The FCA claims another AML scalp

The Financial Conduct Authority has imposed another financial crime-related Final Notice; this time against ADM Investor Services International Ltd (ADM). The regulator imposed a £6,470,600 penalty for historical AML systems and controls failings.

There are numerous takeaways from the Notice, but the following are a couple of standouts:

1. The FCA found that ADM lacked a firm-wide AML risk assessment, which breached Principle 3 of the FCA's Principles for Businesses. It was also a breach of the then-current Money Laundering Regulations 2007. 

A firm's overarching AML assessment is the touchstone for all its relevant policies, controls, and procedures (PCPs). It provides the framework within which the PCPs operate, informing measures taken to mitigate the risk of financial crime from without or within the business. Without having conducted an assessment, the regulator will naturally doubt whether any of a firm's PCPs can possibly be effective. How can they meet risks that haven't even been assessed (or even identified)? It's a very simple but potentially very awkward question.

And it gives rise to another one: are you confident that your firm's risk assessments and PCPs stand scrutiny? If you haven't already, now would be a good time to take stock and assess any potential gaps in your armour.

2. ADM's Final Notice followed two supervisory visits by the FCA in 2014 and 2016. Despite highlighting a series of significant problems with the firm's AML framework in 2014 (including a lack of formal processes for client AML assessments), and subsequent attestations from the firm that it had addressed the FCA's concerns, the 2016 follow-up was pretty damning. Not only had the firm not conducted a firm-wide risk assessment, its policies were outdated, its new client AML risk assessments were "inadequate in design and implementation", and there was little evidence of adequate ongoing monitoring.

In response, the FCA required the firm to revise its client risk assessment in very short order (imposing a one-month turnaround). It also requested the firm to enter into a Voluntary Requirement (VREQ), limiting activities that exposed it to higher AML and financial crime risks. Specifically, the firm was unable to enter into new business with new or existing clients who were resident/domiciled/incorporated in one of the 97 jurisdictions ADM had identified as high-risk (subject to some limited carve-outs), Politically Exposed Persons (PEPs), or clients otherwise assessed as high-risk in accordance with ADM's revised client risk assessment.

The Final Notice is therefore also a timely reminder that ineffective responses to supervisory warnings are fraught with danger. Not only might you find yourself on the wrong side of an enforcement action, you may also have your ability to write business seriously curtailed, with all the commercial and reputational risks that entails. While enforcement grabs many of the headlines, and financial penalties are certainly eye-catching, limiting a firm's regulatory permissions can be a swifter and harder-hitting remedy.

In other words: fail to prepare, prepare to fail.