SRA AML Annual Report 2023/24

Close on the heels of the LSB report, the SRA issued its Anti-Money Laundering Annual Report for 2023-24 which can be found here.

The report is lengthy and wide-ranging, detailing all the steps taken by the SRA to encourage and enforce AML compliance, and a new sharper focus on sanctions compliance. It’s essential reading (we recommend a quiet evening in front of the fire!) and a useful resource in understanding what the SRA considers law firm AML compliance should look like.

We’ll be publishing a detailed commentary and analysis of the report in a Compliance Lifeline special (coming soon), but here are what we consider to be the key takeaways:

Big increase in inspections and enforcement

• The number of SRA AML inspections and desk-based reviews almost doubled in the last year, from 273 to 545.
• The number of files reviewed by the SRA almost trebled, from 1,245 to 3,048.
• Enforcement action for AML breaches almost doubled, from 47 to 78.
• SRA fines totalled £556,832, and exceeded £1 million if SDT penalties are included

Key themes from enforcement action

The most common reasons for enforcement action were failures to:

• have a compliant firm-wide risk assessment (NB: a later section of the report sets the level of detail the SRA expects to see)
• carry out client and/or matter risk assessments
• 585 files – 19% of those reviewed – did not contain a CMRA
• have adequate AML policies, controls and procedures (a later section of the report sets out the most common areas of non-compliance and what the SRA expect to see)
• train all relevant staff on AML

Other reasons for fines included:

• inadequately identifying and verifying individual and corporate client identity at the outset of a matter
• 152 files – 5% – contained no evidence that the client had been identified and verified
• failing to properly assess and identify client and/or matter risk 12% of files reviewed contained an ‘ineffective’ CMRA
• not undertaking source of funds checks (where monies were transacted), not rechecking the SOF in higher risk matters, and not interrogating information provided adequately
• 2,701 of the 3,048 files reviewed required source of funds/wealth checks. 648 (25%) of these contained no evidence of source of funds. One of these was a cash property purchase for £700,000.
• no ongoing monitoring of transactions

Improvements

On a positive note, the report noted improvements in the way firms are managing AML risk. In particular, the percentage of client and matter risk assessments deemed inadequate fell from 47% to 12%.

Sanctions

Sanctions are now firmly on the SRA’s radar. Sanctions controls checks are a feature of all onsite AML inspections. The good news is that of the 247 firms inspected in the last year, 89% were found to have adequate sanctions screening and controls, an improvement on the previous year.  

The SRA also carried out 55 specific sanctions inspections, where firms had indicated in the sanctions survey that they had acted for a designated person. Of these, 40 were found to be compliant, six were ‘engaged with’ (instructed to amend/improve their PWRA and PCPs, screening controls and staff training) and nine were referred for investigation. During the period, the SRA submitted two financial sanctions reports to OFSI under the Russia Sanctions Regime and is currently investigating further breaches of the sanctions regime. 

Suspicious Activity Reports

It’s clear from the report that the SRA has concerns around both the number and quality of SARs and DAMLs submitted to the NCA by law firms.

During the course of its AML inspections the SRA submitted 23 SARs to the NCA, over 70% of which related to conveyancing (mainly residential). The firms in question had not submitted a SAR due to inadequate client due diligence or source of funds checks; in some cases, they had not scrutinised or questioned the information they had received.
In the last year, AML inspectors have reviewed samples of SARs and DAMLs submitted by law firms, which they found to be of variable quality. Firms are urged to complete their own due diligence before submitting a DAML and to include as much information as possible in SARs.

Emerging Risks

Through its proactive inspections of firms and investigations, and liaison with other agencies, the SRA has identified the following as the key emerging risks:

• Sanctions

The regulator is concerned that some firms have not kept up with the pace and complexity of recent changes to the sanctions regime. The report points to the importance of compliance both at a global level (in maintaining the credibility of international law and co-operation) and a firm level (because offences are strict liability). The report points to the SRA’s Guidance Note on Sanctions, but we should expect more proactive inspections to come.

• Conveyancing

The SRA continue to see conveyancing as having the greatest risk of money laundering. The report advises forms to treat conveyancing as a high-risk activity when conducting client due diligence and ongoing monitoring. Take note – conveyancing may be routine for your firm, but you should always start by treating it as high risk. If your assessment finds a lower risk assessment is appropriate, you must document your reasons on the CMRA.

• Technology

The SRA’s concerns are around the risks of cyber security (the law firm’s and the third-party provider’s), new funding platforms and use of AI. So, be sure to carry out a thorough written risk assessment before adopting new technology.

• Supply Chain Risk

Risks increase when a law firm provides advice or services as part of a wider transaction or as part of a network. It’s essential to identify and manage the risks by understanding the purpose of the services the firm provides and who is ultimately benefiting from them. Effective use of the CMRA can help mitigate this risk.

So what can we expect in the coming year?

• More proactive on-site AML and sanctions inspections and desk-based reviews, based on information gleaned from the recent AML and sanctions data collection exercise
• An extension of the SRA’s proactive supervision into the prevention and detection of economic crime under the Economic Crime and Corporate Transparency Act 2023. Economic crime under the Act includes theft, fraud, false accounting, bribery, tax evasion, money laundering and funding of terrorism, and breach of financial sanction arrangements.
• Potentially unlimited fines (although the message coming out of the SRA COLP and COFA Conference on 5 November suggests a possible rethink on this following adverse criticism)

How can you protect your firm?

The breadth and depth of the SRA Report, the clear intention of increasing proactive supervision, and the proposal for unlimited fines, underlines the importance of getting anti-financial crime compliance right. The cost of getting it wrong is not just the fine, it’s the stress of the investigation, which typically drags on for many months, the potential effect on the cost of PII, and the reputational damage to the firm.
The report itself provides a valuable checklist of what is required and expected. If you need further help, please let us know. Our supportive and non-judgemental services to law firms include:

• Reviewing/drafting/amending Firm Wide Risk Assessments and AML policies controls and procedures
• Drafting anti-financial crime policies and procedures, including Sanctions, Anti-Bribery, Anti-Property Fraud and Anti-Tax Fraud
• AML training made bespoke to your firm
• Anti-fraud and cybercrime training
• Regulation 21 AML audits