UK FCA extends annual financial crime reporting obligation (REP-CRIM) to more firms

We take a look at what this means for the new firms in scope, and how they can draw some benefit from this new obligation.

REP-CRIM survey requirements

The FCA first introduced the REP-CRIM in July 2016 for certain firms, including all UK banks and building societies. This currently consists of around 2,500 out of approximately 22,000 firms that the FCA supervises under the Money Laundering Regulations 2017.

The REP-CRIM return provides the FCA with data on firms’ financial crime risks, such as their: (i) high risk jurisdictions and customers, including politically exposed persons (PEPs), (ii) numbers of suspicious activity reports, (iii) sanctions screening and (iv) views on the most prevalent frauds. The FCA’s intention in collecting the data is to assist in its supervision of firms by reflecting "the inherent money laundering risk of a firm". The data collected will, therefore, inform its supervision and, potentially, enforcement strategies.

Extension of REP-CRIM scope to new firms

Last year, the FCA consulted on a proposed increase to the number of firms required to submit the REP-CRIM return. The FCA has now confirmed that it will go ahead with this expansion, with new firms being brought within scope based on their business activities and potential money laundering risks: including:

• Certain FSMA authorised firms falling within the scope of the Money Laundering Regulations 2017 which either (i) hold client money or assets; or (ii) carry out an activity that the FCA considers poses a higher money laundering risk.
• Most payment institutions.
• All electronic money institutions.
• All multi-lateral trading facilities.
• All organised trading facilities.
• All cryptoasset exchange providers and custodian wallet providers.

The extended scope results in an extra c.4500 firms being required to submit the REP-CRIM.

The FCA has now removed home finance mediation firms from the REP-CRIM reporting obligation, and confirmed that general insurance firms/intermediaries will not be required to complete the REP-CRIM, on the basis that neither is within scope of the MLRs.

No change to REP-CRIM requirements for firms already in scope

The substantive information that the FCA requires existing firms to submit will remain the same. So, for firms currently completing the REP-CRIM submission, no significant changes are required.

New firms should start preparing now

For those being brought within scope, the new rules come into force on 30 March 2022 and each firm must submit their REP-CRIM within 60 days of their first Accounting Referencing Date. Those firms should start to prepare internally to ensure that they understand their obligations and the way in which they can collect the required data for the FCA. The extended requirement applies regardless of firm size and largely includes the same information for all firms (although cryptoasset businesses are not required to submit sanctions-specific information, but may do so voluntarily).

Firms can use the FCA’s analysis of the data collected to check their own compliance systems

The REP-CRIM assists the FCA’s work towards a "data-led" and "risk-based" supervisory approach, under which it can focus its resources on firms that carry on activities posing "potentially higher money laundering risks". The FCA can therefore use this data (and combine it with other data that it holds) to identify firms with areas of specific strength or weakness from a financial crime perspective.

Firms should also aim to identify any gaps in their financial crime work when they are collecting and interrogating their data for the FCA, and be mindful that outlier firms may well be the subject of follow up enquiries from the FCA.

In addition, the FCA analyses the results of the REP-CRIM to identify industry-wide threats, trends and averages, as well as market participants’ views on forward-looking trends of expected financial crime risks. This can form a useful basis for firms to compare their own data and consider the adequacy of their own work to combat financial crime, such as their identification of high-risk customers and management of suspicious activity reporting.

The first analysis of REP-CRIM data published by the FCA in November 2018 included:

• Statistics on the number of PEPs and other high-risk customers in the UK, which could be used by the FCA to target firms for additional supervision of AML controls and may be a helpful reference for supervised firms.
• Numbers of internally escalated suspicious cases, external filings with the UK National Crime Agency, and investigative orders and restraint orders received from law enforcement agencies, which each firm could use as a comparison.
• Industry perception of fraud risks (unsurprisingly showing cybercrime at the forefront at that stage) and country risks, which again could be used by firms to compare against their own priority lists.

We have so far only seen high-level data from the first year of the REP-CRIM, as the FCA did not publish an equivalent summary in 2019/2020. The FCA’s Annual Report last year flagged its analysis covering the first three years of data was expected to be published in late 2020, though this timetable has been delayed, potentially due to Covid-19. Any future survey analyses by the FCA will reflect data collected from these new, broader firm types.

Adapting to stricter AML requirements is one of the nine key challenges for in-house counsel identified in Allen & Overy's 2021 Cross-border White Collar Crime and Investigations Review.