A thematic review of trust and company service providers

Executive summary

Background: trust and company services and money laundering risks

Money laundering is not a victimless crime. It is used to fund terrorists and facilitates drug dealers and people traffickers, as well as a range of other criminal activity. The credibility of solicitors and the services they offer makes them an attractive target for criminals, who want to launder their gains. Solicitors have a vital role - and opportunity - to help tackle the problem.

The creation and administration of trusts and companies on behalf of clients has been highlighted by the government as one of the legal service areas at highest risk of exploitation by criminals1. We agree with this assessment and it is reflected in our sectoral risk assessment. We have produced this document to set out information on money laundering and terrorist financing risks that we consider relevant to those we supervise.

Trusts and companies are attractive to money launderers because individuals can:

  • obscure the beneficial ownership and control of assets and wealth
  • create and control multiple legal entities at a relatively low cost
  • create complex and opaque structures
  • operate across multiple jurisdictions
  • avoid tax or duties.

They are the vehicle of choice for the legitimate investment and business world, however criminals may use them to add a veneer of legitimacy to illegal transactions.

The government is committed to disrupting and stopping money launderers and continuing to develop anti-money laundering (AML) and counter terrorist financing (CTF) requirements to monitor, assess and mitigate the risks posed by these vehicles2.

Our role

In July 2018, our Risk Outlook highlighted our growing concern about the risks and challenges posed to the profession by those looking to launder the proceeds of crime and finance terrorism. We explored this further in our Autumn update, where the concern was raised as a priority risk. Our interest in this area continues to intensify and is reflected in our significant, ongoing activities.

As a professional supervisory body, we have a statutory duty to make sure those we regulate assess risks and take proactive steps to mitigate and respond to money laundering issues. We must also take "effective, proportionate and dissuasive disciplinary measures3" where firms do not reach the required standard.

Our activities in this area are monitored by our supervisor, the Office for Professional Body Anti-Money Laundering Supervision (OPBAS).

What we did

In 2018 we reviewed 59 law firms in England and Wales that told us they carried out trust and company service provider (TCSP) work. We had initially planned to review 60, but upon visiting one firm we found they did not carry out this work. We met with firms, money laundering reporting officers (MLRO), money laundering compliance officers (MLCO) and fee earners.

At each firm, where possible, we reviewed two TCSP files. This report features findings from 115 file reviews.

We looked at each firm's compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). The MLR 2017 place certain responsibilities on firms and individuals offering services most likely to be targeted by money launderers, including TCSPs. Around two thirds of the firms we regulate fall within scope of the MLR 2017.

This report summarises what we found. It builds on our two previous money laundering reviews in 2016 and 2017. These looked more generally at how law firms were tackling money laundering. The 2017 review also considered how they were responding to the government's money laundering regulations.

Headline summary

  • In this review we found most law firms who carry out TCSP work are adequately meeting their obligations to tackle money laundering. Yet a significant minority are not doing enough, with some falling seriously short.
  • We found no evidence of actual money laundering or that firms had any intention of becoming involved in criminal activities. Breaches of the MLR 2017 and poor training or processes could, however, mean firms are unwittingly assisting money launderers.
  • Any AML system is an interdependent collection of policies and processes. Where one of these areas fails, it weakens the strength of the entire system. Areas where we had particular concerns included firm risk assessments, file risk assessments and the overall adequacy and availability of policies, controls and procedures.
  • A firm risk assessment is required in legislation and should be the backbone of a firm's AML approach. We found that too many firms' approach was inadequate. More than a third of firms' (24) assessments did not cover areas required in legislation, this included a small number (four out of the 59 firms we visited) that had no risk assessment at all.
  • Firms need to understand who their client is and what money laundering risks they pose. Our concerns in this area included inadequate processes to manage risks around politically exposed persons (PEPs) - an issue in around a quarter of firms. Some firms are also not doing ongoing customer due diligence (CDD), which is particularly important for TCSP work where the client can change. We did, however, find that 15 firms had turned down client instructions, with clients being evasive one of the main reasons.
  • Most firms provided specific training about trust and company work and beneficial ownership. Poor training leads to poor compliance. Seven firms did not provide training on these topics and we have referred five of these into our disciplinary processes for breaches of the MLR 2017.
  • Only ten firms - a sixth of our sample - had submitted suspicious activity reports (SARs) in the last two years. This tallies with concerns raised by the National Crime Agency (NCA) that generally law firms are not being proactive enough in looking to identify and then report suspicious activity.
  • As a result of this review, we have referred 26 firms into our disciplinary processes. We will judge each case on its facts and will be keen to see evidence that firms are moving swiftly to comply with their obligations. We will take strong action against firms where we have serious concerns that they could be enabling money laundering, and/or those who fail to address our concerns promptly.
  • Other action we are taking includes:
    • publishing a warning notice highlighting our concerns, particularly in relation to firms' risk assessments
    • writing to 400 firms asking them to demonstrate compliance with the MLR 2017, focused on the approach to risk assessments
    • setting up a new dedicated AML team in the SRA, with increased resource to monitor and ensure compliance in this area.

Summary of findings by area

Most firms had appropriately assessed, monitored and mitigated the risks inherent within TCSP work. However, a significant minority of firms must improve across various areas.

Identifying and assessing risk

  • Four firms failed to produce written firm risk assessments. This is a mandatory document and informs each organisation's controls and mitigations.
  • Twenty-four firms had an inadequate file risk assessment that failed to cover various areas required by statute.
  • Twenty firms were not able to show that they had specifically addressed TCSP work in their firm risk assessment
  • Thirty-nine firms specifically covered TCSP work in their firm risk assessment.

Policies, controls and mitigation

  • File reviews revealed 21 occasions where firms were unable to show they had continued to review CDD and keep it up-to-date.
  • PEPs featured on six files we reviewed.
  • We were only satisfied with 45 of the PEP processes we reviewed.
  • We found no specific issues about the application of enhanced due diligence (EDD).
  • AML training was provided at most firms but 17 firms failed to provide training about TCSP work. Of that 17, seven firms also failed to provide training about beneficial ownership.
  • Firms had raised low numbers of internal suspicious activity reports (ISARs). These are reports about potential money laundering concerns raised by employees with the MLRO or deputy.
  • Only 10 firms had submitted SARs in the last 24 months.
  • Fifteen firms had turned down TCSP instructions for various reasons.
Open all
  1. "National risk assessment of money laundering and terrorist financing" the National Risk Assessment, (2017)
  2. For example, the introduction of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
  3. Reg 49(d) MLR 2017
  4. The FATF set standards and promote the effective implementation of measures to combat money laundering, terrorist financing and proliferation financing.
  5. "National risk assessment of money laundering and terrorist financing" NRA (2017)
  6. Reg 12(2) MLR 2017
  7. www.sra.org.uk/sra/how-we-work/reports/aml-risk-assessment.page
  8. Reg 46(1) MLR 2017
  9. Reg 51(1) MLR 2017
  10. Schedule 4(3) MLR 2017
  11. Reg 18 MLR 2017
  12. Reg 28(12)(a)(i) and (ii) MLR 2017
  13. Reg 46 MLR 2017
  14. Reg 46(4)(a) MLR 2017
  15. Reg 18(1) MLR 2017
  16. Reg 18(6) MLR 2017
  17. Reg 18(3) MLR 2017
  18. Reg 18(4) MLR 2017
  19. Reg 18(6) MLR 2017
  20. Reg 18(2)(a) and (b) MLR 2017
  21. www.sra.org.uk/sra/how-we-work/reports/aml-risk-assessment.page
  22. As mentioned above, one firm did not carry out TCSP work. Their data has not been provided.
  23. Although 46 firms mentioned that they had incorporated our sectoral risk assessment
  24. Reg 28(12)(a)(i) and (ii) MLR 2017
  25. Reg 19(1) MLR 2017
  26. Reg 46(4) MLR 2017
  27. Reg 46(1) MLR 2017
  28. Reg 19(1) MLR 2017
  29. Reg 19 MLR 2017
  30. Reg 19(4)(a)(i)(aa)
  31. Reg 19(4)(a)(i)(bb)
  32. Reg 27(1) MLR 2017
  33. Reg 4 MLR 2017
  34. Reg 28(3)(a) MLR 2017
  35. Reg 28(3)(b) MLR 2017
  36. www.sra.org.uk/sra/how-we-work/reports/aml-risk-assessment.page
  37. Reg 28(11)(b) MLR 2017
  38. Reg 28(11)(a) MLR 2017
  39. Reg 28(11)(b) MLR 2017
  40. Reg 35(a) and(b) MLR 2017
  41. Reg 35(2) MLR 2017
  42. www.sra.org.uk/sra/how-we-work/reports/aml-risk-assessment.page
  43. Previously, PEPs only included overseas individuals but MLR 2017 has brought UK PEPs into scope
  44. Reg 35(5) MLR 2017
  45. Reg 19(4)(a)(ii) MLR 2017
  46. Reg 35(1)(a) MLR 2017
  47. Reg 33(1)(d) MLR 2017
  48. Reg 33(1)(b) MLR 2017
  49. Reg 33(1)(d) MLR 2017
  50. Reg 33(6) MLR 2017
  51. Reg 33(1)(f)(i) MLR 2017
  52. Reg 33(1)(f)(ii) MLR 2017
  53. www.sra.org.uk/sra/how-we-work/reports/aml-risk-assessment.page
  54. Reg 24(1) MLR 2017
  55. "Anti-money laundering and counter-terrorist financing measures in the United Kingdom", FATF 2018