Anti-money laundering compliance: the regulator closes in

The news that the Solicitors Regulation Authority (SRA) is hot on the heels of firms who fall short on anti-money laundering (AML) compliance will strike further fear into the hearts of money laundering reporting officers (MLROs) and compliance teams.

In Spring 2019, the SRA wrote to 400 firms requesting a copy of their money laundering risk assessments – a requirement under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

If it was hoped this would paint a healthy picture, the result was anything but. Out of the 400 responses received by the SRA, 83 were non-compliant – more than one in five. The SRA reports that of the risk assessments that were reviewed, many did not address all the risk areas required.

Even more surprisingly, many were completely inappropriate with a client or matter risk assessment being sent, rather than one relating to the firm itself.

Of grave concern to the SRA is the fact that 135 of the 400 risk assessments were recently dated. This suggests that those firms did not have a risk assessment in place until the request to provide them had actually been made.

Singled out for particular criticism were firms that appeared to be using templates, many of which were reported to be of low quality. The SRA believes that many firms have tended to “copy and paste” from previous templates without turning their minds to the specific risks and issues faced by their particular organisation.

What’s next?

The SRA is planning to write to all firms and to undertake what it describes as an “extensive” programme of targeted inspection visits. It can be expected that the SRA will routinely call in more firms’ risk assessments over the coming months and years.

Be under no illusion that the regulator will take a soft approach to non-compliance. Figures released in the SRA’s latest annual risk outlook for 2019 to 2020, published on 29 October, show that so far this year 172 investigations linked to anti-money laundering compliance have been opened.

Also, in the last five years more than 60 such cases have been taken to the Solicitors Disciplinary Tribunal (SDT), resulting in more than 40 solicitors being struck off or suspended.

It is something firms and those with compliance responsibilities can ill afford to get wrong. It is notable that the Financial Action Task Force (FATF) remains concerned about the relatively low number of suspicious activity reports (SARs) filed by solicitors and other legal professionals.

For instance, the SRA’s review of firms working on trusts and company services found that only 17 per cent have made any SARs in the past two years.

With new and tougher EU money laundering regulations under the Fifth Money Laundering Directive (5MLD) due to come into force by 10 January 2020, it is inevitable that the scrutiny and monitoring attached to AML compliance will increase.

What should firms do now?

The review presents an opportune time for firms to revisit their AML obligations and make any necessary improvements or changes before the SRA comes to call.

As “relevant persons” under MLR 2017, all firms must ensure they have a full and firmwide risk assessment in place. This risk assessment – together with the information on which that risk assessment is based and any relevant records – must be produced to the SRA (as the supervisory authority) on request.

As the SRA has highlighted, it is not enough to create something after the event. Regulation 18 MLR 2017 states that in carrying out the risk assessment, a law firm must consider risk factors including those relating to:

• Client profile – For example, whether any of them are politically exposed persons (PEPs) or family members or known close associates of PEPs.
• The countries or geographic areas in which it operates – Any country that may bring a risk of corruption or may be considered a high-risk country.
• Products or services – whether the firm is involved in, for example, conveyancing.
• Transactions; and
• Delivery channels – Online or without face-to-face contact.

In deciding what steps are appropriate, the firm must take into account the size and nature of its business. The firm must also keep an up-to-date written record of all the steps it has taken to identify and assess the risks of money laundering.

Firms will welcome the available free guidance on risk assessments in the legal sector, although this isn’t always easy to find (or even in one place). It includes the Law Society’s Quick guide to the Money Laundering Regulations 2017, released shortly after the commencement of MLR 2017 in June 2017.

It indicates the matters a firm should consider within its risk assessment:

• Whether there is a high client turnover a stable client base;
• whether clients operate in sectors that pose a higher risk of money laundering;
• how often the firm acts for clients without meeting them; and
• the type of work undertaken by the firm.

More recent is the Law Society guidance, AML compliance for small firms – customer due diligence and red flags, part three (published February 2018). This says a firm’s risk assessment must include as a minimum the information contained in the UK’s second (and latest) national risk assessment (NRA) published October 2017 and the SRA’s risk outlook.

The first SRA’s AML sectoral risk assessment on anti-money laundering and terrorist financing was published in March 2018.

This sets out what the SRA believes to be the primary risk factors arising from the particular products and services offered by law firms; the clients they act for; and the transactions undertaken.

It helpfully summarises the nature of the risks arising from the three most high-risk services identified by the second NRA: trust and company formation; conveyancing; and client account services.

The document also gives firms guidance on how client accounts may be targeted, and how trusts or corporate structures facilitating anonymity can help disguise the source or destination of money or assets.

Firms will be interested in the useful commentary on transaction, delivery channel and geographical risk factors.

Judgment call

Ultimately, to echo what the Law Society states in the small firms AML guidance: “There are no black and white rules that explain when you might decide your firm is at high risk of exposure to money laundering activity. The conclusions of your practice-wide risk assessment are a matter of judgement.”

Now is the time for firms to exercise that judgement. In the words of the SRA chief executive Paul Philip when the results of the AML review were published: “A call from us should not be the prompt for a firm to get their act together.”

Firms and their compliance officers must take immediate action if they are not on top of the money laundering risks. Where the regulator has serious concerns, it will take “strong action”.

Helen Simm is a partner in the criminal, compliance and regulatory team at Browne Jacobson brownejacobson.com