Customer Due Diligence: Business Prevention or Business Benefit?
The latest instalment in a long line of legislation, the Money Laundering Regulations 2007, entered UK law on 15 December 2007 and set out new measures aimed at tackling organised crime and the financing of terrorism. As a result, regulated sectors (including financial services, legal professionals, accountants, tax advisers, auditors, casinos, estate agents and money service businesses) have to change obligations for customer due diligence and demonstrate effective compliance.
Yet despite the early indicators of legislative change across the regulated sectors, some firms are only now starting to realise their new obligations and are unprepared. Many companies decided to wait until after the Regulations became law before reviewing updated industry guidance, assessing the impact on their business processes and considering what changes are necessary. Inevitably, some confusion has arisen as companies interpret the legislation independently, clarify their obligations and introduce practical measures into the day-to-day working environment.
Although the risk-based approach is designed to introduce some flexibility around customer due diligence, enabling companies to weigh the amount of time spent on customer checks according to the perceived risk attached to the business, the legislation contains no specific rules on what constitutes high, low or medium risk. Instead, the onus is put squarely on each individual firm, leading to ambiguity.
The UK’s Home Office estimates show that when perceived as a ‘market’ in the UK, organised crime is worth around £15bn a year and £3bn of criminal profits is moved out of the UK annually. The mechanisms used to fund global terrorist activities have been linked to international financial systems as laundered money finds its way through bank accounts and other business transactions.
The new Money Laundering Regulations 2007 are borne out of the EU Third Money Laundering Directive and represent the core interpretation of this Directive as it becomes law in the UK. Whereas the First Money Laundering Directive was largely aimed at tackling drug trafficking and the Second Money Laundering Directive extended to cover wider financial crime, the Third Directive adds the combating of terrorist financing to its remit.
The Third Money Laundering Directive adopts many of the principles and much of the learning that appears in the 40 Recommendations and Nine Specialist Recommendations produced by the Financial Action Task Force (FATF), a European based inter-governmental body that provides international guidance and proposes policies to help combat money laundering and terrorist financing worldwide.
In the wake of the Money Laundering Regulations 2007, various industry bodies (including the Law Society, Consultative Committee of Accountancy Bodies and the Joint Money Laundering Steering Group) have published updated guidance designed to help members comply with the new legislation.
When it comes to taking on business (either from existing or new clients), the regulated sectors are obliged to comply with the following guidelines:
Adopt a risk-based approach to customer due diligence
This principle has been in existence for some time and is essentially a useful management tool that allows companies to apply greater levels of customer due diligence to those individuals and corporate entities deemed a higher risk to the business.
Extend customer due diligence requirements
The above measures focus on a more detailed definition of customer due diligence:
There are also measures outlined that emphasise the need to conduct either simplified customer due diligence or enhanced customer due diligence depending on the level of screening required as determined by a company’s risk-based approach.
PEPs are broadly defined as ‘individuals who are or have been entrusted with prominent public functions’ and their ‘immediate family members’. For example, this includes heads of state, government ministers, members of the judiciary, members of the boards of central banks and ambassadors. Essentially, as PEPs are deemed open to influence or corruption, they are considered a higher business risk and must be identified where appropriate.
Conducting due diligence on politically exposed persons or ‘PEP checks’ has been considered best practice for some time, however, the Third Money Laundering Regulations set this procedure in law for the first time.
Another measure to appear in the Third Money Laundering Regulations is the ability for a regulated entity to rely on customer due diligence carried out by another regulated entity. In theory, this measure would enable companies to reduce the amount of due diligence carried out on their clients, however, it is emphasised that final responsibility still remains with the original company and cannot be transferred to the third party so, in reality, how much this measure will be applied by companies is debatable. There is also a regulatory obligation to ensure that all relevant employees receive training on changes in anti-money laundering procedures.
So what do the Third Money Laundering Regulations mean for those industries which fall within the list of regulated sectors? In many cases, they simply bring into law what is already best practice for some sectors.
The financial services sector has a head start on other regulated industries, as its own updated official industry guidance published by the Joint Money Laundering Steering Group (JMLSG) in January 2006 is also based, like the Third Money Laundering Directive, on the same FATF Recommendations and pre-empts much of what appears in the Money Laundering Regulations 2007. Many of the proposals outlined by the new Regulations should not take these firms by surprise.
The financial services sector has been scrutinised through earlier EU Money Laundering Directives and, at a global level, has had to comply with customer identification requirements set out in the USA PATRIOT Act 2001. This affects all companies with a US listing, or activities in, or linked to, the US, whether through a branch, subsidiary, associated company or banking relationship.
The legal sector has access to its own industry guidance published by the Law Society and for the first time, in many cases, will have to conduct checks on PEPs where appropriate and consider applying enhanced customer due diligence in areas of ‘riskier’ business (i.e. private client work, financial services, conveyancing, estates and trusts, wills, company formations, etc.).
Accountants also have their own industry guidance published by the Consultative Committee of Accountancy Bodies. Again, areas deemed at risk from money laundering (i.e. private client work, financial services, estates and trusts, insolvency, income tax) may undergo further internal scrutiny as processes are updated in smaller firms to reflect the new customer due diligence measures.
Since the enactment of the Money Laundering Regulations 2003, companies (particularly within financial services) have had to learn the hard way when they have been unable to demonstrate sufficient compliance to their industry regulator. Media archives are littered with examples of banks and other financial institutions subjected to million pound fines imposed and their name appearing in headlines associated with money laundering and financial crime. Often at fault is the customer due diligence process, which has been flawed, insufficiently audited or, at worst, been catastrophic leading to a company accepting business identified as nefarious. In such cases, significant fines, lost revenues business cessation measures and a large PR bill can be required to fix the mess.
As compliance departments become prominent, investment in both headcount and the software solutions deployed to ease a regulatory burden has escalated. An emerging trend is the increasing pressure on compliance departments to deliver a return on investment (ROI) back to the business.
As an example of compliance ROI, the procedural changes for customer due diligence are providing compliance departments with an opportunity to review existing processes, consolidate research resources used for money laundering checks and prioritise customer due diligence. Streamlining the take-on procedure brings efficiency benefits by reducing the time taken to accept new clients, improving overall customer service and enabling new business to be transacted faster.
Electronic verification of customer identity is also becoming usual practice, enabling new clients to be screened faster and existing clients to be re-checked without relying on a paper trail of photocopied documents.
The overall improvements in the way customer data is consolidated, accessed and maintained through customer due diligence processes allows companies to know their clients better and generate additional business opportunities.
Gone are the days when a long lunch with a business prospect was deemed an acceptable method for conducting customer due diligence. National and international regulations are here to stay and all indications are for more stringent measures to be introduced. Regulated entities can choose to get bogged down under the weight of this new legislation or take this as a given and recognise the opportunities regulatory compliance provides for companies to review outdated processes, innovate and realise business efficiencies.