Legal Compliance

Eilish Cullen, Compliance Consultant at Teal Compliance

A day in the life of Eilish Cullen – Senior Associate at Teal Compliance

Anti-Money Laundering, Blogs, Legal Compliance /

If you’re interested in a career in compliance, our senior associate, Eilish Cullen, talks about life at Teal Compliance, and what her work involves. 

About me

I’ve been working as a Senior Associate at Teal Compliance since November 2022. Having previously carried out Teal’s comprehensive Compliance Officer Training Programme, I was already aware of their reputation within the compliance industry. Prior to this, I worked at a small litigation firm in Liverpool and had several roles including Head of Department, Deputy COLP, Director and Complaints Partner. 

In my previous role, I carried out a wide range of tasks including fee-earning, supervision, training, elements of human resources, as well as policy drafting and compliance record keeping.

My role

My day-to day duties, usually consist of:

  • Reading Legal Futures/Law Gazette. Fellow ‘compliance geeks’ will understand the need to keep ourselves informed of Regulatory and AML developments.
  • I try to be active on LinkedIn. It’s a great platform to share our knowledge with clients, potential clients and those in the industry. I think it’s important for our clients to know about the services we provide and to put some personality into what others deem to be a ‘dry subject’.
  • I’ll plan out my day. This could be a Policy Review, Regulatory/AML training, CQS File Reviews or our most popular service – our independent AML Audit.
  • As Associates, we always keep an eye on our inbox for ‘Ask Teal’ enquiries. This is a central inbox where clients contact us seeking urgent guidance, and we aim to provide high-quality expert advice within a short period of time. Some of these can be very technical and tricky but between the Teal Team, we have always been able to assist.

A typical day

Whilst we’re thankful to have flexible working, I tend to work 9am-5pm.

Thankfully, the Management Team at Teal encourage taking regular breaks and are very keen on having good mental health strategies in place – no one wants a burnt-out employee! This means I always take my lunch break, something that didn’t really seem to happen in my last role due to other demands. I definitely feel more productive as a result.

Sometimes your best thoughts come to you whilst walking your dog – who would have thought?

What I love about what I do

One of the reasons I love working at Teal is the sense of job satisfaction I get, something I feel was missing in my last role due to ‘spinning so many plates’ and never truly feeling that I was adding value as a result.

Many of our law firm clients feel the same, with their time and resources being thinly stretched. Here at Teal, I’ve been given the opportunity to provide expert guidance to our clients and help to shape their compliance framework for the better which gives me a great sense of personal achievement. This is why I ‘do what I do’.

Diversity is also something that keeps me motivated. No month at Teal is ever the same! Alongside carrying out independent AML audits, CQS file review and AML training, I have also been selected to participate in round table discussions on financial management and regulatory issues. Having this level of exposure has been extremely beneficial for my career development within Teal.

That said, like many professionals, I’m sometimes plagued with the dreaded ‘imposter syndrome’ and doubt my own capabilities. However, I genuinely think this is counter-balanced by having a supportive and positive team around. Getting good client feedback also helps!

Find out more

To find out more about a career with Teal, visit our careers page.

Find out more

A day in the life of Eilish Cullen – Senior Associate at Teal Compliance Read More »

Filing cabinet draw with file partially lifted out named "suspicious activity reports (SARs)

The potential pitfalls of SARs: 10 ways to avoid them

Anti-Money Laundering, Blogs, Legal Compliance /

Filing Suspicious Activity Reports (SARs) should be a top priority for UK law firms, especially when dealing with situations that raise red flags for potential money laundering. However, the term ‘suspicious’ itself presents a conundrum due to its lack of a precise definition. The ambiguity surrounding suspicion demands clarity in expressing your concerns—not only to protect your firm against legal repercussions, but also to maintain transparency with your clients.

Here, we look at the pitfalls of filing SARs, and provide our top tips to avoid them. 

Battling financial crime

The 2022 Suspicious Activity Report (SARs) Annual Report, released by the National Crime Agency (NCA), presented a clear picture of the evolving landscape of financial misconduct, spanning 2020/21 and 2021/22. The report includes the following:

Setting new records

The report reveals an impressive 21% surge in SARs submissions, reaching a staggering 901,255 in the latest financial year. This increase underscores the growing vigilance within regulated sectors against potential money laundering and criminal activities.

Striking back at criminals

SARs continue to play a pivotal role in halting financial crime. An astounding £305.7 million was denied to suspected ‘baddies’ through Defence Against Money Laundering (DAML) requests – a remarkable 120.6% boost from the previous year’s £138.6 million. This surge reflects the effectiveness of SARs in curbing illicit financial gains.

Adapting to changing scenarios

The pandemic and geopolitical events have emphasised the adaptability and significance of SARs. Criminals exploited the pandemic chaos, underscoring the need for accurate financial intelligence – intelligence that SARs provide. The report highlights the role of SARs, in unearthing money laundering linked to sanctioned individuals and their affiliations, particularly following Russia’s invasion of Ukraine.

The potential pitfalls

Despite the crucial nature of SARs, there’s a challenge when it comes to what constitutes as ‘suspicion’. Cases like Lonsdale v National Westminster Bank plc [2018] EWHC 1843 (QB) have added to the complexity of this issue.

David Lonsdale, a property law barrister, found himself entangled in a situation where his bank accounts were frozen due to suspicions of money laundering.

Mr Lonsdale owned several properties and managed the finances of each of those enterprises with seven separate bank accounts; including one account for his earnings as a barrister, and another two joint accounts.

The bank's actions

In March 2017, NatWest decided to freeze one of his joint accounts for eight days while filing a SAR to the NCA. In December 2017, they froze all of his accounts while filing additional SARs. That same month, NatWest wrote to Mr Lonsdale, informing him that they were going to close all of his accounts, offering no explanation or justification.

Of course, if a bank has genuine suspicion of money laundering, they’re entirely within their rights to file a SAR and freeze accounts.

Mr Lonsdale's response

Mr Lonsdale vehemently objected to the closure of his accounts and the accusation of suspicious activity. Mr Lonsdale demanded an explanation, but the bank refused to discuss the issue. As a result, Mr Lonsdale requested disclosure of the SARs, as well as any notes leading to the decision, recorded against his accounts, under the Data Protection Act 1998 (since superseded by DPA 2018).

In line with DPA laws, the bank provided account data, but refused to share the contents of any of the SARs raised against him. This led Mr Lonsdale to file complaints on the grounds of:

  • Breach of contract
  • Breach of DPA 1998
  • Defamation of character

The bank continued to assert that they weren’t obliged to grant access to the contents of the SARs. This led Mr Lonsdale to escalate the case by making an application to the courts.

The case results

When the case was heard, the judge found in favour in Mr Lonsdale’s application to access the content of the SARs.

The judge stated that suspicion must exceed mere fanciful possibility and acknowledged the absence of a requirement for suspicion to be ‘clear’ or ‘firmly grounded and targeted on specific facts’.

What we learned

The lack of a formal legislative definition for ‘suspicion’ has led to confusion and subjectivity. However, the judge’s response implies that suspicion holds a subjective nature, although it must be genuine.

NatWest was within its rights to take action, as banks can freeze accounts if genuine suspicion exists. However, this case highlighted the need for transparent communication and well-founded suspicions.

It establishes that, in some circumstances, clients may be legally entitled to view a SAR made about them, which could, potentially, lead them to bring a defamation claim against the MLRO if that suspicion turns out to be damaging and incorrect.

10 tips to avoid the pitfalls of SARs

In line with advice from the National Crime Agency (NCA) and the insights from the Lonsdale case, here are ten effective ways to navigate the potential pitfalls when reporting suspicious activity:

1. Clear and concise language

Aim for simplicity over legal jargon. Remember, the ‘reasons for suspicion’ section of the SAR limits your input to 8,000 characters, which translates to about 1,500 words. Clarity is your best ally.

2. Precise reasoning

When expressing your suspicion of money laundering, provide a comprehensive narrative. Address the fundamental questions: Who? What? Where? When? Why? How? Leaving no room for ambiguity.

3. Thorough details

Don’t shy away from specifics. When identifying individuals and businesses involved, include as much detail as possible. If suspected criminal property is in the mix, ensure it’s outlined with precision while adhering to privilege guidelines.

4. Detailed information

Elaborate on every piece of information that contributes to your suspicion. Clearly explain how you encountered this information, creating a transparent trail that others can follow.

5. Distinguish facts from suspicions

Separate hard facts from suspicions. It’s essential to convey what you definitively know from what you suspect. This distinction adds clarity to your report.

6. Chronological sequence

Create a chronological timeline of events that substantiate your suspicion. Be meticulous with dates, providing a clear sequence that supports your case.

7. Justify suspicion

Go beyond a mere declaration of concern. Provide the rationale behind your suspicion. For example, if sizeable third-party transfers are involved, outline whether you contacted the client, explain the inadequacy of their response, and detail how the transfer pattern arouses suspicion.

8. Deviation from the norm

Highlight how the flagged activity differs from normal operations within the specific customer or business sector. This contextual insight strengthens the gravity of your concern.

9. Professional involvement

If your SAR implicates a professional enabler (like an accountant or conveyancer), assess their involvement. Specify whether their participation appears witting and provide reasons for your assessment.

10. Clarity on transactions

Clearly describe whether your suspicion pertains solely to transactions or if it extends to the professional behind them. Transparency in this regard bolsters the effectiveness of your report.

 

Given the potential for vagueness in the term ‘suspicion’, it’s reassuring to know that The Law Commission is working to provide clearer guidance on what constitutes suspicion. In the meantime, adopting these ten tips will bolster the thoroughness and precision of your SARs.

 

Get in touch

If you need advice or guidance with AML compliance, we’re here to help you. Simply get in touch with one of our friendly experts today.

Get in touch

The potential pitfalls of SARs: 10 ways to avoid them Read More »

Hands resting on laptop with Cyber Security on the screen

How law firms can prevent cyber-attacks

Anti-Money Laundering, Blogs, Legal Compliance /

Think of your accounts like your home. You can have the best locks and the best alarms but, if burglars want to get in, they can often find a way. However, having the best locks and the best alarms does deter them, and it’s the same with cybersecurity. You have to do everything you can to prevent cyber-attacks, protecting your law firm and making it as secure as possible.

When looking to prevent cyber-attacks at your law firm, there are a number of things you can do. This blog provides advice on ways to safeguard and limit your law firm’s exposure to cybercrime.

Safeguards to prevent cyber-attacks

There are numerous safeguards to prevent cyber-attacks. Some may seem a little obvious, but it’s important that they’re all in place to protect your law firm to the best of your ability. These are the most important safeguards:

1. Two-factor authentication on all logins

Whatever account you log into, you usually do so with a username or email, and a password. Two-factor authentication is an extra layer of security. Once you’ve input your username and password, you’ll then have an additional task to complete. This could be authorising the login via an app on your phone or computer, or a text message with a one-time-only code. It’s only when you complete this additional task that you’re able to access your account.

Make sure you have two-factor authentication set up on all your accounts, so it’s much more difficult for scammers, or baddies, to access them.

2. Regularly monitor sign-in activity on your account

Many logins, especially email logins, notify you when someone has logged into your account. These notifications can provide information such as who has logged in and where they’ve logged in from, for example, if they’re overseas.

Make sure, where possible, that you have these notifications activated. That way, when a baddie accesses your account, you’ll be able to act swiftly.

It’s important to note that the location may not always be genuine. If the baddies are using a VPN, they may be able to hide their location and make it look like they’re in the UK.

3. Anti-virus protection

Although it sounds obvious, anti-virus protection can significantly increase your security. It can often detect when a website looks odd, or something doesn’t look quite right. It will alert you to potential suspicious activity, giving your law firm an extra layer of protection, making it more difficult for baddies to get into your accounts, and helping you prevent cyber-attacks. Having your IT department test these firewalls is essential to check they are working.

4. Spam filter

The spam filter isn’t always reliable. Although it can detect some potential fraudulent emails and move them to your spam folder, it can often miss them. Also, genuine emails can often get caught up in spam. However, it does add an extra layer of security and makes you think twice about emails that end up in your spam folder.

5. Strong passwords

According to an article by Tech.Co on ‘Securing Accounts in 2023’, it’s quite easy for hackers to guess uncomplicated passwords. If a password is under 10 characters, it will only take 2 weeks to crack, and a simple 10-character password made of numbers or lowercase letters can be cracked in under 24 hours.  

Therefore, making sure your accounts have strong passwords is an extremely important part of safeguarding to help prevent cyber-attacks.

Limiting exposure to cybercrime

In addition to putting safeguarding measures in place to help prevent cyber-attacks, there are various ways in which you can also help limit exposure to cybercrime:

1. Where possible use an app for clients to confirm bank details

There are apps available where clients can confirm their bank details together with the name of the person that’s expected to receive funds and it will confirm their details. Some banks also now match up the recipient’s name. It’s important to note that these tools are useful for guidance, but you can’t rely on them to be 100% accurate.

2. Never accept bank details over email

Pick up the phone, or better still, speak to them in person to get their bank account details. Although we appreciate it’s not always practical to do that.

3. Set up daily payment limits and limits on amounts per transaction

Although this isn’t necessarily practical as a conveyancer, given you’re dealing with transactions of huge amounts of funds all the time, setting up daily payment limits and limits on amounts per transaction can be very beneficial. If you’re unable to do this with your client account, you might want to consider it for your current account.

If you do this, and a baddie does access your account, they’ll be limited to what they can transfer, which limits your exposure to risk.

4. Dual authorisation on banking

Dual authorisation on banking can be really useful. It’s the modern-day equivalent of having two signatures on a cheque. The advantage is, if there is a scam, one person failing to recognise it is possible, but two people failing to recognise it is much less likely.

5. Have more than one bank account

The advantage to having more than one bank account is that if baddies manage to get into one account, they’re only limited to the funds in that account.

Taking a step back from the cybersecurity reasons, there’s also a practical reason for having more than one bank account. Money in most UK banks is under FCS protection. Your money is protected up to £85,000, but anything over £85,000 is not covered by FCS protection. It’s unlikely that more than one bank would go under at any one time and therefore spreading your money across different bank accounts limits your risk.

6. Regular virus checks

Having regular virus checks on all your devices, such as phones, tablets, laptops, and PCs, can significantly reduce risk and prevent cyber-attacks.

7. Have a good IT response

When a cyber-attack takes place, your response time is extremely important. If something were to happen, you need IT support on hand, rather than trying to find someone to help and wasting valuable time. Having someone at the end of the phone, who put your systems on lockdown and limits your exposure is extremely important.

How to prepare for a cyber-attack

It’s important that you prepare for a cyber-attack by ensuring that a firmwide policy is in place which details what should be done in the event of a cyber-attack

It’s also important to ensure that everyone has had the relevant training, which includes how to detect a cyber-attack. The SRA has suggested that you should probably have training every four months as people can easily forget what they have to do, so they need a reminder.

Carrying out a root cause analysis after an attack is important to establish why the attack happened and what measures can be put in place to stop it happening again. 

Cybersecurity insurance

Many people believe that in the event of a cyber-attack, their business or professional indemnity insurance will cover it. However, they don’t actually cover cyber-fraud. 

Insurance companies know that cybercrime is a substantial risk so the cybersecurity insurance they offer usually has an extensive premium and a rather hefty excess. Many law firms when assessing the risks believe that the cost of the premium and excess is so large, that they’re never going to claim on it, and therefore, having it would effectively waste their money.

Because cybercrime is so high-risk, the insurers often put a lot of limitations on the policy as well as expectations on the policyholder. So, if you do have cybersecurity insurance you need to ensure you’re well aware of all of these points and also what the insurers’ reporting requirements are in terms of time periods. Otherwise, you may find yourself in a situation where you pay a lot for a policy that isn’t fit for purpose.

What are the SRA regulations in the event of a cyber-attack?

In the event of a cyber-attack, you need to contact the SRA. As a solicitor, you have certain obligations under the account rules.

If money has been sent to the wrong person from the client’s account, the SRA regulations state that you need to pay that money back into the client’s account immediately. You can’t wait to try and get the money back first.

There was a case where the SRA fined a law firm as they didn’t pay the money back into the client’s account for four months. This was a breach of accounting rules that resulted in a significant fine.

There’s also a requirement to report the incident to the ICO within 72 hours. 

You also need to tell your client. You don’t want your client to find out another way, such as if it ends up on the news, or the regulator contacts them. Be honest and open, even when it’s difficult.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

Get in touch

How law firms can prevent cyber-attacks Read More »

Two office workers touching a cyber security icon on a window screen

How to detect a cyber-attack via email at your law firm

Anti-Money Laundering, Blogs, Legal Compliance /

The SRA recently confirmed that 100% of the reports of cybercrime they had came from email fraud. In addition, 98% targeted conveyancing, as it’s easier for fraudsters or baddies to try and defer large sums of money in this area of law. It’s therefore hugely important that law firms understand how to detect a cyber-attack via email.

This blog explores the various signs to identify suspicious emails that may lead to a cyber-attack via email.

Why do scammers want to access your email account?

Before looking at how to detect a cyber-attack via email, it’s important you understand why baddies want access to your email account.

When they have access to your email account, they can see emails that have come in and gone out of your account. This will give them access to a wide range of data.

This is especially dangerous for law firms as it could include details of transactions that are about to be made, together with personal details of those involved in the transactions. This could significantly help them when they’re trying to commit fraud.

Having access to your email account will also mean the baddies will have access to your calendar. If they’re planning to send fraudulent emails from your account, it’s more likely that they’ll do it when they know you’re not going to be online. That way, there’s more chance of you not noticing suspicious activity until it’s too late, and the damage has already been done.

What are the signs to identify suspicious emails that may lead to a cyber-attack?

When looking at how to detect a cyber-attack via email, there are numerous signs to look out for.

1. Emails with links asking you to sign into your account

The easiest and most common way for baddies to access your email account is by sending you a link, asking you to sign into your account. There are many different ways they do this. It might be an email from an account that appears to be Microsoft or Google, asking you to re-enter your password via a link. It might be an email from another source asking you to log into your email from a link, so you can sign a document. Even if it’s from an email sender you know and trust, their email account may have been hacked.

When you click on these links, the pages you go to are not genuine and instead of logging into your account, your details are stored. So, avoid clicking on these links in emails.

2. Emails saying that bank account details have changed

You’ll no doubt have heard about, or even received, emails that say things like “we’ve just changed our bank details”. Again, even if you trust the sender as you know them, they too may have been hacked, so it’s important to verify this. Give the person a call but don’t use the phone number on the suspicious email.

If you don’t verify this and it is the baddie’s bank account, it’s unlikely that you’ll see that money again.

3. Emails no in the style you'd expect from the sender

When you receive emails from suppliers, colleagues, clients, friends or family, usually, they tend to have their own style, using specific language and terminology. If you receive an email from someone you know, and it doesn’t use the style you’d expect from them, you should consider the email suspicious.

Again, try to authenticate the email by speaking to them, but if you call them, don’t use the number on the suspicious email. Remember, the email might be coming from the genuine sender’s account, but it doesn’t mean it’s them.

Knowing how to detect a cyber-attack via email from someone you don’t know when you don’t know their style, can be trickier. However, you can still consider the style. For example, if it was coming from a lawyer from another company, are they correctly using legal terminology?

Regardless, if anyone is asking you to transfer money, or do something else which may lead to fraud, think twice!

4. Emails with a sense of urgency

Many baddies send emails that ask you to do something as a matter of urgency. This could be something such as, your account will be deleted, or you’ll be fined if you don’t pay within a short space of time. They may even send emails posing as a manager from your business, asking you to transfer money, for example, saying they’re stuck in a conference and urgently need to make a payment, but their card is blocked.

Baddies want you to panic. They know you don’t want accounts to be deleted, get fined, or get in trouble at work, so you’re likely to take action quickly, as you’ve had little time to think.

The SRA recently said that 82% of the breaches that had been reported to them were as a result of human error, due to being under pressure. Therefore, if an email suggests you make a transaction quickly, don’t panic, think twice and do your due diligence.

5. Emails with signatures that are not quite right

Many baddies pose as reputable organisations, such as Gov UK, Royal Mail, high street banks, etc. Therefore, they include an email signature from that organisation, which often includes a logo.

It’s important to always check the email signature as there can be clear signs in detecting a cyber-attack. The signature and disclaimer may not use the right language or terminology or may even have spelling errors. The logo may be pixelated, stretched, or just seem a little off. If the email signature is suspicious, don’t click on any links.

6. Emails with email addresses that are suspicious

You may receive emails that name the sender and appear genuine. However, if you click on, or hover over, the email sender’s name, the full email address can be seen.

Baddies often have email addresses that appear suspicious and don’t fit with the person they’re pretending to be or the company they’re pretending they’re from.

7. Emails that aren't expected

Although we receive emails all the time that we’re not expecting, if you receive an email asking you to do something that may be considered suspicious, and you weren’t expecting that email, this may be a cyber-attack via email.

Again, you can call or speak to the person the email is from to determine whether the email is genuine.

8. Emails from clients saying there are last-minute changes

Just like with AML, emails that ask for last-minute changes, such as changes to the amount to be transferred, or changes to the bank details are suspicious.

Pick up the phone and speak to the client before you carry out any changes that the email suggests. Last-minute changes can be a red flag, so make sure you do your due diligence.

9. Emails on Friday afternoons

In conveyancing, a lot of completions take place on a Friday afternoon. As it’s the end of the week and many people are tired and want to get home for the weekend, it’s when baddies know lawyers are at their most vulnerable. Therefore, a lot of cyber-attacks via email take place on a Friday afternoon. This is called ‘Friday Afternoon Fraud’.

Therefore, make sure you continue to be vigilant on a Friday afternoon. Never act on impulse and get dragged into the urgency of an email, and treat all emails with caution.

Does a telephone call to the sender prevent a cyber-attack via email?

The clear and simple answer is no. The tactics of scammers are becoming more sophisticated and sometimes, you can make a call to the sender to check if the email is real, and actually end up speaking to the baddie!

When you get a phone number to call, you should also do your due diligence on that phone number. Check their website, check directories and do internet searches on the phone number to check if it’s genuine. If the phone number isn’t the genuine phone number of the genuine person, you’re more likely to find an inconsistency somewhere.

It’s important to note that there have been times when numbers appear genuine, even after due diligence checks. So, you really need to watch out for the other signs and be extremely cautious.

If you’ve fallen victim to a cyber-attack via email and transferred funds, can the recipient’s bank help?

If you find out you’ve fallen victim to one of these scams and transferred funds, the speed of your response is extremely important.

Don’t wait for your bank to contact the recipient’s bank. Find out which bank the money has been transferred to, by checking the sort code. Then, phone that bank, explain the situation, and ask them to put a hold on the recipient’s account. Although the recipient’s bank is under no obligation to do this for you, you may get someone on the line who’s willing to cooperate with you.

Remember, you don’t have days to stop the recipient from taking money from their account, but hours or even minutes. If you leave it too long, the baddies are likely to have cleared that account and you’re unlikely to ever see that money again.

Preparing for a cyber-attack

With every preventative measure in place, cyber-attacks can still happen. That’s why it’s extremely important to have a process in place in the event that one does happen.

We’ve prepared a useful guide on preparing for a cyber-attack which you may find helpful.

Get in touch

If you need advice or would like to talk to us about one of our products or services, simply get in touch and one of our experts will be happy to help.

Get in touch

How to detect a cyber-attack via email at your law firm Read More »

Man with PC and two laptops set up on a desk

The challenges of compliance legal tech

Anti-Money Laundering, Blogs, Legal Compliance /

Leveraging compliance legal tech enables lawyers to get on with doing what they do best. It should be considered a partnership, with technology doing some of the heavy lifting involved in the daily administrative tasks that eat into lawyers’ billable hours.   

Although many advancements have been made in recent years, there are still challenges that are faced by law firms when adopting compliance legal tech.  

How has law firms’ appetite for legal tech changed since the pandemic?

Of course, the pandemic expedited many law firms’ plans to digitise the operations side of their practice. They had to find legal tech solutions overnight, such as digital postroom services, AML, KYC, and digital onboarding solutions, to enable their business to move to a ‘working from home’ environment.  

As a result, legal tech solutions were implemented with an urgency bias, so their appetite for tech was based on survival. It wasn’t necessarily about solving the problems they already had, it was about finding a way for firms to continue with as little interruption as possible.  

The legal tech implemented at the time was able to fulfil that need. However, what many firms are now left with is a number of digitised processes that often don’t speak to each other, and all need to be managed individually. This can be extremely time-consuming and complex.  

Therefore, the appetite law firms have for compliance legal tech has now changed. They were able to see how the legal tech worked for them during the pandemic in order for them to survive, and they’re now looking at it strategically. They want consolidation, and to build a future-proofed data and application ecosystem that’s incredibly strong.  

With teams now working differently – some working hybrid, some working from home, and some full-time in the office – law firms need to make sure there’s a collaborative tool so everyone can keep their fingers on the pulse.  

How has legal tech changed consumers’ expectations since the pandemic?

You’ll no doubt have read stories in the early days of the pandemic about people meeting in car parks to sign deeds over a car bonnet. In the digital world we were living in, this didn’t provide clients with a positive legal experience.  

As law firms adapted to the pandemic by implementing new legal tech, clients were able to see how legal tasks could be done immediately and recognised the significant benefits. This has obviously increased consumers’ expectations of tech within the legal sector.  

Consumers’ increased expectations have given rise to suppliers and other organisations within the legal sector to look at improving processes through legal tech. With more refined legal tech being implemented, the challenge law firms have now is how to link all these processes together effectively and make compliance processes seamless for their lawyers, and also their clients.  

There are already some systems that make the onboarding process easy for consumers. Clients no longer have to find time in their lunch hour to take their documents into a solicitors’ office or find someone to certify them. However, if the next part of the client’s journey isn’t similarly optimised, and they still have to go into the office to sign documents or get an update, this is unlikely to meet their expectations.  

Consumers are aware of how technology can make life easier for them, through tracking progress on particular purchases. For example, if they order a Domino’s pizza, they can track where the order is up to and when it’s due to be delivered; if they order an Uber, they can track the driver’s whereabouts and how far away they are. This is what consumers have come to expect from technology, and compliance legal tech should be addressing this and how clients’ expectations can be met.  

What challenges are law firms facing when it comes to compliance legal tech?

There are a number of challenges now being faced by law firms when it comes to compliance legal tech. 

1. Legal tech buying cycles

One of the challenges faced by law firms relates to the way buying cycles work for technology. It’s quite tempting for law firms to buy individual tech solutions one at a time to solve specific problems as they arise. However, this is causing issues.  

Contracts for legal tech can lock you in for years. Imagine you have one legal tech solution that ties you in for three years. Then, a year later, another problem arises needing a different tech solution, and this ties you in for three years. The more this goes on, how are you ever going to be able to join the dots and get all of your tech working together? This cycle needs to change.  

In an effort to tackle this challenge, law firms should be clear on what their medium-term core tech and application stack is. Once you’ve worked this out, for example, Microsoft, you can plan for all other tech to fit together and tackle issues when they arise. It sounds simple, but many firms don’t do this and it’s a problem we’re currently hearing a lot about.  

2. Finding the right legal tech solution

There are so many different technological solutions, it’s becoming increasingly difficult for law firms to know where to find those tech solutions that will suit your needs.  

The Law Society and the SRA are now working more to signpost firms who are interested in legal tech solutions. But, there’s still more that can be done.   

It’s important to ensure that it: 

  • Solves the problems you face 
  • Is fully compliant  
  • Meets clients’ expectations  

 Our article on finding the right legal tech solution can help when considering technology on the market. 

3. Getting buy-in from lawyers who don’t understand technology

Most often, traditional law firms, particularly high-street firms, don’t have a tech team, and not everyone understands the intricacies of technology. Talking in technology terms can sound alien to most, and something that should be avoided if you want lawyers at your firm to buy into new compliance legal tech.  

The language you use is key when trying to deliver supportive, process-improving technology. Rather than using technology terms, it should be approached from a problem-solving basis, otherwise, you may find yourself just talking into a void. Lawyers are more likely to have an affinity around efficiencies, profitability, client performance, and service standards, as these are the challenges most law firms face.  

You can talk to them about how the proposed new compliance legal tech can help, and the improvements to performance it will bring.  

4. Getting buy-in from law firms that don’t think they’re large enough for legal tech

We often talk about technology for high street firms providing them with an opportunity to level up. That trend has certainly increased over the last few years, especially now we have plug-and-play technologies.  

Several years ago, the sole practitioner of a property practice was able to completely corner the market. This was as a result of her having a direct consumer web interface, a subscription service that clients could log into, and discussion boards. We’re used to this type of interaction these days, but back then, she was way ahead of the curve.  

This just proves that, even back then, you didn’t need huge budgets to benefit from technology. You can still be a contender in the space, you might otherwise have thought, was where the larger law firms with bigger budgets sat. Technology has the potential to unlock so many opportunities.  

The types of technology solutions that are emerging now for high street law firms provides them with a much bigger resource and can even put them on the same playing field as online bankers.  

How can change management help with the adoption of compliance legal tech?

People don’t necessarily like change as it can be disruptive, so change management needs to be built into any plans when adopting new compliance legal tech. That way, you can ensure you’re meeting expectations, and not just proposing a dream solution that isn’t going to work.  

Having open conversations about the change management process is key to ensuring your staff are onboard. Finding people within your business to champion the change and having them work collaboratively with the software developer is a good way to feed the information back to the rest of the firm.  

One thing that staff get concerned about when it comes to legal tech and AI is the fear that they’ll lose their jobs. Technology is about supporting everyone, not about replacing anyone. If efficiencies can be made, why not let tech do the heaving lifting? That way, the lawyers can get on with doing what they do best.  

Over the years, the introduction of technology has already made a massive positive impact on the legal sector. Many conveyancing lawyers will remember that years ago, after completion of property purchases, they had to complete by hand a 20-page Stamp Duty document in black ink. If they got to the last page and made an error, they’d have to start all over again. That specific problem has been solved by tech that we now all use and understand. It’s for the same reason that new legal tech has been introduced – to make efficiencies.  

The reason people train to be lawyers is to become trusted advisors for their clients. The introduction of new technology will enable them to do just that, rather than wasting their time on other tasks that can be done for them. 

Get in touch

If you’d like to talk to us about our latest compliance legal tech, Teal Tracker, simply contact us and we’ll arrange for you to have a demo.

Get in touch

The challenges of compliance legal tech Read More »

Two people reviewing a tablet at a desk which also has a keyboard

Finding the right legal tech solutions

Anti-Money Laundering, Compliance Training, Legal Compliance, Regulatory Compliance /

Going back 10 years, finding the right legal tech was fairly easy, as case management systems were probably the only legal tech solutions law firms had to buy. Now, there are so many different technological solutions, how do you find out what legal tech is out there, and which is the best for you?

Finding the right legal tech is getting easier as the Law Society and the SRA are doing a much better job at signposting firms who are interested in legal tech solutions. The SRA has now introduced SRA Sandbox, which isn’t just for tech firms, but also for law firms that want to know what’s available. However, there’s still more that can be done.  

Suppliers also need to help get the message out to law firms and advise them on what due diligence questions should be asked. In AML, regulators have actually put an obligation on law firms to ensure that they’ve understood exactly how their legal tech works, the data sources they’re accessing, and how it solves their problems.

At Teal, we not only want to provide law firms with reassurance that we’ve gone through all the rules and requirements they need to comply with, but we also want to ensure they’re aware that if they use a technological solution, it’s not just got to be compliant. It also has to be tangibly better than before.  

This article provides helpful advice and things to consider when you’re finding the right legal tech solution for your firm.

Understanding the problems

You need to start the process by asking yourself ‘why’. Why do you need to a find legal tech solution? What problems will it solve? It’s only by understanding the problems you face in the first place, that you can really start your journey to find the right legal tech solution for you.

We all know what pain points may lead you to consider legal tech, such as the business isn’t making enough money, it isn’t profitable enough, or you can’t turn around the process quickly enough.

Not only do you need to understand the problems, but also the goals which you’re trying to reach. It’s only when you fully understand your problems and your goals, that you can really focus your efforts on finding the right legal tech to fix them.

How to work out what the problems are

This doesn’t need to be a difficult or time consuming exercise. It’s actually incredibly simple. Firstly, split the work types and ask questions such as:

  • Who’s delivering this task – lawyers or support staff?
  • How is this being delivered internally at the moment?
  • Is it part of a workflow?
  • How many units are the lawyers spending on it?
  • Could it be delivered by technology?

Once you’ve done this, you’ll start to see exactly what’s required. For example, you’ll notice if a fee earner is spending 9 units doing something which could be done by technology without taking any time at all.

An exercise like this should only take an hour or two and provides you with quick visibility of what your problems might be.

Collaboration of skills

The phrase ‘built by lawyers for lawyers’ often gets criticism. However, having lawyers building tech means they can add a level of knowledge which can be essential. Software developers who don’t understand policy, processes, and regulations can find that side of it really difficult.

However, software developers without legal knowledge build for the user experience (UX), whether the legal tech is for the client, the lawyer, or both. That UX is extremely important if the legal tech is going to work.

This is why building software collaboratively is key. It needs diverse thought when looking at what data lawyers need and what consumers need.

Collaboration within your law firm is also of paramount importance. When finding the right legal tech solution, different stakeholders, such as IT, the MLRO, finance, and the lawyers, will all have different questions. You should try to involve all concerned early on in the process to ensure transparency and that nothing is missed.

It’s all about a collaborative and diverse approach to solving problems.

The importance of integration

Integration is fundamental. However, first and foremost, it’s about problem solving with interconnectedness.

A lot of people in the market are talking about having an interoperable framework that’s going to solve all their problems. However, when finding the right legal tech, as we’ve previously mentioned, you have to start by asking ‘Why’. If you just focus on integration, you may end up with a number of technology integrations rather than having an interconnective framework.

Therefore, rather than focusing on whether the software solution integrates, the focus should be on how they all fit together as a framework.

Integration is expanding beyond our legal horizons. In the conveyancing world there’s a lot going on with regard to upfront material information. Estate agents are now starting to service information that previously has been in a conveyancer’s file before a conveyancer has even been instructed. This leads to many additional questions about what regulatory environment it sits in and how we pass that in a confidential manner between parties, in addition to making sure all the various boxes are ticked.

This is something we see coming in lots of legal work types, and that will bring a lot of opportunities. In AML, we can remove duplication and enhance the checks we’re doing from a fraud risk point of view. This will make sure those barriers are in place earlier in the process, which should hopefully make everyone’s lives easier.

Questions to ask software providers

Many law firms don’t have a tech team in place. For these firms, knowing how to ensure buy-in success when they don’t necessarily have the tech knowledge is difficult.  

Depending on your problems and your goals, the questions will be different. You may be looking at a process for cost optimisation, or one to deliver an exceptional client experience.

Before you start, you may wish to consider instructing a consultant to help you with this. They should deliver value for money, so don’t be afraid to pay someone for advice if you don’t know the questions to ask.

The basic questions to consider asking include:

  • How much is it going to cost, per user, per seat per transaction?
  • What are the returns on investment going to be?
  • Who’s going to deal with any training – is that provided?
  • Who imports the data from old systems?
  • What security does it have – is it encrypted, where is the data stored, etc?
  • Is it a web app and if so, do lawyers and clients have to download it?
  • If it’s a web app, is it available on iOS and Android?

When finding the right legal tech solution, it can be really difficult to make those decisions. One thing you shouldn’t do is choose based on the fact that it’s working for another firm. As it’s all about finding the solution to your problems, what works for them, won’t necessarily work for you.

Therefore, once you’ve asked the basic questions, you really need to delve into the problems you have and get the suppliers to tell you exactly how the tech will meet your needs. By doing this, you’re more likely to find the right solution for you.

Get in touch

If you’d like to talk to us about our latest compliance legal tech, Teal Tracker, simply contact us and we’ll arrange for you to have a demo.

Get in touch

Finding the right legal tech solutions Read More »

People walking on a street seen from behind

How to spot the signs of human trafficking

Anti-Money Laundering, Blogs, Legal Compliance /

Human trafficking, second only to drug trafficking, stands as one of the fastest-growing illegal enterprises worldwide. If we look beyond the immense human costs, it becomes evident that where human trafficking occurs, money changes hands. Law firms can play their part by serving as another line of defence against these terrible crimes by understanding how to spot the signs of human trafficking. 

Given the huge scale and pervasiveness of human trafficking, it’s essential for businesses to be proactive in identifying and addressing this issue within their supply chains. By not understanding how to identify the signs of human trafficking, we can inadvertently expose ourselves to significant risks. It falls upon all of us to make a collective decision not to let this happen on our watch, and to be alert to the red flags that indicate where human slavery may be taking place. 

In this article, we’ll delve into the critical topic of how to spot the signs of human trafficking. As compliance officers and lawyers, your role in combating this heinous crime and its connection to money laundering is vital. By familiarising yourselves with the signs, you can contribute to early detection and intervention, making a difference in the fight against human trafficking.  

The true extent of human trafficking

The true scale and cost of the crime is unknown. The Centre for Social Justice estimates that there are around 100,000 people in the UK in modern slavery, but this figure could just be the tip of the iceberg.  

An annual report from anti-slavery charity, Unseen, shows a 116% increase in calls to its UK Modern Slavery & Exploitation Helpline in 2022 compared to 2021.  

These figures present a bleak reality, exposing the widespread presence of human trafficking in our society. It’s a crime that operates ‘hidden in plain sight’, often occurring right before our eyes. 

The link between money laundering and human trafficking further amplifies the urgency of addressing this issue. A joint report by the Financial Action Task Force (FATF) and the Asia/Pacific Group on Money Laundering (AGF) revealed that this form of crime generates an estimated $150 billion in illicit profits annually. This is a staggering increase of $32 billion compared to a previous report in 2011. These profits stem from the criminal enslavement and exploitation of individuals worldwide. 

The breeding ground for human trafficking lies in the demand for cheap goods, cheap labour, and cheap sex. This exploitative industry thrives on the vulnerability of its victims and perpetuates their suffering. Shockingly, it remains one of the world’s most under-reported crimes, with countless victims suffering in silence. 

Efforts to combat human trafficking have included innovative campaigns, such as the app campaign supported by London’s 10,000 Taxi Drivers. This initiative aimed to eradicate modern slavery in hand car washes by equipping drivers with indicators of forced labour through an app. By raising awareness of the signs of human trafficking and empowering individuals to identify these signs of exploitation, we can collectively work towards dismantling human trafficking networks and providing support to those in need. 

Understanding the link between human trafficking and money laundering

Before we dive into the signs of human trafficking, it’s crucial to grasp the intricate connection between this heinous crime and money laundering. Criminals who engage in human trafficking have a sinister objective not only to exploit vulnerable individuals, but also to conceal the illicit proceeds generated from their abhorrent practices. This is where money laundering comes into play, serving as a tool for these criminals to disguise the origins of their ill-gotten gains and make it exceedingly challenging for law enforcement agencies to trace and intervene. 

Money laundering serves as a critical enabler for human trafficking networks, allowing them to legitimise their illegal profits and integrate them into the formal financial system. By laundering the money, traffickers can create a façade of legitimacy, making it difficult to distinguish between the proceeds from their criminal activities and lawful financial transactions. 

By linking human trafficking and money laundering, criminals not only profit from their exploitative activities, but also further perpetuate the cycle of abuse. The vast amounts of money generated from trafficking are used to fuel other criminal enterprises, perpetuating a cycle of crime that spans across borders and jurisdictions. 

Understanding this intricate connection between human trafficking and money laundering is essential for law firms. By recognising the signs of human trafficking, you can also be on the lookout for potential money laundering activities intertwined with this crime. Identifying and reporting suspicious financial transactions or patterns, you enable you to become an essential part of the collective effort to disrupt and dismantle these criminal networks. 

Understanding the types of human trafficking

Human trafficking involves the deplorable trade of individuals, exploiting them for various purposes, including forced labour, sexual slavery, or commercial sexual exploitation, all serving the interests of the traffickers or others involved.   

The scope of human trafficking extends to horrifying practices such as forced marriages, organ trafficking, and even people smuggling. By understanding the different types of human trafficking, we can better identify the signs and take appropriate action. There are six primary types of human trafficking. 

1. Trafficking for forced labour

This type of trafficking involves the coercion or deception of individuals for forced labour, often in industries such as agriculture, construction, domestic work, manufacturing, or the service sector. Victims are subjected to exploitative working conditions, long hours, minimal pay, and restricted freedom. 

2. Trafficking for forced criminal activities

Traffickers may force individuals, including children, into criminal activities such as drug trafficking, theft, or begging. These victims are often vulnerable and coerced through threats, manipulation, or violence, to participate in illegal activities against their will. 

3. Trafficking for sexual exploitation

This form of trafficking primarily targets women and girls who are coerced or deceived into engaging in commercial sexual activities against their consent. Victims are subjected to physical and emotional abuse, exploitation, and a loss of autonomy over their bodies and lives.

4. Trafficking for the removal of organs

Human trafficking for organ removal involves the illegal trade of organs and tissues, often through the coercion or abduction of individuals. Traffickers exploit the desperation of those in need of organ transplants, causing immense harm to the victims and risking their lives. 

5. Forced marriages

Traffickers can also exploit vulnerable individuals by forcing them into marriage. Victims can be used in this way for the benefit of others who want to enter a country or get access to benefits. It often involves sexual exploitation or servitude.

6. People smuggling

People smuggling refers to the facilitation of illegal entry or transportation of individuals across borders, often involving unauthorised and unsafe means. While distinct from human trafficking, it’s important to recognise the potential overlap, as vulnerable individuals may be subjected to exploitation and abuse during the smuggling process. 

By familiarising ourselves with these different types of human trafficking, we can broaden our understanding of the breadth and depth of this horrendous crime.  

The signs of human trafficking

Identifying the signs of human trafficking is important. There are some specific red flags that lawyers and compliance offices should be aware of when it comes to human trafficking and money laundering.   

While these indicators aren’t definitive proof, they can raise suspicion and warrant further investigation. Here are some potential red flags to keep in mind.  

1. Financial transactions 

There are a number of red flags to look out for in financial transactions, such as:  

  • High volume deposits through bank accounts and immediate withdrawals from border towns 
  • Ongoing ATM/ credit card transactions in even amounts between 10pm and 6am 
  • Credit card payments to online escort services for advertising 

2. Business account activity 

When looking at the activity of a business account, signs may include:  

  • Sudden activity changes in business accounts outside of the client’s expected profile 
  • Structured cash deposits at multiple ban branch locations 

3. Employment practices 

Red flags in employment practices may include:  

  • Workers’ contracts not readily available in a corporate transaction 
  • Observations during client visits, such as the employment of large numbers of migrant workers or the presence of children in and around the premises 

4. Behavioural signs 

There are behavioural signs that may cause suspicion, such as: 

  • Signs such as fearfulness, avoiding eye contact 
  • Hesitancy to talk to strangers 

5. Physical signs 

Certain physical signs of victims may also cause suspicion, as victims may:  

  • Appear to be isolated and rarely allowed to travel on their own 
  • Not possess passports or identification documents that would allow them to travel freely

6. Financial data and due diligence

Law firms that hold financial data as part of their anti-money laundering (AML) checks or during due diligence on a transaction may have an opportunity to spot red flags and gather information that could provide a clearer picture of a potential criminal or money launderer. 

Being alert to the signs of human trafficking is crucial in combating this horrific crime and its connections to money laundering. By familiarising yourself with the potential red flags and incorporating them into your compliance efforts, you can contribute to the early detection and prevention of human trafficking activities.  

If you suspect any form of modern slavery is taking place within your supply chain, or you suspect your client may be involved, flag it immediately with the person responsible for dealing with it at your firm. 

Educating your team and enhancing due diligence

Ensure that your compliance team receives comprehensive training on the signs of human trafficking. By integrating these best practices into your due diligence processes, you can further mitigate the risk of inadvertently supporting human trafficking or money laundering activities. 

You have a crucial role in combating human trafficking and its connection to money laundering. By familiarising yourself with the signs of human trafficking, reporting suspicious activity, and promoting awareness within your organisation, you contribute to a safer society and uphold the values of legal compliance. Remember, every action counts, and together we can make a difference. Stay vigilant, stay informed, and let’s end human trafficking. 

Get in touch

We work with law firms to ensure that anti-money laundering procedures and controls are in place. We also offer practical AML training for all staff, as well as specialist courses for those responsible for compliance. 

If you’d like to speak to one of our experts about how we can help, simply get in touch. 

Get in touch

How to spot the signs of human trafficking Read More »

Desk with coffee, glasses a pen and an assessment book

What are matter based risk assessments?

Anti-Money Laundering, Blogs, Legal Compliance, Risk Management /

Matter-based risk assessments were introduced in the 2017 Money Laundering Regulations (MLR). Fundamentally, the idea is you’re supposed to look at the client and matter, and decide how risky it is for money laundering or terrorist financing. You can then decide on the amount of client due diligence (CDD) you need to do. This is what the matter-based risk assessments are for.

There has been some high-level feedback on the struggles that lawyers are having with the introduction, given that they were all doing CDD before. Firms already had processes and procedures in place which didn’t include this step, and it’s been difficult to try and include it. Nevertheless, this is now the law.

By now, you’ll no doubt have a new process in place that includes matter-based risk assessments. However, this article will help you determine whether your new process is compliant and is going to work.

What does the law say about matter-based risk assessments?

The matter-based risk assessments regulation sits at Regulation 28(12)(a) of the MLR. It states:

“The ways in which a person complies with the requirements to take CDD measures must reflect:

  • The firm’s risk assessment
  • Its assessment of the level of risk arising in any particular case”

The first thing you should be aware of when you look at this is that it was primarily written for banks. When banks talk about commencing a business relationship, that means someone opening a bank account. When someone has an account they can make what constitutes as regulated transactions whenever they want through their bank account.

In the legal sector, this is slightly different. People can’t do transactions using lawyers without them knowing about it. So, the approach taken by banks would be to do a client-based risk assessment when an account is first opened, take the information they have, and set up something called ‘transaction monitoring’. Transaction monitoring is where they would use software to monitor certain behaviours and when something looks odd, this would trigger an alert of possible fraud and may block the account.

When the Regulation talks about ‘the level of risk arising in any particular case’, it’s talking about an account facet of the business relationship. For lawyers, although it doesn’t actually say the word ‘matters’ it means matters.

CDD is a matter-based activity, and the ‘CDD measures’ mentioned in the Regulation come in five parts:

  1. Matter risk assessment
  2. Identify the client
  3. Verify the client
  4. Purpose and nature checks (this is where the source of funds and source of wealth lives)
  5. Ongoing monitoring

So, to complete your CDD measures, you need to make sure that you’re approaching your purpose and nature checks on a matter-by-matter basis. You can return to the same client risk assessment, but you also have to add the particular factors of each matter, if there are any, into the risk assessment.

What does the SRA say about matter-based risk assessments?

The SRA did some work reviewing a number of files in 2019/2020. From that, they commented on the Regulation involving matter-based risk assessments, which included:

 

  • 29% of the files didn’t have a written matter risk assessment: Although the Regulation doesn’t specifically say it has to be written down, it’s clear that the Regulators are looking to see a written record.
  • There was no conclusion following the risk assessment: This is something we see quite a lot. Although it’s unclear why this is the case.
  • Conflict with the firm’s risk assessment: Remember, it states in the Regulation that it must reflect ‘the firm’s risk assessment’. Therefore, if your firm’s risk assessment states that a particular department is high-risk, and you determine that a matter for that department is low-risk, it’s not consistent and they’ll pick up on this.
  • Assumption the E-ID system did it for them: There are systems that incorporate this as part of the process, but one of the things that the regulator is aware of is the over-reliance on technology.

The SRA has expectations that fee earners should know how to do matter-based risk assessments properly and they must reflect the firm’s risk assessment, as there shouldn’t be a conflict between the two documents.

 

What part of matter-based risk assessments are causing lawyers to struggle?

One of the biggest issues we’ve seen is many lawyers are not sure of the purpose of completing a matter-based risk assessment. Although we’ve found that many law firms do have policies in place confirming that matter-based risk assessments are mandatory, there are still blank and incomplete forms on the files.

There are instances when risk assessments have been completed at the start of the matter. However, as further information is gathered, such as the source of funds and source of wealth, or further CDD, the risk assessments aren’t revisited and updated.

Another issue we’ve come across relates to risk assessments being completed to an extent, and the risks are rated low, medium, or high. However, there’s no narrative behind the risk rating, so it’s impossible to see how they’ve come to this conclusion.

Overall, many lawyers tend to carry out risk assessments, but the information they’ve gathered is all in their heads, and in many cases, there’s a failure to write anything down, and this is essential.

Carrying out risk assessments correctly is extremely important as if the SRA carry out an audit on your files, they need to see that you’ve actually considered the risks, recognised any red flags, and identified what level of due diligence should be done for that client.

 

Considering practice or firm-wide risk assessments

There can’t be a conflict between your matter-based risk assessment and your practice or firm-wide risk assessment. It’s therefore important that you get your firm’s risk assessment right.

Your practice or firm-wide risk assessment needs to reflect the National Risk Assessment. This has the following as high-risk:

  • Trust and company service provision: Creation of trust, creation of companies, company secretarial work, and trust administration work are considered high-risk
  • Conveyancing: Both residential conveyancing and commercial property are considered high-risk
  • Misuse of client account: Anything going through the client account is considered high-risk
  • Sham litigation: Although generally litigation is low-risk, sham litigation is an arrangement that’s considered high-risk

As well as reflecting the National Risk Assessment, your firm risk assessment also has to reflect the Regulator Sectoral Risk Assessment.

Considering client risk

The Regulation itself gives you an indication of what high-risk sectors are, such as oil, arms, precious metals, tobacco products, cultural artefacts, ivory. If a client operates in these sectors, they would be considered high-risk clients.

Clients who operate in cash-intensive businesses are also high-risk. These include businesses such as nail bars, car washes, barbers, fast food, and any businesses where people would legitimately pay in cash. Baddies often open businesses like these to launder their dirty money together with the legitimate cash earned.

Politically exposed people (PEPs) are also considered high-risk. The law doesn’t give you much wriggle room in this area. If a client is a politically exposed person and does a certain job, this is high-risk.

The financial Action Task Force (FATF) issues a list of jurisdictions where there’s a particular concern with their ability to handle anti-money laundering. This list is the high-risk third countries list. As FATF can’t take on face value that money from those jurisdictions is genuine, everyone dealing with that money has to check. This is why enhanced due diligence is required on high-risk third countries.

 

Considering matter risk

There has been a recent change in the MLR relating to matter risk. Regulation 19(4)(a)(i)(aa) did state:

“a transaction is complex or unusually large, and there is an unusual pattern of transactions, and…”

This has now changed to:

“a transaction is complex or unusually large, or there is an unusual pattern of transactions, or…”

You’ll note that the words ‘and’ have changed to ‘or’. When the word ‘and’ was included, it suggested that there would need to be a combination of things for it to trigger. However, this is not the case.

We’ve noticed that many firms still have the word ‘and’ in their policies and therefore their matter risk assessment process is looking for a combination rather than any individual factor. So, when lawyers are doing a matter risk assessment which is complex, unusually large, has an unusual pattern of transactions or no economic or legal purpose, these need to be triggered individually.

So, make sure you check your policies and make any necessary changes.

What does LSAG say about matter-based risk assessments?

Each regulator used to publish their own guidance. However, in 2017 the regulators got together and formed the Legal Sector Affinity Group (LASG). LASG then produced one set of guidance, the LASG guidance, to be used across the sector. 

The LASG guidance confirms that matter-based risk assessments should not be a tick-box exercise but suggests you follow the below criteria:

  • Talks about risk ratings
  • Can have a template for similar cases, but it must not become a tick-box exercise
  • Should assess and have regard to negative news results
  • Suggest review of matter-based risk assessments on long-running matters – however, they don’t give an interval of how regular that should be
  • Focus on recording reasoning for assessment
  • Record why you’ve picked the CDD approach

When should you revisit matter-based risk assessments?

We know that there are things you simply can’t answer at the beginning of a case when completing a matter-based risk assessment. That’s why the matter-based risk assessment should be for the life of the file and not just a file-opening exercise.

Therefore, you need to consider all the stages where a matter-based risk assessment is needed. There are three particular stages when we believe this needs to be considered.

  1. When you’ve had an initial conversation with the client. You’ll have as much information as possible and are deciding whether there are any factors from the conversation that are causes for concern. This will determine what level of CDD we should do.
  2. When you’re undertaking CDD. Once you’ve received the documents from the client to undertake CDD, what you receive will either change your initial risk assessment or back it up. In reality, it’s only at this stage that you can do a proper risk assessment as you’ll now have all the CDD information.
  3. Before you potentially launder money. The last point in which to undertake a risk assessment is just before you do anything which could be laundering money. You should stop, revisit your risk assessment and update it before you potentially launder money.

It’s extremely important that you write everything down on your file. If it’s not written down, how are you going to prove that you’ve done it if something goes wrong? Regulators need to see that you’ve covered everything.

What help can be given to lawyers on matter-based risk assessments?

One way of ensuring lawyers complete a risk assessment in the first place is to make it mandatory in order for the file to be opened. However, although this helps ensure they complete one initially, they may only partially complete it or may not revisit and update it at key points of the case. We therefore suggest a three-step approach.

  1. Training: Training is key. Lawyers need to understand the importance of risk assessments and ensuring they receive good quality training can help significantly to drill down that point.
  2. File Reviews: A good way for firms to determine how lawyers are doing with their matter-based risk assessments is through file reviews. You’ll have a chance to discuss any specific issues and identify if there are specific departments that are struggling. This will allow you to revisit the training with them when it’s needed.
  3. Firm-wide risk assessment: If you’ve not already shared your firm-wide risk assessment, this may help. Lawyers will be able to see your thought process towards risk in different departments, and this will help them when completing their matter-based risk assessments.

Following this approach should help lawyers complete their matter-based risk assessments moving forward.

Get in touch

If you need any assistance with policy drafting and reviews, AML audits, or training, simply contact us and one of our experts will be in touch.

Get in touch

What are matter based risk assessments? Read More »

Computer coding on a screen

How to prepare for a cyber attack

Blogs, Data Protection, Legal Compliance /

Knowing how to prepare for a cyber attack is extremely important. This is especially so when you have a duty to protect your client’s data.

Most of us have faced that dreaded email which sends shivers down your spine. It starts with a simple greeting, but what follows can cause much panic and stress.

“Hi, I’ve received an email from one of your team, and we suspect it may be a scam, I thought you should know.”

The action you take within the first hour of a cyber attack may spare you from potential harm, and allow you to navigate through the intricate web of digital deception unscathed. That’s why knowing how to prepare for a cyber attack is essential.

The reality of cyber attacks

We often find ourselves falling into the trap of thinking a cyber attack will never happen to us. However, the truth is that the landscape has evolved significantly. With the rise of hybrid working and increasingly sophisticated hackers, the potential risks have intensified. It takes just one unsuspecting click on a seemingly harmless link for everything to unravel.

The Cyber Security Breaches Survey 2022, sheds light on the harsh reality of cyber attacks. The findings provide valuable insights into the prevalence, impact, and consequences of these incidents. Key findings from the survey paint a compelling picture of the evolving landscape of threats that businesses and individuals face in the digital age.

1. Prevalence of cyber attacks

The survey reveals that cyber attacks continue to be a significant concern, with a staggering 46% of businesses reporting that they’ve experienced cybersecurity breaches or attacks in the past year. This highlights the pervasive nature of the threat, and the need for heightened vigilance across industries.

2. Financial impact

The financial implications of cyber attacks are substantial, with businesses estimating an average cost of £8,460 for identified breaches. The survey reveals that larger organisations tend to face higher costs, with the average cost reaching £15,000. These financial consequences emphasise the importance of robust cybersecurity measures as a critical investment.

3. Human factors

Human error is still a leading cause of cybersecurity incidents, with phishing attacks being the most prevalent method of compromise. The survey highlights the need for comprehensive training and awareness programmes to empower individuals to recognise and mitigate potential threats effectively.

4. Consequences of cyber attacks

The impact of cyber attacks extends beyond immediate financial losses. Breaches can lead to reputational damage, loss of customer trust, and legal ramifications. The survey underscores the importance of incident response and recovery plans to minimise the long-term consequences of cyber incidents.

5. Proactive measures

The survey highlights the increasing adoption of proactive cybersecurity measures among businesses. This includes implementing cybersecurity policies, conducting regular risk assessments, and investing in security software and hardware. These measures show the growing recognition of the need to prioritise cybersecurity to safeguard sensitive data.

Now more than ever, it’s crucial for organisations to acknowledge the real and imminent dangers posed by cybercriminals. The evolving tactics and techniques employed by these individuals demand heightened awareness, proactive measures, and a collective commitment to cybersecurity.

What to do during a cyber attack

When faced with a cyber attack, you need to understand the urgency of the situation and move swiftly. Within the first hour, you should implement your response plan to contain the issue. We recommend the following proactive steps should be taken within the first hour.

1. Thorough system analysis

Engage an IT expert who specialises in cyber attacks. They’ll meticulously examine your systems to assess the extent of the breach. This comprehensive analysis provides crucial insights into the nature and impact of the attack.

2. Reinforcing security measures

Securing your digital assets is important. So, swiftly take actions such as changing email logins and passwords. Additionally, isolate the data breach to prevent further contamination of your systems, safeguarding the unaffected areas.

3. Strengthening authentication

To fortify your defences, promptly implement 2-factor authentication if you’ve not done so already. This adds an extra layer of security to protect sensitive information and ensure authorised access only.

4. Dedicated support team

To address the concerns and enquiries of your stakeholders, assign a dedicated member of your team to respond promptly and provide accurate information. Their role is crucial in keeping open lines of communication and offering reassurance during the incident.

5. Communication

There’s a need for seamless communication so make sure you brief your call team. This will ensure there’s an uninterrupted service and streamlined communication channel for your clients and stakeholders.

6. Transparent communication

Openness and transparency are paramount. We would suggest posting a detailed explanation of the incident on your website, ensuring your clients are informed about the situation.

Simultaneously, send an update to your mailing list. Recommend that if they’ve received the scam email that they contact their IT department immediately.

Incidents like these often serve as a stark reminder of the cunning and sophistication of cybercriminals. Despite regular screening of your systems, you can still experience an attack due to the ever-evolving threats we face from the baddies!

How to prepare for a cyber attack

Here are our top three tips on how to prepare for a cyber attack, which will enable you to respond  swiftly to a cyber attack situation and ensure effective damage control.

1. Have a comprehensive plan in place

One of the key factors that will enable you to respond quickly is ensuring you have a well-defined disaster recovery plan ready to be implemented as soon as an issue arises.

It’s crucial for every organisation to proactively establish a plan before any potential exploitation occurs. This plan can be as simple as naming a point of contact who’s familiar with disaster recovery protocols and can immediately initiate necessary actions to mitigate further damage.

While the aftermath can be addressed over time, having someone who knows how to promptly secure the systems is essential.

2. Build relationships with cybersecurity experts

In the face of an attack, wasting valuable time searching for reliable cybersecurity professionals is an unfortunate setback. We highly advise establishing connections with competent cyber experts in advance, and have their contact details readily accessible.

By having trusted experts on hand, you can swiftly engage their services during emergencies, minimising response time. This will optimise the chance of a successful resolution. If needed, we’re happy to share the details of our own cybersecurity specialist, whose expertise has been invaluable to us. Get in touch.

3. Prepare clear and transparent communications

When faced with a crisis, it may be tempting to keep the situation under wraps and avoid acknowledging any issues. However, we firmly believe that adopting an open and honest approach is the most effective way to handle such situations.

By being transparent with stakeholders and those who may be affected, firms can prove their commitment to protecting individuals and keeping trust. It’s crucial to have a well-thought-out communication strategy in place, ensuring that key messages are prepared in advance to promptly inform and address concerns.

It’s important to recognise that even major institutions with substantial worth have vulnerabilities and have experienced exploitations, such as ransomware attacks. While it’s impossible to completely avoid all risks, being prepared to handle problems swiftly when they arise is an invaluable skill.

Gaining valuable insights from a cyber attack

One fundamental truth holds: you can’t glean valuable insights from a situation that’s swept under the carpet and hidden from view. By embracing this principle, you can swiftly recognise the approach you should choose, enabling you to draft the necessary wording promptly and issue your message effectively.

When this happened to us, we were able to effectively reflect on the experience. We realised the potential benefits of preparing such communications in advance, as a proactive measure. With this realisation, we’ve now taken proactive steps to create a repository of pre-drafted messages, ensuring we’re better equipped for any future challenges that may arise.

We were also reminded of the strength and resilience that lies within our network. It was the collective watchfulness and genuine care of individuals in our community that helped to fortify our defences against cyber threats.

While we sincerely hope that you never encounter a day like the one, we experienced, we believe that preparation is key. Having a well-defined plan in place in advance will undoubtedly enhance your readiness and ability to navigate unforeseen circumstances.

Get in touch

As data protection experts, we work with firms to ensure that procedures and controls are in place to protect the data they process. We offer training courses for staff on protecting clients and themselves from cybercrime and data loss. If you’d like to speak to one of Teal’s experts about how we can help, simply get in touch.

Get in touch

How to prepare for a cyber attack Read More »

Brown paper torn to reveal the words "lessons learned" underneath

The Case of Nirosha Jayawardena and its Nine Key Lessons

Anti-Money Laundering, Blogs, Legal Compliance, Regulatory Compliance /

In an ever-changing landscape, keeping abreast of new developments is essential in the legal profession. This week, I delved into the intriguing case of Nirosha Jayawardena, a solicitor who recently found herself suspended from practice by the Solicitors Disciplinary Tribunal for one month.

 

The decision was an outcome mutually agreed upon by Ms. Jayawardena and the Solicitors Regulation Authority (SRA). Alongside the suspension, there were several stipulated conditions about her future conduct.

 

The Unraveling of a Complex Case

The case drew me in due to its facts and unique circumstances, which I believe underscore vital points for everyone in the law firm to keep in mind. It serves as a stark reminder of how weak anti-money laundering (AML) controls coupled with non-compliance to Accounts rules can potentially result in substantial losses for small firms.

Within the case, we saw the firm fall prey to fraudulent individuals masquerading as property owners. These fraudsters successfully manipulated the firm into selling properties and directing the proceeds into their pockets. In dissecting what transpired, multiple compliance failures came to light.

 

Nine Key Lessons

 

  1. Small Firms are Targeted

It’s a common misconception that only large firms fall prey to nefarious activities. While it’s true that some criminals target big firms, low-complexity impersonation frauds often zero in on smaller firms. These firms may lack the technological advancements or stringent sign-off procedures that larger firms have invested in, making them an easier target.

 

  1. Repeat Offenders

What’s peculiar about this case is the audacity of the fraudsters. After successfully duping the firm once, they brazenly tried their luck a second time. That’s the unsettling nature of fraudsters. They will often test the waters with a legitimate instruction to gauge the firm’s security measures. If successful, they will exploit the vulnerability repeatedly until caught/detected.

 

  1. Disruptive Methods for ID Verification

In the case of Jayawardena, the client conveniently couldn’t visit the office but was able to arrive in a taxi. Such disruptions to standard protocols serve to distract the lawyer, hindering their ability to spot discrepancies.

 

  1. Passport Errors

In a busy legal environment, it can be tempting to overlook small details. However, every document, especially identification ones, should be meticulously scrutinised. Fraudulent documents are surprisingly accessible and can range in quality. The case underlines the importance of spotting typos or unusual language in documents.

 

  1. Ignoring the AML Policy

Needless to say, adhering to your firm’s policy is crucial. Unfortunately, instances of non-compliance do occur. It’s essential to make sure that all guidelines reflect actual practice. Having procedures in place that are habitually ignored only serves to undermine the entire policy.

 

  1. Breach of Solicitors Accounts Rules

Impersonation frauds often hinge on payments made to third parties. This case underscores the importance of handling such transactions with extreme caution. Reinforce this within your firm and ensure that the rationale behind such payments is captured in writing.

 

  1. Ignoring Warnings in Customer Due Diligence (CDD)

Knowing how to interpret electronic verification search results is a must. Document what your next steps are if the checks don’t pass. Ignoring warning signs can clearly lead to a cascade of issues down the line.

 

  1. Failure to Retain and Verify ID Copies

The Regulations mandate that CDD must be retained for 5 years past the end of the business relationship. This case emphasises the importance of not only keeping a copy of the ID but also following through with verification processes like authenticity checks on passports and driving licenses.

 

  1. Mandatory Training Courses

An intriguing element of this case was the requirement for Jayawardena to undergo training courses on AML and Accounts Rules. This is a prudent move and, as an trainer, one I wholeheartedly endorse.

While this might seem daunting, remember that knowledge is power. Let’s learn together and fortify our defenses against these ‘baddies’.

 

Get in Touch

For more information, simply get in touch and one of our helpful experts will contact you without delay.

 

 

The Case of Nirosha Jayawardena and its Nine Key Lessons Read More »