Advocates and Registered Legal Practitioners Sector Specific AML/CFT Guidance Notes

Isle of Man Financial Services Authority Version 2 Page 1 of 22 Last updated September 2021 Advocates and Registered Legal Practitioners Sector Specific AML/CFT Guidance Notes September 2021 Whilst this publication has been prepared by the Isle of Man Financial Services Authority, it is not a legal document and should not be relied upon in respect of points of law. Reference for that purpose should be made to the appropriate statutory provisions. Contact: AML/CFT Division Financial Services Authority PO Box 58 Finch Hill House Bucks Road Douglas Isle of Man IM99 1DT Tel: 01624 646000 Email: aml@iomfsa.im Website: www.iomfsa.im

Isle of Man Financial Services Authority Version 2 Page 2 of 22 Last updated September 2021 Contents Version history ........................................................................................................................................3

1. Foreword.........................................................................................................................................4
2. Introduction ....................................................................................................................................5 2.1 National Risk Assessment .......................................................................................................6
3. Risk Guidance..................................................................................................................................6 3.1 General Higher Risk Indicators................................................................................................7 3.2 Red Flags.................................................................................................................................8 3.3 Risk factors specific to the sector ...........................................................................................9 3.3.1 Property purchases.........................................................................................................9 3.3.2 Conveyancing services / mortgage fraud......................................................................10 3.3.3 Client accounts..............................................................................................................11 3.3.4 Commercial work ..........................................................................................................12
4. Legal privilege ...............................................................................................................................13 4.1 Types of legal privilege................................................................................................................14 4.1.1 Legal advice privilege ...........................................................................................................14 4.1.2 Litigation privilege................................................................................................................15 4.2 LPP and how it relates to Due Diligence ...............................................................................15 4.3. Demonstrating compliance with the AML/CFT Legislation whilst respecting legal privilege 16
5. Relevant income ...........................................................................................................................17
6. Case Studies..................................................................................................................................18 6.1 Misuse of client account.......................................................................................................18 6.2 Obscuring ownership ............................................................................................................19 6.3 Mortgage fraud.....................................................................................................................19 6.4 Purchase through intermediaries.........................................................................................20 6.5 Multiple purchase same bank...............................................................................................20 6.6 Powers of attorney ...............................................................................................................21

Isle of Man Financial Services Authority Version 2 Page 3 of 22 Last updated September 2021 Version history Version 2 (September 2021) Updates to reflect changes to the main structure of the AML/CFT Handbook Updates to footnotes to include links in the main body for consistency purposes 2 – update included in relation to latest FATF publication in respect of this sector 2 – update included in respect of the updated national risk assessment 3 – removal of some types of business which the NRA identifies as not a large proportion of the work carried out by the sector, and of some information not specific to the sector, which are covered in the Handbook 4 – update of the legal privilege section 5 – addition of relevant income section 6 – removal of some case studies which were not relevant

Isle of Man Financial Services Authority Version 2 Page 4 of 22 Last updated September 2021

1. Foreword For the purposes of this guidance, the term “legal sector” is the collective term used to describe the businesses detailed in the definition of “legal professional” which is included in Schedule 4 to the Proceeds of Crime Act 2008 (“POCA”). This is defined as follows: “legal professional” means a person who is – (a) an advocate within the meaning of the Advocates Act 1976; (b) a registered legal practitioner within the meaning of the Legal Practitioners Registration Act 1986; (c) a notary public within the meaning of the Advocates Act 1995 and the Notaries Regulations 2004, as those Regulations have effect from time to time and any instrument or enactment from time to time amending or replacing those Regulations; or (d) any other person who provides legal services to third parties, except for any such person who is employed by a public authority or an undertaking which does not provide legal services to a third party, by way of business. When any of the following services are undertaken by a legal professional (as detailed in paragraph 2(6)(h) of Schedule 4 to POCA) the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (“the Code”) applies. (h) subject to sub-paragraph (14), any of the following activity when undertaken by a legal professional – (i) managing any assets belonging to a client; (ii) the provision of legal services which involve the participation in a financial or real property transaction (whether by assisting in the planning or execution of any such transaction or otherwise) by acting for, or on behalf of, a client in respect of – (A) the sale or purchase of land; (B) managing bank, savings or security accounts; (C) organising contributions for the promotion, formation, operation or management of bodies corporate; (D) the sale or purchase of a business; or (E) the creation, operation or management of a legal person or legal arrangement.

Isle of Man Financial Services Authority Version 2 Page 5 of 22 Last updated September 2021 Sub-paragraph 14 of Schedule 4 to POCA states: (14) Sub-paragraph (6)(h) does not apply to a legal professional where the assets belonging to a client being managed represent only advance payment of fees. Also, this sector is included in the Designated Businesses (Registration and Oversight) Act 2015 (“DBROA”) which came into force in October 2015. The Isle of Man Financial Services Authority (“the Authority”) has the power to oversee this sector for Anti-Money Laundering and Countering the Financing of Terrorism (“AML/CFT”) purposes. For the avoidance of doubt, legal professionals who are providing services “in-house” as an employee of an entity that does not fall within the definition of a legal professional are not included in Schedule 4 to POCA or required to register under the DBROA. 2. Introduction The purpose of this document is to provide some guidance specifically for the legal sector in relation to AML/CFT. This document should be read in conjunction both with the Code and the main body of the AML/CFT Handbook (“the Handbook”). Though the guidance in the Handbook, and this sector specific guidance, is neither legislation nor constitutes legal advice, it is persuasive in respect of contraventions of AML/CFT legislation dealt with criminally, by way of civil penalty or in respect of the Authority’s considerations of a relevant person’s (as such a term is defined in paragraph 3 of the Code) regulatory / registered status and the fit and proper status of its owners and key staff where appropriate. This document covers unique money laundering and financing of terrorism (“ML/FT”) risks that may be faced by the sector and provides further guidance in respect of approaches to customer due diligence where it may vary between sectors. This document is based on the FATF Guidance for a Risk Based Approach Legal Professionals June 2019, and the FATF Money Laundering and Terrorist Financing Vulnerabilities of Legal Professionals June 2013. The Authority recommends that relevant persons familiarise themselves with these documents, and other typology reports concerning the legal sector. Also, by way of example, some case studies are included to provide context to the risks of the sector.

Isle of Man Financial Services Authority Version 2 Page 6 of 22 Last updated September 2021 For the purposes of this document the term “customer” is generally used, in line with the Code definition. 2.1 National Risk Assessment The Island’s National Risk Assessment (“NRA”) was published in 2015 and was updated in 2020. Advocates and Registered Legal Practitioners must ensure their business risk assessment (and customer risk assessments, where necessary) take into account any relevant findings of the NRA. The UK is the nearest comparable sectoral jurisdiction to the Isle of Man and law firms operating in London in particular provide a significant source of work for Manx Advocates. The threats and vulnerabilities faced by UK lawyers and solicitors are therefore considered to be relevant to the Isle of Man assessment with the highest inherent vulnerability being the extent and value of the work provided to high net worth customers, some of whom may also be Politically Exposed Persons (“PEPs”). The NRA sets out the main risks and vulnerabilities in further detail. The exposure to Manx Advocates of being at risk of TF is low for both domestic and international services; neither lend themselves particularly effectively to the facilitation of terrorist financing. The ML risk to Advocates is assessed as medium. Registered Legal Practitioners are assessed as being low risk for TF and medium risk for ML. 3. Risk Guidance The legal sector is a broad sector and the ML/FT risks will vary for each firm based on a wide range of factors such as the type of products they supply, their customers and delivery channels. There are a number of different business types in this sector, therefore this document covers some of the general risk factors common to the sector as a whole, focussing on particular individual business types where necessary. The Code mandates that a number of risk assessments are completed –  a business risk assessment (paragraph 5)  a customer risk assessment (paragraph 6)  a technology risk assessment (paragraph 7)

Isle of Man Financial Services Authority Version 2 Page 7 of 22 Last updated September 2021 In order to complete these risk assessments and keep them up-to-date vigilance should govern all aspects of an entities’ dealings with its customers, including:  customer take on;  providing advice to a customer;  customer instructions;  transactions into and out of any customer accounts or client accounts;  ongoing monitoring of the business relationship; and  any outsourced / delegated services. 3.1 General Higher Risk Indicators As with the basic elements of a risk assessment, discussed under chapter 2 of the Handbook, the following activities may increase the risk associated with a relationship. Just because an activity / scenario is listed below it does not automatically make the relationship high risk, the customer’s rationale / nature / purpose of the business relationship etc. should be considered in all cases. If a firm is unable to obtain a satisfactory explanation from a customer in the event of the following situations, features, or activities, or any other features which cause it concerns, it should be determined whether this is suspicious or unusual activity. Please refer to chapter 5 of the Handbook for further detail of the Island’s suspicious activity reporting regime. As stated in paragraph 13 of the Code: 13 Ongoing monitoring (2) Where a relevant person identifies any unusual activity in the course of a business relationship or occasional transaction the relevant person must – (a) perform appropriate scrutiny of the activity; (b) conduct EDD in accordance with paragraph 15; and (c) consider whether to make an internal disclosure. (3) Where a relevant person identifies any suspicious activity in the course of a business relationship or occasional transaction the relevant person must – (a) conduct EDD in accordance with paragraph 15 of the Code, unless the relevant person believes conducting EDD will tip off the customer; and (b) make an internal disclosure. This list of higher risk indicators is by no means exhaustive, and relevant persons should be vigilant for any transactions where suspicion may be aroused and take appropriate measures. Also please see the list of red flags included at 3.2 of this document.

Isle of Man Financial Services Authority Version 2 Page 8 of 22 Last updated September 2021  Where a customer is reluctant to provide normal information or provides only minimal information.  Where a customer’s documentation cannot be readily verified.  The customer is reluctant to provide the firm with complete information about the nature and purpose of the relationship including anticipated activity.  The customer acts through intermediaries such as money managers or advisers in order to conceal their identity.  The customer is located in a higher risk jurisdiction.  Transactions involving numerous jurisdictions.  The customer has no discernible reason for using the firm’s services, or the firm’s location.  The customer is known to be experiencing extreme financial difficulties.  The nature of activity does not seem in line with the customer’s usual pattern of activity.  The customer is a legal person or arrangement that requests services for purposes or transactions which are not compatible with those declared or not typical for those organisations.  Instruction of a legal professional without experience in a particular specialty or without experience in providing services in complicated or especially large transactions.  The customer is prepared to pay substantially higher fees than usual, without legitimate reason.  The customer has changed legal professional a number of times in a short space of time or engaged multiple legal professional without legitimate reason.  The required service was refused by another legal professional or the relationship with another legal professional was terminated.  The customer is using complex structures without providing, or inadequately providing appropriate rationale.  The customer’s transaction pattern suddenly changes in a manner that is inconsistent with the customer’s normal activities or inconsistent with the customer’s profile.  Where the reasons for undertaking a transaction or instruction change during the completion of that matter.  The customer exhibits unusual concern with the firms’ compliance with Government reporting requirements and/or AML/CFT policies and procedures. 3.2 Red Flags In addition to the above higher risk indicators, there are some factors that would automatically be “red flags” in relation to that particular relationship and would therefore usually be suspicious activity. Appropriate steps as explained in section 3 of this document,

Isle of Man Financial Services Authority Version 2 Page 9 of 22 Last updated September 2021 and the Code, must therefore be taken. This list of red flags is by no means exhaustive and is as follows:  where it is identified a customer provides false or misleading information;  where it is identified a customer provides suspicious identification documents;  the customer does not provide the firm with relevant / accurate information about the nature and intended or ongoing purpose of the relationship, including anticipated activity;  the customer is secretive / evasive when asked to provide more information;  when requested, the customer refuses to identify a legitimate source of funds or source of wealth;  the customer refuses to provide details on beneficial owners of an account or provides information which is false, misleading or substantially incorrect;  unexplained changes in instructions, especially at the last minute;  loss making transactions where the loss is avoidable;  the customer enquires about how quickly they can end a business relationship where it is not expected;  where the business relationship is ended unexpectedly by the customer and the customer accepts unusually high fees to terminate the relationship without question;  the customer appears to be acting on behalf of someone else and does not provide satisfactory information regarding whom they are acting for;  the customer is known to have criminal / civil / regulatory proceedings against them for crime, corruption, misuse of public funds or is known to associate with such persons;  the customer asks for short cuts, or unexplained speed, in completing a transaction; and/or  the customer is interested in paying higher charges to keep their identity secret. 3.3 Risk factors specific to the sector The following section of the guidance covers some of the risk factors specifically related to this particular sector. Further guidance surrounding the risk assessments is outlined in chapter 2 of the Handbook. 3.3.1 Property purchases Criminal conduct generates huge amounts of illicit capital and these criminal proceeds need to be integrated into personal lifestyles and business operations. Property purchases are one of the most frequently identified methods of ML.

Isle of Man Financial Services Authority Version 2 Page 10 of 22 Last updated September 2021 Property can be used either as a vehicle for ML or as a means of investing laundered funds. Criminals may buy property both for their own use, e.g. as principal residencies, second homes, as business or warehouse premises, or as investment opportunities to provide additional income. The purchase of real estate is commonly used as part of the last stage of ML. Such a purchase offers the criminal an investment which gives the appearance of financial stability. Retail businesses, especially cash intensive ones, provide a good front for criminal funds where legitimate earnings can be used to disguise the proceeds of crime. There are several factors to consider in relation to property purchases, including purchasing with a false name, purchasing through intermediaries, purchasing through a company / trust and the potential for mortgage fraud. Quick back to back sales are also important to consider as the frequent changes in ownership may make it more difficult for law enforcement to follow the funds and link the assets back to the predicate offence. 3.3.2 Conveyancing services / mortgage fraud Research suggests that of all the services offered by the legal sector, conveyancing is the most utilised function by criminal groups. Conveyancing is a comparatively easy and efficient means to launder money with relatively large amounts of criminal monies “cleaned” in one transaction. In a stable or rising property market, the launderer will incur no financial loss except fees. Conveyancing transactions can also be attractive to money launderers who are attempting to disguise the audit trail of the proceeds of their crimes. As the property itself can be “criminal property”, the legal sector can still be involved in ML even if no money changes hands. Conveyancing staff should be alert to instructions which are a deliberate attempt to avoid assets being dealt with in the way ordered by the court or through the usual legal process. For example, staff may sometimes suspect that instructions are being given to avoid the property forming part of a bankruptcy, or forming part of assets subject to a confiscation order. Specific risk indicators to consider in this area include:  properties owned by nominee companies or multiple owners which could be used to disguise the true ownership;  sudden or unexplained changes in ownership;  where a third party is providing the funding for a purchase; as per paragraphs 8(3)(e) and 11(3)(e) of the Code the firm must ensure they understand and record the reason for this, identify the account holder and on the basis of materiality and risk of ML/FT

Isle of Man Financial Services Authority Version 2 Page 11 of 22 Last updated September 2021 take reasonable measures to verify the identity of the account holder, Further details regarding SOF is at section 3.8 of the Handbook;  how the property is funded, and any funding changes during the transaction, the legal sector should be alert for large payments from private funds, especially if receiving payments from a number of different individuals/ sources; and/or  an unusual sale price may indicate ML. If a firm becomes aware of a significant discrepancy in relation to the sale price this should be appropriately investigated; In addition to the red flags highlighted in section 3.2 of this document, considering conveyancing, firms should be aware of the potential for customers who attempt to mislead a lender to improperly inflate a mortgage advance (mortgage fraud) for example by misrepresenting the borrower’s income, or because the seller and buyer are conspiring to overstate the sale price; and/or the possibility of larger scale mortgage fraud involving several properties/parties to the transactions. The Authority recognises that in a conveyancing transaction there are usually a number of different relevant persons involved. However, each of these relevant persons has their own responsibilities under the Code and they will all see different parts of the transaction and therefore one relevant person may identify unusual or suspicious activity that may not be apparent to the other relevant persons. Vigilance in this area is key, and appropriate action should be taken as explained in section 3 of this document. 3.3.3 Client accounts The use of client accounts has been identified as a potential vulnerability, as it may enable criminals to access the financial system with fewer questions being asked by financial institutions because of the perceived respectability and legitimacy added by the involvement of the legal professional. While the use of the client account is part of many legitimate transactions undertaken by the legal sector, it may be attractive to criminals as it can:  permit access to the financial system when the criminal may be otherwise suspicious or undesirable to a financial institution as a customer;  be used as part of the first step in converting the cash proceeds of crime into other less suspicious assets;  be used as part of a criminal’s layering activity;  serve to help hide ownership of criminally derived funds or other assets; and/or  can be used as an essential link between different techniques that can be used for ML, such as purchasing real estate, setting up shell companies and transferring the proceeds of crime.

Isle of Man Financial Services Authority Version 2 Page 12 of 22 Last updated September 2021 The following situations could give cause for concern:  a customer deposits funds in a legal professional’s client account, but then ends the transaction for no apparent reason;  a customer advises that funds are coming from one source and at the last minute the source changes for no apparent legitimate reason;  a customer requests to use a client account but does not require any underlying legal services;  funding is either partially or wholly from a third party without an appropriate rationale; and/or  a customer unexpectedly (and for no apparent legitimate reason) requests that money received into a firm’s client account be sent back to its source, to the customer or third party. Where a client account is being utilised the rationale should be obtained and this should be monitored on an ongoing basis. Legal professionals should think carefully before disclosing client account details as this allows money to be deposited into a client account without the firm’s knowledge. Legal professionals must ensure that they comply with the client money rules of their professional body. It is important for legal professionals to ensure that they are holding client money for legitimate reasons and not providing a de facto banking service to their customers. 3.3.4 Commercial work The nature of company structures can make them attractive to money launderers, because it is possible to obscure true ownership and protect assets for relatively little expense. For this reason, firms working with companies and in commercial transactions should remain alert throughout their retainers with customers and ensure compliance with the ongoing monitoring provisions of the Code A common operating method amongst serious organised criminals is the use of front companies. These are often used to disguise criminal proceeds as representing the legitimate profits of fictitious business activities. They can also help to make the transportation of suspicious cargoes appear as though they are genuine goods being traded. More often than not, they are used to mask the identity of the true beneficial owners and the source of criminally obtained assets. International reports have highlighted the extent to which private limited companies, shell companies, bearer shares, nominees, front companies and special purpose vehicles have been used in ML operations. Case studies published by FATF have indicated the following

Isle of Man Financial Services Authority Version 2 Page 13 of 22 Last updated September 2021 common elements in the misuse of corporate vehicles:  multi-jurisdictional and/or complex structures of corporate entities and trusts;  foreign payments without a clear connection to the actual activities of the corporate entity;  use of offshore bank accounts without clear economic necessity;  use of nominees and use of shell companies; and / or  tax, financial and legal advisers were generally involved in developing; and/or establishing the structure, in some international case studies legal agents were involved and specialised in providing illicit services for customers. 4. Legal privilege Section 21 of the DBROA states: A person is not under an obligation under this Act to disclose any information subject to legal privilege within the meaning of section 13 (meaning of "items subject to legal privilege”) of the Police Powers and Procedures Act 1998. Legal professionals are not required to disclose items subject to legal privilege to the Authority, or to the Law Society acting under the Authority’s delegated authority. Legal professionals owe a duty to their customers not to disclose items subject to legal privilege under any circumstances without the express consent of their customer. Legal professionals should also be aware of the Legal privilege provisions in the Proceeds of Crime Act 2008, the Terrorism and Other Crime (Financial Restrictions) Act 2014 and the Anti-Terrorism and Crime Act 2003. Items subject to legal privilege are defined by reference to Section 13 of the Police Powers and Procedures Act 1998 ("the PPP Act") as follows: Meaning of "items subject to legal privilege" (1) Subject to subsection (2), in this Act "items subject to legal privilege" means — (a) communications between a professional legal adviser and his client or any person representing his client made in connection with the giving of legal advice to the client; (b) communications between a professional legal adviser and his client or any person representing his client or between such an adviser or his client or any such representative and any other person made in

Isle of Man Financial Services Authority Version 2 Page 14 of 22 Last updated September 2021 connection with or in contemplation of legal proceedings and for the purposes of such proceedings; and (c) items enclosed with or referred to in such communications and made — (i) in connection with the giving of legal advice; or (ii) in connection with or in contemplation of legal proceedings and for the purposes of such proceedings, when they are in the possession of a person who is entitled to possession of them. (2) Items held with the intention of furthering a criminal purpose are not items subject to legal privilege. The statutory definition of legal privilege above identifies that there are two types of legal privilege. One applies whether or not litigation is contemplated or pending, but covers a narrow range of communications (commonly referred to as advice privilege). The other applies only where litigation is contemplated or pending, but extends over a wider range of communications (commonly referred to as litigation privilege). The right to legal privilege is that of the client and not the legal professional of the client. Legal privilege is not lost by the death of the client, but continues to exist for the benefit of the client's successor in title. Legal privilege is a substantive legal principle, and if a client wishes to maintain privilege, this cannot be taken against them. Equally, it is the client's right to waive privilege either entirely, or where appropriately documented, under a limited waiver. If the client is happy to waive privilege, legal professionals cannot object. 4.1 Types of legal privilege 4.1.1 Legal advice privilege Legal advice privilege may be properly claimed in respect of communications between a legal professional in their professional capacity and their client for the purpose of seeking or giving legal advice to the client. It has been established by case law that legal advice is not confined to telling the client the law, and includes advice as to what should prudently and sensibly be done in the relevant legal context. It is important that there is a relevant legal context in order for communications to attract legal professional privilege. It would be too far to extend legal advice privilege without limit to all legal professional and client communications within the ordinary business of a legal professional. However, where there is a relevant legal context to the instruction of the legal professional, legal advice privilege will attract to all communications between the client and the legal professional in connection with the giving of legal advice (Section 13 of the PPP Act).

Isle of Man Financial Services Authority Version 2 Page 15 of 22 Last updated September 2021 Legal advice privilege refers to communications made “in connection with the giving of legal advice to the client”. Sections 13(2) of the PPP Act excludes communications in furtherance of any criminal purpose. It is necessary that a communication in question is confidential in order to attract privilege. 4.1.2 Litigation privilege Litigation privilege covers confidential communications made, after litigation is commenced or even contemplated, between:-  a legal professional and their client;  a legal professional and their non-professional agent; or  a legal professional and a third party; for the sole or dominant purpose of such litigation (whether for seeking or giving advice in relation to it, or for obtaining evidence to be used in it, or for obtaining information leading to such obtaining). It is necessary that a communication in question is confidential in order to attract privilege. Litigation privilege is based on the idea that legal proceedings take the form of a contest in which each of the opposing parties assembles their own body of evidence and uses it to try to defeat the other, with the judge or jury determining the winner. In such a system each party should be free to prepare their case as fully as possible without the risk that their opponent (or any other third party) will be able to recover the material generated by their preparations. 4.2 LPP and how it relates to Due Diligence Part 4 of the Code requires that a legal professional must identify and verify the identity of their customer, including the identity of the beneficial owner. The FATF methodology notes at footnote 66 that “Lawyers, notaries, other independent legal professionals, and accountants acting as independent legal professionals, are not required to report suspicious transactions if the relevant information was obtained in circumstances where they are subject to professional secrecy or legal professional privilege.” Legal professionals should note that the definition of “items subject to legal privilege” within Section 13 of the PPP Act refer to “communications made in connection with legal advice”, and not simply communications for the purpose of giving legal advice. A communication designed to facilitate the obtaining of legal advice from a legal professional, for instance by ensuring compliance with the Code, is likely to be a communication connected with providing

Isle of Man Financial Services Authority Version 2 Page 16 of 22 Last updated September 2021 and obtaining advice, even if the communication in question does not contain the legal advice itself. Lord Carswell, in Three Rivers District Council and Others v Governor and Company of the Bank of England (No 5) (HL) 2005 1 AC 610 approved the principle affirmed in Minter v Priest [1929] 1 KB 655 that “all communications between a solicitor and his client relating to a transaction in which the solicitor has been instructed for the purpose of obtaining legal advice will be privileged, notwithstanding that they do not contain advice on matters of law and construction, provided that they are directly related to the performance by the solicitor of his professional duty as legal advisor of his client.” There is no reason to think that an Isle of Man Court would take a different approach to legal advice privilege in the Isle of Man and such a principle will be highly persuasive in the Isle of Man in the absence of any contrary judgement in the courts of the Isle of Man. That is not to say that all communications between a client and a legal professional are privileged. Case law supports the view that privilege does not extend to all information which a legal professional knows about their client. For example, it has been stated that legal advice privilege does not protect the conveyancing documents by which land is transferred from one person to another, or the client account ledger which a legal professional maintains in relation to their client's money, or any appointment diary or record of time on an attendance note, time sheet or fee record, relating to the client. Nor does it extend to all information which a legal professional knows about their client (in one case it was said that “the privilege does not extend to matters of fact which the attorney knows by any other means than confidential communication with his client, even though if he had not been employed as attorney, he probably would not have known them”). 4.3. Demonstrating compliance with the AML/CFT Legislation whilst respecting legal privilege Although each engagement with a customer should be considered within its own context and on its own merits, information relating to the name of the customer, nationality, date of birth and gender of the customer, identification documents such as passport, driving licence, utility bills or local tax documents, and possibly verification material from third parties, are unlikely to be items subject to legal privilege. Legal professionals will be asked to demonstrate compliance with AML/CFT legislation. Legal professionals must be open and transparent with the Authority (or its delegated bodies, if appropriate) in demonstrating their compliance in respect of these matters, whilst respecting any right to legal privilege which the client is entitled to claim. Information, and any verification documentation, which evidences the identity of a client should rarely cause a problem. More detailed information relating to the nature and

Isle of Man Financial Services Authority Version 2 Page 17 of 22 Last updated September 2021 purpose of the relationship with the client, where such information is also confidential, may, and usually will, attract legal privilege, if the communication attracts litigation privilege and/or is made in connection with seeking advice as to what should prudently and sensibly be done in a relevant legal context. Legal professionals should ensure that the due diligence materials in respect to which a client is entitled to claim legal privilege is kept separate to any due diligence materials which are open to inspection under the DBROA. The procedural paperwork used by legal professional firms to record the nature and purpose of an instruction, or to record the customer's risk assessment, should not contain information which discloses items subject to legal privilege. This does not mean that it is impossible to demonstrate that the nature and purpose of instructions or the customer risk assessment is recorded, for example it may be possible to summarise such matters in a separate record using generic information which does not disclose confidential privilege communications. In this way it may be possible to indicate the nature and purpose of an instruction in general terms, without disclosing confidentially privileged information, but each case will need to be considered on its own merits. It is important to ensure that clients understand the proper boundaries to communications that can and cannot attract legal privilege. Ultimately, if there was to be a challenge to the non-disclosure of information or documentation under the DBROA on the grounds of legal privilege, any proceedings to enforce disclosure would need to involve the client whose right to privilege was being challenged. For this reason it is important that legal professionals properly advise clients as to what information and documents provided as part of the customer due diligence procedures under the Code are likely to be disclosed and to consider what can properly attract a claim to legal privilege and will not be disclosed without the consent from the client. If the legal professional is in doubt as to whether or not communications are subject to legal privilege, and disclosure under the DBROA is requested, the client may need to be advised to take separate legal advice. 5. Relevant income The Anti-Money Laundering and Countering the Financing of Terrorism (Civil Penalties) Regulations 2019 (“the Civil Penalties Regulations”) introduced a civil penalties regime for contraventions of the Code. The Authority maintains the ability to refer the most egregious contraventions to the Attorney General’s Chambers for criminal prosecution. The Civil Penalties Regulations refer to two levels of penalties; Level 1 and Level 2. As set out in the Table of the Schedule to the Regulations, Level 1 penalties can be up to 5% of the relevant person’s income and Level 2 penalties can be up to 8%. Paragraph 3 of the Civil Penalties Regulations define income as:

Isle of Man Financial Services Authority Version 2 Page 18 of 22 Last updated September 2021 all income derived from the relevant person’s business in the regulated sector during the accounting year in which the contravention occurred Businesses within the legal sector should separate their accounts to reflect the income derived from business in the regulated sector and income derived from activity that falls outside the definition of business in the regulated sector. Further details about the Civil Penalties Regulations can be found in the Anti-Money Laundering and Countering the Financing of Terrorism (Civil Penalties) Regulations 2019 Guidance Note. 6. Case Studies The typologies below are real life examples of risks that have crystallised causing losses and/or sanctions (civil and criminal) against the legal professional. These case studies are taken from the FATF Report on Money Laundering and Terrorist Financing Vulnerabilities of Legal Professionals (June 2013). The FATF document contains additional case studies which may be of interest. 6.1 Misuse of client account An employee working in a very small law firm in Australia received an email from a web-based account referring to a previous telephone conversation confirming that the law firm would act on the person’s behalf. The “customer” asked the employee to accept a deposit of AUD260, 000 for the purchase of machinery in London. The “customer” requested details of the firm’s account, provided the surname of two clients of a bank in London, and confirmed the costs could be deducted from the deposit amount. The details were provided, the funds arrived and the “customer” asked that the money be transferred as soon as possible to the London bank account (details provided) after costs and transfer fees were deducted. The funds were transferred, but no actual legal work was undertaken in relation to the purchase of the machinery. The transfer of the funds to the law firm was an unauthorised withdrawal from a third party’s account. This specific case was brought to the attention of the Office of the Legal Services Commissioner (“OLSC”) in Australia, which took the view that the law firm had failed to ensure that the identity and contact details of the individual were adequately established. This was particularly important given the individual was not a previous client of the law firm. The employee – proceeding on the basis of instructions received solely via email and telephone without this further verification of identity – was criticised. The OLSC also found that the law firm failed to take reasonable steps to establish the purpose of the transaction and failed to enquire into the basis for the use of the client account.

Isle of Man Financial Services Authority Version 2 Page 19 of 22 Last updated September 2021 The high risk indicators from this case include:  the customer avoiding personal contact without good reason,  the customer being willing to pay fees without the requirement for legal work to be taken; and  the customer asks for unexplained speed. 6.2 Obscuring ownership A foreign customer approached a legal professional to buy two properties for EUR11 million. The purchase was completely funded by the purchaser who was located in another jurisdiction (there was no mortgage) and the funds were sent through a bank in another jurisdiction. There was a change of instructions as the contract was about to be signed, and a property investment company replaced the original purchaser. The two minor children of the customer were the shareholders of the property investment company. The customer held an important political function in his country and there was publically available information about his involvement in financial wrongdoing. The high risk indicators from this case include:  the legal professional was located at a distance from the customer/transaction and there was no legitimate or economic reason for using this legal professional over one who was located closer;  a disproportionate amount of private funding, which was inconsistent with the socio￾economic profile of the individual;  the client using bank accounts from a high risk country;  unexplained last minute changes in instructions;  use of a complicated structure without a legitimate reason;  shareholders of the executing party under legal age; and  a customer holding a public position and was engaged in unusual private business given the characteristics involved. 6.3 Mortgage fraud An individual in his early 20s who worked as a gardener approached a legal professional to purchase several real estate properties. The customer advised that he was funding the

Isle of Man Financial Services Authority Version 2 Page 20 of 22 Last updated September 2021 purchases from previous sales of other properties and provided a bank cheque to pay the purchase price. The customer then instructed a different set of legal professionals to re-sell the properties at a higher price very quickly after the first purchase. The properties were sold to other people that the client knew who were also in their early 20s and had similar low paying jobs. The customer had in fact obtained mortgages using false documents for these properties, generating the proceeds of crime. The multiple sales helped to launder those funds. The high risk indicators from this case include:  disproportionate amount of private funding which is inconsistent with the socio￾economic profile of the individual;  transactions are unusual because they are inconsistent with the age and profile of the parties;  multiple appearances of the same parties in transactions over a short period of time;  back to back property transaction, with rapidly increasing value;  customer changes legal advisor a number of times in a short space of time without legitimate reason; and  customer provides false documentation. 6.4 Purchase through intermediaries A Canadian career criminal, with a record including drug trafficking, fraud, auto theft, and telecommunications theft, deposited cash into a bank account in his parents’ name. The accused purchased a home with the assistance of a lawyer, the title of which was registered to his parents. He financed the home through a mortgage, also registered to his parents. The CAD 320,000 mortgage was paid off in less than six months. The high risk indicators from this case include:  disproportionate amount of private funding/cash which is inconsistent with the known legitimate income of the individual;  associates of the customer are known to have convictions for acquisitive crime; and  there are attempts to disguise the real owner or parties to the transaction. 6.5 Multiple purchase same bank In 2008 a law firm employee was approached by three individuals who were accompanied by a friend to seek a quote to purchase three separate properties. They returned later that day

Isle of Man Financial Services Authority Version 2 Page 21 of 22 Last updated September 2021 with passports and utility bills and instructed the law firm to act for them in connection with the purchases. The customers asked for the purchases to be processed quickly and did not want the normal searches undertaken. They did not provide any money to the solicitors for expenses (such funds would normally be provided) but said that the seller’s solicitors would be covering all fees and expenses. The customers said that they had paid the deposit directly to the seller. The mortgages were paid to the law firm, which retained their fees and then sent the funds to a bank account which the law firm employee thought belonged to solicitors acting for the sellers. No due diligence was undertaken. In fact the actual owners of the property were not selling the properties and had no knowledge of the transaction or the mortgages taken out over their properties. The mortgage funds were paid away to the fraudsters, not to another solicitors firm. In 2010, the supervising solicitor was fined GBP10,000 for not properly supervising the employee who allowed the fraud to take place and the proceeds of the funds to be laundered. The solicitor’s advanced age was taken into account as a mitigating factor in deciding the penalty. The high risk indicators from this case include:  transaction was unusual in terms of all three purchasers attending together with an intermediary to undertake separate transactions;  failure to provide any funds for expense in accordance with normal processes; and part of the funds being sent directly between the parties;  customer showed an unusual familiarity with respect to the ordinary standards provided for by the law in the matter of satisfactory customer identification; and  customer asked for short-cuts and unexplained speed in completing a transaction. 6.6 Powers of attorney A legal professional was asked to prepare a power of attorney for a customer to give control of all of his assets to his girlfriend, including power to dispose of those assets. The legal professional then prepared a deed of conveyance under which the girlfriend transferred all of the property to the customer’s brother and sister. The legal professional had just secured bail for the customer in relation to a drug trafficking charge. The high risk indicators from this case include:  a power of attorney is sought for the disposal of assets under conditions which are unusual and where there is no logical explanation – it would have to be very

Isle of Man Financial Services Authority Version 2 Page 22 of 22 Last updated September 2021 exceptional circumstances for it to be in the customer’s best interests to allow them to make themselves impecunious;  unexplained speed and complexity in the transaction; and  customer is known to be under investigation for acquisitive crime.