From 1 June 2015, UK-based businesses will have greater freedom to report suspicions of money-laundering without risking liability to customers, due to an amendment being introduced to UK money-laundering law.

The Proceeds of Crime Act 2002 (POCA) criminalises money-laundering in the UK.

A regulated business, or a person working in such a business, commits an offence if they merely know or suspect, or have reasonable grounds for knowing or suspecting, that another person is engaged in money laundering, and they fail to make a disclosure¹. This is a higher standard than that imposed on un-regulated persons, who have to have some direct involvement in the money-laundering before they can be liable².

The standard response to the risk of money-laundering offences being committed has been for anyone with suspicions about money-laundering to make a disclosure to the authorities (known as a suspicious activity report, or SAR). However, this carried with it some risks, especially if the person making the SAR had fiduciary or other duties to the person to whom the SAR related. If, in fact, there was no money laundering, but the authorities delayed approval of a transaction or took some other measure which harmed the interests of the customer, then, in theory, the reporting party might be liable to its customer in civil law.

The Serious Crime Act 2015 will reduce this risk when an amendment it makes to s. 338 of POCA comes into force on 1 June 2015.

What changes

• The amendment provides statutory protection from civil liability to those who make a SAR in good faith and delay a customer’s transaction while awaiting consent from the National Crime Agency (NCA).
• The amendment gives greater legal certainty to banks and others who are required to make authorised disclosures (consent SARs). While most consent SARs are made by businesses in the regulated sector³, any business may need NCA consent for a transaction to avoid liability under the principle money-laundering offences in ss. 327 – 329 POCA.
• This amendment incorporates into English law the obligation set out in Article 26 of the Third Anti-Money Laundering Directive to protect those making disclosures in good faith from “liability of any kind”.
• The amendment removes the risk that legal immunity would not apply as the SAR was not based on a genuine suspicion.

Why the change was needed

• The long-running case of Shah v HSBC⁴ established that a term should be implied into contracts, so that persons who make a SAR in good faith are protected from civil liability to customers for losses caused by a delay in processing the customer’s transaction. Although this development was welcomed by many, the protection was not automatic and could not be taken for granted; in particular, it would only be implied if the regulated entity making the SAR could show that the SAR was based upon a genuine suspicion.
• The Court of Appeal in Shah held that a customer who alleges loss is entitled to require proof of the suspicion underlying the SAR; the nature of the suspicion could be examined and assessed by the court. In Shah, the MLRO at HSBC gave a gruelling six days of evidence. Whether a court implied the Shah protection into a contract, therefore, still ultimately depended upon judicial discretion and the facts of each case.
• A suspicion is a subjective fact and does not (for POCA purposes) need to be reasonably held, so proving the suspicion is rarely difficult in practice, even when the court finds that the supporting evidence is not entirely coherent, as in the recent case of Parvisi v Barclays Bank.⁵ Yet there remained a risk that, based on the facts, a court would not be satisfied and would not imply into the relevant contract a term protecting the regulated entity from civil liability.

Disclosures under sections 330 and 331 of POCA not covered

• The amendment is made to s. 338 POCA and so only applies to SARs where consent to a transaction is sought. Some commentators have criticised that it therefore fails to protect persons in the regulated sector from civil liability for SARs made to avoid the general ‘failure to disclose’ offences in ss. 330 and 331 of POCA, which only apply to businesses in the regulated sector (such as banks, accountants, brokers, etc.).
• This concern seems more academic than practical – there are no reported cases for civil claims arising from SARs made under ss. 330 and 331 in the 12 years that POCA has been in force.
• Disclosures made under ss. 330 or 331 POCA are not directed at any proposed transaction; in the absence of a transaction, the customer is unlikely even to know that a SAR has been made. Law enforcement agencies are also obliged to ensure that the identity of their sources remains confidential.
• Even if the customer did learn of the SAR, proving that it caused the customer some loss would be challenging, while breach of confidence claims are expressly excluded in s. 337 of POCA.

Is your SAR made ‘in good faith’?

• The new provision provides no protection from liability if a SAR is not made in good faith. Customers may therefore still seek to pursue a reporting party for losses by claiming that the SAR which caused the loss was not made in good faith.
• The exact scope of ‘good faith’ in the context of POCA disclosures is unclear. The Home Office minister Lord Bates stated to the House of Lords on 2 March 2015 that

“those responsible for submitting such reports would continue to be liable for any negligent or malicious conduct”. With the greatest respect to the minister, we would question whether a court would conflate negligence with lack of good faith, since these are separate legal concepts. Of course, a malicious report would be most unlikely to be made in good faith.

• A ‘bad faith’ challenge to a SAR may well require positive evidence that the SAR was made for some motive inconsistent with regulatory obligations (such as the “malicious conduct” referred to by Lord Bates).
• An abundance of caution leading to a ‘defensive’ disclosure by the regulated entity may not be sufficient to establish bad faith (for example, where there are questions about a proposed transaction which fall short of a firmly-held suspicion that the customer is engaged in money-laundering).
• Liability to a customer arising from delay in processing a transaction after the NCA has given consent is unlikely to be protected; the bank or other regulated entity is not at that point delaying the transaction in compliance with its statutory obligations.

Practical considerations

• The burden in any civil claim challenging immunity under the new s. 338(4A) POCA is likely to fall on the claimant to provide prima facie evidence that a SAR was made in bad faith.
• Evidence of genuine suspicion – even if misguided – would constitute evidence that a SAR was made in good faith.
• It therefore remains important to keep a detailed record of the grounds for any suspicion, to keep an audit trail of the internal reporting and decision-making process and to record the basis for the decision whether or not to seek consent for the transaction from the NCA.
• Such records will be required not only should the course of events later be the subject of a dispute, but are also necessary for audits and enquiries by any regulator.

1. POCA s. 330, 331
2. POCA ss. 327-329
3. NCA SARs Annual Report 2014, p. 47.
4. [2010] EWCA Civ 31
5. [2014] EWHC B2 QB

http://bit.ly/1LWsv7G