An Anti-Money Laundering Timeline and the Relentless Regulatory Response

Increased Detail

While neither a measure of effectiveness nor proportionality, the increased length of the MLR 2017 is at least indicative of the increased scale and reach of the latest AML legislative developments. The Money Laundering Regulations 2007 (MLR 2007), themselves made up of 51 regulations, six schedules and 100 pages, have been replaced by the MLR 2017 at 110 regulations, seven schedules and 118 pages. Four of the sections are devoted to the Transfer of Funds (Information on the Payer) Regulations, which regulations were previously contained in separate legislation. The MLR 2017 note that ‘the Treasury are designated for the purposes of section 2(2) of the European Communities Act 1972 in relation to the prevention of money laundering and terrorist financing’ ¹⁶ compared to simply ‘in relation to measures relation to preventing this use of the financial system for the purpose of money laundering’ ¹⁷ as set out in the MLR 2007. Not only is the size of AML measures expanding, but so is the ambition behind them and the consequent burden being placed on those required to comply.

Increased Burden

While the basic requirements of the MLR 2017 largely build upon the foundations set by the MLR 2007, the detailed provisions contain several extensions to the obligations. In order to comply with the new MLR 2017, those within the regulated sector (which itself has remained largely unchanged) ¹⁸ must continue to carry out customer due diligence (CDD) measures, ¹⁹ make suspicious activity disclosures, ²⁰ train staff, ²¹ keep records ²² and carry out risk assessments, ²³ but the way in which they do and record this must change. As before, ²⁴ contravention of a ‘relevant requirement’ under the MLR 2017 carries a hefty penalty of up to two years’ imprisonment, to a fine, or both, on indictment. ²⁵

Risk Assessments

The MLR 2017 require several layers of risk assessments, stretching from individual firms and practitioners and reaching up to EU level and beyond. In the UK, the top layer involves a risk assessment to ‘identify, assess, understand and mitigate the risks of money laundering and terrorist financing affecting the United Kingdom’ ²⁶ to be carried out by the Treasury and the Home Office. ²⁷ This risk assessment is required to take account of the reports of the ‘Commission’ under Article 6.1 of 4MLD, ²⁸ reaching yet further to ensure measures taken within the UK take account of risks identified at the EU level of ‘money laundering and terrorist financing affecting the internal market and relating to cross-border activities’. ²⁹ Underneath the Treasury and Home Office risk assessment, each supervisory authority must undertake a risk assessment, considering ‘international and domestic risks of money laundering and terrorist financing to those relevant persons for which it is the supervisory authority…are subject’. ³⁰ Finally, each relevant person ³¹ must ‘take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject’. ³²

At each level, account must be taken of risk reports at the superior level. ³³ The risk assessment obligations themselves are onerous, requiring identification of areas where enhanced CDD should be taken, and (where appropriate) what this would entail; identifying areas of lower and greater risk and considering whether the rules made by a supervisory authority in relation to its sector would be appropriate in the light of identified risks. ³⁴ Relevant persons must consider factors relating to customers, geographic areas, products or services, transactions and delivery channels appropriate to its operations when undertaking risk assessments. ³⁵

Customer Due Diligence

The CDD procedure under the MLR 2017 has many similarities with the procedure under the MLR 2007: as before, the requirements to identify the customer and to verify the customer’s identity remain. ³⁶ The relevant person must also ‘assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction’. ³⁷ Relevant persons have been familiar with CDD requirements in some form since the MLR 1993 and therefore can be expected to already have systems in place to meet these obligations. The MLR 2017 continue to distinguish among the three options of CDD, enhanced due diligence (EDD) and simplified due diligence (SDD). ³⁸ More onerous is the need for the relevant person to determine the need for EDD or SDD based on specified factors, including the risk assessment of the relevant person or on the basis of information available from the risk assessment of the supervisory authority. ³⁹ At the same time, some blanket provisions allowing for SDD ⁴⁰ have been removed, and EDD has been extended to cover domestic PEPs. ⁴¹

Beneficial Ownership and Transparency

One of the most significant features of the MLR 2017 is the expansion of provisions relating to transparency and disclosure. Relevant persons must undertake due diligence to identify the beneficial owner ⁴² of bodies corporate or partnerships ⁴³ and trusts and similar arrangements and others. ⁴⁴ Due diligence involves identifying the beneficial owner and then taking ‘reasonable measures to verify the identity so that the relevant person is satisfied that it knows who the beneficial owner is’ ⁴⁵ and taking ‘reasonable measures’ to understand the ownership and control structure of a legal person, trust, company, foundation or similar legal arrangement. ⁴⁶ These requirements correspond with recent legislation, prompted by 4MLD, requiring companies and limited liability partnerships to keep an up-to-date register of people with significant control and file information publicly with Companies House within 14 days of changes. ⁴⁷

In addition to requiring relevant persons to identify and verify beneficial owners, ⁴⁸ the MLR 2017 impose obligations on corporate bodies ⁴⁹ to comply with requests from relevant persons to provide information ⁵⁰ identifying matters such as name, board of directors, legal and beneficial owners ⁵¹ and ‘the senior person responsible for its operations’. ⁵² Given that the board of directors and legal and beneficial owners must already be identified, ⁵³ it is difficult to comprehend who else would fall within this category, and this seems to be something of a fishing expedition. Corporate bodies must also notify the relevant person of any change to information or identity of individuals within 14 days of becoming aware of such change ⁵⁴ and provide all or part of the identifying information supplied to a law enforcement authority on request ⁵⁵ within a reasonable period. ⁵⁶ Similar obligations are imposed upon trustees. ⁵⁷

To supplement the beneficial ownership obligations on trustees, ⁵⁸ HMRC ⁵⁹ is required to maintain a register of ‘beneficial owners of taxable relevant trusts’ ⁶⁰ and ‘potential beneficiaries of taxable relevant trusts’, ⁶¹ with trustees obliged to provide HMRC with specified information in relation to the trust, certain individuals, legal entities and beneficial owners, ⁶² initially by 31 January 2018 ⁶³ and then by 31 January following specified tax years. ⁶⁴ The information to be provided and maintained on the HMRC register contains not only basic details of the trust such as its name and the date on which it was set up ⁶⁵ but also the full name of any advisers being paid to provide legal, financial or tax advice to the trustees in relation to the trust. ⁶⁶ The information on the register must be available for inspection by any law enforcement authority, ⁶⁷ and HMRC must ensure that the NCA ⁶⁸ are able to use the information to respond promptly to requests for information made by certain authorities and financial intelligence units within the European Economic Area but outside of the UK. ⁶⁹

Ownership and Management

The MLR 2017 extend their reach firmly into the upper echelons of the private sector actors by requiring that any beneficial owner, officer or manager and sole practitioners of a relevant firm ⁷⁰ should be approved by a supervisory authority on application. ⁷¹ It is questionable whether this level of control is required given that a supervisory authority must grant approval unless the applicant has been convicted of certain specified offences involving perjury, dishonesty or tax, ⁷² and it is likely that relevant firms will already take care to ensure the fitness for the office of those persons. ⁷³ In addition to seeking to control who may undertake certain professions, the MLR 2017 impose obligations on senior managers to approve the policies, controls and procedures of a relevant person ⁷⁴ and require that they (or a member of the board) should be responsible for compliance by a regulated person with the provisions of the MLR 2017. ⁷⁵ Senior managers are also given responsibility for approving a business relationship with a PEP. ⁷⁶

Information Gathering and Disclosure

Provisions are inserted throughout the MLR 2017 to support the gathering and sharing of information by ensuring the availability of written information and prompt disclosure up and down the compliance chain. For example, a relevant person’s policies, controls and procedures regarding the mitigation and effective management of risks of money laundering and terrorist financing must be maintained in writing, in addition to any changes to them, and steps taken to communicate them or any changes within the relevant person’s business. ⁷⁷ Even a relevant person’s risk assessment, the information upon which it is based, and an up-to-date written record of steps taken to carry out the risk assessment must be provided to its supervisory authority on request. ⁷⁸

The MLR 2017 seek to ensure that information regarding business relationships will be available on request by a full and rapid response to enquiries to financial investigators or law enforcement authorities (among others). ⁷⁹ A written record of training must be kept, ⁸⁰ and where disclosure of information to a law enforcement agency is required, specific provisions are made to ensure that the provision of information does not give rise to liability for the body corporate, ⁸¹ relevant person or supervisory authority. ⁸²

In support of these measures, the Criminal Finances Act 2017 amends the Proceeds of Crime Act 2002 to extend the moratorium period for response to consent suspicious activity reports from 31 days to up to 186 days. ⁸³ While the intention behind this policy is to provide law enforcement agencies sufficient time to respond to intelligence provided by the private sector, ⁸⁴ the potential impact on the private sector is assessed to be limited to the delays caused to legitimate transactions. ⁸⁵

Regulatory Growth and Development

While concepts within the MLR 2017 are not new to those already well-versed in AML compliance, the steady and significant expansion of obligations is of concern. ⁸⁶ Speculation about the pace of expansion of the money laundering regime is not new: following the publication of the 2003 FATF Forty Recommendations, ⁸⁷ which themselves prompted the MLR 2007 (see the Timeline), Reuter and Truman express doubts and concerns about the desirability, ‘that the global AML regime will continue to expand at its recent pace’. ⁸⁸ They go further to question the cost and effectiveness of the expansion of the AML regime:

‘…it is reasonable to ask just how much can be expected of governments and the private sector. Constructing a zero-tolerance regime that was consistent with the smooth flow of finance would be costly and politically unacceptable. At the margin, the broadly defined costs of extending the regime are not likely to be worth the modest reduction in money laundering and small contributions to ultimate goals to which such an extension would contribute.’ ⁸⁹

Following the MLR 2007, Harvey suggested that ‘the amount of regulation cannot continue to grow exponentially’, ⁹² however, as there is no sign of either a halt or a deceleration of the pace of growth, there appears, a decade later, to be continued reliance on the ‘sheer hope that such blanket approach will in some way prove effective’. ⁹³

Layers

The layers of compliance serve to diminish the effect of the rhetoric of proportionality by the time the end user is reached. As is clear from the Timeline, there is a gap of several years between the publication of FATF Recommendations to national implementation of the latest standards via money laundering regulations within the regulated sector, and in the meantime, the policies must travel down the chain via the EU, national government and the relevant supervisory bodies. Perhaps as a result of this time and distance between policy determination and regulated sector end users, at the initial inception of the policy, there is no real incentive for FATF to focus on proportionate implementation of standards and policies, as its high-level objectives focus upon threats to ‘the international financial system’. ⁹⁷ At the next level on the Timeline, the EU aspires to proportionality through its directives, ⁹⁸ but it is also driven to address the risks identified in its EU-level supranational risk assessment. ⁹⁹ Down one further layer, at national level, the ability of the UK government to be proportionate in its response is determined in large part by the evaluation of its compliance by FATF, ¹⁰⁰ which, subjective and variable, ¹⁰¹ is impossible to predict. At supervisory level, ¹⁰² proportionality is tempered by an obligation to ensure compliance, ¹⁰³ and among the regulated sector is virtually impossible to achieve as a consequence of being at the lowest level, bearing the ultimate burden of discretion further discussed below.

So the ‘operationalisation’ of the concept of proportionality may require examination of policy, element by element, ¹⁰⁴ but this exercise is complicated by the journey each element must make from initial high-level determination to practical implementation. In the case of restrictions on ownership and management of a relevant firm ¹⁰⁵ outlined above, for example, the high-level language is seemingly straightforward and uncontroversial, requiring a supervisor to:

…take the necessary measures to prevent criminals or their associates from being professionally accredited, or holding or being the beneficial owner of a significant or controlling interest or holding a management function, e.g. through evaluating persons on the basis of a ‘fit and proper’ test… ¹⁰⁶

Discretion

Given that, under the MLR 2017, it is among the private sector actors that discretion under the MLR 2017 must predominantly be exercised, ¹¹³ it becomes paramount that it is predominantly the private sector players who must comply with regulation or face reprimand, censure or imprisonment.

Discretion is found, for example, in the steps to be undertaken to determine beneficial ownership using ‘reasonable measures’. The requirement to take ‘reasonable measures’ gives rise to some ambiguity about exactly what steps a relevant person would be required to undertake to comply with this provision, in particular given that reliance on public registers is deemed inadequate. ¹¹⁴ While some discretion for the relevant person helps to avoid rigid obligations, it brings with it an onerous burden on the relevant person in determining whether or not they would be deemed compliant with the provision. This could lead to a relevant person refusing to act where a beneficial owner cannot be identified, though in fact the act allows the relevant person to treat the senior person in the body corporate responsible for managing it as its beneficial owner. ¹¹⁵ Similarly, a relevant person might feel obliged to take protective measures by undertaking the onerous task of documenting thoroughly steps taken to identify a beneficial owner and reasons why this has not been possible. As previously mentioned, discretionary provisions also impose an element of policing upon the regulated sector, for example, in determining whether information disclosed by clients is correct or otherwise which may or may not be effective. In such cases, there is no reason to suppose that corporate bodies would necessarily provide more accurate information to a regulated person upon request than to a public register.

The MLR 2017 also include a requirement for a relevant person to take account of its risk assessment (discussed above) and its assessment of the risk of the particular case ¹¹⁶ on the basis of a range of factors. These include, among others, the ‘purpose of the account, transaction or business relationship’, ¹¹⁷ the level of assets to be deposited or size of the transaction ¹¹⁸ and the regularity and duration of the business relationship. ¹¹⁹ This assessment, while seemingly logical, is another imposition on the relevant persons, who are, in addition to undertaking the CDD checks ¹²⁰ and keeping records, ¹²¹ required to exercise judgment as to the level of enquiry required, with the threat of non-compliance in the background.

It is easy to see that proportionality via ‘discretion’ would appeal to policy-makers at each level and yet feel less than satisfactory to end users who find themselves with no one below to whom the decision may be transferred. As was true for the MLR 2007, the MLR 2017 may be breached by failure to comply with its terms without any regard to whether money laundering has or has not taken place. The inevitable consequence of this is that relevant persons must strive to achieve compliance at all costs and are unlikely to welcome any discretion contained within the legislation. Where there is discretion, the relevant person will look to its sector guidance, and where that guidance is unavailable (for example, as a result of delays ¹²² ), unclear or ambiguous, a relevant person could be forgiven for erring on the side of caution, perhaps reflected in the steep increase in ‘DAML SARS’ ¹²³ recorded by the NCA. ¹²⁴ As global AML spending on compliance grows at a rate of almost 9% per annum ¹²⁵ and regulatory censure for failure to comply with AML regulations receives press coverage, ¹²⁶ it seems unlikely that the private sector feels confident in proportionality when it comes to the exercise of discretion.

It is difficult to reconcile proportionality with a political climate determined to combat threats of terrorism, transnational crime and money laundering to national and international security, and that is relentless in its rhetoric and ability to set targets, assess risks and draft regulatory standards for compliance. Above the lowest level of the chain, there is little incentive to achieve a proportionate response to a vague, indeterminable threat, yet plenty of incentive to identify risks and demonstrate compliance. At the lowest level, the regulated sector is much further detached from the array of ills which inspire policy-making, and the motivation behind the regulated sector response is much more likely to be driven by cost and compliance.

Timing and Uncertainty

As described above, one of the foundations of the MLR 2017 is the undertaking of layer upon layer of risk assessments, which each depends on risk assessments at the superior levels. These risk assessments are fundamental to the operation of the regulations, for example, in enabling regulated persons to determine whether CDD, SDD or EDD should be undertaken in respect of an individual client. While the European-level supranational risk assessment was first released on its due date, 26 June 2017, ¹³⁶ this was also the date for the implementation of the EU directive in member states. The UK’s Treasury and Home Office national risk assessment was issued in October 2017, ahead of its due date of 26 June 2018 ¹³⁷ (the first anniversary of the coming into force of the MLR 2017). In consequence, those further down the risk assessment chain have been unable to undertake the responsive risk assessments required, and upon which compliance with MLR 2017 depends, until significantly after the implementation date of the MLR 2017.

With delays to the publication of risk assessments come delays to sector-specific guidance, which help the regulated sector to understand and interpret their obligations under MLR 2017. This is of particular importance where provisions of MLR 2017 deviate from provisions of preceding legislation. For example, when undertaking CDD, persons within the regulated sector must now identify customers and verify their identity ‘on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified’ ¹³⁸ rather than ‘on the basis of documents, data or information obtained from a reliable and independent source’. ¹³⁹ While the change of wording is slight, a change to the manner in which CDD must be undertaken would be fundamental to compliance within the regulated sector and timely guidance is imperative to enable regulated persons to comply in the manner intended.

Ongoing Monitoring

Achieving the level of analysis and monitoring required by MLR 2017 within the regulated sector presents further operational challenges for the regulated sector. For example, the supervisory authorities themselves must ‘develop and record in writing risk profiles for each relevant person in its own sector’. ¹⁴⁰ These risk profiles can be generic based on relevant persons sharing similar characteristics and facing similar risks of money laundering and terrorist financing. ¹⁴¹ However, the supervisory authorities must have a good understanding of all businesses within its sector in order to make this determination, and ongoing monitoring is required to ensure the risk assessment is still appropriate, with an individual risk profile being required should circumstances change. ¹⁴² With a total of 25 supervisory authorities ¹⁴³ (in addition to the new Office for Professional Body Anti-Money Laundering Supervision since 1 February 2018), ‘over 23,000 businesses in the UK carrying out accounting, bookkeeping and auditing activities, and tax consultancy’ ¹⁴⁴ ; and ‘over 14,000 businesses in the UK carrying out legal services’ ¹⁴⁵ in addition to money service businesses, trust or company services providers, banks, estate agents, high-value dealers, retail betting and casinos, it is reasonable to doubt whether supervisory authorities have the capacity to effectively undertake such detailed monitoring of the regulated sector. At a more fundamental level, the very basis of risk assessment may also be called into doubt, which calls into question the foundation upon which the MLR 2017 is constructed. ¹⁴⁶

Resources

An additional barrier to operational effectiveness arises from the difficulty in resourcing compliance with the provisions of MLR 2017, which requires information to be gathered and documented. For example, an obligation to undertake risk assessments by a relevant person ¹⁴⁷ is supplemented by an obligation to keep an up-to-date record in writing of the steps taken, ¹⁴⁸ and the risk assessment, and the information on which it was based, must be provided to its supervisory authority on request. ¹⁴⁹ For large firms with deep pockets and well-established compliance functions, this may be achievable and even already in place. For smaller members of the regulated sector, and in particular sole practitioners, this is likely to require a significant amount of time and attention to be withdrawn from day-to-day business. The requirement to document processes and procedures, in addition to being onerous, may also contribute to the tickbox culture to prove compliance and avoid culpability without proving the effectiveness of measures taken. ¹⁵⁰

Arbitrary Designations

There are several examples of apparently arbitrary designations of measures and standards under MLR 2017. For example, EDD must be carried out in respect of any business relationship or transaction with a person established in a high-risk third country, ¹⁵¹ which means a country identified by the European Commission as a high-risk third country. ¹⁵² Further, the assessment of geographical risk factors identifies, among other things, ‘countries identified by credible sources’, ¹⁵³ as ‘not having effective systems to counter money laundering or terrorist financing’ ¹⁵⁴ ; ‘having significant levels of corruption or other criminal activity…’ ¹⁵⁵ ; and ‘not implementing requirements to counter money laundering and terrorist financing that are consistent with the recommendations published by the Financial Action Task force in February 2012 and updated in October 2016’. ¹⁵⁶ The incorporation of such arbitrary standards and measures into MLR 2017 raises questions of effectiveness because designations may change due to political bias, FATF mutual evaluation or other unpredictable events. Responding to this will require effective communication and regular updates up and down the compliance chain.