The Fourth AML Directive: What do accountants need to know?

Money Laundering

One of the first orders of business for the new government, whatever its colour, is to pass the Money Laundering Regulations 2017. According to EU rules, the Fourth Money Laundering Directive must be transposed into UK law by 26 June. While the consultation phase has been completed, there is still room for a new government to make some movement on the new regulations if it wishes. The Directive still leaves some rules open to national interpretation, so while the core of the changes are set, a new government will have just weeks following the election to decide what to do.

However, for the main themes of the legislation we do know what will be changing. Accountants need to be aware of some of the key changes coming in the Fourth Directive.

UBO is changing

The ultimate beneficial owner of a corporate client will need to be determined and due diligence checks performed. A UBO is anyone who owns or controls 25% or greater percentage in a corporation. If you don’t know who the UBO of a client is, you must take “all reasonable steps” to determine this. If no beneficial owners can be identified, then the details of senior managers must be recorded.

CDD is changing

There will no longer be automatic exemptions from conducting client due diligence. Previously UK public authorities, pension schemes, or companies listed on regulated markets or who follow equivalent AML rules could have simplified due diligence automatically applied. This is no longer the case. Simplified due diligence can be applied, but the decision for this must be backed up with evidence and form one part of a justification for the level of due diligence to be applied.

PEP is changing

The rules for politically-exposed persons (“PEPs”) are no longer limited to those outside the UK. British-based PEPs will now be subject to the same scrutiny as foreign PEPs. The Directive notes that these rules are preventative and PEPs should not be stigmatised as being high risk.

Criminal activity is changing

In a departure from previous directives, tax crimes (including both direct and indirect taxes), fall in the definition of criminal activity. Therefore, someone dealing with funds from possible tax evasion could result in money laundering.

Third party equivalence is changing

Under the previous AML directives, a “white list” of jurisdictions whose AML procedures were considered equivalent to those in the EU allowed institutions to operate with a greater degree of freedom where the risk was thought to be lower. However, the Fourth Directive has rescinded the “white list” and country-specific risk determinations must be made for any jurisdiction outside of the EU.

The new risk-based approach

Overall, the Fourth Money Laundering Directive promotes a risk-based approach. Firms should consider each case on its own merits, assessing red flags and risk factors such as client behaviour or high-risk factors that may be present. After conducting a thorough risk assessment, a decision, backed up by evidence, can then be made. Operating this way helps to reduce the liability a firm may have should something go wrong. If they can evidence why they did what they did and how they acted, it will provide a stronger defence.

The encouragement of a risk-based approach is to help firms see due diligence as “a dynamic act, not a static one,” PWC reported recently. Monitoring for red flags and evaluating client relationships should be an ongoing part of a strong and robust business relationship

An example of good practice from ICAEW is to use trigger events in order to update due diligence on existing clients. If a client, for example, starts to work in a high-risk area, or a business owner starts to act differently than expected, these are good opportunities for a firm to investigate the changes.

VinciWorks’ updated AML e-learning suite

All of VinciWorks’ anti-money laundering courses are now fully compliant with the Fourth Directive. This includes the AML 360 course, a course that allows users to be updated on the hot anti-money laundering related topics of today.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.