6 ms·

PayPal compliance is a very different problem to social media moderation. Financial regulations require any transaction that is "suspicious" in any way of havin

PayPal compliance is a very different problem to social media moderation. Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so. And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word, so for a consumer service like PayPal the only real option is to block the transaction. In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high.

the8472 6y ago
But for regular banks service to private citizens is also compulsory, so they can't just choose the easy path by blocking a transaction based on keyword filters, they must do the intended auditing. So for them there is a balance, for paypal there isn't.
- deleted 6y ago
  [deleted]
- lotsofpulp 6y ago
  I would say it’s not much different with regular banks in the US, as they can and do refuse service with no recourse if you do something they seem suspicious.
- eru 6y ago
  > But for regular banks service to private citizens is also compulsory, [...] Depends very much on jurisdiction. PayPal is active in many jurisdictions, too.
- gruez 6y ago
  >But for regular banks service to private citizens is also compulsory what country is that? AFAIK in the US most businesses can refuse to do business with you for any reason, except a very limited set of reasons related to discrimination[1]. [1] https://en.wikipedia.org/wiki/Protected_group https://en.wikipedia.org/wiki/Protected_group
  - scarface74 6y ago
    Better citation is “No Duty to Deal” https://www.ftc.gov/tips-advice/competition-guidance/guide-antitrust-laws/single-firm-conduct/refusal-deal https://www.ftc.gov/tips-advice/competition-guidance/guide-a...
  - the8472 6y ago
    Whole EU, per directive 2014/92/EU > 44) Consumers should be guaranteed access to a range of basic payment services. Services linked to payment accounts with basic features should include the facility to place funds and withdraw cash. Consumers should be able to undertake essential payment transactions such as receiving income or benefits, paying bills or taxes and purchasing goods and services, including via direct debit, credit transfer and the use of a payment card. Such services should allow the purchase of goods and services online and should give consumers the opportunity to initiate payment orders via the credit institution’s online facility, where available. However, a payment account with basic features should not be restricted to online usage as this would create an obstacle for consumers without internet access.
pieno 6y ago
Well completing Know Your Customer checks and audits is sort of their job, isn’t it? They provide a service, saying that they will process payments unless the payment is prohibited by government sanctions. But instead of carrying out actual due diligence, they just block anything remotely related and put the onus and cost of doing their own job on their customers. At least they should have a better process to start proper diligence once a customer complains about overreach of their blacklist, to avoid improperly sanctioning innocent businesses. What if an arms trader used the name “Tickets Limited”? Would they block all payments mentioning tickets? Surely not, as it would hurt their business, clearly illustrating that their conduct is not at all due to “compliance with mandatory laws and nothing we can do about it” but “we did the math and we feel we can screw you over in this case.”
- deleted 6y ago
  [deleted]
- saddlerustle 6y ago
  I suspect there's a false positive rate on some teams's dashboard and it's kept at an acceptable level that won't require raising transaction fees or incurring too many more OFAC fines.
  - gruez 6y ago
    How would they know what transactions were true positives vs false positives? That would require them to know whether a transaction is bad or not, which as we know, is a hard problem
    - DaiPlusPlus 6y ago
      Random sampling, Monte Carlo methods, statistical inference, etc
- bryanrasmussen 6y ago
  >saying that they will process payments unless the payment is prohibited by government sanctions if they say that they will process payments unless prohibited by government sanctions and then do not process payments that is not prohibited I guess they would be getting sued for those payments.
bleepblorp 6y ago
This is the kind of thinking that lead to the TSA putting infants, and even a US Senator, on the US no-fly list because their names matched those of "known terrorists." The Washington concept of NATIONAL SECURITY<tm> is a brain-eating parasite that seemingly renders compliance managers unable to tell the difference between categorically different things, such as US Senators and IRA terrorists, or Serbian companies named Tardigard and products, sold by companies completely unconnected with Serbia, with descriptions that contain the word tardigard.
- lotsofpulp 6y ago
  > seemingly renders compliance managers unable to tell the difference between categorically different things Because it renders them liable. The whole system will turn against you if you give it an opportunity to nail you for using discretion. And this happens everywhere in society after a certain size is reached due to the need to hold people accountable without actually being able to fully evaluate who or what is to blame (due to the situation being too complex or not having all the facts/data). But politically, someone(s) has to go down.
  - deathhand 6y ago
    Only if there was some sort of cohort of people who would be able to judge actions to see if they are liable. Perhaps we aren't scaling the judiciary system propley & allowed it to become overly complex so that only a certain subsect of the population can navigate it efficiently and an even smaller portion of that can litigate for others.
    - eru 6y ago
      For some ideas, see http://www.daviddfriedman.com/Legal%20Systems/LegalSystemsContents.htm http://www.daviddfriedman.com/Legal%20Systems/LegalSystemsCo...
    - montjoy 6y ago
      Perhaps. Maybe if the same cohort of people who practice said laws weren’t incentivized to challenge existing laws and to make more laws there would be more resources to help judge.
ValentineC 6y ago
> Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so. Unfortunately, PayPal's advanced KYC and AML verification process is hilariously incompetent and rigid. Some months ago, they asked me to provide charity information for my personal account, and subsequently limited my receiving/sending privileges. Phone calls to them trying to sort this out have always ended up at some call centre in the Philippines, where the agents can only tell their users that the account limitation is "for their safety". That account of mine is still limited. They've also limited the personal account of a friend of mine (who was interestingly enough ex-PayPal) before, also asking for charity information.
nulbyte 6y ago
> And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word In the US, which is presumably where the sanctions trigger originates (the company is on OFAC's list), a review of a transaction is just that. Even opening an account doesn't require a review of your customer's entire financial history, merely that, for a business account, you understand the nature of your customer's business. > In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high. There is, however, good reason to do an actual review and not outright block transactions. The advice PayPal gave its customer, "change the wording on your website to prevent this from happening," is exactly what competant regulatory training tells you not to do. Changing the wording of a transaction to obviate the need for a review is in itself a red flag. PayPal is utterly incompentant.
classics2 6y ago
The only company I’ve ever seen take these requirement seriously is Transferwise. I have a very common last name and similarly common-ish business name and they had to have me say I wasn’t related to a bunch of politicians I’d never heard or nor associated with a bunch of similar companies. This keyword stuff is no kind of protection for them, especially if their own reps are advising people to just circumvent the list, which itself probably is a TOS violation.

the8472 6y ago

But for regular banks service to private citizens is also compulsory, so they can't just choose the easy path by blocking a transaction based on keyword filters, they must do the intended auditing. So for them there is a balance, for paypal there isn't.

deleted 6y ago
[deleted]
lotsofpulp 6y ago
I would say it’s not much different with regular banks in the US, as they can and do refuse service with no recourse if you do something they seem suspicious.
eru 6y ago
> But for regular banks service to private citizens is also compulsory, [...] Depends very much on jurisdiction. PayPal is active in many jurisdictions, too.
gruez 6y ago
>But for regular banks service to private citizens is also compulsory what country is that? AFAIK in the US most businesses can refuse to do business with you for any reason, except a very limited set of reasons related to discrimination[1]. [1] https://en.wikipedia.org/wiki/Protected_group https://en.wikipedia.org/wiki/Protected_group
- scarface74 6y ago
  Better citation is “No Duty to Deal” https://www.ftc.gov/tips-advice/competition-guidance/guide-antitrust-laws/single-firm-conduct/refusal-deal https://www.ftc.gov/tips-advice/competition-guidance/guide-a...
- the8472 6y ago
  Whole EU, per directive 2014/92/EU > 44) Consumers should be guaranteed access to a range of basic payment services. Services linked to payment accounts with basic features should include the facility to place funds and withdraw cash. Consumers should be able to undertake essential payment transactions such as receiving income or benefits, paying bills or taxes and purchasing goods and services, including via direct debit, credit transfer and the use of a payment card. Such services should allow the purchase of goods and services online and should give consumers the opportunity to initiate payment orders via the credit institution’s online facility, where available. However, a payment account with basic features should not be restricted to online usage as this would create an obstacle for consumers without internet access.

pieno 6y ago

Well completing Know Your Customer checks and audits is sort of their job, isn’t it? They provide a service, saying that they will process payments unless the payment is prohibited by government sanctions. But instead of carrying out actual due diligence, they just block anything remotely related and put the onus and cost of doing their own job on their customers. At least they should have a better process to start proper diligence once a customer complains about overreach of their blacklist, to avoid improperly sanctioning innocent businesses. What if an arms trader used the name “Tickets Limited”? Would they block all payments mentioning tickets? Surely not, as it would hurt their business, clearly illustrating that their conduct is not at all due to “compliance with mandatory laws and nothing we can do about it” but “we did the math and we feel we can screw you over in this case.”

deleted 6y ago
[deleted]
saddlerustle 6y ago
I suspect there's a false positive rate on some teams's dashboard and it's kept at an acceptable level that won't require raising transaction fees or incurring too many more OFAC fines.
- gruez 6y ago
  How would they know what transactions were true positives vs false positives? That would require them to know whether a transaction is bad or not, which as we know, is a hard problem
  - DaiPlusPlus 6y ago
    Random sampling, Monte Carlo methods, statistical inference, etc
bryanrasmussen 6y ago
>saying that they will process payments unless the payment is prohibited by government sanctions if they say that they will process payments unless prohibited by government sanctions and then do not process payments that is not prohibited I guess they would be getting sued for those payments.

bleepblorp 6y ago

This is the kind of thinking that lead to the TSA putting infants, and even a US Senator, on the US no-fly list because their names matched those of "known terrorists." The Washington concept of NATIONAL SECURITY<tm> is a brain-eating parasite that seemingly renders compliance managers unable to tell the difference between categorically different things, such as US Senators and IRA terrorists, or Serbian companies named Tardigard and products, sold by companies completely unconnected with Serbia, with descriptions that contain the word tardigard.

lotsofpulp 6y ago
> seemingly renders compliance managers unable to tell the difference between categorically different things Because it renders them liable. The whole system will turn against you if you give it an opportunity to nail you for using discretion. And this happens everywhere in society after a certain size is reached due to the need to hold people accountable without actually being able to fully evaluate who or what is to blame (due to the situation being too complex or not having all the facts/data). But politically, someone(s) has to go down.
- deathhand 6y ago
  Only if there was some sort of cohort of people who would be able to judge actions to see if they are liable. Perhaps we aren't scaling the judiciary system propley & allowed it to become overly complex so that only a certain subsect of the population can navigate it efficiently and an even smaller portion of that can litigate for others.
  - eru 6y ago
    For some ideas, see http://www.daviddfriedman.com/Legal%20Systems/LegalSystemsContents.htm http://www.daviddfriedman.com/Legal%20Systems/LegalSystemsCo...
  - montjoy 6y ago
    Perhaps. Maybe if the same cohort of people who practice said laws weren’t incentivized to challenge existing laws and to make more laws there would be more resources to help judge.

ValentineC 6y ago

> Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so. Unfortunately, PayPal's advanced KYC and AML verification process is hilariously incompetent and rigid. Some months ago, they asked me to provide charity information for my personal account, and subsequently limited my receiving/sending privileges. Phone calls to them trying to sort this out have always ended up at some call centre in the Philippines, where the agents can only tell their users that the account limitation is "for their safety". That account of mine is still limited. They've also limited the personal account of a friend of mine (who was interestingly enough ex-PayPal) before, also asking for charity information.

nulbyte 6y ago

> And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word In the US, which is presumably where the sanctions trigger originates (the company is on OFAC's list), a review of a transaction is just that. Even opening an account doesn't require a review of your customer's entire financial history, merely that, for a business account, you understand the nature of your customer's business. > In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high. There is, however, good reason to do an actual review and not outright block transactions. The advice PayPal gave its customer, "change the wording on your website to prevent this from happening," is exactly what competant regulatory training tells you not to do. Changing the wording of a transaction to obviate the need for a review is in itself a red flag. PayPal is utterly incompentant.

classics2 6y ago

The only company I’ve ever seen take these requirement seriously is Transferwise. I have a very common last name and similarly common-ish business name and they had to have me say I wasn’t related to a bunch of politicians I’d never heard or nor associated with a bunch of similar companies. This keyword stuff is no kind of protection for them, especially if their own reps are advising people to just circumvent the list, which itself probably is a TOS violation.