46% increase from 2023. Not only do they represent a significant portion of those lodging complaints, but they’re also losing more money than average. As a group, their total losses were $4.885 billion in 2024, which is about 40% of the total losses for all Americans, averaging about $83,000 per person. And 7,500 complainants lost more than $100,000. Americans 60+ most frequently reported being the victims of phishing or spoofing, tech support scams, extortion or sextortion, personal data breaches and investment scams. Investment scams were responsible for the largest financial losses for those 60+ in 2024, followed by tech support and confidence and romance scams. Across all attack types, the losses to scams involving cryptocurrency were substantial. #cybersecurity #seniors #scams #phishing #extortion #romancescams #deepfakes

Indigenous Procurement Fraud: The Hidden Billions Recent investigations by Global News and The Hill Times have confirmed what many of us in community already knew: Federal Indigenous procurement is being exploited. Shell companies, formed by non-Indigenous consultants, list one Indigenous employee to qualify under procurement rules. They win contracts. They collect public dollars. And our communities are left with little to no benefit. A Global News investigation (Nov 2024) revealed widespread misrepresentation under the Procurement Strategy for Indigenous Business (PSIB) with virtually no enforcement. A former federal auditor told Parliament (Dec 2024) that this amounts to public corruption, made possible by lax auditing and oversight. Estimated value diverted from Indigenous communities? Over $2.7 billion in contracts since 2016, with no reliable data on how much actually supported Indigenous-owned businesses. This isn’t just administrative failure, it’s systemic exploitation. It undermines: • Authentic Indigenous entrepreneurship • Community-led economic growth • Public trust and reconciliation efforts What’s needed: • Indigenous-led procurement verification • Transparent tracking of who profits • Real consequences for fraud and misrepresentation “For Indigenous, By Indigenous” isn’t a slogan. It’s a shield. A standard. A future. #FundingAccountability #IndigenousGovernance #ProcurementJustice #ForIndigenousByIndigenous #EconomicSovereignty #ZacharyKnightEnterprises