6.3 Controlling Internal Threats: Insider Fraud, Collusion, and Data Misuse

CAFCA sub-topic 1.9 asks for a control framework to mitigate internal threat. FinTechs give many people powerful access. Customer support agents can change phone numbers and reset two-factor authentication, engineers can query production databases, analysts can close alerts or whitelist names, and outsourced teams handle queues around the clock. Criminals know this and recruit insiders.

What insider threat looks like

The control framework

Think in four layers: prevent, detect, respond and culture.

Prevent

• Pre-employment screening in proportion to the role: identity, right to work, references and, where lawful, criminal record and credit checks. Repeat screening for sensitive roles. The UK Money Laundering Regulations require screening of relevant employees where appropriate to the firm's size and nature.
• Least privilege and role-based access: staff get only the permissions their role needs. Remove access promptly when people move roles or leave.
• Segregation of duties: the person who requests a change is not the person who approves or releases it. For example, the engineer who writes a monitoring rule change is not the one who deploys it.
• Maker-checker (four-eyes) approvals for high-risk actions: whitelist additions, limit overrides, manual releases of held payments, account recovery and contact changes, and fee refunds above thresholds.
• Privileged access management for production systems: just-in-time access, session recording and break-glass procedures.
• Change management for rules, models and screening lists, with versioning and audit trails (Chapter 11).

Detect

• User activity monitoring: log every sensitive action and review the logs. Look for unusual patterns, such as one agent handling an outsized number of contact changes on accounts later hit by fraud.
• Staff account monitoring: review employees' own accounts on the platform where the law permits.
• Data loss prevention tools: alerts on bulk exports, personal email use and unusual downloads.
• Mandatory leave or job rotation for roles with powerful access. Some schemes only work when the insider is present every day.
• QC and second-line sampling that deliberately includes high-risk overrides.

Respond

• A documented insider investigation protocol involving compliance, security, HR and legal, with evidence preserved.
• Immediate access revocation when misconduct is suspected.
• Reporting: US banks must file a SAR for insider abuse involving any amount. Other regimes treat insider involvement as an aggravating factor for STRs. Notify the partner bank where the contract requires it.
• Root-cause fixes: which control failed, and is the same weakness present elsewhere?

Culture

• Training that explains insider red flags and how criminals approach staff, especially in support and operations centres.
• Conflict-of-interest declarations and a gifts and hospitality register.
• Whistleblowing and speak-up channels that protect reporters.
• A tone from the top: leaders who reward escalation rather than speed at any cost.

Outsourced and offshore teams

Outsourcing does not move insider risk outside the firm. Contracts should require screening standards, access restrictions, monitoring rights, incident notification and audit access. The firm should test them in practice, for example by reviewing the vendor's access logs for its own queues.

Realistic exam scenario

Fraud analytics finds that 70% of account takeovers this quarter followed a phone-number change made by one of three outsourced support agents. All three work the same night shift. The firm should suspend the agents' access to sensitive functions at once and preserve the logs. It should notify the vendor under the contract, investigate jointly, and assess SAR obligations for both the takeovers and the suspected insider involvement. It should then add maker-checker approval and step-up verification for contact changes. Retraining alone would leave the control gap open.

Common exam traps

• "Senior or long-serving staff are low risk." Insider cases often involve trusted people with wide access.
• Logs that nobody reviews. Logging is not a control unless someone acts on it.
• One-time background checks for powerful roles.
• Leaving offboarded staff with live access.