AML checks for solicitors: file opening

The rules: Money Laundering Regulations 2017
Supervisor for SRA-regulated firms: The SRA
Firm-wide risk assessment: Regulation 18
Who reports suspicions: The MLRO, the firm's nominated officer

Which work do the Money Laundering Regulations cover?

They cover a firm acting as an independent legal professional in financial or property transactions: buying and selling property or businesses, managing client money or assets, opening or managing accounts, and setting up or running companies and trusts. Trust or company services and tax advice can also be in scope.

Scope depends on the work, not the client. The SRA's scope guidance sets out where the lines fall.

What AML checks happen at file opening?

Identify the client and verify who they are from a reliable, independent source, identify any beneficial owners and take reasonable steps to verify them, and understand the purpose of the work. The SRA also expects a written risk assessment of the client and the matter, which decides how far the checks go.

For a company, add its number, registered office, directors and owners. The SRA publishes a client and matter risk assessment template.

When must the checks be finished?

Before the business relationship starts. Regulation 30 allows verification to finish while the relationship is being set up, if that avoids interrupting normal business and the risk is low, as long as it's completed as soon as practicable. Record why you relied on it.

What is the difference between source of funds and source of wealth?

Source of funds is how and from where the client got the money for this transaction, such as a mortgage, savings or the sale of another property. Knowing it came from a UK bank account isn't enough. Source of wealth is how the client came to have their money overall, such as salary, an inheritance or selling a business. The regulations ask for the first where needed and both for a politically exposed person.

Regulation 28(11) covers source of funds and regulation 35(5) covers both for a PEP. Your risk assessment decides how much evidence to ask for.

When is enhanced due diligence needed?

When the risk is higher. Regulation 33 lists the cases: a high risk in your own risk assessment, a party in a FATF call-for-action country, a PEP or their family or close associates, false or stolen identity documents, and transactions that are unusually complex or large, follow an unusual pattern or have no apparent purpose.

For a PEP, senior management must also approve the relationship (regulation 35). Where the risk is low, regulation 37 allows simplified due diligence.

What holds a new matter up?

Files tend to stall at the same places: missing or mismatched ID, source of funds evidence covering only part of the money, an undocumented family gift, a company client owned through other companies, and clients you never meet.

Asking for everything in the first letter, and saying why, cuts the chasing.

Who is responsible for AML in a law firm?

The firm must appoint a nominated officer, usually called the MLRO, who decides whether internal reports of suspicion go to the National Crime Agency. Where the firm's size and nature make it appropriate, a senior person must also be responsible for compliance, whom the SRA calls the MLCO.

The MLCO can also be the MLRO or the COLP if senior enough. Anyone with a suspicion reports it to the MLRO and says nothing that could tip the client off, which is an offence under section 333A of the Proceeds of Crime Act 2002.

Do we need a firm-wide risk assessment?

Yes, if any of your work is in scope. Regulation 18 requires you to assess the money laundering and terrorist financing risks your business faces and keep an up-to-date written record. The SRA calls it the foundation stone of your AML work, warns that not having one could lead to criminal action, and publishes a template.

The file-opening checklist

Run it on each new matter in scope, alongside your own policies and the SRA's templates.

Download the checklist

AML checks at file opening: checklist

For matters in scope of the Money Laundering Regulations 2017.

Before you accept the matter

Conflict check run and recorded.
Work in scope of the Money Laundering Regulations? Answer and reason recorded.
Client and matter risk assessment written.

Who the client is

Client identified and verified from a reliable, independent source.
Company: name, number, registered office and directors verified.
Beneficial owners identified, reasonable steps taken to verify them, ownership understood.
Anyone acting for the client identified and their authority checked.
PEP and sanctions screening done.

The matter and the money

Purpose of the work recorded.
Source of funds understood, with evidence where the risk calls for it.
Source of wealth established where the risk calls for it, and always for a PEP.
Anything unusual recorded and considered.

Decision

Level of due diligence recorded: simplified, standard or enhanced.
Senior management approval where required, such as for a PEP.
Verification complete before the relationship starts, or the exception recorded.
Any suspicion reported to the MLRO, with nothing said to the client.
Signed off by [fee earner] on [DD/MM/YYYY].

Can AI help with AML checks?

It can do the gathering: read what has come in, check it against your list, flag what's missing and draft the chasers. The risk assessment, the decision to act and anything about a suspicion stay with the fee earner and your MLRO, and out of shared tools.

AML checks for solicitors at file opening