25/07/2022
HMRC’s latest annual self-assessment report of its performance reveals seven problem areas that are undermining its effectiveness as an anti-money laundering (AML) supervisor. HMRC is a crucial player in the AML landscape, responsible for supervising key high risk sectors such as estate agents, company formation agents and luxury goods providers.
In its report HMRC points to several improvements across its performance including the number of supervisory interventions made during the year, consistency in the number of suspicious activity reports (SARs) submitted to the UK’s Financial Intelligence Unit and a rise in staff numbers in its ECS unit to justify its compliance rating.
However, the self-assessment also reveals seven substantial performance gaps which need addressing in the year ahead. These include: (1) too much focus on tax in its risk profiling, (2) on-going issues with registering companies (3) problems with recruitment and staff training, (4) poor communication of sectoral guidance to businesses, (5) far fewer on-site reviews, (6) lack of robust sanctions for non-compliance, (7) a radical reduction in size of AML fines.
Background
HMRC has faced criticism in the past as an AML supervisor, with concerns raised over potential conflicts between its role as a tax authority and its ability to discharge its duties effectively as an AML supervisor. As recently as 2018, its former Chief Executive Sir Jonathan Thompson questioned whether its anti-money laundering duties were a ‘bolt on’ rather than a core party of its business.
At the end of 2018, the Financial Action Task Force (FATF) review of the UK’s framework for tackling money laundering found “significant weaknesses” among all supervisors, and specifically recommended that HMRC should consider “how to ensure appropriate intensity of supervision” across all the sectors it regulates. In response to this review, the government committed HMRC, in its 2019 Economic Crime Plan, to “deliver an enhanced risk-based approach” to AML supervision. Under this commitment HMRC is required to undertake an annual self-assessment of its performance benchmarked to the Money Laundering Regulations 2017 (MLR) and Office for Professional Body Anti-money Laundering Supervision (OPBAS) sourcebook standards.
HMRC’s second self-assessment published on June 30th by its Economic Crime Supervision (ECS) team has concluded that it is “compliant” with the MLR as well as standards set by OPBAS in its Sourcebook. This appears to be a step up on last year’s self-assessment in which it concluded that it was “broadly in line” with these standards, while recognising it could improve further.
But in the absence of independent oversight and evaluation by a statutory ‘supervisor of supervisors,’ HMRC is in effect marking its own homework in the form of a self-assessment, although suggestions that this has resulted in a less rigorous review process have been rejected by HMRC’s Director of the Fraud Investigation Service.
In a parallel assessment process, a statutory review by the Treasury into the implementation of the MLR by the UK’s twenty-five AML supervisors, published six days prior to HMRC’s self-assessment, highlights that despite improvements following the 2018 FATF review, HMRC continues to suffer from “a lack of appropriate AML policies controls and procedures.”
HMRC’s performance gaps
The self-assessment revealed the following seven key areas where HMRC will need to improve to raise its game on AML supervision:
1. Risk profiling
AML supervisors are required to have an understanding of specific AML risks faced by businesses they supervise, and to develop a risk matrix based on several data sources (e.g. application data, tax compliance information and businesses’ record with law enforcement).
This risk-based approach to monitoring compliance is an essential component to a fully functioning AML regime but HMRC in its self-assessment discloses that “in many instances too many factors are included in the risk matrix, including occasionally irrelevant information, and the weighting system is not reliable and can give too much weight to tax and tax compliance issues.” In practice this means that its matrix may not provide “a complete picture of the risks presented by a business.”
The lack of alignment between HMRC’s risk matrix and specific AML risks was identified by FATF in its 2018 UK Mutual Evaluation Report when it observed that tax issues “carried too much weight compared to other ML/TF risk factors.” It is concerning that HMRC’s repeated tendency to view AML risks from a more narrow tax perspective instead of considering a broader set of AML risks despite being identified as a weakness in 2018 continues to undermine HMRC’s overall effectiveness as an AML supervisor.
2. Fit and proper testing on MSBs and TCSPs
Regulation 58 of the MLR requires HMRC to carry out fit and proper testing on money service businesses (MSBs) and trust and company service providers (TCSPs) prior to businesses being registered for AML supervision.
This year’s self-assessment reveals that HMRC is failing to keep pace with the requirement to register a business within 45 days, with performance worsening over the year from 78.07% in 2020/21 to 70.71% in 2021/22. This means in practice that more businesses (nearly a third of those who should be registered by HMRC) are operating outside of the scope of its supervision for longer periods than in previous years.
3. Recruitment and Staff training
The assessment hints at substantial issues in the ability of HMRC to recruit and train staff, despite a rise in staff numbers, which may affect its supervisory performance. Regulation 49(2)(a) of the MLR requires supervisors to provide adequate resources to carry out supervisory functions. However, the self-assessment highlights issues in ECS’ recruitment process and delays in appointing staff which have resulted in existing staff members being asked to fill in with training duties.
HMRC accepts that this situation is placing the team “under strain” and “may in part account for higher rates of attrition and staff turnover.” Additionally, there are doubts over the quality of the two-day training offered by the ECS which has left new staff members to begin their roles without required skills.
4. Sectoral guidance
HMRC discloses that there continues to be delays in publishing guidance for businesses under its supervision on the steps required to meet their regulatory obligations as well as on responding to specific money laundering risks. Although difficult to quantify, according to the data in the self-assessment, HMRC is finding it difficult to contact and engage with businesses under its AML supervision.
The average ‘open rate’ of emails sent out as part of HMRC campaigns has dropped from 71.41% in 2019/20 to 38% in 2021/22, with similar falls in the number of participants attending ECS organised AML webinars and views of the relevant AML pages on the Gov.UK webpage. This decline in engagement may well mean that HMRC’s message has already landed with its supervised population, but it could equally suggest that further work is required on its outreach strategy.
5. Desk-based reviews and on-site visits
The MLR requires AML supervisors to use both on-site and off-site supervisory tools to effectively monitor their members. The distribution between the number of desk-based reviews (methods include questionnaires and regular information requests) and on-site visits (interviewing senior management) should be informed by the specific risk factors affecting the AML population.
Despite warning that COVID-19 restrictions have “continued to limit the volume of face-to-face visits conducted,” HMRC statistics show that a downward tendency in the number of on-site visits conducted (from 1,265 in 2018/19 to 817 2019/20) was in already in place before the outbreak of COVID-19 before slumping to 289 in 2021/22. It is unclear which aspects of HMRC’s risk matrix justify an ever decreasing number of on-site visits.
6. Censuring statement & injunction powers
HMRC has not yet used civil powers it has at its disposal to issue censuring statements for failing to comply with the MLR, or injunction powers to prevent a future breach of the MLR. Both these powers are important enforcement tools available to AML supervisors and a duty under Regulation 85 of the MLR.
According to the data, HMRC is much more likely to publish details of non-compliant firms which it did 15 times in 2019/20 rising to 84 in 2021/21. While publication of non-compliance is a positive step and clearly carries reputational risks for individuals and companies, HMRC should be more robust with more egregious offenders and increase the severity of its sanctions through using the full range of the civil powers available to it.
7. Penalties issued for breaches of anti-money laundering rules
In instances where individuals and firms breach the MLR, HMRC has powers under Regulation 76 to impose fines taking into account the size of the business and the nature and severity of the breaches identified. Between the four years reported in the FATF review and in the two years covered by HMRC’s self-assessments (2014/15 to 2021/22), there has been a steady year-on-year increase in the number of financial penalties HMRC has issued for non-compliance, from 10 in 2014/15 to 282 in 2021/22.
While this increase shows signs that HMRC is ramping up its enforcement as a supervisor, this year’s results include substantial downward revisions to penalty amounts – a total of £44.8 million in AML fines issued between 2018/19 and 2021/22 have now been revised down to just £8.6 million.
HMRC explains this downward revision as a result of changing the fine penalty calculation from being based on “the total value of the transactions that breached the Regulations which were processed by the business,” (or the total sums potentially laundered by a business) to be based on profits generated by a company. HMRC states that this change in fine level is “in line with our legal duty to ensure our penalties are proportionate, effective and dissuasive” but it is hard to understand how radically reducing AML fine sizes results in a serious deterrent for its supervised population.
Conclusion – lots of room for improvement
Despite being broadly compliant with its obligations, there are crucial areas HMRC clearly needs to improve on to be an effective AML supervisor. HMRC’s on-going issues with the skewing of risk assessment by tax issues and the failure to tackle egregious offenders with more robust measures such as censuring statements, the drastic decline in penalties imposed, as well as the ongoing recruitment and retention problems it faces, are areas of ongoing significant concern.
If the UK is to have a hope of tackling its £100 billion a year money laundering problem, HMRC as the supervisor of very high risk areas such as luxury goods and estate agents is going to need to significantly up its game.
