Your AML questions answered

Find answers to questions on:

• requesting a defence against money laundering
• responding to suspicious activity report requests
• replacing a money laundering reporting officer
• the Persons of Significant Control Register
• the Register of Overseas Entities
• updating client due diligence
• requests to delete client due diligence
• charging for compliance with production orders

I made a suspicious activity report requesting a defence against money laundering (DAML) to proceed in a matter. How long will it take for a decision to be made?

Once you submit a suspicious activity report (SAR), the National Crime Agency (NCA) has seven working days to look at the SAR and ask for more information if necessary.

This is also known as the ‘notice period’ and it starts the day after a SAR is submitted.

If the NCA does not respond within the notice period, you may consider that you have what is known as ‘deemed consent’ (section 335(2) Proceeds of Crime Act 2002 (POCA)).

The NCA may also send you one of the following letters:

• letter C – closure for not meeting standards criteria
• letter D – request for more information or to clarify required information
• letter E – closure for no response in specified time frame or unsatisfactory answer in response to letter D

If significant information is missing from your SAR, the NCA may close the case without consultation. You may resubmit a new request if you choose.

If the NCA requests further information by sending letter D but does not receive this in writing within two days, it will consider closing the case.

For more information on SARs and DAMLs, see chapter 11 of the AML guidance for the legal sector.

I made an online DAML SAR. The NCA emailed me asking for further information, which I supplied. Does this extend the notice period?

Decisions must be made within the seven-working-days ‘notice period’ even if the NCA request further information.

Where you receive a request for further information from the NCA, you should respond promptly.

If you do not reply to the information request within two days, it may result in the closure of your SAR or consent may be refused.

Your consent may be granted, or you may ‘deem’ consent after the expiry of the notice period if you do not hear back from the NCA at all or if you receive a letter in which the NCA neither grant nor refuse consent.

In the latter case, you may wish to consider whether you can justify proceeding with the matter where the NCA has not been comfortable granting consent outright or letting it go ‘deemed’ without further contact.

If consent or a DAML is refused, then the initial ‘moratorium period’ is a further 31 calendar days from the date of the refusal.

During the notice and 31-day moratorium period, you must not do a prohibited act.

However, this does not prevent you taking other steps on the file, such as writing letters and conducting searches.

The Criminal Finances Act 2017 made changes to the moratorium period under POCA:

• section 336A enables the moratorium period to be extended by court order
• section 336C provides for an automatic extension of the moratorium period in certain cases

The moratorium period allows law enforcement agencies sufficient time to gather evidence to determine whether further action is needed.

There may be occasions when the NCA requires further information to undertake proper analysis and make an informed decision on whether to investigate.

For more information, see chapter 11 of the AML guidance for the legal sector.

Our MLRO is leaving the firm and another individual will be taking on the role. How long do we have to inform the SRA of the new appointment?

You must inform the SRA of the identity of your new money laundering reporting officer (MLRO) within 14 days of appointment – see regulation 21(4)(b) of the Money Laundering Regulations 2017.

In addition, as the role of MLRO falls under the definition of “manager” under regulation 3, the new MLRO must be approved by the SRA as a beneficial owner, officer or manager (BOOM) prior to their appointment (regulation 26).

The application to be approved as a BOOM can be submitted by logging into the mySRA account and completing form FA10b.

No fee is required.

The SRA will aim to make a decision within 30 days of submission, but this can take longer if additional information is required.

The MLRO must not take up the role until SRA approval has been received.

Acting without approval, could result in a summary conviction and a prison term of up to three months or a conviction on indictment and a prison term of up to two years.

You must also ensure that you notify the SRA within 14 days when an individual ceases to act as a BOOM (when your current MLRO leaves the practice).

For more information, see:

• chapter 4 of the AML guidance for the legal sector
• the SRA’s guidance on making changes to AML authorisation

I’m an MLRO. I understand that the obligation to report discrepancies to Companies House via the Persons of Significant Control (PSC) Register is being expanded. What is the change and when does it come into effect?

Regulation 30A of the Money Laundering Regulations 2017 requires relevant persons to report to the registrar of companies any discrepancies between information:

• they hold about the beneficial owners of companies, as a result of client due diligence (CDD) measures, and
• recorded by Companies House on the public companies register

Currently, the obligation to report discrepancies must be undertaken when a firm first onboards a client.

The Money Laundering and Terrorist Financing (Amendment) (No 2) Regulations 2022 will change the position.

From 1 April 2023, the amended regulation 30A will require solicitors operating in the regulated sector to report discrepancies that come to light on an ongoing basis.

Amended regulation 30A will require firms to report material discrepancies identified during the course of the business relationship – for example, as a result of refreshing CDD or undertaking ongoing CDD.

Material discrepancies include:

• incorrect names, date of birth, nationality, correspondence address
• missing or incorrect entries for a PSC or a beneficial owner

The amended regulations come into force on 1 April 2023.

For more information, see chapter 12.6 of the AML guidance for the legal sector.

I’m the MLRO of a small firm. Has the Law Society published guidance about the Register of Overseas Entities?

A Register of Overseas Entities (ROE) at Companies House was created by the Economic Crime (Transparency and Enforcement) Act 2022.

The purpose of the register is for owners of foreign companies to reveal their identities to make it more difficult for foreign criminals to launder money through UK property.

Refer to our full guide to ROE and what solicitors need to know about verification, which outlines the responsibilities and risks of the verification process in section 3.

A longstanding client has instructed us in a property transaction. We have client due diligence (CDD) documents on file from a previous matter two years ago and one partner has known the client personally for a long time. Do we need to update the CDD?

Regulation 28(11) of the MLRs 2017 requires that you conduct ongoing monitoring of business relationships.

You should consider reviewing (although not necessarily redoing) the CDD upon each new matter.

Where there has been a significant gap between instructions, you should consider refreshing the CDD.

Anything above a year may be considered a significant gap

You must update the CDD when you become aware of any changes to the client’s identification information. This would include change of:

• name
• address
• beneficial owner
• business

There is no provision in the MLRs 2017 for waiving CDD requirements on the basis of longstanding or personal relationships.

Taking this approach will not satisfy the requirement to undertake independent verification, though these factors may inform your risk-based approach.

When reviewing CDD on existing clients, consider information already on your files which verifies their identity or is available publicly to confirm the details you hold, rather than approaching the client.

You must also be aware of obligations to keep clients' personal data updated under the Data Protection Act 1998 and the GDPR or their equivalent.

For more information, see chapter 6 of the AML guidance for the legal sector.

We acted for a client who withdrew instructions at an early stage. The only work we did was collecting client due diligence (CDD). The client has asked that we delete their personal data. Can we do this?

No. The right to erasure of personal data under article 17 of the UK General Data Protection Regulation (GDPR) does not apply to the extent that processing is necessary for compliance with a legal obligation which requires processing under domestic law.

A relevant person, such as an independent legal professional, must keep records as specified in regulation 40 of the MLRs 2017.

Regulation 40(3)(b)(ii) provides:

“(3) Subject to paragraph (4), the period is five years beginning on the date on which the relevant person knows, or has reasonable grounds to believe—

(a) that the transaction is complete, for records relating to an occasional transaction; or

(b) that the business relationship has come to an end for records relating to—

(i) any transaction which occurs as part of a business relationship, or

(ii) customer due diligence measures taken in connection with that relationship.”

It is considered that solicitors, after any initial contact made with such a client, will not have an “occasional transaction”, but a “business relationship”.

For more information, see:

• chapters 6.4 to 6.5 and 10.4 of the AML guidance for the legal sector
• article 17 of the UK GDPR

The police served us with a production order for the files of a longstanding client. Compliance involved a significant amount of time and resources. Can we include a provision in future terms of business that allows us to recover costs from the client?

You should consider including within your terms of business a provision that states the firm will charge the client for responding to all lawful notices and orders from law enforcement agencies relating to the retainer.

Such a provision should also note that the firm may not be able to discuss compliance with the notice or order with the client.

You should not, however, alert the client to the order where there is a risk of prejudicing an investigation.

Consequently, there will be limited opportunity to recover the cost from the client as it is difficult to envisage how the charge on the bill can be worded so as not to alert the client to the existence of the production order.

For further information, see our practice note on responding to a financial crime investigation.