How to ace a compliance review

 The Money Laundering Regulations 2017 aim to prevent money laundering via businesses by ensuring that professional services do what they can to reduce the risk.  

The regulations require that relevant professionals, including tax advisers and accountancy service providers, take a series of steps. 

These include making written risk assessments; implementing systems, policies, controls and procedures; complying with due diligence requirements; providing training for employees; and keeping records. 

The IFA plays an important role in supporting the regulations by supervising members for compliance via regular reviews.  

In this article, we speak to Tim Pinkney, IFA Director of Professional Standards, about what to expect of a review and how to prepare for one. 

What to expect

The first step the IFA takes is contacting the business to say a review will take place.

“We ask for policies and procedures in advance,” says Pinkney.“These are reviewed by our team – either remotely or onsite – then we go through them with the member, discussing them in some detail.”

Following this conversation, the IFA issues an outcome report, which grades the business as ‘compliant’, ‘generally compliant’ or ‘non-compliant’. Pinkney explains these results:

• Compliant: “It’s a big tick – carry on as usual.”
• Generally compliant: “We make some suggestions, and may or may not need to follow up.”
• Non-compliant: “We create an action plan, which the firm must agree to within two weeks. This gives them a number of months to get things right. If they engage and do it, then everything should be fine. If not, we look at disciplinary action.”

The IFA conducts between 200 and 300 reviews per year. Low-risk businesses are reviewed every 10 years, medium-risk every five, and high-risk every three. 

“Risk level is based on the firm’s history and any other intelligence we receive about them. For example, high-risk clients are often those with links to high-risk jurisdictions,” says Pinkney, explaining that those firms with high-risk clients need ongoing support to maintain compliance and minimise risk.

“There’s nothing wrong with being high-risk, as long as you have the right policies and procedures in place.”

How to prepare for a review

“My headline message is this: don’t wait to be selected for a review,” says Pinkney.

“Act now, and then you’ll be ready.”

In other words, a business should not need to prepare upon getting the call. Compliance with the regulations requires following them at all times.

That means having policies and procedures in place – and reviewing them annually to make sure they remain fit for purpose, relevant to your firm and up to date.

“We can spot when a firm has suddenly put something together on the back of a beer mat the week before a review,” says Pinkney.

“You should be able to show a clear trail, demonstrating when your policies and procedures were created, when they reviewed and who looked at them, and when they were updated.

“They should be put together with some thought, and taken seriously across the firm.”

What to do if you’re not prepared

If you’ve not yet been called for a review and are unsure about your level of compliance, then don’t delay. Approach the IFA for help.

“We can provide guidance, support and resources, such as templates,” says Pinkney.

Once your policies and procedures are in place, then the IFA can provide feedback on an ad hoc basis.

If, on the other hand, you’ve been informed a review is scheduled, but you aren’t ready, be honest.

“If you don’t have policies and procedures in place, be upfront,” says Pinkney.

“Explain your situation to the review team, who can then tailor the process for you.

“A review isn’t just about compliance, it’s also about education. You can get a lot out of it – it can even be classed as two hours of CPD.”

In fact, the IFA’s review often attracts positive feedback.

“Members have said that they were very nervous beforehand, the first time they did it – and I can understand that – but, afterwards, that it was a very good experience, and they felt more confident about complying with the regulations.”

Consequences of non-compliance

Last but not least, it’s important to be aware of the consequences of non-compliance.

“Don’t ignore our calls and emails,” says Pinkney.

“If a firm is referred to our disciplinary conduct committees, then this can have far-reaching effects, and the ultimate price can be exclusion.

“We also report to HMRC, which has default supervisors for money laundering, with the power to revoke tax agents’ licences.

“But these steps are the last resort. Don’t bury your head in the sand – if you engage with us, then we’ll engage with you.” 

The Institute of Financial Accountants’ upcoming AML Conference online offers valuable insights from experts about AML regulatory updates and how best practice can protect your business. Find out more and register.