We have updated the Risk score page with a fresh design and additional information to get ready for an upcoming project involving leveraging provider data in risk.

For those using custom fields as risk factors in their risk model, you can now see its description and data source. These will help distinguish between custom fields that were manually entered and those populated by the data provider. Currently, only manually entered values are supported as the data source, which can be from an API response, a form submission, or manual data input by a user.

Read more about it on the help page.

Having migrated our SSO sign in services to Moody's SSO in November 2023, we are removing access to a legacy domain, sso.passfort.com, associated with our previous SSO sign in.

If you sign in to Passfort using SSO, please ensure you are accessing the platform using your correct URL:

• EU environment: https://identity.passfort.com
• UAE environment: https://identity.uae.passfort.com
• US environment: https://identity.us.passfort.com

You can find your assigned website and other sign in details in your initial email from the Solution Delivery team or by contacting your account administrator. Contact our Client Service team if you're unsure who your administrator is.

View more information on our sign in process.

We’ve made some performance improvements to how we calculate risk for companies and their associates. Broadly, these improvements:

• Improve efficiency of calculating risk across a company and its associates
• Have no impact on users
• Have some potential impact on how you use the ‘product badge changed’ webhook if you use it to track the application status of associates

We’ll be rolling out this improvement in two phases:

Phase 1 - For customers who don’t use the ‘product badge changed’ webhook for company applications

Institutions meeting the following criteria will have the performance improvement enabled by Friday 8 November 2024:

• Institutions not subscribed to the ‘product badge changed’ webhook
• Institutions who are subscribed to the ‘product badge changed’ webhook but don’t onboard company profiles

Phase 2 - For customers who use the ‘product badge changed’ webhook and onboard company profiles

We will send a separate announcement with more details for customers who use this webhook and onboard company profiles in mid-November. We are targeting enablement for those institutions by the end of Q1 2025.

Get in touch with our Client Service team if you have any questions.

You can now choose which data points result will cause a monitored profile to be placed in review when using the Moody’s Orbis integration for your company data checks.

This will help to reduce the number of profiles being placed back in review by Orbis monitoring if some of the previously monitored data points are not relevant to your ongoing review process.

Background

When using the Moody’s Orbis integration with monitoring, company profiles are placed back into the review status when there are certain updates to the Orbis data. All of the company data tasks are marked as incomplete. These profiles may require manual completion.

📖 You can read about monitoring on our help site.

Changes to the following data points result in a profile being placed back into review:

• Change of company name (metadata.name)
• Change of address (metadata.addresses)
• Change of status (metadata.is_active and metadata.is_active_details)
• Addition, removal, or resignation of a director (associated_entities)
• Addition, removal, or resignation of an officer (associated_entities)
• Addition, removal, or resignation of a shareholder, controlling shareholder, beneficial owner, or global ultimate owner (associated_entities)
• New financial information (financials)
• Change of country of incorporation (metadata.country_of_incorporation)

Customers told us the number of monitoring updates was too high, and that some of these changes would not require a profile to be reviewed.

What’s changed

In the configuration options for the Moody’s Orbis integration you can now select which of these data points should result in the profile being placed back in review.

All the fields that were previously monitored will remain monitored by default. If you’d like to disable any of them, so that a change to those fields will not place the profile in review, the relevant field just needs to be unchecked in the list.

This configuration option can be changed by the Moody’s Client Service team.

Out of scope

ℹ️ We are still improving monitoring of company data in the platform, and expect to provide further improvements in due course.

• The ability to choose more data points to monitor outside of our previously defined list.
• Information about which data points changed when the profile was placed back into review.

Get started

If have any questions or you’d like us to set this up for you, get in touch with our Client Service team.

You can now filter the entries in a profile’s audit report to quickly find changes related to a particular topic, user, or period of time.

How it works

You can:

• Filter results by specific users who performed the actions
• Filter by the logged action types or events

• Define the date range

  • The default date range is from the date of the first entry to the current day
• Clear any filters by refreshing the page
  

Please note that any filters applied will not be reflected in the downloadable audit report PDF.

Getting started

The audit report filters are available to all users now.

You can access the audit report by opening a profile and selecting the Audit Report option from under the Profile Management section.

Read more about it on the help site.

We've now limited the size of the application flag history that you can retrieve in the v4 API using the flag_history array to the 10 most recent entries.

You can view the pre-announcement, or get in touch with our Client Service team if you have any questions.

You can now interact with VASP businesses confidently, enhance compliance team efficiency, and identify indirect exposure to cryptoassets. 

What is the VASP crypto risk check?

The Virtual asset service provider (VASP) crypto risk check provides an on-chain risk score that is available in Passfort using a third-party tool screening tool from Elliptic. By integrating Discovery, Elliptic’s VASP screening tool, Passfort can show a thorough risk profile for VASPs. This collaborative solution offers a comprehensive assessment of VASP risk, allowing you to analyze a VASP's on-chain risk exposure alongside other Moody’s off-chain risk indicators. 

The Elliptic Discovery tool analyzes a VASP's transaction links with sanctioned actors, illicit entities, and anonymizing services. It shows insights into the assets supported by a VASP and the presence of VASP compliance policies.  Additionally, it assesses the risk level posed by a VASP through the generation of a standardized on-chain risk score.

How it works

• Once you have configured the check, the VASP crypto risk compliance task is accessible on the profile page for an entity. 
• When the VASP crypto risk task runs, either manually or automatically from a Smart policy, the Elliptic Discovery tool generates a pass or fail outcome for the VASP. 
• The outcome is determined by comparing the on-chain risk score provided by Elliptic against a pre-defined threshold range (0-10) set during configuration. The higher the score, the higher the risk of the VASP’s on-chain exposure.
• The check result includes the specific on-chain risk score from Elliptic and a link to Elliptic's Discovery tool, for more in-depth analysis of the VASP.

VASP crypto risk outcome and a link to the VASP entity in the Elliptic Discovery tool.

Visual graphs available via the Elliptic Discovery tool highlighting the VASP’s exposure to licit and illicit counterparties and category types.

Configuration

• This solution is available to all Passfort customers as an optional add-on through Passfort Flex.
• The customer must have both Passfort and Elliptic Discovery to use this integration and it requires an Elliptic license key. Once configured, the integration can be used straight away. 

Out of scope

• Integration with other Elliptic products at this stage. 

Useful links from Elliptic

• What is a VASP? | Blockchain Basics | Elliptic
• The Importance of Knowing Your VASP in AML Compliance
• Banks onboarding VASPs: what you need to know

To learn more, you can also read Moody's brochure on VASP crypto risk.

If you'd like us to set this up for you, contact us. 

Currently, you can retrieve the entire application flag history in the v4 API using the flag_history array documented here. However, this can have significant performance issues for profiles with large numbers of associates.

As a result, we’re planning to limit the size of the application flag history you can retrieve via the API to the 10 most recent entries on 19th August 2024.

We are notifying customers as, although this is unlikely to impact you, it is a backwards-incompatible change to the v4 API.

If your integration relies on the application flag history array, please get in touch with our Client Service team by 12th August 2024 if you have any concerns.

You can now choose to disregard company financial statements when using the Moody’s Orbis integration for your monitored company data checks. This will help to reduce the number of profiles being placed back in review by Orbis monitoring if new financial statements are not relevant to your ongoing review process.

Background

When using the Moody’s Orbis integration with monitoring, company profiles are placed back into the review status when there are certain updates to the Orbis data. These profiles may require manual completion.

Changes to the following data points result in a profile being placed back into review:

• Change of company name (metadata.name)
• Change of address (metadata.addresses)
• Change of status (metadata.is_active and metadata.is_active_details)
• Addition, removal, or resignation of an officer (associated_entities)
• Addition, removal, or resignation of a shareholder, controlling shareholder, beneficial owner, or global ultimate owner (associated_entities)
• New financial statement (financials)

Some customers told us the number of monitoring updates was too high. We identified that new financial statements accounted for a large portion of these updates. For some clients these financial statements are not relevant to decisions made during the onboarding or review process, so we’re now providing the option to exclude updates caused by financial statements.

You can read about monitoring on our help site.

What’s changed

There is now a configuration option in the Policy builder that allows you to ignore company financial statements when using the Moody’s Orbis integration for your monitored company data checks.

This configuration option can be changed by the Moody’s Client Service team.

Important information

If you decide to turn monitoring updates for financial statements back on at a later date, all profiles that have not received the latest financial statements will be placed back in the review state with all company data checks expired. This could represent the entire portfolio.

Out of scope

• A wider ability to choose which data points to monitor.
• Information about which data points changed when the profile was placed back into review.

We are still improving monitoring of Orbis data in the platform, and expect to provide further improvements over the course of this year.

Get started

If have any questions or you’d like us to set this up for you, get in touch with our Client Service team.

You can now see whether shares in an Australian entity are held beneficially when assessing company ownership using the Moody’s Orbis integration.

Background

The Australian Securities & Investments Commission (ASIC) requires companies to disclose whether shareholders are holding shares for their own benefit or not.

This information is useful when trying to understand those who ultimately benefit from ownership of a company.

If the shareholder is holding the shares on behalf of another person, organization, or trust, the shares are not considered beneficially held. If the shareholder is not holding the shares on behalf of another person, organization, or trust, they are considered beneficially held.

What’s changed

When you are reviewing an Australian entity using the Assess company ownership task in the portal, you can now see the Beneficial shares status field for each shareholder.

This field will only be displayed for Australian entities. Information is only available for shareholder associates.

There are three possible values:

• Beneficially held: All of the shares are held for the benefit of the shareholder.
• Non-beneficially held: At least some of the shares are held on behalf of another person, organization, or trust.
• No result: Orbis held no data indicating the beneficially held share status.

This change may need to be enabled in your Orbis configuration.

What’s out of scope

• This data cannot be leveraged in the risk model or application flows.
• We do not monitor for any changes to this information.
• The field is only displayed for Australian entities.
• Information is only available for shareholder associates; the field will not be displayed for associates of the types beneficial owners, global ultimate owners, or controlling shareholders.

Find out more

You can read more about the Moody’s Orbis integration in our help docs, and more about the beneficially held shares in the Orbis help docs.

If you would like us to enable this for you, get in touch with our Client Service team.