Independent AML Audits - What Law Firms Need to Know
As of June 2023, the UK Government estimates that money laundering costs the UK economy more than £100bn every year. As a supervisory body, the Solicitors Regulation Authority (SRA) assigns dedicated resources to preventing and detecting money laundering. Part of that work includes conducting inspections of law firms to ensure suitable processes and controls are in place, providing guidance and support, or where necessary issuing fines for non compliance.
During the 2022 - 2023 SRA financial year, approximately 6,000 firms fell within the scope of the money laundering regulations. This equates to around two-thirds of the firms authorised by the SRA (9,518).
The SRA performed 177 on-site and thematic inspections (up from 163 in the previous year) and 73 desk-based reviews. The SRA’s 2022-2023 Anti-Money Laundering Report revealed that even across that small sample, there were 249 suspected cases of money laundering.
In addition, 24 suspicious activity reports were filed with the National Crime Agency (NCA) equating to approx £75m of funds potentially linked to criminal activities, and the SRA brought enforcement action against 47 firms and individuals resulting in fines amouting to £173,402.
Whilst the latest report doesn’t include statistics relating to AML audits specifically, of the 143 firms which the SRA inspected by on-site visits during the 2021/22 period, shockingly, 74 (51%) of firms had not undertaken an independent audit. Of those, the SRA determined that 34 firms (45%) should have.
This clearly indicates that more education is needed within the legal sector to ensure that firms comply with their obligation to commission an independent AML audit.
If you are unsure whether or not your legal practice falls within this category; read on. In this article we provide plain language information to help you understand what an AML audit is, who requires one, the benefits they provide, and how to book your own AML audit.
What is an independent AML audit
Under Regulation 21 of the Money Laundering Regulations, law firms, estate agents and other businesses can, in theory, conduct their own internal independent AML audits. The key rule in relation to the term “independent” is that it must be someone who is completely independent of the AML functions that are being audited.
In other words, if a person is either part of the operation/application of the AML controls or they are responsible for determining (writing/decision making) the AML controls being audited, they are therefore, not independent.
An independent audit cannot therefore, be conducted by the Money Laundering Reporting Officer (MLRO), Money Laundering Compliance Officer (MLCO) and compliance team.
In addition, the auditor must have in-depth knowledge of anti-money laundering controls, best practice and latest updates on regulations.
Moreover, the person conducting the audit must be of a sufficiently senior level that they cannot be denied access to any information that might be pertinent to the audit. And, of course, whilst such a person was conducting an audit; they would be taken away from several days of fee earning.
Ultimately, this means that many law firms simply cannot conduct a valid independent AML audit using internal resources. However, if you're still considering undertaking your own internal audit, you may find our free download titled "Can your firm really conduct its own Independent AML Audit" helpful.
In reality, many legal practices determine that there are significant benefits to instructing an external, expert auditor to carry out their audits such as the peace of mind afforded by instructing an external pair of eyes to confidentially examine and report on the firm’s controls. We will touch on some of the additional benefits during the course of this article.
What does an AML audit consist of?
It is important to recognise that firms should not ‘prepare’ for an independent AML audit; to do so would skew the outcomes and would not be an accurate reflection of the true state of the firm's AML controls.
Unfortunately, the regulations do not dictate what an audit should include, specifically. As a result, AML auditors vary in their approach. However, it’s generally accepted that an auditor will closely assess your firm’s compliance across a number of core areas which include:
- your Firm-Wide Risk Assessment (FWRA)
- all of your AML controls, policies and procedures including your Customer Identification Procedure (CIP), reporting and monitoring procedures, AML forms on matter files, etc
- your policy for training staff on AML and processes in relation to maintaining staff training records
- your eID-Verification service providers
- your risk register, near misses and register of breaches
- historical file review findings or trends
Robust audits will also include:
- Reviews of; your supervision controls, file review controls and history, accounts controls, matter opening controls, data protection touchpoints and client care information
- Testing or discussing mechanisms for reporting (internal and external).
- Meeting with and interviewing supervisors, heads of departments, the MLRO and/or the MLCO
- Meeting with and interviewing Relevant Employees, including fee earners and support staff to understand their perspective, and to test their application and experience of AML policies, processes and controls
Audits alone add little value if you don’t know how to resolve any issues raised. Therefore, as part of our AML auditing service, you will receive a detailed report which highlights:
- Any aspect we are concerned about
- The nature of the concern
- What steps or action points the legal practice may need to implement to resolve the issue
What are the benefits of an independent AML audit?
AML audits conducted by an external independent auditor provide a number of significant benefits over those conducted by in-house teams.
- Increased client confidence - Independent audits increase internal and external trust in your firm, as you are not “marking your own homework”. This is important as customers, especially new customers, want reassurance that their transactions are secure and their interests are protected.
- More efficient use of resources - Utilising external AML auditors reduces the workload on your existing team. This has two further benefits.
- Firstly, it means your team can stay focused on revenue-generating tasks.
- In addition, the quality, effectiveness and efficiency of the audit can often be improved as independent auditors are focused solely on performing the audit so they are not distracted by other tasks within the practice.
- Gain access to expert insights and knowledge - External AML auditors should be experts in their field. They have a wealth of knowledge and experience to call upon which enables them to spot potential gaps, weaknesses or opportunities which someone less well-versed in the field may miss. This not only improves the robustness of the audit itself but can also provide opportunities for them to add value to your company in other ways such as suggesting improvements and efficiencies in your policies, processes or controls.
- Faster than internal audits - As with any task, speed often improves with experience. Therefore, it’s only natural that an expert AML auditor will be able to perform a thorough audit faster, more efficiently, and with less disruption than an internal staff member who performs audits less frequently. This is a double-benefit as audits should not be drawn out over a period of months; they should be conducted in a short space of time so that they provide an accurate snapshot.
- Reduces internal conflicts - Whilst many firms welcome peer-review practices, some colleagues may feel uncomfortable with a colleague checking their work. Utilising an external auditor ensures the audit is unbiased and removes the risk of any internal conflicts.
- Peace of mind - Finally, the main reason for an AML audit is to ensure you are complying with regulatory requirements. Whilst internal audits are capable of ensuring compliance, we find firms value the extra reassurance that an independent third-party audit provides.
Identifying if your law firm needs to perform an AML audit
The regulations, somewhat unhelpfully, state that firms only need to perform an AML audit “where appropriate with regard to the size and nature of its business”.
This ambiguity has historically caught many firms out, whilst also enabling a small number of less scrupulous firms to use it as an excuse to intentionally avoid audits. As a result, the SRA are taking measures to both educate and clamp down on non-compliance.
The SRA considers that as of 5th April 2023, 6,007 firms fall within the scope of the money laundering regulations. This represents around two thirds of the firms they authorise.
In relation to size, the SRA states that Regulation 21 should be interpreted as follows:
“Any practice who carries out regulated work, must establish an audit function”.
Other indicators of requiring an audit can include:
- Having more than one office
- Having fee earners who conduct work it the regulated sector(e.g. Conveyancers)
- Partners being responsible for the compliance of others with regulations
How long does an AML audit take?
As mentioned earlier, law firms should not prepare for an independent audit. This means that the lead-time, from deciding to instruct an audit to it being conducted, can be very short; it does not need to be something that has a long/large ‘build-up’.
The time needed to conduct a valid independent audit generally depends on the size of the legal practice being audited, how organised the firm is, and how many issues are found. However, as a guide, at PDA Legal reports that on average AML audits take 3 to 4 days which can be broken down as follows:
Remote desktop review
This stage typically takes one day off-site to conduct a remote desktop audit.
We then submit an initial report and wait at least two weeks before proceeding with the next stage. This provides firms with a reasonable timeframe within which to review the initial review prior to our on-site visit.
The two week gap also provides firms with the opportunity to request tailoring of the auditing criteria for the on-site portion of the audit.
On-site visit
We typically spend one to two days on-site, including an early feedback meeting, after which, we move on to collating our findings.
Report creation
We typically spend one day finalising our written report.
Post-audit on-site meeting
Finally, we like to follow up the report with a meeting where we can discuss the findings with the firm, and answer any questions they may have.
We are proud to say that PDA Legal’s AML audit reports have been remarked upon by many of our clients as being the most helpful and detailed of any consultancy.
It should be noted that in addition to the above, you should also allow some time for:
- Discussion with the auditor on the scheduling and scope
- Feedback and review time post-audit
- Implementation time for any recommendations
Common failings to be aware of
According to the SRA 22/23 AML Annual Report, some of the top failings identified by the SRA included:
- Failure to have proper AML policies and procedures - 61 reports
- Failure to carry out a source of funds check - 60 reports
- Failure to carry out a risk assessment on client/matter - 58 reports
- Failure to carry out a firm-wide risk assessment - 48 reports
- Failure to carry out/complete initial CDD - 47 reports
Other common issues identified included:
- Failure to apply enhance customer due diligence (EDD)
- Not having an adequate firm-wide risk assessment (FWRA)
- Poor AML policies, controls or procedures
- Failure to recognise work that brings the firm into scope of the regulations
- Failure to notify the SRA of appointments of money laundering reporting and compliance officers, or seeking approval as a manager (BOOM)
- Failing to take note of issued warning notices or red flag indicators in transactions
Whilst you can access checklists online, we would recommend against using them. This is because every law firm or practice is unique and therefore, generic checklists can increase the risk of missing something important which can ultimately lead to non-compliance and risk.
How frequently do AML audits need to take place?
In the UK, the regulations do not state how often an audit should take place. Instead, it depends on the size of the firm, the areas of law practised, the risk profile of the firm, any SRA concerns and so on. However, as a rule of thumb, a firm that handles conveyancing matters should typically aim for an independent audit every 12-24 months.
By requesting to join our free legal best practice group, you will receive our monthly regulation and risk compliance news digest which helps you stay informed of updates from the SRA and how they might impact your law firm.
Contact us for pre-audit assistance, or to book an independent audit today
With over 25 years experience, PDA Legal is one of the UK’s leading providers of AML services including:
Contact us today for a free initial consultation or to book your independent AML audit.
