Go back to menu

PayPal ordered to investigate itself

Direction from AUSTRAC

07 October 2019

Australian regulator AUSTRAC has directed the Australian arm of the digital payment heavyweight to essentially investigate itself – by ordering it to engage an external auditor to report to AUSTRAC on the company's AML/CTF compliance.

PayPal Australia has been directed to engage an external auditor to examine its compliance with Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws. The direction was made by Australia's financial intelligence and AML/CTF regulator, AUSTRAC. It follows a direction made to Afterpay earlier this year that required the popular 'buy-now, pay-later' platform operator to engage an external auditor in similar circumstances.

The appointment of the auditor to PayPal (at its own expense) relates to concerns about its compliance with the AML/CTF obligation to report to AUSTRAC on the transfers of funds into and out of Australia. AUSTRAC is reportedly concerned that the growing number of financial technology platforms has left some vulnerable to use by offenders involved in money laundering, terrorism financing, the sale of illicit items and child sex exploitation. It considers particularly that reports on international funds transfer instructions to provide vital intelligence to combat serious crimes.

PayPal says the steps taken by AUSTRAC were initiated following PayPal reporting to the regulator that an internal review of its compliance identified issues with its reporting systems. If the issues identified by PayPal relate to a failure of its automated reporting systems, it will not be expecting significant sympathy from AUSTRAC, given the record $700 million penalty given to the Commonwealth Bank of Australia (CBA) following action by AUSTRAC for breaches of AML obligations that were due to a software coding error introduced into the bank's 'smart' ATMs.

A direction by AUSTRAC to appoint an auditor to assess compliance involves the use of its statutory powers to issue remedial directions. In the case of PayPal and Afterpay, AUSTRAC says that, while the audits allow the companies to assess and remedy ongoing compliance, they would also inform the regulator whether or not to take any further regulatory action. This use of a remedial power to assist AUSTRAC in the identification of compliance breaches suggests the regulator considers the power to issues directions to also form a part of its investigative tool kit. In light of recent comments by AUSTRAC expressing a desire to work with Chinese digital payment platforms, it remains to be seen whether similar appointments will be made to platforms like Alipay and WeChat Pay in the future.

AUSTRAC's reliance on 'remedial' directions as an investigative tool may be seen to reflect the dynamic regulatory style necessary to supervise payment systems that utilise sophisticated technologies and involve complicated money flows. On the other hand, it may reflect an organisational shortfall in resources necessary to regulate the modern Australian financial system. In any event, in light of its successful action against the CBA and recent increase in funding, it seems inevitable that AUSTRAC will continue to increase its regulatory activity in the financial technology sector and continue to use the full suite of investigation tools available to it.