Six steps to better AML

According to the Solicitors Regulation Authority’s (SRA) AML annual report 2022/23, many firms don’t have an environment in which the correct AML steps are carried out as standard.

In firms where enforcement action was necessary, the most common area for breaches were firm-wide AML controls, including inadequate policies, controls and procedures (PCPs) and staff training.

Without these actions in place, it makes it very difficult for employees or senior management to detect when money laundering is a risk, let alone know what to do about it.

As a regulated professional and AML expert, I’ve seen the challenges firms have with compliance. But this doesn’t mean it can be ignored.

To remedy the UK’s poor global standing when it comes to AML (we’re second only to the US in the amount of criminal funds that pass through our country every year), the pressure on regulators will only increase.

One way or another, every regulated firm will have to tow the line.

Where do you start?

The Money Laundering Regulations 2017 clearly define the AML obligations all firms are legally required to comply with. These are further supported by sector-specific guidance.

Follow these and your AML processes will hold up when put under the spotlight by your supervisor or law enforcement.

Here are a few of the key steps you need to have in place:

1. Appoint compliance officers

Your business’ senior management need to appoint a member of the board of directors or senior management to be the money laundering compliance principle (MLCP) and money laundering reporting officer (MLRO).

If you are a sole practitioner, you will take on both these roles.

2. Train your staff

Train all your employees, agents and senior management.

Everyone should know how to recognise money laundering, terrorist financing and proliferation financing, as understand their legal AML obligations – like how and why you submit an internal SAR – and how to fulfil them.

3. Assess your risk

Carry out a firm-wide risk assessment analysing all the potential risks your business faces and your clients present.

Your objective is to decide whether your business as a whole, or certain elements of your business, are enhanced risk. 

And for you to have the information needed to create AML PCPs that tackle this risk.

If you have departments, service lines or branches with different risk profiles, you are required to complete additional firm risk assessments.

4. Keep your polices up to date

Your written AML PCPs, while legally required, can also help you save time and resources by showing you where to focus the majority of your efforts – the risk-based approach.

These need to be kept up to date with any changes to your business risk assessment, so that you’re always effectively identifying and mitigating your risks.

5. Do your due diligence

Client due diligence (CDD) on every client is a necessary part of the onboarding process and your continuing relationships.

This includes the identification of your client and any beneficial owners, the verification of these identities and a comprehensive client risk assessment.

You need to show (in writing) your understanding of your client’s business and the nature of the work you plan to do for them.

You also have an obligation to consider when additional transaction or matter risk assessments are required as the relationship develops.

6. Don’t forget the audit trail

You absolutely must document every one of the above steps, as well as any other AML work you do.

This should be in a complete, date-stamped audit trail which can be produced to prove your compliance at any time.

Once you have the right processes in place, AML is much easier to keep up with – more like regular housekeeping rather than a once-a-year spring clean.