AML matters

Your appointment and the formation of a specific anti-money laundering (AML) supervision team is a departure for the Solicitors Regulation Authority (SRA). Could you tell us about this change of approach and what it means for the profession?

The SRA is on a journey in relation to this important strand in its supervision responsibilities, and the formation of the AML team is the natural next step. The team brings together existing resources (but with a new focus), plus the addition of key new staff. Team members are based in both Birmingham and London.

It is fairly early days for the new team, and this interview is part of the team’s engagement with stakeholders.

Although the lack of lead-in to implementation of the Money Laundering Regulations 2017 (MLR 2017) was not very desirable, that shortness of time was reflected in the SRA’s engagement with firms in 2017 and early 2018. The focus was on supporting firms to make sure they comply.

However, it is nearly the second anniversary of the MLR 2017 and the pace of ensuring compliance must change.

What the team means for the profession is probably the following: a focus on emerging risk; focused supervision; implementing the 5th Money Laundering Directive (5MLD); and the development of new guidance.

The SRA now has a full-time Money Laundering Reporting Officer (MLRO). Could you tell us some more about the reasons for this? What are the differences between that role and yours?

The MLRO is full-time and has been in place for a year. The MLRO and deputy MLRO focus on instituting Suspicious Activity Reports (SARS) and any onward reporting; liaison, for example with the National Crime Agency (NCA); plus training of all staff on suspicions and what to look out for.

As director of AML, I am more focused on the profession as described above, for example with a policy remit, understanding the risks through research and thematic review work and, in the next 18 months, addressing the requirements of 5MLD and various consultations. The two posts are mutually complementary.

There was a lot of publicity about the formation of the Office for Professional Body Anti-Money Laundering Supervision (OPBAS). Since then, from the point of view of the ‘solicitor in the street’ there seems to have been silence. What can you tell us about the supervision by OPBAS as it affects the profession? Is there a danger of overload, with two regulators?

OPBAS’ relationship with the SRA is similar to its relationship with the LSB: addressing policy at high level and the all-important question of consistency among regulators in the same sector. The SRA is the frontline regulator and there shouldn’t be regulatory overlap. I wouldn’t expect the ‘solicitor in the street’ to see much of OPBAS’ work.

What are your priorities (personal or as a team) in the year ahead? The trust and company service providers (TCSP) thematic review (TR) talks of other thematic reviews continuing. Can you give us an idea of the likely themes?

Implementation of 5MLD is the main focus for the team. Although content and timing of implementation are in the hands of the Treasury, the team must be ready for the rollout when it comes.

There are two principal aspects: first, the effect of the directive on those the SRA supervises; second, the way the SRA supervises them. For example, the SRA will be required to do an annual return, and some approval processes will change.

Outside the specifics of the 5MLD, the team will:

• continue the work on firm-based risk assessments (see below)
• work to improve the number and quality of SARs sent by the profession to the NCA
• be scoping some further thematic reviews. One candidate for these reviews that is likely to emerge is high-end conveyancing. Another is to look at 5MLD compliance a year or so after implementation (but to some extent, this depends on the Treasury’s timetable). There is unfortunately no information about likely dates for that implementation

TCSP TR

To the impartial observer, there is a strong sense of disappointment (from the SRA) that comes from the report. What was the most surprising finding from your perspective?

The most surprising result from the TR was the high level of referrals for disciplinary consideration (26 out of 59). However, it is important to emphasise that these are referrals within the SRA, not referrals to the SDT – that is a stage that is much further down the track.

The seriousness of the issues identified varies. It is our best hope and expectation that many of these issues are capable of being remedied in a reasonable amount of time, but much of this is in the hands of the solicitors concerned.

The largest issue by numbers relates to business risk assessment (either not having one at all or, alternatively, not having an adequate one). However, that lack can’t be seen in isolation (or ‘cured’ just by writing a risk assessment (RA)). Firms should have clearly stated risk thresholds that are products of the RA, and processes that support them.

Observers note that of the three AML-themed TRs, there were no referrals to disciplinary procedure in 2015, last year there were 12%, and this year, 44%. What has changed? What is getting so much worse?

Our hope is that this trend reverses, but part of the reason for the increase is the change in the requirements in the regulations, as well as the change in regulatory focus. The 2017/18 review was carried out shortly after the announcement of the MLR 17. It was reasonable at that point to give firms time to improve. Now firms have no excuse for not fully complying.

Although the focus of the last TR was TCSP, many of the findings and recommendations were far wider and related to AML prevention more generally. Is there a danger that firms which do not offer those services might not read the report?

A number of work products came out of the TR, including the warning notice about the critical importance of a business RA, which has been widely publicised. The bottom line is that MLROs and others interested in this area would benefit from reading the full review.

There are a number of publications and initiatives (Risk Outlook, COLP newsletter, the annual SRA Compliance Conference, Flag It Up and so on). However, there is also a more general debate within the SRA about how information is disseminated to the profession – in particular getting out timely alerts about important publications.

The TR quotes from the sectoral risk assessment (March 2018) that “trusts or corporate structures which facilitate anonymity can help disguise the source … of money”. This is an important point and it would be helpful to have clarification of what “facilitate anonymity” means in practice. Isn’t there a difference between (a) structures which publicly appear anonymous but which are quite open with those who need to know (for example their solicitors) about ownership, management and control, and (b) the genuinely secretive and uninformative?

It is important that a regulator does not get drawn into what structures are suitable or unsuitable. The important message is to reiterate the risk-based approach, a point which underpins most of the answers in this interview.

The new development is to show how consideration of risk at the highest level filters down through processes to individual matters. The reasoning process is important – does it make business sense? This is a question that can be applied in different ways, whether looking at an entity’s structure or at the proposed transaction, for example.

Business RAs

The SRA in the TR said that 400 firms had been asked for their RA and the deadline for sending them expired shortly before we met. It is therefore early days, but could you comment on impressions so far?

It is too early to draw conclusions. The team will be going through all the submissions as a matter of priority and will consider the best way to communicate the key learning points with the profession. This is likely to take the form of guidance with good/poor practice examples and is unlikely to be published before the autumn.

It is clear so far that a number of templates are being used, which puts the SRA in a dilemma. Should the SRA produce a suggested template that builds on the regulation, or let the regulation speak for itself? It is likely that it will be the former, but the SRA will focus on regulatory compliance and not gold-plating. The intention is that any template will be suitable post-5MLD implementation.

The 400 firms were randomly selected from firms within the regulated sector, with the sample skewed to those with a risk weighting.

There seems to be some confusion about what should be in a firm’s RA. For example, a firm should refer to the SRA RA in its own RA because that is in the regulations. Reference to the national RA isn’t in the regulations: it might be good practice, but should absence be the source of criticism?

The SRA will not be telling firms what their risks should be, but we will be confirming (or not) that the RA meets the regulatory requirements.

The TR said that too many firms had an inadequate approach to their RA. It would be very helpful to give our readers some specific examples of what is adequate/inadequate over and above the general remarks in the TR.

The TR gives some clues. Keeping remarks general, the SRA would expect that if firms did a specific work type, particularly one that was high risk, this would be addressed in the RA – some firms did TCSP work but didn’t mention it in the RA, for example. Another example is an office in a high-risk jurisdiction where the jurisdiction was not addressed in the RA.

Independent audits and integrity screening

Legal Compliance had a number of questions about integrity screening and independent AML audits, but will return to these on a future occasion, because the team is currently doing some additional work on these topics. However, in relation to integrity screening, the message is that selection of employees, nature of the checks, and timing should be on a risk-based approach which is documented. The SRA expects relevant people to be screened on a regular basis, but this might be part of the internal appraisal process.

Other issues

In the TCSP TR, the SRA was “only satisfied with 45 of the PEP [politically exposed person] processes we reviewed” – in other words, dissatisfied with 14 of the 59. What specific aspects of the processes were unsatisfactory, noting that PEPs existed on six of the 115 files inspected? This is a particular concern given that the risk-profile of PEPs can differ dramatically. What “processes” does the SRA expect firms to have for PEPs? Some firms use electronic verification, but it isn’t mandatory. What are firms not doing?

The SRA asked itself two questions

1. Did the firm have a process to identify PEPs?
2. Did the firm know what to do if it found one?

Relying simply on an answer to “are you a PEP?” was not sufficient. This is another example of why it is important to get the RA right. The risk thresholds and processes should be clear and understood. The SRA expects to see questions about source of wealth and control over entities to be asked and to be recorded.

Due diligence of individuals or companies based in the UK is relatively straightforward. However, the further offshore one goes, the harder it is to obtain sufficiently robust evidence. Will the SRA be lobbying the government to improve the regimes that they can influence, such as Crown dependencies?

The SRA has observed the phenomenon in fieldwork. We are supporters of better transparency that can help law firms effectively manage the risks around money laundering.

Linked to the previous question, what exactly does the SRA expect to see evidenced on the file about source of wealth and source of funds (both terms not defined in the MLR 2017). There appears to be some confusion about this which it would be good to clarify.

The regulations are specific about establishing source of wealth for PEPs, and we expect to see firms following them and also remembering their Proceeds of Crime Act 2002 obligations.

Practitioners find the SRA website quite difficult to navigate, and the search function can be quite quixotic. Are there any plans to have a dedicated money laundering page where anything related to AML can be found (even if it is a link to material elsewhere, such as Risk Outlook or news and so on)? The TCSP TR talks of offering support to the profession, but the first task must be making it easy to find. And are there any plans for a specific email service for money laundering reporting officers/money laundering contact officers? Often these are different people, with different roles, to the COLP or COFA (who have their own email news).

Answering both questions, there is a long-term plan to allow practitioners to choose which alerts and services they subscribe to. In the interim, the new team is looking at current services and welcomes feedback about what is useful.

It is clear that information is ‘consumed’ in different ways and so it is important to keep different channels open. Resources can now be found under home/hot topics/money laundering and then clicking on the ‘resources’ tab.

One new development is a direct mail campaign coming soon under the banner ‘Assess, Report, Protect’.