ECSH32825 - Information and documents requested before an intervention

You should request certain information and documents before carrying out a compliance check so you can plan your intervention properly and effectively use your time whilst with the business. 

(This content has been withheld because of exemptions in the Freedom of Information Act 2000)

You will need to establish what records are generated by the business throughout a transaction or a business relationship. The information you gather will help you to understand which business records you need to see to demonstrate the business is complying with The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

Consider the below to help you plan your approach:

  • What paperwork or records are created and where are they kept.
  • Who is responsible for creating and maintaining the records.
  • The nature, quantity and scope of the records that need to be reviewed.
  • Whether any specialist technical skills are needed to help you interpret them, for example, help with a specific accountancy package or IT system – see ECSH33725 for more information.

 

Requesting risk assessment and policies, controls and procedures

In advance of the visit, you should request to see a copy of the business’s written money laundering, terrorist and proliferation financing (ML/TF/PF) risk assessment (RA) and the written anti-money laundering, counter terrorist and proliferation financing policies, controls and procedures (PCPs).

If these are not available, you must establish why.

There may be a number of reasons and you will need to ask further questions to establish:

  • If the documents exist.
  • If the business has carried out a RA and has PCP to mitigate the risk but there are no records in writing.
  • When and how the business assessed the risk of ML/TF/PF in relation to its supervised activities and the information on which it was based.
  • Has the business understood what documents you are trying to request and whether the RA/PCPs are maintained in a different format.
  • Do you need to speak with someone else in the business who is responsible for maintaining the RA and PCPs.
  • Whether the business has a reasonable excuse for not being able to provide the documents.
  • Do you need to postpone the visit, so the business has time to get the documents to you, and to allow time for you to review the documents.

If you do not receive the documents before the visit, see the guidance below titled “What to do if the business does not send you the information requested”.

If the business doesn’t have them in writing, see ECSH33205 and ECSH33210 for more guidance.

 

Requesting sector specific records

The records you need to see will vary on the supervised sector/s of the business and the business model. Guidance regarding how each sector operates and the types of records you are likely to see during a compliance check is in ECSH50000. You should familiarise yourself with the confirmation of visit letter, which sets out the records you will need to see for each sector.

 

Relevant period

You will need to specify the relevant period for the documents you are requesting – see ECSH33705 for guidance on obtaining a representative sample.

 

Time frames to provide information and documents

Once you have decided which information and documents you are requesting in your initial sample, you should have a conversation with the business to confirm a suitable time frame to provide these to you. This is so that it is clear when you can expect to receive the information from the business.

There are some time frames set out in MLR 2017. For example, where further information is requested for a pre-registration visit (see ECSH32600) under regulation 57(3) MLR 2017, it must be provided within 21 days.

Where there is no set time frame set out in MLR 2017, you should assess the time frame on a case-by-case basis. Your request must be reasonable and proportionate to the risk. For example, it would not be reasonable to ask for five years of records with a deadline of providing it to you by the next day.

During your conversation with the business, you could ask questions such as:

  • Is the information and/or documents stored digitally or as paper copies?
  • When would you be able to provide me with the information and/or documents?

You should take the following into consideration:

  • Whether the business asks to send any information by post rather than digitally.
  • Whether the business has any urgent work deadlines such as self-assessment tax returns for an accountancy service provider.
  • Whether the responsible persons or staff members are on holiday/have any holidays or travel planned.
  • Whether the business has the resources to provide all of the information to you - for example, a sole proprietor may find it difficult to pause all of their activities depending on workload and deadlines whereas a compliance officer employed within a larger firm may be able to provide information more quickly.
  • Whether there is anything about their health or personal circumstances that may make it difficult for them to provide you with the documents within the time frame (see ).
  • Whether your own workload would impact being able to review the information when provided by the business - for example you have annual leave booked or other visits.
  • Whether you need to set up a Dropbox for the business to securely upload the information and/or documents (see ECSH33725).

You may need to challenge the business if they state they cannot get the documents to you for longer than you feel is reasonable and may need to see proof of holidays or planned medical interventions where appropriate.

If your primary contact in the business is planning to be absent from the business, consider whether anyone else can provide the records to you.

If you suspect a document doesn’t exist, confirm that with the business and keep a record of the interaction. If you consider the business does not have a valid reason to delay providing records or is being uncooperative, follow the guidance at ECSH33920.

 

Format of the information and documents requested

You should consider what format you request the information in. You should have a conversation with the business regarding their systems, whether the information is stored manually or in a Customer Relationship Management (CRM) system for example.

You also need to consider the sector, for example there is a data capture spreadsheet for Money Service Business money transmitters which you should send to the business for them to fill in. 

Transaction testing sheets for other sectors must not be sent for the business to complete, they are internal documents.

You should consider the ways in which information and documents can be sent to you securely.

Once you have received the requested information, you must review it timely and keep a record of questions you may need to ask the business during your intervention.

 

What to do if the business does not send you the information requested

If the business does not send the documents, or not all of the requested documents have been sent, you should ask the business why, to understand the reason they’ve not been sent. It may be appropriate to issue a notice under regulation 66 MLR 2017.