The Growing Pressure for an "internal independent" audit function for Anti-Money Laundering
Solicitors firms may not have noticed it, but the pressure on complying with their obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 has crept inexorably up since they came into force in 2017.
There is one particular part of the regulations that is becoming increasingly harder to avoid, and that is Regulation 21 (Internal Controls)
Regulation 21 requires firms to;
(1) Where appropriate with regard to the size and nature of its business a relevant person must—
(a) appoint an individual who is a member of the board of directors (or, if there is no such board, the equivalent management body) as the officer responsible for the relevant persons’ compliance with these Regulations;
(b) carry out screening of relevant employees and agents appointed by the relevant person, both before the appointment is made and at regular intervals during the course of the appointment;
(c) establish an independent audit function with the responsibility—
(i) to examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted by the relevant person to comply with the requirements of these Regulations;
(ii) to make recommendations in relation to those policies, controls and procedures, and
(iii) to monitor the relevant person’s compliance with those recommendations
More recent pressure for an independent audit function can be found in the Lexcel V6.1 standard, and the 2019 Conveyancing Quality Standards (which came into effect on the 1st of May 2019). The wording in both of these is;
“Establish an independent audit function to evaluate, monitor compliance with and improve the effectiveness of the practice's AML policies, controls and procedures” and further;
“Otherwise, practices must document why 5.13h (i-iii) above are not appropriate”
So, firstly what does “independent” mean? Well the good news is it doesn’t necessarily mean “external” to the firm. It could simply mean an audit carried out by someone within the firm that does not have any connection with the department being audited.
The issue with this is that firms are encouraged to take a Risk Based approach to determining the need for this function, and where they don’t believe it is needed, to document why.
Given the levels of paranoia surrounding Money Laundering and the additional pressures from the different schemes, unless a firm only provides criminal law services or is a sole principal sole fee earner firm, it will be exceptionally difficult to come up with cogent reasons why the firm would not have this function.
Given the fact that CQS is now subject to audit, Lexcel has always been, and that the SRA are surveying AML risk assessments in firms, now would be a good time to check exactly where your firm is…