Following Treasury’s initial consultation on how to implement MLD4 in September 2016, it has now published the feedback to that consultation and the draft Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLR 2017).

Time is now running short, and the legislation must be in force by 26 June.

All businesses covered by MLD4 will need to make changes to their procedures, systems and controls to comply with the requirements of;

1. the MLR 2017
2. the new JMLSG and
3. FCA guidance (for which consultations are starting to follow).

The changes, some nuanced, and some fundamental will cause all firms to reassess their AML and CTF policies and procedures.

Treasury has taken the opportunity to give a complete overhaul to the existing Money Laundering Regulations. The legislation is so detailed it is not possible to address everything it covers in one briefing – this briefing;

1. focuses on the changes to due diligence that affect firms authorised under the Financial Services and Markets Act 2000 and other financial institutions covered by the MLR 2017.

Please note in this briefing, we refer “firms”, although in the speak of the MLR 2017 they are part of the wider community of “relevant person”.

Who must carry out risk assessments?

Chapter 2 sets out the duties of each of:

1. Treasury and the Home Office
2. The supervisory authorities
3. Relevant persons.

In respect of risk assessments.

1. The assessments firms must do should identify and assess the risks of money laundering and terrorist financing to which their businesses are subject, taking into account information the supervisory authorities make available to them and other risk factors, including the familiar ones of
   1. customers,
   2. geography,
   3. products and services,
   4. transactions, and
   5. delivery channels.
2. The assessment must take into account the size and nature of the business, and
3. the firm must keep an up-to-date written record of what it has done unless its supervisor tells it otherwise (which it can do only if it considers the risks in the relevant sector are clear and understood).

The obligations on the Government and supervisors to carry out risk assessments should be helpful to the firms who are then obliged to carry out their assessments – but it will also mean that these assessments will need to show how they have considered the wider picture these additional reviews provide.

What risk mitigation policies should firm have?

Regulation 19 obliges firms to;

1. establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment they undertake and
2. to keep a written record of them.

These must be both proportionate to the size and nature of the firm’s business and approved by its senior management (which means an officer or employee who has sufficient knowledge of the firm’s ML/TF risk exposure and is of sufficient authority to take decisions regarding its risk exposure).

They must include:

1. Risk management practices
2. Internal controls (which, proportionate to the size and nature of business, should include:
   1. appointing a board member as the person responsible for compliance with the MLR 2017
   2. carrying out screening of all relevant employees and agents, both before the appointment and at regular times during it.
      1. “Screening” means assessing the skills, knowledge and expertise of the individual to carry out their functions effectively and of their conduct and integrity; and
      2. the screening must cover any person whose work is relevant to the relevant person’s compliance with the MLR 2017 or otherwise capable of contributing to ML/TF risk identification or mitigation or to its detection or prevention.
   3. establishing an independent audit function to examine and evaluate the adequacy and effectiveness of the policies, recommend change and monitor compliance with the recommendations
   4. appointing a person as nominated officer, and informing the supervisory authority of the identity of both the person responsible for compliance and the nominated officer
      1. e-money issuers must appoint an individual to monitor and manage compliance with, and communication of, internal controls and procedures on the policies mentioned below with a particular view to identifying high risk situations, keeping records, applying measures to ensure the risks are taken into account in new products and dealing with new customers and business changes; and
      2. that senior management is briefed at least annual on the operation and effectiveness of the policies
   5. keeping systems to enable full, rapid responses to financial investigators and other enforcement officers on whether the relevant person has, or has had in the past five years, a particular business relationship and, if so, the nature of it
      1. e-money issuers and payment service providers must have a central UK contact if requested to do so
   6. authorised persons supervised by FCA must inform FCA of any intention to act as a money service business or a trust or company service provider (or if they cease to do so)
   7. taking appropriate measures to ensure its relevant employees and agents are made aware of the law relating to ML, TF and data protection, and are regularly given training in how to recognise and deal with transactions and other activities which may be related to money laundering or terrorist financing.
3. Customer due diligence
4. Reporting and record keeping
5. Monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures

Moreover, the MLR 2017 mandate that the policies should include those:

1. Which provide for identification and scrutiny of any case where there is no apparent economic or legal purpose and the transaction is unusually large or complex or presents and unusual pattern of transactions, and of any other activity which the relevant person regards as particularly likely by its nature to be related to money laundering or terrorist financing
2. Which specify additional measures to be taken where appropriate to prevent the use for ML/TF purposes of products that might favour anonymity
3. Which ensure the firm assesses and mitigates the ML/TF risks that might occur when it adopts any new technology
4. Under which any person who knows or suspects that a person is engaged in ML or TF, or has reasonable grounds for doing so, is required to comply with the relevant provisions of the Terrorism Act (TA) or the Proceeds of Crime Act 2002 (POCA).
5. Where relevant, these policies must be communicated to its branches and subsidiaries outside the UK.

Where the firm is a parent undertaking of a group, it must ensure the policies apply to all its subsidiaries, whether within or outside the UK, and its non-UK branches where the branch or subsidiary is carrying on relevant business. The parent must also establish and maintain policies, controls and procedures for data protection and information sharing within the group for the prevention of ML/TF, and keep a written record of these. Where there are subsidiaries and branches in the EEA, the parent must ensure that these offices follow the local laws implementing MLD4. Otherwise, they must ensure third-country operations apply measures at least equivalent to UK measures so long as local laws allow it. If they encounter issues with local laws, the parent must tell its supervisor and take additional measures to address the ML/TF risks.

What are the requirements of customer due diligence?

General

Chapter 1 of Part 3 sets out the basic obligation (in Regulation 27) that a firm must apply customer due diligence (CDD) measures when they:

1. Establish a business relationship
2. Carry out an occasional transaction that amounts to a transfer of funds of over €1,000
3. Suspect ML or TF
4. Doubt the veracity or adequacy of documents or information previously obtained for identification or verification.
5. Relevant persons who are not high value dealers or casinos must apply CDD if they carry out any occasional transaction amounting to €15,000 or more. Particular rules apply to high value dealers and casinos, which are outside the scope of this briefing.

Where a firm has to apply CDD measures, it must:

1. Identify any customer unless the customer’s identity is known to and has been verified by the relevant person;
2. Verify the customer’s identity by documents obtained from a reliable source which is independent of the customer; and
3. Assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or transaction.

The regulations are prescriptive on the information that must be obtained about a body corporate, and on the requirement to identify and to take reasonable steps to verify the identity of its beneficial owner (unless the company is listed on a regulated market). They also provide that if the firm has exhausted all possible means of identifying the beneficial owner but has either not succeeded in doing so or doubt whether the individual identified is, in fact, the beneficial owner; then the firm can treat the senior person responsible for managing the customer as its beneficial owner. The MLR 2017 make it clear that a firm cannot meet the standards required simply by referring to the relevant register of people with significant control.

There is also an obligation to identify and verify the identity of a person who purports to act on behalf of the customer – and the verification must be done by documents or information obtained from a reliable source that is independent of both that person and the customer.

Ongoing monitoring standards and suspicion reporting

Firms must conduct ongoing monitoring of business relationships, including scrutinising the transactions to ensure they (and the source of funds for them) is consistent with the knowledge of the customer, its business and risk profile; and undertaking reviews of records and keeping CDD documentation and evidence up to date. This must be done on a risk-based approach.

Where a firm has undertaken CDD and also has made a suspicious activity report (SAR), then if continuing to apply CDD would result in tipping off, then the firm does not have to continue to apply CDD.

Firms must be able to satisfy their supervisors that the extent of measures they have taken to satisfy the CDD requirements are appropriate in the light of their own, and their supervisory authority’s, risk assessments.

There are particular rules for particular products. Where a firm is providing a customer with a contract of long-term insurance, it must also take the full name of the beneficiary(ies) or get enough information to be satisfied it will be able to establish the identity of the beneficiary at any time when there is a pay-out. Then, they must verify the identity of any beneficiary before making a pay-out (including identifying any new beneficiaries if the policy has been assigned). Similarly, no pay-out should be made to a beneficiary under a trust or similar arrangement until the beneficiary has been identified and verified.

Verification must happen before the establishment of the business relationship or the carrying out of the transaction, but may be done during the establishment of the relationship if it is necessary not to interrupt the normal conduct of business and there is little ML/TF risk. There must also be adequate safeguards in place to ensure that no transactions are carried out before verification has been completed if an account is opened beforehand.

Firms must not carry out any transaction or establish a business relationship and must terminate any existing relationship if they are unable to apply CDD measures. They will also need to consider whether to make an SAR. They may return money to the person who deposited it, provided they have consent under POCA or the TA (if necessary).

Product-specific expectations

There is an exception for trustees of debt issues, where a firm is appointed by an issuer as trustee or whose customer is such a trustee. Where the instruments in question are debt instruments or government or public securities, no CDD is necessary.

A firm must apply EDD and enhanced ongoing monitoring in addition to the CDD described above, where:

1. There is a high risk of ML/TF
2. Any transaction or business relationship is with a person in a high risk third country (except where it is a branch or majority owned subsidiary of an undertaking which is within the EEA and subject to MLD4, the customer in question applies group-wide policies, and the relevant person has determined on a risk-based approach, that it is not necessary to apply EDD)
3. There is a correspondent banking relationship
4. The firm has determined a customer, or potential customer is a PEP or a family member or known close associate of a PEP
5. The customer has provided false or stolen identification documents or information;
6. The transaction is complex and unusually large, or there is an unusual pattern of transactions, in either case, if the transaction(s) have no apparent economic or legal purpose
7. Where, by its nature, the case could present a higher risk of ML/TF.

Where EDD is applied, it must include:

If a credit or financial institution wants to enter into a correspondent relationship with an institution from a third country, it must: