Welcome to the first-ever edition of the Regulation & Compliance Office’s fortnightly roundup, where we look at all the latest stories to keep you ahead and informed in the world of law.

The RACO roundup is just another way in which we keep the solicitors and other law professionals we work with in the know, so we can ascertain you are never missing the vital developments occurring in your profession.

Below you will find the most recent headlines selected by our compliance experts, followed by a Security Section, where we will also give you an overview of the latest scams currently impacting solicitors and their clients.

HeadLines

Firm Fined £15,000 for AML Training Failures

A London-based firm has been fined by the Solicitors Regulation Authority following failures in anti-money laundering regulation breaches. 

The £15,200 fine was issued to the southeast firm after the SRA discovered failures to make staff sufficiently aware of its AML requirements. In addition to the relevant training not being provided, the firm also failed to maintain the required AML documents needed for carrying out conveyancing work.

The SRA announced in its report that the firm in question had started conveyancing work as far back as 2017.  In 2020, the regulator contacted the firm to make a declaration about having a risk assessment in place, and the firm responded immediately to communicate that it had not undertaken one.

Following an SRA inspection in November 2022, the supervision team discovered further failures to comply with money laundering regulations. Amongst these failures was the absence of a firm-wide assessment, which hadn’t been in place for almost six years.

The SRA commented that the firm’s conduct was a breach of its regulatory and legislative obligations and that they “persisted for longer than was reasonable”. Failing to fully acknowledge the SRA’s warnings resulted in considerable breaches, particularly when engaged in high-risk work such as conveyancing.

The regulator has now ruled that the firm should be fined 2.4% of its annual domestic turnover, as well as an additional £1,350 in costs. The firm reportedly cooperated with the SRA and its investigation to promptly correct breaches, and no evidence that harm occurred as a result has been made known.

Source: London firm fined £15k for failing to train staff in AML

Compliance For Law Firms

Since October, over 20 firms have been fined for AML regulation failures. With the regulator’s new power to fine up to £25,000, in addition to the new way of calculating fines as a percentage of turnover, sanctions are getting increasingly harsher.

Our Regulation and Compliance Service, including Risk Management and AML Risk, provides a cost-effective but essential solution for law firms to ensure full compliance is achieved.

*

Only 30% of Law Firms Fully Compliant with AML Obligations

The Solicitors Regulation Authority’s 2022/23 anti-money laundering report warns of the reoccurring risks of AML breaches. Here is what you can do to keep your firm compliant.

Between April 2022 and April 2023, the SRA carried out 177 law firm inspections alongside 73 desk-based reviews, which revealed as little as 30% of firms were fully compliant with their AML obligations, and just over half (51%) partially compliant.

Meanwhile, 19% were discovered to be non-compliant, which resulted in corrective or enforcement action.

AML Responsibilities & Tick-Box Mentality

The SRA has also warned that firms should be cautious about the use of “off-the-shelf” AML policies that are not specially tailored to a firm’s unique needs. After announcing that too few firms were taking their AML obligations seriously, the regulator criticised what it phrased as a “tick-box” mentality it had seen from some firms.

Frequent breaches include:

• Insufficient client identification and verification
• Source of funds failures (checks)
• Inadequate training of staff
• Limited or no transaction-monitoring
• Failing to review and update AML policies yearly
• Non-compliant firm-wide risk assessments
• Failing to carry out robust client risk assessments
• Failing to carry out robust matter risk assessments

According to the report, the highest risk area for AML procedural failure was conveyancing, and spot checks were carried out on 23 firms to gather information about compliance with the sanctions regime.

Please note that, over the next year, the SRA will carry out sanction inspections and desk-based reviews to ensure firms are managing their risk and complying with Office of Financial Sanctions Implementation licences.

Source: ‘Off-the-shelf’ AML policies put firms and clients at risk

*

Fine for Solicitor Who Failed to Recognise Cyber Fraud Threat

A solicitor was recently fined by the Solicitors Disciplinary Tribunal for inadequately responding to a fraudulent payment connected to a cyber scam.

It has recently been reported that an experienced solicitor was fined £26,000 in fines and costs in relation to a conveyancing scam, wherein they transferred over £290,000 to a cybercriminal.

Whilst acting for a company on a property sale, the exchange was started with completion arranged for four weeks later. However, between exchange and completion, an email between the solicitor and the client was intercepted. With a day to go before completion, the solicitor received an email from an alternative address stating that the sale proceeds should be transferred to a different account.

In accordance with policy, the solicitor responded to communicate that they would need to confirm with the client via telephone. However, another email was received reconfirming the amended account details, and the solicitor agreed to send the funds.

The bank reportedly notified the solicitor two weeks later to raise concerns regarding the recipient account and, as a result, the client confirmed that no funds had been received. The SDT noted that, despite the bank voicing concern, the solicitor in question only reported the loss to their insurers, supposedly stating that the client seemed “quite relaxed” and didn’t report the matter to the Solicitors Regulation Authority or the police for a further three months. During this time, the missing money was replaced by insurers.

The SRA discovered additional allegations concerning the solicitors’ accounts systems, but paid particular mind to the fact there was a significant breach of the duty to protect client money – the solicitor had sufficient time in which to secure a more substantial confirmation of the change in bank details. The last-minute change in instructions should have been sufficient cause to raise the alarm, given that the solicitor was a conveyancer with considerable experience.

In an outcome agreed on between the SRA and the solicitor, the SDT found the solicitor to be at fault for not suspecting a cyber threat. The SDT also raised concerns on the absence of additional verification measures. Despite there being no evidence of the solicitor’s dishonesty, guidance published by the SRA states that solicitors are expected to report all such cases. This also applies to incidences where fraudulently stolen funds have already been replaced by insurers.

As a result, a fine of £10,000 was issued to the solicitor along with an order to pay costs of £16,000.

Source: Solicitor fined for failing to spot Friday afternoon cyber fraud

Safeguarding Against Cyber Crime

According to the SRA, email modification fraud is currently the most common type of cyberattack and accounts for as much as 68% of reports from 2020. The regulator continues to emphasise the importance of having the appropriate safeguards in place to verify an email sender’s identity. Raising awareness amongst staff and clients continues to be the key defence against this kind of crime, and we at RACO urge all law professionals to consider the following:

• Adequate Training for Staff – Training your staff to identify the signs and communicating with your clients is crucial.
• Contact Identification – Avoid calling numbers involved in suspicious emails. Always try and communicate with clients via telephone or in person.
• Stay Mindful of Requirements – Remember your reporting obligations. If, in any case, you believe a transaction has become suspect, you will have to report to the following immediately: the National Fraud and Cyber Crime Reporting Centre (tel: 0300 123 2040), your professional indemnity insurer, the Solicitors Regulation Authority on 0121 329 6827 (email: fraud@sra.org.uk), and your bank.

IT & Cyber Security Consultancy Service

Whether you require full outsourced IT services or need assistance with a specific project, the Regulation & Compliance Office can assist.

In an ever-changing IT world where new products and services are brought into the sector constantly, it is important to be knowledgeable about the threats to your firm. Cybercriminals use a variety of methods to steal your firm’s data, including phishing, malware and hacking.

If you or your firm has been subject to cybercrime, or wish to take the best preventative measure to safeguard against future threats, reach out to the Regulation and Compliance Office to find out how we can support your law firm. Please call us on 0203 985 8550, or email us at info@regulationandcomplianceoffice.co.uk

IN OTHER NEWS…

*

London Firm Fined Over £12,000

Following an investigation that started in March of 2022, the SRA found that a Pall Mall-based firm had undertaken three conveyancing transactions, on behalf of the partners of the firm or their family members, between 2011 and 2019, meaning that they fell in scope of the Money Laundering Regulations 2017 and 2007.

To read the full SRA report, click here.

*

AML Breaches Land Southampton Firm with £10,000 Fine

The firm was fined £8,964 (with additional costs) for failing to have in place/maintain appropriate documentation to prevent activities relating to money laundering and terrorist financing as required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs 2017).

To read the full SRA report, click here.

*

Solicitor Struck Off After Harvester Bill-Ditch

Solicitor convicted of carrying out a ‘dine and dash’ at a Harvester restaurant has been struck off the roll. 

The SDT judgment said: ‘During the period in which the conduct occurred, she [the solicitor] was practising criminal law, though not working at a regulated entity on the dates of the offences.’

The judgment said the solicitor’s motivation was ‘personal financial gain’ and described the incidents as ‘premeditated and deliberate’. It added that the ‘trust and confidence of the public was seriously diminished when a solicitor committed offences of dishonesty’.

Source: here.

*

Solicitor Ordered to Pay £10,000 Fine for Sexual Misconduct

The SDT assessed the nature of the sexual misconduct and determined that it was not at the highest end of the spectrum such that neither the protection of the public nor the protection of the reputation of the legal profession justified an order striking the respondent from the roll.

The SDT was therefore satisfied that an order suspending the respondent from the roll was proportionate and appropriate to meet the overarching public interest in all the circumstances.

Source: here.

*

CYBER THREATS

SRA warn of telephone calls misusing the name and SRA ID of ‘Luke Denton’ and emails from ‘John Wallace’ of ‘UK International Clearance’

The SRA announced via its website that telephone calls have been made to the public that misuse the name and SRA ID of a genuine solicitor. The caller advised the recipient they were eligible for a mis-selling payout. The recipient was asked to pay a sum of money upfront.

An email seen by the SRA was sent from the email address ‘UKInternationalclearance@gmx.co.uk’, advising the recipient that funds had been received in their name from the Madrid High Court. The recipient was asked to respond back to the email if they wished to accept the offer. The email was signed off with the name John Wallace, who was referred to as a ‘Payment Officer’ and provided the address ‘Regus Business, Liverpool Street, London, WC1’. The email also had an attachment headed ‘International Clearance UK’. Please note the attachment in these emails will likely contain malware.

Please be mindful that the SRA authorises and regulates a solicitor called Luke Andrew Denton with the SRA ID: 660445. Luke Andrew Denton has confirmed that he has no connection to the telephone calls referred to above.

The SRA authorises and regulates a number of solicitors with the name John Wallace, none of whom are believed to have any connection to the email referenced above.

*

Warran Tomson claiming to be a solicitor

The SRA has announced via its website that a member of the public has been in correspondence with ‘Warran Tomson’, who claims to be a solicitor regulated by the SRA and working for ‘Thomas Bakkart’ to help recover money lost through financial investments paid to fraudulent companies.

‘Warran Tomson’ provided the member of the public with a copy of an SRA identity card and a passport. Please be aware that the SRA does not issue identity cards to solicitors, and that any business or transaction with ‘Warran Tomson’ is not undertaken by a genuine firm or solicitor.

*

The identity of Oliver Luke Brown being misused

The SRA has been informed that someone purporting to be a genuine solicitor has been corresponding with the public in relation to financial recovery.

Initial contact was made via WhatsApp, in which the author advised their name was Oliver Brown from the company Brown Ltd, regarding ‘the case of withdrawal the funds from TrustChange’. It advised that their details had sent to it from the ESMA company and that Trust Change was blocking a withdrawal.

A subsequent email was sent to the member of the public from the email address ‘oliver.brown@brown-ltd.eu’, purporting to be from Oliver Brown of the company Brown Ltd. The email included a ‘Call Back line’ of +44 7418355268, a link to a company on Companies House, and a website address of ‘https://brown-ltd.co/’.

Any business or transaction through this email address, telephone number, or website is not undertaken by a genuine firm or solicitor.

Please note that the SRA authorises and regulates a genuine solicitor called Oliver Luke Brown. He works at a genuine firm of solicitors called CMS Cameron McKenna Nabarro Olswang LLP, which is authorised and regulated by the SRA. His genuine email address is Communications@cms-cmno.com. His genuine SRA ID number is 640576.

Oliver Luke Brown has confirmed that neither he nor CMS Cameron McKenna Nabarro Olswang LLP has any connection to the correspondence referred to above.

Been Contacted? Here’s What to Do

When a firm’s or individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.

You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), may be required in other circumstances.

Reach Out to RACO

We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions. With our team of professional specialists and our renowned legal expertise, we can work with your firm to always ensure you are never left unprepared in the wake of legal changes or cyber threats.

For more information on how we can help, call our consultants on 0203 985 8550 or email us at  info@regulationandcomplianceoffice.co.uk