The high cost of AML failures: Lessons from a recent disciplinary case

In a striking case that underscores the serious consequences of failing to meet anti-money laundering (AML) and financial compliance obligations, a London law firm and its compliance officer were fined £25,000 each for multiple regulatory breaches. The Solicitors Disciplinary Tribunal (SDT) found that Law and Lawyers Ltd, an East London firm, and its senior director, Francis Mathew, had committed extensive failures, including misleading regulatory declarations, inadequate AML procedures, and serious client account shortfalls. The case serves as a warning to legal practitioners about the importance of strict adherence to AML regulations and financial governance.

 

A pattern of non-compliance

The case against Law and Lawyers Ltd and Mr Mathew arose from an investigation initiated by the Solicitors Regulation Authority in 2022, following concerns about the firm’s AML procedures and business management. The investigation uncovered significant compliance lapses, including:

 

  • Client account shortfalls: The firm had a deficit of more than £40,600 spread across 423 client matters.
  • Residual balances: Over 1,786 client matters had residual balances totalling £287,800, which had been left untouched for at least a year.
  • Misleading AML risk assessment declaration: Mr Mathew falsely declared to the SRA in 2020 that a firm-wide AML risk assessment was in place when, in reality, it was only drafted in 2022.
  • Failure to conduct proper source of funds checks: Of 15 conveyancing matters reviewed by investigators, 12 exhibited AML compliance issues, including transactions funded by third parties without adequate due diligence.

The SDT found that these breaches were not isolated incidents but part of a broader pattern of systemic non-compliance within the firm.

 

AML failures: A closer look

One of the most concerning findings was the firm’s inadequate AML risk assessment. Firms are required under money laundering regulations to have a documented, firm-wide risk assessment identifying their exposure to financial crime. Mr Mathew, as the firm’s compliance officer, certified to the SRA that such a risk assessment existed when it did not. The SDT determined that this was reckless conduct rather than an innocent mistake, as he had made no effort to confirm whether the document was in place.

Another major failing was the firm’s approach to source of funds checks. The SRA’s review of 15 conveyancing transactions found that:

  • Three were funded by third parties in China without adequate scrutiny.
  • Three had unclear sources of funds with no follow-up enquiries.
  • In multiple cases, Law and Lawyers Ltd failed to verify the legitimacy of client funds, a fundamental requirement under AML regulations.

 

The tribunal noted that conveyancing is particularly susceptible to money laundering risks, making robust AML procedures even more critical.

 

Misuse of client funds

Another alarming aspect of the case was the mismanagement of client funds. The firm had widespread accounts rule breaches, including the improper handling of residual client balances and failing to conduct reconciliations within the required timeframe. The SDT found that Mr Mathew knowingly allowed a practice akin to using one client’s money to pay another—a severe breach of professional standards.

Residual client balances presented further regulatory concerns. The firm held £287,800 in funds that should have been returned to clients or properly billed. The tribunal criticised Mr Mathew for failing to act promptly, noting that efforts to return funds only accelerated once the SRA investigation was underway.

 

Mitigation and penalties

In mitigation, Mr Mathew’s counsel argued that:

  • The compliance failures occurred during a period of intense workload due to the stamp duty land tax holiday, coupled with a reduction in available staff due to the COVID-19 pandemic.
  • The firm had sufficient reserves to cover any client account shortfalls.
  • Mr Mathew took on too many responsibilities in a fast-growing firm without fully understanding the depth of compliance requirements.
  • The firm had since made efforts to rectify its failings and implement proper procedures.

 

Despite these arguments, the SDT imposed significant penalties, stating that the risk of harm was “clear and real as opposed to theoretical.” Mr Mathew was also barred from acting as a compliance officer in future without explicit SRA permission.

 

Lessons for law firms

The £25,000 fines imposed on Law and Lawyers Ltd and Francis Mathew, along with the restrictions placed on Mr Mathew’s future compliance roles, serve as a stark reminder of the importance of robust AML procedures and financial compliance. Regulatory breaches not only expose firms to significant financial penalties but also erode public trust in the legal profession. Law firms must prioritise compliance, invest in proper risk management frameworks, and ensure that those responsible for regulatory oversight fully understand their obligations. Failure to do so can lead to serious consequences, as demonstrated in this case.

This case highlights several key takeaways for legal professionals and compliance officers:

  1. AML compliance must be taken seriously: Law firms must have a properly documented firm-wide risk assessment and ensure that AML checks are thorough and properly recorded.
  2. Declarations to regulators must be accurate: Misleading the SRA, even recklessly, can result in severe disciplinary action.
  3. Client funds require meticulous management: Shortfalls, residual balances, and improper reconciliation practices can lead to significant penalties and reputational damage.
  4. Compliance roles require expertise: Individuals responsible for AML and financial compliance must be adequately trained and should not take on excessive responsibilities without proper oversight.
  5. Proactive remediation is crucial: Addressing compliance failures promptly, rather than waiting for regulatory intervention, can mitigate penalties and demonstrate a commitment to professional standards.
How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.