AML/CFT Reached The Professions

The obligation is not to adopt a policy. It is to understand the money laundering and terrorist financing risk your practice is exposed to, and to build controls proportionate to it. That means a documented, enterprise-wide risk assessment covering your clients, your services, your delivery channels and the jurisdictions you touch.

It matters that this comes first, because it determines everything after it. A firm doing residential conveyancing for local clients has a different risk profile from one forming companies for non-resident beneficial owners, and they should not end up with the same procedures. A policy downloaded from a bank and re-badged fails on exactly this point: it describes controls for risks the practice does not run, and misses the ones it does.

Customer due diligence requires identifying the client, verifying that identity from reliable sources, identifying the beneficial owner where the client is not a natural person, and understanding the purpose of the relationship. Enhanced measures apply where risk is higher - politically exposed persons, unusual structures, higher-risk jurisdictions.

The hardest adjustment for professional firms is cultural rather than technical. Long relationships feel like assurance. In practice, a client of fifteen years whose file was opened before any of this applied is frequently the file with no identification documents at all, and long-standing relationships are precisely how a professional practice gets used.

Remediation of legacy files is unglamorous and it is where most of the work sits. Prioritise by risk rather than alphabetically: highest-risk clients and highest-value matters first.

Where a suspicion arises, the obligation to report runs to the reporting officer and onward to the Financial Reporting Centre. The threshold is suspicion, not proof - a firm is not required to investigate to a conclusion before reporting, and waiting for certainty is itself a failure.

Disclosing to the client that a report has been made, or is contemplated, is a separate offence. That has a practical implication professionals find uncomfortable: you may not be able to explain to a client why a matter has slowed. Decide in advance how the firm handles that conversation, because improvising it is how tipping off happens.

Appoint a reporting officer with the seniority to stop a transaction, and make sure they are not the person whose fee depends on it completing.

None of this requires a bank-scale compliance department. For a small practice it is a documented risk assessment, a client onboarding checklist that actually gets completed, a named reporting officer, a training record, and an annual review with a date on it.

What it does require is evidence. A supervisor assessing a practice will ask to see files, not policies. Five properly documented onboarding files demonstrate more than a fifty-page manual that nobody has applied.