Countdown to the Fourth Money Laundering Directive

The countdown to the new European money laundering regime has begun. The Fourth Money Laundering Directive must be implemented across the European Union by 26 June. On 12 April this year, the UK government ended the consultation on the draft regulations. Despite Parliament being dissolved and a general election taking place between now and the 26 June, it is relatively clear what changes to the UK’s AML regime will be made.

Despite knowing pretty much what the new law will say, the rapid, rollercoaster style timetable from the consultation to implementation has left little room for the regulated sector to get ready. From updating AML policies to retraining staff, a new AML regime means new changes.

Onto the Fifth Directive

Even while national parliaments are scrambling to rush through their AML updates, the EU is already drawing up rules for a Fifth AML directive. Designed to further increase transparency and assist law enforcement agencies, there may not be very much time for business to get used to one set of changes before having to prepare for the next ones.

The Fifth directive is expected to include a requirement on member states to have a central register of politically exposed persons requiring enhanced due diligence, plus making information from the register of beneficial ownership available to the wider public.

Why AML rules matter

Money laundering isn’t something that’s going away. On the contrary, enforcement action and eye-watering fines are only increasing. From the world’s biggest banks and corporations to high-street solicitors.

Allied Irish Bank (AIB) was fined €2.27m by the Irish Central Bank in April 2017 for six major breaches of money laundering and terrorist financing regulations. AIB failed to undertake CDD procedures for more than half a million customers, and had a backlog of nearly 5,000 suspicious transactions.

Shell, one of the world’s largest oil companies, recently admitted that it dealt with a convicted money launderer while negotiating for access to a Nigerian oil field. Shell and an Italian oil company paid £1bn to the Nigerian government, nearly half of which was allegedly laundered through Bureaux de Change and passed to the then president of Nigeria.

A solicitor was suspended for being involved in the transfer of almost £1.27m from her firm’s client account to an offshore bank account in Belize without due diligence on the source of funds. She had allowed her client account to be used as a banking facility and failed to spot red flags in the transaction.

What to do next

Plan to roll out new online anti money laundering training in 2017, once the transposition is complete. The training should include:
- Changes incorporated in the Fourth Directive
- How to perform and document a risk-based assessment of money laundering
- How to access the beneficial ownership registry
MLRO’s should perform and document an internal risk assessment
MLRO’s should update policies to reflect changes to the directive and incorporate a risk-based approach
MLRO’s should consider adding an audit function to test procedures
All new policies should be reviewed and approved by senior management

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”