Question of Ethics

March 2019

Carrying out an AML risk assessment

Q. I am in the process of updating our firmwide AML Risk Assessment. Some of the work we do is regulated and some is unregulated. Must I prepare the AML risk assessment for the regulated work only, or must the AML risk assessment cover all practice areas?

The assessment should be for the whole business.

Regulation 18 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires a relevant person to, "take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject"

Regulation 8 sets out who the "relevant persons" are and includes "independent legal professionals" and "trust or company service providers".

These are further defined in regulation 12 and will cover some, but not all, of the legal services potentially provided by a law firm.

However, regulation 18 refers to the risks to which the "business" is subject and does not appear to limit the assessment to the regulated part of the business.

Any assessment should consider regulation 19 and what policies, procedures and controls are needed to minimise the risk of being involved in money laundering and terrorist financing.

Money laundering checks and politically exposed persons

Q. We are acting for a couple in relation to the purchase of a property and have completed our standard ID and verification checks which seem fine. The purchase is being funded by the clients’ savings and a mortgage. However, we have just found out that the husband’s mother falls within the category of a politically exposed person. Are the checks we have undertaken adequate?

Now that this information has come to light, you will need to apply enhanced due diligence in accordance with Regulation 33 in addition to the checks you have already undertaken. Regulation 33(4) and (5) set out the measures that must be considered.

The information you request will depend upon the circumstances and the risk profile you have determined in respect of your clients and the transaction. The information you request will be ascertained by you on a risk sensitive basis. Given what you have received so far and what you know about the transaction and how it is being funded, it may not be necessary for you to request all the information set out in Reg 33(5).

If you have any queries concerning the above or you need guidance on another matter, please contact the Professional Ethics Team