Anti-Money Laundering Controls: the challenges of compliance

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

Recent investigations by the Gambling Commission (the “Commission”) into anti-money laundering (“AML”) failings illustrate the potential pitfalls of compliance for gambling operators, and serve as a timely reminder of the importance of vigilance in this area as the industry braces itself for broader AML regulation.

Lessons from Grosvenor and Meccabingo.com

Investigations were recently completed into the AML weaknesses of Rank Group’s Grosvenor Casinos, following the money laundering conviction of a leading client, and meccabingo.com, in the wake of a customer pleading guilty to defrauding her employers.

The Commission has subsequently highlighted the key lessons to be drawn from these cases, which are chiefly as follows:

• The Commission stressed the need for operators to “take a critical approach to assessing their own policies and procedures and, crucially, whether they are being followed and remain fit for purpose, to avoid generating a false sense of security”. In both cases existing policies were not consistently being complied with nor reviewed for suitability, ultimately leading to the operator’s failings.

• Despite various warning signs, opportunities were missed in both cases to review the established relationships with the customers with little effort being made beyond the initial entry checks. This serves as a reminder that even established customers should be reviewed on a continuous basis, and if necessary, business relationships terminated.

• In the case of Grosvenor, the staff mistakenly believed that a disclosure of suspicious behaviour would provide cover for the business relationship to continue, unless they were informed otherwise. In fact, where suspicion is raised, operators must consider whether continuing a business relationship could put them at risk of committing an offence under the AML regime – operators do not have carte blanche to continue the business relationships on the basis that the relevant authorities have been notified.

• The Commission also found that Grosvenor gave undue weight to the risk of committing the offence of “tipping off” under the Proceeds of Crime Act 2002 (the “POCA”), without balancing this against the risk of committing other POCA offences. The risk of a potential “tipping off” offence should not be used as an excuse to not make basic enquiries of a customer.

Whilst operators should bear in mind the criminal offences that can result in failure to comply with the POCA, Terrorism Act 2000 and Money Laundering Regulations 2007 (the “MLR”), as well as the enforcement powers that the Commission holds, the Rank Group cases help to illustrate alternative ways in which non-compliant companies may be penalised. Whilst there was no official regulatory action from the Commission, the publicity implications for Rank were substantial. The operator proposed a voluntary settlement with the Commission, under which it agreed to the following:

• taking a sum of £950,000 out of the business to be applied for socially responsible purposes, in order to demonstrate that it had not profited as a result of the compliance failures;

• the publication of the Commission’s public statement;

• the establishment of a critical review of its AML and social responsibility controls led by an external party; and

• to disseminate learnings based on its shortcomings through engagement with other gambling operators.

Challenges of AML Compliance

The UK’s AML regime is made up of various pieces of legislation, under which gambling operators – and in particular remote and non-remote casinos – are subject to a range of AML requirements. Whilst all operators are under a duty to be alert to attempts by customers to gamble money acquired unlawfully and to report instances and attempts of money laundering, casinos are currently also required to comply with the MLR, as implemented by the Third Money Laundering Directive (2005/60/EC). These additional requirements in particular can pose challenges in practice, especially in relation to risk sensitive customer due diligence (“CDD”) requirements, the maintenance of policies and procedures regarding risk assessment and management, and appropriate training of staff.

Various limits in practice may also make compliance a challenge for operators:

• Gambling operators, by their nature, deal in a significant volume of transactions. These take place with high frequency, and payments need to be processed quickly, meaning that there is often only a small window of opportunity in which to comply with CDD obligations.

• Gambling transactions are often cash based, meaning that it can be difficult for operators to keep track of cumulative spend of particular individuals and the source of funds for CDD purposes.

• Significant time and resources must also be spent in order to ensure staff are fully trained to recognise high risk behaviour and activity, something which can be overlooked.

As stressed by the Commission, a crucial point to note from these cases is that AML compliance requires continued attention and pro-activity from gambling operators. Merely putting in place appropriate policies and procedures to prevent money laundering will not suffice. Compliance with such internal codes must be regularly monitored, with critical reviews undertaken to ensure they remain fit for purpose. In the same vein, gambling operators need to prioritise continued AML monitoring on a regular basis (even of established customers), and not simply monitor and complete the necessary due diligence at the start of the business relationship.

The 4th Directive

In addition to these challenges, the AML landscape for the gambling industry faces the prospect of further change with the implementation of the Fourth Money Laundering Directive ((EU) 2015/849) which was published in June this year. This will cover all ‘providers of gambling services’, rather than solely casinos. As yet, the exact implications in the UK are unclear (full implementation into domestic law is expected in June 2017), however, with the entire sector coming within the scope of regulated services AML compliance is set to become a hot topic within the industry. As the changes loom closer, operators would be wise to consult with one another and open discourse with the Commission, as well as undertaking risk assessments to identify major areas of weakness.

Further information on AML compliance can be found on the Commission’s website, in particular the Commission’s Guidance for remote and non-remote casinos sets out the requirements of the current regime.

This article is based on an article by Mike Llewellyn and Alasdair Lamb first published on Lexis® PSL Commercial on 21 September 2015.