On the 31st March 2021, the Financial Services Commission ("FSC") published an updated version of its Anti-Money Laundering and Combatting the Financing of Terrorism Handbook.

Two parts of the Handbook have been updated to clarify the duties of financial institutions in terms of Business Risk Assessment (Chapter 4.3) and Independent Audit (Chapter 13 added).

These amendments ought to be welcome as they will assist licensees of the FSC in implementing the appropriate measures to be compliant with the requirements of the Commission.

I. Business Risk Assessment

In terms of Business Risk Assessment ("BRA"), the salient points are as follows:

  • "The BRA should be carried out by involving all relevant departments of the licensee, including Compliance and Management who must work together to assess and analyse the risks of ML/FT."
  • Internal and external changes may affect the relevance of the last BRA carried out, so it must be reviewed regularly at intervals commensurate with the ML/FT risks of the licensee and at the time of changes in the applicable laws and regulations.
  • "The ultimate responsibility of carrying out the BRA and for implementing an effective internal compliance culture lies with the Board of Directors and each Director may be individually held responsible for any shortcoming."

II. Independent Audit

The most important updates in the Handbook were made with the addition of a Chapter 13 dealing with the Independent Audit function that a licensee must implement.

Requirements

The FIAMLA and FIAML Regulations 2018 require licensees to have in place an independent audit function which will allow the reporting entity to evaluate its AML/CFT programme and to ascertain whether the established policies, procedures, systems and controls are adapted to the money laundering and terrorism financing risks identified.

Scope

The scope of the independent audit was previously unclear, although one would have rightly found it appropriate to assess the same areas that the FSC would during an on-site inspection. The required areas of assessment are now specified:

  • AML/CFT policies and procedures
  • Internal Risk Assessment
  • Risk Assessment on the use of third-party service providers (outsourcing)
  • Compliance Officer function and effectiveness
  • MLRO function and effectiveness
  • Implementation and effectiveness of mitigating controls, including customer due diligence and enhanced measures
  • AML/CFT training
  • Record-keeping obligations
  • Targeted Financial Sanctions
  • Suspicious transaction monitoring and reporting

Qualifications of the audit professionals

The person or firm conducting the audit should have the necessary skills, qualifications, relevant experience of the audit process, and a proper understanding of the FIAMLA and FIAML Regulations 2018, to ensure that the audit is adequately conducted and that the recommendations made are appropriate to enable the licensee to improve upon areas in which gaps have been identified.

An external auditor may be an accountant, a law practitioner, or any independent consultant duly regulated or registered by relevant competent authorities to carry out such exercises. When electing an external audit professional, the licensee must carry out a certain level of due diligence to ensure they have the required competence — and must document and keep records of this assessment for provision to the FSC upon request.

Independence of the audit professional

The notion of independence has been clarified by the FSC: "The person or firm carrying out the audit should be independent and must not be involved in the development of a financial institution's AML/CFT risk assessment, or the establishment, implementation or maintenance of its AML/CFT."

The professional auditor may be external or internal. However, internal professionals must be independent and separate from the operational and executive team dealing with the AML/CFT processes of the licensee. Some criteria to take into account:

  • Was the audit professional involved in the development of the entity's risk assessment? Or the creation, implementation or maintenance of the AML/CFT programme?
  • Does the audit professional have a financial interest in the business? If so, would their interests be harmed by the results of the audit, or could there be influence over the outcome?
  • Does the audit professional have any relationship with any shareholder, director, senior management or employees?

Frequency of independent audits

The frequency of the independent audits of the AML/CFT framework of licensees should be commensurate with the licensee's size, nature, context, complexity and internal risks assessment. The greater the ML/FT risks and rate of change of the business, the more frequent the audits should be. Licensees with no clients during a reporting period, or which have not onboarded or exited any client since the last audit, may extend the audit frequency. Licensees being wound up should have one final independent audit carried out before they are no longer considered a reporting person.

Outcome of the independent audit

At the conclusion of the exercise, the independent auditor must provide the licensee with a dated and signed report which:

  • covers all required areas of assessment
  • identifies where the financial institution did not meet the minimum legal or regulatory requirements
  • includes actions required to address the gaps identified
  • makes recommendations for changes in behaviour and practice to improve the effectiveness of the AML/CFT programme's implementation

It is the responsibility of the Board of Directors of the licensee to take appropriate and corrective actions recommended by the independent auditor to address any gaps identified. Independent audit reports need not be filed with the FSC but must be made available upon request.

Published by Lutchmenarraidoo Chambers · 5 April 2021

Have a matter relating to the topics above? Contact the chambers for a confidential consultation.