Where the legal services may be vulnerable to AML risk
Law firms and solicitors are attractive to money launderers because of the services they provide and the position of trust they hold and regulators have long recognised this.
The Financial Action Task Force (FATF), the inter-governmental body that is responsible for setting worldwide AML standards, published guidance for the legal sector as early as 2008, updating this work most recently in 2019.
However, anti-corruption campaigners argue that such interventions have not galvanised sufficiently robust action.
Transparency International has accused the legal profession of turning a blind eye to money laundering. While Spotlight on Corruption has described law firms as “witting or unwitting enablers” of money laundering.
The bottom line is that criminals see the potential to use legitimate legal services to make their illicit financial, corporate, or real estate transactions look legitimate.
Potential danger areas include:
 |
 |
 |
|
Conveyancing and real estate work Both residential and commercial property provide a real and tangible asset into which criminals can channel illicit funds in order to create the appearance of legitimacy. They use legal services firms to manage such transactions, effectively moving dirty money into a clean asset. |
Handling of client money Where law firms have responsibilities that encompass handling client cash, even through designated client accounts, there is an opportunity for criminals to move the proceeds of crime into apparently legitimate funds.
|
Setting up trusts and company structures Where law firms are engaged to create structures, such as trusts and shell companies, there is potential for criminals to funnel illegitimate cash through these vehicles. By concealing the connection between perpetrators and the proceeds from their crimes, this facilitates money laundering. |
The international perspective
Most international jurisdictions regard legal services as a high-risk sector from an AML and CFT perspective and have introduced specific regulation that covers large numbers of law firms.
This typically mirrors the principles set out by the FATF, but the precise detail of frameworks and standards varies from one jurisdiction to another. Even so, one commonality is that many jurisdictions are considering further regulation.
In the European Union, the relevant regulation is set out in the 5th Anti-Money Laundering Directive, though this is due to be superseded by the 6th Anti-Money Laundering Directive in 2024. The EU is also working on plans to harmonise its AML rule books and to establish an EU-wide AML supervisory authority; this has met with some push back from the legal profession, including the Council of Bars and Law Societies of Europe. The EU’s proposals would extend the scope of coverage of legal firms from an AML perspective – and take powers away from supervisory authorities in the member states.
In the US, the Biden administration is currently seeking to increase scrutiny of professional services businesses, including law firms, as part of tighter regulation of so-called “gatekeeper” firms. The Establishing New Authorities for Businesses Laundering and Enabling Risks to Security (ENABLERS) Act has bi-partisan support and looks likely to pass into law in 2023.
The legislation is likely to bring many law firms within the scope of existing AML regulation in the US – through similar provisions on coverage to UK regulation – with the Financial Crimes Enforcement Network (FinCEN) responsible for scrutinising them.
Guidance from the Legal Support Advisory Group (LSAG) should be the starting point for UK law firms seeking to understand exactly what is necessary from an AML perspective. Compliance work will require action in a number of key areas.
|
Complying with sanctions All organisations are required to comply with sanctions and export controls that may be imposed by the UK Government or other jurisdictions on specific individuals or corporate entities. The number of these sanctions currently in force has increased significantly as the international community has targeted Russia and Russian entities following its illegal invasion of Ukraine. The Law Society has published a detailed guide to the UK’s sanctions regime to help law firms cope with these responsibilities. |
|
Customer due diligence Customer due diligence (CDD) rules set out the checks that law firms must make on their clients – these begin with identifying the client and verifying that they are who they say they are, but also encompass a broad range of additional duties. In practice, law firms are entitled to take a risk-based approach to CDD – more basic checks are acceptable for customers assessed as low-risk, but practices must have a policy in place to make that assessment in the first place. It is also important to note that CDD is an ongoing responsibility, and not limited to work with new clients. Firms will need to conduct ongoing monitoring, scrutinise transactions, and ensure CDD documents are up to date. |
|
Enhanced customer due diligence Clients who are assessed as higher risk must be subjected to enhanced due diligence requirements. Examples include situations where the client is from a high-risk country identified by the UK Treasury, the EU, or the FATF; where a transaction is complex, large, or unusual in some other way. There is also a more generalised duty on law firms to perform enhance diligence if they have any reason to think a client or transaction poses an increased risk of money laundering. In such cases, law firms are expected to go further to identify and verify clients, such as seeking independent verification sources, to take additional measures to understand the background of a client or to a transaction. Regular and ongoing monitoring will also need to be prioritised. |
|
PEP screening Politically exposed persons (PEPs) are individuals (and their close associates) who may be more susceptible to being involved in bribery or corruption because they hold a prominent position or influence. Where a client is identified as a PEP, a law firm will be automatically required to make enhanced AML checks; senior management approval must be given before the firm establishes a business relationship with the individual. These requirements mean the practice must have processes in place to identify PEPs, typically at the onboarding stage, but also through regular checks where the business relationship is ongoing. There is no single global definition of a PEP, but the FATF has issued guidelines on how to identify such individuals; these have largely been accepted in legislation in the UK and the EU. LSAG also offers guidelines on identifying PEPs in its guidance. |
|
Beneficial Owners A beneficial owner is an individual who ultimately owns or controls the client, or on whose behalf a transaction is being conducted. When dealing with clients working on behalf of beneficial owners, law firms must take reasonable steps to establish that owner’s identity, so that due diligence can be undertaken. Where the identity of the beneficial ownership can’t be established, the firm will need to consider whether the client relationship therefore represents an increased risk from an AML perspective – and whether it should continue to act for the client. |
|
Sanctions screening New customers may be subject to specific sanctions and export controls themselves or have links to individuals and countries that have been targeted. Operators therefore need to monitor the sanctions lists published by governments and other international organisations in order to ensure they are not in breach of these sanctions. The UK Government publishes and updates the UK Sanctions List online, with other jurisdictions following similar practices. |
|
|
Transaction monitoring and reporting Without robust transaction monitoring processes, gaming and gambling operators cannot be confident their services are not being used for criminal purposes. It is therefore important to have systems capable of identifying red flag transactions and sounding an alert. And where a transaction does raise concerns, operators will typically be required to file a suspicious activity report (SAR) to the National Crime Agency. In practice, it is difficult to define precisely what constitutes suspicious activity, but regulators deliberately set out broad guidance. The Gambling Commission warns: “Operators and employees working in remote and non-remote casinos are required to submit a SAR in respect of information that comes to them in the course of their business if they know, or suspect or have reasonable grounds for knowing or suspecting, that a person is engaged in, or attempting, money laundering or terrorist financing.” |
