AML Updates for the Legal Sector

Our recent anti-money laundering (AML) update webinar provided an overview of key findings from the Solicitors Regulation Authority’s (SRA) Annual AML Report 2023/24 and AML Thematic Review Report, along with general updates around AML and sanctions compliance.

We started by looking at comments made in the annual report by Paul Philip, SRA Chief Executive, namely:

“The Economic Crime and Corporate Transparency Act provides us with new powers to gather information and to impose unlimited fines for economic crime matters.

We are grateful to the majority of the profession who support this work by complying with the regulations and operating as effective gatekeepers.”

The SRA has an ongoing three-year cyclical review programme in place looking at independent audit compliance and its report highlighted that 17 out of 20 firms reviewed met the requirements with three being referred for further review.

Of interest is the 283 reports made to the SRA by the profession and consumers related to AML non-compliance, with reports being made for a lack of policies, controls and procedures (PCP), a lack of firm-wide (FWRA), client and matter risk assessments (CMRA) and source of funds/wealth/sanctions checks, etc.; this shows that there is nowhere to hide for firms that want to take short cuts!

The report clearly shows how closely the SRA is looking at firms’ AML compliance, with 95 suspicious activity reports made to the National Crime Agency (NCA) being reviewed, with 74 of these being non-compliant for issues like not including the glossary codes, company number, phone numbers, etc., in the SAR.

The lead document firms have to maintain is the FWRA, but it is clear from the report that some firms still don’t understand that they need one, or are unsure how to complete them. The report showed that 495 FWRAs were called in for review:

• 12 – not in place
• 249 – compliant
• 185 – partially compliant
• 49 – non-compliant

Here are some of the non-compliance themes:

• Some firms only put FWRA in place when SRA made contact
• Provided AML policy when asked for FWRA
• Operational business risk assessment provided when FWRA requested
• Using an unaltered FWRA template
• Failed to consider all services offered by the firm
• Firms failed to expand on the risks identified
• Many documents focused on what the firm does not do, rather than the risks it is exposed to

Flowing from a firm’s FWRA is its PCPs, but of the 481 sets called in for review only 209 were fully compliant, with the following themes being identified:

• Assessment and mitigation of the risk associated with the new products and business practices
• Reporting discrepancies  to Companies House
• How to identify and scrutinise unusually large and unusual patterns of transactions
• How to identify and scrutinise transactions that have no apparent economic or legal purpose
• How to identify and scrutinise complex transactions

The SRA’s report detailed key findings around its review into AML training, namely:

• Where money laundering compliance officers (MLCOs) had undertaken additional training, firms were around 50% more likely to be compliant compared with firms where the MLCO had not undertaken any additional training
• raining could be too focused on the regulations and thus what staff should do to remain compliant
• A number of firms have recognized the need for ongoing training, rather than one-off sessions, and that people learn in different ways
• Firms should not rely purely on external providers – while generic training can be a good place to start, it’s unlikely to mesh with all of the risks that individual firms face

A number of firms were found to be lacking in a number of areas:

• A lack of training was highlighted when fee earners were spoken to and were unclear on key aspects of AML compliance, such as source of funds/source of wealth checks and enhanced due diligence
• Some firms failed to keep a record of who had completed training
• There was a small number of firms who failed to follow up with fee earners who had not completed their AML training
• Some firms relied on AML training which was provided as part of external accreditation schemes
• Many firms failed to provide AML training to fee earners on their own internal AML policies, controls and procedures
• Some firms only delivered training to some fee earners when others were in scope of the regulations

The SRA has produced a very useful AML training checklist, and it is worth using it to see whether your current arrangements are compliant or need attention.

The Office for Professional Body Anti-Money Laundering Supervision (OPBAS), the body tasked with overseeing legal regulators’ AML work, has said it was not seeing “the consistent, effective improvement we need”, and that there needs to be a “combined commitment… to effectively fulfil the ongoing AML supervisory roles to protect the UK against the threat of money laundering”; in effect, expect more pressure from the SRA on AML compliance and increased penalties!

The SRA has published revised guidance on complying with the UK sanctions regime, so firms’ Money Laundering Reporting Officers (MLRO), Money Laundering Compliance Officers (MLCO), and Compliance Officers for Legal Practice (COLP), will need to read and digest the changes and update their firm-wide risk assessments (FWRA) accordingly, even if this is just to say it has been read but does not apply.

The Office of Financial Sanctions Implementation (OFSI) has updated its frequently asked questions on UK financial sanctions, and again any appropriate changes or notes need to be reflected in FWRAs.

OFSI has imposed the first monetary penalty under the Russian sanction's regime, which related to a concierge company providing services to high-net-worth individuals. They were fined £15,000 after providing property management services to a designated person, which included rent collection, making and facilitating payments.

The most relevant point for firms to note relates to OFSI's policy on voluntary disclosure, which did not happen in this case.

This case emphasises the importance of entities or persons voluntarily disclosing breaches of the regulations to OFSI … OFSI considers voluntary disclosure under Case Factor J as to the enforcement action taken, and if a penalty is imposed, will make up to a 50% reduction in the final monetary penalty amount to a person who gives a prompt and complete voluntary disclosure.

A number of firms have been fined since the last update in July, including:

• Fined more than £12,000 for not complying with anti-money laundering rules.
• Fined £21,843 for failing to have in place the right documents as required by money laundering regulations.
• Alternative Business Structure (ABS) fined more than £46,000 for failing to have proper anti-money laundering procedures in place, one of the largest such penalties to date.
• Fined £18,000 for failing to have proper anti-money laundering procedures in place

The ABS could have been fined up to £250m and individuals up to £50m, so it got away quite lightly!

Firms may want to use the Law Society’s Core Practice Management Standards to assess their levels of compliance; here are the specific AML requirements:

Practices must have a policy, approved by senior management, to mitigate and manage money laundering and terrorist financing risks and to ensure compliance with anti-money laundering (AML) legislation. The policy must include:

a)     A documented, practice wide risk assessment that identifies and assesses the risks of money laundering and terrorist financing to which the practice is subject, and which complies with Regulation 18 of the Money Laundering, Terrorist Financing and transfer of Funds (Information on the Payer) Regulations 2017.

b)     The appointment of a nominated officer usually referred to as a Money Laundering Reporting Officer (MLRO).

c)     A procedure for making disclosures within the practice and by the MLRO to the authorities.

d)     A procedure for checking the identity of the practice’s clients and for monitoring clients on an ongoing basis.

e)     A plan for the training of personnel.

f)      Procedures for the proper maintenance of records.

g)     A procedure for responding rapidly to AML enquiries from the authorities.

h)     Where appropriate with regard to the size and nature of the practice:

                                                      i.         Appoint a person of sufficient seniority as the officer responsible for the practice’s compliance with the current money laundering regulations (MLCO).

                                                    ii.         Carry out screening of relevant employees.

                                                   iii.         Establish an independent audit function to evaluate, monitor compliance with and improve the effectiveness of the practice’s AML policies, controls, and procedures.

i)      A procedure for checking and analysing the source of funds/wealth and keeping on file both the evidence obtained and the documented analysis.

j)      A procedure for dealing with the transfer of clients from one department of the practice to another.

k)     A procedure for ensuring that a documented individual AML risk assessment is present on every file addressing the risks of money laundering specific to that file.

Guidance on the information sharing measures in the Economic Crime and Corporate Transparency Act 2023 has been published, and should assist with the sharing of information, however, don’t confuse this with sharing information that relates to client due diligence (CDD), for example, estate agents can’t share their CDD with a law firm unless there is a formal ‘reliance’ agreement in place under section 39 of the Money Laundering Regulations, but a key aspect of this is that the law firm would remain liable for any errors or omissions made by the state agent.

Watch Brian Rogers and Mariam Dobosz discuss all of the above in more detail along with extra updates on the changes to AML regulation over the past three months.