Raising the red flag

Firms should undertake due diligence on new clients and potential employees as a matter of course to stay one step ahead of potential fraudsters, advises Susanna Heley

The recent autumn update of the SRA's risk outlook comes complete with additional notes on both bogus firms and money laundering. At first glance, these issues may appear to be very separate but, in fact, they are intrinsically linked and firms need to ensure that their policies and procedures are sufficiently interdependent
to identify certain types of
red flags.

Role play

The SRA's notes highlight all of the usual issues regarding the need for solicitors to identify their clients and understand the transaction and, in particular, their own role in any transaction. Where solicitors are asked to adopt a role which is unusual, or involves more direct handling of funds than would be normal for a transaction of that type (for example, payments directly to third parties), we all know that we need to proceed with caution.

What is perhaps harder to spot is the infiltration of law firms. The notes accompanying the risk outlook identify a number of ways in which fraudsters can target reputable firms by applying for employment using a false identity or references, or through merger or acquisition
of firms.

The issues which these particular practices highlight give rise to the same type of compliance problems created by the apparently increasing incidents of bogus firms. The steady stream of reports of bogus firms and the continuing impact of money laundering demonstrate that these are issues that the profession must keep at the forefront of their risk-management policies. As criminals become increasingly sophisticated, compliance teams must develop appropriate policies to identify and act on red flags.

The SRA recommends a number of simple, common-sense steps, including conducting regular web searches on your own firm and personnel, proper due diligence on firms and individuals unknown to the firm, conducting searches through the Law Society database Find a Solicitor, and looking out for free web-based email addresses or minor discrepancies in domain names. Firms are also reminded of the importance of ensuring they keep the SRA informed of any changes in their contact details and employees.

The SRA publishes reports of bogus firms on its website and all firms should have procedures in place to check the firms listed regularly and to circulate any reports which are of particular note. Bogus firms are named and the SRA usually also includes details of how the identity theft is being perpetrated, ie using a false website, hijacked email or street addresses or entirely made-up details.

These reports should
help compliance officers
to understand some of the strategies employed by fraudsters and to ensure that fee earners are aware of common issues which may merit further investigation.

Routine check

Fee earners should conduct routine checks on firms they are asked to deal with for the first time and should check contact details against websites and Find a Solicitor. If fee earners are in doubt, they can contact the SRA directly.

If firms come across bogus firms or identity theft, they are encouraged to report it to the SRA, or another relevant regulator, and, if appropriate, to the police. The SRA's guidance indicates that fraud perpetrated through bogus firms can happen very quickly and it is important that notifications are made as soon as possible.

Similarly, when firms take on new staff, even on a temporary basis, full checks should be undertaken. Proof of ID and qualifications, checks against online databases like the SRA's Check a Solicitor's Record, as well as general online searches, should be conducted and references should be taken up.

Firms should also conduct appropriate checks on referees, confirming the existence and details of professional referees and speaking directly to personal referees. Where employees are unable to give references from firms, or such references are out of date and contact details are out of the jurisdiction or cannot be verified, firms should
consider conducting
further investigations.

Where the employee is a non-solicitor, a disclosure and barring service (DBS) check may be appropriate. Firms do, of course, need to have regard to the rights of employees and potential employees and ensure they obtain proper consent for DBS searches or credit
checks if these are part of the procedures adopted. SJ