Anti Money Laundering toolkit

Transcription

1 Anti Money Laundering toolkit AAT is a registered charity. No

2 Contents Introduction Policies and procedures within your firm Developing Anti Money Laundering controls in your business Assessing risks within your firm What does risk mean in this context? Identifying threats Identifying vulnerabilities Assessing risk Assessing risks within your firm Introduction The account opening procedures The identity of a customer/client Beneficial owners Nature and purpose of the intended business relationship Know Your Client (KYC) Information Politically exposed persons (PEPs) Prohibited relationships Reliance on third parties Subcontractors Documentary evidence used as verification of identity Electronic verification of identity Customer not present Mitigation of impersonation risk Verification of individuals Verification of sole trader or partnership businesses Verification of private companies, LLPs and limited partnerships Listed or regulated financial and credit institution entities Government bodies Pension schemes Charities, church bodies and places of worship Other trusts, foundations and similar entities Clubs and societies Clients in care homes or in receipt of pension Students and young people Certification and annotation Non-compliance through client refusal Insolvency cases Ongoing monitoring of client relationships AAT is a registered charity. No

3 4. The post SAR regime The key points Continuing work in connection with a reported matter Requests for further information Staff training and record keeping Staff awareness and training general legal obligations Who should be trained? What should training cover? How often should training be given? Record keeping - general legal requirements The records that must be kept Persons who are relied on by another person to apply any customer due diligence measures Businesses which rely on another person to apply customer due diligence measures How long should records be kept? In what format must the records be kept? Penalties for failure to keep records Business and Firms Management Policies and Procedures for reporting suspicious activity (SAR s) Internal reporting Suspicious activity reporting to the National Crime Agency (NCA) The meaning of knowledge, suspicion and reasonable grounds for knowledge or suspicion Internal reporting procedures Making external reports to NCA Types of report Confidentiality protections Non-POCA reporting Guarding the confidentiality of a SAR Tipping off Recognising money laundering Suspicion indicators Tax practitioner s specific guidance Tax practitioners, MLR 2007 and POCA Overview of the tax sector What are the money laundering risks in the tax sector? Tax offences Reluctance to correct past errors Intention to underpay tax Tax evasion Indirect tax Other offences applicable in VAT The privilege reporting exemption Examples of when the privilege reporting exemption might apply Examples of when the privilege reporting exemption is unlikely to apply AAT is a registered charity. No

4 8. Money Laundering and disclosures to HMRC A questions and answers guidance note NCA guidance Introduction What is a SAR? Reason for suspicion When do I submit a SAR? Is the information contained in the SAR I submit held securely? May I inform a client/customer that I have made a report? What is consent in relation to SARs? How do I register with SAR Online? How to report SARs Basic structure of a SAR Completing all SAR information fields Obtaining a defence against money laundering or terrorist financing General guidance Contact details Good practice tips SAR glossary codes (as of September 2016) Checklist of legislation and information Supervision Introduction AAT frequently asked questions about review visits Overview of the supervisory visit Specific failings and breaches of the Money Laundering Regulations MLRO checklist for a compliance visit and sample forms AML - Client account opening form (individuals) AML - Client account opening form (companies) Completion Checklist Highlight areas of risk Completion Checklist Highlight areas of risk Client due diligence risk assessment Staff training record Summary of SARs AAT is a registered charity. No

5 Introduction This toolkit is designed to help AAT Licensed members comply with the Money Laundering Regulations 2007, Proceeds of Crime Act 2002 (as amended) and Terrorism Act 2000 (as amended). The toolkit is not a substitute for the law relating to money laundering. It has been designed to provide a practical reference material for AAT licensed members. The information contained within has been sourced with acknowledgments from relevant industry guidance and best practice including the Joint Money Laundering Steering Group guidance (JMLSG), the CCAB guidance and HMRC MLR guidance. You should refer to this toolkit for practical tips on how to apply relevant sections of the legislation and the money laundering guidance issued by AAT or other relevant professional bodies from time to time. As the law on money laundering and terrorist finance is fast changing, it is important that you keep your knowledge up to date by attending regular training and accessing relevant industry guidance resources. If you have any questions related to this document or to the AAT s money laundering supervision, please us at aatstandards@aat.org.uk or call to speak to someone from the Professional Standards team. Who should use this toolkit? You will find this toolkit useful if you are a licensed member providing accountancy or bookkeeping services. The key UK legislation relating to money laundering is contained in: The Proceeds of Crime Act 2002 (POCA) (as amended) The Terrorism Act 2000 (TA) (as amended) The Serious Organised Crime and Police Act 2005 The Money Laundering Regulations 2007 (the Regulations) Disclaimer Although all reasonable care have been taken to ensure that the content of this toolkit is accurate and reflects the law and industry best practice at the time of writing, members should always consider the individual circumstances of the money laundering risks they or their businesses face. This toolkit does not constitute legal advice and in certain circumstances, it may be necessary for members to seek expert legal advice when assessing the risk of money laundering to their business. Compliance with this toolkit is not a defence to the offences created under the Proceeds of Crime Act 2002 or any other legislation. AAT will accept no liability for loss caused to any person or entity as a result of acting or refraining to act in accordance with any material in this toolkit. The risk assessment and other templates in this toolkit are generic and given only as examples, you should consider the suitability of any templates for your own business before using them. If you decide to use any of the templates, it is important that you adapt such templates to your individual circumstance. This edition This is the December 2016 edition of the toolkit. You are responsible for updating your toolkit with changes to the legislation and/or guidance. AAT will make updates to the legislation, guidance and/or industry practice accessible on our website, aat.org.uk AAT is a registered charity. No

6 Commonly used abbreviations CDD Customer Due Diligence or Client Due Diligence EEA European Economic Area FATF Financial Action Task Force on Money Laundering HMRC Her Majesty s Revenue and Customs HMT Her Majesty s Treasury JMLSG Joint Money Laundering Steering Group MLRO Money Laundering Reporting Officer MLR Money Laundering Regulations 2007 NCA National Crime Agency PEPs Politically Exposed Persons POCA Proceeds of Crime Act 2002 SAR Suspicious Activity Report to NCA TA Terrorism Act 2000 AAT is a registered charity. No

7 1. Policies and procedures within your firm 1.1. Developing Anti Money Laundering controls in your business The Money Laundering Regulations 2007 (MLR 2007) require all bookkeeping and accountancy firms and businesses to establish and maintain appropriate systems of internal control and communication in order to prevent activities related to money laundering and terrorist financing. In simple terms this means that as licensed members, you must ensure that you put policies and procedures in place that will alert your staff and subcontractors in the firm (where relevant) to the possibility that criminals may be attempting to use your services to launder money or fund terrorism. This creates a framework by which they can take appropriate action to prevent or report it, safeguarding you and your firm from committing the offence of money laundering. It also sends out a clear message to existing and prospective clients that you are aware of, and will not tolerate abuse of your business. You must ensure that your policies and procedures are capable of identifying unusual or suspicious transactions or customer activity, and quickly reporting the details to the Money Laundering Reporting Officer (MLRO), who is responsible for making a disclosure to NCA under the terms of the Proceeds of Crime Act 2002 (POCA) or the Terrorism Act 2000 (TA). If you are a sole trader, you will automatically assume this responsibility. The nature and extent of the policies and procedures you need will depend on a variety of factors, including: the nature, scale and complexity of your business the type of products, customers, and activities involved the diversity of operations, including geographical diversity distribution channels the volume and size of transactions. These factors will inform the level of risk your business is exposed to. It is important that you assess and understand the risks of your firm being used for money laundering. The MLR 2007 requires you to adopt a risk based approach to your compliance approach. This means that you should focus your attention towards your highest risk business areas and customers, and not put unnecessary barriers up for those customers and areas which indicate low to no risk of money laundering or terrorist financing. Risk is explained more in part 2 of this toolkit What policies and procedures do you need? You must be able to demonstrate that you have: identified and clarified senior management responsibilities, including who the firm s MLRO is where there is more than one partner, or person working for the business a system of identifying and reporting on money laundering and terrorist financing risks and suspicions (this is relevant to firms with employees specifically) regular training of employees on the legal and regulatory responsibilities for money laundering and terrorist financing controls and measures written Anti Money Laundering/Counter Terrorist Financing AML/CTF risk management policies and procedures measures to ensure that you and your staff are alert to and addressing money laundering and terrorist financing risks in the day to day operation of the business. AAT is a registered charity. No

8 1.3. Ongoing quality control You must carry out regular assessments of the adequacy of your policies and procedures to ensure that they continue to manage the money laundering and terrorist financing risks effectively and are compliant with the MLR You must therefore ensure that appropriate monitoring processes and procedures are established and maintained to regularly review and test the effectiveness of your policies and procedures. This is consistent with the requirements of Practice Assurance Standard 4 on Quality Control. You must test the effectiveness of the checks they make and also the areas and indicators of risk that they have identified. A review should include consideration of the following areas: Are there any areas of weakness in the business where appropriate risk-sensitive checks are not being carried out in accordance with the MLR 2007 requirements and the business s policies and procedures? Are correct records kept in respect of evidence of ID taken and other customer due diligence checks? Are there any new products, services or procedures that require risk assessment, appropriate due diligence checks and internal controls putting in place? You may find the sample Anti Money Laundering policy below useful in designing a compliance management policy for your business. AAT is a registered charity. No

9 1.4. SAMPLE - Anti Money Laundering policy [INSERT FIRM NAME] Anti Money Laundering and Counter Terrorist Financing policy statement This policy sets out [INSERT FIRM NAME] s commitment to understanding and minimising our risks in relation to money laundering and terrorist financing so our services are not abused to legitimize the proceeds of crime. Our commitment to this strengthens our goals of achieving good ethical business and trading standards. Our aim, by having robust policies and procedures and the creation of a compliance culture within the firm, is to prevent money laundering and terrorist financing. In order to achieve this we have undertaken the following: 1. Appointment of the nominated person/money laundering reporting office (MLRO) The firm s MLRO is:. Contact details Internal phone extension Mobile phone number address The MLRO is available to discuss any matters relating to the firms policies and procedures relating to the Money Laundering Regulations and helping you understand your obligations. In the absence or sickness of the MLRO the following deputy/assistant MLRO has been appointed. The firm s deputy/ assistant MLRO is:. Contact details Internal phone extension.. Mobile phone number.. address.. AAT is a registered charity. No

10 2. Establishment of internal procedures appropriate to the Money Laundering Regulations to prevent money laundering and terrorist financing. We have established appropriate and risk-sensitive policies and procedures relating to: i. customer due diligence ii. reporting iii. record-keeping iv. internal control v. risk assessment and management vi. compliance management; and vii. communication. 3. Establishment of internal training requirements so all individuals within the firm understand their responsibilities within the firms policy and procedures and their wider responsibilities under the UK s Anti Money Laundering strategy. To this end we will ensure all individuals within the firm are trained at regular intervals for: awareness of the relevant legislation and any changes understanding of their roles and responsibilities under the Anti Money Laundering regime updates on particular threats and alerts for the firm or the profession how to recognise potential suspicious activity how to report suspicious activity the firm s exposure to risk the firm s client due diligence policies and procedures. 4. Record retention We will retain the following records for five years after ceasing to act for a client: client s risk assessments client s identity and verification client s ongoing monitoring staff training internal reporting external reporting. 5. Reporting suspicions The firm through the MLRO has established procedures for assessing internal suspicious activity reports and on the decision making process for external reporting. We have established procedures for making suspicious activity reports to the National Crime Agency (NCA) and for the secure retention and storage of internal and external reports. 6. Aiding law enforcement The firm through the MLRO has established procedures for aiding any law enforcement agencies who obtain money laundering investigation orders against our clients. These procedures relate to the collation and secure retention of the information required and systems to ensure that confidentiality of the client is maintained were necessary. AAT is a registered charity. No

11 7. Staff and subcontractor commitment to the firms policy and procedures It is important that our staff and subcontractors understand the compliance culture and the roles and responsibilities placed upon them. Penalties imposed including fines and imprisonment can apply to individuals as well as the firm. So we must all: ensure we understand the firms policy and procedures contained in this document, and ask the MLRO if unsure ensure that during the course of our work for the firm we don t turn a blind eye to the obvious. If we have doubts over the legitimacy of a transaction or event then we must follow procedures to discuss the situation or make an internal suspicious activity report. It is only by following these procedures we are protected from the possible penalties contained within the legislation remember not to speculate as to whether a crime has been committed. In order for a report to be made there must be reasonable suspicion that a crime has been committed, the client intended for a crime to be committed and there are proceeds of that crime. An innocent error is not a crime, there has to be an element of intent remember that we are not required to be an investigator that is the role of law enforcement, neither are we judge nor jury remember that tipping off is an offence under the legislation. We must not discuss what we may or may not report with the client and don t make reports the topic of general conversation within the office. AAT is a registered charity. No

12 2. Assessing risks within your firm 2.1. What does risk mean in this context? You will see references throughout the MLR 2007 to on a risk sensitive basis. Risk in this context is the possibility that your firm will be used by criminals to disguise the proceeds of crime and present them as being from a legitimate source. These risks will materialise when an external threat is able to exploit vulnerability within your firm s infrastructure to achieve its intended outcome. Your policies and procedures should safeguard your firm from this happening, but this will only be the case when you have fully reviewed and assessed where these threats might arise from and where your firm may be vulnerable to such exploitation. You must focus resources to higher risks, and avoid placing unnecessary burdens on lower risk clients. This manages compliance costs and burdens to both your business and your clients. Not every business will have the same approach to risk. Smaller businesses are more likely to have a lower appetite for risk because of the limited resources available to manage risk. Larger firms will have access to more resources to address risks, and may therefore take on riskier business. The purpose of the MLR 2007 is to prevent criminals from accessing financial services, but an unintended consequence has been that firms have been de-risking. De-risking means that instead of managing high risk clients, firms refuse to deal with those they class as high risk in the name of AML compliance. This is not a requirement of the regulations Identifying threats The threats your firm faces will depend on many factors, including your clients and how your source them, the services you offer and how they intend to use them, and the geographic spread of your client base. An example of a threat might be a criminal seeking to disguise the criminal origins of their piles of cash by buying a business (let s take for example a chip shop). You may find Table 1 on page 16 helpful in assessing the level of risk posed by your clients. In addition to this overview, you must assess the risk of each of your clients individually Identifying vulnerabilities Vulnerabilities are characteristics of your firm which can be exploited by the threat to launder the proceeds of crime. Let s use as an example a junior member of the team who provides administrative support accepting a new client to your firm. Two vulnerabilities potentially arise from this. Firstly, because they are a junior member of the team, they lack the experience to know how to on-board a new client. The second vulnerability is that because their role is administrative, they have not received AML training, and do not understand the obligations on the firm in respect of AML compliance. You may find Table 3 on page 18 helpful in assessing where your business is most likely to be used by criminals. AAT is a registered charity. No

13 2.4. Assessing risk In order to evaluate the severity of a risk, you need to think about the impact of that risk if it occurs, and the likelihood of it occurring in your firm Measuring impact We recommend that you can use five categories of impact as follows: Limited Minor Moderate Major Catastrophic Each category of impact is accompanied by a score. You will see as the impact increases, the number gets higher. You will need to put criteria in place in order to decide how to measure whether something fits into each of the categories. This will entirely depend on the approach you take to assessing your risks, but here is an example of how that might look, with examples of how the assessment might look at each end of the scale: Value of transaction or service Limited Minor Moderate Major Catastrophic Very limited value, Unlimited funds and not systemic systemically laundered Reputation No impact on reputation Business fails as a result of publicity Reach Isolated to your firm Systemic abuse of the regulated sector (e.g. lawyers, banks, insurers and money service businesses all used). Resources Minimum resources required to address risk Resource requirements far exceed the firm s ability to manage the risk AAT is a registered charity. No

14 Measuring likelihood Your resource will be most efficiently expended on those risks which are likely to materialise more often. Therefore you need to evaluate how often these risks could materialise. This process is measuring the likelihood. You could use the following categories to measure your likelihood: Rare Unlikely Possible Probable Highly probable Measure of <5% 6-20% 21-40% 41-60% >60% occurrence Score There are a number of different factors you can feed into your likelihood assessment which will stem from a combination of factors. The assessment of your clients you have undertaken in Table 1 will help you to identify the percentage of your client base that a particular risk might be triggered by. For example, the threat of a criminal buying a high volume cash business to launder his funds. If 22% of your client base is made up of cash based businesses, then you may conclude that on the face of it, it is possible that your business could be used for money laundering. This would then generate a score of 3 for the purposes of your risk assessment Concluding the overall level of risk The overall risk score is calculated using the following formula: Likelihood x Impact² You need to weight the score towards the impact because this ensures that your resource is targeted at activity which presents the highest risk to your firm. If you do not do this, you will find that a highly probable risk with minor consequences commands exactly the same score (and therefore response) as one which is rare, but with severe consequences. The following table demonstrates how you can use these scores to identify the overall level of risk: 5-HIGHLY PROBABLE PROBABLE POSSIBLE UNLIKELY RARE Limited 2- Minor 3- Moderate 4- Major 5- Catastrophic AAT is a registered charity. No

15 Each score is categorised with a colour. The colour that your risk score comes out at translates into a response to that risk as follows: RED AMBER YELLOW GREEN Risk outcome HIGH Score of above 50 MEDIUM/HIGH Score MEDIUM/LOW Score 5-19 LOW Score 1-4 Response required Take urgent action to manage the risk Take action to manage the risk Monitor this risk Tolerate this risk The client risk assessment Although your firm s risk register will reflect your firm s general risk profile and management policies for mitigation of those risks, you can assess individual clients by comparing their characteristics and transactions with those listed in the risk register. This will promote consistency of treatment of clients throughout your client base. You will need to assess individual clients and record such assessment but this does not have to be very detailed or difficult. The adaptation or mirroring of a single row from the risk register is likely to be adequate for those who pose one of these risks, or a simpler adaptation for those of lower or normal risk. AAT is a registered charity. No

16 Table 1 Date of review: Practice - client business profile Individuals Sole-traders Partnerships Limited companies Other % of client base Number with 64/8 agent authority Number of client relationships less than two years old How are clients introduced into the business? % introduction by: recommendation % introduction by: advertising % introduction by: passing trade % introduction by: other sources Total Additional client profile information Number of remote/non-face to face clients (if any) Number of PEPs as clients (if any) Any clients outside normal profiles? Number of clients with significant cash businesses? AAT is a registered charity. No

17 Table 2 Practice - client services profile Date of review: Number of clients Individuals Sole-traders Partnerships Limited companies Other Bookkeeping services Accounts production Management accounting Payroll services VAT advice and return services WFTC and other benefit applications Company secretarial SA/CT etc. tax return completion CGT, IHT and other taxation planning and/or Other works AAT is a registered charity. No

18 Table 3 Risk: that your client is not who they say they are Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Customer Identification in general regarding ID theft or impersonation New client refusal to provide evidence of identity New client is unable to provide normal evidence of identity New client has not been met face to face before commencement The customer must provide proof of identity when conducting a one off transaction of 15,000 or more or in a series of linked transactions or when establishing a business relationship. Client may refuse to provide any evidence of identity; this may give rise to an opportunity of ID theft or impersonation. Age may be a factor, possibly too young for verification documents or no longer requires them for example, maybe no passport or driving licence or client could be new to an area so not as yet obtaining a utility bill. Lifestyle choices have many people now working away from home, on shift patterns, or on contract in or for medical reasons. Additionally, in the increasingly internet age firms are sourcing new business online. Medium/ High CCAB guidance states that for risk mitigation purposes, customers wishing to use accounting and tax services should prove their identity before a transaction can be completed even when the value of the transaction is lower than the threshold, there is a high expectation of an element of duration with the client. ID and verification procedures must also be made when the customer becomes a regular customer therefore wishes to establish a business relationship. High If the customer cannot produce or fulfil the appropriate identity procedures, the transaction must not be completed. Inform the client of the importance of the CDD process and the requirement of law for this to be undertaken. If continued refusal consider if suspicion indicators merits a note or report to the MLRO. Medium/ High Verification of ID can be by document, data or information. Consider alternative verification documents or method for example, an electronic search, television licence etc. High Obtain medical evidence as extra evidence for verification purposes, such as confirmation from GP or known related person. Obtain evidence of the business interests, arrange to visit the business premises. Try to arrange a future face to face meeting. Carry out firms enhanced CDD management policies. Arrange a meeting via videoconferencing, such as Skype. Medium/ Low Low Medium/ Low Medium/ Low AAT is a registered charity. No

19 Table 4 Risk: your client s source(s) of funds are the proceeds of crime and/or might be used to fund terrorism Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Customer whose business handles large amounts of cash routinely Unusual cash transactions Acting for acquaintances, relatives and friends Client account transactions Clients with complex business ownership and control structures which may conceal underlying beneficiaries Cash based or those businesses have handle large volumes of cash can used to disguise source of funds or to simply evade tax by under declaration of income. Unusually cash transactions or transfers using intermediaries or regular smaller transactions just below a 5,000 limit so as to avoid MLR procedures in regulated firms elsewhere. Possible compromise of objectivity and an unwillingness to enquire or report suspicious activity. Request from client for receipt or payment of monies into the clients account that is not in connection with your services. Nominees may be being used or registered office or service addresses serving no economic purpose. Share classes and structures may disguise true control. High Effective risk-based customer due diligence measures based upon the increased risks in relation to large or frequent cash transactions in line with our general policies on customer due diligence. Understanding of the clients business and the nature of transactions he undertakes, aiding understanding of the source of funds and expected gross margins from the type of business. High Effective risk-based customer due diligence measures based upon the increased risks in relation to large or frequent cash transactions in line with our general policies on customer due diligence. Understanding of the clients business and the nature of transactions he undertakes, aiding understanding of how unusual transactions can arise. Medium/ Low Focus on maintaining objectivity of the firm. Where possible ensure where there may be a possible conflict that works are supervised by an independent member of staff. High Management policy of only accepting funds arising from transactions connected to the firms services. Alert management/ MLRO of any such requests. High Effective risk-based customer due diligence measures based upon the increased risks of complex ownership and control structures with our general policies on customer due diligence. Possible searches of the company registry for information such as latest annual return, appointments or statement of capital and persons with a controlling interest. Ensuring the identity of beneficial owners is verified according to the risk assessed. Medium/ High Medium/ High Low Low Medium/ Low AAT is a registered charity. No

20 Table 4 continued Risk: your client s source(s) of funds are the proceeds of crime and/or might be used to fund terrorism Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Clients who are PEPs Prominent public positions can create a risk of exposure to bribery and corruption. Circumstances such as location, nationality, passport type (diplomatic) or large cash transactions may indicate PEP status. High Carry out enhanced CDD management policies, ensure enhanced ongoing monitoring of where necessary establish the source and/ or destination of funds. Obtain senior management approval before commencement. Medium/High AAT is a registered charity. No

21 Table 5 Risk: you are delivering services beyond your understanding of the client s circumstances Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Customer whose business is based in, or conducts business and cash transactions through, a higher risk jurisdiction of corruption or organised crime Customer whose business is based in, or has nominees or beneficial owners in jurisdictions known as off shore tax havens Clients who are not local to the business Clients whose business model creates situations where the source of funds cannot be easily verified Currency smugglers will look to move products into countries with no exchange control and lax AML legislation. Transactions linked to customers connected with countries that are known to have lax AML controls may lead to bribery or be used to disguise true source. Possible use for off shore tax avoidance schemes or tax evasion. Use of nominees to disguise true beneficial owners Can be advantageous since local knowledge of the client and his business may be minimal. Examples such as second hand cars, house clearance etc. generates cash from hard to verify sources. The buying and selling of goods through the internet or mail order. High Monitor business outlets and/or customer transactions based in geographical areas with a significant risk of money laundering or terrorist financing activity. Enhanced risk assessments will include the OECD report for tax standards and HM Treasury Consolidated List of Financial of Financial Sanctions Targets. Enhanced ongoing monitoring, establish where possible the source of funds High Effective risk-based customer due diligence measures based upon the increased risks of complex ownership and control structures with our general policies on customer due diligence. Possible searches of the company registry for information such as latest annual return, appointments or statement of capital. Ensuring the identity of beneficial owners is verified according to the risk assessed. Enhanced risk assessments will include the OECD report for tax standards. Medium/ High Medium/ High Establish the source of introduction of the client to the business. Understanding of the clients business and the nature of transactions he undertakes, aiding understanding of the source of funds and expected gross margins from the type of business. Medium/ Low High Medium/ Low Medium/ Low AAT is a registered charity. No

22 Table 5 continued Risk: you are delivering services beyond your understanding of the client s circumstances Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Incomplete records Figures do not reconcile and incomplete records not allowing the full picture to be seen. High Ascertain the reason for the missing records. Persuade the client to regularise or improve the quality of record keeping, possibly employ the services of a bookkeeper. Remind the client of his responsibility to keep full records. Medium/ Low AAT is a registered charity. No

23 Table 6 Risk: changes in client behaviour masks criminality Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Complex, unusual patterns of transactions or uncharacteristic transactions A sudden increase in business turnover from an existing client A sudden appearance of significant personal assets for a taxation client Cash introduced into business Unusual transactions not consistent or in keeping the clients known business or personal activities. Large increase in the turnover of a business or income may be used to disguise source. Such as cash balances at a bank, interest or dividends being declared on previously unknown sources outside of the clients normal profile. Cash balances introduced into the business bank or cash account or cash purchases made against insufficient cash balance. May indicate under declaration of cash income or cash from illegitimate sources. High Understanding of the clients business and the nature of transactions he undertakes, aiding understanding of how unusual transactions can arise. Where necessary enquire after the client about the nature or the transaction(s), to gain understanding. Medium/ High Understanding of the clients business and the nature of transactions he undertakes, aiding understanding of how an increase in transactions can arise. Where necessary enquire after the client about the nature or the transaction(s), to gain understanding of the growth of his business and where necessary enquire as to the source of the growth. High Where necessary enquire after the client about the nature and source of the initial investment to establish consistency with the client s circumstances. If explanation is not plausible consider making a suspicious activity report. High Enquire after the client over the source of the cash, establish the plausibility of explanation. Where explanation down to poor or incomplete record keeping persuade the client to regularise or improve the quality of record keeping, possibly employ the services of a bookkeeper. Remind the client of his responsibility to keep full records. If explanation is not plausible consider making a suspicious activity report. Low Low Medium/ Low Medium/ Low AAT is a registered charity. No

24 Table 6 continued Risk: changes in client behaviour masks criminality Risk indicator Characteristics Initial risk Your policies and procedures Resultant risk Payroll - ghost employees Payroll known employees not paid through PAYE scheme Non-payment of tax and NI or creating of employees for bogus expense for deduction from illegitimate income sources. Usually perpetrated by employer, difficult to detect. Possible duplication of recipient bank details. Possible cash in hand which results in nonpayment of tax and NI. Possible secondary employment of employee escaping tax and NI Medium/ High Medium/ High Be aware of possible exploitation. Obtain P45 or signed P46 for all employees Be aware of possible exploitation. Enquire of client of his PAYE scheme and as to his understanding of its operation. Persuade to formalise where necessary. Obtain P45 or signed P46 for all employees Low Low AAT is a registered charity. No

25 3. Assessing risks within your firm 3.1. Introduction The purpose of CDD is to ensure that you know who your client is (including anyone who might hold a controlling interest, but not be obvious as your client), and can trust that they are using your services for legitimate reasons. As you will have read in the risk assessment section, you should take a risk-based approach to focus resources on higher risk areas. You must assess the risks facing your firm as discussed in section 2 before you can gauge the appropriate level of CDD to apply. CDD measures must be carried out: when establishing a business relationship when carrying out an occasional transaction where there is a suspicion of money laundering or terrorist financing where there are doubts concerning the veracity of previous identification information. You must apply CDD measures to all clients, both at the start of an engagement and then on an ongoing basis. When establishing a business relationship, you must: identify and verify the client s identity using documents, data or information from reliable and independent sources identify the beneficial owner of the client (where applicable), including understanding the ownership and control structure of the client and verifying, according to risk, the identity of the beneficial owner(s) obtain information on the purpose and intended nature of the business relationship. Best practice would indicate that verification is completed before a transaction is completed. During a business relationship, you must monitor client activity on an ongoing basis. This includes scrutiny of transactions, identifying the source of funds and other elements of knowledge collected in the course of your engagement, to ensure the new information is consistent with your understanding of the client. It is important that you document consideration of this as evidence of your ongoing monitoring. In our experience, firms are found not to be compliant with their obligations Businesses can use a variety of tools and methods to conduct customer due diligence; the onus is on them to satisfy themselves and to be able to demonstrate to their supervisory body the appropriateness of their approach. AAT is a registered charity. No

26 3.2. The account opening procedures As a regulated firm it is important that you establish set procedures which include an appropriate level of due diligence required for account opening and ongoing monitoring requirements. In simple stepped terms the client account opening and monitoring procedures will encompass: mandatory risk assessment identity and verification identifying beneficial owners nature and purpose of the business relationship know your client (KYC) and Know their business (KTB) letter of engagement ongoing monitoring. Other areas and circumstance that may cause more complex policies to be drawn are: customer not being present timing of verification politically exposed persons prohibited relationships reliance on third parties non-compliance The identity of a customer/client Identity is a core control of financial systems being a legal and regulatory requirement and at the heart of internationally recognised Anti Money Laundering control. Therefore, establishing the identity of those you want to do business with is an apparently simple process but which has to be applied in a complex context. In reality, it means establishing that your customer for business, both personal and non-personal, is that particular person or entity they claim to be. This is different from the Know Your Client checks which are the process of obtaining further information from a particular customer, such as information regarding his business or financial arrangements. The process of establishing someone s identity is a case of how it is done rather than should it be done. This is not unique to the regulated sector but is a part of all aspects of modern society helping to prevent fraud and crime in many different circumstances, from obtaining credit from retailers or mobile phone operators to obtaining proof to protect against underage drinking and gambling. In ever more increasing numbers new clients may come from a non-face to face basis, such as telephone, or internet enquiries. Your client understanding the need to establish identity is crucial, and they should appreciate that it is in their best interests and is not an unnecessary or burdensome imposition. Therefore your identity and verification procedures need to be appropriate and proportionate and as customer friendly as possible. Your firm s procedures and subsequent staff training need to be designed to achieve this outcome. Remember, there may be times when, as a part of on-going monitoring requirements, you may seek to re-verify the client. To achieve this means you need to have effective communication with your client of the reasoning why establishing identity is important and what it normally involves. Many clients are now well versed in the needs for establishing identity. AAT is a registered charity. No

27 With the above in mind, establishing a client s identity needs to be done: competently by applying the firm s set procedures thoughtfully - for example, checking the client does not differ vastly from a photograph in an identity document accurately for example, ensuring addresses and dates of birth are recorded correctly usefully by ensuring photocopies are legible. In developing your risk-based policies to the management of establishing identity, the following considerations apply: the law requires your firm to obtain satisfactory evidence of identity in certain circumstances, but the regulations do not stipulate the detail of what this involves the regulations allow the use of documents, data or information obtained from a reliable and independent source therefore satisfactory evidence is any reliable and independent evidence which is reasonably capable of establishing that the applicant is who he claims to be, not just paper based the law sets a minimum standard which can be used for lower risk or normal risk clients extended scope is required where circumstances indicate a higher risk of money laundering, there is no maximum standard the onus under the law is for the firm to be satisfied as to the identity of the client the firm must be able to demonstrate satisfactory evidence of identity to his supervisory authority and that the extent is appropriate in view of the risk s ascertained Beneficial owners The Money Laundering Regulations set out in some detail the meaning of beneficial owner in terms of bodies corporate, partnerships, trusts and other legal entities/arrangements as well as special provisions regarding estates of deceased persons and a catch all provision that, where not otherwise specified, the beneficial owner is the person who ultimately owns or controls the client on whose behalf a transaction is being conducted. The provisions regarding beneficial ownership are set out in Regulation 6 and are extracted from the CCAB guidance notes summarised below: Bodies corporate beneficial owner means any individual who, in respect of any body other than a company whose securities are listed on a regulated investment market, owns or controls, directly or indirectly including through bearer share holdings, more than 25% of the shares or voting rights in the body or who otherwise exercises control over the management of the body. Partnerships (other than limited liability partnerships established under the Limited Liability Partnerships Act 2000) - beneficial owner means any individual who ultimately is entitled to or controls (directly or indirectly) more than 25% of the capital or profits of the partnership or more than 25% of the voting rights in the partnership or who otherwise exercises control over the management of the partnership. Trusts - beneficial owner means any individual who is entitled to a specified interest in at least 25% of the capital of the trust property, or where a trust is not set up entirely for the benefit of persons with a specified interest, the class of persons in whose main interest the trust is set up or operates or any individual who has control (a trust controller) over the trust. Where a class of persons is identified, it is not a requirement for all members of that class to be identified. AAT is a registered charity. No

28 Other entities and arrangements (meaning an entity or arrangement which administers and distributes funds) where the individuals who benefit from the entity or arrangement have been determined, beneficial owner means any individual who benefits from at least 25% of the property of the entity or arrangements. Where those benefiting have yet to be determined, beneficial owner means the class of persons in whose main interest the entity or arrangement is set up or operates or an individual who exercises control over at least 25% of the property of the entity or arrangement. Where a class of persons is identified, it is not a requirement for all members of that class to be identified. Note that where an individual is the beneficial owner of a body corporate which benefits from, or exercises control over, the property of an entity or arrangement, the individual is to be regarded as having that benefit or control and so is classed as the beneficial owner. Estates of deceased persons the beneficial owner is considered to be the executor or administrator of the estate (full detail is shown in Regulation 6(8)). The focus on identifying and, where appropriate, verifying the identity of beneficial owners is not only an important element of the required customer due diligence information, but is also an important factor in an effective risk-based approach to client acceptance. Businesses will need to be diligent in their enquiries in this field, taking into account that information may sometimes not be readily available from public record sources. This will necessitate a flexible approach to information gathering which will often involve direct enquiry of clients and their other advisers and professional service providers as well as undertaking public record searches in the UK and overseas Nature and purpose of the intended business relationship A firm must understand the purpose and intended nature of the business relationship or transaction. In most instances, for the accountant, this will be self-evident, but in a few cases, the firm may have to obtain information in this regard Know Your Client (KYC) Information In all cases, even where clients qualify for simplified due diligence under the terms of the Money Laundering Regulations, or where they are considered low risk for other reasons, to assist in effective ongoing monitoring, businesses should gather knowledge about the client to allow understanding of: who the client is who owns (including ultimate beneficial owners) who controls it the purpose and intended nature of the business relationship the nature of the client the client s source of funds the client s business and economic purpose. The above points are a part of the know your client information or KYC. Good KYC information may be used where the accumulation of the knowledge may be sufficient to prove the identity of a client without requiring some of the additional documents, data or information under the enhanced due diligence procedures. The length of time the client has been known and depth of knowledge of his circumstances are good elements under KYC helping to reduce risk to one that is normal or lower. AAT is a registered charity. No