A law firm can possess every expected AML document and still be unable to demonstrate effective compliance. The problem arises when the documents exist separately, contradict one another or bear little relationship to what fee earners actually do.
The firm wide risk assessment may describe conveyancing as a significant risk. The AML policy may then prescribe enhanced controls. Yet individual files may contain unexplained low risk ratings, limited source of funds enquiries and no evidence of ongoing monitoring. Each document exists, but the evidence chain is broken.
Regulators do not examine AML controls as isolated pieces of paper. They compare what the firm says its risks are with the procedures it adopted, the decisions made by fee earners and the evidence retained on files.
The FWRA should start the chain
The firm wide risk assessment should identify and assess the money laundering and terrorist financing risks arising from the practice’s clients, jurisdictions, services, transactions and delivery channels. It should also address proliferation financing risk.
As our earlier article explained, the firm wide risk assessment is the foundational AML document. That description is justified only if the rest of the framework genuinely flows from it.
If the FWRA identifies risks associated with high value property transactions, overseas funds, non face to face instructions or complex corporate ownership, those findings should lead to identifiable controls. A regulator should be able to follow the route from the risk identified to the procedure selected to manage it.
The assessment must also remain current. Changes in the firm’s work, client base, technology, offices or delivery methods may alter its exposure. The practical triggers are considered in Firmwide Risk Assessment: Time for a Refresh?
Policies must respond to the risks identified
An AML policy should translate the FWRA into instructions that staff can follow. If the policy is generic, it may describe a technically plausible process without addressing the risks that distinguish the practice.
The connection must work in both directions. The policy should address the risks identified by the FWRA, while the FWRA should reflect the work the firm actually undertakes. Copying a general risk assessment and combining it with an unrelated policy does not create a coherent system.
Senior management should be able to explain why particular controls were adopted, which risks they address and who is responsible for checking that they operate.
The CMRA connects firm level risk with the individual file
The client and matter risk assessment is where the firm’s general analysis meets the facts of a particular instruction. It should not merely repeat a default rating or confirm that identification has been obtained.
A meaningful CMRA considers the client, the transaction, the source and destination of funds, geographic connections, delivery method, ownership structure and any unusual features. It should then record why the matter has been given its risk rating and what further measures are required.
This is the principle behind Think First, Type Second, Tick Never. The form is not the assessment. The assessment is the professional reasoning recorded through the form.
If the FWRA identifies a category as high risk but numerous files in that category are rated low without explanation, the inconsistency may be more damaging than an incomplete box. It suggests that the firm level assessment has not influenced operational decisions.
The file must evidence what happened next
A risk assessment is not complete merely because a rating has been selected. The file should show how the identified risks affected the due diligence undertaken, the evidence requested and the decision to proceed.
Where enhanced due diligence was required, the record should identify the additional steps. Where source of wealth was relevant, it should not be confused with evidence explaining the immediate source of funds. Where an exception was permitted, the authority and reasoning should be retained.
The chain must continue during the matter. New funders, changed instructions, unexpected payments, altered corporate ownership or inconsistent information may require the CMRA to be reviewed. A file opening assessment cannot explain a risk that emerged shortly before exchange or completion.
Management information should expose inconsistency
The MLRO and senior management need more than confirmation that forms have been completed. Useful management information should reveal patterns such as unusually low risk ratings, overdue reviews, unresolved escalations, missing source of funds evidence or teams that repeatedly depart from the firm’s procedures.
That requires an MLRO who is empowered to challenge decisions and a culture in which concerns can be raised without commercial pressure. Our earlier discussion of the MLRO as a cultural architect explains why governance cannot be separated from the technical documentation.
If management information identifies a recurring weakness, the response should also be documented. Training, policy amendments, additional supervision and file remediation should be capable of being traced back to the issue identified.
Independent audit closes the loop
An independent AML audit should test whether the complete evidence chain works. Reviewing the policy in isolation is not enough. The auditor should compare the FWRA with the policies, sample individual matters, examine escalation and oversight records and determine whether earlier weaknesses were corrected.
The purpose is to identify contradictions that internal familiarity may have normalised. A policy may require one process while teams follow another. A risk assessment may identify a serious exposure that management information never measures. A training record may show attendance without demonstrating that staff can apply the procedure.
The distinction between design and operational effectiveness is developed in The Independent AML Audit: Why It Matters. Independent testing provides value when it challenges the framework rather than simply confirming that documents exist.
Can your firm reconstruct the decision?
A useful test is whether someone unfamiliar with the matter could reconstruct the reasoning from the retained evidence. They should be able to see:
- which firm wide risks were relevant;
- which policy requirements followed from those risks;
- how the client and matter were assessed;
- what due diligence and monitoring were undertaken;
- who approved any escalation or exception;
- how management supervised the process; and
- whether independent testing identified and corrected weaknesses.
If those steps cannot be followed, the firm may have AML documents but not a defensible AML evidence chain.
Test the connections, not merely the documents
An independent AML audit should examine whether your FWRA, policies, client matter assessments, file evidence and management oversight operate as one coherent framework.
This article is for general information only and does not constitute legal or regulatory advice. Firms should assess their obligations by reference to their own size, nature, work and risk profile.