AML Compliance | Teal Compliance

Someone reviewing paperwork on their desk

SRA’s Sectoral Risk Assessment: Sanctions

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

There are four emerging risks that the SRA has identified in the Sectoral Risk Assessment which was published in July 2023. One of these emerging risks is sanctions. Here, we explain the SRA’s update on sanctions, the associated risks and advice on what actions you should take.

What does the SRA say about sanctions?

We know that sanctions is a completely separate regime to anti money laundering (AML), but the SRA has stated: “Firms cannot assume that sanctions are not relevant to them. There are a significant number of British nationals subject to sanctions.”

The problem with sanctions is the strict liability. If you’ve acted in breach of the sanctions, then you’re liable. It’s possible that you might get some relief from sanctions as a result of what you’ve done to try and prevent it, but that would be determined as part of the disciplinary process.

Sanctions doesn’t work like bribery and tax evasion, for example, the failure to prevent bribery or the failure to prevent corporate facilitation of tax evasion. Both of those have a statutory defence regime that says, if you follow the guidance issued by Government to try and prevent sanctions, then you’ll have a defence if it actually happens. There’s no equivalent in sanctions.

So, if you do have a sanctions breach, then you’re at the will of the adjudication process as to how your process will be looked at, and whether or not you’ll be disciplined. Doing sanctions training, having a sanctions policy and doing sanctions screening is not an automatic ‘get out of jail free’ card.

What is the SRA doing regarding sanctions?

The SRA is really ramping up on sanctions. If you’re from a larger firm, this may not be news to you. You’ve probably known about sanctions for a long time, have a sanctions policy in place, may have done sanctions training, and probably always do sanctions screening as part of a wider ID&V process.

However, for the rest of the sector, the SRA is expecting to see sections in your AML PCPs or in a separate policy about sanctions. They’re probably looking for you to have incorporated it into training, or at least communicated the policy in relation to sanctions. This includes how they happen, what to look out for, and what CDD you should be considering.

At the recent Law Society Conference, the SRA confirmed that they’re doing some thematic work on sanctions and inspecting firms. If we look at the potential changes in the forthcoming Economic Crime and Corporate Transparency Bill, the SRA’s remit, as in what they’re responsible to detect and prevent, is potentially going to be extended. We believe it’s highly likely that this will be extended to include economic crime as well as money laundering and terrorist financing.

Economic crime obviously carries sanctions with it. So, whilst at the moment we’re talking about sanctions in the context of your AML risk assessment, if it’s not already on your to-do-list, you should be looking into this. In the meantime, make sure that you’re recording sanctions in your Practice Wide Risk Assessment, demonstrating that you’ve thought about it. If it’s in a separate document, make sure you reference it.

Is there an overlap between sanctions and AML?

As we’ve already said, sanctions is a separate regime to AML. However, there is an overlap. Some of the things you need to consider for AML will also be relevant for sanctions, such as:

1. Jurisdictions

This is where you look at countries where there’s corruption. If you’re using commercially available CDD searching tools, they’re likely to have sanctions checks within them. However, there is a huge list of countries that you should be aware of.

When looking at AML and CDD processes and procedures, think about when are you going to get a sanctions match. Do you do it after you’ve taken instructions, later on, or does it depend on what you find out? Always think about the timing of these things. If there’s some distance in your processes, make sure your lawyers have a good awareness of these high risk jurisdictions. That way, they’ll be able to identify them, not just because a search told them, but because they’ve thought about it.

2. Politically exposed people

Politically exposed people can get vast sums of monies from a country and then disappear with it. They then suddenly become sanctioned.

3. Complex corporate structures

The SRA makes the point that a person who becomes sanctioned may suddenly want to offload all of their assets to other people that they have control over. This is so the assets are being owned by those people, and move through banking systems in the name of these other people rather than themselves. So, your CDD, especially in relation to corporate structures, should involve considering:

Whether it makes sense for that person, or is this an attempt to evade sanctions?
Is it really under the ownership or control of the sanctioned person?

When considering complex corporate structures, don’t scrimp on CDD.

5. Sectors

Of course, there are lots of different sectors which are exposed to sanctions. However, if you have practice areas in the following, these are definitely areas where you should be carrying out a sanctions risk assessment and considering what you think the chances are of being targeted:

International trade
Shipping
Aviation
Immigration

Most high street firms don’t practice in these areas. They’re mainly found in larger law firms, and most larger firms have no doubt already got mature programmes in place for sanctions.

However, with immigration in particular, you need to recognise that it does appear in the SRA Sectoral Risk Assessment and that you should think about whether that’s something you’re likely to encounter.

What actions should you take for sanctions?

If you do get exposed to sanctions, you’ll no doubt have already done this work. However, for everyone who believes it’s unlikely to affect them, you do have to be cognisant of the SRA’s quote that “Firms cannot assume that sanctions are not relevant to them….”

If you don’t think that sanctions are relevant to you, make a risk assessment that states that they’re not and record that you’ve done that risk assessment. When you look at the sanctions guidance, it states you ‘should’ conduct CDD on counterparties. We believe you need to consider whether you should be doing this as part of a risk assessment first, before you implement a process.

Of course, your processes always depend on what your risk appetite is. If you’re a particularly risk averse kind of person, and you definitely want to sleep at night knowing that no sanctions could creep in at all, then you’re going to want to do sanctions screening for everybody.

Consider what action you already take. The SRA suggests that there’s a theme of people doing sanctions screening at the file opening stage, and then looping back around as part of ongoing monitoring. Of course, the issue with sanctions is usually about making economic advantages available to someone. It’s usually much later down the line than file opening. So, think about whether your screening has ongoing monitoring or whether you should rescreen if it’s a one off thing.

Consider if you’ve ever actually encountered sanctions. You may decide that you don’t have sanctions exposure, then you find out you do later on because, for example, there was a problem with processing a payment at your bank, or a problem had flagged up. If so, you might wonder whether your processes are adequate. If not, it might be that you don’t think you need to do much about sanctions. However, don’t say nothing about it! The SRA want you to demonstrate that you have thought about it.

Get in touch

At Teal Compliance, we’re here to support your journey towards regulatory and AML compliance.

If you’re looking to ensure that you, your firm and your clients are safe, simply contact our experts today.

SRA’s Sectoral Risk Assessment: Sanctions Read More »

Ellie Shute, Associate and Compliance Consultant at Teal Compliance

A day in the life of Ellie Shute – Associate at Teal Compliance

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

If you’re interested in a career in compliance, our associate, Ellie Shute, talks about life at Teal Compliance, and what her work involves.

About me

When I was studying law at university, the whole concept of compliance was a bit of a mystery to me. Surprisingly, I ended up falling into it after graduating. I embarked on a journey through various roles in different law firms, ranging from international researcher to compliance analyst. Along the way, I discovered my passion for navigating the realm of risk. So, when the opportunity to dive into AML compliance at Teal Compliance presented itself, I leapt at it without hesitation.

I’ve been part of the Teal team for a year now, and it’s been quite a ride. Stepping into the start-up life was a fresh experience for me, but I had a gut feeling that I’d made the right call. Working directly with my own clients has been incredibly rewarding. I’ve had the chance to forge relationships with diverse individuals and witness first-hand how my work can truly make a meaningful impact.

My role

When a firm needs assistance or guidance on anything related to AML, I’m their go-to person. My role covers a wide range of duties, from addressing spontaneous ‘Ask Teal‘ enquiries to crafting comprehensive policies and procedures from the ground up.

A significant portion of my time is dedicated to conducting audits for our clients, which involves conducting a thorough 360-degree examination of the firm. I’ll delve into their policies, interact with their staff, and scrutinise their client files. It’s during these audits that you truly get to dive deep into the inner workings of a firm and discover what drives it.

In between all this, you can catch me participating in our webinars, ‘Teal Talks,’ where we discuss various AML hot topics. Alternatively, you might find me crisscrossing the UK, delivering training sessions for our clients.

A typical day

I know it might sound like a cliché, but seriously, no two days are alike in my line of work! My schedule is usually booked weeks in advance with client tasks, so I have a rough idea of what’s coming. But you never know what surprises the day might bring.

When I’m in the middle of an audit for a client, one day I’ll be digging through their files, determining if they meet AML requirements. On another day, I’ll be chatting with staff members at a firm to see how much they know about their own company’s policies and procedures.

In the midst of all this, when I’m back at the office, my time is sprinkled with tea & cake breaks, impromptu quizzes, and convincing my colleagues to come and eat pizza with me at lunch.

What I love about what I do

One of the things that I love about my job is seeing how my work directly impacts our clients. We often work with small firms just dipping their toes into AML, and through our efforts at Teal, we help them kick-start their compliance journey and navigate the regulatory landscape.

On the flip side, we also have massive magic circle clients where I spend my time chatting to senior staff from around the globe about the regulations in their jurisdictions. It’s like a dream come true for the researcher in me!

Another aspect of my job that I greatly appreciate is the chance to apply my skills in fresh and innovative ways. Having previously worked as an international researcher, where my responsibilities included reviewing and analysing legislation from various countries, I had the opportunity while working at Teal, to take the lead in a significant audit for an esteemed magic circle firm. This audit involved the assessment of all of their international offices, and presenting my findings and recommendations to their senior team – the entire experience was truly remarkable.

Find out more

To find out more about a career with Teal, visit our careers page.

A day in the life of Ellie Shute – Associate at Teal Compliance Read More »

2 men in suits reading a document at a desk with a pen in hand

What are the SRA doing to enforce lack of AML compliance within law firms?

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

Sadly, law firms (along with other professionals) are still being labelled ‘ProfessiEnablers’ an arguably harsh term that has been in place for quite a few years now. This label was repeated by the National Crime Agency (NCA)’s UK Financial Intelligence Unit in their August 2023 update which stated that Professional Enablers’ “skills, knowledge and expertise are exploited by criminals to launder the proceeds of crime”.

For those of us that have dedicated our time, passion and finances to pursuing a legal career, this term is considered highly offensive. However, the term continues to be thrown at the legal sector because the levels of suspicious activity reports received by the NCA don’t reflect the level of serious organised crime that’s taking place within the UK. Their observations? Those of us within the profession are failing to spot the red flags of money laundering.

So, what are the SRA doing to enforce lack of AML compliance within law firms? As promised, they’ve continued to ramp up their anti-money laundering supervision and investigation measures, with dedicated AML teams being in place since 2019. This demonstrates their desire to dedicate time and resources to ensure AML compliance within firms.

Key Trends

Now, let’s take a look at some of the key trends they’re finding as a result of their supervision and investigation activities:

1. Firm-Wide Risk Assessments (A requirement since 2017)

Much to their despair, the SRA was finding that many firms didn’t have a Firm-Wide Risk Assessment in place, despite their numerous warning notices.

Similarly, a common trend was a failure to suitably tailor precedents according to the firm’s specific risks, namely client risk, product and service risk, jurisdiction risk, transactional risk as well as delivery channel.

They also addressed the fact that firms have returned Declarations to them stating that their Firm-Wide Risk Assessments were AML compliant, when this was far from the case. Whether this was intention or based upon reasonable belief that they were remains to be seen.

2. AML Policies, Controls and Procedures

Again, the SRA marked their disapproval at those firms who lacked any AML Policies, Controls and Procedures, a requirement that has been in place since the 2003 Regulations, and reiterated in the updated 2007 Regulations.

Surprisingly, they also found that some firms have robust and comprehensive suites of AML Policies, Controls and Procedures but these were effectively pointless as they weren’t communicated to staff who are the ones carrying out the day-to-day casework.

3. Lack of Independent AML Audits (where appropriate to the size and nature of the firm)

The SRA said that they expect most firms to have an independent AML Audit.

This is something that we see here at Teal Compliance. Many firms either don’t realise that they should have an Independent AML Audit or it’s something firms know they need to do, but don’t have the time, resources or budget to do.

Independent AML Audits can be a vital opportunity for your firm to address any deficiencies in your AML Policies, Controls and Procedures as well as to interview staff members and carry out review files to see whether the policies, controls and procedures are actually being adhered to as intended.

The SRA has confirmed that they intend to carry out AML audits for every firm, it’s a case of when this takes place as opposed to if this takes place.

4. Lack of AML Training within firms

Lack of targeted AML training within firms was another finding picked up by the SRA during their supervisory and investigative functions. Knowledge is power, so failing to equip staff with the knowledge and resources to spot red flags for money laundering can create large holes in a firm’s AML framework.

AML training should be a key focus for all firms, starting with the staff induction process and continuing on a regular basis (recommended annually as a minimum). Staff who work in higher risk sectors would expect to have more frequent bespoke training to their work type. However, distributing AML blogs and enforcement cases to staff can also form a supplementary part of the training framework, helping to keep staff members engaged.

The SRA has confirmed that its next Thematic Review will be in respect of AML training. This means they’ll also be visiting firms to review firms’ AML training processes. So, make sure your house is in order. The SRA will expect to see a training record detailing what training each staff member has had and when.

AML Breaches

Now, let’s turn to some of the statistic findings from the SRA’s supervision and investigations. In 2022, 249 AML Reports were made from the AML Supervision team with the most common breaches being as follows:

61 Reports of failing to have proper AML Policies and Procedures
60 Failure to carry out source of funds and source of wealth checks
58 Failure to carry out risk assessment at client/matter level
48 Failure to carry out Firm-Wide Risk Assessment
47 Failure to carry out /complete CDD

SRA Enforcement Measures

Aside from sometimes causing catastrophic reputational damage, SRA enforcement measures can have a crippling financial impact on firms of all sizes. However, the SRA have continued to use their full fining powers – both at an individual level as well as a firm level. Let’s have a look at some of the key cases:

1. Mrs A - £2,000 fine

Failure to follow firm’s PCPs
Failing to establish appropriate level of risk
Failure to obtain source of funds and source of wealth information

2. Firm B - £20,000 Fine

Failure to have Firm-Wide Risk Assessment
Incorrect Declaration made to SRA regarding the Firm-Wide Risk Assessment
No independent audit
Failure to provide staff with AML training
Failure to carry out client and matter risk assessments
Failure to carry out source of funds and source of wealth checks

3. Mr C - 12 month suspension on Practicing Certificate

Failure to perform CDD adequately
Failure to perform EDD where appropriate
Found manifestly incompetent

For further information on the SRA’s New Fining Powers, please click here.

What should law firms take away from this?

At the SRA’s conference in March 2023, Paul Philips, Chief Executive of the SRA, recognised that most firms are still trying to ‘catch up’ with the large amount of regulatory guidance and legislation that’s come into force in recent years. He stated that these firms will have nothing to fear.

It’s apparent that firms that are demonstrating wilful disregard to the requirement to have a comprehensive AML framework in place are those that are likely to feel the full force of the SRA’s fining powers, in addition to firms who return Declarations that they know to be incorrect.

The SRA also recognised that in times of wider economic pressures (such as the current cost of living crisis) there may be a tendency for firms to reduce their AML resources, whether that’s staffing levels or technology. However, they confirmed that AML resources must not be reduced and must remain a key priority for all firms.

Get in touch

If you require assistance with any of the topics discussed in this blog, such as assistance with your Policies, Controls and Procedures, AML training for your firm or you’d like to discuss our Independent AML audit services then please get in touch.

What are the SRA doing to enforce lack of AML compliance within law firms? Read More »

Eilish Cullen, Compliance Consultant at Teal Compliance

A day in the life of Eilish Cullen – Senior Associate at Teal Compliance

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

If you’re interested in a career in compliance, our senior associate, Eilish Cullen, talks about life at Teal Compliance, and what her work involves.

About me

I’ve been working as a Senior Associate at Teal Compliance since November 2022. Having previously carried out Teal’s comprehensive Compliance Officer Training Programme, I was already aware of their reputation within the compliance industry. Prior to this, I worked at a small litigation firm in Liverpool and had several roles including Head of Department, Deputy COLP, Director and Complaints Partner.

In my previous role, I carried out a wide range of tasks including fee-earning, supervision, training, elements of human resources, as well as policy drafting and compliance record keeping.

My role

My day-to day duties, usually consist of:

Reading Legal Futures/Law Gazette. Fellow ‘compliance geeks’ will understand the need to keep ourselves informed of Regulatory and AML developments.
I try to be active on LinkedIn. It’s a great platform to share our knowledge with clients, potential clients and those in the industry. I think it’s important for our clients to know about the services we provide and to put some personality into what others deem to be a ‘dry subject’.
I’ll plan out my day. This could be a Policy Review, Regulatory/AML training, CQS File Reviews or our most popular service – our independent AML Audit.
As Associates, we always keep an eye on our inbox for ‘Ask Teal’ enquiries. This is a central inbox where clients contact us seeking urgent guidance, and we aim to provide high-quality expert advice within a short period of time. Some of these can be very technical and tricky but between the Teal Team, we have always been able to assist.

A typical day

Whilst we’re thankful to have flexible working, I tend to work 9am-5pm.

Thankfully, the Management Team at Teal encourage taking regular breaks and are very keen on having good mental health strategies in place – no one wants a burnt-out employee! This means I always take my lunch break, something that didn’t really seem to happen in my last role due to other demands. I definitely feel more productive as a result.

Sometimes your best thoughts come to you whilst walking your dog – who would have thought?

What I love about what I do

One of the reasons I love working at Teal is the sense of job satisfaction I get, something I feel was missing in my last role due to ‘spinning so many plates’ and never truly feeling that I was adding value as a result.

Many of our law firm clients feel the same, with their time and resources being thinly stretched. Here at Teal, I’ve been given the opportunity to provide expert guidance to our clients and help to shape their compliance framework for the better which gives me a great sense of personal achievement. This is why I ‘do what I do’.

Diversity is also something that keeps me motivated. No month at Teal is ever the same! Alongside carrying out independent AML audits, CQS file review and AML training, I have also been selected to participate in round table discussions on financial management and regulatory issues. Having this level of exposure has been extremely beneficial for my career development within Teal.

That said, like many professionals, I’m sometimes plagued with the dreaded ‘imposter syndrome’ and doubt my own capabilities. However, I genuinely think this is counter-balanced by having a supportive and positive team around. Getting good client feedback also helps!

Find out more

To find out more about a career with Teal, visit our careers page.

A day in the life of Eilish Cullen – Senior Associate at Teal Compliance Read More »

Filing cabinet draw with file partially lifted out named "suspicious activity reports (SARs)

The potential pitfalls of SARs: 10 ways to avoid them

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

Filing Suspicious Activity Reports (SARs) should be a top priority for UK law firms, especially when dealing with situations that raise red flags for potential money laundering. However, the term ‘suspicious’ itself presents a conundrum due to its lack of a precise definition. The ambiguity surrounding suspicion demands clarity in expressing your concerns—not only to protect your firm against legal repercussions, but also to maintain transparency with your clients.

Here, we look at the pitfalls of filing SARs, and provide our top tips to avoid them.

Battling financial crime

The 2022 Suspicious Activity Report (SARs) Annual Report, released by the National Crime Agency (NCA), presented a clear picture of the evolving landscape of financial misconduct, spanning 2020/21 and 2021/22. The report includes the following:

Setting new records

The report reveals an impressive 21% surge in SARs submissions, reaching a staggering 901,255 in the latest financial year. This increase underscores the growing vigilance within regulated sectors against potential money laundering and criminal activities.

Striking back at criminals

SARs continue to play a pivotal role in halting financial crime. An astounding £305.7 million was denied to suspected ‘baddies’ through Defence Against Money Laundering (DAML) requests – a remarkable 120.6% boost from the previous year’s £138.6 million. This surge reflects the effectiveness of SARs in curbing illicit financial gains.

Adapting to changing scenarios

The pandemic and geopolitical events have emphasised the adaptability and significance of SARs. Criminals exploited the pandemic chaos, underscoring the need for accurate financial intelligence – intelligence that SARs provide. The report highlights the role of SARs, in unearthing money laundering linked to sanctioned individuals and their affiliations, particularly following Russia’s invasion of Ukraine.

The potential pitfalls

Despite the crucial nature of SARs, there’s a challenge when it comes to what constitutes as ‘suspicion’. Cases like Lonsdale v National Westminster Bank plc [2018] EWHC 1843 (QB) have added to the complexity of this issue.

David Lonsdale, a property law barrister, found himself entangled in a situation where his bank accounts were frozen due to suspicions of money laundering.

Mr Lonsdale owned several properties and managed the finances of each of those enterprises with seven separate bank accounts; including one account for his earnings as a barrister, and another two joint accounts.

The bank's actions

In March 2017, NatWest decided to freeze one of his joint accounts for eight days while filing a SAR to the NCA. In December 2017, they froze all of his accounts while filing additional SARs. That same month, NatWest wrote to Mr Lonsdale, informing him that they were going to close all of his accounts, offering no explanation or justification.

Of course, if a bank has genuine suspicion of money laundering, they’re entirely within their rights to file a SAR and freeze accounts.

Mr Lonsdale's response

Mr Lonsdale vehemently objected to the closure of his accounts and the accusation of suspicious activity. Mr Lonsdale demanded an explanation, but the bank refused to discuss the issue. As a result, Mr Lonsdale requested disclosure of the SARs, as well as any notes leading to the decision, recorded against his accounts, under the Data Protection Act 1998 (since superseded by DPA 2018).

In line with DPA laws, the bank provided account data, but refused to share the contents of any of the SARs raised against him. This led Mr Lonsdale to file complaints on the grounds of:

Breach of contract
Breach of DPA 1998
Defamation of character

The bank continued to assert that they weren’t obliged to grant access to the contents of the SARs. This led Mr Lonsdale to escalate the case by making an application to the courts.

The case results

When the case was heard, the judge found in favour in Mr Lonsdale’s application to access the content of the SARs.

The judge stated that suspicion must exceed mere fanciful possibility and acknowledged the absence of a requirement for suspicion to be ‘clear’ or ‘firmly grounded and targeted on specific facts’.

What we learned

The lack of a formal legislative definition for ‘suspicion’ has led to confusion and subjectivity. However, the judge’s response implies that suspicion holds a subjective nature, although it must be genuine.

NatWest was within its rights to take action, as banks can freeze accounts if genuine suspicion exists. However, this case highlighted the need for transparent communication and well-founded suspicions.

It establishes that, in some circumstances, clients may be legally entitled to view a SAR made about them, which could, potentially, lead them to bring a defamation claim against the MLRO if that suspicion turns out to be damaging and incorrect.

10 tips to avoid the pitfalls of SARs

In line with advice from the National Crime Agency (NCA) and the insights from the Lonsdale case, here are ten effective ways to navigate the potential pitfalls when reporting suspicious activity:

1. Clear and concise language

Aim for simplicity over legal jargon. Remember, the ‘reasons for suspicion’ section of the SAR limits your input to 8,000 characters, which translates to about 1,500 words. Clarity is your best ally.

2. Precise reasoning

When expressing your suspicion of money laundering, provide a comprehensive narrative. Address the fundamental questions: Who? What? Where? When? Why? How? Leaving no room for ambiguity.

3. Thorough details

Don’t shy away from specifics. When identifying individuals and businesses involved, include as much detail as possible. If suspected criminal property is in the mix, ensure it’s outlined with precision while adhering to privilege guidelines.

4. Detailed information

Elaborate on every piece of information that contributes to your suspicion. Clearly explain how you encountered this information, creating a transparent trail that others can follow.

5. Distinguish facts from suspicions

Separate hard facts from suspicions. It’s essential to convey what you definitively know from what you suspect. This distinction adds clarity to your report.

6. Chronological sequence

Create a chronological timeline of events that substantiate your suspicion. Be meticulous with dates, providing a clear sequence that supports your case.

7. Justify suspicion

Go beyond a mere declaration of concern. Provide the rationale behind your suspicion. For example, if sizeable third-party transfers are involved, outline whether you contacted the client, explain the inadequacy of their response, and detail how the transfer pattern arouses suspicion.

8. Deviation from the norm

Highlight how the flagged activity differs from normal operations within the specific customer or business sector. This contextual insight strengthens the gravity of your concern.

9. Professional involvement

If your SAR implicates a professional enabler (like an accountant or conveyancer), assess their involvement. Specify whether their participation appears witting and provide reasons for your assessment.

10. Clarity on transactions

Clearly describe whether your suspicion pertains solely to transactions or if it extends to the professional behind them. Transparency in this regard bolsters the effectiveness of your report.

Given the potential for vagueness in the term ‘suspicion’, it’s reassuring to know that The Law Commission is working to provide clearer guidance on what constitutes suspicion. In the meantime, adopting these ten tips will bolster the thoroughness and precision of your SARs.

Get in touch

If you need advice or guidance with AML compliance, we’re here to help you. Simply get in touch with one of our friendly experts today.

The potential pitfalls of SARs: 10 ways to avoid them Read More »

Hands resting on laptop with Cyber Security on the screen

How law firms can prevent cyber-attacks

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

Think of your accounts like your home. You can have the best locks and the best alarms but, if burglars want to get in, they can often find a way. However, having the best locks and the best alarms does deter them, and it’s the same with cybersecurity. You have to do everything you can to prevent cyber-attacks, protecting your law firm and making it as secure as possible.

When looking to prevent cyber-attacks at your law firm, there are a number of things you can do. This blog provides advice on ways to safeguard and limit your law firm’s exposure to cybercrime.

Safeguards to prevent cyber-attacks

There are numerous safeguards to prevent cyber-attacks. Some may seem a little obvious, but it’s important that they’re all in place to protect your law firm to the best of your ability. These are the most important safeguards:

1. Two-factor authentication on all logins

Whatever account you log into, you usually do so with a username or email, and a password. Two-factor authentication is an extra layer of security. Once you’ve input your username and password, you’ll then have an additional task to complete. This could be authorising the login via an app on your phone or computer, or a text message with a one-time-only code. It’s only when you complete this additional task that you’re able to access your account.

Make sure you have two-factor authentication set up on all your accounts, so it’s much more difficult for scammers, or baddies, to access them.

2. Regularly monitor sign-in activity on your account

Many logins, especially email logins, notify you when someone has logged into your account. These notifications can provide information such as who has logged in and where they’ve logged in from, for example, if they’re overseas.

Make sure, where possible, that you have these notifications activated. That way, when a baddie accesses your account, you’ll be able to act swiftly.

It’s important to note that the location may not always be genuine. If the baddies are using a VPN, they may be able to hide their location and make it look like they’re in the UK.

3. Anti-virus protection

Although it sounds obvious, anti-virus protection can significantly increase your security. It can often detect when a website looks odd, or something doesn’t look quite right. It will alert you to potential suspicious activity, giving your law firm an extra layer of protection, making it more difficult for baddies to get into your accounts, and helping you prevent cyber-attacks. Having your IT department test these firewalls is essential to check they are working.

4. Spam filter

The spam filter isn’t always reliable. Although it can detect some potential fraudulent emails and move them to your spam folder, it can often miss them. Also, genuine emails can often get caught up in spam. However, it does add an extra layer of security and makes you think twice about emails that end up in your spam folder.

5. Strong passwords

According to an article by Tech.Co on ‘Securing Accounts in 2023’, it’s quite easy for hackers to guess uncomplicated passwords. If a password is under 10 characters, it will only take 2 weeks to crack, and a simple 10-character password made of numbers or lowercase letters can be cracked in under 24 hours.

Therefore, making sure your accounts have strong passwords is an extremely important part of safeguarding to help prevent cyber-attacks.

Limiting exposure to cybercrime

In addition to putting safeguarding measures in place to help prevent cyber-attacks, there are various ways in which you can also help limit exposure to cybercrime:

1. Where possible use an app for clients to confirm bank details

There are apps available where clients can confirm their bank details together with the name of the person that’s expected to receive funds and it will confirm their details. Some banks also now match up the recipient’s name. It’s important to note that these tools are useful for guidance, but you can’t rely on them to be 100% accurate.

2. Never accept bank details over email

Pick up the phone, or better still, speak to them in person to get their bank account details. Although we appreciate it’s not always practical to do that.

3. Set up daily payment limits and limits on amounts per transaction

Although this isn’t necessarily practical as a conveyancer, given you’re dealing with transactions of huge amounts of funds all the time, setting up daily payment limits and limits on amounts per transaction can be very beneficial. If you’re unable to do this with your client account, you might want to consider it for your current account.

If you do this, and a baddie does access your account, they’ll be limited to what they can transfer, which limits your exposure to risk.

4. Dual authorisation on banking

Dual authorisation on banking can be really useful. It’s the modern-day equivalent of having two signatures on a cheque. The advantage is, if there is a scam, one person failing to recognise it is possible, but two people failing to recognise it is much less likely.

5. Have more than one bank account

The advantage to having more than one bank account is that if baddies manage to get into one account, they’re only limited to the funds in that account.

Taking a step back from the cybersecurity reasons, there’s also a practical reason for having more than one bank account. Money in most UK banks is under FCS protection. Your money is protected up to £85,000, but anything over £85,000 is not covered by FCS protection. It’s unlikely that more than one bank would go under at any one time and therefore spreading your money across different bank accounts limits your risk.

6. Regular virus checks

Having regular virus checks on all your devices, such as phones, tablets, laptops, and PCs, can significantly reduce risk and prevent cyber-attacks.

7. Have a good IT response

When a cyber-attack takes place, your response time is extremely important. If something were to happen, you need IT support on hand, rather than trying to find someone to help and wasting valuable time. Having someone at the end of the phone, who put your systems on lockdown and limits your exposure is extremely important.

How to prepare for a cyber-attack

It’s important that you prepare for a cyber-attack by ensuring that a firmwide policy is in place which details what should be done in the event of a cyber-attack

It’s also important to ensure that everyone has had the relevant training, which includes how to detect a cyber-attack. The SRA has suggested that you should probably have training every four months as people can easily forget what they have to do, so they need a reminder.

Carrying out a root cause analysis after an attack is important to establish why the attack happened and what measures can be put in place to stop it happening again.

Cybersecurity insurance

Many people believe that in the event of a cyber-attack, their business or professional indemnity insurance will cover it. However, they don’t actually cover cyber-fraud.

Insurance companies know that cybercrime is a substantial risk so the cybersecurity insurance they offer usually has an extensive premium and a rather hefty excess. Many law firms when assessing the risks believe that the cost of the premium and excess is so large, that they’re never going to claim on it, and therefore, having it would effectively waste their money.

Because cybercrime is so high-risk, the insurers often put a lot of limitations on the policy as well as expectations on the policyholder. So, if you do have cybersecurity insurance you need to ensure you’re well aware of all of these points and also what the insurers’ reporting requirements are in terms of time periods. Otherwise, you may find yourself in a situation where you pay a lot for a policy that isn’t fit for purpose.

What are the SRA regulations in the event of a cyber-attack?

In the event of a cyber-attack, you need to contact the SRA. As a solicitor, you have certain obligations under the account rules.

If money has been sent to the wrong person from the client’s account, the SRA regulations state that you need to pay that money back into the client’s account immediately. You can’t wait to try and get the money back first.

There was a case where the SRA fined a law firm as they didn’t pay the money back into the client’s account for four months. This was a breach of accounting rules that resulted in a significant fine.

There’s also a requirement to report the incident to the ICO within 72 hours.

You also need to tell your client. You don’t want your client to find out another way, such as if it ends up on the news, or the regulator contacts them. Be honest and open, even when it’s difficult.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

How law firms can prevent cyber-attacks Read More »

Two office workers touching a cyber security icon on a window screen

How to detect a cyber-attack via email at your law firm

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

The SRA recently confirmed that 100% of the reports of cybercrime they had came from email fraud. In addition, 98% targeted conveyancing, as it’s easier for fraudsters or baddies to try and defer large sums of money in this area of law. It’s therefore hugely important that law firms understand how to detect a cyber-attack via email.

This blog explores the various signs to identify suspicious emails that may lead to a cyber-attack via email.

Why do scammers want to access your email account?

Before looking at how to detect a cyber-attack via email, it’s important you understand why baddies want access to your email account.

When they have access to your email account, they can see emails that have come in and gone out of your account. This will give them access to a wide range of data.

This is especially dangerous for law firms as it could include details of transactions that are about to be made, together with personal details of those involved in the transactions. This could significantly help them when they’re trying to commit fraud.

Having access to your email account will also mean the baddies will have access to your calendar. If they’re planning to send fraudulent emails from your account, it’s more likely that they’ll do it when they know you’re not going to be online. That way, there’s more chance of you not noticing suspicious activity until it’s too late, and the damage has already been done.

What are the signs to identify suspicious emails that may lead to a cyber-attack?

When looking at how to detect a cyber-attack via email, there are numerous signs to look out for.

1. Emails with links asking you to sign into your account

The easiest and most common way for baddies to access your email account is by sending you a link, asking you to sign into your account. There are many different ways they do this. It might be an email from an account that appears to be Microsoft or Google, asking you to re-enter your password via a link. It might be an email from another source asking you to log into your email from a link, so you can sign a document. Even if it’s from an email sender you know and trust, their email account may have been hacked.

When you click on these links, the pages you go to are not genuine and instead of logging into your account, your details are stored. So, avoid clicking on these links in emails.

2. Emails saying that bank account details have changed

You’ll no doubt have heard about, or even received, emails that say things like “we’ve just changed our bank details”. Again, even if you trust the sender as you know them, they too may have been hacked, so it’s important to verify this. Give the person a call but don’t use the phone number on the suspicious email.

If you don’t verify this and it is the baddie’s bank account, it’s unlikely that you’ll see that money again.

3. Emails no in the style you'd expect from the sender

When you receive emails from suppliers, colleagues, clients, friends or family, usually, they tend to have their own style, using specific language and terminology. If you receive an email from someone you know, and it doesn’t use the style you’d expect from them, you should consider the email suspicious.

Again, try to authenticate the email by speaking to them, but if you call them, don’t use the number on the suspicious email. Remember, the email might be coming from the genuine sender’s account, but it doesn’t mean it’s them.

Knowing how to detect a cyber-attack via email from someone you don’t know when you don’t know their style, can be trickier. However, you can still consider the style. For example, if it was coming from a lawyer from another company, are they correctly using legal terminology?

Regardless, if anyone is asking you to transfer money, or do something else which may lead to fraud, think twice!

4. Emails with a sense of urgency

Many baddies send emails that ask you to do something as a matter of urgency. This could be something such as, your account will be deleted, or you’ll be fined if you don’t pay within a short space of time. They may even send emails posing as a manager from your business, asking you to transfer money, for example, saying they’re stuck in a conference and urgently need to make a payment, but their card is blocked.

Baddies want you to panic. They know you don’t want accounts to be deleted, get fined, or get in trouble at work, so you’re likely to take action quickly, as you’ve had little time to think.

The SRA recently said that 82% of the breaches that had been reported to them were as a result of human error, due to being under pressure. Therefore, if an email suggests you make a transaction quickly, don’t panic, think twice and do your due diligence.

5. Emails with signatures that are not quite right

Many baddies pose as reputable organisations, such as Gov UK, Royal Mail, high street banks, etc. Therefore, they include an email signature from that organisation, which often includes a logo.

It’s important to always check the email signature as there can be clear signs in detecting a cyber-attack. The signature and disclaimer may not use the right language or terminology or may even have spelling errors. The logo may be pixelated, stretched, or just seem a little off. If the email signature is suspicious, don’t click on any links.

6. Emails with email addresses that are suspicious

You may receive emails that name the sender and appear genuine. However, if you click on, or hover over, the email sender’s name, the full email address can be seen.

Baddies often have email addresses that appear suspicious and don’t fit with the person they’re pretending to be or the company they’re pretending they’re from.

7. Emails that aren't expected

Although we receive emails all the time that we’re not expecting, if you receive an email asking you to do something that may be considered suspicious, and you weren’t expecting that email, this may be a cyber-attack via email.

Again, you can call or speak to the person the email is from to determine whether the email is genuine.

8. Emails from clients saying there are last-minute changes

Just like with AML, emails that ask for last-minute changes, such as changes to the amount to be transferred, or changes to the bank details are suspicious.

Pick up the phone and speak to the client before you carry out any changes that the email suggests. Last-minute changes can be a red flag, so make sure you do your due diligence.

9. Emails on Friday afternoons

In conveyancing, a lot of completions take place on a Friday afternoon. As it’s the end of the week and many people are tired and want to get home for the weekend, it’s when baddies know lawyers are at their most vulnerable. Therefore, a lot of cyber-attacks via email take place on a Friday afternoon. This is called ‘Friday Afternoon Fraud’.

Therefore, make sure you continue to be vigilant on a Friday afternoon. Never act on impulse and get dragged into the urgency of an email, and treat all emails with caution.

Does a telephone call to the sender prevent a cyber-attack via email?

The clear and simple answer is no. The tactics of scammers are becoming more sophisticated and sometimes, you can make a call to the sender to check if the email is real, and actually end up speaking to the baddie!

When you get a phone number to call, you should also do your due diligence on that phone number. Check their website, check directories and do internet searches on the phone number to check if it’s genuine. If the phone number isn’t the genuine phone number of the genuine person, you’re more likely to find an inconsistency somewhere.

It’s important to note that there have been times when numbers appear genuine, even after due diligence checks. So, you really need to watch out for the other signs and be extremely cautious.

If you’ve fallen victim to a cyber-attack via email and transferred funds, can the recipient’s bank help?

If you find out you’ve fallen victim to one of these scams and transferred funds, the speed of your response is extremely important.

Don’t wait for your bank to contact the recipient’s bank. Find out which bank the money has been transferred to, by checking the sort code. Then, phone that bank, explain the situation, and ask them to put a hold on the recipient’s account. Although the recipient’s bank is under no obligation to do this for you, you may get someone on the line who’s willing to cooperate with you.

Remember, you don’t have days to stop the recipient from taking money from their account, but hours or even minutes. If you leave it too long, the baddies are likely to have cleared that account and you’re unlikely to ever see that money again.

Preparing for a cyber-attack

With every preventative measure in place, cyber-attacks can still happen. That’s why it’s extremely important to have a process in place in the event that one does happen.

We’ve prepared a useful guide on preparing for a cyber-attack which you may find helpful.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

How to detect a cyber-attack via email at your law firm Read More »

Man with PC and two laptops set up on a desk

The challenges of compliance legal tech

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

Leveraging compliance legal tech enables lawyers to get on with doing what they do best. It should be considered a partnership, with technology doing some of the heavy lifting involved in the daily administrative tasks that eat into lawyers’ billable hours.  

Although many advancements have been made in recent years, there are still challenges that are faced by law firms when adopting compliance legal tech.

How has law firms’ appetite for legal tech changed since the pandemic?

Of course, the pandemic expedited many law firms’ plans to digitise the operations side of their practice. They had to find legal tech solutions overnight, such as digital postroom services, AML, KYC, and digital onboarding solutions, to enable their business to move to a ‘working from home’ environment.

As a result, legal tech solutions were implemented with an urgency bias, so their appetite for tech was based on survival. It wasn’t necessarily about solving the problems they already had, it was about finding a way for firms to continue with as little interruption as possible.

The legal tech implemented at the time was able to fulfil that need. However, what many firms are now left with is a number of digitised processes that often don’t speak to each other, and all need to be managed individually. This can be extremely time-consuming and complex.

Therefore, the appetite law firms have for compliance legal tech has now changed. They were able to see how the legal tech worked for them during the pandemic in order for them to survive, and they’re now looking at it strategically. They want consolidation, and to build a future-proofed data and application ecosystem that’s incredibly strong.

With teams now working differently – some working hybrid, some working from home, and some full-time in the office – law firms need to make sure there’s a collaborative tool so everyone can keep their fingers on the pulse.

How has legal tech changed consumers’ expectations since the pandemic?

You’ll no doubt have read stories in the early days of the pandemic about people meeting in car parks to sign deeds over a car bonnet. In the digital world we were living in, this didn’t provide clients with a positive legal experience.

As law firms adapted to the pandemic by implementing new legal tech, clients were able to see how legal tasks could be done immediately and recognised the significant benefits. This has obviously increased consumers’ expectations of tech within the legal sector.

Consumers’ increased expectations have given rise to suppliers and other organisations within the legal sector to look at improving processes through legal tech. With more refined legal tech being implemented, the challenge law firms have now is how to link all these processes together effectively and make compliance processes seamless for their lawyers, and also their clients.

There are already some systems that make the onboarding process easy for consumers. Clients no longer have to find time in their lunch hour to take their documents into a solicitors’ office or find someone to certify them. However, if the next part of the client’s journey isn’t similarly optimised, and they still have to go into the office to sign documents or get an update, this is unlikely to meet their expectations.

Consumers are aware of how technology can make life easier for them, through tracking progress on particular purchases. For example, if they order a Domino’s pizza, they can track where the order is up to and when it’s due to be delivered; if they order an Uber, they can track the driver’s whereabouts and how far away they are. This is what consumers have come to expect from technology, and compliance legal tech should be addressing this and how clients’ expectations can be met.

What challenges are law firms facing when it comes to compliance legal tech?

There are a number of challenges now being faced by law firms when it comes to compliance legal tech.

1. Legal tech buying cycles

One of the challenges faced by law firms relates to the way buying cycles work for technology. It’s quite tempting for law firms to buy individual tech solutions one at a time to solve specific problems as they arise. However, this is causing issues.

Contracts for legal tech can lock you in for years. Imagine you have one legal tech solution that ties you in for three years. Then, a year later, another problem arises needing a different tech solution, and this ties you in for three years. The more this goes on, how are you ever going to be able to join the dots and get all of your tech working together? This cycle needs to change.

In an effort to tackle this challenge, law firms should be clear on what their medium-term core tech and application stack is. Once you’ve worked this out, for example, Microsoft, you can plan for all other tech to fit together and tackle issues when they arise. It sounds simple, but many firms don’t do this and it’s a problem we’re currently hearing a lot about.

2. Finding the right legal tech solution

There are so many different technological solutions, it’s becoming increasingly difficult for law firms to know where to find those tech solutions that will suit your needs.

The Law Society and the SRA are now working more to signpost firms who are interested in legal tech solutions. But, there’s still more that can be done.  

It’s important to ensure that it:

Solves the problems you face
Is fully compliant
Meets clients’ expectations

Our article on finding the right legal tech solution can help when considering technology on the market.

3. Getting buy-in from lawyers who don’t understand technology

Most often, traditional law firms, particularly high-street firms, don’t have a tech team, and not everyone understands the intricacies of technology. Talking in technology terms can sound alien to most, and something that should be avoided if you want lawyers at your firm to buy into new compliance legal tech.

The language you use is key when trying to deliver supportive, process-improving technology. Rather than using technology terms, it should be approached from a problem-solving basis, otherwise, you may find yourself just talking into a void. Lawyers are more likely to have an affinity around efficiencies, profitability, client performance, and service standards, as these are the challenges most law firms face.

You can talk to them about how the proposed new compliance legal tech can help, and the improvements to performance it will bring.

4. Getting buy-in from law firms that don’t think they’re large enough for legal tech

We often talk about technology for high street firms providing them with an opportunity to level up. That trend has certainly increased over the last few years, especially now we have plug-and-play technologies.

Several years ago, the sole practitioner of a property practice was able to completely corner the market. This was as a result of her having a direct consumer web interface, a subscription service that clients could log into, and discussion boards. We’re used to this type of interaction these days, but back then, she was way ahead of the curve.

This just proves that, even back then, you didn’t need huge budgets to benefit from technology. You can still be a contender in the space, you might otherwise have thought, was where the larger law firms with bigger budgets sat. Technology has the potential to unlock so many opportunities.

The types of technology solutions that are emerging now for high street law firms provides them with a much bigger resource and can even put them on the same playing field as online bankers.

How can change management help with the adoption of compliance legal tech?

People don’t necessarily like change as it can be disruptive, so change management needs to be built into any plans when adopting new compliance legal tech. That way, you can ensure you’re meeting expectations, and not just proposing a dream solution that isn’t going to work.

Having open conversations about the change management process is key to ensuring your staff are onboard. Finding people within your business to champion the change and having them work collaboratively with the software developer is a good way to feed the information back to the rest of the firm.

One thing that staff get concerned about when it comes to legal tech and AI is the fear that they’ll lose their jobs. Technology is about supporting everyone, not about replacing anyone. If efficiencies can be made, why not let tech do the heaving lifting? That way, the lawyers can get on with doing what they do best.

Over the years, the introduction of technology has already made a massive positive impact on the legal sector. Many conveyancing lawyers will remember that years ago, after completion of property purchases, they had to complete by hand a 20-page Stamp Duty document in black ink. If they got to the last page and made an error, they’d have to start all over again. That specific problem has been solved by tech that we now all use and understand. It’s for the same reason that new legal tech has been introduced – to make efficiencies.

The reason people train to be lawyers is to become trusted advisors for their clients. The introduction of new technology will enable them to do just that, rather than wasting their time on other tasks that can be done for them.

Get in touch

If you’d like to talk to us about our latest compliance legal tech, Teal Tracker, simply contact us and we’ll arrange for you to have a demo.

The challenges of compliance legal tech Read More »

Two people reviewing a tablet at a desk which also has a keyboard

Finding the right legal tech solutions

Anti-Money Laundering, Compliance Training, Legal Compliance, Regulatory Compliance / Joanne

Going back 10 years, finding the right legal tech was fairly easy, as case management systems were probably the only legal tech solutions law firms had to buy. Now, there are so many different technological solutions, how do you find out what legal tech is out there, and which is the best for you?

Finding the right legal tech is getting easier as the Law Society and the SRA are doing a much better job at signposting firms who are interested in legal tech solutions. The SRA has now introduced SRA Sandbox, which isn’t just for tech firms, but also for law firms that want to know what’s available. However, there’s still more that can be done.

Suppliers also need to help get the message out to law firms and advise them on what due diligence questions should be asked. In AML, regulators have actually put an obligation on law firms to ensure that they’ve understood exactly how their legal tech works, the data sources they’re accessing, and how it solves their problems.

At Teal, we not only want to provide law firms with reassurance that we’ve gone through all the rules and requirements they need to comply with, but we also want to ensure they’re aware that if they use a technological solution, it’s not just got to be compliant. It also has to be tangibly better than before.

This article provides helpful advice and things to consider when you’re finding the right legal tech solution for your firm.

Understanding the problems

You need to start the process by asking yourself ‘why’. Why do you need to a find legal tech solution? What problems will it solve? It’s only by understanding the problems you face in the first place, that you can really start your journey to find the right legal tech solution for you.

We all know what pain points may lead you to consider legal tech, such as the business isn’t making enough money, it isn’t profitable enough, or you can’t turn around the process quickly enough.

Not only do you need to understand the problems, but also the goals which you’re trying to reach. It’s only when you fully understand your problems and your goals, that you can really focus your efforts on finding the right legal tech to fix them.

How to work out what the problems are

This doesn’t need to be a difficult or time consuming exercise. It’s actually incredibly simple. Firstly, split the work types and ask questions such as:

Who’s delivering this task – lawyers or support staff?
How is this being delivered internally at the moment?
Is it part of a workflow?
How many units are the lawyers spending on it?
Could it be delivered by technology?

Once you’ve done this, you’ll start to see exactly what’s required. For example, you’ll notice if a fee earner is spending 9 units doing something which could be done by technology without taking any time at all.

An exercise like this should only take an hour or two and provides you with quick visibility of what your problems might be.

Collaboration of skills

The phrase ‘built by lawyers for lawyers’ often gets criticism. However, having lawyers building tech means they can add a level of knowledge which can be essential. Software developers who don’t understand policy, processes, and regulations can find that side of it really difficult.

However, software developers without legal knowledge build for the user experience (UX), whether the legal tech is for the client, the lawyer, or both. That UX is extremely important if the legal tech is going to work.

This is why building software collaboratively is key. It needs diverse thought when looking at what data lawyers need and what consumers need.

Collaboration within your law firm is also of paramount importance. When finding the right legal tech solution, different stakeholders, such as IT, the MLRO, finance, and the lawyers, will all have different questions. You should try to involve all concerned early on in the process to ensure transparency and that nothing is missed.

It’s all about a collaborative and diverse approach to solving problems.

The importance of integration

Integration is fundamental. However, first and foremost, it’s about problem solving with interconnectedness.

A lot of people in the market are talking about having an interoperable framework that’s going to solve all their problems. However, when finding the right legal tech, as we’ve previously mentioned, you have to start by asking ‘Why’. If you just focus on integration, you may end up with a number of technology integrations rather than having an interconnective framework.

Therefore, rather than focusing on whether the software solution integrates, the focus should be on how they all fit together as a framework.

Integration is expanding beyond our legal horizons. In the conveyancing world there’s a lot going on with regard to upfront material information. Estate agents are now starting to service information that previously has been in a conveyancer’s file before a conveyancer has even been instructed. This leads to many additional questions about what regulatory environment it sits in and how we pass that in a confidential manner between parties, in addition to making sure all the various boxes are ticked.

This is something we see coming in lots of legal work types, and that will bring a lot of opportunities. In AML, we can remove duplication and enhance the checks we’re doing from a fraud risk point of view. This will make sure those barriers are in place earlier in the process, which should hopefully make everyone’s lives easier.

Questions to ask software providers

Many law firms don’t have a tech team in place. For these firms, knowing how to ensure buy-in success when they don’t necessarily have the tech knowledge is difficult.

Depending on your problems and your goals, the questions will be different. You may be looking at a process for cost optimisation, or one to deliver an exceptional client experience.

Before you start, you may wish to consider instructing a consultant to help you with this. They should deliver value for money, so don’t be afraid to pay someone for advice if you don’t know the questions to ask.

The basic questions to consider asking include:

How much is it going to cost, per user, per seat per transaction?
What are the returns on investment going to be?
Who’s going to deal with any training – is that provided?
Who imports the data from old systems?
What security does it have – is it encrypted, where is the data stored, etc?
Is it a web app and if so, do lawyers and clients have to download it?
If it’s a web app, is it available on iOS and Android?

When finding the right legal tech solution, it can be really difficult to make those decisions. One thing you shouldn’t do is choose based on the fact that it’s working for another firm. As it’s all about finding the solution to your problems, what works for them, won’t necessarily work for you.

Therefore, once you’ve asked the basic questions, you really need to delve into the problems you have and get the suppliers to tell you exactly how the tech will meet your needs. By doing this, you’re more likely to find the right solution for you.

Get in touch

If you’d like to talk to us about our latest compliance legal tech, Teal Tracker, simply contact us and we’ll arrange for you to have a demo.

Finding the right legal tech solutions Read More »

People walking on a street seen from behind

How to spot the signs of human trafficking

Anti-Money Laundering, Blogs, Legal Compliance / Joanne

Human trafficking, second only to drug trafficking, stands as one of the fastest-growing illegal enterprises worldwide. If we look beyond the immense human costs, it becomes evident that where human trafficking occurs, money changes hands. Law firms can play their part by serving as another line of defence against these terrible crimes by understanding how to spot the signs of human trafficking.

Given the huge scale and pervasiveness of human trafficking, it’s essential for businesses to be proactive in identifying and addressing this issue within their supply chains. By not understanding how to identify the signs of human trafficking, we can inadvertently expose ourselves to significant risks. It falls upon all of us to make a collective decision not to let this happen on our watch, and to be alert to the red flags that indicate where human slavery may be taking place.

In this article, we’ll delve into the critical topic of how to spot the signs of human trafficking. As compliance officers and lawyers, your role in combating this heinous crime and its connection to money laundering is vital. By familiarising yourselves with the signs, you can contribute to early detection and intervention, making a difference in the fight against human trafficking.

The true extent of human trafficking

The true scale and cost of the crime is unknown. The Centre for Social Justice estimates that there are around 100,000 people in the UK in modern slavery, but this figure could just be the tip of the iceberg.

An annual report from anti-slavery charity, Unseen, shows a 116% increase in calls to its UK Modern Slavery & Exploitation Helpline in 2022 compared to 2021.

These figures present a bleak reality, exposing the widespread presence of human trafficking in our society. It’s a crime that operates ‘hidden in plain sight’, often occurring right before our eyes.

The link between money laundering and human trafficking further amplifies the urgency of addressing this issue. A joint report by the Financial Action Task Force (FATF) and the Asia/Pacific Group on Money Laundering (AGF) revealed that this form of crime generates an estimated $150 billion in illicit profits annually. This is a staggering increase of $32 billion compared to a previous report in 2011. These profits stem from the criminal enslavement and exploitation of individuals worldwide.

The breeding ground for human trafficking lies in the demand for cheap goods, cheap labour, and cheap sex. This exploitative industry thrives on the vulnerability of its victims and perpetuates their suffering. Shockingly, it remains one of the world’s most under-reported crimes, with countless victims suffering in silence.

Efforts to combat human trafficking have included innovative campaigns, such as the app campaign supported by London’s 10,000 Taxi Drivers. This initiative aimed to eradicate modern slavery in hand car washes by equipping drivers with indicators of forced labour through an app. By raising awareness of the signs of human trafficking and empowering individuals to identify these signs of exploitation, we can collectively work towards dismantling human trafficking networks and providing support to those in need.

Understanding the link between human trafficking and money laundering

Before we dive into the signs of human trafficking, it’s crucial to grasp the intricate connection between this heinous crime and money laundering. Criminals who engage in human trafficking have a sinister objective not only to exploit vulnerable individuals, but also to conceal the illicit proceeds generated from their abhorrent practices. This is where money laundering comes into play, serving as a tool for these criminals to disguise the origins of their ill-gotten gains and make it exceedingly challenging for law enforcement agencies to trace and intervene.

Money laundering serves as a critical enabler for human trafficking networks, allowing them to legitimise their illegal profits and integrate them into the formal financial system. By laundering the money, traffickers can create a façade of legitimacy, making it difficult to distinguish between the proceeds from their criminal activities and lawful financial transactions.

By linking human trafficking and money laundering, criminals not only profit from their exploitative activities, but also further perpetuate the cycle of abuse. The vast amounts of money generated from trafficking are used to fuel other criminal enterprises, perpetuating a cycle of crime that spans across borders and jurisdictions.

Understanding this intricate connection between human trafficking and money laundering is essential for law firms. By recognising the signs of human trafficking, you can also be on the lookout for potential money laundering activities intertwined with this crime. Identifying and reporting suspicious financial transactions or patterns, you enable you to become an essential part of the collective effort to disrupt and dismantle these criminal networks.

Understanding the types of human trafficking

Human trafficking involves the deplorable trade of individuals, exploiting them for various purposes, including forced labour, sexual slavery, or commercial sexual exploitation, all serving the interests of the traffickers or others involved.

The scope of human trafficking extends to horrifying practices such as forced marriages, organ trafficking, and even people smuggling. By understanding the different types of human trafficking, we can better identify the signs and take appropriate action. There are six primary types of human trafficking.

1. Trafficking for forced labour

This type of trafficking involves the coercion or deception of individuals for forced labour, often in industries such as agriculture, construction, domestic work, manufacturing, or the service sector. Victims are subjected to exploitative working conditions, long hours, minimal pay, and restricted freedom.

2. Trafficking for forced criminal activities

Traffickers may force individuals, including children, into criminal activities such as drug trafficking, theft, or begging. These victims are often vulnerable and coerced through threats, manipulation, or violence, to participate in illegal activities against their will.

3. Trafficking for sexual exploitation

This form of trafficking primarily targets women and girls who are coerced or deceived into engaging in commercial sexual activities against their consent. Victims are subjected to physical and emotional abuse, exploitation, and a loss of autonomy over their bodies and lives.

4. Trafficking for the removal of organs

Human trafficking for organ removal involves the illegal trade of organs and tissues, often through the coercion or abduction of individuals. Traffickers exploit the desperation of those in need of organ transplants, causing immense harm to the victims and risking their lives.

5. Forced marriages

Traffickers can also exploit vulnerable individuals by forcing them into marriage. Victims can be used in this way for the benefit of others who want to enter a country or get access to benefits. It often involves sexual exploitation or servitude.

6. People smuggling

People smuggling refers to the facilitation of illegal entry or transportation of individuals across borders, often involving unauthorised and unsafe means. While distinct from human trafficking, it’s important to recognise the potential overlap, as vulnerable individuals may be subjected to exploitation and abuse during the smuggling process.

By familiarising ourselves with these different types of human trafficking, we can broaden our understanding of the breadth and depth of this horrendous crime.

The signs of human trafficking

Identifying the signs of human trafficking is important. There are some specific red flags that lawyers and compliance offices should be aware of when it comes to human trafficking and money laundering.

While these indicators aren’t definitive proof, they can raise suspicion and warrant further investigation. Here are some potential red flags to keep in mind.

1. Financial transactions

There are a number of red flags to look out for in financial transactions, such as:

High volume deposits through bank accounts and immediate withdrawals from border towns
Ongoing ATM/ credit card transactions in even amounts between 10pm and 6am
Credit card payments to online escort services for advertising

2. Business account activity

When looking at the activity of a business account, signs may include:

Sudden activity changes in business accounts outside of the client’s expected profile
Structured cash deposits at multiple ban branch locations

3. Employment practices

Red flags in employment practices may include:

Workers’ contracts not readily available in a corporate transaction
Observations during client visits, such as the employment of large numbers of migrant workers or the presence of children in and around the premises

4. Behavioural signs

There are behavioural signs that may cause suspicion, such as:

Signs such as fearfulness, avoiding eye contact
Hesitancy to talk to strangers

5. Physical signs

Certain physical signs of victims may also cause suspicion, as victims may:

Appear to be isolated and rarely allowed to travel on their own
Not possess passports or identification documents that would allow them to travel freely

6. Financial data and due diligence

Law firms that hold financial data as part of their anti-money laundering (AML) checks or during due diligence on a transaction may have an opportunity to spot red flags and gather information that could provide a clearer picture of a potential criminal or money launderer.

Being alert to the signs of human trafficking is crucial in combating this horrific crime and its connections to money laundering. By familiarising yourself with the potential red flags and incorporating them into your compliance efforts, you can contribute to the early detection and prevention of human trafficking activities.

If you suspect any form of modern slavery is taking place within your supply chain, or you suspect your client may be involved, flag it immediately with the person responsible for dealing with it at your firm.

Educating your team and enhancing due diligence

Ensure that your compliance team receives comprehensive training on the signs of human trafficking. By integrating these best practices into your due diligence processes, you can further mitigate the risk of inadvertently supporting human trafficking or money laundering activities.

You have a crucial role in combating human trafficking and its connection to money laundering. By familiarising yourself with the signs of human trafficking, reporting suspicious activity, and promoting awareness within your organisation, you contribute to a safer society and uphold the values of legal compliance. Remember, every action counts, and together we can make a difference. Stay vigilant, stay informed, and let’s end human trafficking.

Get in touch

We work with law firms to ensure that anti-money laundering procedures and controls are in place. We also offer practical AML training for all staff, as well as specialist courses for those responsible for compliance.

If you’d like to speak to one of our experts about how we can help, simply get in touch.

How to spot the signs of human trafficking Read More »