Anti-Money Laundering

Desk with coffee, glasses a pen and an assessment book

What are matter based risk assessments?

Anti-Money Laundering, Blogs, Legal Compliance, Risk Management /

Matter-based risk assessments were introduced in the 2017 Money Laundering Regulations (MLR). Fundamentally, the idea is you’re supposed to look at the client and matter, and decide how risky it is for money laundering or terrorist financing. You can then decide on the amount of client due diligence (CDD) you need to do. This is what the matter-based risk assessments are for.

There has been some high-level feedback on the struggles that lawyers are having with the introduction, given that they were all doing CDD before. Firms already had processes and procedures in place which didn’t include this step, and it’s been difficult to try and include it. Nevertheless, this is now the law.

By now, you’ll no doubt have a new process in place that includes matter-based risk assessments. However, this article will help you determine whether your new process is compliant and is going to work.

What does the law say about matter-based risk assessments?

The matter-based risk assessments regulation sits at Regulation 28(12)(a) of the MLR. It states:

“The ways in which a person complies with the requirements to take CDD measures must reflect:

  • The firm’s risk assessment
  • Its assessment of the level of risk arising in any particular case”

The first thing you should be aware of when you look at this is that it was primarily written for banks. When banks talk about commencing a business relationship, that means someone opening a bank account. When someone has an account they can make what constitutes as regulated transactions whenever they want through their bank account.

In the legal sector, this is slightly different. People can’t do transactions using lawyers without them knowing about it. So, the approach taken by banks would be to do a client-based risk assessment when an account is first opened, take the information they have, and set up something called ‘transaction monitoring’. Transaction monitoring is where they would use software to monitor certain behaviours and when something looks odd, this would trigger an alert of possible fraud and may block the account.

When the Regulation talks about ‘the level of risk arising in any particular case’, it’s talking about an account facet of the business relationship. For lawyers, although it doesn’t actually say the word ‘matters’ it means matters.

CDD is a matter-based activity, and the ‘CDD measures’ mentioned in the Regulation come in five parts:

  1. Matter risk assessment
  2. Identify the client
  3. Verify the client
  4. Purpose and nature checks (this is where the source of funds and source of wealth lives)
  5. Ongoing monitoring

So, to complete your CDD measures, you need to make sure that you’re approaching your purpose and nature checks on a matter-by-matter basis. You can return to the same client risk assessment, but you also have to add the particular factors of each matter, if there are any, into the risk assessment.

What does the SRA say about matter-based risk assessments?

The SRA did some work reviewing a number of files in 2019/2020. From that, they commented on the Regulation involving matter-based risk assessments, which included:

 

  • 29% of the files didn’t have a written matter risk assessment: Although the Regulation doesn’t specifically say it has to be written down, it’s clear that the Regulators are looking to see a written record.
  • There was no conclusion following the risk assessment: This is something we see quite a lot. Although it’s unclear why this is the case.
  • Conflict with the firm’s risk assessment: Remember, it states in the Regulation that it must reflect ‘the firm’s risk assessment’. Therefore, if your firm’s risk assessment states that a particular department is high-risk, and you determine that a matter for that department is low-risk, it’s not consistent and they’ll pick up on this.
  • Assumption the E-ID system did it for them: There are systems that incorporate this as part of the process, but one of the things that the regulator is aware of is the over-reliance on technology.

The SRA has expectations that fee earners should know how to do matter-based risk assessments properly and they must reflect the firm’s risk assessment, as there shouldn’t be a conflict between the two documents.

 

What part of matter-based risk assessments are causing lawyers to struggle?

One of the biggest issues we’ve seen is many lawyers are not sure of the purpose of completing a matter-based risk assessment. Although we’ve found that many law firms do have policies in place confirming that matter-based risk assessments are mandatory, there are still blank and incomplete forms on the files.

There are instances when risk assessments have been completed at the start of the matter. However, as further information is gathered, such as the source of funds and source of wealth, or further CDD, the risk assessments aren’t revisited and updated.

Another issue we’ve come across relates to risk assessments being completed to an extent, and the risks are rated low, medium, or high. However, there’s no narrative behind the risk rating, so it’s impossible to see how they’ve come to this conclusion.

Overall, many lawyers tend to carry out risk assessments, but the information they’ve gathered is all in their heads, and in many cases, there’s a failure to write anything down, and this is essential.

Carrying out risk assessments correctly is extremely important as if the SRA carry out an audit on your files, they need to see that you’ve actually considered the risks, recognised any red flags, and identified what level of due diligence should be done for that client.

 

Considering practice or firm-wide risk assessments

There can’t be a conflict between your matter-based risk assessment and your practice or firm-wide risk assessment. It’s therefore important that you get your firm’s risk assessment right.

Your practice or firm-wide risk assessment needs to reflect the National Risk Assessment. This has the following as high-risk:

  • Trust and company service provision: Creation of trust, creation of companies, company secretarial work, and trust administration work are considered high-risk
  • Conveyancing: Both residential conveyancing and commercial property are considered high-risk
  • Misuse of client account: Anything going through the client account is considered high-risk
  • Sham litigation: Although generally litigation is low-risk, sham litigation is an arrangement that’s considered high-risk

As well as reflecting the National Risk Assessment, your firm risk assessment also has to reflect the Regulator Sectoral Risk Assessment.

Considering client risk

The Regulation itself gives you an indication of what high-risk sectors are, such as oil, arms, precious metals, tobacco products, cultural artefacts, ivory. If a client operates in these sectors, they would be considered high-risk clients.

Clients who operate in cash-intensive businesses are also high-risk. These include businesses such as nail bars, car washes, barbers, fast food, and any businesses where people would legitimately pay in cash. Baddies often open businesses like these to launder their dirty money together with the legitimate cash earned.

Politically exposed people (PEPs) are also considered high-risk. The law doesn’t give you much wriggle room in this area. If a client is a politically exposed person and does a certain job, this is high-risk.

The financial Action Task Force (FATF) issues a list of jurisdictions where there’s a particular concern with their ability to handle anti-money laundering. This list is the high-risk third countries list. As FATF can’t take on face value that money from those jurisdictions is genuine, everyone dealing with that money has to check. This is why enhanced due diligence is required on high-risk third countries.

 

Considering matter risk

There has been a recent change in the MLR relating to matter risk. Regulation 19(4)(a)(i)(aa) did state:

“a transaction is complex or unusually large, and there is an unusual pattern of transactions, and…”

This has now changed to:

“a transaction is complex or unusually large, or there is an unusual pattern of transactions, or…”

You’ll note that the words ‘and’ have changed to ‘or’. When the word ‘and’ was included, it suggested that there would need to be a combination of things for it to trigger. However, this is not the case.

We’ve noticed that many firms still have the word ‘and’ in their policies and therefore their matter risk assessment process is looking for a combination rather than any individual factor. So, when lawyers are doing a matter risk assessment which is complex, unusually large, has an unusual pattern of transactions or no economic or legal purpose, these need to be triggered individually.

So, make sure you check your policies and make any necessary changes.

What does LSAG say about matter-based risk assessments?

Each regulator used to publish their own guidance. However, in 2017 the regulators got together and formed the Legal Sector Affinity Group (LASG). LASG then produced one set of guidance, the LASG guidance, to be used across the sector. 

The LASG guidance confirms that matter-based risk assessments should not be a tick-box exercise but suggests you follow the below criteria:

  • Talks about risk ratings
  • Can have a template for similar cases, but it must not become a tick-box exercise
  • Should assess and have regard to negative news results
  • Suggest review of matter-based risk assessments on long-running matters – however, they don’t give an interval of how regular that should be
  • Focus on recording reasoning for assessment
  • Record why you’ve picked the CDD approach

When should you revisit matter-based risk assessments?

We know that there are things you simply can’t answer at the beginning of a case when completing a matter-based risk assessment. That’s why the matter-based risk assessment should be for the life of the file and not just a file-opening exercise.

Therefore, you need to consider all the stages where a matter-based risk assessment is needed. There are three particular stages when we believe this needs to be considered.

  1. When you’ve had an initial conversation with the client. You’ll have as much information as possible and are deciding whether there are any factors from the conversation that are causes for concern. This will determine what level of CDD we should do.
  2. When you’re undertaking CDD. Once you’ve received the documents from the client to undertake CDD, what you receive will either change your initial risk assessment or back it up. In reality, it’s only at this stage that you can do a proper risk assessment as you’ll now have all the CDD information.
  3. Before you potentially launder money. The last point in which to undertake a risk assessment is just before you do anything which could be laundering money. You should stop, revisit your risk assessment and update it before you potentially launder money.

It’s extremely important that you write everything down on your file. If it’s not written down, how are you going to prove that you’ve done it if something goes wrong? Regulators need to see that you’ve covered everything.

What help can be given to lawyers on matter-based risk assessments?

One way of ensuring lawyers complete a risk assessment in the first place is to make it mandatory in order for the file to be opened. However, although this helps ensure they complete one initially, they may only partially complete it or may not revisit and update it at key points of the case. We therefore suggest a three-step approach.

  1. Training: Training is key. Lawyers need to understand the importance of risk assessments and ensuring they receive good quality training can help significantly to drill down that point.
  2. File Reviews: A good way for firms to determine how lawyers are doing with their matter-based risk assessments is through file reviews. You’ll have a chance to discuss any specific issues and identify if there are specific departments that are struggling. This will allow you to revisit the training with them when it’s needed.
  3. Firm-wide risk assessment: If you’ve not already shared your firm-wide risk assessment, this may help. Lawyers will be able to see your thought process towards risk in different departments, and this will help them when completing their matter-based risk assessments.

Following this approach should help lawyers complete their matter-based risk assessments moving forward.

Get in touch

If you need any assistance with policy drafting and reviews, AML audits, or training, simply contact us and one of our experts will be in touch.

Get in touch

What are matter based risk assessments? Read More »

Tree growing from stack of coins

What’s the regulator guidance on source of funds and source of wealth?

Anti-Money Laundering, Blogs, Regulatory Compliance /

Source of funds and source of wealth can be tricky because the regime we have is risk based. It’s not just about making sure you get bank statements. It’s also about the enquiries you make, the evidence you see, and what regulators think when looking at the work you’ve done.

Regulators want to know whether firms are doing this properly or not. Initially, the regulators were interested in firm-based risk assessments, did firms have one, did they assess the money laundering risks the firm was exposed to. They were then interested in whether law firms have their policies, controls and procedures in place.

Now, they’re looking at whether law firms are completing matter risk assessments. This is to ensure they have the right foundations for assessing the money laundering risks the firm is exposed to in respect of each matter. They’re also looking at identification and verification, including what checks you are doing, and what negative news are you looking at.

Eventually the focus will shift to source of funds and and source of wealth. This is because, you can’t stop money laundering by getting passports and utility bills. You can only stop money laundering by not moving dirty money. The enquiries you make in relation to source of funds and source of wealth are pivotal to the success of an AML programme. Therefore, I anticipate that regulators will start putting quite a lot of focus on that, on the basis that everything else is in place.

You can have perfect policies and procedures, with all boxes ticked. However, if a regulator can’t pick up a file and understand the source of funds and source of wealth work that’s been done, this is an issue. There therefore needs to be a proper process in place.

What’s the difference between source of funds and source of wealth?

Source of funds relates to where the funds of a transaction are coming from. You therefore need to consider what activity generated the funds, for example, salary, trading revenues or payments out of a trust. It relates directly to the economic origin of funds to be used in a transaction. Given funds are likely to be received via a bank account, source of funds would generally be evidenced by bank statements.

Source of wealth relates to how and why an individual has their wealth. You need to consider what activity generated their wealth, for example business ownership, inheritance or investments. Source of wealth can be investigated by taking reasonable steps to be satisfied that the funds used in a transaction appear to have come from a legitimate source.

The SRA on source of funds

A couple of years ago, the SRA released their findings and expectations when it comes to source of funds.

SRA Findings

The SRA’s findings included: 

1. ”21% did not evidence the client’s source of funds properly or at all“

What this tells you is that they’re not just checking to see whether you have some paperwork on file. They’re assessing whether it’s enough.

2. ”Companies used filed accounts, but these are old and have no relation on the current amount”

Filed accounts can actually be useful, even if they’re massively out of date. If you’re looking to prove a company is a properly trading business, having a history of filed accounts will help, especially if they’re audited. Although the client might not be showing you their current funds, a history of accounts will help you establish that the company has been trading properly.

That being said for you get the full picture of a company’s business you will need to make sure you have up to date file accounts.

SRA Expectations

The SRA’s expectations are:

1. ”We consider that carrying out and evidencing a source of funds check is crucial to comply…”

‘Evidencing’ is the important word here. One of the challenges we see, is lawyers being lulled into a false sense of security believing that their client isn’t a ‘baddie’. They can often talk themselves into thinking that they don’t have to look too deeply into source of funds and source of wealth. However, investigations need to be evidenced.

2. ”Obtain evidence of the funds early”

If there’s something in your source of funds and wealth information that leads you to a knowledge or suspicion, you’ll have to do a SAR. However, it’ll take at least 7 working days to do this.

You should therefore look at source of funds and source of wealth as early as possible so ensure the smooth running of a transaction. For example, if you wait a week before exchange of contracts before doing your checks, and you notice something suspicious, you’re not going to have time.

Although we understand just how busy lawyers are, this really is something that needs addressing early. Therefore, the processes built, not just in compliance, but also in file management, have to make sure that source of funds and source of wealth is plugged in at the right time.

The SRA and risk assessments for source of funds and source of wealth

The SRA are looking at risk assessments at the moment. As part of that, they want you to be risk assessing your client due diligence and your source of funds and wealth due diligence. A good question we suggest you ask is “Can I see on our file that you’ve considered the risk of money laundering after you have investigated the purpose and nature of the business relationship”. Usually, the answer is no.

When we’re auditing and file reviewing for our clients, it’s often difficult to see that this is happening. This is why we suggest having a 3-stage risk assessment:

  1. At file opening;
  2. When you review client due diligence (including source of funds); and
  3. Before the transaction takes place.

It’s a good way of documenting what you’re doing. It’s also a good trigger for fee earners to remind them that they need to be writing down their assessments because, in compliance if it’s not written down, the assumption is it didn’t happen.

Think of it like taking a maths exam. You get points for the correct answer, but you also get points for the working out, even if you’ve got the answer wrong. So, if something did happen, but you had all your source of funds and source of wealth evidence and you have written down that you have reviewed and assessed the risks, the SRA will take that into account. However, if it’s not written down, they’ll take the stance that you didn’t do it, and you’ll be in a lot more trouble.

Proceed of Crime Act (POCA) offences and the correlation between POCA and the Money Laundering Regulations (MLR)

What we often see is that lawyers feel source of funds and source of wealth is just a process they have to go through to get a file opened. This is understandable given the chance of a client actually being a baddie is slim, and the chances of being able to spot them is even slimmer. Some lawyers who’ve been trained for many years and do AML checks, hardly ever come across a baddie. It can seem like a very remote possibility and, therefore, a pointless task to them.

It’s rare that lawyers are sent to prison, and if they are, they’re more often than not baddies themselves. However, although the chance of a lawyer accidentally involved in money laundering going to prison is remote, it can happen. Take the case of Neil Bolton, a conveyancer in Manchester, who was went to prison several months. He acted for a baddie and pleaded guilty to a section 330, and for failing to comply with the MLR. He wasn’t the MLRO, he was a solicitor just doing his day job.

To prevent this outcome, you need to know about the correlation between both POCA and MLR.

1. POCA

If a POCA offence is committed, you can be sent to prison for up to 14 years. These offences are:

  • 327 – conceal, disguise, convert, transfer or remove (from the UK) criminal property
  • 328 – become concerned in an arrangement
  • 329 – acquire, use, or have possession of criminal property

You can also spend up to 5 years in prison if you commit an offence under s.330/1/2 – failure to disclose an offence.

In order to be at risk of committing one of those offences, you have to know or suspect, or someone else can infer that you should have known or suspected. It’s therefore all anchored on “Is there criminal property?”. So, the first question in your mental flow chart should be “Is there any criminal conduct?”. If there’s no criminal conduct that you suspect, then there probably isn’t any criminal property and you can’t commit an offence.

2. MLR

The penalties for not complying with the MLR are up to 2 years in prison and in order to comply you have to do 5 things:

  1. A matter-based risk assessment
  2. Identify your clients
  3. Verify what your clients have told you, by getting independent evidence to prove this
  4. Understand the purpose and nature of the business relationship
  5. Conduct ongoing monitoring

You’re only safe from criminal prosecution if you do all 5 of these.

3. POCA and MLR combined

These pieces of legislation don’t actually depend on each other. You can do all 5 things under the MLR, but if you suspect that a client is a baddie, then you’re going to commit an offence.

What lawyers often miss is that the opposite is true too. If a lawyer was acting for someone who definitely isn’t a baddie, for example, the Archbishop of Canterbury, but the work you’re doing for them is regulated, failure to carry out these checks is a criminal offence. If you don’t do your client due diligence, then the chances of you being able to spot a baddie is next to none and that’s why they make you do it.

When we talk about source of funds and source of wealth, what we’ve found is that many lawyers focus on whether the clients have the money. However, the focus should be on whether the money they have is dirty money. So, when thinking about source of funds and wealth policies, it’s not just about bank statements and utility bills.

Understanding the purpose and nature of a business relationship

Most lawyers usually go straight to source of funds and source of wealth but forget what other red flags they should be looking for. This falls under the purpose and nature of your business relationship, considering why you’re doing what you’re doing, why they’re asking you to do it and whether it makes sense. The guidance provides 5 questions which should be answered:

1. What is the purpose of the transaction?

You need to consider what the purpose of the transaction is: What’s the client hoping to achieve? Are they purchasing a property because they want to buy a new house?

For example, imagine someone with a corporate entity came to you as they wanted to purchase offices. However, there was no reason why they’d need to purchase offices as they run a garage. If they couldn’t give you a valid explanation as to why they were suddenly purchasing offices, you’ll need to investigate further. 

2. Is that usual for this kind of client?

Again, you have to look at the transaction the client is making and consider whether that transaction is usual for this sort of client. Think about what the client’s usual business practice is and whether this transaction usual for this type of business. If not, you’ll have to investigate further.

3. Is it an usually large or complex transaction?

This is a difficult one as there’s no tick box for this. Transaction sums and complexities differ from firm to firm, so it’s a difficult one for lawyers to get their heads around. The government understands we do need some more guidance on what’s considered ‘unusually large or complex’ and they’re currently looking at this.

However, the way we’d view an unusually large transaction would be to consider if it makes sense. For example, if a high-street hairdresser suddenly wanted to buy a £2m property, this would be an unusually large transaction for the type of work the hairdresser does.

When it comes to a complex transaction, again this is difficult, as some people believe everything is complex. What you need to look at here is whether the client is adding extra steps, or asking for steps to be removed as they want to rush it along, and considering if that makes sense. Some lawyers at this point would simply decline the work given the complexity.

4. Does it lack economic or legal purpose?

When considering if the transaction lacks economic or legal purpose, you should look at things like, whether they’re selling at an undervalue or an overvalue and why they’re doing this. For example, if someone wanted to rush everything through because of the stamp duty changes, this would make sense. However, if there’s no benefit for them in rushing a transaction, it would need further consideration and investigation.

5. Where is the money coming from and how did they get it?

Ultimately, this is what you’ll be investigating when it comes to your source of funds and source of wealth checks.

Money Laundering Regulations (MLR)

Unfortunately, there’s nothing in the legislation that tells you want you really need to do. That’s why lawyers find it so difficult to understand.

The only times you’ll spot reference to source of funds and source of wealth in the MLR is:

Regulation 28(11)(a) – Ongoing monitoring of a business relationship

Regulation 28(11)(a) states “scrutiny of transactions undertaken throughout the course of the relationship (including, where necessary, the source of funds) to ensure that the transactions are consistent with the relevant person’s knowledge of the customer, the customer’s business and risk profile;”

Relation 25(5)(b) – Politically Exposed Persons (PEPs)

Relation 25(5)(b) states “…take adequate measures to establish the source of wealth and source of funds which are involved in the proposed business relationship or transactions with that person;”

Regulation 33(3A)(c) – High Risk Third Countries

Regulation 33(3A)(c) states “…obtaining information on the source of funds and source of wealth of the customer and the customer’s beneficial owner;”

It would be better if we had confirmation of how far back you need to go, or how many documents you need to see. However, the reality is that having a formulaic approach sounds helpful, but it doesn’t work everywhere.

That being said, we would recommend that you have a process base line policy, you wouldn’t want the police to knock on your door and ask why you didn’t do it on this one. This is why we would ask for proof of documentary evidence for 6 months, wherever the funds have been.

Do you have to do a source of funds check if it’s a UK bank account?

This is a common myth which we’ve heard through our ‘Ask Teal’ service several times. Some lawyers think because money has come from a UK bank account everything is fine. But this isn’t the case.

There have been several UK banks fined for money laundering. Most recently was the NatWest who were fined almost £250 million for laundering approximately £365 million through their bank accounts. Baddies were going into various branches and depositing large sums of cash, one of which was £700,000 which was taken into a branch in a black bag.

Even if a bank suspects something and files a SAR, that doesn’t mean you don’t have to carry out the appropriate source of funds and source of wealth checks. There could be ongoing police investigations which you’re not aware of, and the banks are unable to tell you about. So, you really can’t use that as a safety blanket.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

Get in touch

What’s the regulator guidance on source of funds and source of wealth? Read More »

Brown paper torn to reveal the words "lessons learned" underneath

The Case of Nirosha Jayawardena and its Nine Key Lessons

Anti-Money Laundering, Blogs, Legal Compliance, Regulatory Compliance /

In an ever-changing landscape, keeping abreast of new developments is essential in the legal profession. This week, I delved into the intriguing case of Nirosha Jayawardena, a solicitor who recently found herself suspended from practice by the Solicitors Disciplinary Tribunal for one month.

 

The decision was an outcome mutually agreed upon by Ms. Jayawardena and the Solicitors Regulation Authority (SRA). Alongside the suspension, there were several stipulated conditions about her future conduct.

 

The Unraveling of a Complex Case

The case drew me in due to its facts and unique circumstances, which I believe underscore vital points for everyone in the law firm to keep in mind. It serves as a stark reminder of how weak anti-money laundering (AML) controls coupled with non-compliance to Accounts rules can potentially result in substantial losses for small firms.

Within the case, we saw the firm fall prey to fraudulent individuals masquerading as property owners. These fraudsters successfully manipulated the firm into selling properties and directing the proceeds into their pockets. In dissecting what transpired, multiple compliance failures came to light.

 

Nine Key Lessons

 

  1. Small Firms are Targeted

It’s a common misconception that only large firms fall prey to nefarious activities. While it’s true that some criminals target big firms, low-complexity impersonation frauds often zero in on smaller firms. These firms may lack the technological advancements or stringent sign-off procedures that larger firms have invested in, making them an easier target.

 

  1. Repeat Offenders

What’s peculiar about this case is the audacity of the fraudsters. After successfully duping the firm once, they brazenly tried their luck a second time. That’s the unsettling nature of fraudsters. They will often test the waters with a legitimate instruction to gauge the firm’s security measures. If successful, they will exploit the vulnerability repeatedly until caught/detected.

 

  1. Disruptive Methods for ID Verification

In the case of Jayawardena, the client conveniently couldn’t visit the office but was able to arrive in a taxi. Such disruptions to standard protocols serve to distract the lawyer, hindering their ability to spot discrepancies.

 

  1. Passport Errors

In a busy legal environment, it can be tempting to overlook small details. However, every document, especially identification ones, should be meticulously scrutinised. Fraudulent documents are surprisingly accessible and can range in quality. The case underlines the importance of spotting typos or unusual language in documents.

 

  1. Ignoring the AML Policy

Needless to say, adhering to your firm’s policy is crucial. Unfortunately, instances of non-compliance do occur. It’s essential to make sure that all guidelines reflect actual practice. Having procedures in place that are habitually ignored only serves to undermine the entire policy.

 

  1. Breach of Solicitors Accounts Rules

Impersonation frauds often hinge on payments made to third parties. This case underscores the importance of handling such transactions with extreme caution. Reinforce this within your firm and ensure that the rationale behind such payments is captured in writing.

 

  1. Ignoring Warnings in Customer Due Diligence (CDD)

Knowing how to interpret electronic verification search results is a must. Document what your next steps are if the checks don’t pass. Ignoring warning signs can clearly lead to a cascade of issues down the line.

 

  1. Failure to Retain and Verify ID Copies

The Regulations mandate that CDD must be retained for 5 years past the end of the business relationship. This case emphasises the importance of not only keeping a copy of the ID but also following through with verification processes like authenticity checks on passports and driving licenses.

 

  1. Mandatory Training Courses

An intriguing element of this case was the requirement for Jayawardena to undergo training courses on AML and Accounts Rules. This is a prudent move and, as an trainer, one I wholeheartedly endorse.

While this might seem daunting, remember that knowledge is power. Let’s learn together and fortify our defenses against these ‘baddies’.

 

Get in Touch

For more information, simply get in touch and one of our helpful experts will contact you without delay.

 

 

The Case of Nirosha Jayawardena and its Nine Key Lessons Read More »

Hand writing the letters CDD on glass

Delegating CDD Responsibilities between Lawyers and Central Teams

Anti-Money Laundering, Blogs, Legal Compliance /
As regulatory frameworks have evolved over the years, law firms have increasingly had to grapple with the challenge of managing Client Due Diligence (CDD) requirements. The introduction of the Money Laundering Regulations in 2003 was an important moment in this transformation. In response, many legal practices, including mine at the time, ended up establishing a dedicated centralised CDD team.

 

These teams emerged out of a need to streamline the cumbersome process that lawyers found themselves caught up in when conducting CDD. To facilitate this, we integrated ID searches into our case management system. This approach allowed the centralised team to handle the task of verifying client identities electronically, except in the case of conveyancing, due to the provisions of the CML Handbook, where documents were still needed.

 

The centralised team’s process was relatively straightforward: gather client information, attempt electronic verification, and when necessary, directly contact the client for additional details. Once all necessary data was gathered, it was forwarded to the lawyers.

 

However, a recent interaction with a former trainee, now a Money Laundering Reporting Officer (MLRO) at his firm, underscored a significant challenge: even when provided with detailed information about their corporate clients, lawyers often file this information away without a thorough review.

 

Moreover, many firms are struggling with properly conducting matter risk assessments. As revealed by regulatory findings, these assessments are not consistently completed, or accurately so, by the lawyers. This happens often because of an assumption that the central team is responsible for it.

 

This conundrum often raises a common question: how to strike a balance between central team assistance and lawyers’ duties? Here are a few pointers:

 

Manage Expectations: It’s essential to accurately represent the central team’s scope of work. Sometimes, in an effort to secure budgetary approval, the expected reduction in lawyer involvement is overstated. This can lead to lawyers presuming they are completely absolved from Anti-Money Laundering (AML) duties – A “get out for AML free” card if you will!

 

Clarity of Roles: Lawyers should have a clear understanding of their responsibilities. Generalised instructions, such as “conduct a risk assessment”, may not be sufficient. To ensure accuracy, break down the process into detailed steps. If possible, incorporate these steps into your routine procedures.

 

Prompt lawyers to prove they’ve done it: Assigning tasks that compel lawyers to engage with the information sent by the central team as part of the ongoing risk assessment process is crucial. This ensures active participation and reinforces the importance of their role in the CDD process.

 

Central Team Training: Central teams may often comprise individuals new to the legal sector. They may not fully comprehend what the lawyers need or the nature of information that lawyers are likely to possess. Hence, training them about the firm’s legal practices can improve their ability to anticipate and obtain necessary data.

 

The above suggestions serve as a starting point to bridge the divide between central teams and lawyers in the world of CDD. The ultimate aim is to ensure an efficient, effective CDD process that also ensures compliance with regulatory requirements and stops baddies from getting through!

Get in touch

If you need advice or guidance with AML compliance, we’re here to help you. Simply get in touch with one of our friendly experts today.

Get in touch

Delegating CDD Responsibilities between Lawyers and Central Teams Read More »

British pound notes scattered on a table with a calculator, pen and glasses

New SRA fining powers for AML – Be careful as they’re going to use them!

Anti-Money Laundering, Blogs, Legal Compliance, Regulatory Compliance /

The Solicitors Regulation Authority (SRA) has long desired more robust punitive capabilities against traditional law firms. They have historically possessed the ability to impose significant fines on Alternative Business Structure (ABS) firms and can forward cases to the Solicitors Disciplinary Tribunal (SDT) for an agreed decision’s endorsement. However, there are now new SRA fining powers. These powers were broadened, enabling them to impose a fine of up to £25,000 without SDT referral and approval.

Recent case study

A recent noteworthy fine was imposed on an Oxfordshire-based two-partner firm, Ferguson Bricknell, for Anti Money Laundering (AML) breaches. The firm was penalised £20,000 for violations of the Money Laundering Regulations and the SRA’s Standards and Regulations. 

Although £20,000 might appear insignificant to some, for a small firm, it’s a considerable sum! If you consider a £200 hourly rate at 20% profitability, a lawyer would need to work for more than 14 weeks to generate the profit to cover it. This is because fines are paid from profit; there’s no special budget set aside for them!

The full decision is a worthwhile read, providing insights into the firm’s declaration to the SRA of a compliant Practice Wide Risk Assessment. The SRA periodically requests firms to confirm their compliance with certain regulations and verifies this by checking a sample of firms. In this instance, the SRA disagreed with the firm’s assessment of compliance and investigated further into its AML conformity.

Key take aways from the case

The case provides valuable insights into the SRA fining powers and their approach, and offers seven key takeaways:

Number 1

When the SRA communicates with a firm, ensure a response is made. If your Compliance Officer for Legal Practice (COLP) is the recipient, ensure they’re checking their spam emails as the SRA’s emails often land there.

Number 2

If you claim compliance, be certain that you’re indeed compliant. There is an abundance of guidance, including free templates for Practice Wide Risk Assessments. Never claim compliance if it’s not the case.

Number 3

Keep up with reviews. Set reminders and take action. To show that you’ve reviewed a document, log the date and reviewer’s name (and approval if needed) within a version control table in the document.

Number 4

Consider establishing an independent audit function. Although not mandatory for all firms, it’s crucial for those of significant size and nature. The audit doesn’t have to be external, but in smaller firms, it must be conducted by someone independent of the people who oversee the policies, controls, and procedures.

Number 5

Regularly train your staff. The latest Legal Sector Affinity Group Guidance emphasizes annual refresher training. Additionally, the Money Laundering Reporting Officer (MLRO) and the Money Laundering Compliance Officer (MLCO) should receive specialist training for their roles.

Number 6

Conduct a matter risk assessment, as required by the 2017 Money Laundering Regulations. The SRA expects to see an assessment on every file falling within the regulations’ scope, with enough information to judge the risk assessment’s accuracy.

Number 7

Perform source of funds and wealth checks when necessary. Make sure it’s complete before accepting or moving any transactional money through the client account.

The case underscores the SRA’s commitment to enforcing AML Compliance. They’ll act against non-compliant firms, even if there are no actual money laundering allegations. Firms are expected to take their responsibilities seriously, with disciplinary actions waiting for those who don’t.

Get in touch

If you need advice or guidance with aml compliance or  regulatory compliance, we’re here to help you. Simply get in touch with one of our friendly experts today.

Get in touch

New SRA fining powers for AML – Be careful as they’re going to use them! Read More »

digital screen with man clicking on risk management

Managing risk and learning from mistakes

Anti-Money Laundering, Blogs, Risk Management /

As legal professionals, it is crucial to manage the risks we face daily and learn from our mistakes. The common goal of most professionals is to prevent messes in the first place. Building Compliance That Works is fundamental to being able to demonstrate resilience and self-reflection on internal policies and procedures.

In the legal sector, professional identity insurance has seen a significant increase, with some firms experiencing a minimum increase of 20% in their annual premiums. To combat the increase or limit it, it is essential to prepare early, not treat it as a tick box exercise, utilize a specialist broker, demonstrate that the taint has been removed, put in the work and time to the process, demonstrate your firm’s value on the proposal form, and have a standalone document. 

 

We all have problems, things which haven’t gone to plan, so how do we explain them?

If a problem is identified, Root Cause Analysis should be conducted for each instance. The purpose of this is not to blame a person but to investigate the different factors that enabled the incident to occur. In doing so, effective changes and prevention can be implemented to limit recurrence.

It is essential not to merely scratch the surface and dig down below to find the root cause. If the root cause is missed, the incident is likely to occur again, increasing the risk exposure. Human error is never the ultimate root cause, and firms or individuals should not feel ashamed in near misses. Instead, they should feel confident and empowered to share these experiences with others.

 

We worry people will fear it is a witch hunt if we dig too much into the issue.

Creating a positive environment to have these chats and building a safe environment where staff are confident that they will not be judged or penalised for asking for help or alerting a person to an underlying issue is crucial. Ensuring that the culture is embedded throughout the firm sets the right undertones for all staff, regardless of level or position.

Risk is there, through firms at all levels, and risks may change, but they are still present. Consider reporting lines or lines of support, whether internal or external. In most firms, the line manager automatically handles reporting lines, which can make people bury their heads and not speak out for fear of repercussions, insecurity, stress, and compromised decisions.

It’s important we face these causes, because without it people suffer. In many parts of the legal sector, (for example Conveyancing in 2022), there can be real risks that are exacerbated due to several factors outside the staff member’s control and, in some instances, the firm’s. Even if those risks do not transpire into meritorious claims, it is inevitable that there will be claims and complaints arising out of these risks, which will have a considerable impact on staff and firms.

Everyone, at one time or another, will make mistakes within their careers, and it is how we deal with them that helps shape our careers and share the firms we work within.

 

How can we mitigate the consequences of issues arising?

Make it easier to find out what actually went on – Recording file notes is essential, documenting what is done at each stage, what has been found, what the client has been informed of, when they were informed, and by what means, and why the matter cannot proceed further.

Supervise properly – In the remote world we currently operate within, identifying signs in others is crucial. If you are a supervisor, think about how to monitor, motivate, and supervise daily. Remote working adds another layer of complexity, making identifying a gut feeling a lot harder. Make a conscious effort not to focus solely on the work and be visible and personable, building trust and relationships.

Use your data – Data collection and analysis can help fill gaps and identify where and who requires support. Data that could be considered includes low WIP or alternative high WIP, money held on the file, inactive client records, average case length, non-billing for a period, what happens when the file gets to 75% of the fee estimate, and retainer profitability and written off time.

Taking action if you think there might be a problem – doing more file reviews, and stacking the odds in your favour is invaluable regarding risk exposure and learning. Get curious, ask why, and continue learning about your team and how they operate.

 

Get in touch

For more information about our risk management services, get in touch with our experts. 

Get in touch

Managing risk and learning from mistakes Read More »

Woman on laptop with man in background

What does an AML audit involve?

Anti-Money Laundering, Audit, Blogs, Legal Compliance /

We love an AML audit and really enjoy reviewing law firms’ policies and procedures to see the different approaches they take in respect of AML. Most of all, we find it extremely interesting to see how a firms’ culture surrounding compliance is changing.

In this blog, we delve into what an AML audit is, and what an AML audit involves. 

What is an AML Audit?

The AML audit process is a way to strengthen or improve a firm’s AML programme. It is a way of assessing whether Firm’s AML policies, controls and procedures are up to date, comply with The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR) and are functioning in practice as intended.

What's the purpose of an AML audit?

The purpose of the Audit is to:

  • Examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted by the Firm to ensure compliance with the requirements of the Money Laundering Regulations;
  • Make recommendations in relation to those policies, controls and procedures; and
  • Monitor compliance with those recommendations.

Why conduct an AML audit?

There are two types of audit: 

Mandatory Audit

Regulation 21 of the MLR requires a relevant person, where appropriate to the size and nature of the business, to establish an independent audit function. This does not necessarily need to be an external audit, however, it will need to be conducted by someone in the firm who is independent of the Risk/Compliance/Anti Money Laundering (AML) function, but equally has enough AML knowledge to be able to conduct the audit. It is important to note that any findings in an Audit Report carried out under regulation 21 are disclosable to the Regulator.

Non-Mandatory Audit (Internal Audit)

A Firm may choose to conduct an internal Money Laundering Audit as routine procedure, being a way of checking whether the Firm’s policies, controls and procedures are up to date and comply with the MLR. The Audit report in these circumstances would remain for internal purposes only and confidential to the firm.

What's does an AML audit involve?

There are four stages involved in an AML audit: 

1. Review of policies and procedures

Firstly, a review of all the firm’s AML policies and procedures, Firm Risk Assessment and the Firm’s matter-based Risk Assessment is conducted by the auditor.

When carrying out the review the auditor will assess whether the firm’s AML policies and procedures meet the requirements of the MLR.

The auditor will use a list/table of each specific regulation and check this against the firm’s AML policies and procedures to confirm whether or not the firm has met that requirement.

2. Test

As part of the audit the auditor should test the knowledge, understanding and application of the firm’s processes. This is normally tested through staff interviews and matter file reviews.

Interviews

Interviewing staff will help the auditor assess the staff’s knowledge and understanding of money laundering, money laundering red flags and the firm’s processes.

File reviews

The auditor will carry out a review of files and assess whether the matters comply with the firm’s AML policies and procedures.

The auditor may also request to review some closed files. Reviewing a closed matter will assist the auditor in assessing whether there was on-going monitoring of risk and whether the completion instructions to accounts included information as to risk.

3. The Audit Report

The audit will result in a written report on whether:

  • The firm’s risk assessment and AML policies, controls and procedures comply with the minimum requirements of the MLR.
  • Changes which are required as a result of deficiencies identified (if any).

The audit report should:

  • Set out the law (what specific regulations of the MLR were checked against).
  • Explain what was examined for that specific regulation.
  • Document findings of areas of compliance and non-compliance as well as identifying areas for recommended improvement in behaviour and practice. It should be made clear which areas the firm is compliant, non-compliant or partially compliant.
  • Include an indication of where there are potential failings and a recommended course of action.

4. Review

The firm should conduct a review following an implementation period to establish compliance with the recommendations. As part of the review the auditor will be assessing whether the recommendations have been carried out and whether there is any evidence to show whether they are effective.

Get in touch

If you would like to discuss this further or feel your firm requires an independent AML audit, please get in touch and we’ll be happy to help.

Get in touch

What does an AML audit involve? Read More »

two people working on laptops

Anti-Money Laundering – What to expect from an Independent Audit

Anti-Money Laundering, Audit, Blogs, Legal Compliance /

 

Regulation 21 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (otherwise known as the Money Laundering Regulations) requires that regulated firms implement certain controls where it is appropriate to the size and nature of the firm. One of those controls is to establish an independent audit function. 

The size and nature test requires some objective thought and firms are directed by the Legal Sector Affinity Group’s Guidance to consider a number of factors including the number of staff and offices your firm has, your client demographic, and the nature and complexity of work you undertake. The Solicitors Regulation Authority’s take on it is that most firms (but not all) will need an independent audit. In its latest AML Report of October 2021, the Regulator found that a high number of firms visited (49 out of 69) failed to implement an independent audit where required. For those firms where an audit had been carried out, some common areas of concern were that the reviews were not sufficiently thorough or lacked an element of testing, they weren’t independent, and firms had not implemented the recommendations in a timely way. Such concerns could lead to firms being referred to the SRA’s Investigations Team. 

 

So if you have considered the size and nature test and determined that you need an independent audit, what should you expect from your review? It is key that your audit: 
    • Is independent from the people in your firm who are involved in setting and following the policies. The Regulations don’t prescribe that your audit must be carried out by a third party; but consider whether you are of a sufficient size to be able to resource a truly independent audit. Do you have staff with the right knowledge and capacity to carry out the audit? Even larger firms who have an audit function may find they do not have the necessary experience in AML. 
    • Is adequate in its scope and depth in order to give the firm assurance that the policies, controls and procedures they have in place are working. It should include a review of the existing documentation including firm and matter risk assessments and training plans, and a detailed review of how those processes have been implemented through file reviews and interviews with staff members to test understanding. The frequency of the audit should also be considered. Many firms decide to carry out an annual audit based on the size and nature test, but you may also consider focusing more frequent audits on higher risk areas as identified in your firm-wide risk assessment. 
    • Effectively identifies where processes are working well and roots out any problems with the process or where the process is not being followed. This means having the right person with the right expertise to carry out the audit so they know what they are looking for. It means carrying out an adequate number of interviews and file reviews across all locations and matter types so the Auditor can get a good feel for the firm and the types of issues that are occurring. Staff members from your fee earning teams, finance and any centralised onboarding teams should expect to be interviewed, along with the firm’s MLRO/MLCO. You may also consider focusing more frequent audits on higher risk areas as identified in your firm-wide risk assessment 
    • Provides feedback on where the firm’s current policies and procedures are not meeting the requirements of the Regulations and makes recommendations for improvement. A written report will provide you with the evidence that an independent audit has been carried out should the Regulator ever ask you for that information. The report should clearly set out the actions that should be taken to rectify any non-compliance. Recommendations should be implemented in a timely way and you should keep a record of the actions taken to meet the recommendations. 
    • Is part of an ongoing monitoring process to help you continually evaluate and improve compliance with the Regulations. Keep records of independent audits carried out for future reference and to evidence a robust auditing regime. 

There is no doubt that an independent audit requires some forwarding planning and investment in resources, whether that be internal resource or if you plan to engage an independent firm to carry out the audit on your behalf. It’s not a tick box exercise. Senior level commitment to the importance of implementing good anti-money laundering controls is therefore crucial and sets the tone for the firm and for the staff whose files may be reviewed or who may be interviewed as part of the audit process. But the reward for your investment is obtaining a real learning opportunity to understand what your firm is doing right and where it can make improvements and effectively manage money laundering risks.

 

Get in touch

For more information about our independent audit service, get in touch with our experts today.

 

 

Photo by Scott Graham on Unsplash

Anti-Money Laundering – What to expect from an Independent Audit Read More »

British passports (red)

Do you have to collect CDD on employees of clients?

Anti-Money Laundering, Blogs, Data Protection, Legal Compliance /

This is a question I get asked loads of times!

In fact, last week I had a client who has a policy of asking for ID for employees, and their client refused citing Data Protection concerns. I’m not planning to go into the data protection issues here, but instead whether you have to ask for it.

To get to the answer here, we need to start with the law.

The law requires, in connection with a client who is not a natural person (I prefer using the word human here!) that you need to obtain and verify certain information about entity. For a company that is

  • name,
  • company number,
  • registered office,
  • the law to which it is subject,
  • its constitution,
  • the full names of the board and senior persons responsible for it.

In addition, you need to identify and verify the ultimate beneficial owners.

So, do we need ID from directors, or people who instruct us on behalf of a company?

In the original 2003 Money Laundering Regulation it was a requirement to identify and verify at least 2 directors, but this was removed by the 2007 regulations. I’ve found despite this change many firms still have that process, whether as a legacy from the original regulations or as a risk management measure – so that they have proof a real person is connected with the company. After all, the whole point of passports and utility bills is so you can tell the police which door to knock on, to talk to about the entity.

I think many of the more recent queries I have had come from confusion arising from Money Laundering and Terrorist Financing Regulations, which introduced in 2017 Regulation 28(10).

(10) Where a person (“A”) purports to act on behalf of the customer, the relevant person must—

(a) verify that A is authorised to act on the customer’s behalf;

(b) identify A; and

(c) verify A’s identity on the basis of documents or information in either case obtained from a reliable source which is independent of both A and the customer.

There was concern when this first came in that an employee or director might be thought to be purporting to act on behalf of the client. Fortunately, the Legal Sector Affinity Group Guidance helps here:

Section 6.6

Examples of someone purporting to represent might include:

  • a parent on behalf of an adult child.
  • an individual not employed by your client; or
  • a situation where the instructing persons authority to instruct is not clear or does not make sense.

Section 6.14.9

Someone employed by your client (depending on their position or seniority) or a director of your client may be considered as having apparent or ostensible authority to provide instructions on behalf of the client, though you may seek comfort of this on a risk sensitive basis. They should not be considered to be intermediaries, agents, or representatives. Where it is not clear or apparent what their authority to instruct on behalf of the client is, CDD should not be considered to be complete.

Accordingly, it is now much clearer in that “purports to act” is not intended to mean officers or employees of a company. That said, many firms still do carry out individual CDD on Directors and sometimes on employees instructing who are not directors, and whilst that is not required by the Regulations, it can be useful to provide an audit trail for the client in case you are challenged later on as to why you acted on instructions provided on behalf of the non-human client.

 

Get in touch

For more information about our AML services, please get in touch with one of our helpful experts.

Get in touch

Do you have to collect CDD on employees of clients? Read More »

Man working figures and charts on two screens and a laptop

Economic Crime (Anti-Money Laundering) Levy

Anti-Money Laundering, Blogs, Legal Compliance /

With all that is going on at the moment, its quite likely that you are not aware that the Government has introduced the Economic Crime (Anti-Money Laundering) Levy. This previously mooted levy, by way of the Finance Act 2022, achieved Royal Assent on 24th February.

What is the Economic Crime (Anti-Money Laundering) Levy?

The Government has stated:

‘The Economic Crime (Anti-Money Laundering) Levy (‘the levy’) is part of the government’s wider objective, outlined in the 2019 Economic Crime Plan (ECP), to develop a long-term Sustainable Resourcing Model (SRM) to tackle economic crime’

The levy aims to raise £100 million a year from the AML regulated community to help fund new and improved AML capabilities. The NCA for example has been struggling to cope with all the reports it receives. Extra funding aims to address such problems.The first levy year is almost upon us, as it will run from April 2022 to March 2023, with relevant levy payments first being collected in April 2023 (i.e., payment in arrears). It will not be collected by all AML supervisors with only the Financial Conduct Authority, HMRC and the Gambling Commission being tasked with these duties. For the legal sector (and Accountants too) the HMRC will collect it. When you next plan your budgets, don’t forget to take into account the fact that as of April 2023, you may well be paying this levy in addition to all of your other overheads:

  • the levy is to be charged on a fixed fee system, based upon your UK revenue
  • it will be paid by medium, large, and very large AML-regulated entities
  • small entities (those with UK revenue below £10.2 million) will fortunately be exempt.

An entity is classified as:

  • medium if its UK revenue for the relevant accounting period is more than £10.2 million but not more than £36 million
  • large if its UK revenue for the relevant accounting period is more than £36 million but not more than £1 billion
  • very large if its UK revenue for the relevant accounting period is more than £1 billion.

The levy is to be charged as follows:

  • medium entities will pay £10,000
  • large entities £36,000
  • very large entities £250,000.

In addition to the levy itself, the Government estimates that it will impact an estimated 4,000 businesses, who will need to self-declare their levy status (i.e., whether they are AML regulated, and their UK revenue during the period of accounts that ended in a said financial year) to their relevant collector or be invoiced by their collector. The relevant collector (HMRC, the FCA or the Gambling Commission) for businesses will be the collector that already regulates/supervises them under AML Regulations, so the majority of firms will have an existing relationship with their collecting body.

The exception is c.450 firms who are regulated/supervised by the Professional Body Supervisors (PBSs), who will need to declare their status and make their levy payment to HMRC.

The government is to issue centralised guidance on gov.uk that sets out the process for paying the levy in due course.

 

Get in touch

To find out more, get in touch with one of our experts today.

 

Economic Crime (Anti-Money Laundering) Levy Read More »