The Solicitors Regulation Authority has published its Anti-Money Laundering Annual Report and a thematic review of policies, controls and procedures. For the first time, the report paints an encouraging picture of improving standards. Although some firms still get the AML basics wrong (including a good firm-wide risk assessment, AML policies and customer due diligence), they are clearly in the minority. For most firms, the SRA’s focus is moving from what their policies say they should be doing, to what they actually do in practice.
The SRA’s findings are similar to my experience from undertaking AML audits. Although AML policies set out an agreed approach, on individual files a lesser standard is often applied without adequate explanation and justification.
Latest thematic review
The thematic review of policies, controls and procedures is important reading for anyone involved in AML compliance. This review often signposts the start of a particular enforcement focus by the SRA. Recent reviews into source of funds, and into client and matter risk assessments, have heralded an uptick in fines for failures in these areas.
The SRA has made clear that it is not enough to put in place AML policies – firms must actively assess whether they are being followed. The regulator has flagged several ways firms can monitor the effectiveness of their policies, including file reviews, IT systems-based checks, good supervision and independent audit. Most compliance professionals that I speak to are constantly lobbying for IT-systems improvements. But this can be an expensive ask with a significant lead-in. There are, however, other ways that firms can ensure their AML policies are followed, such as file reviews, independent audit, and supervision and training.
File reviews
File reviews are perhaps the easiest and most immediate way of checking the application of AML policies. I recommend a regular programme of file reviews that can sit alongside a firm’s independent audit. Some firms will choose to do these monthly, quarterly or at another interval. But getting into a regular pattern is crucial. Catching issues early on isolated files can save a world of pain later. Ideally, file reviews should be carried out by someone removed from the individuals they are reviewing. A good sample of files should cover different practice areas, levels of risk and fee-earners. If the same onboarding standards are applied to work in and out of scope of the money laundering regulations, it is a good idea to test files from out-of-scope areas too. The SRA has published a helpful checklist for file reviews and guidance for reviewers.
Alongside file reviews, firms also need to demonstrate that there is good governance in respect of any themes or findings, and that any issues found have been rectified. Being able to show good governance is an area that the Financial Conduct Authority is particularly keen on. This will stand firms in good stead with the future regulator once supervision moves to the FCA.
Independent audit
An independent audit can provide a more rounded picture of how policies work in practice. Some firms choose an external auditor, or someone in the firm with good AML knowledge who was not involved in writing policies. A good independent audit will not only check whether policies are up to date with legislation and guidance, it will also test whether they are being applied to files and whether fee-earners understand and are complying with the policies. The SRA has a programme of calling in larger firms’ independent audits and checking whether recommendations have been implemented. Demonstrating that any issues have been addressed is really important. This could either be the auditor signing off any changes through a follow-up letter, or through minutes of an internal committee meeting where improvements are signed off.
Supervision and training
Finally, supervision and training are important to ensure compliance with policies. A regular training programme, based on the firm’s policies rather than on generic e-learning, is essential that fee-earners understand what is required. Supervision goes hand in hand with training to check that fee-earners know what is expected and that someone is monitoring this. Of course, this is easier to implement for associates than partners. The SRA’s review notes that it found junior staff under more scrutiny. Documenting training and supervision is important to demonstrate that requisite controls are in place.
Nearly 10 years after the current regulations came into force, firms have made great progress in implementing systems to prevent money laundering. The shift we now see at an oversight level is that firms need to ensure policies and systems are actually working. Getting ahead of this now will put firms in a good place to withstand scrutiny from the SRA – and the Financial Conduct Authority in due course.
Colette Best is director of anti-money laundering at Kingsley Napley, London
No comments yet