Lexsure’s independent AML audits comprehensively analyses and evaluates a firm’s anti-money laundering and counter-terrorist financing procedures. The main objective of an independent AML audit is to assess the extent to which a firm’s processes, procedures and standards meet established AML regulations and legislative rules. In addition to identifying possible inadequacies and vulnerabilities, the AML audit also aims to provide recommendations to improve the firm’s control systems and enhance the effectiveness of financial crime control methods.
Firms will need to consider the following factors when determining the type of independent AML audit:
The size of the practice.
The volume of work. Does the firm manage a high volume of work undertaken by relatively junior staff?
Complexity of the practice and the work undertaken.
The extent of the PCPs in place to manage the risks identified in the firm’s risk assessment.
An independent AML audit function does not have to be external to the firm but must be independent of the specific function being reviewed. The independent AML auditor should have the authority to:
Access all relevant material to be able to evaluate the adequacy and effectiveness of the PCPs.
Make recommendations in relation to those PCPs.
Monitor the practice’s compliance with its recommendations.
SRA regulated firms should take a risk-based approach to determining how frequently an independent AML audit should take place. Here at Lexsure we do not recommend an annual independent AML audit, for example for sole practitioners.
The Solicitors Regulation Authority has begun tightening its hold on the legal professionals that are not compliant with AML policies. The lack of an independent AML audit as the top area of concern for law firms in England and Wales.
It should not be all about surviving an SRA AML assessment, independent AML audits can be used as evidence of firms compliance when applying for lender panels, investors, and professional indemnity insurers. It can also be regarded as playing a role in protecting a firm’s reputation. Direct and indirect losses from AML breaches can be catastrophic to a firm’s reputation and economic stability.
Law firms can conduct an internal AML audit under Regulation 21 of the Money Laundering Regulations. That said, it must be carried out by someone apart from the in-house money laundering reporting officer, money laundering compliance officer, and the members of the anti-money laundering compliance team.
In addition, the individuals undertaking the AML audit must have a deep understanding of AML policies, Firmwide Risk Assessment and Client Matter Risk Aessments. They should also be robust in their approach to collecting, analysing, and verifying documents and procedures. AML Auditors must identify areas that require improvement and make recommendations where necessary.
Many firms are simply not equipped to undertake an independent AML audit internally..
An independent AML audit may be a better choice than an internal audit for three main reasons:
The Lexsure Independent AML Audit essentially works in the same way as the SRA AML audit, minus the terror.
It involves the following steps :
Lexsure requests a copy of your PCP’s (AML Policy, FWRA etc)
You will be asked to complete a questionnaire concerning your procedures.
You will asked for a list of all live and recently closed matters (these will be matters within the scope of the regulations)
Lexsure will review the firm’s PCPs
Lexsure will randomly select and review up to 8 files. You would be expected to supply these in a digital format (where the independent AML audit is remote) or have the files available at the offices for review in an attended situation.
Where the independent AML audit is remote we will conduct zoom interviews with a selection of fee earners and support staff. Where the AML assessment is ‘office-based’, interviews will be ‘in-person’.
Lexsure will provide a post-audit follow-up either remotely or face-to-face depending on the type of independent AML audit. A written report follows.
The cost and time frames vary depending on the type of AML audit. Discounted pricing is available for sole practitioners.
During an independent AML audit at your offices, you can expect the Lexsure AML assessor to interview some of your fee earners and to go through a selection of their live matters.
You will need to find substitutes where staff members are not available at short notice.
Cooperation from your team is important and it is advisable that staff are made aware of the visit in advance. Those selected for ‘discussion’ can be anyone from partner level through to junior staff. It is not just about conveyancing staff.
It is important that your MLRO and MLCO are also available for interview.
Your staff should be able to confidently talk through the firm’s AML controls. When conducting file reviews. Lexsure will be looking for:
client care letter as well as Terms of Engagement
verification and identity documents – is conference calling part of your process? If so, where is it documented?
any e-verification results and how any referred matters have been handled. What has been done to further investigate any false positives? How was this resolved?
any search engine or adverse findings kept on file
any company searches – were any anomalies as to beneficial ownership reported to Companies House, using a discrepancy report?
evidence of source of funds and wealth
client and matter risk assessments and how the risk is managed through the life cycle of the transaction
Lexcel/CQS/ISO accreditation does not guarantee AML compliance; to the contrary, it can give rise to a false sense of security. You still need to have an independent AML audit under Regulation 21 of the Money Laundering Regulations. The key rule in relation to the term “independent” is that it must be someone who is completely independent of the AML functions that are being audited. Here are our top misconceptions when it comes to Independent AML audits:
We have CQS accreditation and they have approved our AML PPCs. No they have not. Many of the firms who have been fined by the SRA have CQS accreditation.
We don’t need to have an independent AML audit, as we are a small firm. This typically means that ‘’we have no budget’’ Regardless of your size, Regulation 21 of the Money Laundering Regulations.
Fifty percent of firms the SRA audited in 2022 had not conducted an independent AML audit. Out of those that didn’t, the SRA indicated that half of those firms actually should have conducted one.
By adopting the following action in readiness for an independent AML audit, your practice will be best placed to evidence compliance with the Money Laundering Regulations and execute appropriate recommendations to enhance your AML compliance.
Select individuals to be responsible for the independent AML audit process and to liaise with the AML auditor. This must include the MLRO, and, if applicable, members from the compliance department.
Review and update your firm’s AML policies and in light of the legislative requirements to identify any gaps or areas for improvement. Correct any deficiencies or weaknesses before the independent AML audit. You can use services such as Lexsure Hub or the AML Policy Update Service
Once updated, collate all necessary documentation related to your firm’s AML policies, procedures, risk assessments, staff training records, customer due diligence (CDD) files, and any other relevant records.
Ensure staff are aware of the AML audit and inform them that they may be interviewed. We recommend that you ensure that the team has conducted training on AML policies and procedures (in line with the Legal Sector Affinity Group Guidance), so they are ready to address questions and evidence their knowledge. At the very least, they should read the documents ahead of the AML Audit.
Communicate the reasoning and objectives for the independent AML audit to all relevant parties. This will assist in managing expectations and understanding of their part in the process.