A regulation 21 independent audit is a requirement for certain regulated businesses under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) in the UK.

But what is regulation 21? Who needs an independent audit under regulation 21 of the MLRs? What does an independent regulation 21 audit involve?

In this blog, our compliance experts answer frequently asked questions about regulation 21 audits.

What is regulation 21 of the Money Laundering Regulations?

Section 21 of the Money Laundering Regulations (MLRs) refers to the internal controls required of relevant persons depending on the size and nature of their business.

This includes appointing a senior person as the business’s Money Laundering Compliance Officer (MLCO)/ Money Laundering Compliance Principal (MLCP)/ AML Compliance Officer (AMLCO) and the screening of employees.

It also requires that certain relevant persons establish an “independent audit function” to review and make recommendations about their firm’s anti-money laundering (AML) policies, controls and procedures.

Regulation 21 of the MLRs states:

Where appropriate, with regard to the size and nature of its business, a relevant person must… establish an independent audit function with the responsibility:

(i) To examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted by the relevant person to comply with the requirements of these Regulations.

(ii) To make recommendations in relation to those policies, controls and procedures; and

(iii) To monitor the relevant person’s compliance with those recommendations.

What happens during a regulation 21 audit?

An independent audit usually involves the following:

• Review of policies, controls and procedures. An auditor will consider AML procedures in place and assess whether they are up to date and accurate.
• Customer due diligence (CDD). The audit will include an assessment of whether effective due diligence occurs.
• Interviews with staff. An independent auditor will conduct interviews with various staff members to check whether employee understand and follow the processes.
• Training. The audit will consider the staff training programmes your firm has in place.
• File review. An auditor will check for evidence of compliance with the firm’s policies.
• Report. An auditor will produce a written report acknowledging good practice and including any recommendations for improvements.

Which firms need a regulation 21 audit under the MLRs?

Any firm regulated under the MLRs may be required to undertake a regulation 21 audit. While the guidelines under the MLRs say that “with the regard to the size and nature of your business” it is generally considered that most regulated businesses should have an independent audit to ensure compliance.

Professional bodies such as the Solicitors Regulation Authority (SRA) and the Institute of Chartered Accountants in England and Wales (ICAEW) provide guidance indicating that sole practitioners with no employees who do not act in association with any other person are exempt from this requirement.

How often do you need a regulation 21 audit?

The MLRs do not stipulate how often firms need to conduct independent regulation 21 audits.

Regulated businesses are expected to adopt a risk-based approach to AML policies and procedures, which means that how frequently a firm undertakes a regulation 21 audit depends on their size, level of risk, and results of any previous audits.

Most firms undertake regulation 21 audits every one to two years.

Compliance Solutions for Regulated Businesses

At the Regulation & Compliance Office (RACO), we can help organisations of all shapes and sizes from across different sectors with regulation 21 audits.

Our experienced compliance officers undertake a review of their policies, controls, and procedures to ensure that they are compliant with AML regulations and, therefore, avoid any breaches.

A review of this nature provides valuable insight into a business when performed correctly. Along with an overview of risk, these crucial assessments also highlight issues within the business, so it is essential to undertake a proper review. All of a company’s building blocks must be considered, including its staff, clients, operations, and finances.

By working with the Regulation & Compliance Office, a business can be assured that we will bring the required level of knowledge and expertise needed to perform the review, which adds value to the business and is not simply a box-ticking exercise. Our team can also provide a full range of services that include:

• Consultancy.
• Compliance Policies.
• Training.
• Handbooks.
• Auditing.

Our services focus on businesses’ anti-money laundering and regulatory requirements through the implementation of effective policies, procedures, training, and consultancy. We also provide continued monitoring of staff and ongoing training to ensure that everyone within a business is aware of the latest requirements and complies with their responsibilities.

We offer a full range of services focused on ensuring businesses across all regulated sectors create, maintain and evidence their compliance with the requirements of their regulators and legislation. We work with businesses of all sizes, from the smaller high street or niche businesses to the large multi-office and multinationals.

Get In Touch

We adopt a sensible and pragmatic approach to fees, ensuring we are competitive and always add value. As necessary, we will agree on packaged services to control cost and enable clients to spread payments to alleviate cash flow, yet ensure services are provided when needed.

If you want to discuss our services in more detail, contact us at 0203 985 8550, email us at info@regulationandcomplianceoffice.co.uk or complete an enquiry form.