Emma Oettinger
Ashurst, London
Emma.Oettinger@ashurst.com

AML supervision – UK, Europe and beyond

For many lawyers around the world, compliance with anti-money laundering (AML) obligations has been a feature of client onboarding for the last two decades. The complexity of the obligations have been increasing over the years and while Law Societies and Bar Associations have provided guidance and training, supervisory or enforcement action in the legal sector has not had a high profile.

Firms with offices in offshore centres in the Middle East and Spain have been accustomed to regular reporting and audit requirements applied by the AML regulators who cover both financial and legal service providers. However, where AML supervision is legal-sector based, for many years the perception was of a light touch approach being taken unless there were concerns around client money. This is beginning to change. As a case in point, in 2020 and 2021 the Solicitors Regulation Authority (SRA) in England and Wales has not only been increasing its supervisory actions despite the pandemic, but also talking more about their approach, priorities and findings. 

Case study: the SRA approach in England & Wales

In January 2021 the SRA issued a sectoral risk assessment,^[1] drawing on information from law enforcement, the UK national risk assessment and intelligence from their own supervisory work. 

Emerging risks identified relating to Covid-19, wider economic pressures and new technologies were perhaps unsurprising; while the challenges posed by the emergence of legalised cannabis business for understanding whether you are dealing with the proceeds of crime, and how you understand the source of funds for clients using crowdfunding and cryptocurrencies, were some of the more interesting risks highlighted.

In July 2021 (and updated in October 2021), the SRA published their annual AML report^[2], setting out their role, reporting on their supervisory and enforcement activity and providing case studies of some of the action they had taken. 

A few key highlights from the SRA are as follows:

• they investigated 273 suspected breaches of money laundering regulations and cases of suspected money laundering;
• one hundred and sixty-eight desk-based reviews were conducted, considering either the firm-wide risk assessment or comprising a full desk-based review of policies and processes;
• they conducted 65 visits as part of their rolling programme of firm visits – interviewing 86 people holding senior management responsibility for AML compliance and 137 fee earners, while reviewing 349 files. On average the interviews at each firm lasted between three and five hours;
• six further visits were conducted as part of an onsite investigation and ten as part of their thematic work; and
• they made 39 reports of suspicious activity to the UK’s Financial Intelligence Unit.

In terms of outcomes:

• from their visits, 16 law firms were considered to be compliant, 45 were considered to be partially compliant and eight (who were referred to investigation) were found to be non-compliant;
• in 2020/21 in terms of enforcement activity, the SRA issued nine fines totalling £95,900 and made a number of other non-financial interventions; and
• further, the Solicitors Disciplinary Tribunal, which deals with more serious matters, struck off three solicitors, suspended three other solicitors and fined a further five solicitors a total of £67,500 for AML non-compliance.

Some of the key themes coming out of their enforcement and supervisory work were:

• most firms are really trying to comply with their obligations;
• poor policies, controls and procedures in the first place, especially with respect to risk assessments and source of funds, were the cause of many non-compliance issues;
• poor training or individuals not following existing policies, controls and procedures also led to non-compliance; and
• they noted a lack of robust and independent review of the firm’s policies, systems and controls in quite a few firms, which they felt would hinder management’s ability to take action early to improve compliance.

In November 2021^[3] the SRA issued its report on how firms should approach AML governance, and set out the three pillars for success. This report looks at how different firms across the legal sector are set up and highlighted three areas that needed to be taken into account when designing an AML governance system that works for the firm: Authority, Independence and Resources. 

Some of the conclusions drawn focused on the importance of having a deputy for business continuity purposes, and ensuring that where senior roles are held by practising lawyers the client-facing caseload needs to adjust, with appropriate resourcing and delegation across their roles, to enable them to provide sufficient attention to their roles in AML prevention.

Finally, in early January 2022^[4] the SRA issued its largest single fine to date – in the amount of £232,500 – to a high-profile law firm for AML failings. While still a small fine by comparison to the fines seen against large banks, this is a significant step up in terms of enforcement action and related to only two clients, whereas most bank fines relate to tens of thousands of transactions.

So what does this mean for the legal profession in the UK and beyond?

Across Europe and parts of Asia in recent years there has been an increase in annual returns and audits by Law Societies and Bar Associations, either for individual lawyers or for the firm as a whole. These returns are growing increasingly detailed in scope, although often with a focus on being able to report numbers against specific sections of law rather than how a client and mandate relationship really work in practice.  

With proposals^[5] for an EU-wide AML supervisor helping to coordinate national supervisors for non-financial entities covered by the AML rules and increased focus from the Financial Action Task Force (FATF) on supervision outside the financial sector in mutual evaluations, it is expected that AML supervision activity in the legal sector will increase.

For firms, it is not just a matter of compliance, but setting your systems in such a way that you can quickly demonstrate compliance, not just on a file-by-file basis, but on a macro basis over a period of time. You will need to be able to account for your activities in line with differing formulas from different regulators if you operate in more than one country and demonstrate senior management engagement with the decisions being made around your AML prevention programme.

For Law Societies and Bar Associations the challenge is to be able to clearly articulate the reality of compliance in a law firm across the whole range of different types of legal practices that they supervise, what their expectations are, how they are supervising, and what action they are taking when standards are genuinely not met. Their audience is not just FATF or pan-sector supervisors, but also those they supervise, as well as the wider press and public who are interested in these issues. 

The transparency of approach and reporting that the SRA of England & Wales has engaged in in the last year is one model to consider.