Anti-Money Laundering Compliance for FCA-Regulated Firms

Anti-money laundering compliance for FCA-regulated firms

Anti-money laundering could be any law, regulation or procedure designed to respond to the threat of money laundering. However, it can be hard to decipher the precise rules which you need to be aware of. This is because the AML policies and procedures which apply to your organisation will depend on a number of factors, such as the jurisdiction in which you are based, the customers you work with, and the products and services you offer. In this blog, we will focus on the AML rules which apply to the UK’s financial service firms and introduce the guidance produced specifically for this sector.

The Proceeds of Crime Act 2002

The offences in the UK’s Proceeds of Crime Act 2002 (POCA) fit into two categories. First, are the ‘core’ offences that apply to everyone, and aren’t specific to the financial sector. These include:

Concealing or disguising criminal property
Removing criminal property from the jurisdiction
Acquiring, using or possessing criminal property
Entering into – or becoming concerned in – financial arrangements which you know or suspect involve criminal property

An arrangement concealing or transferring terrorist property could also be an offence under POCA. But this is explicitly prohibited under the Terrorism Act 2000.

POCA also contains offences that apply to the “regulated sector”. This term covers a number of businesses in the financial sector, such as banks, credit institutions and most businesses offering investment services. The additional rules include:

The “failure to report” offence, where knowledge or suspicion of money laundering is not disclosed to the National Crime Agency; and
“Tipping off”, or revealing that there is an ongoing investigation into money laundering.

The Money Laundering Regulations

In addition to the rules contained in POCA, certain organisations in the UK must adhere to The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, as amended (the MLRs). The MLRs apply to “relevant persons”, which includes banks, credit institutions, and building societies. The list has expanded recently, and now includes organisations undertaking crypto-asset activities. Whilst there are some exclusions, the FCA’s website warns that firms falling within these exclusions must still have AML procedures in place to prevent financial crime. Organisations governed by the MLRs must meet certain requirements, such as undertaking customer due diligence (CDD) in a number of situations. Examples of when CDD should be applied include when a business relationship is first established, or whenever money laundering is suspected.

The JMLSG Guidance

The Joint Money Laundering Steering Group has produced guidance on the prevention of money laundering for the UK financial sector. JMLSG’s Guidance is aimed at firms in sectors represented by its members (comprising a number of UK Trade Associations), as well as firms regulated by the Financial Conduct Authority (FCA). The aims of the guidance include setting out “what is expected of firms and their staff in relation to the prevention of money laundering and terrorist financing”. However, in keeping with the risk-based approach, the guidance allows for some discretion in how firms’ AML requirements are applied.

The guidance helps firms take the risk-based approach by explaining the practical steps that should be taken in order to prevent money laundering and combat terrorist financing. These include (amongst other topics) explanations on:

Ensuring senior management takes responsibility for managing the money laundering risks;
Properly carrying out CDD on a range of entities; and
Increasing staff awareness, including implementing proper training.

Charges against NatWest: a warning to FCA-regulated firms

Clearly, it is important for financial firms to comply with the MLRs, and to follow the guidance if they do not want to fall foul of the offences outlined above. This importance is emphasised by the recent charges brought against NatWest by the FCA, for failure to comply with its AML obligations. NatWest pleaded guilty to charges brought under the Money Laundering Regulations 2007. These have now been superseded by the MLRs 2017 referred to above. But the case relates to a failure to implement “adequate anti-money laundering systems and controls to prevent money laundering”, an enduring obligation under the current MLRs.

Sentencing is set for 13 December 2021, with NatWest expected to pay a large fine. This case should serve as a warning to anyone governed by MLRs, especially FCA-regulated firms.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”