AML and sanctions update: October 2026

Tipping off

00:02:56 Brian: "The solicitor immediately contacted his client to inform him about the investigation, that is a clear no-no, and went on to meet him to discuss the matter across the next 5 months, including by flying out to the client's home in Malta the following week and meeting him at a West London private dining club. This was despite being repeatedly warned by the Serious Fraud Office not to tell the client."

00:04:02 Brian: "You shouldn't be doing it. You should be making sure that staff are fully aware of tipping off. Now of course, one of the thing that some people get confused about is asking questions of a client in order to satisfy yourself that something might not be quite right. That is not tipping off. You won't have made I suspect at that point a report to your MLRO. Therefore, you won't have made a report to the NCA and therefore there won't be a formal investigation ongoing. So, there is no issue there."

00:04:40 Brian: "There are or there there is the ability within the rules for you to ask further questions to satisfy your mind as I say around, you know, are there issues that you then might need to report. So, you need to be clear on that one that it isn't necessarily tipping off at that point, but it may you know, it will be later on."

00:05:06 Brian: "Again, one of the other issues is around, you know, what should you be telling the clients when you've sort of made a report to the NCA. Again, you've got to be very careful about tipping off."

Fines, risk assessments and compliance oversight

00:08:26 Brian: "We've had another 12 firms fined since June. No firm-wide risk assessments, no client and matter risk assessments, no policies, controls, or procedures, or they were in place, but they were inadequate. Um bearing in mind, you know, we've I've certainly been banging on about this for the last probably three or four years now. Uh and we've seen fines over that period of time to probably 300 plus law firms now. You know, you would have thought firms had actually got the got the idea that they need to be making sure they're doing everything that they should be doing."

00:09:39 Brian: "Question that I then pose, of course, when I see these things is where were all the compliance officers? Particularly when four of these firms held CQS and six of these firms held CQS and Lexcel. Both of those standards in section five require board sign-off or or senior partners sign-off, management board sign-off, whatever you have, to say, 'We have a an AML policy in place. It covers all these various things, and we are going to comply with all these these different requirements.'"

00:12:14 Brian: "And it again, it isn't just about making sure you have a template in place, it's about making sure that it fits your firm, it is reviewed, it is updated. People are trained on whatever has changed. So you know, the warning is there. We're only, you know, what, 18 months, 2 years away from the NC the the FCA taking over things. So and and they're starting to move and I'll come on to that in a little bit more detail later on, but you know, time is of the essence. People need to stop getting fined for things."

Due diligence and reliance

00:18:34 Brian: "So, we need to be making sure that, you know, law firms aren't an attractive option. That you in effect have that imaginary LED sign flashing outside your office to say, 'We're doing all the right things here. Don't even bother walking through the door if you think you're going to come and try money laundering with us. It's not going to happen.' Um but, of course, the moment you let your guard down, that is the moment people will then start to think, 'Right. Okay, well, I can go in there.' And, you do need to be really careful. I mean, I remember when I was in practice, not necessarily around money certainly the criminals and the ends they go to to to basically push forward transactions, try and convince you that they are legitimate clients, that ID has been certified by law firms round the corner when in fact they haven't been. It was basically they had made up the the stamps, but they'd used a previous letter that had had a foot that particular firm's stamp on it."

00:20:14 Brian: "Okay. Um the other thing that um I would pick up on is the fact that, you know, money was paid into bank accounts, and money was taken in in uh cash, sports bags, carrier bags, holdalls, hundreds of thousands of pounds. So, you would have thought that when they put that on the counter at the bank, the bank would be saying, 'And where does this money come from?' But they didn't. Uh or they did, but they allowed it to go through because they had consent, but I suspect it that wasn't the case."

00:20:54 Brian: "That brings me to a question in terms of reliance. I.e., would you want to rely on banks to give you all the relevant documents and all the other CDD checks under the money laundering regulations uh particularly on the basis that you would remain liable if there were any errors or omissions. Well, I certainly wouldn't uh when particularly when you see this type of case, but of course, we've also seen in the last few weeks other banks and I think there was one the this week um that was fined millions of pounds because of failures in their money laundering um their anti-money laundering processes. So, I would be very careful."

00:21:36 Brian: "A lot of people sort of tend to say to me, 'Well, you know, why can't we just get rid of the CDD and put it onto a state agents? Why can't we put it onto the banks?' [Editor note: captioned as 'state agents', most likely 'third parties'.] You might want to do that if you didn't have the liability, but while you have the liability for their errors and omissions, I wouldn't go anywhere near it unless you were completely happy they were doing the right things. But I think to to to think that banks are doing everything right, that the state agents are doing things right, the evidence just suggests otherwise. So, I personally, I wouldn't go there, but it is down to you."

00:32:27 Brian: "So, this all goes to what we've um been seeing with Companies House over the last year or so. Companies House is obviously trying to tidy up what's been going on, trying to stop frauds frauds going through Companies House and such like. Uh but apparently there are thousands of um directors who shouldn't be on there. Uh they are fraudulent. Um so you need to again, when you're doing your checks on corporate clients and others if if necessary, um you need to be careful what you're actually finding. Do you need to sort of ask further questions? Is what I'm seeing here okay? Uh I I would be Well, you're not supposed to be relying on Companies House anyway. You're supposed to be going to other things as well."

Property work and PEPs

00:16:48 Brian: "Non-compliance around PEPs. So again, I wanted this one to your attention cuz clearly, you know, there are a number of people making mistakes out there. And so if we're able to learn from those, then I think you know, we ought to. So this is where there were no there weren't processes in place to cope with acting for a politically exposed person. And this was on multiple property transactions. And of course, property transactions, conveyancing, it is one of the highest risk areas going. So, you know, if you're ever going to be put under the spotlight, it's going to be because you are dealing with that type of work."

00:17:27 Brian: "But, you definitely need to be looking at your politically exposed persons and, you know, dealing with it. You need to get the appropriate sign-off and and and such like. Uh so, bear that one in mind, training for staff. Uh they need to know exactly what they should be doing around this. And, you know, do they need to get sign-off from a senior person? Yes, they do."

Police production orders

00:30:08 Brian: "Now, I just want to give you a little bit of a sort of a personal case study here. Because when you get police officers sort of walking into your office as I did once, um and saying, 'Here's a production order. We want this client's file.' Um you need to take a very cautious approach to it. You shouldn't just be saying, 'Okay, I've got a production order here. I now need to go and get everything.' Well, the first thing we need to think about is legal professional privilege. But, I didn't even get that far because the first question I or the first thing I did was I looked at the production order itself. And the production order itself was wrong. Uh they had basically put us down as the the firm but as a company. We weren't a company, we were a partnership. And so I said to them, you need to go back to the court and you need to get this changed."

00:31:29 Brian: "I had another one. Um it was the day after, I think it was, of the bomb attacks that we had in London. Uh phone call from New Scotland Yard saying, you know, you put in a suspicious activity report to us on this particular client. We now need to see their file because we think they may have been involved in the you know, in in the attack. And I said, 'Well, fine, send me the the relevant order um and I'll look at it.' Uh no order. Well, again, they were kicking off about the fact cuz they turned around and said, 'Well, do you not realize what happened?' And I said, 'Yes, but the law didn't go out the window at the same time.'"

00:32:06 Brian: "Uh they weren't impressed uh but surprise, surprise, they never came back again. So, they clearly wasn't that desperate. But you do need to be questioning these things when they get presented. Don't sort of just fall back and and think, 'Right, well, I've got to do it because there's a police officer standing there.' No. You know, take take time to think about what you're doing."

Sanctions

00:33:37 Brian: "OFSI communications, criminals they are getting onto the sanctions side of things now. Um apparently there are communications out there that are purporting to come from OFSI going into organizations um and people are thinking, 'Oh, this is legitimate. I need to answer this. I need to click this particular link, whatever it might be.' So be re- very careful um around anything that you do get from OFSI. So, you know, pick up the phone to them and not using the any phone numbers that are obviously on the the email or whatever it might be. Um but, you know, contact them separately and see whether in fact what they're asking you to do is legitimate. So just bear that one um in mind."

00:34:23 Brian: "You need to make sure that other members of staff are aware of this one as well. So, you know, when I was in practice I used to sort of when I got these types of things I used to send a quick email around to everybody to say, 'Just be careful. If you get anything around off-sea or dodgy emails, then come and see me, and obviously I'll I'll sort of sort it out from there.' But yeah, let them know these things are going on."

00:34:46 Brian: "Sanctions and breach of contract. Now, again, this might be related to Shanghai and the Maritime Court over there, but I wanted to just put this one out there. So, this is the Shanghai Maritime Court held that the defendant as the carrier materially breached the contract as it refused to perform its obligations thereunder. The court further held, and this is the important bit, that the defendant's reliance on foreign sanctions as a justification for non-performance was legally untenable. Um so, you do need to be aware that different courts are coming up with different scenarios and different judgments and things like that."

00:37:57 Brian: "Russia sanctions, lots of them around, and I suspect they will keep on coming thick and fast. Uh for those of you who have downloaded the the slides, um I added one on about 5 minutes before we came on air. So, the one right down at the bottom, you probably won't Well, you won't see it on the slides, but it's been added. Uh so, do have a look at those. Now, one hopes that if you just go to the UK sanctions list anyway, which is at the bottom. Everything should be reflected. But of course, some people don't rely on online AML checks, sanction checks. They in effect rely on it on doing it themselves. Well, you need to be making sure that, you know, you check against all these these these different updates."

00:38:41 Brian: "Afghanistan has has crept in as well. So, um we've got some from Afghanistan that you need to be checking. And we also got ISIL and Al-Qaeda, as well. I mean, you can see from these lists uh and these, as well, because we've got Syria, Iran, Iraq. I mean, there's all sorts. But these are coming through on a daily basis. I'm picking these up on a daily basis from the government. Uh and so, you know, there's a lot of things going on around sanctions at the moment. Just don't fall foul of them."

00:39:16 Brian: "Now, in terms of licenses, again, you need to be checking. So, depending on which client you deal with, the type of work that you deal with, you may be wanting to have a look at some of the licenses. But there have been a lot of licenses, as you can see. So, you can't assume that, well, I've looked at this. Well, yeah, but okay, that particular license might have been adapted. It might have been updated, so I need to look at it again. So, you need to keep on looking at these different things. It can't just be a one-stop, and then we move on. You've got to be reviewing these things on an ongoing basis."

Regulation and FCA supervision

00:23:32 Brian: "So, I mentioned earlier on about uh FCA supervision. Um the Law Society recently had its um annual financial crime conference, and the FCA, as expected, were there talking. Um and basically, they're talking that uh it's before the end of 2028 that things will probably really get ramping up and going. Um I think firms being held to account at that particular point. But, let me just read some comment that uh we got from that. So, um speaking in the Law Society's economic crime conference, the FCA's lead said, 'Further onboarding will take place in phases, with the broad aim that all firms within scope will be supervised by the FCA by mid-2030.'"

00:25:02 Brian: "Now, of course, is there anything new you need to be doing now? No, if you're doing all the right things now. Yes, if you're not. Um so, you know, you either are fine because you're doing it all and and you've obviously had I use the the phrase green light advisedly. So, if you have been through an SRA audit and everything is now fine and dandy, then one would hope that things will stay that way. But, of course, that doesn't necessarily follow because people do tend to sort of let things slip once they've sort of had the SRA around. Uh but, I am aware of some firms that have actually been asked several times for their firm-wide risk assessments, their peace their policy controls and procedures. So, just because you get given, as I say, the green light one year doesn't mean you're not going to get picked up on the next one."

00:26:01 Brian: "But, they then go on to say, 'Implementation should proceed only when the necessary preparations are complete. This includes ensuring that appropriate systems and effective information sharing arrangements are in place. Supervisory staff are adequately trained and sufficient clarity is provided to firms about the future regime. This reform is not about applying a banking style or one-size-fits-all supervisory model to professional services firms. The future regime will be proportionate and risk-based and establish a establish a more consistent and effective framework while recognizing the different characteristics and risks of those sectors.'"

00:28:03 Brian: "Um but one of the things that he did say sort of pricked my ears, um and it was that cyber insurance is fundamental and a core requirement. Now, he didn't go so far as to say it is mandatory. He didn't go so far as to say, 'We are going to make it mandatory.' But the sheer fact that the chief executive of the FCA, and your future AML supervisor, is saying that cyber insurance is fundamental and a core requirement, seems to be a strong indicator that if you haven't got it, you need to get it. I think it is good business practice anyway, and that's exactly what he went on to say, that you need to have a look at cyber insurance in the same way that you look at professional indemnity insurance."

00:43:19 Brian: "Albert said, uh 'Let's just have a look. What will the practical implication be for firms not meeting the FCA fit and proper test?' Well, that's one of the things that we've got to really wait for, Albert, but I suspect that we will have a number of different options. Um, there will be putting everybody through and that's everybody who has records, don't have records, whatever. I don't think they will do that. I don't think they will basically put a bar on all firms that have a regulatory record. Because if you do that, you're going to be taking a lot of firms out of the system."

00:44:36 Brian: "I think where we might land, and again, don't hold me to this, but I think common sense would say we will allow those with no records to go through, no problem at all. So, they'll just do cursory checks. But firms where there are regulatory histories, they will then, in effect, put them under enhanced supervision. Now, will they put them straight through? I'm not quite sure. How that how that sort of enhanced supervision will work, I'm not quite sure yet. I might be completely wrong on all of this, but that's the way I sort of would see this working."

00:45:13 Brian: "I would certainly not want uh to be taking on as a regulator firms where they have been non-compliant for an average of 6 years, with some firms being non-compliant for up to 15 years. I mean, what does that say about your compliance culture? Particularly if you are CQS and Lexcel. Put aside the fact that well, why didn't Lexcel and CQS pick it up? But the fact is, you know, ultimately the partners are responsible for all of this."

Client money

00:46:11 Brian: "Anonymous said, 'If a client has received gifted funds, then decides they are not going to use them, possibly as gift or does not want to provide evidence because they are elderly, will it suffice for client to move funds out of bank account or are they considered to be mixed funds still forming part of the transaction?' Um it it's it's not an easy one to answer that one because you know, depending on your your assessments that you've carried out on on the client, on the matter, and whether you have any suspicions around money laundering. You know, if you've got money coming into your client account and then somebody says, 'I want it back.' That is a red flag for potential money laundering."

00:47:07 Brian: "Um however, if you were to sort of risk assess and say, 'Well, you know, they they were considered to be low risk, the matter was low risk.' Um I you know, I can't see any red flags. Well, you might think, 'Well, let's put it you know, let let's send it back.' Again, it depends how much is it? Uh if it's thousands and thousands, um then that obviously makes it a lot higher risk than if it was hundreds, for example."

00:47:37 Brian: "Um so, I I I can't give a specific answer, but I think you need to be very very careful when money is coming into the client accounts and then all of a sudden people want it back."