As we settle into the new year, change in the rapidly evolving world of AML shows no signs of decelerating. This blog continues our series of updates for legal practitioners and law firms on the key developments from recent months.

1. New SRA guidance on the UK’s sanctions regime for firm-wide risk assessments

On 23 January 2024, the SRA published guidance to help firms assess exposure to risks associated with the UK's sanctions regime. This is a particularly welcome development in light of the rapid expansion of the UK’s sanctions regime (and its applicability to all firms in all sectors) since the invasion of Ukraine in February 2022.

the Key Points from the guidance:

  •  Universal risk: Previously, sanctions risk primarily affected specialist firms dealing with clients in affected jurisdictions, but this is no longer true. All firms are now at risk, and breaches, even unintentional, can lead to severe financial, reputational, and regulatory consequences;
  • Higher risk categories: Firms at higher risk are likely to be involved in multi-jurisdictional transactions, complex corporate structures, dealings with high net-worth individuals or those with political connections, providing trust and company services, charities based in sanctioned jurisdictions, and high-value transactions involving assets like artwork, vessels, and aircraft;
  • A sanctions risk assessment: While not compulsory, the SRA considers having a sanctions risk assessment as best practice, especially for higher-risk firms. The assessment will help identify vulnerabilities to breaches and allow for the development of appropriate policies, controls, and procedures.
  • OFSI’s risk-based approach: The Office for Financial Sanctions Implementation (OFSI) takes a risk-based approach to enforcement. Preventative measures are considered significant mitigation in case of a breach.
  • Regular review and approval: The SRA reminds firms that they are encouraged to regularly review and update their firm-wide risk assessments, which should be approved by senior management.
  • Factors in a sanctions risk assessment: These should mirror the requirements of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), namely the consideration of factors such as the firm’s customers, geographic areas of operation, products or services that the firm provides, the firm’s transactions and how services are delivered. It should also be appropriate to the size and nature of the business, considering headcount, areas of work, geographic location of the office, and supervisory structure.
  • Higher-risk clients: Clients who are more likely to be ‘Designated Persons’ are high net-worth individuals, the politically exposed (which, the SRA says, could be interpreted more widely than the definition of a PEP in the MLR 2017), those connected to sanctioned jurisdictions, those who use complex corporate structures to obscure their involvement, and/or those who instruct through third parties.
  • Licensing considerations: Licenses entitle a firm to deal with sanctioned clients or assets in a way that would otherwise be prohibited but still present risks of their own. They usually have conditions and are time-limited. The SRA recommends that firms have procedures to monitor these restrictions and ensure that any time limits or financial restrictions are not breached.
  • Counterparty risk: It is possible to breach the sanctions regime about a party who is not a client. If a counterparty or a third party is a Designated Person, the same considerations apply concerning transfers as if they were the firm’s client. Relying on the other side’s screening for Designated Persons is unlikely to be a complete defence if there is a breach of the sanctions regime. 

The SRA has also provided a table of sanctions risks, questions for a firm to assess in relation to those risks, and examples of good and bad practices concerning each risk.

The guidance emphasises the importance of compliance with the UK’s sanctions regime, the need for proactive risk assessments, and the potential consequences of breaches, providing practical tips for firms in implementing effective risk assessments.

2. Presumption of lower risk for domestic PEPs vs international PEPs

With effect from 10 January 2024, the Money Laundering and Terrorist Financing (Amendment) Regulations 2023 further amended the MLRs 2017 to require enhanced due diligence (EDD) on domestic politically exposed persons (PEPs) to be less than with foreign PEPs (as required by the Financial Services and Markets Act 2023).

This means there now exists a presumption of lower risk associated with domestic PEPs, departing from the heightened scrutiny imposed on their international counterparts.

3. Another update to the list of high-risk third countries

On 5 December 2023, the list of high-risk third countries was amended by virtue of the Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) (No.2) Regulations 2023.

Added to the list

  • Bulgaria
  • Cameroon
  • Croatia
  • Nigeria
  • South Africa
  • Vietnam

Removed from the list:

  • Albania
  • Cayman Islands
  • Jordan
  • Panama

Firms must ensure that its firm-wide risk assessments is updated to reflect these changes. 6/ The full updated list is available here.

4. New Regulations replacing the list of high-risk countries with a cross-reference to the FATF list

The Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2024, made by the Treasury under section 55(3) of the Sanctions and Anti-Money Laundering Act 2018, came into force on 23 January 2023. Their enactment will mean that in the future, the definition of “high-risk third country” in Regulation 33(3)(a) MLRs 2017) will now mean a country named by the Financial Action Task Force (from time to time on lists it publishes), being the black list (High-Risk Jurisdictions subject to a Call for Action) and grey list (Jurisdictions under Increased Monitoring). Schedule 3ZA has accordingly been removed from the MLR 2017.

5. Addendum to Legal Sector Affinity Group (LSAG) AML guidance for the legal sector

On 1 December 2023, the Law Society published an addendum to the important LSAG guidance for the legal sector.

The addendum covers the following topics

  • economic crime levy;
  • discrepancy reporting;
  • register of overseas entities;
  • ECCTA;
  • company due diligence;
  • de minimis exception;
  • mixed-property transactions;
  • supply chain risk;
  • source of funds (third parties);
  • client due diligence; and
  • beneficial ownership.

The most significant update in this addendum (other than those already touched upon elsewhere in this blog) is further guidance on the source of funds checks on third parties. When a client is known to have received funds for a transaction from a third party, the guidance stresses how crucial it is to understand and obtain evidence of the third party's source of funds. The level of review depends on the risk profile, especially in higher-risk situations (refer to section 6.18.3 for source of wealth guidance). Understanding the source of funds of both the client and associated third parties is essential to ensure effective risk assessment and monitoring under Regulations 28(11) to (13) of the MLR 2017. Practitioners must also meet their obligation under Regulation 28(16) by demonstrating that due diligence measures align with practice-wide and sectoral risk assessments.

6. SRA Corporate Strategy programme for November 2023 to October 2026

On 1 November 2023, the SRA published its Corporate Strategy programme for November 2023 to October 2026.

Among the priorities for the SRA was to achieve an increased reputation in the AML sphere. Within the category of ‘Priority One: we will deliver high professional standards,’ the SRA states that its aim will be for the public and profession to see the SRA as having developed a proportionate and effective regulatory approach that delivers compliance with requirements in AML and sanctions, and for the SRA to be “perceived as a leader in the regulation of AML and compliance with UK and international sanctions regimes.”

The outcome of the HM Treasury consultation on the future of AML supervision (link to blog here) will potentially change the landscape significantly. It may impact the viability of this objective.

7. Economic Crime and Corporate Transparency Act

The Economic Crime and Corporate Transparency Act (“the Act”) received Royal Assent on 26 October 2023. The Act is perhaps the most important development of the past decade in the area of criminal liability for UK companies, partnerships, and other corporate entities, with the two most significant provisions being:

  • The ‘identification doctrine’ so that a corporation can be held criminally liable where a senior manager is involved in an economic crime and
  • A new criminal offence of ‘failure to prevent fraud’ makes large organisations criminally liable if it, or a customer, benefits from a fraud committed by an individual associated with the organisation.

So why does this matter so much for law firms and solicitors?

The Act introduced unlimited fining powers for the SRA in cases related to economic crime. Specifically, where the SRA considers that an individual or firm it regulates has failed to prevent or detect economic crime or that its failure to act inhibited the prevention or detection of economic crime, it can now impose an unlimited fine. It was previously the case that unlimited fining powers were granted solely to the Solicitors Disciplinary Tribunal, and the SRA’s powers were statutorily limited, but no more.

Economic crime is also defined widely under the Act and covers a broad range of crimes from theft, false accounting and bribery to offences under the Proceeds of Crime Act 2002, the Fraud Act 2006 and the Terrorism Act 2000.

The Act has also granted the SRA a significant extension of power to request documents and information where a matter relates to economic crime. In these situations, the SRA can issue a notice requiring a person to provide information or produce documents as specified in the notice (section 111A (1)). This information power may only be exercised where the SRA considers it necessary or expedient to have the information or documents requested for, or in connection with, the performance of its regulatory functions relating to the prevention or detection of economic crime (section 111A (2)).

The government also published guidance on money laundering reporting obligations in relation to the DAML exemption provisions introduced by the Act, explaining how the exemptions operate alongside one another. These include the new exemptions of ending a relationship with a customer, paying away property with a value below £1,000, and allowing customers proportionate access to the non-suspicious proportion of their assets (where only part of the assets are suspected to be criminal proceeds).

8. SRA AML Annual Report 2022-23 and Warning Notice for Client and Matter Risk Assessments

The SRA’s AML Annual Report was published on 13 October 2023.

The SRA conducted 177 law firm inspections and 73 desk-based reviews between April 2022 and April 2023. Just one in three firms inspected were fully compliant with their AML obligations, with just over half (51%) partially compliant, and 19% of firms were found to be non-compliant.

Alongside the Solicitors Disciplinary Tribunal (SDT), the SRA has submitted 24 suspicious activity reports to the National Crime Agency relating to assets totalling more than £75 million, levied fines totalling £137,402, and suspended one individual and placed controls on employment on another.

The sra criticised the 'tick-box mentality' of some firms and highlighted common aml breaches such as:

  • lacking or inadequate AML policies and procedures;
  • non-compliance with firm-wide risk assessments;
  • failure to carry out robust client and/or matter risk assessments;
  • inadequate identification and verification of clients;
  • failure to check the source of funds;
  • poor staff training;
  • little-to-no ongoing monitoring of transactions; and
  • not reviewing or updating AML policies on a yearly basis.

The Report was followed by a Warning Notice published on 18 October 2023, noting that it had seen “a persistent level of non-compliant client/matter risk assessments.”

To reduce the high levels of law firm non-compliance, the SRA released a new template for client matter risk assessments in October 2023.

It also updated its Q&As page about AML & Sanctions.

Looking ahead

In what could have a major impact on shaping the future direction of compliance in the UK, a decision on the preferred supervision model (following the government’s AML supervision consultation) is set to be made by the end of Q1 2024. A summary of the potential models by the Law Society is available here.

It is also expected that the next SRA Thematic Review will be on AML training in firms. Firms will want to ensure that their programme is, among other things, compliant with Regulation 24.

This update provides a brief overview of the key developments that have taken place over recent months concerning the regulation of money laundering in the legal sector. We encourage our readers to consider the publications, guidance, and advisory notes referenced above by following the embedded links to each document.