UK's third National Risk Assessment (NRA)

On 17 December 2020, HM Treasury and the Home Office published the UK's third National Risk Assessment (NRA) of the threat of money laundering and terrorist financing (ML/TF).

The NRA is a key document for all firms regulated under the UK's anti-money laundering (AML) regime, mandated not only by UK money laundering regulation (the MLR) but also as a Europe-wide requirement under the EU's Fourth Money Laundering Directive (4MLD). The Financial Action Task Force (FATF) also expects all countries to conduct NRAs. The NRA must identify, assess, understand and mitigate the risks of money laundering and terrorist financing particular to that jurisdiction. This is the third iteration of the UK NRA, which was first issued in 2015 and updated in 2017.

Described as a 'stock-take of our collective knowledge of money laundering and terrorist financing risks in the UK', the NRA is one in a sequence of risk assessments required under the MLR. Its findings must be taken into account in the risk assessment prepared by each of the supervisory authorities (e.g. FCA, HMRC, Law Society, etc.) that govern the different regulated sectors. These supervisory risk assessments, in turn are legally required to be taken into account by regulated businesses, who must themselves prepare their own individual, firm-wide risk assessments (FWRAs). It is therefore essential that the risks highlighted in the NRA are properly understood at senior manager level, and that compliance teams and money laundering reporting officers (MLROs) have a good working understanding of what ML/TF threats have been identified particularly to the firm's relevant areas of business.

Third National Risk Assessment - what are the key points?

The NRA outlines the positive changes that have taken place since 2017, including the creation of the National Economic Crime Centre (NECC), and the Office for Professional Body Anti-Money Laundering Supervision (OPBAS), which are said to have helped to strengthen and coordinate the UK response to money laundering. It references the growth of the public-private partnership in the fight against ML/TF, including the inception of the Economic Crime Strategic Board in January 2019. It recognises the UK's achievement in winning the best rating of any country in the current round of FATF evaluations.

Notwithstanding these encouraging developments, the NRA estimates that serious economic crime now costs the UK economy £37 billion per year. It warns that the UK cannot rely on its current regime and that it must be proactive in further strengthening its defences against ML/TF, noting in particular that advances in new technologies and COVID-19 have created additional opportunities for those involved in the laundering of money or the financing of terrorism.

New angles on traditional money laundering:

The NRA found that the traditional high-risk areas of money laundering remain unchanged (financial services, money service businesses (MSBs) and cash), although new methods in this field are emerging, as criminals adapt to exploit vulnerabilities in different sectors and emerging technology. Extensive use of mule accounts in the movement of funds was noted, with activity up 32% on 2017.

Increased compliance and awareness of risk within the UK banking sector has had an unintended consequence: the de-banking of the MSB sector by some retail banks has displaced criminal MSBs to the unregistered sector, using informal value transfer systems and complex and convoluted relationships with other MSBs to continue to operate. The NRA also notes the increase in the abuse of cash-related services such as cash deposits at the Post Office, the use of cash couriers and cash/valuables transit companies.

Financial services:

In relation to financial services, the scale and complexity of the UK's financial services sector continue to make it attractive for criminals and corrupt elites seeking to launder the proceeds of crime among huge volumes of legitimate business. Retail banking is singled out, with reference to the onboarding practices of challenger banks who promote quick and easy access to account opening, which the NRA supposes may be exploited by criminals, particularly where the information gathered at onboarding is sometimes insufficient. In wholesale banking, the risks exist in the complex structure of financial arrangements, which often include cross-border elements. Wealth management services can involve the investment of proceeds of crime, tax evasion and political corruption. The NRA nonetheless recognises the good progress made by firms since 2017 in implementing strong AML/CTF programmes.

Cryptoasset and new entrants to the regulated sector:

The NRA notes that recent regulatory changes have recognised the risk cryptocurrencies pose, with the rating moving from low to medium. The cryptoasset ecosystem has developed and expanded considerably since 2017, leading to an increased money laundering risk, with criminals increasingly using and incorporating them into their money laundering methodologies. Art market participants and letting agency businesses have also joined the ranks of MLR-regulated entities and although there is still an incomplete understanding of the mitigations and vulnerabilities in the art market in particular, the ability to conceal the beneficial owners and final destination of art make both sectors attractive for money laundering.

Professional services:

These are said to remain at risk of abuse by those seeking to launder money, particularly for trust and company service providers (TCSPs). Whilst there has been some improvement in the supervision of accountancy and legal service providers, TCSPs still remain feature prominently in enforcement investigations. Developments in relation to beneficial ownership transparency, including where Persons of Significant Control are established outside the UK, together with the reforms to Companies House and limited partnerships structures are being implemented in order to address the risks posed by the abuse of TCSP services. The Department of Business, Energy & Industrial Strategy (BEIS) committed in September 2020 to introduce identity verification for individuals who set up, control and own companies. Furthermore, BEIS' reform intends to improve the accuracy and usability of data on companies register and Companies House will be given greater powers to query and check the information it receives, with support from law enforcement and other investigative partners.

TF threats:

The UK's terrorist financing threat continues to involve low levels of funds being raised by UK individuals for the purpose of lifestyle spending and low sophistication attacks. The majority of funds raised domestically are via legitimate means, including salaries and state benefits. Terrorists also use easily accessible methods to purchase items for attacks such as cash and debit/credit cards.

The NRA also dedicates a section to the impact of COVID-19 on ML/TF. It notes that the overall risk of economic crime has not increased as a result of the pandemic, but has rather shifted position somewhat. The first lockdown made it difficult to move cash across borders, so money launderers looked to other methods, as well as exploring ways to exploit the fear created by the pandemic. Reports of COVID-19-related fraud, fake online sales for COVID-19 kits and equipment, and fake charities and financial support schemes have increased. According to the NRA, swift reactions from the government, law enforcement, regulators and the private sector have apparently mitigated the impact of COVID-19-related risks, though the reality is that the true effectiveness of these interventions is unlikely to be quantifiable until some months or years after the current state of emergency has receded.

Comment

Whilst the fresh NRA brings current risks into focus; it's not clear how long it will remain applicable – or credible - in the medium term. The current febrile concatenation of prolonged lockdown, mutant COVID-19 strain and vaccine uncertainty, economic despair, and the imminent expiry of the Brexit transition period may conspire to outdate this NRA far more quickly than might have been anticipated at the start of 2020.

Nevertheless, firms will ignore the relevant sector-specific risks at their peril. The NRA, whilst lengthy, is a relatively user-friendly document with some helpful visual aids to understanding the risks for each regulated area. Those firms with robust compliance programmes will examine this document carefully and reference it generously when updating their FWRA. Regulators are likely to update their own supervisory risk assessments shortly, but firms should not wait too long to update their own FWRAs, particularly where new or emerging threats have been identified as relevant to their individual businesses.

https://www.eversheds-sutherland.com/global/en/what/articles/index.page?ArticleID=en/Financial-services-and-dispute-investigation/Third-National-Risk-Assessment-published-by-HM-treasury-Home-Office-UK