Are you ready for 4MLD on Monday?

Is your firm prepared for 4MLD?

If not, you only have this weekend to get sorted and while we have had draft versions and a consultation JMLSG guidance in circulation for some time now, the new Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017) are were finally laid before Parliament yesterday, and will come into force on Monday, meeting the 4MLD implementation deadline of 26 June.

There was some doubt as to whether the UK would meet the deadline because of the recent general election, in which case the 2007 regulations would have applied in the interim. However, with the MLRs 2017 becoming law on Monday, today was the last working day under the old regime.

There were some changes to the MLRs 2017 from the draft version. Nothing major; however there are relevant changes you should be aware of. I have therefore included a comparative table at the end of this article. It is worth noting that the numbering of the regulations is slightly different from the draft, so I have gone with the numbers in the finalised Regulations.

Monday morning will be a double whammy for firms in terms of new regulations, with the new EU Wire Transfer Regulations taking effect. Some firms, particularly cash based remitters are being hit especially hard, requiring ID on all transactions going forward. It is certainly a challenging time ahead and so, to help you cope with that Monday morning feeling, here is a reminder of what this means for your firm.

Simplified due diligence (SDD)

SDD thresholds for e-money is no longer based on just an annual limit, but impose initial load and ongoing usage limits. Products that allow cash withdrawals now attract a €100 monthly threshold. UK only cards have a €500 limit, while international cards are capped at €250.

E-money firms whose wallets allow top ups higher than this will need to conduct CDD on their clients.

For those of you that are particularly up to speed in you AML laws, you will know that the upcoming “5MLD” is considering reducing these further, but more on that as it happens.

Purporting to act on behalf of

Where someone acts on behalf of the customer, for example directors on behalf of a company, you will need to confirm that they are directors, or that they otherwise have authority to bind the customer. You will then need to verify the signatory to the contract.

Politically exposed persons (PEPs)

Domestic PEPs are now within scope of the regulations, which caused a bit of a stir among UK politicians when 4MLD was published.

However, FCA guidance on the matter was issued, allowing firms to assess PEPs as “low risk PEPs” in certain circumstances relating to jurisdiction risk and whether they had held an office with executive decision making power (e.g. an MP without ministerial office). If this is the case, less extensive measures can be taken to establish the source of wealth and source of funds.

Firms are reminded here that getting the ID of a PEP is not the intention of the law, the intent is to take measures to detect or prevent bribery, so ongoing monitoring as a high risk customer with specific bribery based monitoring rules is advised.

Risk assessments

Extra guidance was given on risk assessment, which must not be unduly influenced by one factor. JMLSG guidance states that firms must appropriately weight various factors including:

• customer risk;
• geographical risk;
• product risk;
• transactional risk; and
• delivery channel risk.

One factor cannot trump all other considerations, meaning you cannot classify a client as high risk solely because he or she comes from a high-risk country or is in a “high risk industry” (A phrase which completely misunderstands the concept of risk if you ask me but, I digress).

Also of vital importance to firms, profit considerations are not to influence the risk rating one iota. If a company is outside of your risk criteria, the fact that there is profit to be made is not something that can override your assessment.

It goes without saying, of course, that these assessments need to be written and documented. There is extensive guidance in the Regulations now about the factors you should consider as a minimum, and so firms should check that their risk assessments include all of these factors.

As a general suggestion: to firms using Transparency International as their sole source for geographic risk, don’t! Transparency International do great work, but corruption isn’t everything.

Group companies

The new regulations extend well beyond British shores, with firms required to draw up group wide AML/CTF strategies covering subsidiaries or branches of UK entities based abroad.

Firms with a presence abroad will need to start writing policies and procedures covering the entire group.

On this note, firms should consider the viability of controls they have in each country. Requirements such as checking the client’s source of funds and that they are from an account in their own name may not be feasible in some countries, and so firms will need to be careful about making sweeping changes without considering impacts.

Need help?

If you haven’t already, you must review your current policies and procedures against the new requirements to check if you are compliance.

This will include a review against the relevant guidance for your firm, as while the above are the changes to the legislation, other changes such as the specific types of document you need (such as whether you can accept electronic copies of utility bills) are only finally hammered out in the regulatory guidance.

This can be a daunting task so feel free to give me or one of my colleagues a call for help. We can help with anything from advice on any aspect of the Regulations, to conducting a gap analysis on your current procedures, to writing the policies and procedures your firm needs to comply.

This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.