AML nitrate!

There are five pillars that underpin AML compliance for a solicitor’s practice. Kevin Kerrigan takes you through them, so you can assess where your firm stands and pick up some practical takeaways

The Law Society is currently running a thematic review of business risk assessments, gathering data on how well practices understand and document the AML risk in the legal services they offer. Firms had until 30 September to report.

Rather than treating that deadline as a box-ticking exercise, it’s worth using it as a proactive prompt: is your practice fully AML compliant, or are there gaps that need attention?

If The Law Society selected your practice for a full AML inspection, would you pass with flying colours or would you be found as non-compliant?

Pillars of compliance

Pillar 1: Awareness and management of AML obligations

Every practice needs a designated money-laundering reporting officer (MLRO), or equivalent nominated officer. The appointment should be documented, and staff should know who that person is and how to report a suspicion or concern to them.

Alongside this, your firm needs an up-to-date manual on AML policies, controls, and procedures (PCP) that reflects how your practice meets your AML obligations on a daily basis, and how you mitigate AML risk.

It is acceptable to start from a template, but it must be tailored to your firm’s services and client base and reviewed at least annually or whenever there is a material change to the practice.

Takeaway: check that your MLRO appointment and PCP manual are both documented, current, and something staff can actually point to – not just something that exists in principle.

Pillar 2: Firm-wide (business) risk assessment

This is a distinct requirement from client-level due diligence, and it’s also the specific focus of the Law Society’s current thematic review.

A firm-wide or business risk assessment looks at the risk profile of the practice as a whole, considering the types of clients you act for, the services you provide (conveyancing, probate, trust and corporate services, etc), the transactions and industries you facilitate, the geographic spread of your client base, and the delivery channels you use.

It needs to be reviewed regularly, evidenced, and refreshed as external factors change.

Takeaway: this is a legal requirement that has been in place since 2018. If your business risk assessment hasn’t been looked at in the last year, this is the moment to update it. It’s the one document the current review is asking every firm to stand over.

Pillar 3: AML training

Staff need AML training at induction and on an ongoing basis, with an annual refresher, and that training needs to be logged, not just delivered.

MLROs need their own specific training.

Firms should also be able to produce an annual staff declaration confirming awareness of obligations and access to the firm’s PCPs and training.

Takeaway: a training log is only useful if it’s up to date. Confirm every member of staff has a dated entry and that your MLRO’s training is recorded separately.

Pillar 4: Customer due diligence

Every client needs a documented risk assessment that determines the level of due diligence applied to them for the matter at hand.

You also need to identify and verify clients, screen for ‘politically exposed persons’ (PEPs) and sanctioned individuals, and apply the appropriate risk classification.

Due diligence is not a one-off exercise at onboarding. It needs to be monitored throughout the life of the engagement, and the file should tell that story clearly.

On a risk-based approach, further scrutiny may be required to verify source of funds, source of wealth and, in the case of corporate and legal arrangements, you will need to determine the ownership and control structure and verify the ultimate beneficial owners.

Takeaway: spot-check a handful of client files at random. If you can’t quickly show how the risk level and due-diligence levels were determined, that’s a gap worth closing.

Pillar 5: AML reporting

Firms need a clear internal structure for raising a suspicious transaction report, alongside the mechanism for determining and escalating external reporting. Each firm should be able to show periodic effectiveness reviews and compliance-gap analysis.

Takeaway: make sure every member of staff, not just the MLRO, knows the internal reporting line for raising a concern. A policy nobody remembers is no better than no policy at all.

Common gaps

Across thematic reviews and AML inspections, the same gaps are regularly flagged:

• AML policies that were never tailored to the firm,
• Business risk assessments that are missing or out of date,
• Client files with missing or inadequate risk assessments; missing ID/proof of address documents; inadequate proof/evidence of source of funds,
• No evidence of PEP/sanction screening,
• No evidence of beneficial ownership checks for corporate clients,
• Training gaps for relevant staff members or training that happened once and was never refreshed or logged again.

Legal professionals are typically very effective at identifying bad actors and the red flags for money-laundering. However, when it comes to AML inspections, firms are often found short when evidence of the thought process or risk assessment is requested.

Within minutes of meeting a prospective client, your professional intuition or scepticism quickly identifies if everything appears to be in order; whether they look like an awkward client; whether the situation adds up.

However, AML inspectors have two statements that they love to use during an on-site visit: “Show me; don’t tell me”; and “If it wasn’t written down, it never happened”.

Kevin Kerrigan is COO and head of product at AML HQ, a compliance platform and support service used by legal and accountancy practices across Ireland and the UK to manage their AML obligations.