AML regulations could soon expand to previously unregulated sectors, including universities. How should your organisation prepare?

With its 20-point lead in opinion polls, Labour seems poised to win in the UK’s upcoming July 4th election. If indeed Labour form the next government, economic crime in general and anti-money laundering in particular are likely to form the backbone of initial legislation given the unending criticism of the UK’s role in the ‘global laundromat,’ which London was called by shadow foreign secretary David Lammy, though even the former Conservative justice secretary criticised the last government for not introducing this failure to prevent money laundering offence and for watering down the failure to prevent fraud offence.

The All-Party Parliamentary Group on Anti-Corruption, headed by Labour grandee Dame Margaret Hodge, recently produced a thorough manifesto on tackling economic crime. If the polls are correct and Keir Starmer is set for a stonking majority in the next parliament, it’s hard to imagine what of Hodge’s agenda would be omitted.

Dame Margaret Hodge is not standing for re-election in 2024, but her manifesto fits right in with Labour thinking. It repeats common calls for finding new ways to seize frozen assets and enhance data sharing and crime fighting powers for law enforcement. 

The manifesto calls on the next government to ensure that all companies and firms should declare the identity of individuals with significant ownership or control over their activities. The UK should also impose obligations on Companies House to verify the status of shareholders and stop people hiding behind nominee shareholders. 

The APPG report also calls on the government to expand the failure to prevent fraud offence to cover companies of all sizes, as well as introducing a new failure to prevent money laundering offence, which may even go beyond just the regulated sector.

The manifesto also demands the next government introduce senior executive liability for economic crimes committed by the company as a result of neglect by a senior executive. This means individual criminal liability for senior executives who facilitate or fail to prevent these crimes from taking place. 

Significantly, the APPG manifesto includes demands for broadening the scope of regulations on the enablers of economic crime. The manifesto calls for Anti-Money Laundering Regulations (MLRs) to cover private schools, universities, PR agencies, developers, all letting agents and commodity traders, to consider including litigation in the anti-money laundering duties. 

One in five institutions are leaving themselves vulnerable to money laundering by continuing to accept cash

Campuses are under increased scrutiny and accountability from stakeholders including students, staff, government organisations and the public who are pressuring them to demonstrate accountability and transparency in their operations. There have been a number of recent cases in the news about a lack of transparency when it comes to paying fees and even securing places at higher education institutions. 

One of these issues is that actually a lot of universities are at risk of being vulnerable to money laundering. This is due to their significant financial transactions, international connections, and diverse funding sources, which can be exploited by criminals seeking to launder money through legitimate channels. 

Some UK universities are still accepting large cash payments for fees, and this definitely poses a money laundering risk since large cash transactions can be difficult to trace and are often used to conceal the illicit origin of funds. A recent study found that one in five institutions are leaving themselves vulnerable to criminal gangs and money laundering by continuing to accept cash for fees. 

In addition, the UK’s National Crime Agency (NCA) revealed in 2020 that increasing numbers of students are being used as money mules, i.e., their bank accounts are being used by organised criminals. This means that criminals abuse the students’ bank accounts to launder money through things like paying fees. Any large payments like fees that are done in cash are vulnerable to financial crime. That’s why in sectors like financial services or law firms, if there is a suspicion of money laundering activity, or red flags are identified, a suspicious activity report needs to be filed. And this is required of universities and colleges, even though they aren’t specifically included in the money laundering regulations yet.

Recent research by Cardiff University and the University of the West of England found that a fifth of higher education institutions are not providing training or guidance on money laundering risks, and a quarter do not provide any guidance on the risks posed by financial crime.

With universities possibly coming under the scope of MLRs soon, it is prudent for these and other previously non-regulated organisations to take a thorough look at their anti-money laundering procedures and staff training.

How should your organisation prepare?

  • Understand how money laundering affects your industry and organisation specifically
  • If you are regulated, consider reviewing AML procedures in terms of a new failure to prevent money laundering offence
  • If your industry could be regulated in the future, start to understand what AML compliance would look like. This would include:
    • training, 
    • implementing an automated incident reporting system, and 
    • implementing AML procedures such as regular risk assessments on their activities (i.e. accepting fees), due diligence on customers (i.e. students paying fees), and have systems in place to spot suspicious activity and red flags.
  • Prepare for the expansion of failure to prevent fraud offences
  • Assess the risk of economic crime in your business, and prepare mitigation measures

VinciWorks’ new HEFE training package

VinciWorks’ new safety and compliance training package for higher and further education institutions includes over 50 courses most commonly used and requested by other educational institutions so you can meet the training requirements of all your staff and students. The VinciWorks Education Package provides training in five comprehensive suites – compliance, information security, health & safety, diversity & inclusion and performance & leadership.

The General Election and Compliance – Special Webinar

Every sector could be impacted and every area of compliance is likely to be reviewed by the next government. From overhauls of financial services regulation, reviews of data protection law, closer alignment with EU regulations and an expansion of health and safety protections, the next parliament will see compliance at the centre of the regulatory agenda.

With everything from whistleblowing reform to overhauls of corporate governance, new employment rights like menopause leave and expanded equal pay rules, alongside crackdowns on tax evasion and expansion of the money laundering regulations, organisations large and small should prepare for the outcome of the general election.

This webinar will cover:

  • What the main parties are pledging on key compliance areas
  • Potential changes to legislation including the Equality Act, sexual harassment and employment rights
  • Expected legislation on AML, bribery, sanctions, fraud and economic crime
  • Possible expansion of regulations around GDPR, AI and health and safety
  • Preparing your organisation for future regulatory changes and new requirements
How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.