Lawyers remain laggards in adopting money laundering risk assessment tools

Lawyers remained laggards in a league table of sectors obliged to have a business risk assessment, a review by the Financial Intelligence Analysis Unit shows.

Only 57% of lawyers had a business risk assessment (BRA) in place last year, placing them last in a list of sectors that includes credit institutions, gaming companies, trust services providers, notaries and accountants.

However, the FIAU’s drive to achieve more compliance from subject persons has left its mark since in 2019, only 44% of lawyers had a BRA in place.

The overall results show that improvements were registered in every sector as Malta continued with its anti-money laundering drive.

A BRA is a tool by which operators in financial services analyse client risk and how this can be minimised through mitigation measures. It is part of the anti-money laundering obligations imposed on key operators.

A significant improvement was seen among real estate agents. Whereas in 2019, only 46% of real estate agents had a BRA in place, this shot up to 73% last year.

The champions were credit institutions where 100% of operators had a BRA in place, followed by financial institutions at 94%.

There were 80% of accountants who had a BRA in 2020, up from 65% a year earlier.

Financial services practitioners and ancillary services to the industry were rocked by the high-profile money laundering prosecutions of late that saw partners at Nexia BT and Zenith being charged along with their clients.

In the guidance document released last week by the FIAU, the regulator noted that the number of entities that did not have a BRA dropped to 15.2% last year from 24.3% in 2019.

All sectors experienced an increase in risk assessment compliance ranging between 10% and 27%.

The Malta Gaming Authority and the Malta Financial Services Authority also contributed to the exercise.

In terms of the quality of the BRAs adopted by the operators, the FIAU said “a good number” adopted detailed methodologies that explained the approach used to determine inherent risk and control effectiveness.

But the FIAU also found deficiencies in some of the assessments presented by operators.

“Instances were noted where the BRA did not explain how the likelihood and impact level for each inherent risk and the control effectiveness level were calculated… [some did not say] how the control measures serve to mitigate the specific risks identified,” the FIAU said.

The FIAU insisted that a risk assessment must not be an off-the-shelf document, but tailored to reflect the operator’s business model, operations, and scenarios.

The regulator said that while a number of operators engaged consultants to help them carry out risk assessments, it emphasised that they remained ultimately responsible for the exercise.

“The FIAU acknowledges the subject persons’ commitment to engage consultants to assist them in carrying out certain anti-money laundering and financing of terrorism obligations. However, subject persons remain solely responsible for the BRA and most importantly should ensure that they have knowledge of both the content and result of it,” the FIAU said.

It also noted that generic mitigating measures had to be avoided.

One risk assessment analysed by the FIAU found that an operator listed the application of “client due diligence (CDD) measures” as a safeguard against risks arising from exposure to politically exposed persons (PEPs).

“This is not sufficient given that CDD measures are to be applied in all circumstances irrespective of the risk level. In cases PEPs, subject persons are expected to define in more detail the type of enhanced due diligence measures to be applied,” the FIAU said.

The report acknowledged the investment done by operators to implement effective risk assessment tools but the reviews carried out by the FIAU, the MFSA and MGA concluded that there is “room for further improvement”.