Impact of the Fourth EU Money Laundering Directive

Impact of the Fourth EU Money Laundering DirectiveAmasis Saba – Compliance Manager Deputy MLRO

Agenda• Operating environment and Political landscape• Risk Assessments and the Risk Based Approach• Policies, controls and procedures/internal controls• Training• CDD

• Standard• On-going monitoring (OGM)• Enhanced (EDD)/Politically Exposed Person (PEP)• Simplified (SDD)• Reliance and record keeping (don’t forget GDPR)

• PSC Update• 5th Directive…?• View from Law Enforcement

UK National Risk Assessment – October 2015

• UK Legal Sector ranked 3rd highest regulated sector money laundering threat to the UK

• Legal Sector CDD failures

• Legal professionals should be aware that they are vulnerable to being targeted by criminals

www.blplaw.com Page 3 © Berwin Leighton Paisner

The landscape does not seem to be improving…• "law enforcement continue to identify cases of legal services being used to facilitate

money laundering, thought it remains difficult to prove in any given case whether the legal professionals involved are unwittingly exploited, negligent, wilfully blind or complicit".

• "legal professional privilege continues to pose a potential risk to effective law enforcement, where it is used inappropriately to mask illegitimate activity".

• " allocation of the MLRO role or customer due diligence responsibilities to fee earning members of staff poses a "potential conflict of interest" ".

• "currently law enforcement investigations mostly feature solicitors as the legal professional enabler". • HMT

• the level of ML vulnerability related to legal advice from legal professionals is considered as significant • EU Supranational Risk Assessment


Time for some positivity!


Risk Based Approach (Regulation 18)

• Risk Assessments – Must identify risks relevant to you and your firm (and be written down!)

• What to take into account?

• Address risk factors identified by National Risk Assessments (new one out end of this month)

Policies, controls and procedures (Regulation 19/20)

• Proportionate to size and nature and MUST link to risk assessment

• Senior Management approval

• Group level approach to subsidiaries and branches

• PCPs must cover:• Internal Controls • CDD• Reliance and record keeping• Monitoring, management and internal communications• Identification and scrutiny of obviously concerning transactions

Internal controls (Regulation 21)

• Mandatory Controls – everyone must have

• Additional controls – Dependent on “size and nature”:• Appoint MLR Officer• Employee screening• Independent Audit Function

• Demonstrable compliance

Word of warning…

• No policy ever stopped money laundering or regulatory sanctions!

• The only control that really matters are people• Three key drivers for people:

• Training• Remuneration• Internal ethics (conduct)

Training (Regulation 24)

• Relevant staff must be adequately and regularly trained

• Effective training is targeted and relevant

• Focus must be on behaviour

• Box ticking training leads to box ticking compliance

Pause for thoughts – Internal Controls…• Which lucky person is your MLR Officer?• Do you know what employee screening you do (internationally?) • Can independent audit be internal?• Do you use an external independent audit function, how often? If not how

do you demonstrate/test compliance?• Do people know who to bring law enforcement enquires to?• Training reviewed recently?• Is it sufficiently targeted/supplemented?• Dealing with training fatigue?• Is all of the above documented?


Cute 1.


Pointless approvals (Regulation 26)

• The 'beneficial owners, officers or managers' of your firm will have a year to apply to the SRA for approval

• Not clear if this will involve anything different from current approvals

• Still waiting on word from the SRA…


CDD (Regulation 27)

• Inconsistent approach• Risk based vs. prescriptive

• Client• verify their identity on the basis of a reliable

independent source

• UBO• identify the beneficial owners of the client,• take reasonable measures to verify their identity so you

know who they are and,

Risk based, but… (Regulation 27)

• Your approach to CDD must be risk based• However there are a number of mandatory requirements:

• Verify client’s company number or other registration number;• Verify the address of its registered office, and if different, its principal

place of business• Take reasonable measures to determine and verify

• the law to which the body corporate is subject, and its constitution (whether set out in its articles of association or other governing documents);

• the full names of the board of directors (or equivalent management body)• The senior persons responsible for its operations

• Verify the identify of anyone purporting to act on behalf of your client AND verify their authority to do so


Beware! (Regulation 27 Para.6)

• If the customer is a body corporate, and paragraph (7) applies, the relevant person may treat the senior person in that body corporate responsible for managing it as its beneficial owner.

• (7) This paragraph applies if (and only if) the relevant person has exhausted all possible means of identifying the beneficial owner of the body corporate

• USE AT YOUR OWN RISK!!!


On-going monitoring (Regulation 27)

• Must be risk based

• What does your OGM involve?

• How do you evidence?


Pause for thoughts – CDD…

• Who relies on Partners to obtain CDD, how is this being checked?

• New Business teams are now asking for pointless documents/verifications – air cover will be needed!

• Use of third party data providers/PSC Registers, proceed with caution

• How much is enough?• Do your CDD requirements relate to your risk assessment • Vital need for joined up/partnership approach


Cute 2.


Enhanced Due Diligence (Regulation 33)

• EDD must be applied:• If the client, or its UBO, is a PEP • With a business relationship/transaction with a person

established in a high risk third country (see next slide)• In cases your risk assessment identifies as higher risk

• Regulations provide an extensive list of factors that must be taken into account


EDD Factors

• Regulations provide an extensive list of factors that must be taken into account, these are broken down by:• Client• Services• Geography

• The presence of one or more of the risk factors identified in 33(6) is not in and of itself determinative of a higher risk situation.


Pause for thoughts – EDD…

• Do your risk assessments take the mandatory factors into account? Can you prove it?

• Have your business intake teams been trained to spot these or are you relying on the business to tell you if these factors apply?

• How are you deciding if a factor is sufficient to make a client/matter high risk?

• Do your fee earners know if they are working on a higher risk matter/client?

• How are you assessing country risk? https://www.knowyourcountry.com/country-ratings-table


PEPs (Regulation 35)

• Must be able to identify clients and UBOs:• who are PEPs or family members/close associates of

PEPs

• Must obtain senior management approval

• You can make your life easier…


Simplified Due Diligence (Regulation 37)

• No automatic SDD - If you want to apply it you have to be able to justify it

• Not all regulated entities are created equal!

• Regulations provide an extensive list of factors that mustbe taken into account, these are broken down by:• Client• Services• Geography

• Can’t apply SDD if you suspect money laundering!


Pause for thoughts – PEPs and SDD…• Who can approve PEPs?• Do you distinguish between ‘real’ PEPs and wannabes?• Can you produce a list of your PEP Clients/PEP UBOs• How are you taking ‘international organisations’ into account• Have you documented your SDD approach – simply lifting what you used to

do is almost certainly not sufficient• If you want to apply SDD it you have to be able to justify it• Caution regarding how much comfort to take in relation to an individual

resident in a low risk area?• Not all regulated entities are created equal! – Again, air cover may be

needed

Cute 3.


Reliance and Record Keeping (Regulation 39 and 40)

• Reliance – nice theory, badly done, made worse!

• MUST “immediately” obtain/provide CDD information

• Why bother? – Just request the documents (nicely)

• Record keeping


PSC Register

• The UK already had a requirement for companies and LLPs to maintain a publicly available register of persons with significant control

• Some elements of the PSC register did not meet 4th

EU Directive standard

• Biggest changes are to scope and update timings


5th Directive…No really!

• Just when you thought it was safe to look up…

• A range of measures suggested following European terrorist attacks

• All still under debate but include some troubling suggestions…


View from law enforcement

• SAR quality concerns mainly aimed at smaller firms

• Legal sector FAQ being produced in conjunction with NCA

• Joint Webinars (NCA, SRA, Law Soc.)

• NCA concerned/surprised about some consent requests where they would have expected the firm to walk away

Still feeling positive?


Obligatory ‘Questions?’ Slide


This document provides a general summary only and is not intended to be comprehensive. Specific legal advice should always be sought in relation to the particular facts of a given situation.

Documents

Impact of the Fourth EU Money Laundering Directive