There was an interesting development for law firms this week when Steve Smart, the FCA’s Executive Director of Enforcement and Market Oversight, spoke at the Law Society Economic Crime Conference.
His speech provided a useful early indication of how the FCA intends to approach its future role as AML supervisor for the legal and accountancy sectors.
When will the FCA take over?
The Government plans to make the FCA the AML supervisor for legal, accountancy and trust and company service providers.
Steve Smart said that the FCA expects to begin taking on responsibility for AML supervision of around 60,000 entities in the legal and accounting sectors at the backend of 2028.
The transition is therefore still some way off, but the FCA is already working with the existing Professional Body Supervisors and engaging with some of the firms that it expects eventually to supervise.
What will FCA supervision look like?
Perhaps the most significant message for law firms is that the FCA does not intend to adopt a one-size-fits-all approach.
Steve Smart said that the FCA will focus on whether a firm’s core AML controls are effective for the risks that firm presents, rather than simply imposing additional paperwork and information requests.
He also emphasised that the FCA’s approach will be risk-based, intelligence-led and technology-enabled.
This is consistent with the FCA’s wider approach to financial crime supervision. The FCA is already using large datasets and technology to identify potential risks and says that its intelligence systems can process more than 56 million records every day. It intends to bring information from the legal and accountancy sectors into this wider intelligence picture.
For law firms, this means that the quality of the information and data they hold about their own AML risks is likely to become increasingly important.
Does this mean more work for law firms?
Not necessarily.
In fact, one of the more reassuring aspects of Steve Smart’s speech was his repeated emphasis on proportionality.
He said that the FCA’s focus will be on criminals and firms that enable financial crime, rather than firms which are making genuine efforts to comply. He also said that the FCA wants to minimise unnecessary burdens on firms and reduce duplication where possible.
That does not mean that firms should become complacent. The FCA has made clear that it intends to identify risk earlier and intervene more quickly where it sees potential harm.
The practical message for law firms is therefore not necessarily “do more”. It is to make sure that what they are already doing is appropriate to their risks, effective and capable of being demonstrated.
Data and intelligence will become increasingly important
The speech also reinforces a trend that is already becoming apparent across AML supervision.
The FCA is investing heavily in data, technology and intelligence systems. It is working with the National Crime Agency and other partners to combine information from different sources in order to identify connections and emerging risks.
Steve Smart specifically referred to the importance of firms sharing information and intelligence appropriately, and to the opportunities created by the Economic Crime and Corporate Transparency Act for private-sector information sharing.
For law firms, this does not mean that they need sophisticated technology or an expensive AML system. But it does reinforce the importance of having good-quality, relevant and up-to-date information about the firm’s own AML risk profile.
That includes being able to demonstrate why the firm has identified particular risks, how those risks influence its controls and whether those controls are working in practice.
What should firms do now?
There is no suggestion in Steve Smart’s speech that law firms need to undertake an immediate wholesale review of their AML arrangements.
However, the speech provides a useful indication of what firms should be thinking about ahead of the transition.
Firms should consider whether they can demonstrate:
- that their firm-wide risk assessment reflects the risks to which the firm is actually exposed;
- that client and matter risk assessments are meaningful and influence the level of due diligence undertaken;
- that their AML controls are proportionate to the risks identified;
- that AML training is relevant to the firm’s actual work and client base;
- that the firm monitors and reviews its AML arrangements rather than simply having policies and procedures in place; and
- that the firm could explain and evidence why its approach is appropriate if asked by a future supervisor.
These are not new requirements. They are, however, likely to become increasingly important in an environment where supervision is based on data, intelligence and demonstrable risk management.
A gradual change rather than a sudden one
The FCA’s planned assumption of AML supervision is still more than two years away.
There is therefore no reason for firms to view Steve Smart’s speech as heralding a new set of immediate compliance requirements.
What it does provide is a useful indication of the direction of travel.
The FCA intends to use data and technology to identify risk, target its supervisory resources and intervene where it sees firms or activities presenting a greater threat. At the same time, it says it wants proportionate supervision and to avoid unnecessary burdens for firms that have effective controls in place.
For law firms, the sensible response is therefore to continue strengthening the fundamentals: know your risks, apply proportionate controls, keep those controls under review and be able to demonstrate that they are working.
That should put firms in a much better position when the transition to FCA AML supervision eventually takes place.
