ResourcesPractical guidance and standards for financial crime compliance practitioners

The Wolfsberg Group c/o Basel Institute on Governance Steinenring 60 | 4051 Basel, Switzerland

29 September 2023

Via Electronic Submission His Majesty’s Treasury 1 Horse Guards Road Westminster SW1A 2HQ London, United Kingdom

RE: Consultation on Reform of the Anti-Money Laundering and Counter-Terrorism Financial Supervisory Regime

I. Introduction

• The Wolfsberg Group (the Group) welcomes the opportunity to comment on the proposal for reform of the Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) supervisory regime by His Majesty’s Treasury (HMT).¹ The Group has previously set out three key elements of an effective AML/CTF programme in our Statement on Effectiveness² and welcomed HMT’s acknowledgement of our work on Demonstrating Effectiveness in the 2022 Review of the UK’s AML/CTF regulatory and supervisory regime.³ We particularly support the Government’s focus on the effectiveness of the ‘whole system’ in its Economic Crime Plan 2.⁴
• Economic crime poses a significant threat to national security and prosperity.⁵ In the fight against economic crime it is essential that policy makers, Law Enforcement Agencies (LEAs), supervisors and regulated firms act as a single, coordinated system, focusing resources on national priorities, and delivering against defined, measurable outcomes. Vulnerabilities in one sector can undermine the effectiveness of a country’s entire AML/CTF system.
• The Group believes that Model 3, an independent public body Single Professional Services Supervisor (SPSS) overseen by Parliament, would be the best choice to support the ‘whole system’ approach and address inconsistencies and systemic weaknesses. Such an SPSS would deliver a single view of risk; a consistent risk-based approach to supervision; enhanced coordination with government agencies (by acting as a single point for contact); and more effective information sharing on risks, vulnerabilities, and national priorities with the firms it supervises. Models 1 and 2 would not, in our view, deliver the required transformative change, while Model 4 would undermine the Government’s own future regulatory framework for financial services.
• The Call for Evidence on the UK’s AML/CTF regulatory and supervisory regime, from July 2021⁶, found that the large number of Professional Body Supervisors (PBSs) “creates an uneven playing field for business while also increasing the risk that criminals could exploit the UK’s financial system.” The Office of Professional Body Supervision (OPBAS) 2022/23 Report⁷ also found weaknesses with PBSs that need to be addressed.
• Effective supervision through an independent SPSS would help deliver cross-cutting government objectives, including Companies House reform, combatting kleptocracy, and providing opportunities for Financial Institutions (FIs) to reallocate effort to higher-value AML/CTF activity – all key priorities for the UK’s Economic Crime Plan 2023-26.
• No country is rated as “Highly Effective” for Immediate Outcome 3 in the Financial Action Task Force’s (FATF) Mutual Evaluation Report (MER) process. Even in countries where supervision is assessed as being more effective than in the UK, fragmentation among supervisors of the non-financial sector is a clear barrier to being Highly Effective⁸.
• We recognise the transition to a single SPSS will take time to establish and for it to become fully operational. But the Group’s view is that the risks of this transition are outweighed by the benefits of a more effective supervisory regime.
• It is critical for the SPSS to deliver more effective supervision to meet FATF Recommendations and Immediate Outcomes fully while not increasing regulatory burden. While the SPSS can deliver coordination and consistency in the fight against economic crime, PBSs and regulated firms should still play a critical role as subject matter experts by providing insight to the SPSS and by producing industry guidance on practical application of AML/CTF rules.⁹

We also recommend that consideration is given to transitioning higher risk sectors currently supervised by His Majesty’s Revenue and Customs (HMRC) to the Financial Conduct Authority (FCA). For example, the UK’s National Risk Assessment (NRA¹⁰) identified payment and electronic money services as posing a medium risk of money laundering and terrorist financing “owing to the continued diversification of products and platforms available, providing criminals with more options to control and move funds, often across border”. To ensure a level playing field, it is critical that the supervisory regime is consistent across sectors providing the same or equivalent services.

Recommendations:

• The Group recommends that the UK adopts Model 3 – a single public SPSS.
• We also recommend that consideration is given to transitioning sectors identified as higher risk in the UK’s National Risk Assessment from HM Revenue and Customs to the Financial Conduct Authority.

II. The Benefits of Model 3

II(a). Information Sharing, Public-Private Partnerships and National Threat Priorities

• The Group believes that a key element of an effective AML/CTF regime is that it provides highly useful information to relevant government agencies in defined priority areas. We therefore commend the Economic Crime Plan’s focus on information sharing between supervisors, the firms they supervise, and LEAs. As recognised in the Call for Evidence, and being delivered through the Economic Crime Plan, “a core principle of an effective AML/CTF framework is that the totality of activity generated by compliance will be focussed towards the most significant threats to the UK system whilst reducing administrative burdens as far as possible.”¹¹ Actionable national threat priorities developed through Public-Private Partnerships (PPPs), an understanding of how those threats translate to risk and controls within each sector, and a supervisory regime that provides firms with the confidence to reallocate resources to higher-value activity, are all critical enablers of an effective AML/CTF system.
• However, OPBAS’ 2022/23 Report identified weaknesses that need to be addressed through a ‘cultural shift’. For example, “less effective PBSs could not evidence the outcomes from attending these groups, such as consistent information sharing with other PBSs, law enforcement and other AML supervisors. […] PBSs’ engagement with intelligence and information sharing platforms such as the FCA’s Shared Intelligence Service (SIS) and the Financial Crime Information Network (FIN-NET) also varied. Some PBSs did not conduct any searches on SIS for extended periods and failed to upload any live investigations”. OPBAS also highlighted that a PBS took enforcement action against a dual-regulated individual but did not share that information with the other supervisor.¹²
• We recognise the importance of OPBAS’ proactive multi-PBS supervisory activity in high-risk areas such as Trust and Company Service Providers (TCSPs). However, ambitious change is required to deliver effective information sharing between the supervisor, the supervised, and LEAs.
• A single public SPSS would be best placed to ensure system coordination and help deliver a ‘whole system’ approach to national threat priorities:
  • PPPs: This includes information and intelligence sharing between the supervisor, LEAs, and regulated firms, potentially through participation in intelligence sharing groups. The SPSS could facilitate the transition of PPPs from a current focus on the financial sector to the ‘whole system’ through intelligence-led collaboration identifying emerging risks and threat priorities.
  • Communication of national threat priorities: National threat priorities require sufficient actionable information to enable firms to assess their exposure and develop reasonable risk mitigating measures proportionate to their size, business model, and the geographic scope of their business. The SPSS will be well placed to ensure that national threat priorities are collectively understood and applied by the firms it supervises.

II(b). Risk-Based and Effective Outcome-Based Supervision

• Risk Assessment: FATF’s Guidance on Risk-Based Supervision, from March 2021 stated that “A risk-based approach involves tailoring the supervisory response to fit the assessed risks. This approach allows supervisors to allocate finite resources to effectively mitigate the ML/TF risks they have identified and that are aligned with national priorities”.¹³ A critical enabler of risk-based supervision is a consistent, data-led understanding of threats to a sector and how those threats translate into risks to regulated firms.

  • However, the UK’s MER, from 2018, identified “significant weaknesses in supervision by the 22 legal and accountancy sector supervisors through… ensuring consistency in ML/TF risk understanding”.¹⁴ OPBAS’ 2022/23 Report concluded that PBSs have “still not implemented a fully effective risk-based approach that prioritises their AML supervisory and enforcement work”¹⁵ e.g. by assessing TCSPs within the legal and accountancy sectors as relatively low risk, contrary to the UK’s NRA.

• The Group welcomes the secondary objective of the UK’s AML/CTF system, i.e. that the “regulated sector work in partnership with supervisors and the government to improve collective understanding of the ML/TF threat, which in turn ensures compliance activity is focussed on the highest risks”¹⁶. We believe that a single SPSS would most effectively deliver this objective, collaborating with government agencies while also recognising that firms manage different risks. The Group commends OPBAS’ work to inform government understanding of the risks posed by TCSPs, recognising that the NRA needs to consider the different risks across the sector, as opposed to treating the sector homogenously.¹⁷

• An Outcomes Framework: The Group believes that key elements of an effective AML/CTF framework are that a firm complies with AML/CTF laws and regulations, provides highly useful information to relevant government agencies in defined priority areas and establishes a reasonable and risk-based set of controls to mitigate the risks of being used to facilitate illegal activity¹⁸. The SPSS should be tasked with measuring the effectiveness of firms’ risk-based controls against stated AML/CTF objectives by:

  • Regularly collecting and analysing statistics and providing feedback on the impact of their supervisory actions on compliance with legal obligations;
  • Reviewing the correlation of effort with national priorities and the provision of highly useful information to LEAs (e.g. through feedback from LEAs, analysis of Suspicious Activity Reports (SARs);
  • Assessing participation in high value voluntary activities such as PPPs).

  The SPSS will be well placed to provide data for the government’s proposed Outcomes Framework, demonstrate the impact of their supervision on AML/CFT compliance and, ultimately, on the objective of reducing money laundering, cutting fraud, and combatting kleptocracy.

• Data-Led Supervision: OPBAS’ 2022/23 Report highlighted that “many [firms] lacked adequate processes to monitor their medium to low-risk population”.¹⁹ With the benefit of a single, data-led view of risk, the SPSS should collect and analyse statistics on the numbers and trends of findings to target and adjust its supervisory activities and outreach. It is also critical that the low-risk population of firms is subject to sample checking to validate the understanding of risk. The single SPSS would deliver consistency and predictability to this process, to the benefit of the firms it oversees and to the UK’s overall effectiveness in its AML/CTF efforts.

• A focus on capacity and capability building: The SPSS would require expertise in the sectors they oversee. There is a critical role in reciprocal skill-sharing between public and private sector, enabled through collaboration with PBSs. Additionally, consideration should be given to the SPSS ringfencing fines for building capacity and capability.

• Sufficient flexibility of the supervisory regime to respond to emerging threats. We believe that the financial system and broader society would be best protected by giving the responsibility to prevent and disrupt criminality to sectors whose products and services are abused by criminals. This could be achieved by extending the supervisory perimeter in response to heightened risk identified by the NRA. The SPSS should therefore become the supervisory body to oversee these new sectors. For example, as highlighted in the UK’s Fraud Strategy, from May 2023: “Most frauds are now perpetrated – or facilitated in part – online, with online platforms”.²⁰ Activity-based sanctions are also rapidly evolving – for example the requirement for social media companies and internet service providers to take reasonable steps to prevent their users from encountering or accessing services or content online directly generated, shared, or uploaded by designated persons.²¹

II(c). Dissuasive Sanctions

• The FATF Methodology recognises the need for countries to have effective, proportionate, and dissuasive sanctions for failure to comply with AML/CTF requirements. The French supervisory system was found to be “Moderately Effective” in its 2022 MER, with the observation that self-regulatory bodies “do not apply any financial sanctions, but seem to prefer disciplinary sanctions for the most serious breaches, as well as a “didactic” approach in monitoring the implementation of corrective measures.”²² A similar observation was made in Belgium’s MER in 2015.²³
• HMT’s response to the Call for Evidence notes “inconsistency in the application of enforcement powers across different sectors… Supervisors have demonstrated differing views on the appropriateness of stringent enforcement decisions”.²⁴ There needs to be greater consistency in enforcement and the SPSS would be best placed to:
  • Implement a single approach to enforcement, creating a level-playing field by standardising rules and practices for conducting inspections, and eliminating different views on the balance between enforcement and a combination of education and guidance.
  • Be granted specific AML/CFT supervision powers through an update to the Money Laundering Regulations 2017 (MLRs), with powers to make public statements censuring any person that has failed to comply with AML/CFT requirements and to progress a criminal prosecution for breaches of the MLRs; thus taking stronger action than simply expelling firms from membership or removing professional accreditation.
  • Police the regulatory perimeter effectively - the proposed use of TCSPs to verify the identity of beneficial owners under the Economic Crime and Corporate Transparency Bill highlights the importance of maintaining a register of regulated firms and identifying unregulated firms that are providing regulated services.
• Supervisors must be independent of the firms they oversee: We stress the need for a clear separation between a supervisor’s advocacy and supervisory functions. Although OPBAS’ 2022/23 Report found that “AML supervision staff acted independently and did not carry out advocacy work” and that “PBSs also had independent escalation arrangements in place, which were separate from the advocacy function”, OPBAS also found that “some did not clearly demonstrate how they apply these policies and procedures in practice”.²⁵ The establishment of a single SPSS would resolve this issue, which is critical to ensure firms are subject to independent oversight and enforcement.

II(d). Supporting Cross-Cutting Government Policies

The Group believes that Model 3 is best placed to support wider government economic crime policies:

• System Prioritisation: Effective supervision through an independent SPSS could unlock significant opportunities for FIs to reallocate effort to higher-value AML/CTF activity. FIs should be able to take comfort from a robust supervisory regime within which their customers operate. A supervisory expectation, or perceived expectation, that FIs must assess and monitor the controls and reputation of customers that are themselves subject to AML/CTF supervision (over and above correspondent banking requirements under FATF Recommendation 13) results in FIs becoming de facto supervisors. In this role, FIs must spend considerable resource monitoring customers that are themselves subject to AML/CTF requirements and may even be supervised by the same authority as the FI. It may also result in the customer losing access to financial services following an FI’s assessment of its ability to manage money laundering and terrorist financing risk. Recognised challenges such as access to Pooled Client Accounts (PCAs) can be addressed by enhancing the effectiveness of the supervisory regime and explicitly permitting FIs to rely on that regime when assessing customer risk and conducting due diligence.
• The Economic Crime Plan recognises the need to identify and disrupt “the small fraction of bad actors in the Trust and Company and Service Providers, real estate, legal and accountancy and other sectors who are knowingly complicit in assisting these elites to move their finances, undertake high end money laundering, and evade sanctions”.²⁶ We believe that an independent SPSS would prevent professional enablers and the facilitation of kleptocracy more effectively; for example, by conducting criminal background checks to ensure that criminals and their associates are prevented from owning or controlling firms, and exercising wider powers to police the regulatory perimeter and move to prosecute those who provide regulated services without authorisation.
• Corporate Transparency: We believe that the SPSS would be best placed to support effective Companies House reform thereby delivering on FATF’s objective of adequate, accurate and up-to-date beneficial ownership (BO) information:
  • Third Party Verifiers: The SPSS would play an important role by collaborating with Companies House to conduct risk-based assurance on verifiers, by applying a robust registration process and effective risk-based supervision, and by ensuring that compliance failures are flagged on the register and with firms that use the register. SPSS supervision of TCSPs should clearly focus on effective outcomes rather than an exercise in technical compliance; creating an environment where the gathering and reporting of the information, as well the processes around ensuring its accuracy and adequacy, are all aligned with the objective of reducing economic crime.
• Data Analysis: The SPSS would be well positioned to work in partnership with Companies House to conduct proactive data analysis to identify known and emerging typologies and take appropriate action. It is through analysis of accurate, adequate, and up-to-date company data (not just data on BOs) that LEAs and registrars can identify known threat typologies on how company structures are abused. These typologies can be communicated to TCSPs through secure channels and enhanced through effective PPPs. Remedial action must be taken when systemic control failings are identified in a TCSP, supported by a registrar having querying and corrective powers (including deleting companies from the register).

II(e). Sanctions

• The Group commends OPBAS’ contribution to the effective implementation and enforcement of sanctions in the UK, as highlighted in OBPAS’ 2022/23 Report.²⁷ However, more needs to be done to deliver a truly effective sanctions regime that minimises unintended consequences. The SPSS could:
  • Facilitate effective information sharing between supervisors on suspected breaches.²⁸
  • Facilitate the Office of Financial Sanctions Implementation’s (OFSI) engagement with the private sector with the objective of identifying opportunities to enhance the effectiveness of sanctions and minimise unintended consequences on legitimate business and UK competitiveness. PBSs would continue to play an important role in assisting the SPSS to form a detailed view of the effectiveness and unintended consequences of proposed and current sanctions.
  • Address the increasing complexity of activity-based restrictions by streamlining collaboration between supervisory authorities, subject matter experts, and government agencies such as the Ministry of Justice, the Foreign, Commonwealth & Government Office, and the Department for Business and Trade, to provide standardised, timely and comprehensive guidance supported by case studies, similar to guidance issued by the US Office of Foreign Assets Control. OFSI’s industry guidance on the Oil Price Cap is an example of public-private collaboration between subject matter experts resulting in high quality guidance.²⁹ PBSs could also play an important role in continuing to drive improvements in sanctions systems and controls through collaboration with an SPSS to produce sector-specific guidance.
  • Encourage and facilitate operational-level public-private sector collaboration in the UK more effectively. Although more limited than the financial sector, collaboration facilitated by the SPSS could play a role in the timely identification and freezing of assets through sharing actionable intelligence. Where appropriate, pre-designation public-private information sharing should be considered. Proactive public-private information sharing can help governments understand the impact of proposed designations and thereby reduce unintended consequences on legitimate business activity.

III. Disadvantages of Model 4

• The Group believes that a single SPSS is the best choice to drive consistency, collaboration, and to support the ‘whole system’ approach. The Group strongly opposes Model 4 for the following reasons:
  • It would create unnecessary disruption and turbulence in the supervisory system because, in this scenario, FIs would be supervised by multiple supervisors with competing and potentially inconsistent demands. For example, while it is important that FIs meet the requirements of the Consumer Duty by putting retail customers’ needs first and delivering good outcomes for them, firms must balance Consumer Duty with managing the threat of economic crime; a single supervisor can cover both obligations and thereby minimise or avoid unintended consequences.
  • It would risk compromising HMT’s key objective of achieving supervisory effectiveness by attempting to supervise a much larger population of firms, all at varying levels of AML/CTF maturity.
  • The transition risk would be significantly higher than for Option 3, given the need for a single supervisor to build capacity and capability to oversee sectors with wide-ranging risk exposure effectively. Further, the additional complexity and cost would risk damaging UK competitiveness.

IV. Conclusion

• The Group recommends that the UK adopts Model 3 – a Single Professional Services Supervisor.
• We also recommend that consideration is given to transitioning sectors identified as higher risk in the UK’s National Risk Assessment from HMRC to the FCA to promote greater consistency and effectiveness.
• We welcome dialogue with HMT on driving improvements in the effectiveness of the UK’s sanctions regime.
• If we can be of further assistance, please contact the Wolfsberg Group Secretariat at info@wolfsberg-principles.com.

Yours sincerely,

Alan Ketley Executive Secretary The Wolfsberg Group