Financial Regulation - In the know: Financial Crime - August 2024

(5 min read)

WUC argued that the NCA had misdirected itself in law, in short because:

• it was not necessary for there to be specific criminal property before the NCA could commence an investigation (the point of investigating would be to see what emerges and whether or not there was such property);
• it was wrong for the NCA to take the view that, as soon as property entered a supply chain for adequate consideration, this had a 'cleansing' effect on it such that no further POCA offences could be committed by dealing with it.  That was not the legal effect of the 'adequate consideration' provisions in POCA s329(2)(c) or other civil recovery provisions in POCA.

During the course of the proceedings, the NCA clarified its position following the September 2021 decision letter.  In particular, it accepted that an investigation could be commenced before specific criminal property was identified.  As a result, the issues for decision by the Court became quite narrow, focusing on the NCA's decision making and whether or not it had actually been based on what the NCA had later accepted involved errors of law.  The Court found that the decision letter, read as a whole, would convey to the reasonable reader that the NCA had proceeded on the basis of propositions which were legally wrong, quashed the NCA's earlier decision, and sent it back to the NCA to be reconsidered.

We suggest the most interesting point in the case lies in some commentary that the Court of Appeal made about the 'adequate consideration' defence in s329 POCA.  In particular, the Court commented (at para 33 and following of the judgment):

• the 'adequate consideration' provisions in s329(2)(c) create an exemption from the s329 offence which is personal to the individual concerned;
• in order for it to operate, the property still has to be 'criminal property' whose acquisition, use, or possession would attract potential criminal liability - that depends on the state of mind of the individual providing the 'adequate consideration' (in short, whether they know or suspect it is criminal property);
• if a person acquires 'criminal property' for 'adequate consideration', then that person does not commit an offence under s329 POCA – but the property is still 'criminal property' and is not 'cleansed' by the adequate consideration.  That person could still commit other POCA offences, e.g. by transferring it to someone else or taking it out of the UK (offences under s327 POCA); and
• just because one person has acquired property for 'adequate consideration' and can rely on section 329(2)(c), this does not prevent the same property from being 'criminal property' in the hands of someone else later on, provided they know or suspect it is criminal.

Whilst it remains possible at the time of writing that the Court of Appeal's decision might be appealed, the commentary above is important for anyone looking at the issue of money laundering in supply chains.  

An importer or purchaser that suspects goods to be the product of forced labour or certain other human rights abuses may have the requisite mental state to make the goods in issue 'criminal property' for POCA purposes.  The judgment indicates that just because an importer or purchaser lower down in the supply chain has acquired suspected goods or other property for 'adequate consideration' (essentially, market value), that alone will not be sufficient to 'cleanse' that property and prevent them committing other money laundering offences (e.g. by transferring the property on up the supply chain).

Nor will others further up a supply chain be exempt from committing money laundering offences by handling goods because there has already been a chain of previous transactions for 'adequate consideration'.  A purchaser further up the supply chain that does not suspect the goods to be 'criminal property' would not, in principle, be at risk of committing a substantive money laundering offence.  If however, they did suspect the goods, they too would be at risk.

POCA risks can, however, often be managed using other defences in the Act which were not considered in detail in the judgment (for example by obtaining a defence against money laundering through the SAR / DAML process).

AG regularly advises a wide range of businesses and their services providers on supply chain issues. Please reach out any of the authors or key contacts for more information.

(5 min read)

The new "best efforts" obligations are set out in newly introduced Article 8a of EU Regulation 833/2014.  EU companies must now undertake their "best efforts" to ensure that their non-EU subsidiaries also do not participate in activities that undermine EU sanctions against Russia.  While EU sanctions continue to apply to (i) EU persons wherever they are located, and (ii) non-EU persons when undertaking any activity within the EU, this measure is one of a number of attempts by the EU for EU sanctions to have extraterritorial impact, without going so far as mirroring the US approach to enforcement on an extraterritorial basis.

Non-EU subsidiaries

The EU has also adopted a wide definition of non-EU subsidiaries, to include any legal persons or entities owned or controlled by the EU company.  The EU's "Best Practices" for the effective implementation of restrictive measures (3 July 2024 provisions update) contain the following definitions:

• "ownership" is defined as being in possession of 50% or more of the proprietary rights of the company or having a majority interest in it.  The recitals of the amending legislation, Council Regulation (EU) 2024/1745, contain a mirroring definition of "ownership";
• "control" is however defined more broadly.  As criteria for assessing control, EU Best Practices take into account various indicating factors, such as the power to appoint/remove a majority of the management body of a company, and the right to exercise a dominant influence over the company (including having the de-facto power to exercise such influence).   

This means that an EU company will be responsible for making sure that any foreign companies which it has control over, in the manner described above, complies with EU sanctions.  This can be the case even if the EU company does not own a significant shareholding in the foreign company.  

"Best efforts"

"Best efforts" is widely defined in the recitals of Council Regulation (EU) 2024/1745 as all actions which are suitable and necessary to prevent the undermining of EU sanctions.  The recitals, providing guidance with respect to the legislative provisions, specify the implementation of appropriate policies, controls and procedures to mitigate and manage risk effectively as one example.  In doing so the EU company must consider factors such as jurisdictional risks and the business sector and activity of the subsidiaries.

In practice, this means that both the EU company and its non-EU subsidiaries should consider adopting appropriate systems and controls. The EU company will have to ensure, through effective implementation of policies and procedures, that its subsidiaries are particularly careful when trading in specific types of sensitive goods, by using the “no Russia” clause in their contracts, by conducting appropriate customer and third party due diligence (these being examples set out in the EU Q&A on the 14th package of restrictive measures against Russia), and through other measures.  They should also consider monitoring their non-EU subsidiaries and consider providing professional support, which may include external legal advice, to them to check if relevant systems and controls are properly implemented.  

Problem areas

Organisations, particularly those that do not cascade their international trade and compliance programmes through their entire organisation, or have operational control of their non-EU subsidiaries, should consider taking steps to ensure that they meet this new obligation.  We anticipate a number of commercial structures (such as foreign joint-venture companies and SPVs) may pose material risks to businesses in this context.  Breaches may result in criminal or administrative penalties determined by domestic rules of EU member states, as prescribed by the amending legislation.

For a summary of other measures of the 14th sanctions package, see the EU's press release on its implementation.

If you want to find out what these updates mean for your business, or discuss training opportunities or systems and controls changes, please get in touch with the authors or key contacts listed on this page.

(5 min read)

In summary, the FCA found that, among the firms it reviewed:

• most had systems and controls in place to implement the provisions of the MLRs and FCA guidance concerning PEPs;
• most were not subjecting PEPs to excessive or disproportionate checks, but there was room for widespread improvement;
• all firms reviewed were 'clear that they would not decline products or services to UK PEPs or their RCAs simply because of PEP status', however other data gathered by the FCA showed that some PEPs and RCAs had been denied services or had accounts closed due to financial crime concerns;
• some had definitions of PEPs and RCAs that were not in line with regulations and guidance, with some firms applying broader definitions than the FCA would have expected;
• some had ineffective arrangements for reviewing and declassifying PEPs and RCAs after they leave public office;
• some were not effectively considering the customer's actual risk in their risk assessments;
• there was a need in a number of firms reviewed to improve the clarity and detail of communications with PEPs, in particular so that customers could understand what they were being asked and why;
• most of the firms needed to improve staff training, using practical examples and case studies;
• some firms needed to update their policies to reflect legislative developments in January 2024, regarding the treatment of UK PEPs and RCAs.

Key actions that firms need to take now

The FCA has identified several areas where firms could improve and called on firms to act now to ensure that their approaches are compliant with the legislative framework and FCA guidance.  Key changes the FCA has called on firms to make include:

• reviewing current arrangements (policies, procedures, controls) for the risk management and treatment of PEPs and RCAs against the FCA's findings;
• addressing any gaps in their current arrangements, including updating policies and procedures, ensuring these are aligned with the relevant regulations and FCA guidance;
• improving communications with customers so they are clear and effective when requesting information so that PEPs and RCAs can understand what information is being sought and why the requests are being made.  In this regard the FCA has warned firms of the need to comply with the Consumer Duty requirements to ensure their communications meet customers’ information needs and are likely to be understood;
• making sure that staff are appropriately trained (through, for example, the use of case studies and other practical guidance) so that the firm’s policies and procedures are consistently and effectively applied in line with the regulations and FCA Guidance.

We believe having reviewed the FCA's findings that some areas could potentially be difficult for some firms, particularly international firms that operate under multiple anti-money laundering regimes.  We would be happy to assist clients with this further; please get in touch.

The FCA's guidance consultation GC 24/4

The FCA is consulting on some changes to its 2017 PEPs guidance, which in our view are relatively modest.  In summary it is proposed that the guidance be updated:

• to align it with more recent legislative change, particularly the January 2024 amendment to the 2017 Money Laundering Regulations (pursuant to which the starting point for a firm’s risk assessment of a domestic UK PEP is that they are lower risk than non-UK PEPs);
• to provide further guidance on the treatment of certain non-executive board members of civil service departments; the FCA is proposing to clarify that such roles, in the UK context, are not roles that firms should treat as politically exposed;
• to allow firms a measure of more flexibility in their approaches to sign-off for PEP relationships, provided the MLRO retains oversight of all PEP relationships within the firm.

The FCA has however invited firms to provide the FCA with comments on where the guidance as a whole might – within the confines of the MLRs – help firms apply a more effective risk-based approach.

This clearly remains an area of focus for the FCA and in our view there are potential s166 and/or enforcement risks for firms that do not react to the FCA's multi-firm review.  Any firms that would like help with their reviews, or would be interested in an assurance review or to discuss the changes, are encouraged to contact the authors.

(6 min read)

Objectives of the EU's AML/CTF Package

The AML/CTF Package, first proposed by the European Commission in July 2021 (following on from its Action Plan for a Comprehensive EU policy on AML and CTF), promises to bring profound change in combating ML/TF. Notably, selected cross-border financial entities will find themselves subject to increased scrutiny and oversight; the existing divergent regulatory framework (created by inconsistent implementation of the standards in the AML/CTF Directives) will be superseded by detailed, directly applicable provisions; and new powers will create greater convergence between national AML/CTF supervisors and FIUs.

AMLA Regulation

AMLA will be established as the key authority responsible for a unified supervisory approach to combating ML/TF in the EU financial system and ensuring compliance with AML/CTF requirements. Its main focus will be enhancing cooperation between national supervisory bodies and FIUs, to create a more harmonised approach. It will conduct periodic review and institute practices to enable cross-border analysis of suspicious payments and transactions. It will also have the power to draft guidelines and recommendations for national supervisors. AMLA will also support and facilitate data sharing and improve the reporting of suspicious payments and transactions from the list of entities subject to EU AML/CFT rules (obliged entities). While it will have a coordination and convergence role in the non-financial sector, AMLA will provide direct supervision to some obliged entities exposed to the highest risk of ML/TF in the financial services sector. Additionally, the AMLA Regulation provides for AMLA to impose administrative measures and financial sanctions for non-compliance with AM/CTF requirements including the power to issue binding decisions to obliged entities and impose penalties of up to 10 % of turnover or €10 million, whichever is higher.

AML Rulebook Regulation

The EU has found that inconsistent implementation of the AML Directives has led to fragmented approaches to AML/CTF standards across the EU which create frictions for cross-border businesses, among other challenges. The Regulation is designed to provide a harmonised set of rules (Single Rulebook), that applies directly across all EU Member States, ensuring a consistent approach to combating money laundering and terrorist financing. It will also update several norms under the existing regime to account for changing FATF standards. So, for example, it will expand the list of obliged entities in scope to include:

• persons trading, as their regular or principal professional activity, in precious metals and stones;
• persons trading with other high-value goods;
• certain professional football clubs and football agents carrying out specific transactions;
• investment migration operators defined as offering services to third-country nationals which seek to obtain residence rights in a Member State in exchange for any kind of investment; and
• non-financial mixed activity holding companies.

It will expand customer due diligence (CDD) requirements by, for example, introducing stricter requirements for carrying out CDD on occasional transactions and for specific customers and situations. It will also make minor clarifications to the definition of a PEP and streamline and enhance beneficial ownership requirements. It will create a requirement for a nexus with the EU before a legal entity can apply to be on a beneficial ownership register. The general threshold for beneficial ownership of 25% of the voting rights or other interest rights will remain the same, but the AML Rulebook Regulation provides that control exercised through other means can also trigger beneficial ownership reporting. Legal entities established outside the EU will be required to register their beneficial ownership in the central registers where they have an EU nexus.

MLD6

The new directive contains a range of anti-money laundering and anti-terrorist financing mechanisms, predominantly concerned with imposing requirements for supervisors and FIUs including in respect of beneficial ownership registers. Specifically, it lays down rules on:

• the establishment of FIUs in Member States; outlining their responsibilities, ensuring their operational independence and autonomy;
• enhanced cooperation and coordination among Member States, competent authorities, FIUs, and other relevant entities;
• the responsibilities of Member States to ensure that all obliged entities are subject to adequate and effective supervision;
• the imposition of pecuniary sanctions and administrative measures on obliged entities for breaches of AML/CFT requirements;
• the establishment of central beneficial ownership registers, specifying the information to be held and the conditions for access to this information;
• central registers or electronic data retrieval systems and other centralised automated mechanisms;

Conclusions

The AML/TF Package represents material changes to EU law seeking to prevent ML/TF.  The package sees the introduction of new, more stringent penalties, greater coordination and cooperation across supervisors, and attempts to improve transparency. Firms may need to conduct a review of their practices to help identify gaps in their operations and assess how to best ensure compliance to meet new EU standards, especially as the EU regulations now significantly diverge from UK legislation.

If you have any questions regarding the revised EU anti-money laundering regime, please contact the authors or your usual AG contact.