Audit

What does beneficial ownership mean for AML compliance

What does Beneficial Ownership mean for law firm AML compliance?

Anti-Money Laundering, Audit, Blogs, Legal Compliance, Regulatory Compliance, Risk Management /

Whether you’re based in the UK or Australia (where our sister firm AML Sorted is based), are a law firm whose areas of law offer corporate and commercial law, you’re going to need to know what Beneficial Ownership means.

The UK and Australian governments and regulatory bodies are pretty clued up on these risks, which is why they’ve brought in some stringent anti-money laundering (AML) regulations. Understanding beneficial ownership information is a central requirement of those regulations, and it’s critical to your firm’s AML compliance and control structures.

Contents

  • Understanding beneficial ownership
  • Definition of an individual PSC of a UK company
  • Definition of a beneficial owner of an overseas entity
  • Examples of concealing beneficial ownership
  • Don’t rely on the corporate veil — lift it
  • Challenge vague answers
  • Document the risk rationale
  • Verify control, not just ownership
  • Watch for layered structures
  • US Legislation News

Understanding beneficial ownership

When we talk about ‘beneficial ownership,’ it’s all about figuring out who really owns or controls something, whether it’s a property or a company. It’s not just about the names on the official paperwork, ie…. the ‘legal owners.’ For specialists like us at Teal Compliance, and AML Sorted, we’re like detectives, digging deeper and deeper until the ownership and control is truly transparent. In another life instead of solicitors and AML compliance experts we’d be investigative journalists!

In the world of property and conveyancing, as an example, we’ve got to identify and check who’s actually pulling the strings and getting any benefit from a property deal, even if they’re not the ones listed on the deeds. Our job in AML compliance is to support you, the law firms and the MLROs, protect your bottom line and your reputation whilst ensuring financial criminals are held to account.

Identifying beneficial owners is really important when we’re trying to stop money laundering because criminals are sneaky. They often hide their dirty money by owning entities that are set up through complicated setups like shell companies and trusts. It makes it really hard for anyone to trace where the money really came from.

In this blog, when we use the acronym PSC, this means person with significant control.

Definition of an individual PSC of a UK company

In accordance with the Economic Crime and Corporate Transparency Act: beneficial ownership (last updated on 1st March 2024) the definition of an individual PSC of a UK company comes under Schedule 1A, where it states that if an individual (“X”) meets one or more of the following conditions in relation to a company (“Y”), they must be registered as a PSC in respect of Y:

  1. X holds, directly or indirectly, more than 25% of the shares in company Y.
  2. X holds, directly or indirectly, more than 25% of the voting rights in company Y.
  3. X holds the right, directly or indirectly, to appoint or remove a majority of the board of directors of company Y.
  4. X has the right to exercise, or actually exercises, significant influence or control over company Y.
  5. The trustees of a trust or the members of a firm that, under the law by which it is governed, is not a legal person meet any of the other specified conditions in relation to company Y, or would do so if they were individuals, and, X has the right to exercise, or actually exercises, significant influence or control over the activities of that trust or firm.
    1. If you want to dig deeper into LSAG’s definition of a beneficial owner when it comes to the topic of TRUSTS, law firms should verify settlors, beneficiaries, protectors, and the assets the trust holds (not just the trustee). You can read more under LSAG Section 6.14.12.2) or of course, get in touch with us or become an ASK TEAL client.

Definition of a beneficial owner of an overseas entity

Under paragraph 6 of Schedule 2 to the Economic Crime (Transparency and Enforcement) Act 2022, a person (“X”) is a beneficial owner of an overseas entity or other legal entity (“Y”) if one or more of the following conditions are met:

  1. X holds, directly or indirectly, more than 25% of the shares in Y.
  2. X holds, directly or indirectly, more than 25% of the voting rights in Y.
  3. X holds the right, directly or indirectly, to appoint or remove a majority of the board of directors of Y.
  4. X has the right to exercise, or actually exercises, significant influence or control over Y.
  5. The trustees of a trust, or the members of a partnership, unincorporated association or other entity, that is not a legal person under the law by which it is governed meet any of the conditions specified above in relation to Y, and, X has the right to exercise, or actually exercises, significant influence or control over the activities of that trust or entity. Note: please reference 5.a above for more information on LSAG and trusts.

Examples of concealing beneficial ownership

The National Crime Agency’s (NCA) news page is full of crimes and it’s worth having a read to keep you and your compliance officers on their toes. The agency always says to keep a look out for changes in client circumstances. Are the international sanctions’ listings checked on a daily basis? If your client is an art dealer or auction house and your diligence measures flag up questions over their source of funds on their artwork, get them to check these red flags:

 

  • Attempts to transfer artwork or cultural property ownership to a family member, close contact, business associate or other intermediary, or
  • Attempts to sell artwork or cultural property quickly, or move it to another jurisdiction.

Be especially vigilant when dealing with front or shell companies, or intricate corporate or trust structures that obscure the ultimate beneficial owner. While it’s tempting to prioritise well-paying, existing clients, the heightened focus on combating money laundering means your firm faces significant risk if you’re flagged for inadequate AML compliance by the SRA. 

 

Definition of Beneficial Owners: those that might benefit from their ownership of an entity or asset (eg a company.) You will need to identify and undertake reasonable measures to verify the identity of your clients, especially when dealing with high-risk clients or transactions.

Don’t rely on the corporate veil — lift it

Always identify the natural person(s) behind any legal entities. Shell companies and complex structures can hide risk — dig and keep digging, until you find the ultimate beneficial owner (UBO), not just the named shareholders.

If you are concerned about upsetting your client, find ways of carrying out your due diligence and be specific and clear about what you need at the outset.

Why not provide a list to your client with the information you need and if they push back have the back up to explain the purpose.

You should always ask for their details – see below (where applicable) to support and evidence your AML processes and controls. The SRA and your insurer will thank you for this….

  • Shareholder registers
  • Company structure charts
  • Trust deeds 

Challenge vague answers

Here’s an example of what your MLRO might be up against….

Client: “Oh, the company is owned by a few investors.”

Reply with… “To comply with regulations, we need to identify the individuals who ultimately own or control the company. Could you please provide a list of all shareholders with more than 25% ownership, and details about anyone who has significant control over the company’s decisions? We really want to protect your own interests and this information will support this.”

Document the risk rationale

Keep clear notes on why a client is low, medium, or high risk, especially if beneficial ownership is complex. You’ll thank yourself during audits or inspections.

Our own software, the TEAL TRACKER, supports your documentation and evidence in this regard because it includes a high-risk client register, an undertakings register, incident management tracker, file reviews and more. 

Here’s the framework we are aligning ourselves to, and knowing which legislation your tracking and note taking adhere to will help you and your team.

Money Laundering Regulations 2017: These regulations are the cornerstone of AML compliance in the UK and place a legal obligation on firms to identify beneficial owners.   

Economic Crime (Transparency and Enforcement) Act 2022: This Act introduced the Register of Overseas Entities, further emphasizing the importance of beneficial ownership transparency, especially in relation to UK property.

Proceeds of Crime Act 2002 (POCA): This is the legal backbone of the UK’s fight against money laundering and places stringent obligations on law firms to be vigilant, to have strong AML controls, and to report suspicious activity. 

Companies Act 2006 (in particular Schedule 1A): In this act, it defines “People with Significant Control” (PSCs) for UK companies, which is closely related to the concept of beneficial ownership. 

Verify control, not just ownership

Control can be exercised in various ways, and it’s important to look beyond just shared ownership.

A person can be an ultimate beneficial owner (UBO) if they exercise significant control, even if their shareholding is below 25%, for example when your client is an LLP. Check for influence via voting rights, directorships, or veto powers.

Red flags to be on high alert for include:

Nominee Directors or Shareholders: The use of nominees to hold shares or directorships.

Lack of Transparency: Reluctance to provide information or vague answers about ownership and control.   

Inconsistent Information: Discrepancies between information provided by the client and information from other sources.

Why not do your research and look into their confirmation statements, do they have information on control of beneficial ownership on their websites, or are Board Minutes available to you?

Check on the Registers for Beneficial Owners website, and run a check on the background and relationships of the company’s directors and senior management.

Watch for layered structures

Multiple holding companies across jurisdictions may indicate masking of the truth! You’d want to understand the chain until you reach a human being. We appreciate that layered ownership structures can feel like untangling a particularly tricky ball of wool, but the key is to break it down step by step—each layer tells part of the story.

What would you do in the following scenarios?

  • Multiple Layers of Ownership where ownership is divided across several entities, often spanning different jurisdictions (e.g. Company A owns Company B, which owns Company C, and so on).
  • Use of Shell Companies, which are entities that exist only on paper, with no significant business activities, often used to add layers of ownership without transparency.
  • Circular Ownership, which occurs when entities within the structure own shares in each other, creating a loop that obscures the ultimate beneficial owner (UBO).
  • Offshore Jurisdictions are entities registered in jurisdictions with high levels of secrecy and minimal disclosure requirements are often included to complicate tracking.
  • Nominee Directors or Shareholders (as mentioned above), can be individuals or entities who are listed as directors or shareholders but act on behalf of the true owners without having actual control or interest.
  • Frequent Changes – watch out for regular changes in ownership, directors, or shareholders because these can make it harder to establish a clear picture of control.
  • Trusts and Foundations are legal arrangements that can be used to conceal the identity of the true owners by placing assets under the control of trustees or foundations.

The above structures are often red flags for money laundering, tax evasion, or other illicit activities. In these circumstances, your enhanced due diligence (EDD) measures, such as verifying the identities of beneficial owners and understanding the ownership structure, are crucial to back you and your practice up.

US Legislation News For Information

It’s worth noting that the US has also stepped up its efforts in corporate transparency, introducing new provisions that came into effect on 1st January 2024.  These rules now require certain corporate entities in the States to report information about their beneficial owners.

Much like the corporate transparency legislation we’ve seen introduced in other parts of the world, including our own measures here in the UK, the overarching goal is to make it tougher for those with illicit intentions to conceal their activities behind shell companies or other murky ownership structures. The hope is that this increased transparency around who really owns and controls these entities will be a significant weapon in the ongoing fight against money laundering and the financing of terrorism.

To wrap this article up, the one thing I urge you to remember, is that it’s up to you to take reasonable measures to verify the identity of the beneficial owner.

 

LS beneficial ownership definition

For more information on the Register of Overseas Entities, you can click here to read more. The ROE came into force in the UK on 1 August 2022 through the new Economic Crime (Transparency and Enforcement) Act 2022.

Thanks for reading and if you have any specific questions on this subject or would like to take advantage of our ASK TEAL service, you can get in touch HERE.

 

Tom Hughes

Senior Associate

OUTSOURCED COMPLIANCE & REGULATORY SUPPORT
Teal Compliance EVENTS
Teal Compliance Audit
Subscribe to our ASK TEAL service here

What does Beneficial Ownership mean for law firm AML compliance? Read More »

SARs - understanding suspicious activity with key insights and reporting tips from Teal Compliance and Amy Bell

SARs – Understanding Suspicious Activity: Key Insights and Reporting Tips

Anti-Money Laundering, Audit, Blogs, Legal Compliance, Regulatory Compliance, Risk Management /

Teal Compliance explains the signs of suspicious activity in law firm compliance and risk management.

Before I kick off this blog, I’m going to remind you (or explain to you if you are new to the role of an MLRO or COLP) what suspicious activity actually means when it comes to law firm compliance and risk management.

In the context of anti-money laundering (AML) compliance, “suspicious activity” refers to behaviour, transactions, or patterns of conduct that give rise to a suspicion that money laundering or other criminal activity might be taking place. 

Persons working in the regulated sector are required under part 7 of the Proceeds of Crime Act 2002 (POCA) and the Terrorism Act 2000, taking into account relevant guidance provided by your regulator, for example the SRA and the Law Society of England and Wales.

If you hold a client account, carry out work in trust and company formation, or offer conveyancing as a legal service, you are more likely to be targeted by financial criminals. Our ASK TEAL service is extremely helpful and supportive for defining suspicious activity, understanding reasonable grounds, inappropriate use, responsibilities of the MLRO / MLCO (depending on size of firm), and the process around reporting economic crime.

To get an idea of the amount of reports submitted, the UK Financial Intelligence Unit (UKFIU) receives over 460,000 SARs per year and stores them in a secure central database.

Before I crack on with more guidance and examples of suspicious activity, here’s a reminder of acronym meanings:

  • SOW – source of wealth
  • SOF – source of funds
  • SAR – suspicious activity report
  • MLRO – money laundering reporting officer
  • MLCO – money laundering compliance officer
  • AML – anti-money laundering
  • CDD – customer due diligence
  • DAML – defence against money laundering

This blog is predominantly for the legal profession and we’re kicking it off with Section 12 of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (Regulations), Section 12 definition.

AML Guide: Independent legal professionals/trust/company service providers

So, when we’re talking about ‘independent legal professionals’ in these regulations, what we’re really referring to is a firm or a solo lawyer, you know, someone who’s running their own show, providing legal or notarial services to other people. But, and this is important, it’s specifically when they’re involved in financial or property deals.

 

Think things like:

  • the buying and selling of real estate and property or business entities;
  • Management of client money, securities or assets;
  • the opening or management of bank, savings or securities accounts;
  • anything to do with setting up, running, or managing a company, when money’s involved; or
  • the creation, operation or management of trusts, companies, foundations or similar structures.

When you ever read someone that ‘participates’ in a transaction for these rules, what we’re talking about is if they’re helping out with the planning or actually making the transaction happen. Essentially, if they’re acting for the client in some way during the whole thing. It’s about being involved, not just watching from the sidelines.

And then, when we get to ‘trust or company service provider’ that’s a firm who’s running a business and offering these specific services to clients. Now, the key here is, it’s only when we’re actually providing these services that we fall under that definition. So, basically, if I’m providing these services:

  • forming a firm (The SRA’s definition – forming any entity that, whether or not a legal person, is not an individual and includes a body corporate and a partnership or other unincorporated association)
  • acting, or arranging for another person to act
    • as a director or secretary of a company
    • as a partner of a partnership; or
    • in a similar capacity in relation to other legal persons;
  • providing a registered office, business address, correspondence or administrative address or other related services for a company, partnership or any other legal person or legal arrangement; 
  • acting, or arranging for another person to act,
    • as a trustee of an express trust or similar legal arrangement;
    • or a nominee shareholder for a person other than a company whose securities are listed on a regulated market.

Here’s Section 12’s specifics from source READ HERE.

What is the Definition of Suspicious Activity?

So, what exactly counts as ‘suspicion’ in our line of work? 

Well, it’s a lower hurdle than you might think. In the case of R v Da Silva the present standard is set. Lord Justice Longmore said,

“So, probably, ‘knowing’ will not arise and what will arise instead is ‘suspecting’, which is a very different state of mind to knowing. To suspect something, you have a state of mind that is well short of knowing that the matter that you suspect is true. It is an ordinary English word. Members of the jury, if the Crown can show that the defendant said to herself, ‘I suspect that this money is the proceeds of criminal conduct, but it may be, on the other hand, that it is not’, that would fall within the definition of ‘suspicion’. The dictionary definition, which I direct you is relevant to the meaning of the word, is this. The dictionary definition of ‘suspicion’: ‘an act of suspecting, the imagining of something without evidence or on slender evidence, inkling, mistrust’. Therefore, any inkling or fleeting thought that the money being paid into her account 9950 might be the proceeds of criminal conduct will suffice for the offence against her to be proved.”

Essentially, if there’s a possibility, beyond just a far-fetched one, that something’s amiss, you’ve got a reportable suspicion. Of course, a simple ‘gut feeling’ isn’t enough, but if you’re thinking ‘there’s a chance this isn’t right,’ it’s time to take action.

I’m often asked about examples and how far back in the SOF you should be looking at suspicious activity work or actions. The answer is…it depends…because no two clients are the same and no two matters are the same. I’d start by some training on this to begin with, and thereafter have a clear protocol in your policies for firmwide use and follow with proactive controls. Better safe than sorry right?

Suspicious activity may include:

Unusual or inexplicable transactions: Let’s say you’re a conveyancer and your client has passed on admin and payments to a proxy third party. Why? Maybe the purchase price is much higher than current market value. Is your retainer set out £1,000 but they are insistent they’d like to be retained at £10,000? There are a variety of red flags to watch out for here.

Inconsistent behaviour: We would urge you to be on high alert for inconsistent purchaser behaviour in conveyancing or commercial entities. Are they changing key details, are they hard to get hold of, putting off replying to urgent requests? Time to investigate them further!

Deceptive and secretive clients: Got a client that seems evasive? Is the client avoiding questions? Is the client providing incomplete or false information? Why did the client choose your firm?

Exploitation of professional services: You will have been hiding under a rock if you don’t realise that financial criminals target us in the legal services to hide the origins of their illicit funds, i.e. dirty cash. Remember this case of a well paying and long standing corporate client who manipulated their instructing firm and chugged £4.1m through the client account for use of a banking account? The firm was fined £36k by the SRA. Legal Futures article can be read HERE.

A suspicion does not require certainty or concrete proof of money laundering. Instead, it arises when, based on the available information you have, a reasonable person concludes that there is something unusual warranting further investigation.

You’ll no doubt have read the latest cases for firms being fined for breaching AML conditions, like the firm where two partners were fined £50k for offering a banking facility to their wealthy client. In 2023 – 2024 alone, the SRA “submitted 23 SARs, performed 237 proactive inspections, and 258 desk-based reviews, and brought enforcement action against a combined total of 78 firms and individuals.”

This is Teal’s original blog, which has more information to delve into: “AML Definition of Suspicion”

Please note that failure to file a SAR after suspicion is raised is an offence under UK law. You can read the full Law Society guidance HERE.

Key Indicators of Suspicious Activity

The following are some classic examples of what to look out for in terms of red flags.

Unusual Transactions

  • Large, unexpected deposits with no clear explanation.
  • Multiple small transactions that together exceed a threshold.
  • Use of complex legal structures (e.g., trusts, offshore companies) without clear rationale.

Client Behaviour

  • Reluctance to provide identification or supporting documentation.
  • Insistence on confidentiality without clear reason.
  • Clients seeking to use cash for large transactions.

High-Risk Jurisdictions

  • Funds originating from or being sent to high-risk jurisdictions (e.g., countries known for corruption or weak AML controls) 
  • Keep your “Black and grey” lists pinned to your desktop for continued updates.

Conveyancing and Real Estate

  • Over or under valuation of property compared to market norms.
  • Use of funds from unverified sources, particularly cash deposits.

Obligations for Law Firms

Under the AML regime, solicitors and law firms must:

  1. Conduct Customer Due Diligence (CDD): Verify the client’s identity and the source of funds.
  2. Monitor Transactions: Look for unusual patterns or behaviours.
  3. Report Suspicious Activity: File a Suspicious Activity Report (SAR) to the UK Financial Intelligence Unit (FIU) within the National Crime Agency (NCA) if suspicious activity is identified.

Scenarios of Suspicious Activity

Here are some examples that will give you some insights into what and how organised crime can work:

Scenario 1: High-Value Cash Deposit for a Property

A solicitor is instructed by a new client to assist in purchasing a property worth £1.5 million. The client insists on paying £1 million in cash and provides vague explanations for the source of funds. Despite requests for supporting documentation, the client refuses to provide details.

Red Flags: Large cash payment, lack of source-of-funds evidence, and unwillingness to cooperate.

Action: The solicitor would usually file an internal suspicious activity report to their MLRO and then it is the responsibility of the MLRO to decide whether a SAR needs to be made to the NCA.

Scenario 2: Use of Offshore Companies

A client establishes an offshore company and instructs a solicitor to assist with purchasing several properties. The company is registered in a jurisdiction with weak AML controls, and the client is vague about the ultimate beneficial owner (UBO).

Red Flags: Complex structures without legitimate purpose, high-risk jurisdiction, and lack of transparency regarding UBOs.

Action: The solicitor must conduct enhanced due diligence (EDD), request documentation to identify the UBO, and must speak to their MLRO, and then file a SAR if suspicions persist.

Scenario 3: Unusually Structured Payments

Corporate client instructs a law firm to hold funds in a client account as part of a commercial transaction. The funds are received in multiple instalments from unrelated third parties, and the client can’t provide a satisfactory explanation.

Red Flags: Multiple third-party payments, no legitimate business explanation.

Action: Conduct CDD on all parties involved, report to their MLRO, and refuse to proceed if concerns remain, and consider filing a SAR.

Scenario 4: Evasive Client Behaviour

A client seeks advice on setting up a trust but is reluctant to disclose the purpose or the source of the funds. The client requests frequent meetings but provides contradictory information about their income and assets.

Red Flags: Lack of transparency, contradictory information, and attempts to obscure the trust’s purpose.

Action: Ask further questions, verify the information provided, and if suspicions persist, file a SAR.

 

ALWAYS report suspicious activity to your MLRO come what may.

What triggers a suspicious activity report (SAR) in the UK?

Here’s the deal. There are these laws we have to follow, right? Part 7 of the Proceeds of Crime Act (POCA) and the Terrorism Act. Basically, if you’re working in a regulated field – and that’s us – you have to file a Suspicious Activity Report if you have a sniff that someone’s trying to launder money, evade tax or fund terrorism.

If you, as a law firm, suspects that a client’s SOW or SOF is suspicious, you have to:

  • Conduct further inquiries to clarify the situation.
  • Document all findings and decisions.
  • Consider whether to file a Suspicious Activity Report (SAR).

Reporting Suspicious Activity (SAR)

The above triggers would mean then that you, as an MLRO, or compliance officer, overseeing compliance in your firm should report suspicions straight away to the NCA and SRA (if regulated by the SRA) as follows.

National Crime Agency (NCA):

Yes, as a law firm, you are legally required to report suspicious activity to the NCA via a SAR. The NCA has made this easy to do, as they have a secure SAR portal that you can submit a Suspicious Activity Report.

It shouldn’t surprise you that the SAR portal is SECURE.

NCA SAR portal flow chart

Solicitors Regulation Authority (SRA):

While a legal practice has to primarily report suspicious activity to the NCA, it also has obligations to the SRA. Doesn’t everything?!

If the suspicious activity involves a breach of SRA rules or raises concerns about the firm’s compliance, they must report this to the SRA.   

Aligning to the SRA’s guidance, you’ve got to report all serious breaches of the money laundering regulations to them. Schedule 4 (12) of the regulations state that supervisors have to collect all information regarding the number of contraventions of these Regulations committed by supervised persons.

A reminder of what constitutes as a Serious Beach

  • serious or persistent compliance failures involving safeguards designed to prevent money laundering
  • clear risks of money-laundering activity taking place, or
  • where there has been potential loss or harm to businesses or individuals.

ASK TEAL is the perfect support solution and service for you, where our compliance consultants and associates are on hand to guide you through your query. Please find out more HERE.

The SRA has its ETHICS HELPLINE to help if unsure: 0370 606 2577 

Amy's Reminders and Key Takeaways

Further to the Law Society Risk & Compliance Conference 2025, there is a clear requirement for law firms to conduct better and more robust AML protocols. Don’t rely on a template and not tailor it to your clients and areas of work. 

Always conduct thorough CDD and escalate to EDD where necessary.

Please be vigilant about client behaviour, source of funds, and high-risk jurisdictions.

Report suspicions promptly through a SAR, even if it means delaying or refusing a transaction. It’s just not worth the risk.

If there’s one thing I’ve learned in my years working with law and AML, it’s this: meticulous record-keeping is your ultimate defence when demonstrating compliance.

TEAL TRACKER

Suspicious Activity Resources Reminder

When we draft Firm Wide Risk Assessments for clients we also refer to the 2023 amendments which you can read HERE. This amendment was made so that domestic PEPs are treated as lower risk than overseas PEPs, although to be clear, EDD does need to be applied in both instances.

Thanks for reading, and please get in touch with any questions, you know I’m always happy to help.

Amy (with a big dollop of help from Rhiannon!)

OUTSOURCED COMPLIANCE & REGULATORY SUPPORT
Teal Compliance Audit
Subscribe to our ASK TEAL service here

SARs – Understanding Suspicious Activity: Key Insights and Reporting Tips Read More »

Two anonymous people discussing paperwork at a desk

New SRA Notice Warns Against Funds Missing From Client Account

Audit, Legal Compliance, Regulatory Compliance /

The SRA has published its new Warning Notice (21 June) warns against funds missing from a firm’s client account. The SRA has made it clear shortages will not be tolerated.

Whilst the SRA hasn’t reported any sanctions decisions relating to this issue in particular recently, the warning notice outlines the risks of firms failing to quickly address a shortage.

Firms will note the relatively recent closure of Axiom Ince last year, where the SRA reported the largest shortage in client account funds of £64m.

SRA's Warnings

The SRA’s warnings are as follows:

  • Firms have an obligation to replace immediately any money missing from a client account
  • Replacement of funds is to be carried out regardless of the underlying reasons – even where there’s been circumstances beyond the firm’s control for example by way of a cyber-attack, or administrative errors or, dishonest acts by employees
  • There’s a clear duty in the accounts rules to replace a deficiency, and managers of a firm are jointly responsible for doing so
  • Firms that continue to transact with a shortfall on their client account risk using other clients’ funds to facilitate those transactions

Employee Behaviour

The SRA provides indicators when identifying behaviour amongst employees that may indicate a problem. This includes failure to deliver bills or a written notification of costs, any suggestion of over-charging, and a sweeping up of residual balances.

Steps To Take

Paul Philip, chief executive at the SRA has said: “Caselaw is very clear that the client account is sacrosanct. However, firms do report shortages on the client account for a variety of reasons. Our rules are also very clear – you must make good on any deficit promptly. A shortage on the client account presents a risk to all clients for whom you hold money.”

  • Managers are advised to immediately investigate and take action against any member of staff who may have acted dishonestly regarding the client account, and to take regular steps to monitor, review and manage risks
  • If you identify that money is missing, you have a duty to take steps to ensure it’s replaced, in full, immediately
  • If you’re a manager of the firm, you have a duty to replace missing client money from your own resources. It may be necessary for you to obtain a loan to do this. It’s irrelevant that fault may not lie with you personally
  • You need to notify your insurer. You may be able to make a claim on your professional indemnity insurance. The obligation to remedy a breach of the SRA Accounts Rules 2011 is treated as civil liability for the purposes of clause 1 of the Minimum Terms and Conditions
  • If you identify a shortage, you should report the matter to the SRA in line with your obligations under paragraph 7.7 of the Code of Conduct for Solicitors, RELs and RFLs and paragraph 3.9 of the Code of Conduct for Firms

Enforcement Action

On enforcement action, the SRA warns that failing to replace client money will usually lead to an intervention. Even if money has been replaced, it may be that an intervention is necessary to deal with what caused the problem, such as dishonesty, in order to protect the clients and the public.

Firm Closures

The SRA has also addressed the issue in the context of firms heading for closure, given this can’t happen if there are client balances remaining in a firm’s account.

The SRA has advised any firms seeking to close that they should send all client money to clients, pay counsel fees and bill for outstanding costs.

The notice adds: “If your client account has a shortage, you cannot undertake any of these actions and therefore you cannot close your firm until the shortage is replaced.”

Get in touch

At Teal, we’re here to support your journey towards compliance that works.

We understand that compliance can be a daunting word, but it’s also the key to unlocking your firm’s full potential.

Our experts at Teal Compliance are here to help. Get in touch today to explore tailored solutions and ensure your firm stays ahead of regulatory requirements.

Get in touch

New SRA Notice Warns Against Funds Missing From Client Account Read More »

Teal Compliance Legal Compliance Audit

Is your law firm’s website compliant with the SRA Price Transparency Rules?

Audit, Legal Compliance, Regulatory Compliance /

If you’re involved in managing compliance at a UK law firm, you’re probably no stranger to the SRA Price Transparency Rules. But just how compliant is your website? In this blog post, we dive into what you need to know and how you can ensure your firm meets the requirements.

Understanding the SRA Price Transparency Rules

The SRA Transparency Rules, which came into force in December 2018, marked a significant shift in how law firms should communicate pricing and service details to their clients. Instructed by the Solicitors Regulation Authority (SRA), these rules aim to improve transparency within the legal sector enabling clients to make informed decisions about their legal matters.

Covering a range of practice areas, law firms must disclose price and service information in a clear and accessible manner.  These areas include:

  • Residential conveyancing
  • Probate (uncontested)
  • Motoring offences (summary offences)
  • Immigration (excluding asylum)
  • Employment tribunals (unfair/ wrongful dismissal)
  • Debt recovery (up to £100,000)
  • Licensing applications (business premises)

Also, it’s crucial to note that even if your firm doesn’t have an online presence through a website, you’re still required to provide this information upon request in alternative formats. This ensures that regardless of the means of communication, clients have access to transparent pricing information.

What the SRA Price Transparency Rules entail

The SRA Price Transparency Rules include a multifaceted approach to transparency and accountability within the legal sector. Beyond the disclosure of pricing and service information, firms have to adhere to additional requirements to enhance clarity and trust. Alongside publishing price and service details, firms must prominently display the SRA’s digital logo on their website, serving as a visual indicator of compliance. This badge reassures clients that the firm operates within regulatory guidelines, instilling confidence in the transparency of legal fees and services offered.

Additionally, the Rules also require firms to publish details of their complaints procedure on their website. This includes comprehensive information on how and when a complaint can be lodged, both to the Legal Ombudsman and directly to the SRA. By offering clear guidance on the complaints process, firms prove a commitment to accountability and client satisfaction.

Teal’s new compliance culture services partnership

As well as ensuring such a damaging and toxic environment doesn’t exist, how can we further test and measure the true culture we have in our workplace?  

At Teal we have always believed culture to be the bedrock of sound firm management and compliance. That’s why it’s the biggest, first, and most vital cog in our six Cs of compliance. Without a good culture, the others ‘Cs’ simply won’t work. It’s the foundation from which thriving firms are possible.

That’s why Teal is delighted to be launching its partnership with Gemma Ellison and the team at Heart Leadership.

Gemma said “I started Heart Leadership after spending 15 years in legal practice and so it is a profession I understand and deeply care about. I am committed to helping organisations create healthy and inspiring working environments, which I know, in turn, leads to enhanced wellbeing and higher performing teams. Often, as we move through the ranks of our industry, we are rarely told to fully consider culture and the fundamental impact it has on the working environment of our people. I want to help change that.” 

Insights from the Year Three Evaluation

The Year Three Evaluation of the SRA Transparency Rules shed light on the full adoption of the rules. While progress has been made, there are still significant challenges that law firms must address to meet the requirements effectively.

The compliance landscape

According to the evaluation, a majority of firms reported compliance with various aspects of the transparency rules:

  • 75% claimed to provide price and service information
  • 88% displayed the SRA clickable logo
  • 88% published complaints procedures
  • 76% detailed how to complain to the SRA/ Legal Ombudsman

However, when it comes to price and service information specifically, only 42% of firms stated they published all required details. This highlights a significant gap in compliance, with more than half of firms falling short in this crucial area alone.

The reality of compliance

In 2021, the SRA took proactive steps by requiring all law firms with websites to complete a mandatory declaration confirming compliance with the transparency rules. Despite these declarations, spot checks conducted by the SRA revealed a different reality.

Common areas of non-compliance identified during spot checks include:

  • Partial compliance with certain aspects of the rules, such as publishing price and service information while omitting complaint information
  • Selective compliance with rules for specific service areas, particularly among firms with multiple websites or sections dedicated to different areas of law
  • Incomplete publication of information regarding how services will be delivered and by whom
  • Improper display of the SRA clickable logo, hindering the dynamic link to firm information on the SRA website

Ensuring compliance

Ensuring compliance with SRA Price Transparency Rules is essential for law firms to maintain trust and transparency with their clients, as well as meet their regulatory requirements.

So, how can your law firm ensure compliance with the transparency rules?

1. Review your website regularly

Regularly review your website to ensure all required information is up-to-date, accurate, and easily accessible to visitors. Keeping a vigilant eye on your online presence ensures that potential clients can find the information they need without any hassle.

2. Utilise SRA templates

Take advantage of the SRA’s provided templates for suggested text. These templates can be invaluable in identifying any missing information on your website, helping you align with the requirements of the Transparency Rules more effectively.

3. Consider user experience

Prioritise the user experience on your website to ensure that clients can easily navigate and find the necessary information. Whether through specific webpages, intuitive online quote tools, or seamless connections to price comparison sites, prioritising accessibility enhances client satisfaction.  

4. Get expert help

If you’re unsure about compliance or need assistance, Teal Compliance offers website audit services. We can provide guidance and help you navigate any non-compliance issues, ensuring your firm remains aligned with regulatory standards.

Moving forward

The findings highlight the importance of ongoing vigilance and proactive measures to achieve full compliance with the SRA Transparency Rules. Law firms must not only ensure that they are meeting the minimum requirements but also strive for transparency and clarity across all aspects of their online presence.

As regulatory scrutiny intensifies and expectations evolve, firms need to review their compliance strategies, address identified gaps, and embrace best practices to uphold the principles of transparency and accountability.

Get in touch

At Teal, we’re here to support your journey towards compliance that works.

We understand that compliance can be a daunting word, but it’s also the key to unlocking your firm’s full potential.

Our experts at Teal Compliance are here to help. Get in touch today to explore tailored solutions and ensure your firm stays ahead of regulatory requirements.

Get in touch

Is your law firm’s website compliant with the SRA Price Transparency Rules? Read More »

Laptop with the Teal Tracker's Root Cause Analysis Process on screen

The Teal Tracker’s New Feature: Root Cause Analysis Process

Audit, Blogs, Legal Compliance, Risk Management /

The Teal ‘Root Cause Analysis Process’, or ‘RCAP’, is a new, groundbreaking feature of the Teal Tracker. Here we explain what it does, how it works and how it can benefit you. 

What does the Root Cause Analysis Process do?

The Root Cause Analysis Process forms part of the Incident Management module in the Teal Tracker, and is a yet another example of how law firms can use their compliance data to help reduce the future risk of claims, complaints and breaches.

At its core, it assists in identifying trends and reducing incidents through identification, analysis and learning, which will in turn protect clients, the firm and the team.

How does the Root Cause Analysis Process work, and how is AI involved?

The RCAP feature uses AI to assist firms in identifying root causes of issues or near misses. It forms part of the Teal Tracker’s Incident Management module, whereby firms can analyse incidents to drill down to root cause.

As with all our new features in the Teal Tracker, we’ve extensively asked our law firm partners how they would best like to see this work in practice, so its design is simple and intuitive.

Teal Tracker subscribers are invited to carry out a Root Cause Analysis Process using the ‘five whys’ methodology principle, which is a standard engineering concept developed way back in the 1950’s for Toyota’s production line. It is, at its core, really simple. The principle is that if you ask ‘why’ something went wrong five times, you’ll likely drill down to arrive at the core answer.

But the Teal RCAP combines this tried and tested practice with AI to generate the next response to each of the ‘five whys’ questions and to confirm the root causes and their weightings. This smartly assists users in drilling to the key root cause or causes, and skillfully assists law firms in getting to the true root cause and the granular detail of issues.

This is then automatically exported to the Teal Tracker’s management reports functionality. In turn, this allows trend analysis to be systematically identified in detail, and reflected back to the firm to ensure they can both learn and improve in the key areas they really need to focus on.

Why has Teal integrated AI into the Root Cause Analysis Process?

Teal has integrated generative AI into the solution so that AI can smartly create the next drill down question to ultimately display what has actually happened and its cause. This means users have smart options to drill down into the issues and figure out what precisely occurred and what contributed to each particular problem.

It will give the firm much more useful and intelligent data on which to make decisions or to deploy resource. This will assist in better use of budgets for training or capacity as well as ultimately reducing the number of claims, complaints and breaches that occur.

How is the Root Cause Analysis Process working in practice?

Teal has been trialling the solution in full, in live environments for some time and it’s working extremely well. That’s why we’re now proud to be able to roll-out this groundbreaking feature to all our Teal Tracker law firm partners. 

Want to know more about the Teal Tracker?

At Teal, we’re here to support your journey towards compliance that works. Our compliance technology platform, Teal Tracker, is the solution to your compliance issues, ensuring you, your firm and your clients are safe. 

To find out more about the Teal Tracker, or to book a demo, contact our team today!

Get in touch

The Teal Tracker’s New Feature: Root Cause Analysis Process Read More »

Business women at desk meeting with laptop and notepad

Legal compliance issues: Embracing legal compliance for success

Audit, Blogs, Legal Compliance /

In the world of law firms, the mere mention of the “C” word tends to send shivers down the spines of many. Partners and owners alike sometimes choose to bury their heads in the sand, hoping that legal compliance issues will resolve themselves. However, the landscape is changing rapidly, and firms are evolving their approaches to business support. The old misconceptions of ‘fee burners’ and ‘fee earners’ are giving way to a proactive stance, where compliance isn’t just a requirement but a fundamental aspect of a firm’s culture. 

We believe that investing in business support is the compass that points your firm in the right direction. In this blog post, we’ll delve into why legal compliance is the cornerstone of your firm’s success. It’s not just about collecting a plethora of accreditations, although staying within the guidelines of these accreditations certainly minimises your risk exposure. 

Asking the right questions and breaking down silos

Are you asking the right questions to stay informed about your firm’s day-to-day activities? Are all departments collaborating to review risk registers and ensure everyone’s on the same page? Avoid the smoke and mirrors approach, which only masks underlying legal compliance issues. Instead, let’s shine a light on the importance of communication. 

Engaging with your employees is key to success. Often, during performance reviews, employees express a lack of communication. It’s not about inundating your team with every minor detail; it’s about involving them in achieving the firm’s objectives. Without effective communication, there’s room for important matters to slip through the cracks. 

Consider a compliance project. How many different team members are involved, and is there a streamlined approach to ensure continuity and prevent duplicate tasks? A joined-up approach is crucial. 

Ground-level knowledge: Your shield against regulatory pitfalls

Ground-level knowledge is your shield against regulatory pitfalls. To truly understand its importance, think of it as a solid foundation based on understanding, vigilance, and adaptability. In this section, we’ll explore why this knowledge is crucial for the well-being and prosperity of your law firm. 

1. A foundation of understanding 

Understanding begins with actively listening to what’s happening within your firm. It means having a finger on the pulse of daily operations, being aware of the challenges your employees encounter, and comprehending the intricacies of your clients’ needs. This understanding extends to the beliefs and values that underpin your firm’s culture, ensuring everyone is aligned with the same vision.  

2. The cost of ignorance 

When it comes to legal compliance issues, ignorance is not a valid defence. Regulators expect firms to be well-versed in the regulations governing their sector, and they won’t accept ignorance as an excuse for non-compliance.  

Ignorance can lead to dire consequences, including hefty fines, damage to your firm’s reputation, and even legal repercussions. In the eyes of the law, not knowing isn’t an excuse. Ground-level knowledge is your safeguard against such risks, as it empowers you to stay informed and take proactive measures to address potential legal compliance issues.  

3. The power of continuous review and analysis

Ground-level knowledge isn’t a static state but an ongoing process. It involves continuously reviewing your firm’s processes and critically analysing essential data. 

Regular process reviews enable you to identify bottlenecks, inefficiencies, or areas where compliance may be at risk. It’s similar to fixing weaknesses to make sure they can handle the challenges of time and close inspection. Additionally, the analysis of critical data allows you to spot emerging trends and potential compliance challenges before they escalate into formidable problems.   

Conducting a full 360 review of your business

The process of conducting a full 360 degree review of your law firm isn’t just a routine task; it’s a transformative journey that aligns your firm with the ever-evolving regulatory landscape. Visualise it as the compass that directs your firm towards its full potential in legal compliance. In this section, we’ll delve into why this comprehensive examination of your business is vital for your law firm’s success, particularly in the context of legal compliance, and how it can lead to meaningful change.

1. Celebrating achievements and strengths

Every law firm possesses unique achievements and strengths, often concealed in plain sight. Taking the time to recognise and celebrate these successes isn’t just about acknowledging your accomplishments in legal compliance; it’s about honouring what’s working exceptionally well within your compliance framework. These are the foundations upon which you can build a robust legal compliance structure for the future.  

2. Embracing a culture of self-scrutiny 

Genuine growth often necessitates introspection. It involves the willingness to roll up your sleeves and delve deep into the areas of legal compliance that require improvement. Just as a sculptor chisels away at a block of marble to reveal a masterpiece, your firm must be prepared to examine the rough edges within your compliance procedures.  

Scrutinising areas that need improvement isn’t a sign of weakness; it’s a testament to your dedication to legal compliance. It’s about identifying bottlenecks, inefficiencies, or outdated practices that may pose legal compliance issues. This process demands honesty and the willingness to address shortcomings proactively.  

3. Implementing systematic change

The true power lies in translating your observations and insights into systematic changes that enhance legal compliance. Instead of just pinpointing issues, you develop actionable solutions that bolster your compliance efforts. These changes may include streamlining compliance processes, investing in training and development for your compliance team, or adopting new technologies to bolster compliance tracking and reporting.  

This proactive approach creates an environment where your team can excel in legal compliance, your clients receive a top-notch service, and your firm operates with the utmost legal compliance diligence.  

Revisiting key performance indicators (KPIs)

Key Performance Indicators, or KPIs, are not confined solely to your fee earners. They’re a potent tool that can revolutionise your firm’s approach to maintaining compliance standards. In this section, we’ll explore why KPIs are indispensable, how they extend beyond the fee earners, and why regular reviews are essential to ensure they align with your legal compliance objectives. 

1. Expanding the scope of KPIs in legal compliance

While fee earners often take the spotlight, KPIs have a more profound role to play in the broader context of legal compliance. They should encompass every facet of your firm’s operations, from risk management to client service and regulatory adherence. By embracing a holistic perspective, you can foster a culture of compliance that permeates every department. 

KPIs that focus on legal compliance go beyond mere metrics; they become a compass guiding your firm towards a safer, more compliant working environment. They encourage proactive behaviours and decision-making that prioritises adherence to regulations, mitigating risks, and ensuring ethical conduct. 

2. The imperative of regular KPI reviews for legal compliance

KPIs are not static; they should evolve to reflect changing compliance requirements and your firm’s objectives. Regular reviews are the lifeblood of effective KPI implementation in legal compliance. 

During these reviews, you assess whether the KPIs are still relevant, achievable, and aligned with your evolving legal compliance goals. They provide the opportunity to recalibrate your firm’s course, ensuring that you continue to navigate the legal compliance landscape with precision. 

Independent file audits: Elevating legal compliance through insightful evaluation

Consider conducting independent file audits. They can unveil trends that highlight training issues or identify individuals with untapped potential. Striking a balance between micro-management and providing adequate supervision is essential for responsible leadership. 

Conducting independent file audits is a strategic manoeuvre that transcends routine checks; it’s an opportunity to gain unparalleled insights and elevate your firm’s commitment to legal compliance. In this section, we’ll explore why independent file audits are a linchpin in the quest for legal compliance excellence, how they unearth invaluable trends, and their pivotal role in honing the skills of your team.   

1. The power of independent file audits in legal compliance

Independent file audits are not mere paperwork exercises; they’re powerful tools for enhancing legal compliance. These audits provide an unbiased lens through which you can scrutinise your firm’s practices, ensuring they align with regulatory requirements and best practices. Beyond the checkboxes, they offer a holistic view of your firm’s performance in legal compliance. 

One of the key advantages of independent file audits is their ability to spot trends. These audits can unearth patterns that might otherwise remain hidden. For example, they can highlight recurring legal compliance issues or training gaps within your team. By identifying these trends early, you can proactively address them, fortifying your legal compliance framework. 

2. Enhancing training and identifying potential

The insights gained from independent file audits extend beyond compliance issues. They can also help identify individuals within your team who possess untapped potential. By recognising standout performance, you can nurture future leaders or identify team members ready for greater responsibilities. This not only benefits your firm’s growth but also bolsters its commitment to legal compliance, by having capable leaders. 

3. Striking the balance in legal compliance leadership

Achieving legal compliance excellence requires a delicate balance between oversight and empowerment. Micro-management stifles initiative, while inadequate supervision can lead to lapses in compliance. Independent file audits help strike this balance. They provide a mechanism for oversight without suffocating your team’s autonomy. 

Every role matters: A unified framework

In compliance, the significance of every role within your firm can’t be overstated. It’s not just the lawyers or compliance officers; it’s every individual, from support staff to partners. Embracing a unified framework is the cornerstone of fostering compliance excellence. In this section, we’ll emphasise the importance of this cohesion where everyone comprehends their responsibilities, and how it results in tangible benefits for your firm. 

1. The power of a unified framework in legal compliance

Legal compliance isn’t a responsibility that falls solely on the shoulders of a select few; it’s a collective effort. Encouraging your entire team to work within an established framework ensures that legal compliance becomes an integral part of your firm’s DNA. This framework provides clarity, defining roles, expectations, and the processes that ensure adherence to regulatory requirements. 

2. Benefits of cohesion in legal compliance

When every team member understands their role within the legal compliance framework, several benefits emerge. First, it minimises the risk of compliance gaps or oversights. Second, it fosters a culture of accountability, where everyone takes ownership of their compliance-related duties. Third, it streamlines communication and collaboration, facilitating smoother compliance processes. 

In addition, a unified approach to legal compliance enhances your firm’s reputation. Clients and regulatory bodies, such as the SRA, perceive your organisation as one that takes its responsibilities seriously, instilling trust and confidence. It also mitigates potential legal risks, reducing the likelihood of legal repercussions or fines. 

Get in touch

At Teal Compliance, we’re here to support your journey towards compliance that works by mitigating the risk of legal compliance issues.  

We understand that compliance can be a daunting word, but it’s also the key to unlocking your firm’s full potential. Don’t hesitate to reach out if you need assistance. Together, we can navigate the compliance maze and ensure your firm’s continued success. 

Get in touch

Legal compliance issues: Embracing legal compliance for success Read More »

Woman on laptop with man in background

What does an AML audit involve?

Anti-Money Laundering, Audit, Blogs, Legal Compliance /

We love an AML audit and really enjoy reviewing law firms’ policies and procedures to see the different approaches they take in respect of AML. Most of all, we find it extremely interesting to see how a firms’ culture surrounding compliance is changing.

In this blog, we delve into what an AML audit is, and what an AML audit involves. 

What is an AML Audit?

The AML audit process is a way to strengthen or improve a firm’s AML programme. It is a way of assessing whether Firm’s AML policies, controls and procedures are up to date, comply with The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR) and are functioning in practice as intended.

What's the purpose of an AML audit?

The purpose of the Audit is to:

  • Examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted by the Firm to ensure compliance with the requirements of the Money Laundering Regulations;
  • Make recommendations in relation to those policies, controls and procedures; and
  • Monitor compliance with those recommendations.

Why conduct an AML audit?

There are two types of audit: 

Mandatory Audit

Regulation 21 of the MLR requires a relevant person, where appropriate to the size and nature of the business, to establish an independent audit function. This does not necessarily need to be an external audit, however, it will need to be conducted by someone in the firm who is independent of the Risk/Compliance/Anti Money Laundering (AML) function, but equally has enough AML knowledge to be able to conduct the audit. It is important to note that any findings in an Audit Report carried out under regulation 21 are disclosable to the Regulator.

Non-Mandatory Audit (Internal Audit)

A Firm may choose to conduct an internal Money Laundering Audit as routine procedure, being a way of checking whether the Firm’s policies, controls and procedures are up to date and comply with the MLR. The Audit report in these circumstances would remain for internal purposes only and confidential to the firm.

What's does an AML audit involve?

There are four stages involved in an AML audit: 

1. Review of policies and procedures

Firstly, a review of all the firm’s AML policies and procedures, Firm Risk Assessment and the Firm’s matter-based Risk Assessment is conducted by the auditor.

When carrying out the review the auditor will assess whether the firm’s AML policies and procedures meet the requirements of the MLR.

The auditor will use a list/table of each specific regulation and check this against the firm’s AML policies and procedures to confirm whether or not the firm has met that requirement.

2. Test

As part of the audit the auditor should test the knowledge, understanding and application of the firm’s processes. This is normally tested through staff interviews and matter file reviews.

Interviews

Interviewing staff will help the auditor assess the staff’s knowledge and understanding of money laundering, money laundering red flags and the firm’s processes.

File reviews

The auditor will carry out a review of files and assess whether the matters comply with the firm’s AML policies and procedures.

The auditor may also request to review some closed files. Reviewing a closed matter will assist the auditor in assessing whether there was on-going monitoring of risk and whether the completion instructions to accounts included information as to risk.

3. The Audit Report

The audit will result in a written report on whether:

  • The firm’s risk assessment and AML policies, controls and procedures comply with the minimum requirements of the MLR.
  • Changes which are required as a result of deficiencies identified (if any).

The audit report should:

  • Set out the law (what specific regulations of the MLR were checked against).
  • Explain what was examined for that specific regulation.
  • Document findings of areas of compliance and non-compliance as well as identifying areas for recommended improvement in behaviour and practice. It should be made clear which areas the firm is compliant, non-compliant or partially compliant.
  • Include an indication of where there are potential failings and a recommended course of action.

4. Review

The firm should conduct a review following an implementation period to establish compliance with the recommendations. As part of the review the auditor will be assessing whether the recommendations have been carried out and whether there is any evidence to show whether they are effective.

Get in touch

If you would like to discuss this further or feel your firm requires an independent AML audit, please get in touch and we’ll be happy to help.

Get in touch

What does an AML audit involve? Read More »

two people working on laptops

Anti-Money Laundering – What to expect from an Independent Audit

Anti-Money Laundering, Audit, Blogs, Legal Compliance /

 

Regulation 21 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (otherwise known as the Money Laundering Regulations) requires that regulated firms implement certain controls where it is appropriate to the size and nature of the firm. One of those controls is to establish an independent audit function. 

The size and nature test requires some objective thought and firms are directed by the Legal Sector Affinity Group’s Guidance to consider a number of factors including the number of staff and offices your firm has, your client demographic, and the nature and complexity of work you undertake. The Solicitors Regulation Authority’s take on it is that most firms (but not all) will need an independent audit. In its latest AML Report of October 2021, the Regulator found that a high number of firms visited (49 out of 69) failed to implement an independent audit where required. For those firms where an audit had been carried out, some common areas of concern were that the reviews were not sufficiently thorough or lacked an element of testing, they weren’t independent, and firms had not implemented the recommendations in a timely way. Such concerns could lead to firms being referred to the SRA’s Investigations Team. 

 

So if you have considered the size and nature test and determined that you need an independent audit, what should you expect from your review? It is key that your audit: 
    • Is independent from the people in your firm who are involved in setting and following the policies. The Regulations don’t prescribe that your audit must be carried out by a third party; but consider whether you are of a sufficient size to be able to resource a truly independent audit. Do you have staff with the right knowledge and capacity to carry out the audit? Even larger firms who have an audit function may find they do not have the necessary experience in AML. 
    • Is adequate in its scope and depth in order to give the firm assurance that the policies, controls and procedures they have in place are working. It should include a review of the existing documentation including firm and matter risk assessments and training plans, and a detailed review of how those processes have been implemented through file reviews and interviews with staff members to test understanding. The frequency of the audit should also be considered. Many firms decide to carry out an annual audit based on the size and nature test, but you may also consider focusing more frequent audits on higher risk areas as identified in your firm-wide risk assessment. 
    • Effectively identifies where processes are working well and roots out any problems with the process or where the process is not being followed. This means having the right person with the right expertise to carry out the audit so they know what they are looking for. It means carrying out an adequate number of interviews and file reviews across all locations and matter types so the Auditor can get a good feel for the firm and the types of issues that are occurring. Staff members from your fee earning teams, finance and any centralised onboarding teams should expect to be interviewed, along with the firm’s MLRO/MLCO. You may also consider focusing more frequent audits on higher risk areas as identified in your firm-wide risk assessment 
    • Provides feedback on where the firm’s current policies and procedures are not meeting the requirements of the Regulations and makes recommendations for improvement. A written report will provide you with the evidence that an independent audit has been carried out should the Regulator ever ask you for that information. The report should clearly set out the actions that should be taken to rectify any non-compliance. Recommendations should be implemented in a timely way and you should keep a record of the actions taken to meet the recommendations. 
    • Is part of an ongoing monitoring process to help you continually evaluate and improve compliance with the Regulations. Keep records of independent audits carried out for future reference and to evidence a robust auditing regime. 

There is no doubt that an independent audit requires some forwarding planning and investment in resources, whether that be internal resource or if you plan to engage an independent firm to carry out the audit on your behalf. It’s not a tick box exercise. Senior level commitment to the importance of implementing good anti-money laundering controls is therefore crucial and sets the tone for the firm and for the staff whose files may be reviewed or who may be interviewed as part of the audit process. But the reward for your investment is obtaining a real learning opportunity to understand what your firm is doing right and where it can make improvements and effectively manage money laundering risks.

 

Get in touch

For more information about our independent audit service, get in touch with our experts today.

 

 

Photo by Scott Graham on Unsplash

Anti-Money Laundering – What to expect from an Independent Audit Read More »

Two screens on a desk containing data spreadsheets

Time to audit data compliance?

Audit, Blogs, Data Protection /

We’re nearly a year since the frantic preparations for GDPR. How is it all going? Should we be checking? Should we audit data compliance?

Why do I need to complete a data compliance audit?

An audit allows an organisation to understand whether it is complying with the requirements of the Data Protection Act 2018, GDPR and PECR. Art 5(2) of GDPR states that

“The Controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 [the principles]”.

This is often referred to as the ‘accountability’ principle – completing and audit will allow an organisation to demonstrate accountability with the principles.

If the worst happens, and your organisation does suffer a data breach, the ability to demonstrate that you have completed regular audits and reviews of your data protection arrangements may assist in mitigating against a GDPR fine.

Data protection compliance is an ever evolving journey and not a destination. Audits allow organisations to assess any gaps in compliance and any improvements that can be made.

Initial Audit/GAP Analysis

If you haven’t already completed one, its a good idea to start with a full audit/GAP Analysis to benchmark the current level of compliance within your organisation. This audit will then form the basis of any improvements.

You should consider:

  • Do you have the relevant policies and procedures?
  • Have you completed a data audit, clearly documenting what personal data you process and the legal basis for processing it?
  • Do you have up to date data flow maps showing how data moves through your organisation?
  • Do you have a process for dealing with data subject requests within one month?
  • Do you have a process for dealing with data breaches and incidents?
  • Have you updated your contracts of employments and issued a privacy notice to all employees detailing how their data will be processed?
  • Do you have contracts in place with anyone who processes data on your behalf?
  • Do you have training scheduled or already completed?
  • Do you have a culture of privacy by design and default including a DPIA process?

Annual Compliance Audit

Once you have completed the work identified in your initial audit, the annual audit should be a much shorter exercise. The aim of this exercise is to test your process and controls to provide assurance that your organisations policies are being followed and to identify any improvements that can be made.

For an annual audit you should consider:

  • Are your policies and procedures up to date?
  • Do they reflect any process changes which have taken place?
  • Refresh your data audit – are your data flow maps up to date?
  • Is your Data Retention Policy being followed – ask IT to check whether you are holding data that should have been deleted?
  • Are data subject requests being responded to within one month?
  • Are data subject complaints being responded to promptly?
  • Is training up to date?Is there a good level of employee awareness?
  • Do you have contracts in place with all your data processors?

Report to the Board

Following the annual audit, you may want to complete a report to the Board detailing the findings together with MI on the number of data subject requests, data related complaints, breaches, incidents and any contact with the ICO.

How can Teal Compliance help?

Our Teal experts can help you with any aspect of data protection compliance, from carrying out a gap analysis, assisting you with a data audit or creation of policies/procedures to carrying out an independent annual audit. This can be done as a stand alone piece of work or as part of our DPO support service. Get in touch with our experts today.

Time to audit data compliance? Read More »