Recent data from the Financial Conduct Authority (FCA) sheds
light on whistleblowing reports that the regulator has received
about firms’ anti-money laundering (AML) controls.
UK Whistleblowing Reports
The data, obtained by consultancy firm Accuracy via a Freedom of
Information request, reportedly shows that over the past five
years, employees at finance firms have submitted 141 whistleblowing
reports relating to AML to the FCA. The data also shows that,
during this period, the number of AML whistleblowing reports has
declined. In the 2021 to 2022 period, which is the most recent
period reported on, nine reports were made; down from 25 reports
made the previous year and the peak of 45 reports in the 2018 to
2019 period.
Notwithstanding this decline, the total number of reports over
this period remains significant and shows that the regulator’s
concerns about how firms are handling AML risks are being echoed by
those closest to the action.
What we do not know from this data is how many of these reports
resulted in investigations by the FCA, the specific nature of the
tips, or whether whistleblowers had first taken their concerns to
the relevant firms before reporting to the regulator.
But, with the additional pressures of a U.S. whistleblower law
that provides monetary incentive to tipsters, including UK-based
employees, we anticipate that more AML whistleblower reports will
be made in the coming years. To address this emerging risk, firms
should consider reviewing their policies and procedures to, among
other things, ensure that they have proper internal processes in
place to encourage, receive, and act quickly on internal
reports.
AML as a Priority for the FCA
The decline in AML whistleblowing reports made to the FCA does
not appear to be representative of a significantly improved culture
of AML compliance or a lighter touch from the regulator on AML
issues.
In May 2021, the FCA published a “Dear CEO” letter in
which it set out a number of common AML failings it had identified
and made clear that it would pursue enforcement action where
appropriate. Since that letter was published, the FCA has made good
on its promise. In 2022, the FCA issued its largest fine for these
alleged failings when it imposed a penalty of £107.8 million
on Santander UK PLC for “serious and persistent“
gaps in AML controls across its banking operations. This was
followed by a £7.6 million fine assessed on Guaranty Trust
Bank (UK) Ltd and a £4 million fine assessed on Al Rayan Bank
PLC, both resulting from AML failings.
There are no signs of the FCA slowing down in terms of
enforcement. In its 2023/2024 business plan the FCA said it intends
to lower incidences of money laundering by increasing proactive
assessments of AML controls. Alongside this, the FCA is also
enhancing its enforcement capabilities across the board. As such,
it seems that the FCA has an increased appetite, and soon will have
an enhanced ability, to take enforcement action against firms whose
AML controls are found to be lacking.
Whistleblowing Review
Firms should also be aware of potential changes on the horizon
in the whistleblowing space. The UK government recently announced a
review of the country’s whistleblowing framework, and it is
anticipated that reforms may be implemented to bring UK legislation
more in line with the new EU Whistleblowing Directive, which offers
enhanced protections to whistleblowers. Additionally, an Office of
the Whistleblower is being mooted, to bring the UK in line with
other jurisdictions, such as the U.S. (as described below). The
outcome of the review is due later this year and, if these reforms
are implemented, more employees who are uncomfortable with the way
in which their employers are handing AML compliance may be
encouraged and empowered (and in the case of U.S. regulators,
monetarily incentivized) to speak out.
Lessons to Be Learned
The combination of the newly published whistleblowing figures,
the FCA’s restated focus on AML, and the looming prospect of
whistleblowing reforms should serve as a cue for firms to review
their AML policies and controls to ensure compliance with relevant
regulations.
As a starting point, firms may wish to consider some of the
areas of concern noted in the FCA’s “Dear CEO”
letter, which included generic customer risk assessments,
inadequate customer due diligence measures, and improper
implementation of processes for handing Suspicious Activity
Reports. The two fines issued by the FCA this year also highlight
areas for consideration. The FCA found that Guaranty Trust Bank
(UK) had failed to act on numerous internal and external reviews
which showed continued weaknesses in the bank’s AML controls.
For example, the FCA found that Guaranty Trust Bank (UK) failed to
adequately document customer risk assessments, resulting in a lack
of transparency as to how specific customer risk ratings had been
determined. This was despite the fact that this issue had been
raised previously, including by the FCA, an external consultant,
and the bank’s compliance function. Al Rayan Bank PLC’s
breaches included the failure to implement appropriate procedures
for handling cash deposits and the failure to train staff on
whether cash transactions should be accepted if source-of-funds
information was not provided, despite the bank identifying that
cash transactions presented a high risk of financial crime. For
onboarding purposes, Al Rayan Bank PLC also relied on due diligence
carried out by financial institutions based in the Gulf states,
where the bank was aware that such due diligence would not meet the
standards required under UK regulations. It is notable that a
common factor in both cases was that the issues had been flagged
previously, by people both inside and outside the organization, but
the banks had not taken appropriate remedial action.
Not only should firms be reviewing their AML obligations and
best practices, but they should also ensure that they have in place
appropriate whistleblowing procedures to handle and address any
concerns raised, from either internal or external sources. Training
should be given to ensure that managers know how to approach
disclosures and that retaliation against whistleblowers is
unacceptable. The aim of any firm should be that a whistleblower
can report their concerns to the firm and that these are adequately
dealt with, without the tipster feeling the need to refer the
matter to the regulator.
Developments for AML Compliance and Whistleblowing in the
U.S.
For many companies, whistleblowing developments in the UK will
not be their only concern, as the U.S. has also been making strides
with respect to establishing its own AML whistleblower program. In
2021, Congress passed the Anti-Money Laundering Act (AMLA), which
increased financial rewards for individuals who blow the whistle on
potential anti-money laundering and sanctions violations and made
numerous other enhancements to the U.S. AML laws. Specifically, the
whistleblower provisions of the AMLA provide that any person who
reports original information relating to a violation of anti-money
laundering laws to: (1) an employer; (2) the Secretary of the
Treasury; or (3) the Attorney General, which results in a monetary
sanction of over US$1 million, may be eligible for a financial
reward. The amount of the financial reward will be between 10% and
30% of the monetary sanction collected and will depend on a number
of factors, including the significance of the information and the
degree of assistance provided. The U.S. Congress then further
enhanced this new program by establishing a fund to pay awards and,
significantly, expanding the program to cover violations of U.S.
sanctions laws and regulations.
In addition to these specific AML provisions, recent years have
seen the U.S. Securities and Exchange Commission (SEC) make changes
intended to provide greater incentives for whistleblowers. For
example, in 2020 the SEC implemented a presumption of awarding the
statutory maximum for whistleblowers who provide information that
results in a sanction of US$5 million or less and broadened the
scenarios in which whistleblowers may receive financial rewards to
include deferred prosecution agreements, non-prosecution
agreements, and settlement agreements.
In its most recent Annual Report, the SEC reported that it has
paid whistleblower awards to individuals on six different
continents, and the UK is always in the top three countries from
which it receives whistleblower tips. The SEC recently made a
record-breaking award of US$279 million to a single whistleblower,
news of which will surely cause a wider international awareness of
this U.S. program. The SEC has increased its supervision and enforcement in the AML arena bringing several
settled actions in recent years. Because of the
industry attention to the AMLA whistleblower program, we suspect
that the SEC and other U.S. agencies will continue receiving
AML-related tips this year, which could bolster their enforcement
efforts.
U.S. regulators have been quick to point out the significance of
these whistleblower programs. In April of this year, the Acting
Director of the Financial Crimes Enforcement Network (FinCEN), who
is charged with establishing the AML whistleblower program,
testified that the new whistleblower program could be “a
force-multiplier” for the entire federal government —
most notably, the DOJ and the Department of the Treasury’s
Office of Foreign Assets Control (OFAC) — and a powerful tool
for holding financial institutions accountable for violations of
the BSA and economic sanctions.
Conclusion
The supervisory and enforcement focus on AML compliance in the
financial services arena continues in both the UK and U.S., and the
success of and attention given to the various whistleblower
programs will likely lead to an increase in potential investigative
and enforcement activity. With further developments on the horizon
in both the UK and the U.S., firms should take the opportunity to
ensure they are well placed to comply with relevant regulations and
manage any risks appropriately.
Arnold & Porter has extensive experience in advising on AML
compliance and whistleblower matters in the U.S. and UK. In the
U.S., Arnold & Porter has a leading Securities Enforcement
Defense and Whistleblower Mitigation & Defense team, which
includes Jane Norberg, who is the former SEC Chief of the Office of
the Whistleblower. Arnold & Porter represents clients in
defending against whistleblower actions, conducts internal
investigations, and defends clients to the SEC, the FCA, and other
regulatory and criminal authorities in both the U.S. and the
UK.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
