Period of Recognised Training / Training Contract Financial, Accounts and Risk Management Syllabus

When must Enhanced Due Diligence (EDD) be applied under MLR 2017?

EDD applies in higher-risk situations: where there is a high risk of money laundering/terrorist financing, dealings with a Politically Exposed Person (PEP), the client is established in a high-risk third country, the transaction is complex/unusually large, or there is no apparent economic/legal purpose.

When may Simplified Due Diligence (SDD) be applied?

SDD may be applied where the business relationship or transaction presents a low degree of risk (e.g. certain regulated/listed entities, public authorities), based on a documented risk assessment. The firm still monitors the relationship and must escalate if risk increases.

What is a 'beneficial owner' for a body corporate under MLR 2017?

An individual who ultimately owns or controls (directly or indirectly) more than 25% of the shares or voting rights, or who otherwise exercises control over the management of the body. If none is identifiable, the senior managing official is treated as the beneficial owner.

What governance/role requirements does MLR 2017 impose on a regulated firm?

It must (where appropriate to its size) appoint a Money Laundering Reporting Officer (MLRO/nominated officer), appoint a member of the board/senior management responsible for compliance (MLCO), undertake a written firm-wide risk assessment, maintain policies, controls and procedures, and provide staff AML training.

What is a 'PEP' and what additional steps are required when dealing with one?

A Politically Exposed Person is an individual entrusted with a prominent public function (and their family/close associates). The firm must obtain senior management approval to establish/continue the relationship, take adequate measures to establish the source of wealth and funds, and conduct enhanced ongoing monitoring.

How long must AML records (CDD and transaction documents) be retained under MLR 2017?

Five years from the end of the business relationship or the completion of the occasional transaction. After that period the records must generally be deleted unless retention is required by law or the client consents.

What is a Suspicious Activity Report (SAR) and to whom is it ultimately made?

A SAR is a report of knowledge or suspicion (or reasonable grounds for suspicion) that a person is engaged in money laundering or that property is criminal property. Within a firm it is made to the MLRO/nominated officer, who, if they share the suspicion, reports externally to the National Crime Agency (NCA).

What is the difference between an internal SAR and an external SAR?

An internal SAR is made by a member of staff to the firm's nominated officer (MLRO). An external SAR is the report the nominated officer makes to the NCA where they consider there are grounds for suspicion. The internal report discharges the individual's duty; the MLRO decides on external reporting.

What is a 'DAML' (Defence Against Money Laundering) / consent SAR and why is it sought?

It is a SAR seeking the NCA's consent (appropriate consent) to proceed with an act that would otherwise be a principal money laundering offence (e.g. completing a transaction involving suspected criminal property). It provides a defence under POCA ss.327–329 if consent is given or deemed.

Under POCA 2002, what is the 'notice period' and 'moratorium period' after a consent (DAML) SAR?

The notice period is 7 working days from the day after disclosure, during which the NCA may refuse consent. If refused, a moratorium period of 31 calendar days applies, during which the prohibited act must not be done. Consent is deemed if no refusal within the notice period.

What are the three principal money laundering offences under POCA 2002, ss.327–329?

s.327 — concealing, disguising, converting, transferring or removing criminal property; s.328 — entering into or becoming concerned in an arrangement which a person knows/suspects facilitates the acquisition, retention, use or control of criminal property; s.329 — acquiring, using or possessing criminal property.

What is the failure-to-disclose offence under POCA 2002 s.330 and to whom does it apply?

s.330 makes it an offence for a person in the regulated sector to fail to disclose where they know, suspect, or have reasonable grounds to know/suspect that another is engaged in money laundering, and the information came to them in the course of business. Liability arises even on an objective 'reasonable grounds' basis.

What is the offence of 'tipping off' under POCA 2002 s.333A?

It is an offence (in the regulated sector) to disclose to a third party that a SAR has been made, or that a money laundering investigation is being or may be contemplated, where the disclosure is likely to prejudice any resulting investigation.

What is the maximum penalty for the principal money laundering offences under POCA 2002?

On conviction on indictment, up to 14 years' imprisonment and/or an unlimited fine. The failure-to-disclose and tipping-off offences carry lower maxima (up to 5 years and 2 years' imprisonment respectively).

Does legal professional privilege (the 'privileged circumstances' exemption) excuse a solicitor from making a SAR under POCA s.330?

Yes, in limited circumstances. There is no offence under s.330 if the information came to the solicitor in 'privileged circumstances' (e.g. giving legal advice). However, the exemption does not apply where the information is communicated with the intention of furthering a criminal purpose (the 'crime/fraud' exception).

What is the legal effect of UK financial sanctions on a solicitor acting in a transaction?

Sanctions (administered by OFSI under the Sanctions and Anti-Money Laundering Act 2018) prohibit making funds or economic resources available to, or dealing with funds of, a 'designated person'. A solicitor must screen parties against the sanctions list and must not breach an asset freeze; breach is a criminal offence and a licence may be required from OFSI.

What is OFSI and what is the threshold for liability in many financial sanctions breaches?

OFSI is the Office of Financial Sanctions Implementation (part of HM Treasury). For many financial sanctions offences liability is strict in part: OFSI can impose monetary penalties on a 'knew or had reasonable cause to suspect' basis, and can name and shame, regardless of intent.

What is Professional Indemnity Insurance (PII) and what minimum cover must SRA-regulated firms hold?

PII covers a firm's civil liability to clients/third parties arising from the practice. SRA Minimum Terms and Conditions require qualifying cover of at least £2 million per claim for ordinary firms, or £3 million for firms incorporated with limited liability (e.g. companies/LLPs).

What is 'run-off cover' in the context of PII and how long must it last?

Run-off cover is PII that covers claims made after a firm ceases practice (without a successor), in respect of work done while it was in practice. Under the SRA Minimum Terms it must be maintained for six years after the firm closes.

What are the key components of risk management in a typical conveyancing/property transaction?

Identity verification of all parties (and source of funds), checking for mortgage/identity fraud, verifying the seller's title and authority to sell, vendor's solicitor checks, ensuring funds are cleared before completion, avoiding involvement in dubious/back-to-back transactions, and watching for 'too good to be true' deals.

What red flags should prompt heightened transactional risk scrutiny (potential fraud/money laundering)?

Unusual or unexplained source of funds, reluctance to provide ID, instructions from third parties, large cash transactions, payments to/from unrelated third parties, transactions with no apparent commercial rationale, sudden changes of instruction, and clients keen to overpay or use the firm's account as a banking facility.

What is the SRA Accounts Rules prohibition on using the client account as a 'banking facility'?

Rule 3.3: a firm must not use a client account to provide banking facilities to clients or third parties. Payments into and out of the client account must relate to an underlying transaction (a legal service or regulated activity) the firm is providing — not merely passing money through.

What are the six data protection principles under UK GDPR (Article 5)?

Personal data must be: (1) processed lawfully, fairly and transparently; (2) collected for specified, explicit and legitimate purposes (purpose limitation); (3) adequate, relevant and limited to what is necessary (data minimisation); (4) accurate and kept up to date; (5) kept no longer than necessary (storage limitation); (6) processed securely (integrity and confidentiality). A seventh overarching duty is accountability.

What are the six lawful bases for processing personal data under UK GDPR Article 6?

(1) Consent; (2) Contract (necessary for performance of a contract with the data subject); (3) Legal obligation; (4) Vital interests; (5) Public task; (6) Legitimate interests (not available to public authorities in performance of their tasks).

Within what time must a personal data breach be reported to the ICO, and when is reporting required?

Where the breach is likely to result in a risk to the rights and freedoms of individuals, it must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. If it is likely to result in a high risk, affected data subjects must also be informed without undue delay.

What is the maximum fine under UK GDPR for the most serious infringements?

The higher tier maximum is £17.5 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier is £8.75 million or 2% of turnover.

What are the core elements of good cybersecurity / information governance for a law firm?

Access controls and strong authentication (e.g. multi-factor authentication), encryption of data at rest and in transit, regular patching and software updates, staff training on phishing, secure backups, an incident response plan, supplier due diligence, and clear data retention/disposal policies. Certification such as Cyber Essentials evidences good practice.

What costs information must a solicitor give a client at the outset under the SRA Codes of Conduct?

The best possible information about the overall cost of the matter — including the basis of charges, likely overall cost or a clear estimate, whether VAT and disbursements are extra, funding options, and the client's potential liability for the other side's costs. This must be kept under review and updated as the matter progresses.

What client funding options should a solicitor advise on, and what is a CFA versus a DBA?

Options include private payment, legal aid (if eligible), legal expenses insurance, third-party/trade union funding, and litigation funding. A Conditional Fee Agreement (CFA) is a 'no win, no fee' agreement with a success fee calculated as an uplift on costs; a Damages-Based Agreement (DBA) takes the fee as a percentage of the damages recovered (capped at 50% in commercial cases, 25% in personal injury).

What is a costs budget and how does the costs budgeting/management process work under CPR Part 3?

In multi-track cases parties (other than litigants in person) must file and exchange costs budgets in Precedent H. The court reviews and may make a costs management order recording the agreed or approved budgeted costs for each phase. On detailed assessment the court will not depart from the approved budget without good reason (CPR 3.18).

On a 'between the parties' assessment of costs, distinguish the standard basis from the indemnity basis.

On the standard basis, costs must be proportionate and reasonably incurred and reasonable in amount; any doubt is resolved in favour of the paying party (and proportionality can reduce even reasonably incurred costs). On the indemnity basis, costs need only be reasonable (no proportionality requirement) and any doubt is resolved in favour of the receiving party. The standard basis is the default.

What is the general rule on recovery of costs between parties in litigation, and what is the main practical effect on the winning party?

The general rule (CPR 44.2) is that the unsuccessful party pays the successful party's costs ('costs follow the event'), though the court has discretion to order otherwise (e.g. for conduct or Part 36 offers). Even a successful party rarely recovers 100% of its solicitor-client costs — typically around 60–70% on the standard basis — leaving a shortfall borne by the client.