FCA Puts Firms on Notice Over Anti-Money Laundering Shortfalls

Review Topic

FCA Findings

Policies and procedures

• The FCA found that some firms’ policies were lacking detail on practical steps to comply with customer identity verification.
• For example, there was insufficient coverage of what alternative ID verification could be carried out if customers lacked standard documentation.
• In our experience the FCA’s expectation is that policies and procedures must be sufficiently detailed to provide practical guidance to staff on what specific steps they should take to implement the firm’s AML requirements. For example, the FCA has expressed the view that materials must be detailed enough so as to allow new staff members to pick the policies and procedures and know what they need to do to perform their role without further assistance.
• Periodic reviews and event-driven refreshes — The FCA noted that with some firms polices contained insufficient detail on these areas, including in relation to the cadence of periodic reviews and steps to be taken in relation to event-driven refreshes.
• Governance deficiencies — These issues relate to escalations and circumstances in which senior management sign off is needed.
• Distinctions between CDD, EDD and measures relating to PEPs — The review looked at whether firms distinguish between CDD and EDD sufficiently. It also looked at the response to the change in requirements around domestic PEPs. In some cases EDD measures were not sufficiently different from CDD to deliver enhanced scrutiny of the customer or business relationship.

CDD

• Recording information on the purpose and intended nature of the business relationship — The FCA found that some firms do not do enough to record CDD information and other relevant matters as part of the CDD process.
• EDD — The FCA identified failures in evidencing and documenting EDD measures taken for high-risk customers.
• It is clear that the FCA has high expectations around EDD processes and noted that “strong firms” document each stage of this process.
• Customer risk assessment (CRA) — The FCA noted that most firms tailor their approach to the risk profile of each customer, ensuring that higher-risk customers are subject to enhanced checks and reviews. The CRA in our experience is a key area of focus for the FCA.

Compliance monitoring and audit

• Level and depth of reviews and independence of these arrangements — The FCA noted a variation in the level and depth of compliance monitoring and audit. These matters need to be proportionate to a firm’s profile and risks.
• Independent second line assurance — The FCA noted that “strong firms” operate independent third line testing that assessed controls. This standard appears to be the FCA’s benchmark.
• The FCA questioned the effectiveness and impartiality of testing if firms did not have independent second line assurance, with the same staff responsible for both onboarding and reviewing customers.