Welcome back to the Regulation & Compliance Office’s fortnightly roundup, where we look at all the latest stories to keep you ahead and informed in the world of law and compliance.
The RACO roundup is just another way in which we keep the solicitors and other law professionals we work with in the know, so we can ascertain you are never missing the vital developments occurring in your profession.
Below you will find the most recent headlines selected by our compliance experts, followed by a Security Section, where we will also give you an overview of the latest scams currently impacting solicitors and their clients.
***
FWRA Failures Leave West Sussex Firm With £10,000 Fine
As published yesterday by the Solicitors Regulation Authority, a firm based in West Sussex was fined for failing to have relevant documentation in place to help prevent money laundering and terrorist financing.
The SRA’s investigators undertook an inspection of the firm to assess its compliance against the MLRs 2017. Concerns were initially raised surrounding the firm’s compliance with requirements for a documented and compliant firm-wide risk assessment (FWRA) and policies, controls and procedures (PCPs).
Following a referral to the SRA’s AML investigation team, the firm was provided with guidance to help remedy and repair regulatory shortcomings, and the firm took immediate action to revise its FWRA (Firm Wide Risk Assessment) and PCPs, as required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017).
The SRA discovered the following:
- In 2020, the firm failed to implement a documented assessment of the risks of money laundering and terrorist financing (to which its business was subject).
- The firm further failed to establish and maintain adequate PCPs to mitigate and manage the risks of money laundering and terrorist financing.
- In 2023, the firm failed to maintain fully compliant PCPs to mitigate and appropriately manage the risks of money laundering and terrorist financing, identified in any Fide Wide Risk Assessment.
In relation to the findings above, the West Sussex firm was in breach of the following:
- Principles 6 and 8 of the SRA Principles 2011.
- Outcomes 7.2 and 7.5 of the SRA Code of Conduct 2011
- (Given the conduct took place after 25 November 2019) Principle 2 of the SRA Principles 2019.
- Paragraphs 2.1(a) and 3.1 of the SRA Code of Conduct for Firms (2019).
As a result, the firm’s conduct was placed in conduct band C, which has a financial penalty of 1.6 per cent to 3.2 per cent of annual domestic turnover. The firm was directed to pay a financial penalty of £10,035 and ordered to pay costs of £1,350.
In assessing the financial penalty, the following mitigating factors were considered:
- The firm fully cooperated with the SRA’s investigation.
- It quickly took remedial action once SRA guidance was provided.
- There was no evidence that harm had materialised as a result of the breaches.
See the full SRA report here.
Compliance Support for Law Firms
At Regulation and Compliance Office (RACO), we have extensive experience in SRA investigations and engagements. We provide guidance at all stages, from the early stages of a self-report or enquiry to dealing with the SRA or the Solicitors Disciplinary Tribunal (SDT).
We will work with you to understand the complaints and help respond appropriately to the SRA and their investigation team, ensuring replies are measured and providing the appropriate documentary evidence, including Firm Wide Risk Assessments.
Whatever the cause or the need to engage with or consider engaging with the SRA, the Regulation and Compliance Office offers a vital service to help firms, whether this is:
- To investigate a breach or alleged breach and provide guidance on whether it is serious and reportable.
- Responding to an enquiry by the SRA
- Responding to and managing an SRA investigation, audit, or referral to the Solicitors Disciplinary Tribunal
- General guidance and support to Law Firm Owners and their Staff
- Attend an SRA interview (recorded or not).
We provide tailored services that deal with:
- SRA Self Reports, Enquiries & Investigations
- Solicitor Disciplinary Tribunal
- Regulatory Settlement Agreements
Regardless of the reason for engagement with the SRA, RACO has helped support multiple Law Firms and Individuals in addressing and overcoming issues. To learn more about Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
***
Long-Serving Solicitor Fined £15,000 for Client Check Failings
Following an investigation by the Solicitors Regulation Authority, a solicitor of 47 years was discovered to have failed to perform due diligence on the third-party account details provided by his client.
As a result, payments were made to a Chinese bank account that is now known not to have any connection with the real owner of the properties. The SRA had been alerted by the solicitor’s own firm. The firm, based in Newcastle, reported concerns to the regulator that it had been involved in a vendor fraud.
The following investigation identified multiple instances where the solicitor is believed to have caused the firm to fall short of Anti-money laundering regulation requirements. A review of nine cases revealed that none had been carried out with an appropriate client and matter risk assessment.
The solicitor in question reportedly failed to adhere to the firm’s policies, controls and procedures in regards to the sales of two irrespective properties, and further omitted to carry out due diligence on client files.
The solicitor confessed to being in breach of the code of conduct, stating solicitors must keep up to date with laws and regulations. On account of the fact that the sale payments were made to non-clients, he also confessed to a technical breach of the rule that prevents client accounts from being used as a banking facility.
In conclusion of the investigation, the SRA announced via their report that the solicitor cooperated throughout. Regardless, the regulator noted that these were significant breaches that had the potential to facilitate money laundering.
Taking account of the solicitor’s experience and that the matter was thought to form a pattern of behaviour, the fine was established halfway between 16% and 40% of his gross annual income.
Accounting for his cooperation and the subsequent efforts made to assist the SRA throughout, he was fined a total of £15,075 and ordered to pay an additional £600 in costs.
Regulation & Compliance: Breaches Recap
- Client & Matter Risk Assessments (CMRA)
Throughout the investigation, the Forensic Investigation Officer (FIO) reviewed nine of the solicitor’s matters that were in scope of the MLRs 2017 and discovered that he had failed to conduct a CMRA, as required by Regulation 28(12)(a)(ii) and Regulation 28(13) of the MLRs 2017.
- Enhanced customer due diligence (EDD)
The FIO also determined that between January 2023 and March 2024, in the matters relating to the sales of two properties, the solicitor failed to carry out EDD as required by Regulation 33 of the MLRs 2017.
- Disregard of the Firm’s Policies, Controls & Procedures (PCPs)
The solicitor admitted to failing to sufficiently understand his obligations under the MLRs 2017. He also failed to abide by his firm’s PCPs in a way that would ensure compliance with the MLRs 2017.
- Client Relationship Monitoring
The solicitor also failed to perform customer due diligence on the third-party account details provided to him, pursuant to his ongoing obligations to monitor the client relationship under Regulation 28(11) of the MLRs 2017. Payments were made to a Chinese bank account not belonging to or having any connection with the true owner of the properties.
Because the name on the bank account was not that of the client of the firm, the solicitor accepted that the payments did not relate to any services provided by the firm to the owner of the account. This resulted in a technical breach of the client account banking facility rule.
Read the full article here.
***
Artificial Intelligence Use in Law Firms – What Should a Law Firm Consider?
Introduction
Artificial Intelligence (AI) is gaining a lot more attention in the legal sector as more Firms turn to forms of AI to assist in a variety of tasks.
Concerns are starting to be raised about the impact of over-reliance on AI and how this may influence poor behaviour and complacency, which could lead to claims.
This article is designed to assist Firms in deciding whether AI is right for them and, if so, how they can control and manage the solutions deployed to remove or at least reduce the risks involved.
Implementing AI tools into your Firm is not a decision to be taken lightly. Insurers are starting to consider the risks associated with the use of AI, and for the first time, they are seeking more information via proposal forms asking questions about its use.
It has to be remembered, at all times, that the final output of advice provided by a Firm is what they will be judged on. Regardless of the research of the source, if the Firm gets it wrong and negligence arises, it does not matter that the AI Solution erred. Only the Firm will be held accountable, and there will be scrutiny of the policies and controls around the use of AI.
How is AI Used In Law Firms?
AI is the use of machines to simulate human intelligence through the use of datasets and algorithms to identify patterns and predict outcomes.
In law firms, Artificial Intelligence (AI) is primarily used to automate repetitive tasks such as document generation, document review, legal research, and analysis. The aim is to allow fee earners to focus more on strategic aspects of client matters by improving efficiency and productivity, whilst also providing insights through predictive analytics based on large data sets of past cases and legal precedents.
Generative AI is often used in law firms to assist with the creation of documents. Generative AI learns from large amounts of data (such as books, articles, and social media posts) and uses it to create content by predicting the most likely information to be used. Generative AI needs to be provided with instructions and can be further trained to improve its accuracy.
The SRA & AI
Currently, there is little guidance offered by the Regulators. However, in 2023, the SRA issued a paper on the Use of AI in the Legal Market –
https://www.sra.org.uk/sra/research-publications/artificial-intelligence-legal-market/.
The SRA’s paper sets out that 60% of larger law firms were at least exploring the use of AI, and 72% of financial service Firms were already engaging with it. The SRA recognises AI is growing rapidly, and as more systems are brought into the market, the more it will get deployed. It claimed to have “an open mind on the systems used, balancing protections for consumers with support for innovation”.
In 2024, we received weekly requests to assist in the drafting of AI-based solutions and policies, and were asked to offer guidance on how to effectively implement risk control AI solutions.
It is clear that AI is becoming increasingly popular, and it is understandable why Firms are considering its usage. However, its implementation must be considered carefully.
The Risks of Using AI
There are various risks to utilising AI. Firms that deploy such systems must implement control measures and issue clear guidance to their staff on how to engage with and use such systems.
- Flaws with the systems (all of which must be addressed) can include (but are not limited to):
- Inaccurate or misleading information being collated and presented.
- Hallucinations – AI can generate incorrect or fabricated information, known as “hallucinations”. AI hallucinations can occur when:
- AI models misapply learned patterns or make confident predictions based on flawed data. These are known as ‘processing errors’.
- AI models don’t understand the context of a prompt or misidentify patterns. This is known as ‘misunderstood context’.
- AI models draw from limited or biased data to generate an output. This is known as ‘limited data’.
- ‘Algorithmic bias’ – AI can be biased if the data used to train it is biased. This can lead to unfair or incorrect outcomes.
- Breach of confidentiality – AI often requires access to large amounts of personal data, which can be mishandled or shared improperly.
- Loss of human interaction – relying too much on AI can damage the Solicitor-client relationship.
- Copyright Issues.
- Failure to follow regulatory requirements by preferring data sets that have not considered the requirements of the regulator.
- Presentation of inaccurate information, which has not been checked (particularly cross-jurisdictional information).
- Insufficiently trained staff.
- Unauthorised sharing of data by the AI solution without the consent of the Firm or the Client, whether deliberate or not.
It is important that ALL FIRMS devise strategies to recognise these risks and implement procedures to ensure all AI solutions are properly managed and controlled.
AI Policy & Controls
If a firm is using AI, it will need a policy which clearly sets out the rules of engagement. Such a Policy will need to cover:
- Officers and Responsibility
- Who does this Policy apply to?
- What is Artificial Intelligence?
- Utilisation of AI in the Firm
- Risks of Using AI in Law Firms
- Use of AI in the Firm
- Risk Management and Control
- Monitoring and Regulation (the Firm and Third Parties)
- Record Keeping
- Training
- Breaches and Reporting
- Register of Approved AI Solutions
Each of these areas considers the key issues and will help set out the appropriate requirements.
Not having a Policy is an error. Allowing staff to use AI solutions without proper approval or sufficient training is to be discouraged. It is, therefore, essential to:
- Understand why AI is needed in your Firm.
- Identify the Benefits.
- Identify what systems will be allowed, and build a list of approved systems.
- Vet and approve the systems
- Ensure staff are trained on its use.
- Decide how you will monitor quality.
- Decide who will supervise the solutions.
- Include AI use as part of standard file review functions.
- Ensure all staff know the rules of engagement.
Allowing AI to be used in the Firm in an uncontrolled way does not address the risks and will expose the Firm to negligence and potential regulatory breaches.
We believe AI has its place in the future of Law, but it must be controlled.
See full article here.
***
SCaM ALERtS
Phone calls misusing the name of Milbank LLP
The SRA has warned that telephone calls have been made misusing the name of a genuine firm of solicitors.
The callers claimed to be a management company and car insurance and warranty provider working with the genuine firm of solicitors.
The callers identified themselves as ID Tech Solutions or Autoprotect.
Please be aware that the SRA authorises and regulates a genuine firm of solicitors called Milbank LLP. The telephone number for the genuine firm’s head office is 02076153000. The firm’s website address is www.milbank.com. The firm’s head office address is 100 Liverpool Street, London, EC2M 2AT.
The genuine firm has confirmed that it has no connection to the telephone calls referred to in the above alert. It has also confirmed that it is not working with ID Tech Solutions or Autoprotect.
*
Fraudulent Emails Misusing the ‘Dunn and Co’ Name
The SRA warned that an email has been sent from a ‘John Brandt’, misusing the name of a genuine firm of solicitors.
The email seen by the SRA advises the recipient that they owe an outstanding balance of £25,000, pushing them to settle the balance promptly to avoid legal action. The email came from the address, ‘johnbrandt.law@gmail.com’.
Please note that the SRA does not authorise or regulate a solicitor by the name of ‘John Brandt’. Any business or transaction through the email address ‘johnbrandt.law@gmail.com’ is not undertaken by a firm or solicitor authorised and regulated by the SRA.
Be aware, however, that the SRA does authorise and regulate a firm of solicitors called Dunn & Co, of which, Stephen Dunn is the sole practitioner. The genuine email address used by the firm is, ‘SDunnlaw@aol.com’.
The genuine firm of Dunn & Co also confirmed that it does not have any connection to the email referred to above.
*
Misuse of the names ‘Paul Edmondson’ and ‘CMS Cameron McKenna Nabarro Olswang LLP’
The SRA has reported to have seen emails falsely claiming to be from Paul Edmondson and CMS Cameron McKenna Nabarro Olswang LLP.
It is understood that these emails were in relation to cryptocurrency trading.
The emails were sent from the email address ‘cmslaw.paul.edmondson@protonmail.com’ and provide a telephone number of ‘+44 7449 209638’.
The emails also provided a postal address of ‘Cannon Place, 78 Cannon Street, London, EC4N 6A’.
Please note that any business or transaction through the above email address or telephone number is not undertaken by an individual or firm of solicitors authorised and regulated by the SRA.
However, the SRA does authorise and regulate a genuine firm of solicitors called CMS Cameron McKenna Nabarro Olswang LLP.
The firm’s genuine head office address is Cannon Place, 78 Cannon Street, London, EC4N 6AF (please note the ‘F’ at the end of the postcode). The firm’s genuine telephone number for its head office address is 02073673000.
The firm’s genuine email domain ends in ‘@cms-cmno.com‘. The SRA also authorises and regulates Paul Hamilton Edmondson, a solicitor at CMS Cameron McKenna Nabarro Olswang LLP.
The genuine firm of CMS Cameron McKenna Nabarro Olswang LLP has confirmed that neither it nor its Paul Edmondson have any connection to the emails referred to above.
BEEN CONTACTED?
Here’s What to Do…
When a firm’s or individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.
You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), maybe required in other circumstances.
Reach Out to RACO
We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions. With our team of professional specialists and our renowned legal expertise, we can work with your firm to always ensure you are never left unprepared in the wake of legal changes or cyber threats. For more information on how we can help, call our consultants on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
