Regulation 18 risk assessment reviews

Every year after conclusion of licence renewals, the IPA carries out a random ‘dip sample’ of Regulation 18 firm risk assessments. The IPA samples approx. 10% of firms that we supervise for AML purposes.

For 2023 we have reviewed 15 risk assessments and whilst most were compliant, six of the assessments reviewed required some urgent amendments to make the assessments compliant with Regulation 18.

The main areas of non-compliance were:

  • Failing to consider emerging high-risk areas as outlined by the IPA – in particular the impact of Covid loan/furlough fraud issues, especially on low value CVL cases – how is the payment of the statement of affair fee being made? Is the appointment being made to avoid repayment of the Covid loan/bounce back loan?
  • Failing to consider any impact from sanctions – not only on potential appointments, but also in respect of distributions or asset sales
  • Needing to consider issues on geographic risk further – the IPA still sees too many Reg. 18 assessments where geography is treated as low risk as all cases are taken that are UK based. There is no consideration of where the appointment is with an entity who is a considerable distance away from the IP’s office You must consider why an individual or a company chooses to appoint an IP who is, for example, 150+ miles or over an hour journey away from them – especially where you have no direct contact with the individual director(s) or the initial approach to your firm is directly to you and you are advised that they found you from an internet search. Why is an individual searching for insolvency advice and decides to seek an appointment via a practitioner a distance from where they are resident?
  • Extending the risk consideration into the ‘worth’ of the entity – this is especially important with MVL cases. Do you know where the assets/cash in bank originated from?

Remember that a Reg 18 risk assessment is not a generic document. The IPA has seen too many assessments that utilise the templates provided by compliance consultants or AML service providers, which are just amended to show a firm’s name and given a current date.

All risk assessments should be unique to a specific firm and deal with the risks that occur in the work that firm carries out.

What is required in a risk assessment can be found here.

The IPA will continue to review Reg 18 assessments as part of all inspection visits – not just AML visits and reviews. It remains vital that you treat your risk assessment as a ‘living document’ and keep it under regular review and update with any new/emerging threats that impact on the work that you carry out.

Members also need to give due consideration of the impact of the changes introduced of Reg 18a concerning the risk assessment of proliferation financing which is often overlooked along with the risks of Terrorist Financing  

Insolvency Practitioners can take several measures to reduce the risks of terrorist financing and proliferation financing in the UK, including:

  • Conducting due diligence: IPs should ensure that their due diligence on clients identifies any potential risks of not just money laundering but also terrorist financing or proliferation financing. This is likely to involve checking clients’ backgrounds, sources of funding, and business activities.
  • Reporting suspicious activities: IPs should report any suspicious activities or transactions to the relevant authorities, such as the National Crime Agency or the Office of Financial Sanctions Implementation. This can include transactions that appear to have no legitimate business purpose or involve high-risk jurisdictions.
  • Maintaining appropriate records: IPs should maintain appropriate records of all transactions and activities related to their clients. This can help to identify any suspicious patterns or activities.
  • Ensuring compliance with regulations: IPs should ensure that they are complying with all relevant regulations and guidelines related to terrorist financing and proliferation financing. This may include the Proceeds of Crime Act 2002, the Terrorism Act 2000 and the Money Laundering Regulations 2017.
  • Providing training and education: IPs should provide training and education to their staff on how to identify and prevent risks of terrorist financing and proliferation financing. This can help to raise awareness of these issues and ensure that staff are equipped to deal with them effectively.