Registration-only Firms Face Closer FCA Scrutiny For AML Compliance

It takes more than a bank to launder money, so a wide range of businesses are required to comply with the UK's anti-money laundering (AML) regime. The scrutiny of these businesses has been increasing, particularly since Russia's invasion of Ukraine and the sanctions (and sanctions evasion) that followed. Various misadventures in crypto and Iran have also raised the stakes. The Financial Conduct Authority is the latest regulator to up the ante for the firms it supervises. This post is for information purposes only. If you would like advice on whether you need to register or other aspects of AML, please let me know.

What's involved in AML compliance?

Basically, AML compliance involves the relevant service provider registering with a supervisory authority; conducting certain 'customer due diligence' on clients; and monitoring the business relationship with clients in order to detect and report any suspicious activity to the National Crime Agency. There are also related laws that require a firm to screen clients against sanctions lists, avoid handling proceeds of crime or 'tipping off' those under investigation, provide information on transactions, establish client's source of funds/wealth and so on. 

To meet these regulatory obligations, each 'relevant person' that is covered by the regime must maintain policies and procedures that also involve appointing a 'money laundering reporting officer', assessing the risk of money laundering and terrorist financing for the business as a whole, as well as each product and client; and taking a risk-based approach to deploying resources in their compliance efforts. 

The consequences of getting any of this wrong can be very serious indeed, including jail time, fines and the firm having to cease doing business unless/until the right policies, procedures and controls are in place.

Non-financial businesses that must register and comply

The types of business activities that trigger registration when carried out in the UK are listed in Chapter 1 of the UK's money laundering regulations (MLRs).

The Gambling Commission is obviously the supervisory authority for gambling operators, while HMRC is the supervisory authority for the other non-financial business covered by the regime:

• money service businesses not supervised by the Financial Conduct Authority (FCA) 
• high value dealers handling cash payments for goods totalling 10,000 euros or more on a single transaction or linked transactions
• trust or company service providers not supervised by the FCA or a professional body 
• accountancy service providers not supervised by a professional body 
• estate agency businesses 
• bill payment service providers not supervised by the FCA 
• telecommunications, digital and IT payment service providers not supervised by the FCA 
• art market participants buying or selling of works of art where the transaction value (or a series of linked transactions) is 10,000 euros or more 
• letting agency businesses renting property or land valued at the equivalent of 10,000 euros or more a month

It is typically quite straightforward for these firms to register with HMRC. Money service businesses and trust or company service providers must be registered first before they do any business. The others can trade while their application is being assessed, but run the risk of their application being unsuccessful and having to cease the relevant activity. Otherwise, it's basically a crime not to be registered where you should be, and the sanctions are explained here.

Financial services businesses that must register, even if not FCA authorised.

Certain financial services providers are covered by the AML regime if they carry out financial activities listed in Annex 1 of the MLRs as a business in the UK, even if those activities don't require the firm to be otherwise 'authorised' by the FCA (e.g. under the Financial Services and Markets Act 2000). Such firms must still register with the Financial Conduct Authority (FCA) and otherwise comply with the AML regime. It used to be quick to register, but the FCA has just announced that it will increase its scrutiny of these firms and take longer to register them.

Cryptoasset service providers are not mentioned in Annex 1 of the MLRs, but have their own listing and detailed qualifying criteria set out in Chapter 1 - basically, they are caught by the regime where they undertake cryptoasset exchange or custodian wallet activity (separately from the new cryptoasset regulations).  The FCA already takes considerably longer to register cryptoasset service providers than other businesses.

Are there any exclusions?

Yes, there is a range of exclusions under the MLRs (as well as the initial 'gating' factors of whether an activity is 'carried out as a business' in its own right and 'in the UK', which should not be overlooked).

One area of potential confusion is whether an entity is acting as a 'special purpose vehicle' (SPV). An SPV is a company or other legal entity which is established exclusively for the purpose of simply holding the legal or beneficial (equitable) title or interest in an asset of some kind -  typically a loan, lease or other type of funding agreement. They are common in securitisation (asset-backed bond issuance), but there are also more private arrangements. The financial asset is agreed or 'originated' and funded by some other entity before the legal or beneficial ownership (and the right to receive payments or 'receivables') are transferred (sometimes automatically or almost immediately) to the SPV to be simply held pending expiry or transfer elsewhere. Accordingly, the SPV has no operations, staff or systems of its own because a range of related agreements provide for the 'servicing' of the assets and collection of receivables by either the originator or a third party servicer. The point is that AML compliance obligations should already have been carried out by the entity which originated or created the instrument so it would be 'overkill' to require the SPV to gear up just to carry out AML compliance obligations. Sometimes, people confuse the role of the originator (which must comply with AML requirements) with the role of the SPV (which does not), especially where the originator transfers the asset to the SPV straight away and itself plays no further role in relation to the asset. 

This post is for information purposes only. If you would like advice on whether you need to register or other aspects of AML, please let me know.

Changes to UK Anti-Money Laundering Regime

The UK's anti-money laundering regulations suffer from an enormously long name, so I will shorten them to the "MLRs" for the purpose of explaining some changes that take effect on 1 September 2022 (except where noted). Perhaps the highlight is that account information service providers (AISPs) will no longer need to comply with the MLRs. This note is a summary for information purposes only, not advice. It does not include changes to the authorities' obligations or offences. If you need advice on any of the changes, please let me know.

• The meaning of a trust or company service provider covers the formation of all forms of business arrangement or "firm", not just companies and other legal persons, including limited partnerships registered in England and Wales or Northern Ireland. TCSPs must conduct customer due diligence when they are providing certain services (outlined in regulation 12(2)(a), (b) or (d) of the MLRs). 

• Cryptoasset transfers will be covered by a new Part 7A from 1 September 2023. The provisions apply to a cryptoasset exchange provider or a custodian wallet provider (referred to as a "cryptoasset business"), whether acting for the transferor ('originator'), the transferee ('beneficiary') or just as an intermediary. Cryptoasset businesses acting for originators of transfers (as well as intermediaries involved in the transfer) must include certain information about the originator and beneficiary of the transfer. Where the information is missing, the cryptoasset business acting for the beneficiary of a transfer (as well as intermediaries involved in the transfer) must request it and consider not making the cryptoasset available (subject to a risk assessment). Similar rules apply in relation to transfers from/to 'unhosted wallets'  (private or self-custody wallets). Cryptoasset businesses must inform the Financial Conduct Authority (“FCA”) of any "repeated" non-compliance. 

• The definition of art market participant in the MLRs will not apply to artists who sell their own works of art over the EUR 10,000 threshold.

• From 1 April 2023, firms covered by the MLRs will have to report to the registrar of companies any material discrepancies between information they hold on the beneficial ownership of a customer and information on the companies register. The registrar has clear powers to deal with such discrepancies. 

• Any change in control of a registered cryptoasset business must now be pre-approved by the FCA (a particularly slow and painful process!), which of course may object and publish a notice of the objection. The FCA and HMRC can now also publish notices of refusals to register applicants. 

• Supervisory authorities can now request suspicious activity reports (SARs) from their members, to assist in meeting their supervisory functions. 

• At long last, account information service providers (or AISPs) will no longer need to comply with the MLRs.

Again, this note is a summary of some changes for information purposes only, not advice. If you need advice on any of the changes, please let me know.