How do I set up the AML process?

Setting up an effective AML process is crucial for firms of all sizes. This article provides detailed information for setting up the AML process, paying specific attention to several pitfalls.

What exactly is an AML process?

The AML process includes all the measures and procedures you take to comply with AML obligations. These are obligations such as:

• Identifying and verifying the identity of clients.
• Reporting suspicious transactions to the relevant authorities.
• Monitoring the client. 

Setting up the AML process 

AML policy

The starting point of an AML process is the AML policy. In it, you record what your process regarding client onboarding and AML compliance looks like. In doing so, answer the following questions: 

• What is our risk policy?
• How do we establish the client's risk profile?  
  
• What information do we request from the client?
• How do we store KYC data securely?
• What information do we check for possible sanctions?
• When can you start providing services? When not?
• How do we monitor ongoing matters? And existing clients? 
• When do we report suspicious transactions to the relevant authorities?
• (From when) Do we need a compliance officer? 

Note!
You will need to think carefully about the roles within the process. Who does what and where does the responsibility lie?

Workflow

You can then visualise the AML process, for example in the form of a workflow. Create a simple overview showing the different steps to be taken by the different roles. This will provide more clarity on what is expected from whom.

Tip: don't make the workflow too detailed. The entire process should be clear to every employee!

The following components are important to include in the workflow:

• Creating a matter for a new client
  • Creating a matter
  • Requesting information from the client
  • Adding information to the matter
• Creating a matter for an existing client
  
  • Creating a matter
  • What information do you already have and is the information up-to-date?
  • Requesting new information from client
  • Adding information to the matter
• Who monitors the clients?
• Who reviews the matters?

Read this article for some tips on drafting AML procedures.  

What are the pitfalls? 

A comprehensive AML process ensures that all AML obligations can be easily met. Nevertheless, there may be some indications that show that the AML process is not yet entirely correct. Below is an overview of possible misunderstandings and common mistakes

No AML policy and/or workflow
Firms that give employees clarity on the AML process logically are in more control of AML than those where employees have their own AML responsibility. With this second option, you quickly see that one person has everything in order, but the other does not. For example, some are very comprehensive in terms of documentation, while others are too concise. If you want to create certain consistency and uniformity, an AML policy or workflow is a step in the right direction.

AML policy is not up to date
Review the AML policy once a year. Include growth of the firm and new positions. Also evaluate whether what is written out on paper is feasible in practice.

AML policy is too extensive
Keep the policy practical and not too elaborate. Ultimately, the goal is to onboard clients quickly and be able to start working for the client. Not to just create exceptions to make it a difficult process. 

Decentralisation  
With decentralisation, each team or firm is responsible for managing its own AML processes. A major disadvantage of this is that inconsistency occurs. For small offices (< 5 lawyers), this may not be such a problem. Then you can easily keep an overview.

When the firm expands, the idea of a centralised function is interesting. Increasingly, we see at large firms that a compliance officer or a central team coordinates the process within the firm. The result: a thought-out AML process and a clear roadmap for employees.

Note: In some cases, hiring a compliance officer is mandatory.

Maintaining client matters manually
Keeping client matters manually is only manageable for small firms. As soon as you fulfil more assignments, you soon find that you lose track. After all, not every client sends in all the information immediately after you make a KYC request. That still requires quite an administrative process to keep up. Then it is not feasible to work with an Excel document and do everything manually. So with a large number of clients, think carefully about how to make monitoring easier. 

The four-eye principle
For a one-person firm, this will be a less relevant tip, but are you with several lawyers? Then make sure you comply with the four-eye principle. Ask each other for input on high-risk cases and thus ensure quality. In addition, in some cases it is also mandatory to have permission from the compliance officer and/or the executive board.