Are outsourcing and automation the way to streamline AML?

Anti-Money Laundering can place a burden on practices – but here’s what you need to understand if you are looking to streamline.

Outsourcing or automating AML processes is becoming increasingly popular, as practices look for ways to streamline their operations.

Technology can help them to avoid possible sanctions while using external specialists can be attractive to overcome a lack of anti-money laundering (AML) and tech skills within the business.

 Yet outsourcing is not as straightforward as it might first appear. Accountants need to spend time and money ensuring the third-party providers they are considering actually have robust processes in place.

The buck stops with the practice

After all, liability ultimately remains with the business or accountancy firm when it comes to demonstrating that any customer due diligence conducted by a third party meets strict UK regulations.

There are also concerns that some providers might be putting prospective clients’ information at risk. Plus, it’s important to ask if they are actually conducting the adequate due diligence expected when instructed to do so by an accountancy client.

Don’t forget, too, that some third-party providers will have ceased trading during the pandemic but might still be holding sensitive information. Accountants need to retrieve this as soon as possible or demand reassurance that it remains secure.

“Some accountants see these providers as one-stop shops, but ultimately ongoing due diligence can only be done by the accountancy firm,” says AAT’s professional standards policy development manager, Jackson Quaker.

He says many software companies have spotted a market opportunity in recent years and are targeting accountants who might be considering contracting out what can appear a complex area of their business.

“This is fine, but accountants need to remember that their obligations do not stop because they have outsourced part of their AML process,” says Quaker. “They must do their research and ensure any third-party provider is reliable. Is their software robust? Where are the potential risks?”

Evolving rules

AML regulations are constantly evolving, and there is a strong view that accountants should be investing more in upskilling their own people to meet the requirements. “It’s important to look not only at your in-house AML processes but also your team,” says Quaker. “Are you hiring people with the relevant understanding of the regulations and what’s required?”

This is important because the in-house team needs to be able to verify or understand the information being provided by a third party. Results tend to be based on points scored where personal data is matched in various databases. If only some data matches, then the result will be referred for further analysis. If a negative data source is matched or a document is invalid, then the result will be a failure.

One example of the constantly-changing AML rules occurred last year when the Fifth Money Laundering Directive came into force. The amendments made to the Fourth Directive are designed largely to stop the funding of terrorism. The changes request direct access to information around virtual currencies and prepaid cards. There are also improvements to digital safeguards relating to financial transactions to and from high-risk countries in case that money is funding terrorism.

Another new AML requirement is that accountants must report any inconsistencies between information discovered during the onboarding process and details held on a client at Companies House. Of course, it is not just onboarding where AML can be a concern. A client might start to act in a way that raises suspicion, so it is important firms can spot the signs.

A couple of years ago, the Serious Fraud Office launched its Flag it Up campaign to raise awareness of money laundering among accountants.

It says due diligence must be about accountants taking a step back from simply ticking a number of boxes and asking themselves some important questions such as:

• Is a long-term client making requests that are out of character?
• Is a client repeatedly asking for services outside your or your firm’s area of expertise?
• Has a client requested arrangements that do not make commercial sense?

If there are gaps in an accountant’s own due diligence when understanding this area, a practice could be putting itself in a potentially difficult situation and risking professional or monetary sanctions.

AML checks

Remote working during pandemic has showcased the advantages of digital AML checks and even automation. “Such solutions offer a more robust quality of check over traditional manual methods and can be completed quicker and more cheaply,” claims Tim Barnett, chief commercial officer at identity verification experts, Credas.

He says digital AML checks have become more important with people working differently. The checks used to establish and confirm the end client’s identity and personal details tend to be:

• ID verification
  “Typically, to verify an end client’s identity, accountants would need to see a passport or similar form of a Government-issued ID and would take a photocopy,” says Barnett. “However, an untrained member of staff looking at a passport and assessing whether the document is authentic or not, and then comparing the image on the passport to the face of the person in front of them, is literally the least robust method to complete this process.”

He claims that on the Home Office scale of document validation, this method ranks at the lowest (level 1), only marginally above performing absolutely no check whatsoever.

“Photocopying personal documents such as passports and then storing the hard copy for years presents a significant data security risk. The inconvenience for the end client to have to come and complete this in person at a branch or office is also often a barrier to a transaction being completed or the customer onboarded.”

• Address/DOB/mortality
  It can be inconvenient for people to provide documentary proof of address, such as copies of bank statements, utility bills or mortgage statements.
  
  

“Nowadays any 12-year-old with a tablet could create a convincing forged utility bill in about five minutes,” says Barnett. Digital AML systems will usually complete these searches electronically (and instantly) by checking against the electoral roll, banking system data or other data sources.

“Going direct to the source of data is clearly a lot more secure. It removes the opportunity for the end client to provide fraudulent documents, reduces the data security risk of people providing personal data via email or hard copy and can be completed instantly.”

Additional checks such as confirming the end client is not impersonating a deceased person (by interrogating the HALO database) are often included in digital AML packages and further increase the robustness of the checks being completed.

“Politically exposed persons checks, international sanctions lists, credit headers, title deeds, bank account checks, and adverse media checks can all be run on an individual instantly when an accountant deems that additional due diligence is required. These all provide near-instant results, are low cost and improve the quality of your compliance process.”

Latest guidance for accountants

The reputation of the accountancy sector means the industry must take money laundering extremely seriously indeed.

Last autumn, the umbrella group of chartered professional accountancy bodies, CCAB, provided updated guidance (available at bit.ly/3zuON0g) and this is currently awaiting approval from the Treasury.

This advice represents the first major change since 2018 and largely reflects a number of amendments to the UK Money Laundering and Terrorist Financing Regulations 2017. These regulations were amended in January 2020 to reflect the Fifth Money Laundering Directive from the EU.

Ultimately, accountants need to appoint a relevant person to take responsibility for creating, reviewing and updating policies to manage money laundering risks. This means communicating with the rest of the business, screening staff, establishing money laundering audit functions and ensuring employees are trained adequately. All of this should be recorded in writing.

Who are the third parties offering AML compliance services?

Shufti Pro
Founder Shahid Hanif set up Shufti Pro after a bad experience he had with identity verification service providers while working in the financial sector. Shufti Pro was one of the first companies to offer free trials to clients, including accountants. The identity of individuals is screened against several global watchlists.

AMLCC

More than 12,000 accountants, bookkeepers and tax advisers use this online platform to manage AML risk and document their actions. The company offers help with risk assessments, AML policy, biometric client verification as well as helping accountants with AML training.

IRIS AML

IRIS’s cloud-based solution allows accountants to get alerts and reminders about ongoing work. They receive suspicious activity reports, “know your customer” assessments, ID checks, and risk profiles and assessments. The company’s various software is used by more than 21,000 UK accountancy firms.

Encompass

The company simultaneously verifies customer-supplied information, discovers ultimate beneficial owners, screens for sanctions and politically exposed persons and conducts adverse media checks using advanced AML automation. Encompass is a finalist in the RegTech Partner of the Year category at the 2021 British Bank Awards.

Calum Fuller Calum Fuller is editor of AT and 20 magazines. He's previously served as editor of Credit Strategy, assistant editor Accountancy and began his career at Accountancy Age..