The Solicitors Regulation Authority (SRA) has updated its sectoral risk assessment for anti-money laundering and terrorist financing, following HM Treasury’s publication of its National Risk Assessment.
For firms within the scope of the Money Laundering Regulations, the SRA’s assessment is an important starting point when considering the risks faced by the firm. Firms should take the sectoral risk assessment into account when preparing and maintaining their own firm-wide risk assessment (FWRA).
The latest update identifies a number of emerging and continuing risks which should prompt firms to consider whether their own risk assessments, policies and procedures remain appropriate.
Cash-intensive businesses – a particular area of focus
One of the key takeaways from the updated assessment is the increased emphasis on cash-intensive businesses and high street crime.
The SRA highlights the heightened money laundering risks associated with cash-intensive businesses and nominee arrangements, particularly where beneficial ownership, control or the source of funds may be difficult to establish.
The assessment identifies risks in areas such as commercial property work involving cash-intensive businesses and company matters involving nominee or otherwise unconnected directors.
Firms should also be alert where a client’s turnover, profitability or stated activities appear inconsistent with the size, age or apparent operations of the business.
This does not mean that a client operating a cash-intensive business should automatically be treated as high risk. Rather, firms should consider whether the nature of the business creates additional risks and whether their CDD, source of funds and risk assessment procedures adequately address them.
Physical cash and property transactions
The SRA separately highlights the risks associated with physical cash, particularly because cash can make the origin of funds more difficult to establish.
The fact that cash has subsequently been paid into a bank account does not, of itself, answer the question of where the money originated.
This is particularly relevant to property transactions. Firms should be alert to substantial cash being used to fund property purchases and should consider whether the explanation for the cash is credible, supported by appropriate evidence and consistent with what the firm knows about the client and the transaction.
Don’t automatically rely on previous CDD
Another important addition is the SRA’s focus on passporting and reliance on existing due diligence.
A client having previously been through CDD does not necessarily mean that the firm can simply rely on that information for a new matter.
The firm needs to consider whether the existing due diligence remains appropriate for the new instruction and whether the circumstances, risk profile or nature of the transaction require further information or verification.
This is particularly relevant where previous work was outside the scope of the Money Laundering Regulations or where CDD was undertaken for a different purpose or in materially different circumstances.
The practical message for fee earners is simple: “we have acted for this client before” is not, by itself, an AML risk assessment.
AI, deepfakes and identity fraud
The updated assessment also reflects the rapidly developing risks presented by technology.
The SRA highlights the increasing use of AI, deepfakes and sophisticated identity fraud, particularly in connection with remote onboarding and digital identity verification.
Firms should therefore consider whether their existing CDD procedures remain sufficiently robust where clients are onboarded remotely and whether there are adequate controls for identifying unusual or potentially manipulated identification documents and communications.
Companies House information is not proof of legitimacy
The SRA also draws attention to risks associated with company registration and Companies House information.
The fact that information appears on the Companies House register does not, by itself, establish that the underlying company, directors, shareholders or transaction are legitimate.
Firms should continue to apply appropriate scrutiny to corporate structures and consider whether the information available is consistent with what they know about the client and the matter.
This is particularly important where there are unusual ownership structures, nominee arrangements or other indicators that the registered structure may not reflect the true ownership or control of a business.
Global instability and sanctions risks
The assessment also reflects the wider international environment, including risks arising from geopolitical instability.
Firms should consider risks associated with corruption, sanctions evasion, illicit movement of assets and proliferation financing, particularly where clients, counterparties, jurisdictions or transactions have relevant connections.
This reinforces the importance of considering AML and sanctions risks together rather than treating them as entirely separate compliance exercises.
What should firms do now?
The publication of an updated sectoral risk assessment is a good opportunity for firms to review their own FWRA.
In particular, firms should ask:
- Does our FWRA reflect the risks identified in the updated SRA assessment and the National Risk Assessment?
- Do we have clients operating cash-intensive businesses, and have we properly assessed the additional risks they may present?
- Are fee earners alert to the risks associated with physical cash and cash-funded property transactions?
- Do our procedures deal appropriately with nominee arrangements and potentially opaque ownership structures?
- Are we automatically relying on previous CDD when we should be reassessing the client and the new matter?
- Are our CDD procedures sufficiently robust to address AI-generated documents, deepfakes and remote identity fraud?
- Are we placing too much reliance on information obtained from Companies House without considering the wider circumstances?
- Does our FWRA accurately reflect the types of clients, work and transactions that our particular firm deals with?
The important point is that firms should not simply update the date on their FWRA and file the new SRA assessment away.
The SRA’s assessment should be used to challenge and test the firm’s existing risk assessment and controls.
For some firms, the changes may require only targeted amendments. For others, particularly firms acting for cash-intensive businesses, dealing with complex corporate structures or handling significant client money, the update may warrant a more comprehensive review.
Either way, now is a good time to ask whether your firm’s AML controls genuinely reflect the risks it faces today – and whether those risks are understood by the people dealing with clients and transactions every day.
