FCA warns firms to do better on risk assessments and training

The Financial Conduct Authority (FCA) has warned over 1,000 Annex 1 firms (lenders, money brokers and financial leasing companies), about serious money laundering failings at the most basic level.

The FCA has written to these firms, making it clear that firms should “complete a gap analysis against each of the common weaknesses we have outlined within six months.” The FCA’s letter also says that in future engagements with the FCA, they expect to be provided with the findings from the gap analysis, the gaps identified, and the progress towards effective policies, controls and procedures. Failing to do so could result in regulatory action. 

The FCA’s review of financial crime controls revealed widespread weaknesses across various areas. Firms were found to be inconsistent in reporting their activities to the FCA, failing to adapt their controls to accommodate business growth, and lacking proper risk assessments. Additionally, the FCA identified shortcomings in due diligence procedures, ongoing monitoring, and the documentation of financial crime-related decisions. The review also highlighted a lack of resources and inadequate training provided to staff, alongside insufficient oversight from senior management. 

Continue reading

Our recent poll reveals an alarming gap between concern and action regarding fraud. While nearly half (48%) of the 258 surveyed compliance professionals across the UK, Europe, North America, and other key regions consider fraud a high concern, 38% of their organisations haven’t planned any fraud prevention training.

Continue reading

Thanks to GDPR, DPIAs matter more than ever. Here’s why – and tips on how to do them

A data protection impact assessment (DPIA) is a process to help identify and minimise the data protection risks of a project. They always mattered but the General Data Protection Regulation (GDPR) made them matter much, much more.

As most Data Protection Officers (DPOs) and data processors are aware by now, GDPR added significant compliance burdens. Under GDPR, data breaches need to be reported to the authorities within 72 hours and each new data processing activity needs to be documented. GDPR also introduced a new obligation to do a DPIA before carrying out processing likely to result in high risk to individuals’ interests. If your DPIA identifies a high risk which you cannot mitigate, you must consult the Information Commissioner’s Office (ICO). The regulator can recommend changes to reduce the risk, give a formal warning not to carry out the processing or even ban the processing altogether. 

Continue reading

It’s been almost six years since Europe’s data protection landscape changed with GDPR. Are you prepared for SARs?

Since the General Data Protection Regulation (GDPR) was passed there has been almost constant change for companies, with new case law, rulings and court cases making compliance with GDPR an ongoing hot topic for organisations of all shapes and sizes.

With GDPR decisions from 27 different member states coming through on an almost daily basis, it can be a challenge to ensure compliance. One of the basic rights of GDPR is a subject access request (SAR). It provides people with the right to access and receive a copy of their personal data, and other supplementary information. SARs can be made verbally or in writing, including via social media.

People are entitled to find out what personal data is held about them by an organisation, why the organisation is holding it and who else knows the information. 

Continue reading

Australia is a global outlier in AML

Australia is one of only five countries to exempt lawyers, accountants and real estate from anti-money laundering rules. The Australian government has committed to change this, expanding AML/CTF obligations to an additional 100,000 ‘Tranche-2’ entities in Australia, while modernising the AML regime. The reforms are expected to be introduced to parliament in 2024, but have received push back from some affected industries.

Continue reading

Download your free guide to the latest developments in sanctions on Russia and what your firm needs to do to stay compliant

The field of economic sanctions has been growing increasingly complicated in recent years. The past year was a historic and transformative period for the use of financial sanctions on both the global and UK levels. Western nations launched an unprecedented line of sanctions against Russia and Russian companies, and also against Russia’s ally Belarus, in response to its February 2022 invasion of Ukraine. With the war showing no end in sight, sanctions and penalties for non-compliance are only continuing to ramp up. 

All businesses, both regulated and unregulated, must comply with financial and trade sanctions and companies must be able to prove that they are properly screening for sanctions. Failure to comply with screening requirements can carry stiff penalties reaching into the millions per infraction and remember that there’s strict liability when it comes to sanctions so any sanctions breach, even accidental, is a crime. 

Continue reading

The UK’s Equality and Human Rights Commission (EHRC) has issued guidance to inform firms they could be liable for being taken to an employment tribunal if they do not make reasonable adjustments for staff experiencing menopause.

Adjustments can include time off, flexible hours, relaxed uniform policies and rest areas. Failing to make reasonable adjustments can amount to disability discrimination, as menopause symptoms can have a long term and substantial impact on a person’s ability to carry out usual day-to-day activities.

Continue reading

Download your free guide to learn how it will impact your company

In recent years, artificial intelligence (AI) systems have become increasingly common in both business and daily life – with many people not even fully aware that AI is changing the way they go about their day.  From virtual assistants to online shopping to driving to streamlining production processes, AI is powering so much of what we do.

In December 2023, the EU’s three branches – the European Parliament, the Council of the EU and the European Commission – reached a provisional agreement on the EU’s proposed Artificial Intelligence Act (AI Act). Once it passes – it hasn’t been fully approved yet – it will be the world’s first comprehensive legislation on AI and could set a standard for laws enacted in other parts of the world. 

Continue reading

Download your free guide to every item under Russian trade sanctions

What is the Common High Priority List?

The Common High Priority List has been developed by the UK, US, EU and Japan which includes many items found on the battlefield in Ukraine. All these items are under sanction. The list is divided into four Tiers, each containing particularly sensitive items such as integrated circuits used in Russian weapons systems, as well as mundane items like ball bearings and TV cameras.

There are dozens and dozens of individual items listed on the Common High Priority List. These items should be treated like handling stolen goods. Transporting, selling, buying, shipping or otherwise being connected to the supply of these goods to sanctioned entities is a criminal offence.

Continue reading

For firms subject to AML regulations, there’s been a host of new rules and guidance. Here are the key reminders and  takeaways

The Law Society has published proposed updates to Legal Sector Affinity Group (LSAG) as an addendum. They await Treasury approval of the wording. The changes are largely reminders and clarification on certain points and are not likely to have a large impact. 

Continue reading