ICAEW is urging accountancy firms to pay close attention to their handling of two critical areas of customer due diligence (CDD).

The call comes in the latest edition of the Institute’s annual Anti-Money Laundering (AML) Supervision Report, titled ‘Protecting Against Professional Enabling’. Covering the 2023/24 financial year, the report sets out how ICAEW is meeting its obligations as a supervisory body, in line with money-laundering regulations.

As such, the report states that ICAEW undertook 1,088 proactive monitoring reviews at firms within its supervisory remit throughout FY23/24 – more than a third (35%) of which covered firms in the high and high-medium risk brackets.

More than 80% of those monitored were found to be compliant or “generally compliant” with regulations, but the cases of non-compliance highlighted issues around CDD.

According to the findings, 34.4% of non-compliant firms performed ineffective verification procedures during their CDD activities. Meanwhile, 36.7% of non-compliant firms were ineffective in their ongoing monitoring of CDD issues affecting their businesses – even though all firms are required by law to regularly update their CDD monitoring.

During the review period, ICAEW sanctioned 39 firms in relation to AML non-compliance – and excluded one member for their role in the facilitation of money laundering.

Higher bar

Writing in the report, ICAEW Head of AML Michelle Giddings explains that the methodology that the Institute applied to FY23/24 monitoring reviews was different from that of previous years.

Rather than looking solely at “technical” compliance and the existence of appropriate measures at the firms it supervises, ICAEW instead focused on the effectiveness of those procedures. As a result of that higher bar, the percentage of firms found to be either compliant or generally compliant (80.7%) was down on that recorded for FY22/23 (84.4%).

Giddings notes that, as part of the shift towards monitoring effectiveness, ICAEW’s Professional Standards Department (PSD) broke down CDD into its component phases: identifying the client, assessing risks and verification.

“We have placed more focus on the three stages of CDD,” she writes, “and assessed how well firms perform each stage, including reperforming some elements of CDD with open-source checks and identifying risks and red flags. This has meant that technically compliant CDD may not be concluded as ‘compliant’ if it didn’t effectively identify and mitigate all AML risks within the clients or services provided.”

Enhanced procedures: case studies

Two case studies contained in the report provide examples of how ICAEW’s CDD-related supervisory actions worked during the review period.

In an onsite review of a firm with a medium-low AML score, ICAEW identified one client with operations in a high-risk third country. The firm had classed that client as normal risk, and had not performed on it the full range of enhanced due diligence measures required under the regulations. In addition, ICAEW found two clients for which the firm had failed to document ongoing CDD monitoring.

The firm subsequently reviewed its entire client base to ensure that it had not missed any other high-risk factors. It also informed ICAEW of the enhanced due diligence procedures it had put in place in relation to the higher-risk client, and confirmed that it would apply them to other such clients in future.

In addition, the firm confirmed that it had performed ongoing due diligence on all clients. It also explained that it had updated its procedures to ensure there was evidence that all higher-risk clients were reviewed at least every six months, and standard-risk clients annually. Based on those responses, ICAEW closed the monitoring review.

The second case study concerned a desk-based review of a firm with a high-medium risk score, stemming from a client base with links to higher-risk countries and complex business structures. Open-source checks on a sample of the firm’s clients revealed adverse media, raising the risk of a client being involved in money laundering.

While the firm had rightly concluded that the clients checked were high risk, it had not documented its assessment of those risks. And while it had completed a firm-wide risk assessment, that process had failed to spot or mitigate all the AML risks that ICAEW had identified. As such, ICAEW deemed the firm non-compliant and asked it to submit revised CDD for all the high-risk clients reviewed – plus a revised, firm-wide risk assessment.

Although the firm submitted improved verification procedures that dealt with the risks identified, it still failed to provide a documented risk assessment. Meanwhile, its improved, firm-wide risk assessment still left out some of the risks linked to higher-risk clients.

ICAEW requested further follow-up actions – including an external AML compliance review. That needed to include a quality review of the firm’s updated CDD, specifically in relation to higher-risk clients, plus a review of the latest firm-wide risk assessment.

The firm remains in ongoing monitoring and has been referred to ICAEW’s Conduct Department for further investigation.

Providing assurance

In a foreword to the report, PSD Chief Officer Duncan Wiggetts notes that the department is always looking for continuous improvement – not just in the way it supervises and regulates, but in the levels of compliance achieved by members and firms.

As well as thanking Giddings and her team for their work, Wiggetts acknowledged the efforts of ICAEW’s Practice Assurance Committee (PAC), which reviews reports of firms’ poor compliance and decides on subsequent sanctions.

He writes of the PAC: “It is an important part of ICAEW’s regulatory and supervisory activities that all decisions on how to respond to poor performance are made by an independent committee with a parity of lay members and a lay chair. This structure is in place to provide assurance to the public that non-compliant firms are properly held to account.”

Guidance and support

Alongside publishing the report, the PSD team has published resources and guidance to support firms on maintaining compliance, covering: 

• what ICAEW finds on proactive AML monitoring reviews;

• updating customer due diligence;

• review of policies, controls and procedures;

• firm-wide risk assessments;

• training; and
• reporting discrepancies in the PSC (person with significant control) register.