Banks have 18 months to impact SA’s greylisting

South Africa’s greylisting spans a wide range of shortcomings.

---

In January 2025, the global anti-money laundering watchdog, the Financial Action Task Force (FATF), will review its decision to greylist South Africa and interrogate the public and private sector measures to address its concerns. The country will need to demonstrate a practical, scalable plan to combat money laundering, fraud and other financial crimes. Failing to achieve this will have serious economic knock-on effects, such as a significant decrease in international capital inflows and downgrading by credit rating agencies, all of which will negatively impact the rand. An extended greylisting is also a serious threat to state-owned enterprises that rely on offshore debt capital markets for funding.

This doesn’t need to be South Africa’s reality. Mauritius successfully met FATF’s criteria and was removed from the grey list in two years. However, this required focused attention and collaboration from the public and private sectors. Now, South African financial institutions are under the spotlight, and the country has just 18 months to demonstrate an effective anti-money laundering (AML) strategy. It is sufficient time to make enough strides to reverse the greylisting, as the technology exists to combat money-laundering and financial crime at scale.

South Africa’s greylisting spans a wide range of shortcomings, some of which fall within the remit of the public sector. The private sector, however, can make a concerted effort to combat money laundering and financial crime. While some criminal activity occurs using cash or crypto-currencies, banks remain vulnerable to money laundering, particularly in cross-border transactions. Currently, only 1% of laundered funds are ever recovered despite the government estimating R35 billion-R143 billion is laundered through local financial institutions each year.

To successfully combat money laundering and financial crime, banks need to get to the root cause of how these crimes can go undetected. And this root cause is identity.

Murray Collyer, Chief Operating Officer of iiDENTIFii, says: “If banks want to effectively and reliably counter financial crime, they need to validate one critical piece of information: a person’s identity. Banks need the security that a person performing a transaction on the other side of the screen is who they say they are.”

As our lives grow increasingly digital, the ability to counter cyber crime is an urgent consideration. The global police agency Interpol’s Global Crime Trend Report 2022 estimates that over 70% of respondents (all from law enforcement) expect crimes such as ransomware and phishing attacks to increase significantly in the next three to five years. This renders the traditional verification technologies banks favour – such as one-time passwords (OTPs) – outdated and a security risk.

Biometric security threats currently fall into two categories: presentation attacks and digital injection attacks. Presentation attacks refer to photos, videos or even masks being held up to a screen to fool the technology into mapping the features of the identity being defrauded. On the other hand, digital injection attacks see imagery injected directly into the video stream, either through emulators, hacking tools or virtual cameras. This directly injected imagery includes sophisticated ‘deepfakes’ or ‘face swaps’, where AI technology spoofs another person’s likeness. iProov, iiDENTIFii’s technology partner, reveals in a new 2023 study that there has been a 149% increase in digital injection attacks and a 295% increase in face swaps. With the emergence and growth of face swaps, low-skilled criminals now have the means to launch advanced attacks. Threat actors launched motion-based attacks simultaneously and at scale against hundreds of systems globally.

Collyer adds: “To the untrained eye or technology, face swap synthetic imagery has the characteristics of the genuine individual’s facial traits. The imagery can match their government-issued identification photograph during a liveness verification attempt if the technology is not equipped with the latest defences.”

Banks must tackle the challenge head-on to have the robust AML systems and processes required for South Africa’s greylisting review. This needs a clear perspective on the current threats and how to mitigate the resulting risks to banks and customers.

Digital injection attack detection needs fundamentally different techniques from presentation attack detection (PAD). Many current biometric systems are not equipped to defend against this fast-growing threat and financial institutions must find a new way to prove identity to prevent money laundering and cyber attacks. The answer lies in the use of ‘liveness’ in authentication.

“Simply put, ‘liveness’ is the confirmation and verification that there is a human being conducting a transaction on the other side of the screen,” Collyer explains. “While cyber criminals can mine personal data and override certain systems through targeted attacks, it is more difficult to forge a sense of human liveness.”

Many local banks are addressing the challenge head-on. They are upgrading their systems in response to new digital risks. “iiDENTIFii has to date partnered with three leading South African banks to fortify their digital identification and onboarding processes. This is part of a wider banking strategy to protect companies and consumers against AML and fraud,” adds Collyer. “Over the next 18 months, we believe the full impact of this solution will be visible and hopefully play a part in shifting the needle on the greylisting decision.

“Our 4D Liveness is resilient to deepfake and replay attacks. It comprises different colour lights that reflect in a certain sequence off the user’s face, which helps determine true biometric liveness. This has been the solution of choice for South Africa’s leading banks.”

It is possible to reverse South Africa’s greylisting in 18 months. Financial institutions need to refine their focus on digital identity, the central factor in performing safe, verifiable and authenticated transactions.

Collyer concludes: “We call on financial institutions and the government to embed infallible, enterprise-level and sophisticated biometric authentication into the country’s financial services infrastructure. This should not just be a response to our greylisting, but a strategic imperative in an increasingly digitised economic climate where cyber security risks abound. If we can demonstrate an ability to combat threats at a global level, this could instil faith in reluctant overseas investors and local customers alike.”