Money Laundering Governance: Three Pillars of Success

The regulatory requirements for these roles are set out at regulation 21 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended) (the regulations).

MLCO

21 (1) Where appropriate with regard to the size and nature of its business, a relevant person must—a. appoint one individual who is a member of the board of directors (or if there is no board, of its equivalent management body) or of its senior management as the officer responsible for the relevant person's compliance with these Regulations

MLRO

21 (3) An individual in the relevant person's firm must be appointed as a nominated officer.

Under regulation 3: "nominated officer" means a person who is nominated to receive disclosures under Part 3 (terrorist property) of the Terrorism Act 2000 or Part 7 (money laundering) of the Proceeds of Crime Act 2002

While the strict regulatory requirements are brief, these roles carry considerable duties.

• While the MLCO can delegate some of their duties, overall responsibility for compliance with the regulations remains with them. We also expect them to be our point of contact within the firm and to have a detailed knowledge of their firm’s AML regime – most prominently, their firms policies, controls and procedures.
• The MLRO’s primary duty is to make suspicious activity reports (SARs) to the National Crime Agency (NCA). They can potentially face personal criminal liability if they fail to carry out this duty properly. This role is also likely to involve advising on how to deal with clients while waiting for the NCA to respond to reports, without alerting the client to the fact a report has been made. They are referred to in the regulations and Proceeds of Crime Act 2002 as a ‘nominated officer’.

These roles only apply to firms which are in scope of the regulations; those firms we regulate which are in scope are those which fall within the categories set out in regulations 11(d) and 12.

There is one further difference between the roles:

• Every firm within scope needs to have an MLRO – even very small firms. Even sole practitioners need to have one if they employ any other staff.
• Firms only need to appoint an MLCO if appropriate to their size and nature. This is not defined in the regulations, but in reality, most practices are likely to need one unless the principal is personally involved with all matters in scope.

AML officers are not the only people in the firm who need to be concerned about the risk of money laundering. A firm's first line of defence against money laundering are its fee earners, finance staff, administrative and reception staff, and it is for AML officers to lead them in this.

The only seniority requirement imposed by the regulations is on the MLCO, who needs to be a member of the firm’s senior management or board, if applicable.

However, in reality the holder of both of these roles will need to have a certain amount of authority in their role. An AML officer is likely to have to make commercially unpopular decisions and turn away work which, on the face of it, appears lucrative. They will also need to be able and prepared to overrule senior members of the firm, and to insist that those senior individuals do certain things such as completing training.

For an AML officer to be effective, they need to be the right person for the role.

Who should they be?

Of the 54 AML officers at 50 firms we initially surveyed:

• the overwhelming majority (87%) were equity partners or equivalent
• four were salaried partners or equivalent
• two were heads of department without a partnership or equivalent role
• one was a compliance officer.

An AML officer does not need to be at the very top of the firm’s hierarchy but should hold sufficient authority for their decisions to be automatically followed without further approval being required. The MLCO in particular must hold a position on the firm’s board, if it has one, or otherwise be part of senior management. An MLRO does not have this requirement, but will still need to have unquestioned access to the firm’s data and support from the MLCO, and the wider management, if they are to be effective.

One of the first decisions a firm will need to make about its AML officers is whether to appoint one person to hold both roles, or to appoint separate people.

Of the 50 firms we contacted, six had separate MLCOs and MLROs. This is a slightly higher percentage than the general picture across the firms we supervise, where around 90% of firms appoint the same person to fulfil both roles.

We asked firms why they chose to have separate role holders. They all gave different reasons, but they can be summarised as:

• a fairer division of the work
• separating the compliance function from the firm’s senior management
• a feeling that the role of MLCO sat naturally alongside that of Compliance Officer for Legal Practice (COLP)
• increasing the number of people fee earners could approach with any problems.

Firms should make this decision based on their own particular structure, work and expertise. Where MLCOs and MLROs are different people, we found that they also tend to delegate and divide the firm’s AML duties between them to some extent, rather than follow the division in the regulations. While AML officer need to be mindful of the distinct responsibilities of their roles, these are sensible practices, and we would not wish to curtail firms’ discretion.

We do, however, expect that the MLCO will take their role as guarantor of the firm’s AML compliance seriously. At one firm we visited, the MLCO had delegated large parts of his role to the MLRO. When asked about key aspects of the firm’s AML regime, such as training, he was unable to answer and directed us to the MLRO. While it is permissible for parts of the MLCO’s role to be delegated, they should retain oversight and make sure that they have an understanding of the firm’s overall AML regime for which they bear ultimate responsibility.

We asked the AML officers what, in their view, makes a successful MLCO or MLRO – 15 mentioned ‘authority’ or ‘seniority’ in a firm. Specific comments included:

• "Accountability to the Board. Ability to delegate and supervise".
• "Sufficient seniority to be able to deal effectively with fee-earners of all levels, including senior partners".
• "They need to be senior so they can ensure their recommendations are taken seriously and implemented by the firm at all levels".
• "Holding a senior role that provides an overview of the client base and work introduced to the business".

There are other benefits to having a senior member of the firm holding these roles. An intimate knowledge of the firm’s work and client base is invaluable and enables them to be alert to any matters out of the ordinary that might give rise to suspicion. Full access to the firm’s accounts is also of great assistance to gain an insight into the flow of money through the firm. Finally, an equity partner or equivalent will have a natural personal, professional and financial investment in the firm, its success, and its reputation.

Conversely, though, senior members of the firm with a number of different duties may find themselves struggling to find the time for effective AML monitoring. This is an aspect which we consider below in the second pillar, resources.

Authority is not, of course, conferred solely by somebody’s formal position within the firm. One of the firms we spoke to had a professional, expert MLRO who was not part of the firm’s senior management but was supported by an MLCO who was also managing director.

Leading by example

It is also important for AML officers to model the behaviour expected of the firm's fee earners. One firm we spoke to said that a cornerstone of their AML regime was fostering a culture in which junior fee earners did not feel under pressure to accept each and every client who wished to instruct the firm. The MLCO modelled this by being selective about clients and encouraging junior fee earners to do so as well. He encouraged junior lawyers to consider the risks as well as rewards of each particular client. There was a benefit to the business in doing this as well, as it resisted a tendency for legal work to become process-driven, as opposed to the personalised service the firm wanted to provide.

Commitment to compliance can also be tested in other ways. One firm we spoke to addressed this as part of the interview process, which not only makes their intentions clear to candidates at the very outset, but also ensures that they will only appoint people whose values and attitudes align with the firm’s.

Determining the firm’s risk appetite and risk-based approach

This is a function which technically sits with the MLCO rather than MLRO. Where these roles are held by different people, however, the firm’s risk-based approach is certain to need some input from the MLRO.

Determining a firm's risk tolerance and appetite will need an intimate knowledge of the firm’s work and staff and AML officers are likely to need some time in the role before it can be properly set.

Five firms made the point that file reviews are an excellent way to shape the firm's AML regime. As well as ensuring compliance on an individual matter basis, file reviews:

• give AML officers an insight into how things are progressing within different parts of the firm
• allow them to connect with fee-earners and give an opportunity for one-on-one teaching
• allow firms to consider their client demographic (for example, location, business type, legal service needed) and use this to shape their risk-based approach
• let them see trends and tendencies within the firm’s work
• help the firm to achieve its obligation to monitor compliance under regulation 19(3)(e).

The AML officers we spoke to gave us several views on how they had determined the firm’s risk-based approach:

• Limiting the work they do to that with which they feel comfortable. This was as much a business decision as an AML risk one, based on an assessment of the work needed to carry out due diligence on high-risk clients balanced against the fee charged.
• Making the subject a standing item at partners’ meetings, to find out what the head of each department saw as the significant risks affecting them.
• Making sure to learn from any AML risk near-misses, at both an individual and a firm level.
• Using the firm’s case management system to monitor the way that matters and transactions were progressing, trends in clients and areas of law, and keep close watch of high-risk matters.
• Treating all of the firm’s work as being in scope of the regulations, to simplify the process and meaning that clients were not treated differently depending on whether they were in or out of scope. A long-standing employment client, for example, would not suddenly find themselves asked to identify themselves if they wished to use the firm’s conveyancing department.

Firm-wide risk assessment

A cornerstone of a firm’s risk-based approach is, of course, the firm-wide risk assessment made under regulation 18 (FWRA). We have published a considerable amount of material on this elsewhere, so will focus here on how it can be used in practice.

We noticed in some visits that the FWRA, once drafted, essentially remained dormant until its next update or review, or was only ever viewed by the AML officers. This should, though, be a living document which underpins the firm’s AML regime and should be reviewed whenever there is a change to the services provided, legislation, client base or delivery channels such as a move to remote working as a result of Covid-19. Periodic reviews are also sensible.  

We asked the AML officers we spoke to whether their colleagues ever fed in to the FWRA, and 17 said that they did. This is good practice and makes sure that the FWRA remains a relevant document which takes all of the firm’s business into account. Of the remaining 13, two were sole practitioners with no colleagues, and four said that they still informally canvassed colleagues’ views before drafting the FWRA.

Some thoughts from AML officers on involving their colleagues in producing a FWRA:

• "I prepared the FWRA in outline and then discussed with the Heads of Department. When I updated it, I sent them the original and said which areas needed updating or I'd like to enhance and expand".
• "We talk with new lateral hires who come in about AML risk as well. This makes sense as they bring new clients and areas of work with them".
• "I tasked all the people in my team to look at whatever was going on in each practice area and feed back to me. Other colleagues know more about their own work than I do".
• "We discuss this at partners’ meetings. We talk about the unusual circumstances of our practice, for example, referrals from our criminal clients, the fact that in university towns property is disproportionately expensive, and so on".

18 of the 30 AML officers also said that they used management information and data to inform the FWRA. The majority used their firm’s case management system to run reports on open matters and monitor trends across the business, which allowed them to see:

• trends in due diligence provided and risk level
• percentage of work in each department
• geographical areas and jurisdictions involved in the firm’s transactions.

Not all firms will have a case management system capable of doing this, of course. Where they do have access to these tools, however, we encourage firms to take full advantage of the services for which they are paying and hopefully simplify the risk assessment process. Some firms had case management systems with unused features which would have made the process much simpler and easier.

In addition, 21 of the 30 AML officers we spoke to shared the FWRA with colleagues across the firm. This did not, however, generally amount to more than placing it on the firm’s intranet. We consider that more use can be made of the FWRA, for example in training or explaining the underpinnings of the firm’s AML policies.

As a final point, a minority of firms said that they actively tested the firm’s AML regime. This took various forms:

• File audits and spot-checks.
• Testing the firm’s case management and e-verification systems to make sure they work as intended and provide the correct information.
• Regular checking of the firm’s remittances.
• Sending the firm’s inbox dummy emails to see how fee earners would react to it.
• One firm set up a mock visit from regulators to check over the conveyancing department's processes. While this will not be a suitable measure for all firms, it is an innovative way of keeping a check on the firm's procedures.

Testing the firm's AML regime is considered good practice, and will give MLCOs a realistic idea of how resilient their systems are.

Maintaining interest

To some, anti-money laundering can seem a dry and abstract topic with limited relevance – until it becomes suddenly, immediately and disruptively relevant. Fee-earning staff who are knowledgeable about the risks and understand their obligations are the most effective first line of defence and are also more likely to catch other forms of attempts to hijack the firm’s accounts, such as 'Friday afternoon fraud' or mortgage fraud.

Some common themes were:

• Making sure to speak to staff about AML face to face, either in person or by video call, to give an opportunity to ask questions and to tailor training content to the firm.
• Providing real-life examples of where AML has come into play, and making the process relevant to the firm’s work.
• Going to great lengths to make staff feel able to make reports, to question and to discuss AML matters.

Three firms mentioned that it was important to "scare" fee earners to make them aware of the consequences of becoming involved in money laundering. Conversely, one firm was clear that they fostered a no-blame culture where fee earners knew that they "would not be slaughtered" if problems arose, so that they felt able to report issues to the MLRO. It can be difficult to maintain a balance between highlighting the potential serious consequences of AML breaches on one side, and encouraging approachability and reporting on the other, meaning that the AML officers need to be effective at influencing behaviour. We consider that one key element is to encourage early reporting – the consequences for the firm of a problem detected and reported early are likely to be far less severe than one delayed.

Good practice

• Appointing AML officers who have the authority and respect within the firm to influence colleagues at every level.
• Ensuring that the MLCO and/or MLRO have the final say in all AML matters, potentially writing this into the firm's governing documents.
• Giving AML officers the widest possible access to the firm's systems and information to allow them to make informed decision about the firm's approach to risk.
• Involving colleagues around the firm in drafting the FWRA and updating it.
• Stress-testing the firm's AML regime to identify weaknesses.
• Maintaining fee earners' interest in the subject by making AML personal and relevant to their work. 
• Influencing and persuading fee earners to understand the consequences of AML failures, while also encouraging them to be open and to report concerns. 
• Making sure that fee earners, administrative staff, and all other relevant people within the firm understand their own responsibility for money laundering prevention and compliance.

This is a crucial attribute for both MLCOs and MLROs:

• An MLCO needs to be sufficiently independent from the influences of colleagues, clients and other pressures, to oversee and enforce the firm’s AML compliance. They need to be able to make decisions objectively and free from any business constraints. They need to be able to speak up against any senior voices who may wish to take the firm down a superficially profitable but dangerous route. They will also need to be able to challenge clients and potentially to bring to an end long-standing and lucrative business relationships where need be.
• An MLRO needs to be able to make firm, decisive and potentially unpopular decisions at a client and matter level. They will need to be able to overrule opposition but also to make each decision on its merits. Given the potential personal criminal liability if the role of MLRO is not carried out properly, they will need to be able to have the final word in making those accountable decisions. They must have the independence to decide what and when they report to the NCA – and implement feedback from the NCA as required.

We asked the 30 AML officers: Do you ever experience resistance to AML measures from colleagues? (13% said yes, 87% said n)r clients? (47% did, 53% did not).

Resistance from colleagues

Six AML officers explained that they did not encounter resistance as such but did encounter low-level complaints, ‘moans’ and ‘grumbling’. Others, however, said that the firm aimed to foster a culture which encouraged compliance and there was no resistance at all. They ascribed this to:

• Practical examples used in training, which were relevant to fee earners' work.
• The potential consequences of the firm becoming involved in money laundering.
• Making sure that fee earners understand the reasons for the requirement.
• Reinforcing fee earners' personal responsibility for AML measures, rather than assuming it is the job of the AML officers or compliance staff.
• A personal focus on winning respect from fee earners rather than instilling fear in them.

We are aware from our wider work that it can be harder to encourage senior staff to comply with the firm's AML regime, in terms of completing full CDD and undergoing training. A successful MLCO should be able to influence their peers to create a culture of compliance.

We were, however, concerned that two of the AML officers said that their decisions could, theoretically, be outvoted by the rest of the firm’s board. While they expressed that this was very unlikely, we consider that AML officers should have the last word on AML matters, given the personal responsibility and potential liability which rests on them. To put matters beyond doubt, we recommend that this is set out in the firm’s governing documents.  

Resistance from clients

As to resistance from clients, seven AML officers said that clients today were generally more aware of the requirements of the regulations, understood them and accepted the need for them.

Three said that clients generally tended to push back on source of funds and wealth checks, which they felt were intrusive. One, for example, related that a client who was a wealthy executive felt that his source of wealth should be self-evident from his CV. Others said that clients tended to feel frustrated when repeatedly asked for due diligence documents from different parties, for example, from estate agents, mortgage lenders and finally solicitors, and having to keep all of these updated if their matter was lengthy.

In dealing with this, the AML officers we spoke to emphasised the need to be firm with clients and explain that due diligence is a legal requirement. A friendly and professional approach was also helpful. Most significantly, two firms emphasised that it was essential to make sure that due diligence information was collected as early as possible. We consider this a key point. As expressed to us, getting this information early on:

• manages client expectations
• minimises the risk of disruption due to trying to obtain key documents late in the transaction
• avoids client frustrations – it can be irritating for clients to be asked for documentation in a piecemeal way

As two other firms also pointed out, making sure that all of the information is gathered in at an early stage has a further benefit. It means that the firm is better able to check at an early stage whether any money laundering suspicion is raised. Preparing and submitting a SAR, and awaiting a response from the NCA, will be far less disruptive if it happens before crucial stages of the transaction are due to occur. Likewise, if a defence to money laundering is refused, it will be easier to draw the transaction to a close at an early stage without tipping the client off and before any potential proceeds of crime are transferred.

Advice on overcoming resistance from clients

"Have to first consider whether this resistance is an AML red flag. Try to be friendly and explain/educate instead of being blunt, which typically lawyers are! Focus on what the outcomes are."

"Have to first consider whether this resistance is an AML red flag. Try to be friendly and explain/educate instead of being blunt, which typically lawyers are! Focus on what the outcomes are."

"Explaining stuff at the outset, ie doing ID, source of funds and source of wealth at the start instead of doing it later on in the transaction so it doesn't delay things."

"Be as upfront as possible – clients will be annoyed if you ask for documents over time - 'Why didn't you ask for this sooner?' Be clear in what is required. Clients are fine as long as they understand."

"It’s improved massively over the years. Now the majority of clients understand that we have to do it."

"Explain that you are not accusing the client of anything. It is about ensuring they are safe as well as us, and making sure we adhere to requirements which are imposed on us. Not a reflection on them personally."

Good practice

• Making sure that AML officers have the support of their wider colleagues.
• Enshrining the AML officers’ right to have the last word on AML matters.
• Giving support to fee earners when dealing with client resistance to AML measures.
• Being empowered to make and stand by decisions which may be unpopular.

This does not only mean financial resources – firms should make sure that their AML officers are given the appropriate means to carry out their role including:

• support from colleagues
• budgetary resources where applicable, for example, if the AML officer is responsible for providing training or maintaining their own compliance staff
• time.

The final factor, time, is particularly significant. As mentioned above, all but one of the AML officers we spoke to held partnership positions in the firm. These were not, however, their only roles.

Of the 54 AML officers we contacted

• 8 had no fee-earning role
• 46 had a caseload

Of those with a caseload:

• only 15 had reduced billing targets – of 2 had a reduced billing target which did not match the actual time they spent on AML

As well as holding a partnership role, it was significant that the majority of these AML officers also held other substantial management roles, such as:

• managing partner
• complaints partner
• COLP
• Compliance Officer for Finance and Administration (COFA)
• staff partner
• head of department
• data protection officer.
• other roles included CEO, training principal and Legal Aid quality representative.

The average number of additional roles held was three, and the most was five. This also leaves aside the sole practitioners we reviewed, all of whom worked alone and necessarily held all of their firm’s roles.

When asked how they balanced the various demands of these roles, seven expressed that they were encountering, or had encountered, difficulties in balancing them.

A few firms thought that some roles such as COLP and COFA naturally went together with MLCO and MLRO and that it made sense to have all of the 'compliance' activity centred on one individual. This may be so in some cases, but it will depend on:

• the nature of the firm and its work
• the support available within the firm to the AML officer.

AML officers should be careful to make sure that they are not overloaded by these roles. MLCO and MLRO are onerous and time-consuming roles which demand a significant investment of time to perform properly.

By way of illustration, we asked firms how long it took them to submit a SAR. While one firm said that, from memory, their sole SAR had taken half an hour to submit, the majority said that it had taken them several hours. The longest amount of time taken was 20 hours. This also does not take into account much of the post-submission activity involved with a SAR:

• increased supervision of the matter which caused the SAR
• dealing with any queries from the NCA about the SAR
• where applicable, handling the client while waiting for the NCA to respond.

One firm navigated this with a concept of 'chargeable' and 'accountable' time:

• chargeable time is directly working on files, in other words, billable hours
• accountable time work which is not billable but benefits the firm in some way.

Both types of time recorded went towards the AML officer's monthly target, and recognised the time taken up by these duties.

We consider that, in all but the smallest firms, holding one or both AML officer roles without any adjustment to case holding and/or other duties is unrealistic. While the roles of MLRO and MLCO may not make constant demands on an AML officer’s time, they should be given appropriate priority.   

Firms can help AML officers to discharge their duties by:

• limiting the amount of additional roles they hold
• reducing their fee-earning targets and caseholding, with a regular review to make sure that this is sufficient
• where possible, appointing dedicated staff to share the burden and carry out more routine AML tasks.

AML officers can help themselves by:

• delegating responsibilities as appropriate
• appointing a deputy (see below).

We asked AML officers for their advice on balancing different roles

"Getting the culture right. Do it for the right reasons, because you enjoy it and want to do it, not for the sake of it".

"Diarise time to make things work. The sooner you get this right, the easier your life will be - if staff get ingrained bad habits, it will be difficult to change them".

"Be upfront - make it clear that you will need an amount of time each week/month to deal with this. Shouldn't be penalised for taking on these roles and billing being reduced as a result…Try to get buy-in from key partners in the office. Get firm support to back you - someone more junior might need more support. Learn to juggle".

"One of the most important things is to let senior management and leadership know what you're spending your time on and why it's so important. Need to make judgement about what is best for the business. Need to understand just how important this is. This is a core requirement".

"You need to have time to do these roles - reduce your fee earning role to allow time for management. The compliance and management side need the time they require, and you cannot do them at the same time as a full caseload."

"Take it seriously, it's not just about ticking the boxes. The firm is just as vulnerable to money laundering as anybody. You have got to be available, make sure people can come and talk to you and don't think they will get shouted out."

Support, deputies, and delegation

One of the key ways that an AML officer can help to manage their own workload is to appoint a deputy. A deputy does not need necessarily to have the same depth of knowledge as the AML officer themselves but should have a working knowledge of the regulations and related legislation and guidance. Quick decisions may be needed, particularly where the MLRO is concerned, which may not be able to wait for their return from court, a meeting or a holiday.

Sara Gwilliam, SRA Money Laundering Officer:

'While it is not a legal requirement, it is widely recognised that having a designated Deputy MLRO to support to the MLRO function is best practice. A Deputy MLRO can provide vital cover during any MLRO absence, ensuring your money laundering and terrorist financing reporting obligations continue to be met, effectively acting as a second line of defence.

'They can also play an important role in assisting the organisations continued awareness and compliance with money laundering and terrorist financing legislation, such as supporting the development and delivery of training and advising colleagues.

'Here at the SRA, we have a full time Deputy MLRO which gives us resilience, and is a dedicated resource to step in and act as our MLRO when required. This means we have two trained members of staff who can deal with internal suspicious activity reports, submit SARs (both information SARs and time critical Defence Against Money Laundering (DAML) SARs, and handle enquiries to provide support and guidance as subject matter experts.'

However, not all firms have this important resource. Of the 54 AML officers we contacted, 28 did not have a deputy.

Appointing a deputy is, we consider, central to a successful AML regime. A deputy can help the AML officer and the firm in a range of ways:

• providing holiday and absence cover
• succession planning – some AML officers had started as deputies and had a good level of experience already when they took on the role
• a second pair of eyes and ears in detecting the risk of money laundering or terrorist financing
• a trusted and understanding colleague to act as a sounding-board.

Some firms, where the MLCO and MLRO were separate people, deputised for each other. Others delegated to compliance officers or other partners.

We were concerned to find that, of the 30 AML officers we spoke to, six stated they did not need a deputy as they were always contactable, even while on holiday. Only 13 had a deputy. Even of these, however, one said that in reality the deputy would contact them if a problem arose in their absence.

This attitude is somewhat short-sighted because:

• in cases of serious illness or injury, the AML officer may be unable to answer calls or access email
• if on holiday or in some other public space, accessing information and documents needed to make a decision may be difficult or impossible,
• even if these confidential documents can be accessed, a secure and reliable internet connection may be unavailable
• time is often of the essence, particularly if a decision needs to be made about a report to the NCA, and may not be able to wait for a reliable internet signal, time zone differences etc.

This also leaves aside the obvious point that taking time off is crucial to an AML officer’s wellbeing and ability to do a good job when returning to the office.

Of course, for sole practitioners who work alone, the situation will be challenging. Given, though, that arrangements for work to continue while they are out of the office are likely to be limited, they are perhaps at less risk of needing to be disturbed.

There is no set mechanism to appoint a deputy, nor do we or any other body need to be notified. Nonetheless, of the 13 AML officers we spoke to who had one, seven said that the appointment had been made formally. This can be helpful in terms of setting out expectations of the deputy and what aspects of the role they can and should take on.

We asked the AML officers what support they received from their colleagues:

• 10 said they could rely on the assistance of a practice manager or specialist compliance staff
• 16 mentioned specific senior colleagues who had AML knowledge or experience
• 1 mentioned an external AML expert who they consulted when issues arose

Training

The regulations state at Regulation 24 that:

• firms must make their relevant employees aware of the law relating to money laundering
• relevant employees are regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering or terrorist financing
• the training must take account of the firm’s size and nature, and their exposure to risk.

"Relevant employees" is defined as anyone within the firm who is directly involved in work within scope, or who is capable of contributing to the identification, mitigation, prevention, or detection of the risk of money laundering. This does not exempt those who may not be 'employees' in an employment law sense (such as consultants or partners) and could potentially extend to anyone within a firm.

There is no explicit requirement on AML officers to undergo any training over and above the rest of the firm. In reality, though, the obligations on AML officers are different to other fee earners and staff and they should have a wider scope of knowledge on which to draw.

It was very encouraging to see that the overwhelming majority of AML officers made sure to undertake some kind of training at least once per year. While the regulations do not set down strict timescales for the frequency of training, money launderers’ tactics are constantly changing and becoming more sophisticated. AML officers should constantly be aware of new threats and refresh their knowledge. Training is also a good way to make sure that they are aware of any changes to the regulations and other relevant legislation.

Likewise, there is no prescribed way for AML officers to maintain their competence. A wide range of methods were described to us:

• 39 used webinars
• 34 used other forms of online training
• 28 attended specialist conferences
• 12 attended specialist round-table discussions and workshops with peers
• 19 described reading specialist articles and publications.

All of these are legitimate ways of keeping knowledge up to date. Equally, this training need not be costly, and there are a range of free resources available. Some AML officers drew attention to the increased number of free webinars on AML as a result of the Covid-19 pandemic. Likewise, there is much to be said for setting time aside to understand thoroughly the regulations and the Legal Sector Affinity Group guidance.

The responsibility for making sure that the firm’s staff are trained lies with the MLCO, as part of their responsibility for ensuring the overall compliance of the firm. The function (though not the responsibility) may, however, be delegated to other figures within the firm, for example, to the MLRO or to the firm’s HR department. It is, however, essential that the MLCO at least understands what is being done to ensure AML compliance. At four firms, the MLCO did not have a clear view of the firm’s training regime or how it worked. They bear ultimate responsibility for making sure that all relevant employees are trained in accordance with the regulations, so should have insight into how the regime works.

While the choice to use an external provider is one for the firm to take, we encourage firms to shop around and to consider whether the provider is a good fit for the firm. This might be in terms of:

• the trainer’s knowledge and expertise in the firm’s areas of work
• the ability to tailor training to the firm and its staff
• whether the training materials are recent and up to date.

Several firms made reference to webinars and AML guides provided free by training providers as a good way of deciding if they were right for the firm and its staff.

Balancing commercial interests and AML obligations

Embedding an effective and compliant AML regime will carry a cost. This may be direct, in terms of employing specialist staff or paying for external training, or indirect, such as the resource involving in providing internal training and maintaining and updating the firm’s policies.

The landscape of AML is ever-changing. Legislation is now regularly updated, and compliance is mandatory. Failure to comply and any resulting sanction, whether this involves regulatory or criminal action, is hugely disruptive to the firm and its reputation. Creating and maintaining a culture of compliance is the best way of minimising these costs. Fee earners need to be invested in the process and understand their role in AML.

We asked firms how they worked to maintain the proper balance between their AML obligations and the commercial realities of running a firm. Below is a selection of their answers:

• "It is in the firm’s commercial interests to be compliant. The cost of losing my practising certificate or fines is a lot worse than the cost of compliance".
• "In terms of all of the policies, controls and procedures, we try to adapt them in a way where resources are considered. We take a risk-based approach to everything - there are only a few occasions where exceptions are made, eg employment law but make systems friendly. We make the experience as efficient as possible."
• "Thorough CDD is now the cost of doing business, so if it takes a while to do, you must do it to mitigate the risks. Rather mitigate the risks and protect the firm than get in trouble."
• "It is a hard situation to be in. The only real way of doing it is reducing the fee-earning work of the MLRO."

Some firms also made the point that they pass the direct costs of AML, such as e-verification, on to the client. We have no objection to this, as long as:

• any charges are made clear to the client at the outset of the retainer
• charges are properly described as a profit cost, or a disbursement as may be applicable.

Good practice

• Having a realistic assessment of the impact that AML duties will have on fee earning.
• Appointing a deputy who can provide absence cover, support and succession planning.
• Regular access to relevant training for AML officers.
• Input into a staff training regime which includes multiple methods of delivery.
• Viewing AML compliance as an integral part of the business and encouraging fee earners to do likewise.

The AML officers we spoke to gave us a clear insight into the challenges they faced. In all but three cases, we were able to work with the firms to make sure that they had a compliant AML regime in place. All seemed genuine in their desire to protect their firms, their staff and themselves from become involved in money laundering or terrorist financing.

Generally, AML officers tend to fulfil the two pillars of authority and independence well, being able to command the respect of their peers and capable of making clear-sighted and risk-based decisions.

The biggest challenge which AML officers discussed with us was resourcing, most acutely in relation to time – time to learn about the role, time to plan, time to check the firm’s progress, time to reflect, and time to act in an emergency. All are significant parts of the role and need an appropriate investment. All other strategies – support, funding, training and so forth – are likely to be of limited use if the MLCO or MLRO do not have enough time to dedicate to their duties.

• We recommend that firms consider carefully whether they are overloading their AML officers. Having spoken to a wide variety of practices, we are not convinced that it is possible to give either role the time it demands while holding a full caseload.
• Likewise, we encourage AML officers to consider other roles they hold within the firm, and whether any of them could, and should, be scaled down, given to colleagues or delegated, to allow them to focus on their AML work.
• Finally, we encourage all AML officers to appoint a deputy. This will give them absence cover, a sounding-board, and a succession plan.