In the world of AML compliance, there is a significant difference between doing your work and proving that your work is effective.
Anti-Money Laundering (AML) compliance is no longer a "set it and forget it" task. For firms regulated under the Money Laundering Regulations (MLR 2017), the requirement for an independent AML audit is a critical hurdle. But a common question persists among MLROs and Compliance Officers: How often do we actually need to do this?
1. The Regulatory Starting Point: "When Appropriate"
The law (specifically Regulation 21 of the MLR 2017) states that a relevant person must establish an independent audit function "where appropriate, with regard to the size and nature of its business."
While the legislation doesn’t give a hard calendar date, the consensus among regulators—including the SRA and the Legal Sector Affinity Group (LSAG)—is that for most firms, an audit should be conducted at least every 2 years.
2. Factors That Shorten the Clock (The 12-Month Rule)
For many law firms, waiting two years is too risky. You should consider an annual (12-month) audit cycle if any of the following apply:
- High-Volume Conveyancing: If your firm handles property transactions, you are in a high-risk category. The speed of these transactions means a small systemic error can lead to a massive failure quickly.
- High Staff Turnover: Significant changes in fee-earners can lead to a "culture drift." An AML audit ensures new starters are following procedures correctly.
- Previous Regulatory Issues: If you have previously received a "letter of advice" or "compliance plan" from the SRA, an annual audit is your best evidence of remediation. In reality many firms take the view 'we have had a SRA AML audit so we have taken the hit and are safe for a while now'
3. Trigger-Based AML Audits (The "Change" Rule)
Outside of your regular schedule, certain events should trigger an immediate independent AML audit:
- Technology Shifts: If you have recently implemented new Digital ID (eIDV) software, you need an audit to ensure the tech maps to your Firm-Wide Risk Assessment (FWRA).
- Mergers and Acquisitions: If you have taken over another firm, you have inherited their risk. An independent audit is essential to "level the set."
4. Why "Internal" Isn’t Always "Independent"
A common mistake is thinking that the MLRO checking files counts as an independent audit. To satisfy a regulator (SRA or FCA), the AML auditor must be objective. They cannot be the person who wrote the AML policies or the person who oversees the daily AML checks.
The Bottom Line
- Small, low-risk firms: Every 2 years (minimum).
- Medium-to-large or high-risk firms: Every 12 to 18 months.
- Firms in a growth phase: Annually.
Is your firm due for a check-up? Don't wait for a SRA AML Audit or FCA AML Audit to find out where your gaps are. Professional independent AML audits provide the "Safe Harbour" you need to operate with confidence.
Comments
Post a Comment