46a Supervisory Report

IAB Anti-Money Laundering Supervision Report 2024 Reporting period: 6th April 2023 – 5th April 2024

Contents Foreword from IAB CEO

03

The IAB as a Professional Body Supervisor

04

Improving Supervisory Effectiveness

05

Supervised population overview and key risk ractors

08

IAB AML Assessment methods

12

Assessment outcomes and themes 2023-2024

14

Supervisory Resources & Support

17

A look ahead to 2024-2025

19

www.iab.org.uk

Foreword Over the past year, the focus at the IAB has been on growth and diversity, illustrating our dedication to expanding these values beyond the business sector to personal development. In 2024, the continued rollout of our proprietary AML practice management tool, AML Complete, has played a crucial role in embodying these values by empowering individuals to effectively manage their AML responsibilities, ensuring consistency, and raising awareness of risk.

Sarah Palmer CEO Institute of Accountants and Bookkeepers

As a Professional Body Supervisor (PBS), we are vigilant about the high-level risks faced by our members. Despite the ongoing uncertainties surrounding the Public Consultation, our unwavering commitment and consistent results highlight the essence of this report: to provide transparency regarding the quality of service we offer. The outcomes of our assessments during this period reflect our dedication, with a notable increase in members achieving Outstanding and Good gradings, along with a decrease in those requiring improvement.

Our implementation of live practice profile reporting through AML Complete has transformed the way information is evaluated, ensuring our practice profiles are more up to date than ever before. Allowing us to be more reactive with our guidance and support. These insights guide our content creation and collaborations with other organisations and panels.

During this reporting period we have collaborated closely with the UKFIU to address underreporting in the sector. Our efforts include conducting thematic reviews on Suspicious Activity Reports (SARs) that have yielded positive outcomes and valuable insights to guide our future support for members. Additionally, we have extended our collaboration with UKFIU through a podcast initiative aimed at educating and involving the broader community in understanding these crucial issues.

In the face of a challenging economic landscape, where small businesses drive the UK economy, the IAB stands firm in its mission to provide relevant guidance and support to our members.

Finance professionals play a critical role in empowering business owners to make informed financial decisions. It is imperative that our members, and the wider industry operate successful and compliant businesses to effectively support the small business community. Our role in achieving this objective is paramount, and we are committed to amplifying our efforts and that of our fellow PBSs with regulators and government stakeholders.

03 | www.iab.org.uk

The IAB as a Professional Body Supervisor The IAB is a Professional Body Supervisor (PBS) listed in the Money Laundering Regulations (MLRs). This enables the organisation to provide the required supervision for the accountancy sector practice of any professional IAB Member or Fellow. In doing so, the IAB is responsible for overseeing the practice’s compliance with the MLRs. Regulation 11(c) of the 2017 Regulations defines an external accountant as someone who provides accountancy services to other persons by way of business. There is no definition given for the term accountancy services. However, His Majesty’s Treasury (HMT) approved industry guidance from Consultative Committee of Accountancy Bodies (CCAB) states: ‘it includes any service which involves the recording, review, analysis, calculation or reporting of financial information and which is provided under arrangements other than a contract of employment.’

Regulation 11(d) of the 2017 Regulations defines tax adviser to include both direct and indirect provision of material aid, assistance, or advice on someone’s tax affairs. This includes any specific tax advice given to clients, including completing and submitting tax returns, advice on whether something is liable to tax, or advice on the amount of tax due.

The IAB offers professional membership to individuals who have completed IAB and other recognised bookkeeping and accountancy qualifications, with three grades of membership to reflect qualification and experience. As part of our gatekeeping role for the profession, all UK IAB members are required to provide a fresh criminal record check (DBS or equivalent) every 12 months. Member grades eligible for applying for supervision of an associate practice are:

Member MIAB

Practical experience is not required to register as a Member, however, certain qualifications are required as a minimum to apply for membership.

Fellow FIAB

In addition to an appropriate level of qualification, applicants need to have five years of practical accounting or bookkeeping experience, including at least 12 months experience of working with a commercial accounting software package.

Together with ensuring that the wider professional standard requirements of professional membership are upheld, promoting member development and providing support resources, the IAB as a PBS is obligated to: Risk assess its population and base supervisory activity on these findings; Effectively monitor its supervised population, ensuring that practices: Conduct appropriate risk assessments as required under the MLRs; and Have in place and implement adequate policies, controls and procedures designed to minimise the risk of exposure to Money Laundering and Terrorist Financing (MLTF);

Make its supervised population aware of developing risks of MLTF that the population might be subject to; Ensure that contraventions of the MLRs are met with proportionate and dissuasive disciplinary measures; Approve Beneficial Owner, Officer or Manager appointments within supervised practices; and Facilitate information sharing between law enforcement and other PBSs enabling them to execute their functions.

04 | www.iab.org.uk

Improving supervisory effectiveness Having achieved technical compliance, the IAB has continued to enhance its effectiveness as an AML supervisor. The following provides an overview of the IABs approach to continue its development across this reporting period.

Engaging IAB supervised practices The MLRs apply to a wide range of professional sectors and undergo frequent amendments, some of which have more relevance to the accountancy sector than others. There is a wide range of practice profiles even within the accountancy sector, from the ‘big 4’ to the ‘kitchen table’ practitioner.

Understandably industry wide guidance must apply to the masses, however, as recognised by the MLRs themselves, a one size fits all approach will not be effective. By having a detailed understanding of our supervised population and the way that they operate, we ensure that the additional guidance and support we offer to IAB supervised practices is directly relevant to our specific supervised population. Coupled with enhanced engagement with professional members, this in turn drives greater engagement by what would otherwise be a neglected group of practitioners.

Investing in supervision Despite the protracted MLR reform consultation, the IAB has forged ahead with its investment in developing its AML online platform, AML Complete. Created as a response to supervisory review findings - where a lack of risk awareness and timely review was commonplace and exacerbated by paper forms – AML Complete ensures that practices are alerted to potential risks and review deadlines within their client base and practice profile.

Whilst the wider approach taken and overall responsibility for compliance remains with the practice, the system promotes risk recognition within a sector that has been found to frequently overlook risk factors in favour of tick box compliance.

The system also permits the IAB to gain a deeper understanding of true risks within its supervised population. This in turn allows a greater focus of resource to support practices, recognise and react to risks appropriately and commit supervisory review resources where they can be most effective.

Being owned and developed by a PBS at the forefront of sectorial risk developments, this platform focuses purely on live AML risk awareness for the benefit of AML effectiveness.

Driving MLR compliance through wider professional standards For a PBS supervised practice, MLR compliance is just one element of a wider set of professional standards requirements. As professional members of the IAB, in addition to the MLR compliance of their practice, members are held accountable for their professional conduct and required to maintain their professional knowledge through CPD. The lack of protected title for accountants and bookkeepers provides an open gateway for abuse. Through our supervisory work, we have seen the correlation in poor MLR compliance standards and practices who have not previously held PBS affiliation whilst in operation. The wider accountability and oversight of PBS affiliation brings a more professional approach to standards across the board.

05 | www.iab.org.uk

Promoting consistency and effectiveness in accountancy AML supervision As one of the accountancy sector PBSs, we sit on numerous AML working groups – including the Accountancy AML Supervisors’ Group (AASG), Anti Money Laundering Supervisors Forum (AMLSF), Intelligence Sharing Expert Working Group (ISEWG) - looking to develop the organisations’ approach to supervision with industry good practice and risk developments.

The strong collaborative approach between the PBS’s means that we all benefit from each other’s innovation and expertise, whilst having the autonomy to ensure the most effective supervisory model for the risks attached to our own population is in place.

Adding value to the wider AML landscape As an AML Professional Body Supervisor, the IAB recognises the valuable role that it can play in the wider objective of reducing the harm of money laundering, terrorist financing and wider economic crime in society. Whilst the IAB has successfully improved the compliance of its supervised population with the requirements of the MLRs, we must still understand where the threat within the sector is most acute, and how best to tackle this. Accountants in business remain unregulated, and the lack of protected title means that a non-PBS affiliated individual could act as an accountant or bookkeeper with no professional experience or accountability.

We are working with our counterparts in education, law enforcement and government, to understand the threat, and how each organisation can individually and collectively take appropriate action to combat it. This includes increasing the wider understanding of the processes, capabilities and limitations of PBS’s, and dispelling myths and misinformation surrounding the sector that hinder effective and collaborative working.

Through this reporting period, we have represented the sector during the formation of the NECC chaired Professional Enablers Strategy, as well as participating in wider actions to support the government’s Economic Crime Plan 2.

Developing intelligence sharing Following on from our 2022 chairmanship of the accountancy Intelligence Sharing Expert Working Group (ISEWG), the IAB has continued to promote the development of intelligence sharing within the sector and between the wider law enforcement community.

As a sector, we have developed a strong ethos of intelligence sharing between PBS’s, seeking to minimise the risk of non-complaint practices evading responsibility by jumping between organisations.

We remain committed to working with law enforcement to support criminal justice outcomes, or to play our part in the reduction of Money Laundering and Terrorist Financing (MLTF) through relevant supervisory activity where appropriate. Whilst the IAB has strong powers to ensure that its members adhere to the organisation’s high standards, we can only take action when we are aware of an issue. We recognise the resourcing and communication complexities within law enforcement, and continue to stand ready for reciprocal engagement. To this end, we look forward to OPBAS making progress in its key objective of facilitating collaboration and information and intelligence sharing between PBSs, statutory supervisors and law enforcement agencies.

06 | www.iab.org.uk

To aid communication with law enforcement, the IAB has a dedicated Single Point of Contact (SPOC) for relevant intelligence sharing, including a secure Criminal Justice Secure Messaging account (CJSM).

Encouraging non-compliance reporting Accountancy and Bookkeeping are respected professions. Those that evade compliant practice or practice without any supervision can cause significant reputational damage to the sector, as well as positioning themselves as a target for being exploited for money laundering.

As required by the Regulations, the IAB provides a path for reporting suspected breaches of the MLRs, including anonymous reporting. The MLRs are designed to reduce the risk of professional practices being exploited by or facilitating criminals laundering the proceeds of their crimes. Failing to apply the requirements of the Regulations increases the opportunity of serious criminal activity being rewarded by enabling their proceeds of crime to enter the legitimate mainstream economy. Failure to identify the red flags of money laundering risks criminal activity that impacts society at large going unreported, often where there is a legal obligation from the professional involved to do so.

Reports of suspected breaches can be summitted across multiple channels, online via the IAB website, by post, and phone. Where an IAB professional member is involved, the IAB will take action. In other cases we will work with the relevant third party supervisor or HMRC, in their role as the statutory supervisor responsible for policing the perimeter.

The reporting channel is open to all, and reports can be submitted in relation to non IAB member practices. Throughout this reporting period the IAB received no reports of actual or potential breaches of the MLRs through this channel.

Drawing accurate findings through a consistent, transparent and accountable process At the heart of our supervisory review process, the IAB has an established a consistent process for assessing fundamental supervisory compliance within its population. To emphasise the required separation of supervisory and advocacy functions within the IAB, the process involves inspections being conducted by independent inspectors, who have no vested interest in the performance of a practice. The majority of these experienced individuals have held their position for over 4 years, conducting nearly 800 inspections between them. The IAB then reviews the inspectors findings, setting any required actions to gain compliance and applying disciplinary measures where needed.

Through this process, the IAB maintains an up to date understanding of the key issues that practices face to prevent compliance, allowing the organisation to respond with updated guidance and support for the whole supervised population. As this also feeds into our wider cross sector work and wider sector representation commentary, the accuracy of findings is paramount. Although exceptionally rare, where practices feel that the inspection findings did not accurately reflect their practice inspection, a clear and independent appeal process is available to ensure that the IAB draws accurate conclusion from its supervisory work.

07 | www.iab.org.uk

Supervised population overview and key risk factors

719

Practices

82% 22%

79% 79% 57% have 1 employee

have less than 50 clients

have a turnover of under £30,000

offer one or more form of tax service offer TCSP as part of an overall service offering as an ASP

99.8% 44% 34%

have less than 10 employees

have less than 10 clients

have a turnover of under £15,000

Key risk factors relevant to the IAB supervised population The National risk assessment of money laundering and terrorist financing 2020 (NRA) risk rates the Accountancy sector as HIGH risk for Money Laundering, and LOW risk for Terrorist Financing.

The NRA states that accountancy and bookkeeping services remain attractive to criminals due to the ability to use them to help their funds gain legitimacy and respectability, as implied by the accountant’s professionally qualified status.

The NRA concludes that accountancy and bookkeeping services are at highest risk of being exploited or abused by criminals when the accountant doesn’t fully understand the money laundering risks and does not implement appropriate risk-based controls.

08 | www.iab.org.uk

The accountancy services considered most at risk of exploitation continue to be: • • •

company formation and termination, mainstream accounting; and payroll.

Bookkeepers and accountants are in prime position to be able to identify these risk indicators through their often-granular work with clients.

Failure to identify ML risk indicators may result in products passed onwards to other Accountancy Sector Providers (ASP’s) or HMRC receiving ‘face value acceptance’, and a lower level of scrutiny because they have been produced by a regulated professional with a requirement to conduct adequate checks.

Assisting supervised practices understanding, identifying and mitigate the risks As highlighted in the NRA, a lack of understanding of risk within the sector is one of the key risks.

We believe this goes beyond a basic lack of risk recognition.

Risk 1: The bigger picture A failure to understand the purpose and relevance of the process. The MLRs apply to a range of sectors and sizes of businesses, from big banks operating globally to kitchen table bookkeepers with a couple of local clients. For many, being told that you are a regulated professional that must apply a 100+ page guidance document, including writing your own policy manuals, moves the focus from understanding and supporting what the process goal is, to desperately trying to get through the process. Within this, practices often lose sight of what they are trying to achieve.

The IAB promotes the bigger picture view of AML. With education at the forefront of what we do we provide a range of real world examples of the damage that ML causes, which supports the importance of compliant practice.

Case Study A practice that had previously undergone a full IAB inspection was reassessed as part of its ongoing monitoring cycle. Several updates to the MLRs had taken place between the two inspections, including the introduction of Companies House discrepancy reporting. Whilst the practice had adopted the changes to the MLRs in practice, the inspection found that the supporting written procedures had not been updated to reflect this good practice. This was addressed through a proportionate action plan, which ensured that the practice achieved technical compliance, as well as effective application of the regulations.

09 | www.iab.org.uk

Risk 2: You can’t see what you don’t understand Failing to understand, and therefore see relevant risks. To appropriately manage risk, practices must first be able to understand the risks that they might be exposed to. With this awareness, practices can recognise those that are present or likely within their own practice.

They can then consider them with an open mind and professional scepticism. Not taking time to invest in this stage means that practices are blinkered to the possibility of risk exposure, or unable to recognise the red flags before them.

Whilst it has its own place, MLR guidance written for the whole sector sometimes does not feel relatable to the practices that we supervise. Equally, reams of generic risk warnings can overwhelm a practice, who will switch off and miss warnings that are relevant.

The IAB has sought to engage its own supervised population by providing resources and guidance that are relevant to the kinds of practice that they run. By explaining the meaning behind risk phrases, outlining how these may be seen in everyday work, and explaining why processes are required by the regulations, practices should recognise that risks are real and aren’t just something that happens to other bigger practices.

Case Study During the transition to IAB Complete, a practice offering purely payroll services stated that they had an insufficient understanding of their clients businesses to be able to complete the online risk assessment due to the limited service that they offered. The practice believed that as they only offered a limited service, they were not required to understand the wider business and that they had previously completed risk assessments on this basis. The IAB was able to explain the requirements of a comprehensive client risk assessment and CDD process, as well as flagging the potential increased risk of limited ongoing monitoring. The IAB ensured that the practice had taken this increased understanding forward and completed a comprehensive risk assessment and CDD review of all clients that it uploaded to the IAB Complete system.

Risk 3: Dealing with risks through relevant process Seeing AML as an afterthought or to be completed as a one-off exercise to then be forgotten about. Taking a tick list approach, often reflected in generic template documents, reflects a practice that has not stopped to think why the task is being completed or if it is relevant to the situation. This in turn renders it virtually meaningless.

We promote practices building AML into the day to day, retaining it at the forefront of their mind, and understanding what tasks seek to achieve. We have worked hard to develop a variety of resources, including our IAB Education series, which allow practices to further develop their understanding of specific areas of the MLRs where needed, as well as providing a broad overview of obligations.

We encourage an open, straight forward line of communication with members on AML as well as having practical implementation as a key topic of discussion through the wider

10 | www.iab.org.uk

support network that we provide. Our IAB Ambassador groups, social media groups, and coffee mornings are platforms for sharing practical experience and supports the wider IAB community in considering relevant, proportionate, and effective processes that they might also adopt.

Case Study A practice enquired with IAB regarding the use of live CDD monitoring and adverse news scanning for all of its clients. Despite having mostly low risk clients with a limited likelihood relevance to such checks, the practice had previously applied this level of electronic monitoring to all of its clients at some significant financial and time cost. The IAB discussed a proportionate approach to ongoing risk management and understanding what the objective of each process in place. In turn, the practice was able to reduce the use of this service to those clients where it was relevant, and invest its resources in more relevant processes for the remaining clients.

Practice engagement expectations Having developed a range of resources, we expect that practices use these to good effect.

Our supervisory oversight programme has included nearly 800 inspections in the past 4 years (April – April), allowing us to see how our supervised practices have engaged with the process. As shown by our supervisory outcome chapter, we have seen a steady increase in compliance by IAB practices over this period. Between 2023-24, 25% of practices inspected received no mandatory action plans, up from 22% the year before and just 3% between 2020-21. This improvement shows that compliant practice is well within grasp for those who are proactive. We understand that some practices will need to address minor non-compliance issues, and we work with these practices through a monitored action plan to ensure they address their issues.

Where practices have failed to engage with the process of compliance effectively, they risk enabling ML through a lack of understanding or implementation of appropriate process. In these cases, we will issue practices with fines, and can refer them to the IAB Adjudication Panel with a recommendation to remove supervision and/or issue fines of up to £50,000.

Case Study Following initial inspection, a large established practice previously unsupervised by the IAB was found to have no AML processes in place, with no application of the regulations evident. Given the scale of failing, the case was sent to the IAB Adjudication Panel, with an action plan put in place to monitor the completion of required actions. The Panel made an order for the member fine in excess of £20,000 to ensure that there is no incentive for ignoring the requirements of the MLRs

11 | www.iab.org.uk

IAB AML Assessment methods As is required by the Regulations, The IAB risk assesses all supervised practices and considers where they should be placed into the ongoing cycle to assess compliance. Not every practice will receive a direct supervisory review each year, and not all practices will be the subject of every assessment method. The most appropriate method to assess a practice’s compliance with the regulation will be chosen, considering the risk factors that we consider appropriate to the practice.

The IAB takes a risk-based approach to its supervisory activity, including selection for full inspection of practices. In addition to considering the risk factors present within a practice – for example, the services offered and client types – we consider the potential impact of compliance failing. The IAB also seeks to identify practices where there is a higher likelihood of active non-compliance, brought to light through a range of indicators. Taking a wholistic view during inspection allocation means that the IAB naturally inspects a range of practices within its risk profile spread each year.

Within the IAB supervised population, the IAB has completed a full inspection of the following percentage of practices per risk category within the past 4 years. Additional supervisory oversight may have been applied to some practices within this period, whilst some practices remain within the assessment window relevant to that risk group since obtaining IAB supervision.

High = 88%

Medium = 84%

Low = 48%

Live practice profile reporting The IAB previously relied upon receipt of the annual application for supervision as an opportunity for a supervised practices to provide us with an accurate up-to-date picture of their practice. By introducing AML Complete, which practices continue to update throughout the year with relevant changes – the IAB can ensure that the practice profile that we hold is as up to date as possible.

Through this we gain an overall understanding of both our whole supervised population and where each individual practice sits within this. We can apply any update to our risk assessment as sector developments occur throughout the year, and as our supervised population changes. This understanding enables us to direct our resources to the most appropriate areas, not only through inspection, but also through development of appropriate support resources and advising practices of relevant risks that they may be subject to.

On-site/Virtual Inspection The IAB has partnered with Compliance and Privacy Solutions LTD (CaPS) to implement its onsite and virtual inspection tool. The inspection model, which has been successfully operational for 4 years, gives the IAB the ability to assess an increased number of supervised practices compliance with the Regulations without geographical restriction and gain a more detailed understanding of their approach to compliance. The content of virtual inspections

12 | www.iab.org.uk

remains the same as onsite inspections. The onsite/virtual inspection is designed to assess a practice’s technical compliance and implementation against the key areas of the MLRs. It is drawn from the accountancy sector guidance offered by CCAB. Inspection findings are reviewed by the IAB and relayed to the member in an inspection report. Gradings of Outstanding, Good, Requires Improvement or Inadequate are applied to each of the categories, with an overall grade reflecting the practices assessed compliance.

Action plans are put in place to ensure practices address any areas of non-compliance that has been found. Completion of these is then monitored throughout the action plan. Where significant non-compliance is found or insufficient improvement throughout an action plan, fixed fines can be applied to the practice, or in cases of extreme non-compliance, the case may be referred to the Adjudication Panel for consideration. In line with the IAB byelaws, the Panel has the power to issue fines of up to £50,000, terminate supervision and membership.

Where a practice has not previously received an IAB supervisory inspection, the inspection will cover the full range of MLR requirements. Having concluded initial inspection, practices re-enter their supervisory cycle and will be subject to ongoing review based on their risk profile. Where a practice is selected for a second inspection, this will focus on reviewing the maintenance of compliant practice previously observed, as well as the adoption of any MLR amendments.

Thematic reviews Thematic reviews, conducted alongside inspections, provide an opportunity for the IAB to gain a greater understanding of the performance of a specific area of compliance. Whilst coupled with the standard requirements for regulatory compliance, the main purpose of this review is to gain an understanding of an issue, rather than to provide a graded assessment.

Through this exercise, we seek to understand if our current risk rating is appropriate and if there are indications of further guidance needed.

Policy and Procedure review These reviews are designed to specifically assess the practices Policy and Procedure documents. The same outcomes of assessment are available as above, with action plans designed to address areas where improvement is required. The Policy and Procedure review is designed to ensure that an appropriately practice specific set of documents are in place. Where the practice has taken time to consider and document appropriate policy and procedure to meet its MLR obligations, rather than for example relying on unedited templates, the practice is more likely to implement these and be compliant with the regulations. By focusing on this area initially, we can ensure that additional practices – particularly those that are newly set up – will have responded to the obligations of the MLRs appropriately in theory. Subsequent inspections where implementation is tested would expect to find a higher level of compliant practice where policy and procedure have been properly considered.

During this period, the IAB moved away from assessing practices policy and procedures with a view to setting action plans. Instead, all new supervisory applicants received a policy and procedures review through the initial onboarding process, the outcome of which could lead to escalation of a full inspection.

13 | www.iab.org.uk

2020-2021

Assessment outcomes and themes 2020-2024

2021-2022 2022-2023 2023-2024

50%

Virtual inspections

45%

Inspections completed

40%

204

35%

176

156

78%

74%

Practices issued with a mandatory action plan

30% 25%

87.5%

96.6%

20%

Practices issued with fines

15%

53

10%

39

6

12

Total fine value

5% 0%

255

£15,000 £6,700 Outstanding

Good

Requires Improvement

£4,463 £30,500

Inadequate

Action Plan reviews Referred to Adjudication Panel

1%

Incomplete at first review, assessed as requiring further active monitoring to ensure completion

2%

Incomplete at first review, assessed as requiring further active monitoring to ensure completion

8.3% 10% 8.3% 10% 11%

18%

23% 83%

Fully completed at first review

78%

59%

100%

Policy and Procedure reviews

90% 80%

Completed reviews

70%

14

60%

36

24

Practices issued with a mandatory action plan

50% 40%

100%

30%

100%

87%

Practices issued with fines

20% 10% 0%

88%

0 Good

14 | www.iab.org.uk

Requires Improvement

Inadequate

0

0

0

Assessment themes Mindset and proactive engagement in the process show strongly across inspections. Practices will not be compliant by chance, and a practice that comes out inadequate in one area will often be graded similarly across the others. Conversely, where we increasingly find practices who have thought through their AML process and made conscious decisions around the processes that fit their practices, they are much more likely to perform well across the board.

The requirements of the MLRs are interlinked, all designed to achieve the end goal of reducing the risk of the practice being used or abused for ML. Positive acceptance of the practices approach feeds into the day-to-day adoption of good practice, which feeds a consistent approach to compliance.

Targeted re-inspections of practices previously assessed have shown positive outcomes, with all practices maintaining the good practices observed or achieved through former action plans.

However, in line with initial inspections, whilst most practices had adopted MLR update requirements in practices, some practices had not updated the policy and procedure documentation to reflect this.

Action plan review periods are set using a risk based approach, therefore the higher the practice risk rating and more issues identified on inspection will result in a shorter initial review period. In some cases, we would not expect a practice to have fully completed their mandatory action plan at the point of initial review. However, this would provide the IAB with an opportunity to ensure that progress is on target. Within this reporting period, we also inspected a number of smaller part time practices, who had less operational time to commit to completing required actions. This process allows us to monitor the successful completion of an action plan within an appropriate period of time for each practice, considering the various risk factors present.

Across the 8 categories assessed through the virtual inspection, the key areas requiring improvement were:

Systems and Controls Including documented policy and procedure.

Themes include: • Overreliance on templates, unread or unedited to suit the practice • Documents not updated to reflect changes to either the regulations or the way the practice operates • A lack of documented procedure to explain how a policy is implemented in practice

Consistent implementation of an appropriate risk management process Themes include: •Inappropriate risk mitigation strategies to address risks identified • A lack of understanding surrounding the risks that have been identified through client and firm risk assessments

15 | www.iab.org.uk

Consistent implementation of an appropriate CDD process Themes include: • CDD checks not addressing relevant risks identified with the client engagement • Misunderstanding of the extent of what electronic CDD checks cover • The provenance of documents not being recorded – copies of documents without date stamps or declarations explaining how they came to be in the CDD file

Consistent implementation of an appropriate monitoring process Themes include: • No or limited evidence of internal review or consideration of the effectiveness of policy and procedures • A lack of awareness of changes to the regulations that impact the practice

Thematic findings During this reporting period, the IAB conducted a thematic review focusing on SAR reporting and quality. The assessment found that where SARs had been reported, they were of good quality. Whilst less of a frequent requirement in the accountancy sector, there was a lower level of knowledge surrounding the potential use of a Defence Against Money Laundering (DAML).

The review also highlighted the MLR anomaly where there is no requirement for a practice to retain evidence of the actual SAR submitted for review.

General inspection findings support that IAB supervised practices have good SAR reporting process in place, however, where practices have additional employees they often lack a documented internal SAR process, despite having a good process in place.

The IAB notes the ongoing stance of the UKFIU in underreporting within the sector. We continue to promote both SAR reporting and SAR quality withing the supervised population. In addition to signposting relevant UKFIU guidance and raising risk awareness, the IAB participated in a UKFIU accountancy sector podcast, aimed at increasing SAR reporting and quality.

16 | www.iab.org.uk

Supervisory resources and support In addition to signposting relevant industry guidance, the IAB has continued to develop specific support material that is relevant to its supervised population. The findings and themes of supervisory activity are used to direct resources where support is needed most.

As the IAB becomes aware of developing industry risk factors, we make all supervised practices aware through direct email to the practice MLRO. Practices receive a whole practice assessment of risk, including a client specific output from the new AML Complete system. This flags potential risks that are present so that the practice can focus resources to areas where they will have the most impact.

Each practice also receives a personalised practice risk summary document, highlighting the specific risks that the practice is likely to be subject to, based on the information provided at the point of refreshing and submitting an updated IAB Complete profile.

Supervised practices can make direct contact with the IAB compliance team where they are unable to find the answers to technical queries using the below resources.

Guidance documents surrounding AML compliance and starting a practice that is AML compliant IAB Education AML training modules, based around the 8 key areas of the MLRs Risk awareness resource library, updated on release of new briefings

AML FAQ’s

AML Specific support stats: IAB AML related social media posts, advising of relatable real-life content

Coffee morning discussion items, allowing a two-way discussion between supervisor and practices

E-newsletter updates, alerting practices to relevant regulatory and risk updates

IAB Ambassador groups, where practices can provide practical support to each other and raise collective questions to the IAB.

17 | www.iab.org.uk

External Resources of note: CCAB – The Anti-Money Laundering and Counter-Terrorist Financing Guidance for the Accountancy Sector, pending HM Treasury approval. This guidance interprets the requirements of the MLRs for accountancy practices, offering clear guidance and examples of application. As official sector guidance for all operating in the accountancy sector, this should be a practices primary resource for compliance with the regulations.

The National risk assessment of money laundering and terrorist financing 2020 (NRA) - The

overall risk assessment of MLTF risks across all sectors within the UK. The accountancy sector is specifically addressed in Chapter 9.

2021 HM Treasury National risk assessment of proliferation financing National Crime Agency - For Suspicious Activity Reports (SAR). Official guidance on how and when to report a SAR, including best practice for submitting a good quality SAR and up to date glossary codes.

The online SAR reporting portal can be accessed through this site.

HMRC – Report a suspected unsupervised practice by completing their online form.

18 | www.iab.org.uk

A look ahead to 2024-2025 With the rollout of AML Complete concluding in 2024, we look forward to developing the potential of the system for both practices and the IAB as a supervisor. This in turn will allow the IAB to refine guidance to those areas most relevant to our supervised populations, and more accurately quantify the potential risk areas present.

Having started the second phase of inspection cycles – the review of practices previously inspected – in 2023, we will continue this process through the next reporting period. With the accumulation of reviews, we will draw greater understanding as to the ongoing performance of IAB supervised practices post initial inspection. Initial reviews have provided a positive indication of performance, however, we continue to explore areas that we can provide greater ongoing support and guidance.

Coupled with the learning drawn from AML Complete and phase two inspections, we will continue to deepen our understanding of our supervised population through thematic reviews.

As ever, additional support material is being developed in response to the findings of all forms of assessment and supervision oversight.

Through our ongoing engagement with the NECC’s Professional Enabler Strategy and other forums, we support the cross-sector approach to enhancing the UK’s effectiveness in combatting MLTF and wider economic crime.

We will also continue to work with other accountancy PBS’s and law enforcement agencies to develop an understanding of relevant risk factors that impact the sector, and provide a consistent level of supervision across the sector.

19 | www.iab.org.uk

110 Bishopsgate London EC2N 4AY United Kingdom Tel: +44 (0)2081 878888 www.iab.org.uk @IAB_social

IAB

@iab_social

IAB

Registered No. 1119378 (England) | Limited by Guarantee