The UK's Financial Conduct Authority has published a 'thematic review' of the efficacy of financial crime controls at asset management and platform firms, presumably as a prelude to some disciplinary action later in the year.

The regulator, in its previous incarnation as the Financial Services Authority, visited 22 firms of all shapes and sizes – wealth/asset management firms, fund firms and platform firms – in 2012-13 and this is the result.

In the review the FCA made it plain that it was interested only in money-laundering, bribery and corruption. It explicitly said that it had no interest in terrorist finance in this instance and did not even mention other financial crimes such as fraud, insider-dealing and market manipulation. 

What is suspicion? 

The review started with an observation, made in passing, that the 'risk' of money-laundering and corruption may increase wherever there is a big-ticket or unexpected transaction. This cuts to the heart of the nature of 'suspicion' – the stage of alertness that every firm should reach before sending off a suspicious transaction report to the National Crime Agency – as it applies to high-net-worth individuals. It is an old trope that the spotting of 'unusual' transactions is not the same thing as the spotting of suspicious transactions because almost all HNW transactions are unusual. The FCA does not tackle this problem with any advice – a position its predecessor the Financial Services Authority always took, no matter how closely it was questioned.

Record-keeping and pay: five out of ten for effort 

Throughout the report the FCA dwelt on the common problem of bad record-keeping in this area. It thought that clear reporting lines and lines of responsibility for controls against these financial crimes were quite good on the whole. It did not, however, think that the effectiveness of these structures was documented for all to see. At one point it berated firms for not having 'customer due diligence' (a stilted phrase from the Basle Group that the European Union picked up and started using instead of 'know your customer' in 2001) records ready for its people to look at. This, too, was a reference to bad record-keeping. At one firm, the FCA complained, a customer had withdrawn £25 million and thereby triggered off a transaction monitoring alert, but no evidence was available in the records of who reviewed it or why it was eventually waved through. Not only might compliance officers draw the lesson from this story that good record-keeping is essential; they might also be inclined to think that it is always wise to spend the most effort (record-keeping and otherwise) on 'customer files' to which the FCA is like to attribute a high profile in drawing up a complaint.

Hidden in among the detail of the review paper was a compliment for firms: “The type and level of sophistication of transaction monitoring systems and controls implemented by firms is typically dependent on the nature, scale and complexity of a firm's business activities.” This was another way of saying that the firms the FCA surveyed were actually successful in observing the doctrine of 'proportionality'.

The FCA looked briefly at the way firms paid and vetted their staff. It was most pleased with those firms that used long-term incentive plans to pay staff extra for their performance as this diffused such rewards over a wider period and was likely to induce a measure of stability. The idea was that one-off bonuses for 'performance' were only too easy to use as excuses for corrupt payments for cutting corners or worse. The regulators also approved of the fact that firms typically vetted staff by checking their credit ratings; by verifying their names and addresses; by looking at their previous employment; by searching for County Court judgments; and by going to the eduction authorities for proof of their qualifications. They also liked the idea of practical training that was aimed squarely at the risks that every firm faced. 

What the FCA wants

In 2006-7 the old FSA developed a disconcerting habit, which some commentators have likened to a slight mental disease, of stating that this-or-that activity was 'good' or 'bad' practice with no reference to actual rules or even guidance. The FCA has continued this tradition here, with a battery of assertions – none of which can legally count in the eyes of the Upper Tribunal, the body that hears firms' appeals against the FCA. For what it is worth, this list of assertions stresses the FCA's desire to see firms spending large amounts of money and senior manpower on the problems of money-laundering and bribery control. 

What is a senior manager? 

On the subject of firms using 'management information' (an ill-defined term that refers to all the information about operations that staff can gather together for certain purposes) to combat crime, the FCA stresses its preference for a clear definition of 'senior management roles'. This phrase is always left vague but the report contains a rare moment of specificity in the context of sign-off for business relationships with 'politically exposed persons' and other highly risky customers, where the FCA reveals that it thinks of the money-laundering reporting officer as 'senior management'. It does, however, imply that additional involvement from the head of risk, the chief operating officer and the CEO would be preferable.

The FCA also likes the idea of committees composed of senior people meeting regularly to pinpoint risks and – a well-known FCA favourite – the inclusion of staff compliance with money-laundering and bribery controls in remuneration and staff incentive structures. It dislikes the absence of 'senior management challenge', but leaves the reader to guess what this means.

Risk-assessments also find favour with the FCA, especially when undertaken regularly. It also, rather daringly, mentions board-level involvement in signing-off processes as part of senior managers' jobs. Examples of poor practice include ad hoc risk assessments, a lack of 'dynamism' and the carrying-out of anti-bribery assessments as one-off exercises. 

On the subject of money-laundering controls the FCA thinks that it is 'good practice' for firms to come up with 'a clearly articulated definition of a PEP' (something that the Financial Action Task Force, the world's AML standard-setter, has continually failed to do for the whole of its history and the FCA along with it). It is also keen to see identification and verification information for customers reviewed periodically and 'refreshed', with a special eye on risks. It does not like out-of-date policies and procedures or failure to conduct 'enhanced due diligence' for PEPs, which admittedly is a legal requirement. 

No cash limits for bribe-prone payments 

On the subject of controlling bribery, the regulator is keen to see the rationale for each firm's use of agents and collaborators being documented because these people are thought to be the source of much corruption in financial services. It wants policies surrounding gifts and entertainment to be clear and available for all staff, but stops maddeningly short of giving the regulated community something it has long been crying out for: solid guidelines with concrete cash amounts being mentioned for every generic case. It could have done this in April at its inception; the fact that it is not doing so here is a sign that it never will. 

A right to audit 

The regulator's dislikes, the 'bad practices' of anti-bribery control, seem rather irrelevant in an environment where its guidance is so vague. Once again, the emphasis is on tying up large amounts of senior management time. It thinks it is bad practice, for example, for senior managers not to monitor gifts and entertainment activity consistently. More realistically, it is concerned that firms are not doing enough to monitor the anti-bribery efforts of their associates and counterparties. The FCA notes in the body of the report that contracts with these people ought to contain a 'right to audit' clause.

'Good practice' for training and awareness, according to the regulator, includes the rolling-out of good training to all staff; of even better training to senior managers; of 'tailored' training with a special eye on the business activities of the firm in question; periodic reviews; and above all good records of who has been trained and how. These are obvious common sense, as are the FCA's statements of 'bad practice'. These include a failure to train and involve senior managers; the absence of extra training for new joiners; and the use of training as a one-off exercise.

The tenor of the report might presage a new round of enforcement activity, but the reader is left with a sense that much has been achieved in the past few years in financial crime compliance. It states that most firms in the survey did have “a comprehensive suite of AML policies and procedures approved by senior management.” A few years ago this would have been highly questionable.