Registration-only firms face closer FCA scrutiny for AML compliance

It takes more than a bank to launder money, so a wide range of businesses are required to comply with the UK’s anti-money laundering (AML) regime. The scrutiny of these businesses has been increasing, particularly since Russia’s invasion of Ukraine and the sanctions (and sanctions evasion) that followed. Various misadventures in crypto and Iran have also raised the stakes. The Financial Conduct Authority (FCA) is the latest regulator to up the ante for the firms it supervises.

What is AML compliance?

Basically, AML compliance involves the relevant service provider registering with a supervisory authority; conducting certain ‘customer due diligence’ on clients; and monitoring the business relationship with clients in order to detect and report any suspicious activity to the National Crime Agency. There are also related laws that require a firm to screen clients against sanctions lists, avoid handling proceeds of crime or ‘tipping off’ those under investigation, provide information on transactions, establish clients’ source of funds/wealth, and so on.

To meet these regulatory obligations, each ‘relevant person’ that is covered by the regime must maintain policies and procedures that also involve appointing a ‘money laundering reporting officer’, assessing the risk of money laundering and terrorist financing for the business as a whole, as well as each product and client; and taking a risk-based approach to deploying resources in their compliance efforts.

The consequences of getting any of this wrong can be very serious indeed, including jail time, fines, and the firm having to cease doing business unless/until the right policies, procedures, and controls are in place.

Non-financial businesses that must register and comply

The types of business activities that trigger registration when carried out in the UK are listed in Chapter 1 of the UK’s money laundering regulations (MLRs).

The Gambling Commission is the supervisory authority for gambling operators, while HMRC is the supervisory authority for the other non-financial business covered by the regime:

• money service businesses not supervised by the Financial Conduct Authority (FCA)
• high-value dealers handling cash payments for goods totalling 10,000 euros or more on a single transaction or linked transactions
• trust or company service providers not supervised by the FCA or a professional body
• accountancy service providers not supervised by a professional body
• estate agency businesses
• bill payment service providers not supervised by the FCA
• telecommunications, digital, and IT payment service providers not supervised by the FCA
• art market participants buying or selling of works of art where the transaction value (or a series of linked transactions) is 10,000 euros or more
• letting agency businesses renting property or land valued at the equivalent of 10,000 euros or more a month

It is typically quite straightforward for these firms to register with HMRC. Money service businesses and trust or company service providers must be registered first before they do any business. The others can trade while their application is being assessed, but run the risk of their application being unsuccessful and having to cease the relevant activity. Otherwise, it’s basically a crime not to be registered where you should be, and the sanctions are explained here.

Financial services businesses that must register

Certain financial services providers are covered by the AML regime if they carry out financial activities listed in Annex 1 of the MLRs as a business in the UK, even if those activities don’t require the firm to be otherwise ‘authorised’ by the FCA (e.g. under the Financial Services and Markets Act 2000). Such firms must still register with the FCA and otherwise comply with the AML regime. It used to be quick to register, but the FCA has just announced that it will increase its scrutiny of these firms and take longer to register them.

Cryptoasset service providers are not mentioned in Annex 1 of the MLRs but have their own listing and detailed qualifying criteria set out in Chapter 1. Basically, they are caught by the regime where they undertake cryptoasset exchange or custodian wallet activity (separately from the new cryptoasset regulations). The FCA already takes considerably longer to register cryptoasset service providers than other businesses.

Are there any exclusions?

Yes, there is a range of exclusions under the MLRs (as well as the initial ‘gating’ factors of whether an activity is ‘carried out as a business’ in its own right and ‘in the UK’, which should not be overlooked).

One area of potential confusion is whether an entity is acting as a ‘special purpose vehicle’ (SPV). An SPV is a company or other legal entity which is established exclusively for the purpose of simply holding the legal or beneficial (equitable) title or interest in an asset of some kind – typically a loan, lease, or other type of funding agreement.

SPVs are common in securitisation (asset-backed bond issuance), but there are also more private arrangements. The financial asset is agreed or ‘originated’ and funded by some other entity before the legal or beneficial ownership (and the right to receive payments or ‘receivables’) are transferred (sometimes automatically or almost immediately) to the SPV to be simply held pending expiry or transfer elsewhere. Accordingly, the SPV has no operations, staff, or systems of its own because a range of related agreements provide for the ‘servicing’ of the assets and collection of receivables by either the originator or a third-party servicer.

The point is that AML compliance obligations should already have been carried out by the entity which originated or created the instrument so it would be ‘overkill’ to require the SPV to gear up just to carry out AML compliance obligations. Sometimes, people confuse the role of the originator (which must comply with AML requirements) with the role of the SPV (which does not), especially where the originator transfers the asset to the SPV straightaway and plays no further role in relation to the asset.

If you have questions or concerns about AML compliance, please contact Simon Deane-Johns.