Developments in AML Legislation in the UK
There have been two key developments in UK money laundering deterrence recently. First, the FSA has abolished its Money Laundering Sourcebook in favour of high-level provisions in the Senior Management Arrangements, Systems and Controls Sourcebook (SYSC). Secondly, the Joint Money Laundering Steering Group (JMLSG) has issued its new guidance notes (approved by HM Treasury on 13 February 2006).
The new SYSC provisions came into force on 1 March 2006 and the existing Money Laundering Sourcebook will be revoked from 31 August 2006. During the transitional period until 31 August, firms complying with the Money Laundering Sourcebook will be deemed compliant with the changes to the SYSC. In other words, firms have four months to address the new provisions and make any necessary changes to systems and procedures. The FSA high-level principles on money laundering deterrence are contained in SYSC 3.2.6 and the four key rules are:
There are certain key aspects to bear in mind relating to these four rules. They are entirely separate to the obligations arising from both the primary legislation on money laundering and terrorist financing and the Money Laundering Regulations 2003. The FSA will have regard to the JMLSG guidance notes but following the guidelines will not be compulsory. The FSA has also never considered uncritical adherence to the guidelines to be a safe harbour.
In identifying money laundering risk and establishing systems and controls, firms should consider the following: their client, product and activity profiles; their distribution channels; the complexity and volume of their transactions; their processes and systems; and their operating environment.
In addition, firms should ensure their systems and controls include:
The MLRO is to act as an anti-money laundering focal point in the firm based in the UK. Some of the SYSC may also be extended to fraud and further consultation will follow.
The brave new world of the risk-based approach is here. As seen from the sections above, the FSA requirements focus on appropriate procedures and it will be up to firms to examine their own risks and respond accordingly. In case you’re thinking that there will be some guidance in the JMLSG’s guidance notes as to what is appropriate in relation to the various requirements, think again. Not as much flesh is put on the bare bones of regulation as you may think (see the sections below). Since each firm needs to differentiate itself from its competitors from a commercial perspective, then the money laundering risk profile and response should be expected to differ from firm to firm, and standard approaches will largely be ineffective.
The new 295 page radical version of the guidance notes has also been issued. In fact, the new guidance notes are not as radical as might be imagined, and what the JMLSG means by radical is more about emphasising senior management responsibility in a risk-based approach. A standard approach to identification and verification is introduced, and basic identification is separated from other aspects of know your customer (KYC). The purpose of the guidance is fourfold:
The JMLSG’s use of the term ‘guidance’ is not the same as in the ordinary use of the word. JMLSG states that the guidance notes set out ‘what is expected’ but allows some discretion and shows how firms should fulfil obligations. It then states that ‘should’ means ‘may’. The guidance notes are divided into two parts, generic and sector specific. Part I consists of nine chapters:
| Ch | Title | Content |
|---|---|---|
| 1 | Senior management responsibility | Mainly restates law and FSA regulation, sometimes incorrectly, the only guidance relating to what may be considered for inclusion in an AML/CFT policy statement |
| 2 | Internal controls | A restatement of the SYSC, with no real guidance. Thin coverage of the issues relating to outsourcing and cross-border issues |
| 3 | Nominated officer/MLRO | Mainly a restatement of SYSC and MLR, with very little guidance, particularly over what ‘appropriate’ might mean |
| 4 | Risk-based approach | A fairly turgid yet useful introduction as to what a risk-based approach may look like, but no mention of the risk cycle! |
| 5 | Customer due diligence | The bulk of the guidance split between standard ID and detailed KYC. Firms will accept different documents for ID. |
| 6 | Monitoring customer activity | Introduction to monitoring, even though there is no legal or regulatory requirement to do so! |
| 7 | Suspicious activities, reporting and data protection | Fairly solid chapter on the reporting process, though not comprehensive on all situations which arise. Little emphasis on the importance of information security. |
| 8 | Staff awareness, training and alertness | Again, little guidance as to what is meant by ‘appropriate’, ‘reasonable’ or ‘adequate’. No consideration of educational theory, only four of 60 learning techniques mentioned, no proper differentiation between awareness and training. Information on techniques contradicts experience. |
| 9 | Record keeping | Mainly repeats law and regulation, but oversimplifies a complex area of the law. Some suggestions, if followed, would increase firms’ commercial risk, so beware! |
Part II contains section specific guidance, an approach that harks back to the days of the red, yellow and green books, albeit there are now 20 sub-sections. The sub-sections are written in a broadly consistent manner, and most incorporate a section overview, a view of specific risks, an indication as to who should be regarded as the customer, suggested customer due diligence, and customer monitoring. Accordingly, the section chapters focus on the identification and suspicion recognition aspects of the requirements, rather than on controls, systems, reporting, record keeping and training, which are contained in Part I of the guidance notes.
Although a risk based approach can provide a safer harbour than prescriptive guidance, clearly a lot depends on the FSA’s approach to enforcement, and there is little indication as to how this may develop. Much is made of reliance on others to identify problems, but this is likely to become more risky since firms’ procedures are expected to diverge with the introduction of the risk-based approach. Curiously, those judged acceptable as verifiers remain limited to regulated financial institutions, rather than the extended scope of other types of entity now covered by the Money Laundering Regulations 2003.
Overall, however, the JMLSG has aimed to produce the following effects, and these can be largely expected to materialise:
The FSA will continue to expect every firm to demonstrate that it has adequately assessed the risk of it being used for money laundering and that its response is proportionate. Firms are likely to have to spend more time using the risk cycle to its full effect in the short term, in order to benefit from cost reduction and improvements in the strength of deterrence systems in the long term.
As a final sobering thought, the trial of Stephen Judge, formerly MLRO of City Index, is due to start soon. He was charged by the City of London Police with consenting to transfer £30,787.26 before consent had been received under the Proceeds of Crime Act. He had been in compliance at City Index for 10 years, and the MLRO for the past three. It is understood that consent is granted by the National Crime Intelligence Service (NCIS) in 98 per cent of cases where consent is requested, and that the majority of cases where consent is withheld relate to suspected VAT carousel fraud and matrimonial cases.
It will be interesting to see what happens in this case, particularly against a background of ever-increasing incidence of the predicate crimes underlying money laundering, and concerns over the effectiveness of the legislative system.