AML Firmwide Risk Assessment Case Study: B81A1-523A3-37CA6

Publication Date
2023-01-16

An onsite forensic investigation was carried out by the SRA into the law firm, following concerns highlighted in a qualified Accountant’s Report. The investigation identified areas of concern in relation to the firm’s compliance with the Money Laundering, Terrorist Financing (Information on the Payer) Regulations 2017 (MLRs 2017).

The law firm closed in December 2021 and the relevant lawyer continued to practice as a freelance solicitor from January 2022 onwards. The law firm did not have in place an AML practice-wide risk assessment, as required by Regulation 18 of the MLRs 2017, until the firm closed in December 2021, and therefore failed to have sufficient regard for the SRA’s warning notice on this topic.

The relevant lawyer, on behalf of the firm, incorrectly made a declaration in January 2020, that the firm had a AML firm-wide risk assessment which was compliant with Regulation 18 and in line with relevant guidance, when it did not. The MLRs 2017 set out five key risk areas which must be assessed. The firm had no documented risk assessment, and therefore had failed to fully assess any of those key areas as detailed below: - its customers, - the countries or geographic areas in which the firm operates, - the products or services which the firm provides, - how the firm’s products and services are delivered, and - its transactions.

The risks associated with conveyancing and controlling client money, a significant area of work for the firm accounting for around half of its fee income, should have been addressed in a AML firm-wide risk assessment. In addition, the lack of a firm-wide risk assessment also showed a failure to have sufficient regard for the Legal Sector Affinity Group guidance, the sectoral AML risk assessment, and the warning notice.

The law firm did not have in place AML policies, controls, and procedures (PCPs), as required by Regulation 19 of the MLRs 2017. The firm was required to have established and maintained AML policies, controls, and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing, which should include areas such as (but not limited to): - simplified due diligence, - reporting to Companies House, - training, - reliance and record keeping, - suspicious activity reporting, - procedures for the identification of matters that are complex, unusually large, have an unusual pattern of transactions, have no apparent economic or legal purpose, are at high risk of being related to money laundering or terrorist financing, or involve products or services that might facilitate anonymity, - customer due diligence procedures, and - an explanation of the roles of the Money Laundering Reporting Officer (MLRO) and Money Laundering Compliance Officer (MLCO).

The relevant lawyer also failed to take appropriate measures to ensure that relevant employees were made aware of the law relating to money laundering and terrorist financing, regularly given training in how to recognize and deal with transactions which may be related to money laundering or terrorist financing, and failed to maintain a written record of training undertaken on anti-money laundering and counter-terrorist financing, as required by Regulation 24 of the MLRs 2017.

The forensic investigation also evidenced the failure of the law firm to keep contemporaneous accounting records, as required by the SRA Accounts Rules (both the 2011 and 2019 iterations). As a result of the firm not having up-to-date client ledgers, the forensic investigation officer was unable to rely on the books of account and was therefore unable to express an opinion as to whether the firm held sufficient funds in the client bank account to meet its liabilities to clients. Breaches identified were the SRA Accounts Rules 2011 and the SRA Accounts Rules 2019. The law firm closed in December 2021.

The relevant lawyer admitted that by failing to comply with money laundering legislation and SRA Accounts Rules, they have: - failed to behave in a way that maintains the trust the public places in them and in the provision of legal services, - failed to comply with legal and regulatory obligations, - failed to carry out their role in the business effectively and in accordance with proper governance and sound financial and risk management principles, - failed to achieve having effective systems and controls in place to achieve and comply with all requirements, - failed to identify, monitor and manage risks to compliance with all requirements, - failed to comply with legislation applicable to their business, including anti-money laundering and data protection legislation.