Counting the cost of poor anti-money laundering controls

The UK FCA's decision to impose a £102 million fine on a firm underscores the crucial importance of complying with anti-money laundering requirements.

On 9 April 2019 the UK's Financial Conduct Authority ("FCA") confirmed that it has imposed a fine of £102,163,200 on an international bank (the "Bank") for failing to comply with anti-money laundering ("AML") requirements over the period 24 November 2009 to 31 December 2014.

Specifically, the FCA found that the Bank failed to establish and maintain risk-sensitive AML policies and procedures, and failed to ensure that its overseas branches in the UAE applied UK equivalent AML and counter-terrorist financing controls.

Given the clear similarity in approach between the UK's and Jersey's AML regimes[1] and the JFSC's recent focus in this area, this decision offers firms a reminder of the importance of their obligations and the need to ensure that their AML systems and controls are in practice fit for purpose.

Background

The Bank is a London-headquartered global bank that comprises a network of more than 1,109 branches and outlets in 68 markets. It provides a range of financial products and services for both personal and business customers. Of particular relevance to the FCA's action were that:

• The Bank had licensed branches in the UAE serving over 340,000 customers in the UAE, Middle East, North Africa and elsewhere. The UAE was the Bank's seventh-highest earning region across its group, but was recognised by the Bank to be a high financial crime risk environment (due in part to its geographic proximity to sanctioned countries).
• The Bank's UK Wholesale Bank had correspondent banking relationships with 1,314 financial institutions in non-EEA jurisdictions. As a correspondent bank often has no direct relationship with the underlying parties to the transaction, the bank is reliant on (amongst other things) the AML controls of the overseas bank. Correspondent banking relationships with overseas banks from non-EEA states are recognised as presenting a particularly high risk of money laundering.

Under the UK's AML regime (which is similar in these respects to Jersey), the Bank was required to:

• establish and maintain appropriate and risk-sensitive policies and procedures in order to minimise the risk of the firm being used by those seeking to launder the proceeds of crime, evade financial sanctions, or finance terrorism
• require its non-EEA branches and subsidiaries to apply AML standards at least equivalent to those required in the UK in relation to due diligence and ongoing monitoring

What the FCA found

The FCA found "serious and sustained shortcomings" in the Bank's AML controls, and identified a number of "significant" failings. Many of these issues persisted even though they had been identified by internal reports and audits. Whilst specific to the facts, the findings provide clear examples of what is expected of firms in this space.

In terms of the Bank's due diligence, the Bank failed to ensure that:

• its UAE branches collected sufficient information on the customer and analysed it to understand the nature and purpose of the customer's account and businesses
• its UAE branches consistently established the source of funds to properly assess risk
• when undertaking correspondent banking, an adequate assessment was undertaken of the overseas bank's AML controls and, further, that adequate steps were taken to identify and understand the role of politically exposed persons ("PEPs")

The FCA also identified "widespread failures" in the Bank's reviews of due diligence conducted as part of its ongoing monitoring of AML risks. For example, the FCA identified instances where: employees accepted unconvincing information from customers; incomplete periodic review forms were approved or the required sign-off was not obtained; and trigger events requiring due diligence to be repeated (e.g. if there was information casting doubt over the veracity of documents or if a SAR was filed) were not followed.

Failings were also found in the Bank's own internal checks on its AML controls. For example, the checks conducted by the first line of defence did not provide an appropriate level of scrutiny and challenge, and the second line of defence was under-resourced in terms of both quantity and quality.

Further, the FCA was concerned by the Bank's approach to the identification and mitigation of material AML risks, which it considered to be neither holistic nor proactive. Of particular concern was the Bank's failure to consider the risk of individuals in sanctioned countries accessing its banking services through a variety of digital channels.

Finally, the FCA criticised the Bank's escalation of money laundering risks. For example, the notice records concerns about the adequacy of management information and the absence of detailed escalation criteria.

Discussion

Given the similarity in approach between the UK's and Jersey's AML regimes, the FCA's action against the Bank stands as a reminder to firms of the need to ensure they are meeting their AML obligations on an ongoing basis, including the requirement to adopt a risk-based approach in their AML policies and procedures.

However, firms must not confuse a risk-based approach with being permitted to adopt low or poor standards. In Bell v AG [2006] JLR 61, Jersey's Court of Appeal considered[2] what it means to 'maintain' procedures for the purposes of forestalling and preventing money laundering. The Court held that it is "consistent only with a requirement that the prescribed obligations be met in respect of every relevant transaction, subject only to defendants being excused where there are circumstances which are beyond their control".

The JFSC's AML/CFT Handbook sets out clearly the JFSC's expectations in this area, which firms will need to consult routinely when assessing their AML systems and controls. However, some high-level observations can be made.

First, the Board has a key responsibility in setting the firm's general framework to combat money-laundering (i.e. its systems and controls). This includes conducting (and recording) a business risk assessment that then drives the firm's strategy for countering money-laundering, which in turn drives the firm's systems and controls and how it apportions responsibilities internally. Importantly, Board's must remember that the business risk assessment must be kept up-to-date, and should also ensure that the firm's systems and controls remain fit for purpose over time.

Second, it is important to remember that the aim of AML systems and controls is to forestall and prevent money laundering. Firms must therefore not only conduct adequate due diligence (with appropriate steps taken to verify what they are being told), but they must then ensure that they conduct ongoing monitoring of business relationships against the profile they have built of the customer.

Third, firms must ensure their systems and controls are fit for purpose and adhered to. A 'tick box' approach to compliance must be avoided.

AML compliance has been a key area of focus for the JFSC in recent months and, given the importance of AML requirements, it will remain so for the foreseeable future. Firms must therefore ensure that they apply a rigorous focus at all levels on ensuring compliance with the requirements of the AML regime.

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice