AML Firmwide Risk Assessment Case Study: 27169-63E12-F2382

Publication Date
2023-01-17

The Solicitors Regulation Authority (SRA) conducted an investigation into the law firm, which included an onsite forensic review of the firm's overall anti-money laundering (AML) compliance. The investigation identified areas of concern regarding the firm's compliance with the Money Laundering, Terrorist Financing (Information on the Payer) Regulations 2017 (MLRs 2017).

The firm did not have in place a compliant AML practice-wide risk assessment, as required by Regulation 18 of the MLRs 2017, until July 2022. The firm also made an incorrect declaration in January 2020 that its AML firm-wide risk assessment was compliant with Regulation 18 and in line with relevant guidance when it was not. The MLRs 2017 mandate assessing key risk areas, but the firm's risk assessment failed to include risks associated with its significant conveyancing work, which accounted for approximately 75% of its fee income.

The investigation revealed breaches of other AML regulations as well:

  • The firm breached Regulation 21(1)(c) by not establishing an independent audit function, necessary based on the size of the firm and the nature of its services, particularly its high-risk residential conveyancing work.
  • The firm also failed to establish compliant AML policies, controls, and procedures (PCPs) as required by Regulation 19. The policies provided at the time of the investigation were outdated, referring to superseded legislation (MLRs 2007) instead of the current regulations (MLRs 2017).
  • There was a breach of Regulation 24(1)(a)(i) and (ii) regarding AML training, as not all employees received the necessary training on the MLRs 2017. Several employees, including a partner and the money laundering reporting officer (MLRO), did not receive adequate training.
  • The firm was in breach of Regulation 28(11)(a) for failing to conduct proper ongoing transaction monitoring and source of funds checks, even receiving unexplained third-party payments which went unverified.

The firm admitted to these failings and acknowledged that the required AML policies and risk assessments were only put in place after the SRA's investigation concluded.