ICAS launches new anti-money laundering (AML) monitoring regime from 1 August 2023
Find out what our new anti-money laundering (AML) monitoring regime means to you and your firm.
Why have we changed the regime?
We have made some significant changes to our AML monitoring regime to take account of the growing prioritisation of AML compliance in the UK, and to ensure that ICAS:
- Continues to provide high-quality AML supervision;
- Responds to increased requirements from our AML supervisor, OPBAS (the Office for Professional Body Anti-Money Laundering Supervision - which is part of the Financial Conduct Authority)
During 2022 we removed the AML monitoring work from the Practice Monitoring regime and introduced a standalone AML monitoring process.
We have now further strengthened our AML monitoring regime by making it more risk-focused, as explained below.
What are the main changes?
Previously all firms would have received a monitoring visit once in a monitoring cycle which was focused primarily on AML compliance, with the work conducted on each visit being broadly similar.
The new monitoring regime will change how often a firm is reviewed. It will also change how the firm is reviewed. Finally it may also change how the Authorisation Committee will deal with serious non-compliance.
How often a firm is reviewed
From 1 August 2023 onwards the nature, timing, extent and frequency of monitoring visits to each firm is determined by our money laundering risk assessment of that firm. Our aim is to focus our monitoring resources on the highest money laundering risks.
We risk-categorise our supervised firms, based primarily on responses provided in the firm’s annual AML declaration, but also with additional information, into the following categories:
- Lowest
- Low
- Medium
- High
- Highest
These risk categories reflect the nature and circumstances of the firm, the type of engagement services provided, how they are delivered, the nature of the client base, and other associated money laundering risk factors. The risk categorisation also takes into account other internal ICAS factors such as ICAS monitoring visit and complaints history and any external intelligence (eg media articles). The way we conduct our risk assessment is consistent with guidelines agreed amongst the various accountancy body supervisors.
Firms in the high-highest range are visited most frequently, approximately every two years, with firms in the medium range being visited approximately every four years. Those firms at the low and lowest end of the risk spectrum are visited between every four to10 years.
How firms are reviewed
Additionally, ICAS deploys a range of methods of conducting visits:
- Onsite reviews: A full review conducted onsite.
- Desk-top reviews: A full review conducted remotely.
- Teams/Telephone call: A remote review based on discussions only.
Low and lowest risk firms may only receive a Teams/Call or a desktop review. High and highest risk firms are more likely to receive an onsite review.
As well as checking AML compliance, as before, the visit focusses more on the money laundering risks being faced by the firm, including:
- Discussions with the firm to understand the money laundering risks facing the firm.
- Assessing the effectiveness of the firm’s whole firm risk assessment.
- Considering how these risks have been disclosed to ICAS in the annual AML declaration.
- Our fieldwork and engagement file reviews (where conducted), including our review of customer due diligence will be more focused on the AML risks identified by both the firm, and ICAS.
- Our monitoring assesses in detail the firm’s internal reports and the subsequent suspicious activity reports issued, and the firm’s money laundering reporting policies and procedures.
Authorisation Committee: Regulatory Actions Guidance
OPBAS, our regulator, requires all professional bodies to take a two-pronged approach to AML non-compliance:
- Ensuring that non-compliance failings are improved. We do this currently with scheduled follow-up checks to firms which have compliance failings; and
- Penalizing firms for poor performance, in order to prevent recurrence.
Our current follow-up check regime is working, as we are seeing an improvement in the levels of AML compliance across our firms and these follow-up checks will continue. However, firms will now be required to evidence improvement quicker than before, usually within one month of the visit.
OPBAS expects each regulator to take a robust approach to regulatory penalties. The Authorisation Committee is currently testing a new approach to AML regulatory actions, and specifically regulatory penalties. This is being rigorously tested before it is implemented to ensure that it is proportionate. We will provide more information on this new regulatory actions regime once it is finalized.
It should be noted that as the firm’s AML declaration is an integral part of our money laundering risk assessment, firms which have misrepresented the risks they face, are likely to face serious regulatory action going forward.
What are the benefits to firms?
Firms are the lower end of the risk spectrum will benefit from having a lighter touch or less frequent monitoring visit.
Firms in the medium-high-highest end of the spectrum should benefit from more risk-focused discussions with the monitoring team, which should:
- Provide some reassurance to firms if they are on the right track;
- Drive improvement where the firm is risk-exposed and not mitigating these risks appropriately.
Find out more
Our FAQs document provides more detailed information on our new monitoring approach.