JFSC BUSINESS [BRA] and CUSTOMER RISK [CRA] ASSESSMENTS FEEDBACK across the LEGAL SECTOR

The JFSC have published feedback on BUSINESS [BRA] and CUSTOMER RISK [CRA] ASSESSMENTS across the legal sector, with a focus on

• Compliance with legislative and regulatory requirements.
• Helping firms identify opportunities to strengthen their risk frameworks and ensure alignment with regulatory expectations.

The JFSC findings highlight:-

• GOOD PRACTICE AND
• AREAS FOR IMPROVEMENT,
• KEY CONSIDERATIONS

These findings are illustrated as follows:-

GOOD PRACTICE

1. BRA
1. BUSINESS RISK ASSESSMENTS [BRA]  were tailored to the entity, clear, easy to follow, and comprehensively detailed, including money laundering, terrorist financing, and proliferation financing risks. 
2. The effectiveness of controls in mitigating risks was based on quantitative and qualitative analysis.
2. BRA/CRA
1. Risk assessments were periodically refreshed following trigger events, such as changes to Appendix D2 of our Handbook.
2. Meeting minutes were detailed and evidenced collaboration between senior management and the compliance function.
3. Discussions and constructive challenge were evidenced when undertaking periodic reviews of the assessment methodology

AREAS OF IMPROVEMENT

1. BRA/CRA
1. Inadequate consideration of terrorist financing and proliferation financing risks within risk assessments.
2. This increases the likelihood that these risks are not adequately identified, monitored or controlled.
2. BRA
1. BUSINESS RISK ASSESSMENTS [BRA]  were not kept up-to-date with review cycles, or all the risks an entity is exposed to were not comprehensively considered.
2. A BUSINESS RISK ASSESSMENT [BRA] must be maintained and updated to be effective. 
3. CRA
1. Customer risk assessments did not consider all key risks, such as customer involvement in sensitive activities or industries, links to higher-risk jurisdictions, and complexity of relationships, structures, or arrangements.
2. Where risks were identified, the impact on the customer risk rating was not proportionate to the risk.

KEY CONSIDERATIONS

1. CRA
1. Does your CUSTOMER RISK ASSESSMENT [CRA] process consider and allow for the documented recording and assessment of risks presented by your customers?
2. Does your CUSTOMER RISK ASSESSMENT [CRA] consider the risk factors in section 3.3 of the Handbook?
3. Do you know if your internal processes require the CUSTOMER RISK ASSESSMENT [CRA] process to be reperformed following trigger events? For example,

1. 1. 1. A customer acquires politically exposed person status during the business relationship.

1. BRA
1. Check the controls in your BUSINESS RISK ASSESSMENT [BRA] to help mitigate the risk they are aligned against.
2. Have you been able to assess the effectiveness of these controls correctly? Is this effectiveness assessment and the resultant residual risk documented?

The JFSC has provided a concise, one-page summary to help entities understand the JFSC observations and take any necessary action – this is shown as follows:-

SOURCES

• https://www.jerseyfsc.org/news-and-events/bitesize-feedback-for-the-legal-sector-on-business-and-customer-risk-assessments/
• https://www.jerseyfsc.org/media/8249/bitesize-feedback-legal-sector-business-and-customer-risk-assessments.pdf