Acting as a subcontractor

This helpsheet covers subcontracting accountancy services, specifically acting as a subcontractor. In the appendices, there are checklists to help you identify the information needed to clarify your role, responsibilities and liabilities. There is also an outline of considerations to include in an agreement between a firm and a subcontractor.

Members may also wish to refer to the following related helpsheet and regulations:

• ICAEW statement on members engaging in public practice
• Setting up a practice
• Subcontracting accountancy services – Using a subcontractor 

• Acting as a subcontractor
• Appendix 1: Subcontractor checklist
• Appendix 2: Proforma summary about the subcontracting firm
• Appendix 3: Outline contract between firm and subcontractor

Terminology

In this helpsheet reference to ‘subcontractor’ means the party providing their accountancy services to another accountancy firm and ‘the firm’ means the accountancy firm entering into a contract to obtain professional accountancy services from the ‘subcontractor’.

Need for a practising certificate as a self-employed consultant to a practitioner

You are liable to disciplinary action if you do not hold a practising certificate where it is a requirement so to do.

A practising certificate is not required when you are a self-employed consultant or act as a subcontractor (and not held out as a principal) to a public practitioner that takes responsibility for your work (see ICAEW statement on members engaging in public practice).

The following are examples of situations where a practising certificate is likely to be required. Refer to the statement above to see a wider range of examples.

• You provide a specialist service to a firm which then passes that service on to its client
• You agree with the firm to provide a service directly to their clients.

In both these scenarios you are likely to be acting as a principal. In the first case with the firm as your client and in the second with the firm’s client as your client. See ‘When am I held out as a principal?’ in ICAEW statement on members engaging in public practice.

In these cases you will normally be considered as engaging in practice and will need to satisfy all the requirements relating to the Practising certificate regulations, practice assurance regulations, Professional indemnity insurance regulations, compliance with the Money Laundering Regulations and the Anti-money laundering guidance for the accountancy sector and setting up a practice.

Professional indemnity insurance when not engaging in public practice

In circumstances where your subcontracting activity falls outside the scope of engaging in public practice, you should still consider carefully your personal exposure to professional indemnity risks and, if necessary, take appropriate cover. Where you consider your work is covered by the professional indemnity insurance (PII) of the firm you are subcontracting to, then your name and status as a subcontractor must be advised to that firm’s PII insurers. It is recommended that you have this confirmed in writing to you.

A member who provides accountancy services in circumstances where a practising certificate is not needed should inform the recipient of the accountancy services of the absence of their own PII (if this is the case).

Anti-money laundering

In broad terms, there are three different categories that a member may fall into for AML supervision when subcontracting.

1. Acting for clients directly:
If acting for clients directly you will need to comply with all the requirements of the anti–money laundering (AML) regulations including completing customer due diligence on those ultimate clients.

You will also be responsible for reporting any suspicions that may arise during the course of relevant business directly to your firm’s MLRO or to the NCA.
As discussed in section 5.4 of the CCAB guidance, you may be able to place reliance on the customer due diligence work carried out by the accountancy firm on the clients, but this will be dependent on the firm’s agreement and consent to share the documentation with you and does not remove your responsibility for complying with your legal requirements.

2. >Acting for the firm and outside the scope of AML regulation:
If you provide all of your services to accountancy firms that are supervised accountancy service providers then you will not require separate supervision, as long as you meet all of the following criteria:

1. all of the service you provide are to the firm (rather than providing services directly to the firm’s clients as your clients),
2. you are included in the firm’s anti money laundering procedures, reporting and training programmes and
3. you have a contract with the firm confirming that every aspect of the relationship between you meets all anti money laundering requirements.

This would mean that you only act as a subcontractor to supervised accountancy service providers and do not have any other clients. If this is the case, you may still wish to consider whether client due diligence procedures would be beneficial.

3. Acting for the firm but still requiring your own AML regulation:
Where you conclude that you are providing services to a supervised accountancy firm rather than to the ultimate clients, you can limit customer due diligence to documenting and checking the regulated status of the firm (see B.3, Appendix B, Anti-money laundering guidance for the accountancy sector).

However, you will still need to consider the nature of the ultimate clients and the services you are providing as this will feed into your risk assessment. Depending on that risk assessment you may feel it is necessary to still complete some client due diligence procedures over the ultimate clients – this will be a matter of judgement.

You must consider how you will fulfil your legal responsibilities to report any suspicious activity. In some cases, your subcontracting contract will require you to report to the MLRO of the firm. If there is no such arrangement, you will need to make suspicious activity reports to the MLRO of your own practice, or directly to the National Crime Agency in order to fulfil your reporting obligations under POCA 2002.

You should also consider if, under the policies and procedures of your own firm, you also need to inform the MLRO of your own firm, as well as to the firm’s MLRO. Some examples are below:

The money laundering regulations require all firms with relevant employees to have internal reporting policies and procedures. A subcontractor should consider whether its arrangements increase its exposure to AML risks and manage those AML risks accordingly, which may include formalising reporting arrangements between the firm and itself.

Data protection legislation

The Information Commissioner’s Office (the regulator for data protection legislation) says that the determination of whether a service is provided as a data controller or as a data processor should be assessed on a case-by-case basis. See our helpsheet GDPR – Data processor or data controller? In most situations a subcontractor would be a data controller. However, it may be possible in particular circumstances for you to arrive at the conclusion that the subcontractor is a data processor.

Depending on the wording of the subcontracting arrangement, an individual may be a data processor:

• if an individual provides services to a firm in circumstances where a practising certificate is not required (so the individual is not subject to Practice Assurance) and
• the individual comes under the professional indemnity insurance of the other firm (so no records are retained by the individual to protect themselves from a claim) and
• the firm takes responsibility for the work of the individual (so no personal data is held by the individual) and
• the individual only provides services to other accountancy service providers, and reports any suspicious activities through to MLRO of those firms in accordance with the contract.

If the professional relationship is that of a data processor providing services to a data controller then contractual terms are necessary to reflect this. Where the professional relationship is a data controller providing services to another data controller then, contractual terms are not required but it would be prudent to state in the contract, for the avoidance of doubt, that the subcontractor is a data controller. A data controller will need to send their privacy notice to the recipient of their services. See helpsheet Engagement letters and privacy notices.

Both firms will need to be mindful of protecting personal data. See ICAEW helpsheets GDPR – Communicating safely with clients and  GDPR – Client files.

Employment status

This document does not consider the tax implications of these arrangements but subcontractors and firms will need to give careful consideration to any personal tax and national insurance implications. Further guidance is on the HMRC website.

Professional considerations

There may sometimes be potential for confusion over which party to the subcontracting contract, you or the engaging firm, is taking responsibility for the client service. Both parties must remember that they have a duty of care at least to each other and the client.

When accepting work as a subcontractor you should also consider matters such as client confidentiality, the existence of possible conflicts of interest and other factors that might affect your objectivity and/or independence, as well as the technical requirements of the work itself.

Where the work to be undertaken falls within a ‘reserved’ area of practice (Audit, ATOL Reporting, Investment Business Advice, Insolvency work or Probate), particular attention should be paid to matters such as confirmation of ‘fit and proper’ status and maintenance of competence, including the achievement of adequate continuing professional development (CPD). In many cases, as a subcontractor providing services in these areas, you will often be expected by the firm to meet the requirements made of employees in areas such as declarations of fit and proper status, independence, confirmation of CPD, etc. (as a member, you will already be complying with ICAEW’s own CPD requirements).

ICAEW members, affiliates, ICAEW students and staff in eligible firms with member firm access can discuss their specific situation with the Technical Advisory Service on +44 (0)1908 248 250 or via webchat.