Blogs

Business women at desk meeting with laptop and notepad

Legal compliance issues: Embracing legal compliance for success

Audit, Blogs, Legal Compliance /

In the world of law firms, the mere mention of the “C” word tends to send shivers down the spines of many. Partners and owners alike sometimes choose to bury their heads in the sand, hoping that legal compliance issues will resolve themselves. However, the landscape is changing rapidly, and firms are evolving their approaches to business support. The old misconceptions of ‘fee burners’ and ‘fee earners’ are giving way to a proactive stance, where compliance isn’t just a requirement but a fundamental aspect of a firm’s culture. 

We believe that investing in business support is the compass that points your firm in the right direction. In this blog post, we’ll delve into why legal compliance is the cornerstone of your firm’s success. It’s not just about collecting a plethora of accreditations, although staying within the guidelines of these accreditations certainly minimises your risk exposure. 

Asking the right questions and breaking down silos

Are you asking the right questions to stay informed about your firm’s day-to-day activities? Are all departments collaborating to review risk registers and ensure everyone’s on the same page? Avoid the smoke and mirrors approach, which only masks underlying legal compliance issues. Instead, let’s shine a light on the importance of communication. 

Engaging with your employees is key to success. Often, during performance reviews, employees express a lack of communication. It’s not about inundating your team with every minor detail; it’s about involving them in achieving the firm’s objectives. Without effective communication, there’s room for important matters to slip through the cracks. 

Consider a compliance project. How many different team members are involved, and is there a streamlined approach to ensure continuity and prevent duplicate tasks? A joined-up approach is crucial. 

Ground-level knowledge: Your shield against regulatory pitfalls

Ground-level knowledge is your shield against regulatory pitfalls. To truly understand its importance, think of it as a solid foundation based on understanding, vigilance, and adaptability. In this section, we’ll explore why this knowledge is crucial for the well-being and prosperity of your law firm. 

1. A foundation of understanding 

Understanding begins with actively listening to what’s happening within your firm. It means having a finger on the pulse of daily operations, being aware of the challenges your employees encounter, and comprehending the intricacies of your clients’ needs. This understanding extends to the beliefs and values that underpin your firm’s culture, ensuring everyone is aligned with the same vision.  

2. The cost of ignorance 

When it comes to legal compliance issues, ignorance is not a valid defence. Regulators expect firms to be well-versed in the regulations governing their sector, and they won’t accept ignorance as an excuse for non-compliance.  

Ignorance can lead to dire consequences, including hefty fines, damage to your firm’s reputation, and even legal repercussions. In the eyes of the law, not knowing isn’t an excuse. Ground-level knowledge is your safeguard against such risks, as it empowers you to stay informed and take proactive measures to address potential legal compliance issues.  

3. The power of continuous review and analysis

Ground-level knowledge isn’t a static state but an ongoing process. It involves continuously reviewing your firm’s processes and critically analysing essential data. 

Regular process reviews enable you to identify bottlenecks, inefficiencies, or areas where compliance may be at risk. It’s similar to fixing weaknesses to make sure they can handle the challenges of time and close inspection. Additionally, the analysis of critical data allows you to spot emerging trends and potential compliance challenges before they escalate into formidable problems.   

Conducting a full 360 review of your business

The process of conducting a full 360 degree review of your law firm isn’t just a routine task; it’s a transformative journey that aligns your firm with the ever-evolving regulatory landscape. Visualise it as the compass that directs your firm towards its full potential in legal compliance. In this section, we’ll delve into why this comprehensive examination of your business is vital for your law firm’s success, particularly in the context of legal compliance, and how it can lead to meaningful change.

1. Celebrating achievements and strengths

Every law firm possesses unique achievements and strengths, often concealed in plain sight. Taking the time to recognise and celebrate these successes isn’t just about acknowledging your accomplishments in legal compliance; it’s about honouring what’s working exceptionally well within your compliance framework. These are the foundations upon which you can build a robust legal compliance structure for the future.  

2. Embracing a culture of self-scrutiny 

Genuine growth often necessitates introspection. It involves the willingness to roll up your sleeves and delve deep into the areas of legal compliance that require improvement. Just as a sculptor chisels away at a block of marble to reveal a masterpiece, your firm must be prepared to examine the rough edges within your compliance procedures.  

Scrutinising areas that need improvement isn’t a sign of weakness; it’s a testament to your dedication to legal compliance. It’s about identifying bottlenecks, inefficiencies, or outdated practices that may pose legal compliance issues. This process demands honesty and the willingness to address shortcomings proactively.  

3. Implementing systematic change

The true power lies in translating your observations and insights into systematic changes that enhance legal compliance. Instead of just pinpointing issues, you develop actionable solutions that bolster your compliance efforts. These changes may include streamlining compliance processes, investing in training and development for your compliance team, or adopting new technologies to bolster compliance tracking and reporting.  

This proactive approach creates an environment where your team can excel in legal compliance, your clients receive a top-notch service, and your firm operates with the utmost legal compliance diligence.  

Revisiting key performance indicators (KPIs)

Key Performance Indicators, or KPIs, are not confined solely to your fee earners. They’re a potent tool that can revolutionise your firm’s approach to maintaining compliance standards. In this section, we’ll explore why KPIs are indispensable, how they extend beyond the fee earners, and why regular reviews are essential to ensure they align with your legal compliance objectives. 

1. Expanding the scope of KPIs in legal compliance

While fee earners often take the spotlight, KPIs have a more profound role to play in the broader context of legal compliance. They should encompass every facet of your firm’s operations, from risk management to client service and regulatory adherence. By embracing a holistic perspective, you can foster a culture of compliance that permeates every department. 

KPIs that focus on legal compliance go beyond mere metrics; they become a compass guiding your firm towards a safer, more compliant working environment. They encourage proactive behaviours and decision-making that prioritises adherence to regulations, mitigating risks, and ensuring ethical conduct. 

2. The imperative of regular KPI reviews for legal compliance

KPIs are not static; they should evolve to reflect changing compliance requirements and your firm’s objectives. Regular reviews are the lifeblood of effective KPI implementation in legal compliance. 

During these reviews, you assess whether the KPIs are still relevant, achievable, and aligned with your evolving legal compliance goals. They provide the opportunity to recalibrate your firm’s course, ensuring that you continue to navigate the legal compliance landscape with precision. 

Independent file audits: Elevating legal compliance through insightful evaluation

Consider conducting independent file audits. They can unveil trends that highlight training issues or identify individuals with untapped potential. Striking a balance between micro-management and providing adequate supervision is essential for responsible leadership. 

Conducting independent file audits is a strategic manoeuvre that transcends routine checks; it’s an opportunity to gain unparalleled insights and elevate your firm’s commitment to legal compliance. In this section, we’ll explore why independent file audits are a linchpin in the quest for legal compliance excellence, how they unearth invaluable trends, and their pivotal role in honing the skills of your team.   

1. The power of independent file audits in legal compliance

Independent file audits are not mere paperwork exercises; they’re powerful tools for enhancing legal compliance. These audits provide an unbiased lens through which you can scrutinise your firm’s practices, ensuring they align with regulatory requirements and best practices. Beyond the checkboxes, they offer a holistic view of your firm’s performance in legal compliance. 

One of the key advantages of independent file audits is their ability to spot trends. These audits can unearth patterns that might otherwise remain hidden. For example, they can highlight recurring legal compliance issues or training gaps within your team. By identifying these trends early, you can proactively address them, fortifying your legal compliance framework. 

2. Enhancing training and identifying potential

The insights gained from independent file audits extend beyond compliance issues. They can also help identify individuals within your team who possess untapped potential. By recognising standout performance, you can nurture future leaders or identify team members ready for greater responsibilities. This not only benefits your firm’s growth but also bolsters its commitment to legal compliance, by having capable leaders. 

3. Striking the balance in legal compliance leadership

Achieving legal compliance excellence requires a delicate balance between oversight and empowerment. Micro-management stifles initiative, while inadequate supervision can lead to lapses in compliance. Independent file audits help strike this balance. They provide a mechanism for oversight without suffocating your team’s autonomy. 

Every role matters: A unified framework

In compliance, the significance of every role within your firm can’t be overstated. It’s not just the lawyers or compliance officers; it’s every individual, from support staff to partners. Embracing a unified framework is the cornerstone of fostering compliance excellence. In this section, we’ll emphasise the importance of this cohesion where everyone comprehends their responsibilities, and how it results in tangible benefits for your firm. 

1. The power of a unified framework in legal compliance

Legal compliance isn’t a responsibility that falls solely on the shoulders of a select few; it’s a collective effort. Encouraging your entire team to work within an established framework ensures that legal compliance becomes an integral part of your firm’s DNA. This framework provides clarity, defining roles, expectations, and the processes that ensure adherence to regulatory requirements. 

2. Benefits of cohesion in legal compliance

When every team member understands their role within the legal compliance framework, several benefits emerge. First, it minimises the risk of compliance gaps or oversights. Second, it fosters a culture of accountability, where everyone takes ownership of their compliance-related duties. Third, it streamlines communication and collaboration, facilitating smoother compliance processes. 

In addition, a unified approach to legal compliance enhances your firm’s reputation. Clients and regulatory bodies, such as the SRA, perceive your organisation as one that takes its responsibilities seriously, instilling trust and confidence. It also mitigates potential legal risks, reducing the likelihood of legal repercussions or fines. 

Get in touch

At Teal Compliance, we’re here to support your journey towards compliance that works by mitigating the risk of legal compliance issues.  

We understand that compliance can be a daunting word, but it’s also the key to unlocking your firm’s full potential. Don’t hesitate to reach out if you need assistance. Together, we can navigate the compliance maze and ensure your firm’s continued success. 

Get in touch

Legal compliance issues: Embracing legal compliance for success Read More »

Ellie Shute, Associate and Compliance Consultant at Teal Compliance

A day in the life of Ellie Shute – Associate at Teal Compliance

Anti-Money Laundering, Blogs, Legal Compliance /

If you’re interested in a career in compliance, our associate,  Ellie Shute, talks about life at Teal Compliance, and what her work involves. 

About me

When I was studying law at university, the whole concept of compliance was a bit of a mystery to me. Surprisingly, I ended up falling into it after graduating. I embarked on a journey through various roles in different law firms, ranging from international researcher to compliance analyst. Along the way, I discovered my passion for navigating the realm of risk. So, when the opportunity to dive into AML compliance at Teal Compliance presented itself, I leapt at it without hesitation.

I’ve been part of the Teal team for a year now, and it’s been quite a ride. Stepping into the start-up life was a fresh experience for me, but I had a gut feeling that I’d made the right call. Working directly with my own clients has been incredibly rewarding. I’ve had the chance to forge relationships with diverse individuals and witness first-hand how my work can truly make a meaningful impact.

My role

When a firm needs assistance or guidance on anything related to AML, I’m their go-to person. My role covers a wide range of duties, from addressing spontaneous ‘Ask Teal‘ enquiries to crafting comprehensive policies and procedures from the ground up.

A significant portion of my time is dedicated to conducting audits for our clients, which involves conducting a thorough 360-degree examination of the firm. I’ll delve into their policies, interact with their staff, and scrutinise their client files. It’s during these audits that you truly get to dive deep into the inner workings of a firm and discover what drives it.

In between all this, you can catch me participating in our webinars, ‘Teal Talks,’ where we discuss various AML hot topics. Alternatively, you might find me crisscrossing the UK, delivering training sessions for our clients.

A typical day

I know it might sound like a cliché, but seriously, no two days are alike in my line of work! My schedule is usually booked weeks in advance with client tasks, so I have a rough idea of what’s coming. But you never know what surprises the day might bring.

When I’m in the middle of an audit for a client, one day I’ll be digging through their files, determining if they meet AML requirements. On another day, I’ll be chatting with staff members at a firm to see how much they know about their own company’s policies and procedures.

In the midst of all this, when I’m back at the office, my time is sprinkled with tea & cake breaks, impromptu quizzes, and convincing my colleagues to come and eat pizza with me at lunch.

What I love about what I do

One of the things that I love about my job is seeing how my work directly impacts our clients. We often work with small firms just dipping their toes into AML, and through our efforts at Teal, we help them kick-start their compliance journey and navigate the regulatory landscape.

On the flip side, we also have massive magic circle clients where I spend my time chatting to senior staff from around the globe about the regulations in their jurisdictions. It’s like a dream come true for the researcher in me!

Another aspect of my job that I greatly appreciate is the chance to apply my skills in fresh and innovative ways. Having previously worked as an international researcher, where my responsibilities included reviewing and analysing legislation from various countries, I had the opportunity while working at Teal, to take the lead in a significant audit for an esteemed magic circle firm. This audit involved the assessment of all of their international offices, and presenting my findings and recommendations to their senior team – the entire experience was truly remarkable.

Find out more

To find out more about a career with Teal, visit our careers page.

Find out more

A day in the life of Ellie Shute – Associate at Teal Compliance Read More »

2 men in suits reading a document at a desk with a pen in hand

What are the SRA doing to enforce lack of AML compliance within law firms?

Anti-Money Laundering, Blogs, Legal Compliance /

Sadly, law firms (along with other professionals) are still being labelled ‘ProfessiEnablers’ an arguably harsh term that has been in place for quite a few years now. This label was repeated by the National Crime Agency (NCA)’s UK Financial Intelligence Unit in their August 2023 update which stated that Professional Enablers’ “skills, knowledge and expertise are exploited by criminals to launder the proceeds of crime”.

For those of us that have dedicated our time, passion and finances to pursuing a legal career, this term is considered highly offensive. However, the term continues to be thrown at the legal sector because the levels of suspicious activity reports received by the NCA don’t reflect the level of serious organised crime that’s taking place within the UK. Their observations? Those of us within the profession are failing to spot the red flags of money laundering.

So, what are the SRA doing to enforce lack of AML compliance within law firms? As promised, they’ve continued to ramp up their anti-money laundering supervision and investigation measures, with dedicated AML teams being in place since 2019. This demonstrates their desire to dedicate time and resources to ensure AML compliance within firms.

Key Trends

Now, let’s take a look at some of the key trends they’re finding as a result of their supervision and investigation activities:

1. Firm-Wide Risk Assessments (A requirement since 2017)

Much to their despair, the SRA was finding that many firms didn’t have a Firm-Wide Risk Assessment in place, despite their numerous warning notices.

Similarly, a common trend was a failure to suitably tailor precedents according to the firm’s specific risks, namely client risk, product and service risk, jurisdiction risk, transactional risk as well as delivery channel.

They also addressed the fact that firms have returned Declarations to them stating that their Firm-Wide Risk Assessments were AML compliant, when this was far from the case. Whether this was intention or based upon reasonable belief that they were remains to be seen.

2. AML Policies, Controls and Procedures

Again, the SRA marked their disapproval at those firms who lacked any AML Policies, Controls and Procedures, a requirement that has been in place since the 2003 Regulations, and reiterated in the updated 2007 Regulations.

Surprisingly, they also found that some firms have robust and comprehensive suites of AML Policies, Controls and Procedures but these were effectively pointless as they weren’t communicated to staff who are the ones carrying out the day-to-day casework.

3. Lack of Independent AML Audits (where appropriate to the size and nature of the firm)

The SRA said that they expect most firms to have an independent AML Audit.

This is something that we see here at Teal Compliance. Many firms either don’t realise that they should have an Independent AML Audit or it’s something firms know they need to do, but don’t have the time, resources or budget to do.

Independent AML Audits can be a vital opportunity for your firm to address any deficiencies in your AML Policies, Controls and Procedures as well as to interview staff members and carry out review files to see whether the policies, controls and procedures are actually being adhered to as intended.

The SRA has confirmed that they intend to carry out AML audits for every firm, it’s a case of when this takes place as opposed to if this takes place.

4. Lack of AML Training within firms

Lack of targeted AML training within firms was another finding picked up by the SRA during their supervisory and investigative functions. Knowledge is power, so failing to equip staff with the knowledge and resources to spot red flags for money laundering can create large holes in a firm’s AML framework.

AML training should be a key focus for all firms, starting with the staff induction process and continuing on a regular basis (recommended annually as a minimum). Staff who work in higher risk sectors would expect to have more frequent bespoke training to their work type. However, distributing AML blogs and enforcement cases to staff can also form a supplementary part of the training framework, helping to keep staff members engaged.

The SRA has confirmed that its next Thematic Review will be in respect of AML training. This means they’ll also be visiting firms to review firms’ AML training processes. So, make sure your house is in order. The SRA will expect to see a training record detailing what training each staff member has had and when.

AML Breaches

Now, let’s turn to some of the statistic findings from the SRA’s supervision and investigations. In 2022, 249 AML Reports were made from the AML Supervision team with the most common breaches being as follows:

  • 61 Reports of failing to have proper AML Policies and Procedures
  • 60 Failure to carry out source of funds and source of wealth checks
  • 58 Failure to carry out risk assessment at client/matter level
  • 48 Failure to carry out Firm-Wide Risk Assessment
  • 47 Failure to carry out /complete CDD

SRA Enforcement Measures

Aside from sometimes causing catastrophic reputational damage, SRA enforcement measures can have a crippling financial impact on firms of all sizes. However, the SRA have continued to use their full fining powers – both at an individual level as well as a firm level. Let’s have a look at some of the key cases:

1. Mrs A - £2,000 fine

  • Failure to follow firm’s PCPs
  • Failing to establish appropriate level of risk
  • Failure to obtain source of funds and source of wealth information

2. Firm B - £20,000 Fine

  • Failure to have Firm-Wide Risk Assessment
  • Incorrect Declaration made to SRA regarding the Firm-Wide Risk Assessment
  • No independent audit
  • Failure to provide staff with AML training
  • Failure to carry out client and matter risk assessments
  • Failure to carry out source of funds and source of wealth checks

3. Mr C - 12 month suspension on Practicing Certificate

  • Failure to perform CDD adequately
  • Failure to perform EDD where appropriate
  • Found manifestly incompetent

For further information on the SRA’s New Fining Powers, please click here. 

What should law firms take away from this?

At the SRA’s conference in March 2023, Paul Philips, Chief Executive of the SRA, recognised that most firms are still trying to ‘catch up’ with the large amount of regulatory guidance and legislation that’s come into force in recent years. He stated that these firms will have nothing to fear.

It’s apparent that firms that are demonstrating wilful disregard to the requirement to have a comprehensive AML framework in place are those that are likely to feel the full force of the SRA’s fining powers, in addition to firms who return Declarations that they know to be incorrect.

The SRA also recognised that in times of wider economic pressures (such as the current cost of living crisis) there may be a tendency for firms to reduce their AML resources, whether that’s staffing levels or technology. However, they confirmed that AML resources must not be reduced and must remain a key priority for all firms.

Get in touch

If you require assistance with any of the topics discussed in this blog, such as assistance with your Policies, Controls and Procedures, AML training for your firm or you’d like to discuss our Independent AML audit services then please get in touch. 

Get in touch

What are the SRA doing to enforce lack of AML compliance within law firms? Read More »

Eilish Cullen, Compliance Consultant at Teal Compliance

A day in the life of Eilish Cullen – Senior Associate at Teal Compliance

Anti-Money Laundering, Blogs, Legal Compliance /

If you’re interested in a career in compliance, our senior associate, Eilish Cullen, talks about life at Teal Compliance, and what her work involves. 

About me

I’ve been working as a Senior Associate at Teal Compliance since November 2022. Having previously carried out Teal’s comprehensive Compliance Officer Training Programme, I was already aware of their reputation within the compliance industry. Prior to this, I worked at a small litigation firm in Liverpool and had several roles including Head of Department, Deputy COLP, Director and Complaints Partner. 

In my previous role, I carried out a wide range of tasks including fee-earning, supervision, training, elements of human resources, as well as policy drafting and compliance record keeping.

My role

My day-to day duties, usually consist of:

  • Reading Legal Futures/Law Gazette. Fellow ‘compliance geeks’ will understand the need to keep ourselves informed of Regulatory and AML developments.
  • I try to be active on LinkedIn. It’s a great platform to share our knowledge with clients, potential clients and those in the industry. I think it’s important for our clients to know about the services we provide and to put some personality into what others deem to be a ‘dry subject’.
  • I’ll plan out my day. This could be a Policy Review, Regulatory/AML training, CQS File Reviews or our most popular service – our independent AML Audit.
  • As Associates, we always keep an eye on our inbox for ‘Ask Teal’ enquiries. This is a central inbox where clients contact us seeking urgent guidance, and we aim to provide high-quality expert advice within a short period of time. Some of these can be very technical and tricky but between the Teal Team, we have always been able to assist.

A typical day

Whilst we’re thankful to have flexible working, I tend to work 9am-5pm.

Thankfully, the Management Team at Teal encourage taking regular breaks and are very keen on having good mental health strategies in place – no one wants a burnt-out employee! This means I always take my lunch break, something that didn’t really seem to happen in my last role due to other demands. I definitely feel more productive as a result.

Sometimes your best thoughts come to you whilst walking your dog – who would have thought?

What I love about what I do

One of the reasons I love working at Teal is the sense of job satisfaction I get, something I feel was missing in my last role due to ‘spinning so many plates’ and never truly feeling that I was adding value as a result.

Many of our law firm clients feel the same, with their time and resources being thinly stretched. Here at Teal, I’ve been given the opportunity to provide expert guidance to our clients and help to shape their compliance framework for the better which gives me a great sense of personal achievement. This is why I ‘do what I do’.

Diversity is also something that keeps me motivated. No month at Teal is ever the same! Alongside carrying out independent AML audits, CQS file review and AML training, I have also been selected to participate in round table discussions on financial management and regulatory issues. Having this level of exposure has been extremely beneficial for my career development within Teal.

That said, like many professionals, I’m sometimes plagued with the dreaded ‘imposter syndrome’ and doubt my own capabilities. However, I genuinely think this is counter-balanced by having a supportive and positive team around. Getting good client feedback also helps!

Find out more

To find out more about a career with Teal, visit our careers page.

Find out more

A day in the life of Eilish Cullen – Senior Associate at Teal Compliance Read More »

Filing cabinet draw with file partially lifted out named "suspicious activity reports (SARs)

The potential pitfalls of SARs: 10 ways to avoid them

Anti-Money Laundering, Blogs, Legal Compliance /

Filing Suspicious Activity Reports (SARs) should be a top priority for UK law firms, especially when dealing with situations that raise red flags for potential money laundering. However, the term ‘suspicious’ itself presents a conundrum due to its lack of a precise definition. The ambiguity surrounding suspicion demands clarity in expressing your concerns—not only to protect your firm against legal repercussions, but also to maintain transparency with your clients.

Here, we look at the pitfalls of filing SARs, and provide our top tips to avoid them. 

Battling financial crime

The 2022 Suspicious Activity Report (SARs) Annual Report, released by the National Crime Agency (NCA), presented a clear picture of the evolving landscape of financial misconduct, spanning 2020/21 and 2021/22. The report includes the following:

Setting new records

The report reveals an impressive 21% surge in SARs submissions, reaching a staggering 901,255 in the latest financial year. This increase underscores the growing vigilance within regulated sectors against potential money laundering and criminal activities.

Striking back at criminals

SARs continue to play a pivotal role in halting financial crime. An astounding £305.7 million was denied to suspected ‘baddies’ through Defence Against Money Laundering (DAML) requests – a remarkable 120.6% boost from the previous year’s £138.6 million. This surge reflects the effectiveness of SARs in curbing illicit financial gains.

Adapting to changing scenarios

The pandemic and geopolitical events have emphasised the adaptability and significance of SARs. Criminals exploited the pandemic chaos, underscoring the need for accurate financial intelligence – intelligence that SARs provide. The report highlights the role of SARs, in unearthing money laundering linked to sanctioned individuals and their affiliations, particularly following Russia’s invasion of Ukraine.

The potential pitfalls

Despite the crucial nature of SARs, there’s a challenge when it comes to what constitutes as ‘suspicion’. Cases like Lonsdale v National Westminster Bank plc [2018] EWHC 1843 (QB) have added to the complexity of this issue.

David Lonsdale, a property law barrister, found himself entangled in a situation where his bank accounts were frozen due to suspicions of money laundering.

Mr Lonsdale owned several properties and managed the finances of each of those enterprises with seven separate bank accounts; including one account for his earnings as a barrister, and another two joint accounts.

The bank's actions

In March 2017, NatWest decided to freeze one of his joint accounts for eight days while filing a SAR to the NCA. In December 2017, they froze all of his accounts while filing additional SARs. That same month, NatWest wrote to Mr Lonsdale, informing him that they were going to close all of his accounts, offering no explanation or justification.

Of course, if a bank has genuine suspicion of money laundering, they’re entirely within their rights to file a SAR and freeze accounts.

Mr Lonsdale's response

Mr Lonsdale vehemently objected to the closure of his accounts and the accusation of suspicious activity. Mr Lonsdale demanded an explanation, but the bank refused to discuss the issue. As a result, Mr Lonsdale requested disclosure of the SARs, as well as any notes leading to the decision, recorded against his accounts, under the Data Protection Act 1998 (since superseded by DPA 2018).

In line with DPA laws, the bank provided account data, but refused to share the contents of any of the SARs raised against him. This led Mr Lonsdale to file complaints on the grounds of:

  • Breach of contract
  • Breach of DPA 1998
  • Defamation of character

The bank continued to assert that they weren’t obliged to grant access to the contents of the SARs. This led Mr Lonsdale to escalate the case by making an application to the courts.

The case results

When the case was heard, the judge found in favour in Mr Lonsdale’s application to access the content of the SARs.

The judge stated that suspicion must exceed mere fanciful possibility and acknowledged the absence of a requirement for suspicion to be ‘clear’ or ‘firmly grounded and targeted on specific facts’.

What we learned

The lack of a formal legislative definition for ‘suspicion’ has led to confusion and subjectivity. However, the judge’s response implies that suspicion holds a subjective nature, although it must be genuine.

NatWest was within its rights to take action, as banks can freeze accounts if genuine suspicion exists. However, this case highlighted the need for transparent communication and well-founded suspicions.

It establishes that, in some circumstances, clients may be legally entitled to view a SAR made about them, which could, potentially, lead them to bring a defamation claim against the MLRO if that suspicion turns out to be damaging and incorrect.

10 tips to avoid the pitfalls of SARs

In line with advice from the National Crime Agency (NCA) and the insights from the Lonsdale case, here are ten effective ways to navigate the potential pitfalls when reporting suspicious activity:

1. Clear and concise language

Aim for simplicity over legal jargon. Remember, the ‘reasons for suspicion’ section of the SAR limits your input to 8,000 characters, which translates to about 1,500 words. Clarity is your best ally.

2. Precise reasoning

When expressing your suspicion of money laundering, provide a comprehensive narrative. Address the fundamental questions: Who? What? Where? When? Why? How? Leaving no room for ambiguity.

3. Thorough details

Don’t shy away from specifics. When identifying individuals and businesses involved, include as much detail as possible. If suspected criminal property is in the mix, ensure it’s outlined with precision while adhering to privilege guidelines.

4. Detailed information

Elaborate on every piece of information that contributes to your suspicion. Clearly explain how you encountered this information, creating a transparent trail that others can follow.

5. Distinguish facts from suspicions

Separate hard facts from suspicions. It’s essential to convey what you definitively know from what you suspect. This distinction adds clarity to your report.

6. Chronological sequence

Create a chronological timeline of events that substantiate your suspicion. Be meticulous with dates, providing a clear sequence that supports your case.

7. Justify suspicion

Go beyond a mere declaration of concern. Provide the rationale behind your suspicion. For example, if sizeable third-party transfers are involved, outline whether you contacted the client, explain the inadequacy of their response, and detail how the transfer pattern arouses suspicion.

8. Deviation from the norm

Highlight how the flagged activity differs from normal operations within the specific customer or business sector. This contextual insight strengthens the gravity of your concern.

9. Professional involvement

If your SAR implicates a professional enabler (like an accountant or conveyancer), assess their involvement. Specify whether their participation appears witting and provide reasons for your assessment.

10. Clarity on transactions

Clearly describe whether your suspicion pertains solely to transactions or if it extends to the professional behind them. Transparency in this regard bolsters the effectiveness of your report.

 

Given the potential for vagueness in the term ‘suspicion’, it’s reassuring to know that The Law Commission is working to provide clearer guidance on what constitutes suspicion. In the meantime, adopting these ten tips will bolster the thoroughness and precision of your SARs.

 

Get in touch

If you need advice or guidance with AML compliance, we’re here to help you. Simply get in touch with one of our friendly experts today.

Get in touch

The potential pitfalls of SARs: 10 ways to avoid them Read More »

Hands resting on laptop with Cyber Security on the screen

How law firms can prevent cyber-attacks

Anti-Money Laundering, Blogs, Legal Compliance /

Think of your accounts like your home. You can have the best locks and the best alarms but, if burglars want to get in, they can often find a way. However, having the best locks and the best alarms does deter them, and it’s the same with cybersecurity. You have to do everything you can to prevent cyber-attacks, protecting your law firm and making it as secure as possible.

When looking to prevent cyber-attacks at your law firm, there are a number of things you can do. This blog provides advice on ways to safeguard and limit your law firm’s exposure to cybercrime.

Safeguards to prevent cyber-attacks

There are numerous safeguards to prevent cyber-attacks. Some may seem a little obvious, but it’s important that they’re all in place to protect your law firm to the best of your ability. These are the most important safeguards:

1. Two-factor authentication on all logins

Whatever account you log into, you usually do so with a username or email, and a password. Two-factor authentication is an extra layer of security. Once you’ve input your username and password, you’ll then have an additional task to complete. This could be authorising the login via an app on your phone or computer, or a text message with a one-time-only code. It’s only when you complete this additional task that you’re able to access your account.

Make sure you have two-factor authentication set up on all your accounts, so it’s much more difficult for scammers, or baddies, to access them.

2. Regularly monitor sign-in activity on your account

Many logins, especially email logins, notify you when someone has logged into your account. These notifications can provide information such as who has logged in and where they’ve logged in from, for example, if they’re overseas.

Make sure, where possible, that you have these notifications activated. That way, when a baddie accesses your account, you’ll be able to act swiftly.

It’s important to note that the location may not always be genuine. If the baddies are using a VPN, they may be able to hide their location and make it look like they’re in the UK.

3. Anti-virus protection

Although it sounds obvious, anti-virus protection can significantly increase your security. It can often detect when a website looks odd, or something doesn’t look quite right. It will alert you to potential suspicious activity, giving your law firm an extra layer of protection, making it more difficult for baddies to get into your accounts, and helping you prevent cyber-attacks. Having your IT department test these firewalls is essential to check they are working.

4. Spam filter

The spam filter isn’t always reliable. Although it can detect some potential fraudulent emails and move them to your spam folder, it can often miss them. Also, genuine emails can often get caught up in spam. However, it does add an extra layer of security and makes you think twice about emails that end up in your spam folder.

5. Strong passwords

According to an article by Tech.Co on ‘Securing Accounts in 2023’, it’s quite easy for hackers to guess uncomplicated passwords. If a password is under 10 characters, it will only take 2 weeks to crack, and a simple 10-character password made of numbers or lowercase letters can be cracked in under 24 hours.  

Therefore, making sure your accounts have strong passwords is an extremely important part of safeguarding to help prevent cyber-attacks.

Limiting exposure to cybercrime

In addition to putting safeguarding measures in place to help prevent cyber-attacks, there are various ways in which you can also help limit exposure to cybercrime:

1. Where possible use an app for clients to confirm bank details

There are apps available where clients can confirm their bank details together with the name of the person that’s expected to receive funds and it will confirm their details. Some banks also now match up the recipient’s name. It’s important to note that these tools are useful for guidance, but you can’t rely on them to be 100% accurate.

2. Never accept bank details over email

Pick up the phone, or better still, speak to them in person to get their bank account details. Although we appreciate it’s not always practical to do that.

3. Set up daily payment limits and limits on amounts per transaction

Although this isn’t necessarily practical as a conveyancer, given you’re dealing with transactions of huge amounts of funds all the time, setting up daily payment limits and limits on amounts per transaction can be very beneficial. If you’re unable to do this with your client account, you might want to consider it for your current account.

If you do this, and a baddie does access your account, they’ll be limited to what they can transfer, which limits your exposure to risk.

4. Dual authorisation on banking

Dual authorisation on banking can be really useful. It’s the modern-day equivalent of having two signatures on a cheque. The advantage is, if there is a scam, one person failing to recognise it is possible, but two people failing to recognise it is much less likely.

5. Have more than one bank account

The advantage to having more than one bank account is that if baddies manage to get into one account, they’re only limited to the funds in that account.

Taking a step back from the cybersecurity reasons, there’s also a practical reason for having more than one bank account. Money in most UK banks is under FCS protection. Your money is protected up to £85,000, but anything over £85,000 is not covered by FCS protection. It’s unlikely that more than one bank would go under at any one time and therefore spreading your money across different bank accounts limits your risk.

6. Regular virus checks

Having regular virus checks on all your devices, such as phones, tablets, laptops, and PCs, can significantly reduce risk and prevent cyber-attacks.

7. Have a good IT response

When a cyber-attack takes place, your response time is extremely important. If something were to happen, you need IT support on hand, rather than trying to find someone to help and wasting valuable time. Having someone at the end of the phone, who put your systems on lockdown and limits your exposure is extremely important.

How to prepare for a cyber-attack

It’s important that you prepare for a cyber-attack by ensuring that a firmwide policy is in place which details what should be done in the event of a cyber-attack

It’s also important to ensure that everyone has had the relevant training, which includes how to detect a cyber-attack. The SRA has suggested that you should probably have training every four months as people can easily forget what they have to do, so they need a reminder.

Carrying out a root cause analysis after an attack is important to establish why the attack happened and what measures can be put in place to stop it happening again. 

Cybersecurity insurance

Many people believe that in the event of a cyber-attack, their business or professional indemnity insurance will cover it. However, they don’t actually cover cyber-fraud. 

Insurance companies know that cybercrime is a substantial risk so the cybersecurity insurance they offer usually has an extensive premium and a rather hefty excess. Many law firms when assessing the risks believe that the cost of the premium and excess is so large, that they’re never going to claim on it, and therefore, having it would effectively waste their money.

Because cybercrime is so high-risk, the insurers often put a lot of limitations on the policy as well as expectations on the policyholder. So, if you do have cybersecurity insurance you need to ensure you’re well aware of all of these points and also what the insurers’ reporting requirements are in terms of time periods. Otherwise, you may find yourself in a situation where you pay a lot for a policy that isn’t fit for purpose.

What are the SRA regulations in the event of a cyber-attack?

In the event of a cyber-attack, you need to contact the SRA. As a solicitor, you have certain obligations under the account rules.

If money has been sent to the wrong person from the client’s account, the SRA regulations state that you need to pay that money back into the client’s account immediately. You can’t wait to try and get the money back first.

There was a case where the SRA fined a law firm as they didn’t pay the money back into the client’s account for four months. This was a breach of accounting rules that resulted in a significant fine.

There’s also a requirement to report the incident to the ICO within 72 hours. 

You also need to tell your client. You don’t want your client to find out another way, such as if it ends up on the news, or the regulator contacts them. Be honest and open, even when it’s difficult.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

Get in touch

How law firms can prevent cyber-attacks Read More »

Two office workers touching a cyber security icon on a window screen

How to detect a cyber-attack via email at your law firm

Anti-Money Laundering, Blogs, Legal Compliance /

The SRA recently confirmed that 100% of the reports of cybercrime they had came from email fraud. In addition, 98% targeted conveyancing, as it’s easier for fraudsters or baddies to try and defer large sums of money in this area of law. It’s therefore hugely important that law firms understand how to detect a cyber-attack via email.

This blog explores the various signs to identify suspicious emails that may lead to a cyber-attack via email.

Why do scammers want to access your email account?

Before looking at how to detect a cyber-attack via email, it’s important you understand why baddies want access to your email account.

When they have access to your email account, they can see emails that have come in and gone out of your account. This will give them access to a wide range of data.

This is especially dangerous for law firms as it could include details of transactions that are about to be made, together with personal details of those involved in the transactions. This could significantly help them when they’re trying to commit fraud.

Having access to your email account will also mean the baddies will have access to your calendar. If they’re planning to send fraudulent emails from your account, it’s more likely that they’ll do it when they know you’re not going to be online. That way, there’s more chance of you not noticing suspicious activity until it’s too late, and the damage has already been done.

What are the signs to identify suspicious emails that may lead to a cyber-attack?

When looking at how to detect a cyber-attack via email, there are numerous signs to look out for.

1. Emails with links asking you to sign into your account

The easiest and most common way for baddies to access your email account is by sending you a link, asking you to sign into your account. There are many different ways they do this. It might be an email from an account that appears to be Microsoft or Google, asking you to re-enter your password via a link. It might be an email from another source asking you to log into your email from a link, so you can sign a document. Even if it’s from an email sender you know and trust, their email account may have been hacked.

When you click on these links, the pages you go to are not genuine and instead of logging into your account, your details are stored. So, avoid clicking on these links in emails.

2. Emails saying that bank account details have changed

You’ll no doubt have heard about, or even received, emails that say things like “we’ve just changed our bank details”. Again, even if you trust the sender as you know them, they too may have been hacked, so it’s important to verify this. Give the person a call but don’t use the phone number on the suspicious email.

If you don’t verify this and it is the baddie’s bank account, it’s unlikely that you’ll see that money again.

3. Emails no in the style you'd expect from the sender

When you receive emails from suppliers, colleagues, clients, friends or family, usually, they tend to have their own style, using specific language and terminology. If you receive an email from someone you know, and it doesn’t use the style you’d expect from them, you should consider the email suspicious.

Again, try to authenticate the email by speaking to them, but if you call them, don’t use the number on the suspicious email. Remember, the email might be coming from the genuine sender’s account, but it doesn’t mean it’s them.

Knowing how to detect a cyber-attack via email from someone you don’t know when you don’t know their style, can be trickier. However, you can still consider the style. For example, if it was coming from a lawyer from another company, are they correctly using legal terminology?

Regardless, if anyone is asking you to transfer money, or do something else which may lead to fraud, think twice!

4. Emails with a sense of urgency

Many baddies send emails that ask you to do something as a matter of urgency. This could be something such as, your account will be deleted, or you’ll be fined if you don’t pay within a short space of time. They may even send emails posing as a manager from your business, asking you to transfer money, for example, saying they’re stuck in a conference and urgently need to make a payment, but their card is blocked.

Baddies want you to panic. They know you don’t want accounts to be deleted, get fined, or get in trouble at work, so you’re likely to take action quickly, as you’ve had little time to think.

The SRA recently said that 82% of the breaches that had been reported to them were as a result of human error, due to being under pressure. Therefore, if an email suggests you make a transaction quickly, don’t panic, think twice and do your due diligence.

5. Emails with signatures that are not quite right

Many baddies pose as reputable organisations, such as Gov UK, Royal Mail, high street banks, etc. Therefore, they include an email signature from that organisation, which often includes a logo.

It’s important to always check the email signature as there can be clear signs in detecting a cyber-attack. The signature and disclaimer may not use the right language or terminology or may even have spelling errors. The logo may be pixelated, stretched, or just seem a little off. If the email signature is suspicious, don’t click on any links.

6. Emails with email addresses that are suspicious

You may receive emails that name the sender and appear genuine. However, if you click on, or hover over, the email sender’s name, the full email address can be seen.

Baddies often have email addresses that appear suspicious and don’t fit with the person they’re pretending to be or the company they’re pretending they’re from.

7. Emails that aren't expected

Although we receive emails all the time that we’re not expecting, if you receive an email asking you to do something that may be considered suspicious, and you weren’t expecting that email, this may be a cyber-attack via email.

Again, you can call or speak to the person the email is from to determine whether the email is genuine.

8. Emails from clients saying there are last-minute changes

Just like with AML, emails that ask for last-minute changes, such as changes to the amount to be transferred, or changes to the bank details are suspicious.

Pick up the phone and speak to the client before you carry out any changes that the email suggests. Last-minute changes can be a red flag, so make sure you do your due diligence.

9. Emails on Friday afternoons

In conveyancing, a lot of completions take place on a Friday afternoon. As it’s the end of the week and many people are tired and want to get home for the weekend, it’s when baddies know lawyers are at their most vulnerable. Therefore, a lot of cyber-attacks via email take place on a Friday afternoon. This is called ‘Friday Afternoon Fraud’.

Therefore, make sure you continue to be vigilant on a Friday afternoon. Never act on impulse and get dragged into the urgency of an email, and treat all emails with caution.

Does a telephone call to the sender prevent a cyber-attack via email?

The clear and simple answer is no. The tactics of scammers are becoming more sophisticated and sometimes, you can make a call to the sender to check if the email is real, and actually end up speaking to the baddie!

When you get a phone number to call, you should also do your due diligence on that phone number. Check their website, check directories and do internet searches on the phone number to check if it’s genuine. If the phone number isn’t the genuine phone number of the genuine person, you’re more likely to find an inconsistency somewhere.

It’s important to note that there have been times when numbers appear genuine, even after due diligence checks. So, you really need to watch out for the other signs and be extremely cautious.

If you’ve fallen victim to a cyber-attack via email and transferred funds, can the recipient’s bank help?

If you find out you’ve fallen victim to one of these scams and transferred funds, the speed of your response is extremely important.

Don’t wait for your bank to contact the recipient’s bank. Find out which bank the money has been transferred to, by checking the sort code. Then, phone that bank, explain the situation, and ask them to put a hold on the recipient’s account. Although the recipient’s bank is under no obligation to do this for you, you may get someone on the line who’s willing to cooperate with you.

Remember, you don’t have days to stop the recipient from taking money from their account, but hours or even minutes. If you leave it too long, the baddies are likely to have cleared that account and you’re unlikely to ever see that money again.

Preparing for a cyber-attack

With every preventative measure in place, cyber-attacks can still happen. That’s why it’s extremely important to have a process in place in the event that one does happen.

We’ve prepared a useful guide on preparing for a cyber-attack which you may find helpful.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

Get in touch

How to detect a cyber-attack via email at your law firm Read More »

Man with PC and two laptops set up on a desk

The challenges of compliance legal tech

Anti-Money Laundering, Blogs, Legal Compliance /

Leveraging compliance legal tech enables lawyers to get on with doing what they do best. It should be considered a partnership, with technology doing some of the heavy lifting involved in the daily administrative tasks that eat into lawyers’ billable hours.   

Although many advancements have been made in recent years, there are still challenges that are faced by law firms when adopting compliance legal tech.  

How has law firms’ appetite for legal tech changed since the pandemic?

Of course, the pandemic expedited many law firms’ plans to digitise the operations side of their practice. They had to find legal tech solutions overnight, such as digital postroom services, AML, KYC, and digital onboarding solutions, to enable their business to move to a ‘working from home’ environment.  

As a result, legal tech solutions were implemented with an urgency bias, so their appetite for tech was based on survival. It wasn’t necessarily about solving the problems they already had, it was about finding a way for firms to continue with as little interruption as possible.  

The legal tech implemented at the time was able to fulfil that need. However, what many firms are now left with is a number of digitised processes that often don’t speak to each other, and all need to be managed individually. This can be extremely time-consuming and complex.  

Therefore, the appetite law firms have for compliance legal tech has now changed. They were able to see how the legal tech worked for them during the pandemic in order for them to survive, and they’re now looking at it strategically. They want consolidation, and to build a future-proofed data and application ecosystem that’s incredibly strong.  

With teams now working differently – some working hybrid, some working from home, and some full-time in the office – law firms need to make sure there’s a collaborative tool so everyone can keep their fingers on the pulse.  

How has legal tech changed consumers’ expectations since the pandemic?

You’ll no doubt have read stories in the early days of the pandemic about people meeting in car parks to sign deeds over a car bonnet. In the digital world we were living in, this didn’t provide clients with a positive legal experience.  

As law firms adapted to the pandemic by implementing new legal tech, clients were able to see how legal tasks could be done immediately and recognised the significant benefits. This has obviously increased consumers’ expectations of tech within the legal sector.  

Consumers’ increased expectations have given rise to suppliers and other organisations within the legal sector to look at improving processes through legal tech. With more refined legal tech being implemented, the challenge law firms have now is how to link all these processes together effectively and make compliance processes seamless for their lawyers, and also their clients.  

There are already some systems that make the onboarding process easy for consumers. Clients no longer have to find time in their lunch hour to take their documents into a solicitors’ office or find someone to certify them. However, if the next part of the client’s journey isn’t similarly optimised, and they still have to go into the office to sign documents or get an update, this is unlikely to meet their expectations.  

Consumers are aware of how technology can make life easier for them, through tracking progress on particular purchases. For example, if they order a Domino’s pizza, they can track where the order is up to and when it’s due to be delivered; if they order an Uber, they can track the driver’s whereabouts and how far away they are. This is what consumers have come to expect from technology, and compliance legal tech should be addressing this and how clients’ expectations can be met.  

What challenges are law firms facing when it comes to compliance legal tech?

There are a number of challenges now being faced by law firms when it comes to compliance legal tech. 

1. Legal tech buying cycles

One of the challenges faced by law firms relates to the way buying cycles work for technology. It’s quite tempting for law firms to buy individual tech solutions one at a time to solve specific problems as they arise. However, this is causing issues.  

Contracts for legal tech can lock you in for years. Imagine you have one legal tech solution that ties you in for three years. Then, a year later, another problem arises needing a different tech solution, and this ties you in for three years. The more this goes on, how are you ever going to be able to join the dots and get all of your tech working together? This cycle needs to change.  

In an effort to tackle this challenge, law firms should be clear on what their medium-term core tech and application stack is. Once you’ve worked this out, for example, Microsoft, you can plan for all other tech to fit together and tackle issues when they arise. It sounds simple, but many firms don’t do this and it’s a problem we’re currently hearing a lot about.  

2. Finding the right legal tech solution

There are so many different technological solutions, it’s becoming increasingly difficult for law firms to know where to find those tech solutions that will suit your needs.  

The Law Society and the SRA are now working more to signpost firms who are interested in legal tech solutions. But, there’s still more that can be done.   

It’s important to ensure that it: 

  • Solves the problems you face 
  • Is fully compliant  
  • Meets clients’ expectations  

 Our article on finding the right legal tech solution can help when considering technology on the market. 

3. Getting buy-in from lawyers who don’t understand technology

Most often, traditional law firms, particularly high-street firms, don’t have a tech team, and not everyone understands the intricacies of technology. Talking in technology terms can sound alien to most, and something that should be avoided if you want lawyers at your firm to buy into new compliance legal tech.  

The language you use is key when trying to deliver supportive, process-improving technology. Rather than using technology terms, it should be approached from a problem-solving basis, otherwise, you may find yourself just talking into a void. Lawyers are more likely to have an affinity around efficiencies, profitability, client performance, and service standards, as these are the challenges most law firms face.  

You can talk to them about how the proposed new compliance legal tech can help, and the improvements to performance it will bring.  

4. Getting buy-in from law firms that don’t think they’re large enough for legal tech

We often talk about technology for high street firms providing them with an opportunity to level up. That trend has certainly increased over the last few years, especially now we have plug-and-play technologies.  

Several years ago, the sole practitioner of a property practice was able to completely corner the market. This was as a result of her having a direct consumer web interface, a subscription service that clients could log into, and discussion boards. We’re used to this type of interaction these days, but back then, she was way ahead of the curve.  

This just proves that, even back then, you didn’t need huge budgets to benefit from technology. You can still be a contender in the space, you might otherwise have thought, was where the larger law firms with bigger budgets sat. Technology has the potential to unlock so many opportunities.  

The types of technology solutions that are emerging now for high street law firms provides them with a much bigger resource and can even put them on the same playing field as online bankers.  

How can change management help with the adoption of compliance legal tech?

People don’t necessarily like change as it can be disruptive, so change management needs to be built into any plans when adopting new compliance legal tech. That way, you can ensure you’re meeting expectations, and not just proposing a dream solution that isn’t going to work.  

Having open conversations about the change management process is key to ensuring your staff are onboard. Finding people within your business to champion the change and having them work collaboratively with the software developer is a good way to feed the information back to the rest of the firm.  

One thing that staff get concerned about when it comes to legal tech and AI is the fear that they’ll lose their jobs. Technology is about supporting everyone, not about replacing anyone. If efficiencies can be made, why not let tech do the heaving lifting? That way, the lawyers can get on with doing what they do best.  

Over the years, the introduction of technology has already made a massive positive impact on the legal sector. Many conveyancing lawyers will remember that years ago, after completion of property purchases, they had to complete by hand a 20-page Stamp Duty document in black ink. If they got to the last page and made an error, they’d have to start all over again. That specific problem has been solved by tech that we now all use and understand. It’s for the same reason that new legal tech has been introduced – to make efficiencies.  

The reason people train to be lawyers is to become trusted advisors for their clients. The introduction of new technology will enable them to do just that, rather than wasting their time on other tasks that can be done for them. 

Get in touch

If you’d like to talk to us about our latest compliance legal tech, Teal Tracker, simply contact us and we’ll arrange for you to have a demo.

Get in touch

The challenges of compliance legal tech Read More »

People walking on a street seen from behind

How to spot the signs of human trafficking

Anti-Money Laundering, Blogs, Legal Compliance /

Human trafficking, second only to drug trafficking, stands as one of the fastest-growing illegal enterprises worldwide. If we look beyond the immense human costs, it becomes evident that where human trafficking occurs, money changes hands. Law firms can play their part by serving as another line of defence against these terrible crimes by understanding how to spot the signs of human trafficking. 

Given the huge scale and pervasiveness of human trafficking, it’s essential for businesses to be proactive in identifying and addressing this issue within their supply chains. By not understanding how to identify the signs of human trafficking, we can inadvertently expose ourselves to significant risks. It falls upon all of us to make a collective decision not to let this happen on our watch, and to be alert to the red flags that indicate where human slavery may be taking place. 

In this article, we’ll delve into the critical topic of how to spot the signs of human trafficking. As compliance officers and lawyers, your role in combating this heinous crime and its connection to money laundering is vital. By familiarising yourselves with the signs, you can contribute to early detection and intervention, making a difference in the fight against human trafficking.  

The true extent of human trafficking

The true scale and cost of the crime is unknown. The Centre for Social Justice estimates that there are around 100,000 people in the UK in modern slavery, but this figure could just be the tip of the iceberg.  

An annual report from anti-slavery charity, Unseen, shows a 116% increase in calls to its UK Modern Slavery & Exploitation Helpline in 2022 compared to 2021.  

These figures present a bleak reality, exposing the widespread presence of human trafficking in our society. It’s a crime that operates ‘hidden in plain sight’, often occurring right before our eyes. 

The link between money laundering and human trafficking further amplifies the urgency of addressing this issue. A joint report by the Financial Action Task Force (FATF) and the Asia/Pacific Group on Money Laundering (AGF) revealed that this form of crime generates an estimated $150 billion in illicit profits annually. This is a staggering increase of $32 billion compared to a previous report in 2011. These profits stem from the criminal enslavement and exploitation of individuals worldwide. 

The breeding ground for human trafficking lies in the demand for cheap goods, cheap labour, and cheap sex. This exploitative industry thrives on the vulnerability of its victims and perpetuates their suffering. Shockingly, it remains one of the world’s most under-reported crimes, with countless victims suffering in silence. 

Efforts to combat human trafficking have included innovative campaigns, such as the app campaign supported by London’s 10,000 Taxi Drivers. This initiative aimed to eradicate modern slavery in hand car washes by equipping drivers with indicators of forced labour through an app. By raising awareness of the signs of human trafficking and empowering individuals to identify these signs of exploitation, we can collectively work towards dismantling human trafficking networks and providing support to those in need. 

Understanding the link between human trafficking and money laundering

Before we dive into the signs of human trafficking, it’s crucial to grasp the intricate connection between this heinous crime and money laundering. Criminals who engage in human trafficking have a sinister objective not only to exploit vulnerable individuals, but also to conceal the illicit proceeds generated from their abhorrent practices. This is where money laundering comes into play, serving as a tool for these criminals to disguise the origins of their ill-gotten gains and make it exceedingly challenging for law enforcement agencies to trace and intervene. 

Money laundering serves as a critical enabler for human trafficking networks, allowing them to legitimise their illegal profits and integrate them into the formal financial system. By laundering the money, traffickers can create a façade of legitimacy, making it difficult to distinguish between the proceeds from their criminal activities and lawful financial transactions. 

By linking human trafficking and money laundering, criminals not only profit from their exploitative activities, but also further perpetuate the cycle of abuse. The vast amounts of money generated from trafficking are used to fuel other criminal enterprises, perpetuating a cycle of crime that spans across borders and jurisdictions. 

Understanding this intricate connection between human trafficking and money laundering is essential for law firms. By recognising the signs of human trafficking, you can also be on the lookout for potential money laundering activities intertwined with this crime. Identifying and reporting suspicious financial transactions or patterns, you enable you to become an essential part of the collective effort to disrupt and dismantle these criminal networks. 

Understanding the types of human trafficking

Human trafficking involves the deplorable trade of individuals, exploiting them for various purposes, including forced labour, sexual slavery, or commercial sexual exploitation, all serving the interests of the traffickers or others involved.   

The scope of human trafficking extends to horrifying practices such as forced marriages, organ trafficking, and even people smuggling. By understanding the different types of human trafficking, we can better identify the signs and take appropriate action. There are six primary types of human trafficking. 

1. Trafficking for forced labour

This type of trafficking involves the coercion or deception of individuals for forced labour, often in industries such as agriculture, construction, domestic work, manufacturing, or the service sector. Victims are subjected to exploitative working conditions, long hours, minimal pay, and restricted freedom. 

2. Trafficking for forced criminal activities

Traffickers may force individuals, including children, into criminal activities such as drug trafficking, theft, or begging. These victims are often vulnerable and coerced through threats, manipulation, or violence, to participate in illegal activities against their will. 

3. Trafficking for sexual exploitation

This form of trafficking primarily targets women and girls who are coerced or deceived into engaging in commercial sexual activities against their consent. Victims are subjected to physical and emotional abuse, exploitation, and a loss of autonomy over their bodies and lives.

4. Trafficking for the removal of organs

Human trafficking for organ removal involves the illegal trade of organs and tissues, often through the coercion or abduction of individuals. Traffickers exploit the desperation of those in need of organ transplants, causing immense harm to the victims and risking their lives. 

5. Forced marriages

Traffickers can also exploit vulnerable individuals by forcing them into marriage. Victims can be used in this way for the benefit of others who want to enter a country or get access to benefits. It often involves sexual exploitation or servitude.

6. People smuggling

People smuggling refers to the facilitation of illegal entry or transportation of individuals across borders, often involving unauthorised and unsafe means. While distinct from human trafficking, it’s important to recognise the potential overlap, as vulnerable individuals may be subjected to exploitation and abuse during the smuggling process. 

By familiarising ourselves with these different types of human trafficking, we can broaden our understanding of the breadth and depth of this horrendous crime.  

The signs of human trafficking

Identifying the signs of human trafficking is important. There are some specific red flags that lawyers and compliance offices should be aware of when it comes to human trafficking and money laundering.   

While these indicators aren’t definitive proof, they can raise suspicion and warrant further investigation. Here are some potential red flags to keep in mind.  

1. Financial transactions 

There are a number of red flags to look out for in financial transactions, such as:  

  • High volume deposits through bank accounts and immediate withdrawals from border towns 
  • Ongoing ATM/ credit card transactions in even amounts between 10pm and 6am 
  • Credit card payments to online escort services for advertising 

2. Business account activity 

When looking at the activity of a business account, signs may include:  

  • Sudden activity changes in business accounts outside of the client’s expected profile 
  • Structured cash deposits at multiple ban branch locations 

3. Employment practices 

Red flags in employment practices may include:  

  • Workers’ contracts not readily available in a corporate transaction 
  • Observations during client visits, such as the employment of large numbers of migrant workers or the presence of children in and around the premises 

4. Behavioural signs 

There are behavioural signs that may cause suspicion, such as: 

  • Signs such as fearfulness, avoiding eye contact 
  • Hesitancy to talk to strangers 

5. Physical signs 

Certain physical signs of victims may also cause suspicion, as victims may:  

  • Appear to be isolated and rarely allowed to travel on their own 
  • Not possess passports or identification documents that would allow them to travel freely

6. Financial data and due diligence

Law firms that hold financial data as part of their anti-money laundering (AML) checks or during due diligence on a transaction may have an opportunity to spot red flags and gather information that could provide a clearer picture of a potential criminal or money launderer. 

Being alert to the signs of human trafficking is crucial in combating this horrific crime and its connections to money laundering. By familiarising yourself with the potential red flags and incorporating them into your compliance efforts, you can contribute to the early detection and prevention of human trafficking activities.  

If you suspect any form of modern slavery is taking place within your supply chain, or you suspect your client may be involved, flag it immediately with the person responsible for dealing with it at your firm. 

Educating your team and enhancing due diligence

Ensure that your compliance team receives comprehensive training on the signs of human trafficking. By integrating these best practices into your due diligence processes, you can further mitigate the risk of inadvertently supporting human trafficking or money laundering activities. 

You have a crucial role in combating human trafficking and its connection to money laundering. By familiarising yourself with the signs of human trafficking, reporting suspicious activity, and promoting awareness within your organisation, you contribute to a safer society and uphold the values of legal compliance. Remember, every action counts, and together we can make a difference. Stay vigilant, stay informed, and let’s end human trafficking. 

Get in touch

We work with law firms to ensure that anti-money laundering procedures and controls are in place. We also offer practical AML training for all staff, as well as specialist courses for those responsible for compliance. 

If you’d like to speak to one of our experts about how we can help, simply get in touch. 

Get in touch

How to spot the signs of human trafficking Read More »

Desk with coffee, glasses a pen and an assessment book

What are matter based risk assessments?

Anti-Money Laundering, Blogs, Legal Compliance, Risk Management /

Matter-based risk assessments were introduced in the 2017 Money Laundering Regulations (MLR). Fundamentally, the idea is you’re supposed to look at the client and matter, and decide how risky it is for money laundering or terrorist financing. You can then decide on the amount of client due diligence (CDD) you need to do. This is what the matter-based risk assessments are for.

There has been some high-level feedback on the struggles that lawyers are having with the introduction, given that they were all doing CDD before. Firms already had processes and procedures in place which didn’t include this step, and it’s been difficult to try and include it. Nevertheless, this is now the law.

By now, you’ll no doubt have a new process in place that includes matter-based risk assessments. However, this article will help you determine whether your new process is compliant and is going to work.

What does the law say about matter-based risk assessments?

The matter-based risk assessments regulation sits at Regulation 28(12)(a) of the MLR. It states:

“The ways in which a person complies with the requirements to take CDD measures must reflect:

  • The firm’s risk assessment
  • Its assessment of the level of risk arising in any particular case”

The first thing you should be aware of when you look at this is that it was primarily written for banks. When banks talk about commencing a business relationship, that means someone opening a bank account. When someone has an account they can make what constitutes as regulated transactions whenever they want through their bank account.

In the legal sector, this is slightly different. People can’t do transactions using lawyers without them knowing about it. So, the approach taken by banks would be to do a client-based risk assessment when an account is first opened, take the information they have, and set up something called ‘transaction monitoring’. Transaction monitoring is where they would use software to monitor certain behaviours and when something looks odd, this would trigger an alert of possible fraud and may block the account.

When the Regulation talks about ‘the level of risk arising in any particular case’, it’s talking about an account facet of the business relationship. For lawyers, although it doesn’t actually say the word ‘matters’ it means matters.

CDD is a matter-based activity, and the ‘CDD measures’ mentioned in the Regulation come in five parts:

  1. Matter risk assessment
  2. Identify the client
  3. Verify the client
  4. Purpose and nature checks (this is where the source of funds and source of wealth lives)
  5. Ongoing monitoring

So, to complete your CDD measures, you need to make sure that you’re approaching your purpose and nature checks on a matter-by-matter basis. You can return to the same client risk assessment, but you also have to add the particular factors of each matter, if there are any, into the risk assessment.

What does the SRA say about matter-based risk assessments?

The SRA did some work reviewing a number of files in 2019/2020. From that, they commented on the Regulation involving matter-based risk assessments, which included:

 

  • 29% of the files didn’t have a written matter risk assessment: Although the Regulation doesn’t specifically say it has to be written down, it’s clear that the Regulators are looking to see a written record.
  • There was no conclusion following the risk assessment: This is something we see quite a lot. Although it’s unclear why this is the case.
  • Conflict with the firm’s risk assessment: Remember, it states in the Regulation that it must reflect ‘the firm’s risk assessment’. Therefore, if your firm’s risk assessment states that a particular department is high-risk, and you determine that a matter for that department is low-risk, it’s not consistent and they’ll pick up on this.
  • Assumption the E-ID system did it for them: There are systems that incorporate this as part of the process, but one of the things that the regulator is aware of is the over-reliance on technology.

The SRA has expectations that fee earners should know how to do matter-based risk assessments properly and they must reflect the firm’s risk assessment, as there shouldn’t be a conflict between the two documents.

 

What part of matter-based risk assessments are causing lawyers to struggle?

One of the biggest issues we’ve seen is many lawyers are not sure of the purpose of completing a matter-based risk assessment. Although we’ve found that many law firms do have policies in place confirming that matter-based risk assessments are mandatory, there are still blank and incomplete forms on the files.

There are instances when risk assessments have been completed at the start of the matter. However, as further information is gathered, such as the source of funds and source of wealth, or further CDD, the risk assessments aren’t revisited and updated.

Another issue we’ve come across relates to risk assessments being completed to an extent, and the risks are rated low, medium, or high. However, there’s no narrative behind the risk rating, so it’s impossible to see how they’ve come to this conclusion.

Overall, many lawyers tend to carry out risk assessments, but the information they’ve gathered is all in their heads, and in many cases, there’s a failure to write anything down, and this is essential.

Carrying out risk assessments correctly is extremely important as if the SRA carry out an audit on your files, they need to see that you’ve actually considered the risks, recognised any red flags, and identified what level of due diligence should be done for that client.

 

Considering practice or firm-wide risk assessments

There can’t be a conflict between your matter-based risk assessment and your practice or firm-wide risk assessment. It’s therefore important that you get your firm’s risk assessment right.

Your practice or firm-wide risk assessment needs to reflect the National Risk Assessment. This has the following as high-risk:

  • Trust and company service provision: Creation of trust, creation of companies, company secretarial work, and trust administration work are considered high-risk
  • Conveyancing: Both residential conveyancing and commercial property are considered high-risk
  • Misuse of client account: Anything going through the client account is considered high-risk
  • Sham litigation: Although generally litigation is low-risk, sham litigation is an arrangement that’s considered high-risk

As well as reflecting the National Risk Assessment, your firm risk assessment also has to reflect the Regulator Sectoral Risk Assessment.

Considering client risk

The Regulation itself gives you an indication of what high-risk sectors are, such as oil, arms, precious metals, tobacco products, cultural artefacts, ivory. If a client operates in these sectors, they would be considered high-risk clients.

Clients who operate in cash-intensive businesses are also high-risk. These include businesses such as nail bars, car washes, barbers, fast food, and any businesses where people would legitimately pay in cash. Baddies often open businesses like these to launder their dirty money together with the legitimate cash earned.

Politically exposed people (PEPs) are also considered high-risk. The law doesn’t give you much wriggle room in this area. If a client is a politically exposed person and does a certain job, this is high-risk.

The financial Action Task Force (FATF) issues a list of jurisdictions where there’s a particular concern with their ability to handle anti-money laundering. This list is the high-risk third countries list. As FATF can’t take on face value that money from those jurisdictions is genuine, everyone dealing with that money has to check. This is why enhanced due diligence is required on high-risk third countries.

 

Considering matter risk

There has been a recent change in the MLR relating to matter risk. Regulation 19(4)(a)(i)(aa) did state:

“a transaction is complex or unusually large, and there is an unusual pattern of transactions, and…”

This has now changed to:

“a transaction is complex or unusually large, or there is an unusual pattern of transactions, or…”

You’ll note that the words ‘and’ have changed to ‘or’. When the word ‘and’ was included, it suggested that there would need to be a combination of things for it to trigger. However, this is not the case.

We’ve noticed that many firms still have the word ‘and’ in their policies and therefore their matter risk assessment process is looking for a combination rather than any individual factor. So, when lawyers are doing a matter risk assessment which is complex, unusually large, has an unusual pattern of transactions or no economic or legal purpose, these need to be triggered individually.

So, make sure you check your policies and make any necessary changes.

What does LSAG say about matter-based risk assessments?

Each regulator used to publish their own guidance. However, in 2017 the regulators got together and formed the Legal Sector Affinity Group (LASG). LASG then produced one set of guidance, the LASG guidance, to be used across the sector. 

The LASG guidance confirms that matter-based risk assessments should not be a tick-box exercise but suggests you follow the below criteria:

  • Talks about risk ratings
  • Can have a template for similar cases, but it must not become a tick-box exercise
  • Should assess and have regard to negative news results
  • Suggest review of matter-based risk assessments on long-running matters – however, they don’t give an interval of how regular that should be
  • Focus on recording reasoning for assessment
  • Record why you’ve picked the CDD approach

When should you revisit matter-based risk assessments?

We know that there are things you simply can’t answer at the beginning of a case when completing a matter-based risk assessment. That’s why the matter-based risk assessment should be for the life of the file and not just a file-opening exercise.

Therefore, you need to consider all the stages where a matter-based risk assessment is needed. There are three particular stages when we believe this needs to be considered.

  1. When you’ve had an initial conversation with the client. You’ll have as much information as possible and are deciding whether there are any factors from the conversation that are causes for concern. This will determine what level of CDD we should do.
  2. When you’re undertaking CDD. Once you’ve received the documents from the client to undertake CDD, what you receive will either change your initial risk assessment or back it up. In reality, it’s only at this stage that you can do a proper risk assessment as you’ll now have all the CDD information.
  3. Before you potentially launder money. The last point in which to undertake a risk assessment is just before you do anything which could be laundering money. You should stop, revisit your risk assessment and update it before you potentially launder money.

It’s extremely important that you write everything down on your file. If it’s not written down, how are you going to prove that you’ve done it if something goes wrong? Regulators need to see that you’ve covered everything.

What help can be given to lawyers on matter-based risk assessments?

One way of ensuring lawyers complete a risk assessment in the first place is to make it mandatory in order for the file to be opened. However, although this helps ensure they complete one initially, they may only partially complete it or may not revisit and update it at key points of the case. We therefore suggest a three-step approach.

  1. Training: Training is key. Lawyers need to understand the importance of risk assessments and ensuring they receive good quality training can help significantly to drill down that point.
  2. File Reviews: A good way for firms to determine how lawyers are doing with their matter-based risk assessments is through file reviews. You’ll have a chance to discuss any specific issues and identify if there are specific departments that are struggling. This will allow you to revisit the training with them when it’s needed.
  3. Firm-wide risk assessment: If you’ve not already shared your firm-wide risk assessment, this may help. Lawyers will be able to see your thought process towards risk in different departments, and this will help them when completing their matter-based risk assessments.

Following this approach should help lawyers complete their matter-based risk assessments moving forward.

Get in touch

If you need any assistance with policy drafting and reviews, AML audits, or training, simply contact us and one of our experts will be in touch.

Get in touch

What are matter based risk assessments? Read More »