ECSH32825 - Information and documents requested before an interventation

You should request certain information and documents before carrying out a compliance checkso you can plan your intervention properly and effectively use your time whilst with the business. 

(This content has been withheld because of exemptions in the Freedom of Information Act 2000)

You will need to establishwhat records are generated by the business throughout a transaction or a business relationship. The information you gather will help you to understand which business records you need to see to demonstrate the business is complying with The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017)[Link to ECSH 32820 What to establish]. 

Consider the below to help you plan your approach: 

  • what paperwork or records are created and where are they kept 

  • who is responsible forcreating and maintaining the records 

  • the nature, quantity and scope of the records that need to be reviewed 

  • whether any specialist technical skills are needed to help you interpret them, for example, help with a specific accountancy package or IT system – see [link to ECSH 33725 Records testing – Electronic documents and records] for more information. 

Requesting risk assessment and policies, controls and procedures 

In advance of the visit, you should request to see a copy of the business’s written money laundering, terrorist and proliferation financing (ML/TF/PF)risk assessment (RA) and the written anti-money laundering, counter terrorist and proliferation financing policies, controls and procedures (PCPs). If these are not available, you should establish why. There may be a number ofreasonsand you will need to ask further questions to establish: 

  • if the documents exist 

  • if the business has carried out a RA and has PCP to mitigate the risk but there are no records in writing 

  • when and how the business assessed the risk of ML/TF/PF in relation to its supervised activities and the information on which it was based 

  • has the business understood what documents you are trying to request and whether the RA/PCPs are maintained in a different format 

  • do you need to speak with someone else in the business who is responsible formaintainingthe RA and PCPs 

  • do you need to postpone the visit, so the business has time to get the documents to you, and to allow time for you to review the documents 

If you do not receive the documentsbefore the visit, see the guidance below titled “What to do if the business does not send you the information requested”. 

If the business doesn’t have them in writing, see the guidance titled “What to do if the business confirms there is no risk assessment in writing” at [link to ECSH 33205 Checking risk assessment and management] and “What to do if the business confirms there are no policies, controls and procedures in writing” at [link to ECSH 33210 Establishing policies, controls and procedures]. 

Requesting sector specific records 

The records you need to see will vary on the supervised sector/s of the business and the business model. Guidance regarding how each sector operates and the types of records you are likely to see during a compliance check is in ECSH 50000 Business sectors supervised by HMRC. You should familiarise yourself with the (This content has been withheld because of exemptions in the Freedom of Information Act 2000) letter, which sets out the records you will need to see for each sector. Relevant period  

You will need to specify the relevant period for the documents you are requesting – see [Link to ECSH 33705 Relevant period to test] for guidance on obtaining a representative sample. 

Time frames to provide information and documents 

Once you have decided which information and documents you are requesting in your initial sample, you should have a conversation with the business to confirm a suitabletime frame to provide these to you. This is so that it is clear when you can expect to receive the information from the business.  

There are some timeframes set out in the MLR 2017. For example, where further information is requested for a pre-registrationvisit (see ECSH 32600 Types of Intervention)under Regulation 57(3) of the MLR 2017 [link to ECSH 45800 Requesting further information from a business or responsible person], it must be provided within 21 days. 

Where there is no set time frame set out in the MLR 2017, you should assess the time frame on a case-by-case basis. Your request must be reasonable andproportionate to the risk. For example, it would not be reasonable to ask for five years of records with a deadline of providing it to you by the next day.  

During your conversation with the business, you could ask questions such as: 

  • is the information and/or documents stored digitally or as paper copies? 

  • when would you be able to provide me with the information and/or documents? 

You should take the following into consideration:  

  • whether the business asks to send any information by post rather than digitally [Link to ECSH 32812 By email] 

  • whether the business has any urgent work deadlines such as self-assessment tax returns for an accountancy service provider 

  • whetherthe responsible persons or staff members are on holiday/have any holidays or travel planned 

  • whether the business has the resources to provideall of the information to you - for example, a sole proprietor may find it difficult to pause all of their activities depending on workload and deadlines whereas a compliance officer employed within a larger firm may be able to provide information more quickly 

  • whether there is anything about their health or personal circumstances that may make it difficult for them to provide you with the documents within the timeframe [Link to ECSH 32926 Extra Support]  

  • whether yourown workload would impact being able to review the information when provided by the business- for example you have annual leave booked or other visits 

  • whether you need to set up a Dropbox for the business to securely upload the information and/or documents [Link to ECSH 33725 Electronic documents and records] 

You may need to challenge the business if they state they cannot get the documents to you for longer than you feel is reasonable and may need to see proof of holidays or planned medical interventions where appropriate. If your primary contact in the business is planning to be absent from the business, consider whether anyone else can provide the records to you. If you suspect a document doesn’t exist, confirm that with the business and keep a record of the interaction. If you consider the business does not have a valid reason to delay providing records or is being uncooperative, follow the guidance at ECSH 33920, Dealing with a lack of cooperation. 

Format of the information and documents requested 

You should consider what format you request the information in. You should have a conversation with the business regarding their systems, whether the information is stored manually or in a Customer Relationship Management (CRM) system for example.  

You also need to consider the sector, for example there is a data capture spreadsheet for MSB money transmitters which you should send to the business for them to fill in.(This content has been withheld because of exemptions in the Freedom of Information Act 2000)

You should consider the ways in which information and documents can be sent to you securely [link to ECSH 33725 Electronic documents and records]. 

Once you have received the requested information, you must review it timely and keep a record of questions you may need to ask the business during your intervention. 

What to do if the business does not send you the information requested  

If the business doesnot send the documents, or not all of the requested documents have been sent, you should ask the business why, to understand the reason they’ve not been sent. It may be appropriate to issue a notice under Regulation 66 of the MLR 2017 [link ECSH 71500 MLRs Regulation 66 Power to require information, access or documents].