Financial Regulation - In the know: Financial Crime

The FCG is designed to provide practical assistance and information for firms of all sizes and across all FCA-supervised sectors, to help them counter the risk that they might be used to further financial crime. By following the guidance, firms should easily be able to demonstrate a risk and outcomes-focused approach to financial crime systems and controls, assess and proactively address any gaps. Importantly, experience suggests that firms which can demonstrate they have considered the FCG and used it when developing their own financial crime control environment are better positioned to respond to FCA queries, investigations and enforcement action. 

Originally borne out of the FCA's experience of thematic reviews in different parts of the market, the FCG has evolved over the years and continues to do so with this proposed version. The latest proposed revisions seek to align the FCG to various changes in legal and regulatory obligations in the financial crime compliance arena. There are more significant changes in relation to guidance around sanctions and proliferation financing. 

Sanctions

The FCA conducted an extensive assessment of firms’ responses to increased sanctions due to Russia’s invasion of Ukraine and published its key findings in Autumn 2023. The proposed changes to the FCG would incorporate some of its learnings around good and poor practice and areas for improvement. For example, the updates propose more rigorous controls and checks to identify and block financial transactions that may breach sanctions. There is also more prescriptive guidance for reporting breaches and more emphasis on governance and oversight. The revised guidance emphasises the need for senior management to take clear responsibility for managing sanctions risks. The proposals also highlight the importance of Management Information (MI) with the expectation being around regular, calibrated MI reporting to provide senior management with a clear understanding of the firm's sanctions compliance risk. Effective customer due diligence and more informed risk assessment is also covered in the revised guidance as well as the use of up-to-date and effective screening systems that are appropriate to the business. Firms will also need to consider putting systems in place to identify potential sanctions evasion involving third parties.

Proliferation financing  

The FCA is proposing to update FCG in light of changes brought about by the Money Laundering and Terrorist Financing (Amendment) (No 2) Regulations 2022, SI 2022/860, which (in the UK) implemented The Financial Action Task Force (FATF's) revised recommendations about proliferation financing risk assessment. The revised guidance will contain new references to proliferation financing throughout the FCG, to highlight that the risk of this (essentially the provision of funds or financial services connected to the manufacture and use of nuclear, chemical or biological weapons) is to be treated in the same way as other financial crime risks. However, it also clearly sets out the expectations for proliferation financing risk assessments to be undertaken, either as part of the existing business-wide risk assessment or as a standalone document. The key takeaway for firms is the need to assess exposure to proliferation financing and mitigate this exposure as necessary. 

Other changes

The FCA is proposing to set out new guidance for firms on how they can implement and monitor more effective transaction monitoring systems. Calibration of tools and rules to key risks will remain of key importance. 

Other proposed changes to FCG would add explicit reference to cryptoasset businesses, specifically in the context of risk assessment, Customer Due Diligence (CDD) and sanctions and counter proliferation financing compliance. 

The FCA is also proposing changes to make it clear that firms should consider whether their systems and controls are proportionate and consistent with their obligations under the Consumer Duty, and to update some of the existing case studies.

Should you require assistance in responding to this consultation, please contact the authors.

Common weaknesses that the FCA observed and outlined in its letter included discrepancies between firms’ registered and actual activities; a lack of financial crime controls to keep pace with business growth; weaknesses in business wide risk assessments and customer risk assessments; lack of detail in policies creating ambiguity around actions staff should take to comply with their obligations under the MLRs and a lack of resources for the financial crime function; as well as inadequate financial crime training and the absence of a clear audit trail for financial crime related decision-making. 

What must firms do?

• Within six months of receipt of the letter, firms must complete a gap analysis against the identified common weaknesses. In particular:
• Firms need to reassure themselves that their registered activities are accurate and up-to-date and to notify the FCA of any relevant changes to their business details or any inaccuracies within 30 days;
• Firms should be prepared to show that their financial crime controls are not only robust but have evolved in line with the growth and complexity of their business;
• Firms should have a business-wide risk assessment in place, and, where they do already, they should review those risk assessments to make sure they have identified and assessed the money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risks to which the business is subject. This must be documented;
• Firms should be able to demonstrate that customer risk assessments have been tailored towards individual customer characteristics;
• Firms' customer due diligence (CDD) policies and procedures should contain sufficient detail about the actions staff should take to comply with the firms' legal and regulatory obligations, including what level of CDD measures should be applied to different risk ratings, especially during the onboarding process;
• Firms' CDD procedures should be kept up to date to reflect the latest changes in the MLRs and FCA guidance in the Financial Crime Guide;
• In particular, firms should check their risk assessments explain what frontline staff should do for customers established in or transacting with a party established in a high-risk third country;
• Firms need to have clear, written policies and procedures for investigating and recording Suspicious Activity Reports (SARs);
• Firms need to be clear as to what their ongoing monitoring of policies and procedures looks like and to ensure it is carried out and documented;
• Firms need to ensure (and be able to demonstrate) that their financial crime teams are adequately resourced to carry out their functions effectively;
• Firms must ensure there is effective and appropriate oversight by senior managers;
• Firms' financial crime training provision needs to be demonstrably prioritized and firms must be able to demonstrate that the training has been tailored to the business function of the staff concerned;
• Front-line employees need to be able to speak confidently about the financial crime systems and controls in place within their firms; and
• Firms need to have clear and effective data management and reporting strategies around financial crime, including management reporting.
• Firms need to reassure themselves that their registered activities are accurate and up-to-date and to notify the FCA of any relevant changes to their business details or any inaccuracies within 30 days;
• Firms should be prepared to show that their financial crime controls are not only robust but have evolved in line with the growth and complexity of their business;
• Firms should have a business-wide risk assessment in place, and, where they do already, they should review those risk assessments to make sure they have identified and assessed the money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risks to which the business is subject. This must be documented;
• Firms should be able to demonstrate that customer risk assessments have been tailored towards individual customer characteristics;
• Firms' customer due diligence (CDD) policies and procedures should contain sufficient detail about the actions staff should take to comply with the firms' legal and regulatory obligations, including what level of CDD measures should be applied to different risk ratings, especially during the onboarding process;
• Firms' CDD procedures should be kept up to date to reflect the latest changes in the MLRs and FCA guidance in the Financial Crime Guide;
• In particular, firms should check their risk assessments explain what frontline staff should do for customers established in or transacting with a party established in a high-risk third country;
• Firms need to have clear, written policies and procedures for investigating and recording Suspicious Activity Reports (SARs);
• Firms need to be clear as to what their ongoing monitoring of policies and procedures looks like and to ensure it is carried out and documented;
• Firms need to ensure (and be able to demonstrate) that their financial crime teams are adequately resourced to carry out their functions effectively;
• Firms must ensure there is effective and appropriate oversight by senior managers;
• Firms' financial crime training provision needs to be demonstrably prioritized and firms must be able to demonstrate that the training has been tailored to the business function of the staff concerned;
• Front-line employees need to be able to speak confidently about the financial crime systems and controls in place within their firms; and
• Firms need to have clear and effective data management and reporting strategies around financial crime, including management reporting.

The FCA may ask for the findings from this analysis as well as evidence of actions taken to address the gaps identified, and the progress of any remedial work and testing, in future engagements. If a firm's actions in response to the letter are deemed inadequate, the FCA will consider appropriate regulatory intervention.

AG regularly advises a wide range of firms, including Annex I firms, on their compliance with the MLRs.  If you would like help with an assurance review or to discuss the changes, please contact the authors.

The consultation covers four core themes:

Making CDD more proportionate and effective

The consultation discusses stakeholder concerns about the proportionality of due diligence and notes that some find the way in which due diligence requirements are applied to be burdensome or feel the requirements lack purpose. The paper explores various options to achieve a better balance and support efforts to prioritise resource where it will have greatest impact. In particular: 

• Respondents are asked to consider whether the triggers for CDD are sufficiently clear, especially for regulated firms that are not in the financial sector. HM Treasury is seeking feedback on whether additional guidance or changes to the MLRs would improve clarity around CDD measures; 
• HM Treasury is proposing providing clearer guidance to regulated firms on when to carry out 'source of funds' checks. Respondents are asked whether the current wording in the MLRs is clear and whether there is a need for additional guidance or legislative changes; 
• The consultation considers whether the wording in regulation 28(10) MLRs around due diligence on persons acting on behalf of a customer is sufficiently clear. Respondents are asked to provide suggestions for improving clarity; 
• The consultation explores how to support the use of digital identity when verifying customer identity. Respondents are asked whether the MLRs are sufficiently clear on how digital identity verification can be used and whether further guidance or changes to the MLRs are required; and
• Respondents are asked to consider whether a legislative approach is necessary to address the timing of verification of customer identity following a bank insolvency, or whether a non-legislative approach would be sufficient to clarify expectations. 

Strengthening system coordination

The consultation notes that AML/CTF-regulated firms and supervisory authorities are part of a wider system of public and private sector actors working together to tackle economic crime in the UK. HM Treasury aims to enhance the effectiveness of the UK's anti-money laundering and counter-terrorist financing regime by improving coordination and information sharing among different actors in the system. The proposed changes reflect in part the need to update the MLRs, to ensure continuing effective cooperation as the system evolves to take account of new and emerging threats, technological change, and changes in the legislative landscape such as the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023). In particular:

• Respondents are asked to consider whether further changes to the information-sharing gateways in the MLRs are needed to support system coordination and whether there are any remaining barriers to the effective operationalisation of regulation 52;
• HM Treasury proposes expanding the relevant authorities listed under regulation 50 to include Companies House and the Secretary of State, to provide more comprehensive grounds for supervisors to cooperate with Companies House. Respondents are asked to consider what impact this amendment would have. 
• The consultation discusses the role of the National Risk Assessment (NRA) in guiding firms' compliance work. Respondents are asked to comment on whether the government should do more to clarify the relationship between the NRA and firm risk assessments of regulated firms and how the NRA could be made more useful. 

Providing clarity on scope of the MLRs

Proposed changes and questions aim to ensure that the scope of the MLRs is clear and appropriately captures higher-risk business activity. In particular: 

• The paper discusses the fact that the thresholds for the application of the requirements in the MLRs are currently set in a mix of currencies, with references to both euros and pound sterling. It proposes changing all references to euros in the MLRs to pound sterling and seeks views on the best conversion method;
• HM Treasury has identified potential gaps in the regulation of Trust Company and Service Providers (TCSPs), particularly in relation to the sale of off-the-shelf companies. It proposes extending TCSP activity to include the sale of off-the-shelf companies and seeks views on this;
• The consultation highlights a need for clarity on the registration and change in control measures for custodial wallet providers and cryptoasset exchange providers. Respondents are asked their views on whether the MLRs should be amended to align the registration and change in control measures for these providers with the Financial Services and Markets Act 2000 (FSMA 2000). 

Reforming registration requirements for the Trust Registration Service (TRS)

The proposed amendments are also intended to increase transparency in relation to certain higher risk trusts whilst reducing administrative burdens on low-risk trusts. In particular: 

• There are proposals for requiring the registration of all non-UK express trusts with no UK trustees, that own UK land, excluding Scottish survivorship destination trusts from TRS registration and aligning the registration requirements of some trusts required to register following the death of a settlor. The consultation seeks views on the proposal and its potential unintended consequences; 
• The consultation also proposes introducing a de minimis exemption for trusts required to register on the TRS. Respondents are asked to give views on this, as well as suggestions for what controls could be put in place to ensure that there is no opportunity to use the de minimis exemption to evade registration on TRS.

Should you require assistance in responding to this consultation, please contact the authors.

Policy proposals that the APPGs put forward in their second manifesto include: 

• Implementing public registers of beneficial ownership in the UK's offshore territories;
• Making the existing UK trust register public;
• Amending the Register of Overseas Entities to publish information of all parties to trusts that own properties via overseas entities;
• Closing other loopholes in corporate transparency, including requiring all companies and partnerships to declare the identity of individuals with significant ownership or control over their activities;
• Introducing senior executive accountability for neglect around economic crime;
• Broadening the scope of regulation of a series of bodies and institutions said to be 'enablers of economic crime';
• Broadening the scope of the new 'failure to prevent fraud' offence to cover companies of all sizes and introducing a new 'failure to prevent money laundering' offence;
• Establishing a cross-governmental Economic Crime Fighting Fund (by reinvesting financial penalties);
• Implementing a 'fraud levy' on large tech corporations;
• Strengthening enforcement capability by attracting and retaining staff and paying them appropriately as well as employing the skills and expertise of private sector professionals;
• Tackling structural challenges and streamlining the agencies involved in the economic crime response, to enhance the coherence of the economic crime landscape;
• Tougher sanctions enforcement, including improving links between sanction policy and law enforcement, greater information sharing, aligning designations to match the UK's allies, targeting networks, and bearing down on sanctions evaders and their enablers as well as proper enforcement of the UK's trade sanctions, by quickly closing the refining loophole and policing its insurance industry more effectively;
• Tightening up political donations by introducing requirements for political parties to conduct 'know your donor' due diligence checks on donations above a certain threshold;
• Enhancing the transparency and accountability of the lobbying framework by expanding both departmental releases and the scope of the Lobbying Act to encompass declarations from a broader spectrum of lobbyists;
• Reforming public procurement rules to make it easier to debar and exclude companies that have been complicit in fraud or economic crimes and ensure the new debarment list is fit for purpose;
• Enhancing parliamentary scrutiny of enforcement agencies and regulatory or supervisory bodies responsible for tax and economic crimes, with a new Select Committee of both Houses that would work under Privy Council terms; and
• Appointing an Independent Economic Crime Commissioner who would be responsible for ensuring accountability across government departments to enhance the UK's defences against and response to economic crime.

The second manifesto also sets out the APPGs' views of the current state of economic crime in the UK, highlighting the scale of the problem and the progress made to date.

For further information, please contact the authors.