This morning buy-now-pay-later start-up Afterpay Touch Group Ltd (ASX: APT) told investors it's making progress in getting its house in order ahead of an AUSTRAC commissioned audit and warned retail shareholders its share purchase plan will be delayed and potentially scrapped altogether.
Afterpay revealed it has created a sub-committee to report to the board on the progress it's making in dealing with the external audit of Afterpay's AML / CTF policies, responsibilities to AUSTRAC and obligations under the AML / CTF Act 2006.
First up, let's note that passing an external or AUSTRAC audit of your risk and compliance program for your AML / CTF obligations is not rocket science.
Especially not when Afterpay has more than $300 million sitting on its balance sheet of which a tiny fraction can be used to pay consultants (usually one of the "Big 4") to build you an audit-proof risk and compliance.
Any plan can also be made pretty dummy proof with step-by-step procedures and controls to follow to demonstrate an entity's compliance with its obligations. It's amazing what money can buy in business.
Previously, I outlined how to meet its suspicious transaction monitoring and reporting obligations Afterpay will almost certainly be advised (if it's not doing so already) to dump all daily transaction data into something as simple as a spreadsheet, before applying some filters that might identify suspicious transactions or those over a certain threshold.
It could also apply other filters for example to identify if one user bought the same item 10 days in a row (this might be considered suspicious), or if a retail client only ever sold the same goods to the same user, again could be suspicious, you get the picture.
Suspicious transactions must be reported to AUSTRAC who can then choose to investigate. Either way it's not much more than a box ticking exercise Afterpay is obliged to demonstrate it follows.
Afterpay will also likely have a risk control self assessment (RCSA) built for it by its advisers. RCSAs are the standard method for demonstrating management of risks or obligations around KYC/ AML, suspicious transaction reporting, and other general obligations under the AML / CTF Act 2006.
For example the inherent risk that Afterpay fails to properly identify a client is met by controls (electronic verification, etc) and the residual risk is then lower. These kind of plans and controls are what highly-paid consultants will create to hopefully ensure they're dummy proof for Afterpay's staff. Not that I'm suggesting they're dummies!
ID matters
It's clear though that the primary AML/CTF risk confronting Afterpay is on client ID, which is something I pointed out well over 18 months ago.
Clearly, it's providing low risk services under the terms of the relevant legislation, so verification standards will be lower compared to an over-the-counter money transfer business for example where client ID must be photocopied, etc.
So the issue for Afterpay will be finding an online ID verification system and provider that satisfies its auditors and by extension AUSTRAC.
For investors and the company the auditor's view on its compliance with this matter will be the key issue to follow.
Personally, I expect it's resolvable, although AUSTRAC has certainly become more unpredictable in recent years with Commonwealth Bank of Australia's (ASX: CBA) top brass perhaps justifiably complaining they were blindsided by its sudden blow-up on them for failing to meet transaction monitoring obligations.
Share purchase plan
In other news Afterpay also warned that due to the upcoming audit its $30 million share purchase plan offered to retail investors is to be delayed and potentially cancelled.
This after institutional investors helped themselves to $300 million in new scrip at $23 per share.
Afterpay reports the reason for the delay is the unknown result of the upcoming audit and it seems to be hinting at legal indemnity type issues in case the share price bombs on the back of a failed audit.
That's fair enough I suppose, although I'll be disappointed if the company chooses to cancel the retail offer simply because it reckons it's not worth the cost or effort.
Now that the stock is changing hands for $26.92 any retail offer is likely to be heavily oversubscribed assuming the offer price (instos got $23) will be a big discount to the exchange traded price.
For example it would take just 2,000 retail shareholders to apply for their full amount ($30m / $15,000) before a scale back takes effect. As such I expect any scale back is likely to be 50% or far more in depending on how many retail shareholders Afterpay has.
