FATF Guidance for a Risk-Based Approach for Legal Professionals — GFSC — GG

JUNE 2019
GUIDANCE FOR A RISK-BASED APPROACH
LEGAL PROFESSIONALS

The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes policies to protect the global financial system against money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money laundering (AML) and counter-terrorist financing (CFT) standard. For more information about the FATF, please visit www.fatf-gafi.org This document and/or any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. As Citing reference:
FATF (2019), Guidance for a Risk-Based Approach for Legal Professionals, FATF, Paris, www.fatf-gafi.org/publications/documents/Guidance-RBA-legal-professionals.html © 2019 FATF/OECD. All rights reserved. No reproduction or translation of this publication may be made without prior written permission. Applications for such permission, for all or part of this publication, should be made to the FATF Secretariat, 2 rue André Pascal 75775 Paris Cedex 16, France (fax: +33 1 44 30 61 37 or e-mail: contact@fatf-gafi.org) Photocredits coverphoto ©Getty Images

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 1 © 2019 | FATF
TABLE OF CONTENTS
Acronyms ............................................................................................................................................................3
Executive Summary.........................................................................................................................................4
Section 1- Introduction and key concepts...............................................................................................5
Background and context............................................................................................................................................. 5
Purpose of the Guidance............................................................................................................................................. 6
Target audience, status and content of the Guidance .................................................................................... 7
Scope of the Guidance: terminology, key features and business models............................................... 8
Terminology................................................................................................................................................................ 8
Services provided by legal professionals and their vulnerabilities for ML/TF.............................12
Services performed by notaries........................................................................................................................17
FATF Recommendations applicable to the legal professionals ...............................................................17
Section II- The RBA to AML/CFT .............................................................................................................. 19
What is the RBA? .........................................................................................................................................................19
The rationale for the RBA........................................................................................................................................19
Application of the RBA..............................................................................................................................................20
Challenges ......................................................................................................................................................................21
Allocating responsibility under a RBA ...............................................................................................................24
Identifying ML/TF risk..............................................................................................................................................24
Assessing ML/TF risk................................................................................................................................................25
Mitigating and managing ML/TF risk.................................................................................................................25
Developing a common understanding of the RBA.........................................................................................26
Section III – Guidance for legal professionals ..................................................................................... 27
Risk identification and assessment......................................................................................................................27
Country/Geographic risk.....................................................................................................................................29
Client risk...................................................................................................................................................................30
Transaction/Service risk.....................................................................................................................................35
Variables that may influence risk assessment................................................................................................38
Documentation of risk assessments....................................................................................................................41
Risk management and mitigation.........................................................................................................................42
Initial and ongoing CDD (R.10 and 22)..........................................................................................................43
Ongoing monitoring of clients and specified activities (R.10 and 23)..............................................47
Suspicious transaction reporting, tipping-off, internal control and higher-risk countries
(R.23)...........................................................................................................................................................................49
Section IV- Guidance for supervisors..................................................................................................... 54
Risk-based approach to supervision...................................................................................................................54
Supervisors and SRBs’ role in supervision and monitoring..................................................................55
Background: national frameworks and understanding ML/TF risk- the role of countries .........55
Mitigating and managing ML/TF risk.............................................................................................................57
Supervision of the RBA.............................................................................................................................................58

Licensing or Registration.....................................................................................................................................58
Monitoring and supervision ...................................................................................................................................61
Enforcement..............................................................................................................................................................62
Guidance.....................................................................................................................................................................62
Training.......................................................................................................................................................................63
Endorsements ..........................................................................................................................................................63
Information exchange...........................................................................................................................................63
Supervision of beneficial ownership and source of funds/wealth requirements............................64
Sources of funds and wealth ..............................................................................................................................66
Nominee arrangements............................................................................................................................................66
Annex 1: Beneficial ownership information in relation to a trust or other legal
arrangements to whom a legal professional provides services................................................... 69
Annex 2: Sources of further information.............................................................................................. 74
Annex 3: Glossary of terminology ........................................................................................................... 79
Annex 4: Supervisory practices for implementation of the RBA ................................................. 82
Annex 5: Examples of Red flags highlighting suspicious activities or transactions for
legal professionals ........................................................................................................................................ 92
Annex 6: Members of the RBA Drafting Group ................................................................................... 94

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 3 © 2019 | FATF Acronyms AML/CFT Anti-money laundering/Countering the financing of terrorism CDD Client1 due diligence DNFBP FIU Designated non-financial businesses and professions Financial intelligence unit INR. Interpretive Note to Recommendation ML Money laundering MLRO Money Laundering Reporting Officer PEP Politically Exposed Person R. Recommendation RBA Risk-based approach SRB STR Self-regulatory body Suspicious transaction report TCSP TF Trust and company service providers Terrorist financing 1 In some jurisdictions or professions, the term “customer” is used, which has the same meaning as “client” for the purposes of this document.

Executive Summary

The risk-based approach (RBA) is central to the effective implementation of
the FATF Recommendations. It means that competent authorities, supervisors and legal professionals should identify, assess, and understand the money laundering and terrorist financing (ML/TF) risks to which legal professionals are exposed, and implement appropriate mitigation measures. This approach enables allocation of resources where the risks are higher.
The FATF RBA Guidance aims to support the implementation of the RBA,
taking into account national ML/TF risk assessments and AML/CFT legal and regulatory frameworks. It includes a general presentation of the RBA and provides specific guidance for legal professionals and for their supervisors. The Guidance was developed in partnership with the profession, to make sure it reflects expertise and good practices from within the profession.
The Guidance acknowledges that legal professionals operate within a wide
range of business structures - from sole practitioners to large, multi-national firms and provide a variety of services in different jurisdictions. Given the diversity in scale, activities and risk profile, there is, therefore, no one-size-fits-all approach.
The development of the ML/TF risk assessment is a key starting point for the
application of the RBA. It should be commensurate with the nature, size and complexity of the law firm. The most commonly used risk criteria are country or geographic risk, client risk and service/transaction risk. The Guidance provides examples of risk factors under these risk categories.
The Guidance highlights that it is the responsibility of the senior management
of legal professionals to foster and promote a culture of compliance. They should ensure that legal professionals are committed to manage ML/TF risks when establishing or maintaining relationships.
The Guidance highlights that legal professionals should design their policies
and procedures so that the level of initial and ongoing CDD measures addresses the ML/TF risks to which they are exposed. The Guidance thus explains the obligations for legal professionals regarding identification and verification of beneficial ownership information and provides examples of standard, simplified and enhanced CDD measures based on ML/TF risk.
The Guidance has a section for supervisors of legal professionals and
highlights the role of self-regulatory bodies (SRBs) in supervising and monitoring. It explains the RBA to supervision as well as supervision of the RBA by providing specific guidance on licensing or registration requirements for the profession, mechanisms for on-site and off-site supervision, enforcement, guidance, training and the value of information-exchange between the public and private sector.
The Guidance highlights the importance of supervision of beneficial
ownership requirements and nominee arrangements. It underscores how supervisory frameworks can help ascertain whether accurate and up-to-date beneficial ownership information on legal persons and legal arrangements is maintained and made available in a timely manner.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 5 © 2019 | FATF
Section 1- Introduction and key concepts
This Guidance should be read in conjunction with the following, which are available on the FATF website: www.fatf-gafi.org. a) The FATF Recommendations, especially Recommendations 1, 10, 11, 12, 17, 19, 20, 21, 22, 23, 24, 25 and 28 and their Interpretive Notes (INR), and the FATF Glossary b) Other relevant FATF Guidance documents such as:

The FATF Guidance on National Money Laundering and Terrorist
Financing Risk Assessment (February 2013)
FATF Guidance on Transparency and Beneficial Ownership
(October 2014)
FATF Guidance on the Risk-Based Approach for Trust and Company
Service Providers (TCSPs) (June 2019)
FATF Guidance on the Risk-Based Approach for Accountants (June
2019) c) Other relevant FATF reports such as:
FATF Report on Money Laundering and Terrorist Financing:
Vulnerabilities of Legal Professionals (June 2013)
The Joint FATF and Egmont Group Report on Concealment of
Beneficial Ownership (July 2018)
Background and context

The RBA is central to the effective implementation of the revised FATF
International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, which were adopted in 20122. The FATF has reviewed its 2008 RBA Guidance for Legal Professionals, in order to bring it in line with the new FATF requirements3 and to reflect the experience gained by public authorities and the private sector over the years in applying the RBA. This revised version applies to legal professionals when they prepare for, or carry out, transactions for their clients concerning certain specified activities4 . 2 FATF (2012). 3 The FATF Standards are comprised of the FATF Recommendations, their Interpretive Notes and applicable definitions from the Glossary. 4 The services provided by legal professionals include those provided by both lawyers and notaries, and these services are included under bullet (e) of the definition of “Designated nonfinancial businesses and professions” in the FATF Glossary. For details about specified activities of legal professionals under R.22 and other FATF Recommendations applicable to the legal professionals, please refer to paragraph 20 of this Guidance.

This Guidance was drafted by a project group comprising FATF members and
representatives of the private sector. The project group was co-led by the UK, the United States, the Institute of Chartered Accountants in England and Wales, the International Bar Association and the Society of Trust and Estate Practitioners. Membership of the project group is set out in Annex 5.
The FATF adopted this updated RBA Guidance for legal professionals at its
June 2019 Plenary.
Purpose of the Guidance
The purpose of this Guidance is to:
a) Assist legal professionals in the design and implementation of a RBA to AML/CFT compliance by providing guidelines and examples of current practice, with a particular focus on providing guidance to sole practitioners and small firms; b) Support a common understanding of a RBA for legal professionals, financial institutions and designated non-financial businesses and professions (DNFBPs)5 that maintain relationships with legal professionals (e.g. through pooled or client accounts or for trust and company accounts) and competent authorities and self-regulatory bodies (SRBs)6 responsible for monitoring the compliance of legal professionals with their AML/CFT obligations; c) Outline the key elements involved in applying a RBA to AML/CFT applicable to legal professionals; d) Assist financial institutions and DNFBPs that have legal professionals as clients in identifying, assessing and managing the ML/TF risk associated with legal professionals and their services; e) Assist countries, competent authorities and SRBs in the implementation of the FATF Recommendations with respect to legal professionals, particularly R.22, 23 and 28; f) Assist countries, SRBs and the private sector to meet the requirements expected of them, particularly under IO.3 and IO.4; g) Support the effective implementation of action plans of national risk assessments (NRAs) conducted by countries; and h) Support the effective implementation and supervision by countries of national AML/CFT measures, by focusing on risks as well as preventive and mitigating measures. 5 Including both legal and natural persons, see definition of the term ‘Designated Non-Financial Businesses and Professions’ in the FATF Glossary. 6 See definition of the term ‘Self-regulatory body’ in the FATF Glossary.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 7 © 2019 | FATF Target audience, status and content of the Guidance
13. This Guidance is aimed at the following audience:
a) Legal professionals; b) Countries and their competent authorities, including AML/CFT supervisors of legal professionals, AML/CFT supervisors of banks that have legal professionals as customers, and Financial Intelligence Units (FIUs); and c) Practitioners in the banking sector, other financial services sectors and DNFBPs that have legal professionals as customers.
14. The Guidance consists of four sections. Section I sets out introduction and key
concepts. Section II contains key elements of the RBA and should be read in conjunction with specific guidance to legal professionals (Section III) and guidance to supervisors of legal professionals on the effective implementation of a RBA (Section IV). There are six annexes on:
a) Beneficial ownership information in relation to a company, trust or other legal arrangements to whom a legal professional provides services (Annex 1); b) Sources of further information (Annex 2); c) Glossary of terminology (Annex 3); d) Supervisory practices for implementation of the RBA (Annex 4); e) Red flag indicators highlighting suspicious activities or transactions for legal professionals (Annex 5); and f) Members of the RBA Drafting Group (Annex 6).
15. This Guidance recognises that an effective RBA will take into account the
national context, consider the legal and regulatory approach and relevant sector guidance in each country, and reflect the nature, diversity, maturity and risk profile a country’s legal professionals and the risk profile of individual legal professionals operating in the sector and their clients. The Guidance sets out different elements that countries and legal professionals could consider when designing and implementing an effective RBA.
16. This Guidance is non-binding and does not overrule the purview of national
authorities7
, including on their local assessment and categorisation of legal professionals based on the prevailing ML/TF risk situation and other contextual factors. It draws on the experiences of countries and of the private sector to assist competent authorities and legal professionals to implement effectively applicable FATF Recommendations. National authorities may take this Guidance into account while drawing up their own Guidance for the sector. Legal professionals should also refer to relevant legislation and sector guidance of the country where their clients are based. 7 National authorities should however take the Guidance into account when carrying out their supervisory functions.

Scope of the Guidance: terminology, key features and business models Terminology Legal professionals
17. The FATF Recommendations apply to all legal professionals when they carry
out specified transactional activities for third parties (see below) and do not apply to all activities carried out by legal professionals. Most notably, litigation is not a specified activity, and a legal professional representing a client in litigation will not be subject to the FATF Recommendations; unless during the course of such representation the legal professional additionally engages in one or more specified activities, in which case the Recommendations will apply to this specified activity or activities only. The FATF Recommendations do not apply where a person provides legal services ‘in-house’ as an employee of an entity that does not provide legal services.
18. The legal sector comprises a broad spectrum of practitioners and is not a
homogenous group, from one country to another or even within a country. For the purposes of this Guidance, legal professionals include barristers, solicitors and other specialist advocates and notaries. In addition to obligations they may owe through the contracting of their services, legal professionals owe special duties both to their clients (e.g. duties of confidentiality and loyalty), as well as public duties to the legal institutions of their jurisdictions (e.g. through roles such as ‘officers of the court’). These duties are designed to assist in the administration of justice and promote the rule of law, and generally set legal professionals apart from other professional advisors. In many jurisdictions, these duties and obligations are enshrined in law, regulations or court rules pursuant to historic and well established practices.
19. Titles given to different legal professionals vary among countries and legal
systems, with the same title not always having the same meaning or area of responsibility. Although some common elements may exist based on whether the country has a common law or civil law tradition, even these generalisations will not always hold true. As the range of services provided and carried out by legal professionals is diverse and varies widely from one country to another, it is important to understand the specific roles undertaken by different legal professionals within their respective countries when assessing the AML/CFT obligations of the legal profession sector, as well as how these services interact with those of other professionals. Many legal professionals are required to comply with specific national legislation, rules and regulations adopted by professional associations or other SRBs.
20. R.22 provides that the customer due diligence and record-keeping
requirements of the Recommendations apply to legal professionals when they prepare for and carry out certain specified activities for their clients, namely:
a) Buying and selling of real estate; b) Managing of client money, securities or other assets; c) Management of bank, savings or securities accounts; d) Organisation of contributions for the creation, operation or management of companies; and e) Creation, operation or management of legal persons or arrangements, and buying and selling of business entities.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 9 © 2019 | FATF
21. The FATF Recommendations set an international standard, which countries
should implement through measures adapted to the circumstances of their particular jurisdictions. In general terms, jurisdictions have closely followed the FATF Recommendations but differences exist and legal professionals need to carefully consider the laws, rules and regulations of the relevant jurisdictions as implemented in such jurisdictions. The overarching concept of the obligations applying to certain specified activities (as set out in paragraph 20) is considered to be common across all jurisdictions.
22. Some legal professionals and law firms may accordingly be able to conclude
that based on the services they provide, they do not have any specific AML/CFT obligations as they do not prepare for, or carry out any of the specified activities. Even though specific AML/CFT obligations may not apply to a legal professional or a law firm, it is consistent with the overall ethics and best practices of the profession for all legal professionals to ensure that their services are not being misused, including by criminals. Accordingly, legal professionals and law firms should carefully consider what they need to do to guard against that risk irrespective of the application of specific AML/CFT obligations in order not to be unwittingly involved in ML/TF.
23. Legal professionals provide advisory services and representation to members
of society, companies and other entities to a) understand their increasingly complex legal rights and obligations; b) facilitate business transactions; c) assist their clients to comply with laws; and d) provide access to justice and judicial redress.
24. They may provide these services alone, in collaboration with other
independent legal professionals or as partners or as members of a law firm. A firm may consist of a sole practitioner or a few practitioners or thousands of legal professionals spread throughout numerous offices around the globe. There are also alternative business structures in which legal professionals combine with non-legal professionals to form partnerships. Most legal professionals practise alone or with other legal professionals in small firms.
25. Legal professionals include barristers, solicitors and other types of specialist
advocates, however called. Typically, these legal professionals represent clients in court and also, in some countries, provide advisory services that might include one of the specified activities in R.22 and, as set forth above, they will therefore need to comply in respect of such services.
26. Services provided globally by legal professionals include advising on clients’
financial transactions and legal structures that involve financial or business arrangements. As a result of their regulated status and to assist clients in transactions, legal professionals may also hold clients’ funds in designated accounts or agree to act on behalf of clients (e.g. under a power of attorney) in relation to specific aspects of transactions. However, the counselling and advisory roles of legal professionals, especially in an increasing regional and global marketplace, do not generally involve handling funds. Legal professionals frequently work in collaboration with other professional advisors on transactions, such as accountants, TCSPs, escrow agents and title insurance companies and may refer their clients to particular professionals for services. Flows of funds are also often dealt with and facilitated exclusively by financial institutions.

The work of legal professionals is fundamental to promoting adherence to the
rule of law. Legal professionals are typically regulated by laws, professional standards and codes of ethics and conduct. Breaches of the obligations imposed upon them can result in a variety of sanctions, including civil, contractual, disciplinary and criminal sanctions. Legal professional privilege and professional secrecy
The actions and behaviours discussed in this Guidance are subject to
applicable professional privilege and professional secrecy. Privilege/professional secrecy is a protection to the client, and a duty of the legal professional. Privilege (a common law concept existing in jurisdictions such as England and Wales and the United States) and professional secrecy (a civil law concept existing in jurisdictions such as Germany and France) aim to protect client information or advice from being disclosed. Though the two concepts differ in scope and purpose, both are founded on the nearly universal principle of the right of access to justice and the rationale that the rule of law is protected where clients are encouraged to communicate freely with their legal advisors without fear of disclosure or retribution. R.23 and the accompanying INR.23 recognise concepts of privilege and professional secrecy.
The degree and scope of legal professional privilege or professional secrecy
and the consequences of a breach of these principles vary from one country to another and are determined by the relevant national laws.
In some jurisdictions, the protections against non-disclosure may be
overridden by the consent or waiver of the client or by express provisions of law. Most jurisdictions seek to balance the right of access to justice and the public interest in investigating and prosecuting criminal activity. Accordingly, legal professional privilege or professional secrecy does not protect a legal professional from knowingly facilitating a client’s illegal conduct.8 Moreover, the protections against non-disclosure may not exist where the “crime/fraud” exception applies. Under the “crime/fraud” exception to privilege, privilege is not created where there is an illegal purpose whether or not the legal professional is aware of the illegality or is complicit in the illegality.The extent of that exception is a matter of national law.
Each country needs to determine the matters that would fall under legal
professional privilege or professional secrecy. This would normally cover some information that legal professionals receive from or obtain through their clients: (a) in the course of ascertaining the legal position of their clients, or (b) in performing their task of defending or representing their clients in, or concerning judicial, administrative, arbitration or mediation proceedings. There may be cases in which these professionals conduct activities that are clearly covered by the legal privilege (i.e. ascertaining the legal position of their client or defending or representing their client in judicial proceedings) alongside activities that may not be covered by it. In addition, within a single matter, privilege may attach to some but not all communications and advice.
A number of the DNFBP sectors, including legal professionals, are already
subject to regulatory or professional requirements (including as promulgated by SRBs) that complement AML/CFT measures. For example, by virtue of their professional codes of conduct, many legal professionals are already subject to an obligation to identify their clients 8 Also see IBA and the secretariat of the OECD: Report of the Task Force on the Role of Lawyers and International Commercial Structures (May 2019): Full Report and Executive Summary.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 11 © 2019 | FATF (e.g. to check for conflict of interest) and the substance of the matter submitted to them by such clients, to appreciate the consequences that their advice may have. If a legal professional provides legal advice to a client that helps the client commit an offence, that legal professional may, depending on the legal professional’s state of knowledge, become an accomplice to the offence.
33. This Guidance must be considered in the context of these professional and
ethical codes of conduct. In situations where legal professionals are claiming legal professional privilege or professional secrecy, they must be satisfied that the information is protected by the privilege/professional secrecy and the relevant rules. For example, it is important to distinguish between legal advice, which generally is subject to robust protections, and underlying facts, which in many cases are not protected by privilege. Role of notaries as a legal professional
34. Both civil and common law countries have notaries, but the main difference
between them is the roles that they play in their respective jurisdictions. In some common law countries, a notary public is a qualified, experienced practitioner, trained in the drafting and execution of legal documents. In other common law countries, a notary public is a public servant appointed by a governmental body to witness the signing of important documents (such as deeds and mortgages) and administer oaths. Notaries provide legal advice in the context of documenting transactions and legal arrangements, and do not necessarily direct this advice to a specific party. In some common law countries, such as the UK, the notary is no longer required for documenting transactions.
35. Most civil law notaries are members of autonomous legal professions
(regulated by law) and qualified public officials, as they are appointed by the State through a selective public competition among law graduates. Civil law notaries, who are bound by an obligation of independence and impartiality with respect to parties to a transaction, must be regarded, in matters of real estate property (conveyancing), family law, inheritance and corporate legal services (e.g. the formation of companies, sale of shares, capital increases, liquidation and dissolution of companies), as practising non-adversarial activities. They act as gatekeepers by drafting and ensuring the legality and certainty of the instruments, and the authenticity of the content of the instrument and in some jurisdictions, also provide a public fiduciary function by performing the role of trusted third parties. Civil law notaries are obliged by law to remain impartial, fair and independent as between the parties they are advising, including bearing in mind any disparity of power between the parties. For this reason, civil law notaries are assigned functions of a public nature as part of their legal assignments and typically do not act for one of the parties in an advisory capacity.
36. In civil law jurisdictions, as notaries are entrusted with public functions, they
act as public office holders in accordance with the principles of impartiality, legality, certainty and independence. In these jurisdictions, the involvement of notaries in transactions includes the notaries’ responsibility and the specific legal value of the notarial form established by law. This legal framework for civil law notaries ensures a high degree of legal certainty and enhances the traceability and transparency of transactions between the parties. Notarial deeds as authentic instruments are recognised as a particular form of evidence, which is taken to be authoritative and in certain cases, as judicially enforceable as court orders and judgments and, sometimes, are an indispensable step in order to obtain other effects such as traditio, right of first refusal, third-party effectiveness and registration in substantive and administrative registries. State powers are therefore effectively delegated to civil law

notaries so that they can assign “public authority” to the authentic instruments they establish and are responsible for. The obligations of fairness and public office mean that services performed by civil law notaries are often very different in nature to the services provided by other legal professionals.
37. Notaries are subject to a duty of professional secrecy, as well as generally
being subject to a duty to respect rights to confidentiality. Notaries are the party to interpret these duties in the light of their overarching obligation to ensure the common good and the general interests of society. Therefore, in practice, professional secrecy is not an absolute duty and is often subordinated to the public interest. Notaries may also be required to disclose the contents of their archives and communications in criminal proceedings or when required by law. In the context of ML/TF, notaries are obliged to co-operate with law enforcement, and to disclose all the relevant information to the competent authorities, in accordance with the laws of the jurisdiction. Notification to public authorities of any suspicious transactions should not be considered as an infringement of the notary’s duty of professional secrecy. Information received by the civil law notaries in respect of a client and which is being transferred to the competent FIU in conformity with the AML/CFT legislation still remains confidential information.
38. This Guidance does not cover some common law notaries when those notaries
perform merely administrative acts such as witnessing or authenticating documents, as these acts are not specified activities. Services provided by legal professionals and their vulnerabilities for ML/TF
39. Legal professionals provide a vast range of services to a diverse range of
clients. For example, services may include (but are not restricted to):
a) Advising on the purchase, sale, leasing and financing of real property; b) Tax advice; c) Advocacy before courts and tribunals; d) Representing clients in disputes and mediations; e) Advice in relation to divorce and custody proceedings; f) Advice on the structuring of transactions; g) Advisory services on regulations and compliance; h) Advisory services related to insolvency/receiver-managers/bankruptcy; i) Administration of estates and trusts; j) Assisting in the formation of entities and trusts; k) Trust and company services9; l) Acting as intermediaries in the trade of citizenship and residency or acting as advisors in residence and citizenship planning; 9 For such activities, refer also to the guidance on risk-based approach for Trust and Company Service Providers (TCSPs).

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 13 © 2019 | FATF m) Providing escrow services and token custody services in connection with legal transactions involving an initial coin offering or virtual assets; n) Legitimising signatures by confirming the identity of the signatory (in the case of notaries); and o) Overseeing the purchase of shares or other participations (also in the case of notaries).
40. While some of these services may involve activities that fall within the scope
of the specified activities under R.22, not all (e.g. representing clients in disputes and mediations; providing advice in relation to divorce and custody proceedings; or providing advisory services on regulations) will do so. When considering the range of tasks undertaken by legal professionals only specified activities under R.22 are subject to the AML/CFT regime.
41. The specifics of the risk-based processes should accordingly be determined
based on the activities undertaken by the legal professional, the ethical and existing supervisory structure for legal professionals and the susceptibility or vulnerability of activities of a legal professional to ML/TF. Firms with offices in multiple jurisdictions should apply a consistent approach across all of its offices with a general compliance tone from the top.
42. A RBA requires legal professionals to mitigate the risks that they face and with
due regard to the resources available. Mitigating practices will invariably include initial CDD and ongoing monitoring, as well as a range of internal policies, training and systems to address the vulnerabilities faced in the particular practice setting of the legal professional. This section does not attempt to exhaustively list the mitigating practices that may be employed by legal professionals. For information on ways in which legal professionals might mitigate their vulnerabilities to ML/TF, see “Section 2 – Guidance for Legal professionals and Notaries” and chapters III and IV of the separate publication: “A Lawyer’s Guide to Detecting and Preventing Money Laundering” published in October 2014 by a collaboration of the International Bar Association, American Bar Association and the Council of Bars and Law Societies of Europe10. Client funds
43. Most legal professionals can hold funds of clients. Client accounts are accounts
held by legal professionals with a financial institution. In some civil law countries, a professional body holds the funds of clients, rather than legal professionals. For example, in France, where funds are held in CARPA (see Annex 4 “France”). Operating client accounts does not automatically require a legal professional to observe AML/CFT obligations. These obligations apply when the accounts are used in conjunction with a specified activity under R.22.
44. In most countries, legal professionals are required to hold client funds in a
separate account with a financial institution and use the funds only in accordance with their client’s instructions. In countries where client accounts are used, legal professionals are required to hold client funds separate from their own. The purpose of these accounts is to hold client funds in “trust” for or for a purpose designated by the client. Funds will also be 10 The full publication is available at:
www.ibanet.org/Article/NewDetail.aspx?ArticleUid=f272a49e-7941-42ee-aa02- eba0bde1f144

held or received for payment of costs incurred by the legal professional on behalf of the client. No funds may pass through a client account without being attached to an underlying legal transaction or purpose, and the legal professional is required to account for these funds.
45. The use of client accounts has been identified as a potential vulnerability, as it
may be perceived by criminals as a means to either integrate tainted funds within the mainstream financial system or a means by which tainted funds may be layered in such a way to obscure their source, with fewer questions being asked by financial institutions because of the perceived respectability and legitimacy added by the involvement of the legal professional. Legal professionals can seek to limit their exposure to this risk by developing and implementing policies on the handling of funds (e.g. currency value limits) as well as restricting access to the account details of the client account in order to prevent unsanctioned deposits into the client account. Advising on the purchase and sale of real property
46. Real estate, both commercial and residential, accounts for a high proportion
of confiscated criminal assets, demonstrating thatthis as a clear area of vulnerability. In many countries, legal professionals are either required by law to undertake the transfer of property or their involvement is a matter of tradition, custom or practice. However, the specific role of legal professionals in real estate transactions varies significantly from country to country, or even within countries. In some countries, legal professionals will customarily hold or control (e.g. through a financial institution) and transfer or control the transfer of the relevant funds for the purchase of the real estate assets. In other countries this will be done by other parties, such as a title insurance company or escrow agent. Even if legal professionals are not handling the funds, they will typically be aware of the financial details and in many cases will be in a position to inquire about the transaction where appropriate.
47. Some criminals may seek to invest the proceeds of their crime in real estate
without attempting to obscure their ownership of the real estate. Alternatively, criminals may seek to obscure the ownership of real property by using false identities or title the property in the names of family members, friends or business associates, or purchase property through an entity or a trust. Legal professionals should consider carefully who they are acting for at the outset of a real estate transaction, especially where there are multiple parties involved in a transaction. In some cases, legal professionals may also opt to apply specific checks on the settlement destinations of transactions (i.e. performing limited diligence on the seller of real property, when acting for the buyer and the seller and the buyer appear to be related parties). Formation of companies and trusts11
48. In some countries, legal professionals (in civil law jurisdictions this will
usually be a notary) must be involved in the formation of a company. In other countries members of the public are able to register a company themselves directly with the company register, in which case a legal professional’s advice is sometimes sought at least in relation to initial liability management, corporate, tax and administrative matters.
49. Criminals may seek the opportunity to retain control over criminally derived
assets while frustrating the ability of law enforcement to trace the origin and ownership of 11 The illustrations could also apply to other legal persons and arrangements.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 15 © 2019 | FATF the assets. Companies and often trust and other similar legal arrangements are seen by criminals as potentially useful vehicles to achieve this outcome. While shell companies12, which do not have any ongoing business activities or assets, may be used for legitimate purposes such as serving as a transaction vehicle, they may also be used to conceal beneficial ownership, or enhance the perception of legitimacy. Criminals may also seek to misuse shelf companies13 formed by legal professionals by seeking access to companies that have been ‘sitting on the shelf’ for a long time. This may be in an attempt to create the impression that the company is reputable and trading in the ordinary course because it has been in existence for many years. Shelf companies can also add to the overall complexity of entity structures, further concealing the underlying beneficial ownership information. Management of companies and trusts
50. In some cases, criminals will seek to have legal professionals involved in the
management of companies and trusts in order to provide greater respectability and legitimacy to the company or trust and its activities. In some countries professional rules preclude a legal professional from acting as a trustee or as a company director, or require a disclosure of directorship positions to ensure independence and transparency is maintained. In countries where this is permitted, there are diverse rules as to whether that legal professional can also provide external legal advice or otherwise act for the company or trust. This will determine whether any funds relating to activities by the company or trust can go through the relevant legal professional’s client account. In addition, in some countries, the non-legal counsel of a legal professional acting in a business capacity for formation or management of companies or trusts may not be protected by the legal professional privilege. Acting as nominee
51. Individuals may sometimes have legal professionals or other persons hold
their shares as nominees, where there are legitimate privacy, safety or commercial concerns. However, criminals may also use nominee shareholders to obscure their ownership of assets. In some countries, legal professionals are not permitted to hold shares in entities for whom they provide advice, while in other countries legal professionals regularly act as nominees. Legal professionals should identify beneficial owners when establishing business relations in these situations. This is important to prevent the unlawful use of legal persons and arrangements, by gaining a sufficient understanding of the client to be able to properly assess and mitigate the potential ML/TF risks associated with the business relationship. Where legal professionals are asked to act as nominees, they should understand the reason for this request and ensure that they are able to verify the identity of the beneficial owner of the shares and that the purpose is legitimate. General management of client affairs
52. In some jurisdictions, legal professionals may undertake a range of
‘management’ activities for clients permitted in limited circumstances by some professional rules. In some European jurisdictions, this is sometimes referred to as ‘man of affairs work’. 12 A shell company is an incorporated company with no independent operations, significant assets, ongoing business activities, or employees. 13 A shelf company is an incorporated company with inactive shareholders, directors, and secretary, which has been left dormant for a longer period even if a customer relationship has already been established.

Situations where a legal professional may be undertaking these activities legitimately may involve a client who has limited capacity to manage his/her own affairs, or in other circumstances where the client has a clear legitimate rationale for seeking the continuing assistance from the legal professional. The legal professional, whether acting pursuant to a court order or a power of attorney, may use his/her client account to undertake transactions, but would more typically use accounts held by the client for whom the legal professional is acting. While ordinarily this type of activity should give the legal professional access to sufficient information to make considered assessments of a client’s legitimacy under a RBA, it is possible that criminals will seek to use such ancillary services, in addition to legal services, to minimize the number of advisors and third parties who have access to the client’s financial and organizational details. Legal professionals should carefully scrutinize any request to take on additional obligations for a client beyond their primary services and consider the justification of such a request in the totality of the circumstances and its overall legitimacy. Other services that might indicate ML/TF activity
53. Legal professionals possess a range of specialised legal skills that may be of
interest to criminals, in order to enable them to transfer value obtained from criminal activity between parties and obscure ownership. These specialised skills include the creation of financial instruments and arrangements, advice on and drafting of contractual arrangements, and the creation of powers of attorney. In other areas of legal specialisation, such as probate (succession) and insolvency or bankruptcy work, the legal professional may simply encounter information giving rise to a suspicion that the deceased or insolvent individual previously engaged in criminal activity or that parties may be hiding assets to avoid payment to legitimate creditors. Countries differ on how unexpected funds are treated in relation to probate or insolvency cases, in some, a threshold report will be made and the government becomes a super-creditor able to recover the money before any other beneficiary or creditor. Where these circumstances involve legal professionals engaging in a specified activity, legal professionals must carefully consider their AML/CFT obligations. Legal professionals should also consider the ML/TF risk in such circumstances.
54. Many aspects of this Guidance on applying a RBA to AML/CFT may also apply
in the context of predicate offences, particularly for other financial crimes such as tax crimes. The ability to apply a RBA effectively to relevant predicate offences will also reinforce the AML/CFT obligations. Legal professionals may also have specific obligations in respect of identifying risks of predicate offences such as tax crimes, and supervisors may have a role to play in oversight and enforcement against those crimes. Therefore, in addition to this Guidance, legal professionals and supervisors should have regard to other sources of guidance that may be relevant in managing the risks of predicate offences.14 14 For example, legal professionals may be subject to mandatory disclosure rules, requiring them to report arrangements that have the hallmarks of tax evasion to the tax authority. Legal professionals may also commit an offence where they facilitate the commission of tax evasion. These initiatives require legal professionals and supervisors to take many of the steps outlined in this Guidance to ensure they fulfil their obligations under applicable law.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 17 © 2019 | FATF Services performed by notaries Overseeing the purchase of shares or other participations
55. Notaries are often involved in reviewing the documentation for the transfer of
shares and/or for transactions that enable participation in a company’s equity. It is possible for criminals to use fictitious or misleading accounting methods to distort the apparent value of a company, including by diminishing it in order to hide or obscure transfers of value. Although a notary is generally not responsible for verifying the ‘true’ value of companies, notaries may encounter information in the course of their duties that is at odds with the presented valuation of a company. Legitimisation of identities of signatory
56. In certain situations, the intervention of a notary is required to legitimise the
execution of a private document. Although this technically relates only to verifying the identity of the signing parties, notarisation can often lend an impression of credibility to the content of the document. Criminals may use this form of notarisation service to lend credibility, in particular, to information contained in such documents that asserts the identity of the owners of assets, thereby potentially hiding its true owners. Legalisation of old documents
57. In certain situations, the intervention of a notary is required for the
legalisation of private documents drafted several years before the time of notarisation. The purpose of this service is to provide certainty in relation to the validity of old documents. Criminals may seek to use such services in relation to documents that falsely assert that transactions occurred many years ago, in circumstances that cannot otherwise be verified. Opening of safe deposit boxes
58. Notaries may be present at the opening of a safe deposit box held at a bank
that is opened in the name of a deceased person. This service is to certify the contents of the safe deposit box. Criminals may fraudulently place contents that were not the property of the deceased person in such a deposit box in order to ensure that the title to this property passes in an apparently legitimate and ‘clean’ transfer from the estate of the deceased to the same criminal enterprise as the beneficiaries of the estates. FATF Recommendations applicable to the legal professionals
59. The basic intent behind the FATF Recommendations as it relates to legal
professionals is to ensure that their operations and services are not abused for facilitating criminal activities and ML/TF. This is consistent with the role of legal professionals, as guardians of justice and the rule of law namely to avoid knowingly assisting criminals or facilitating criminal activity. The requirements of R.22 regarding CDD, record-keeping, PEPs, new technologies and reliance on third parties set out in R.10, 11, 12, 15 and 17 should apply to legal professionals in certain circumstances.
60. R.22 mandates that the requirements for CDD, record-keeping, PEPs, new
technologies and reliance on third parties set out in R. 10, 11, 12, 15 and 17 apply to legal professionals in certain circumstances. R.22 applies to legal professionals when they prepare

for and carry out certain specified activities. Unless legal advice and representation consist of preparing for or carrying out one or more of these specified activities, legal professionals are not subject to the FATF Recommendations. This Guidance has been prepared to assist in situations where legal professionals prepare for and carry out transactions for the clients concerning the specified activities. For example, FATF Recommendations would not be applicable if a legal professional only provides litigation advice or routine advice at legal aid or other legal help clinics.
61. Where more than one law firm or legal professional prepares for or carries out
a transaction, each firm or legal professional must comply with the applicable CDD, recordkeeping and other AML/CFT obligations. Where permitted, legal professionals may rely on third parties in accordance with R.17 to perform elements (a)-(c) of the CDD measures set out in R.10 or to introduce business. Where not all legal professionals are preparing for or carrying out the transaction, those legal professionals providing advice or services (e.g. a general legal opinion on the applicability of a local law) peripheral to the transaction need not be subject to the AML/CFT obligations.
62. R.23 requires that measures set out in R.18 (Internal controls and foreign
branches and subsidiaries), 19 (Higher-risk countries), 20 (reporting of suspicious transactions) and 21(tipping-off and confidentiality) should apply to legal professionals subject to certain qualifications.
63. R.23 applies to legal professionals when they engage in a financial transaction
on behalf of a client, in relation to the specified activities under R.22. If legal professionals suspect or have reasonable grounds to suspect that funds are the proceeds of a criminal activity or are related to TF, they should be required to promptly report their suspicions to the FIU. Subject to certain limitations, legal professionals are not required to report their suspicions if the relevant information was obtained in circumstances where they are subject to professional secrecy or legal professional privilege, as recognised by INR.23. The lawyerclient relationship is protected in many countries, including in some instances by constitutional provisions.
64. The FATF Recommendations set the international standards on combating ML
and the financing of terrorism and proliferation, which jurisdictions implement taking into consideration their national context including their legal framework. In general terms jurisdictions have closely followed the FATF Recommendations but differences do exist and legal professionals need to carefully consider these differences in their own jurisdictions. The overarching concept of the obligations only applying to certain specified activities is common across all jurisdictions. Section III provides further guidance on the application of obligations in R.22 and R.23 to legal professionals.
65. Even though individual legal professionals or law firms may be able to
conclude that specific AML/CFT obligations do not apply to them, ethical standards require them to ensure that their services are not being misused, including by criminals, and they should carefully consider what they need to do to guard against that risk.
66. Countries should establish the most appropriate regime, tailored to address
relevant ML/TF risks, which takes into consideration the activities and applicable code of conduct for legal professionals.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 19 © 2019 | FATF
Section II- The RBA to AML/CFT
What is the RBA?
67. The RBA to AML/CFT means that countries, competent authorities and
DNFBPs, including lawyers, notaries and other legal professionals should identify, assess and understand the ML/TF risks to which they are exposed and take the required AML/CFT measures effectively and efficiently to mitigate and manage the risks.
68. For legal professionals, identifying and maintaining an understanding of the
ML/TF risk faced by the sector as well as specific to their services, client base, the jurisdictions where they operate, and the effectiveness of their controls in place, will require the investment of resources and training. For supervisors, this will also require maintaining an understanding of the ML/TF risks specific to their area of supervision and the degree to which AML/CFT measures can reasonably be expected to mitigate such risks.
69. The RBA is not a “zero failure” approach; there may be occasions where a legal
professional has taken reasonable and proportionate AML/CFT measures to identify and mitigate risks, but is still used for ML/TF in isolated instances. Although there are limits to any RBA, ML/TF is a real and serious problem that legal professionals must address so that they do not, unwittingly or otherwise, encourage or facilitate it.
70. Key elements of a RBA can be summarised as follows:
The rationale for the RBA
71. In 2012, the FATF updated its Recommendations to keep pace with evolving
risk and strengthen global safeguards. Its purposes remain to protect the integrity of the financial system by providing governments with updated tools needed to take action against financial crime.
72. There was an increased emphasis on the RBA to AML/CFT, especially in
preventive measures and supervision. Though the 2003 Recommendations provided for the Risk identification and asessment

identifying ML/TF risks facing a firm, given its customers, services,
countries of operation, also having regard to publicly available information regarding ML/TF risks and typologies Risk management and mitigation
identifying and applying measures to effectively and efficiently mitigate
and manage ML/TF risks
Ongoing monitoring
putting in place policies, procedures and information systems to monitor
changes to ML/TF risks
Documentation
documenting risk assessments, strategies, policies and procedures to
monitor, manage and mitigate ML/TF risks

application of a RBA in some areas, the 2012 Recommendations considered the RBA to be an essential foundation of a country’s AML/CFT framework.15
73. The RBA allows countries, within the framework of the FATF
Recommendations, to adopt a more tailored set of measures in order to target their resources more effectively and efficiently and apply preventive measures that are reasonable and proportionate to the nature of risks.
74. The application of a RBA is therefore essential for the effective
implementation of the FATF Standards by countries and legal professionals.16 Application of the RBA
75. The FATF standards do not predetermine any sector as higher risk. The
standards identify sectors that may be vulnerable to ML/TF. The overall risk should be determined through an assessment of the sector at a national level. Different entities within a sector will pose higher or lower risk depending on a variety of factors, including services, products, customers, geography, preventive measures and the strength of the entity’s compliance program.
76. R.1 sets out the scope of application of the RBA as follows:
a) Who should be subject to a country’s AML/CFT regime?

In addition to the sectors and activities already included in the scope of the
FATF Recommendations17, countries should extend their regime to additional institutions, sectors or activities if they pose a higher ML/TF risk. Countries could also consider exempting certain institutions, sectors or activities from some AML/CFT obligations where specified conditions are met, such as proven low risk of ML/TF and in strictly limited and justified circumstances.18 b) How should those subject to the AML/CFT regime be supervised or monitored for compliance with this regime
Supervisors should ensure that legal professionals are implementing their
obligations under R.1. AML/CFT supervisors should consider a legal professional’s own risk assessment and mitigation and acknowledge the degree of discretion allowed under the national RBA. c) How should those subject to the AML/CFT regime be required to comply
The general principle of a RBA is that, where there are higher risks, enhanced
measures should be taken to manage and mitigate those risks. The range, degree, frequency or intensity of preventive measures and controls 15 R.1. 16 The effectiveness of risk-based prevention and mitigation measures will be assessed as part of the mutual evaluation of the national AML/CFT regime. The effectiveness assessment will measure the extent to which a country achieves a defined set of outcomes that are central to a robust AML/CFT system and will analyse the extent to which a country’s legal and institutional framework is producing the expected results. Assessors will need to take into account the risks and the flexibility allowed by the RBA, when determining whether there are deficiencies in a country’s AML/CFT measures, and their importance (FATF, 2013f). 17 See FATF Glossary, definitions of “Designated non-financial businesses and professions” and “Financial institutions”. 18 See INR.1.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 21 © 2019 | FATF conducted should be stronger in higher risk scenarios. Legal professionals are required to apply each of the following CDD measures19: (i) identification and verification of the client’s identity; (ii) identification of the beneficial owner and taking reasonable measures to verify the identity of beneficial owner; (iii) understanding the purpose and nature of the business relationship; and (iv) on-going due diligence on the relationship. However, where the ML/TF risk is assessed as lower, the degree, frequency and/or the intensity of the controls conducted will be relatively lighter. Where risk is assessed at a normal level, the standard AML/CFT controls should apply. d) Consideration of the engagement in client relationships

Legal professionals are not obliged to avoid risk entirely. Even if the services
they provide to their clients are considered vulnerable to ML/TF risks based on risk assessment, it does not mean that all legal professionals and all their clients or services pose a higher risk when taking into account the risk mitigating measures that have been put in place. e) Importance of legal professional services to overall economy
Legal professionals often play significant roles in the legal and economic life
of a country. The role of legal professionals in supporting the negotiation of business and other agreements is vital. The risks associated with any type of client group are not static and the expectation is that within a client group, based on a variety of factors, individual clients could also be classified into risk categories, such as low, medium-low, medium, medium-high or high risk (see section 3.1 below for a detailed description). Measures to mitigate risk should be applied accordingly. Challenges

Implementing a RBA can present a number of challenges for legal
professionals. A RBA requires resources and expertise, both at a country and sector level, to gather and interpret information on risks, to develop policies and procedures and to train personnel. A RBA is also reliant on individuals exercising sound and well-trained judgement when designing and implementing such policies and procedures. Box 1. Particular RBA challenges for legal professionals Culture of compliance and adequate resources. Implementing a RBA requires that legal professionals have a sound understanding of the ML/TF risks and are able to exercise good professional judgement. Above all, legal professionals and the leadership of law firms should recognise the importance of a culture of compliance across the organisation and ensure sufficient resources are devoted to its implementation appropriate to the size, scale and activities of the organisation. This requires the building of expertise including, for example, through training, recruitment, taking professional advice and ‘learning by doing’. It also requires the allocation of necessary resources to gather and interpret information on ML/TF risks, both at the country and institutional levels, and to develop procedures and systems, including ensuring effective decision-making. The process will 19 See R.10

benefit from information sharing by relevant competent authorities, supervisors and SRBs. The provision of good practice guidance by competent authorities, supervisors, legal professionals and SRBs is valuable and encouraged. Significant variation in services and clients. Legal professionals will vary substantially in the breadth and nature of services provided and the clients they serve, as well as the size, focus, geographic reach and sophistication of the firm and its employees. In implementing the RBA, legal professionals should make reasonable judgements for their particular services and activities. This may mean that no two legal professionals and no two firms are likely to adopt the same detailed practices. Legal professionals should thus tailor their RBA based on their unique characteristics and practice profile. Appropriate mitigation measures will also depend on the nature of the legal professional’s role and involvement. Circumstances may vary considerably between professionals who represent clients directly and those who are engaged for distinct purposes. Where these services involve tax laws and regulations, legal professionals also have additional considerations related to a country’s or jurisdiction’s permissible means to structure transactions and entities or operations to legally avoid and/or minimise taxes. Transparency of beneficial ownership on legal persons and arrangements. Legal professionals can be involved in the formation, management, or administration of legal entities and arrangements, though in many countries any legal or natural person may be able to perform these activities. Where legal professionals do play this “gatekeeper” role, they may encounter challenges in keeping current and accurate beneficial ownership information depending upon the nature and activities of their client. Other challenges may arise when on-boarding new clients with minimal economic activity associated with the legal entity and/or its owners, controlling persons, or beneficial owners, established in another jurisdiction. Finally, whether the source is a public registry, another third party source, or the client, there is always potential risk in the correctness of the information, in particular where the underlying information has been provided by the client.20 Those risks notwithstanding from the outset the legal professional should seek answers from the immediate client in determining beneficial ownership (having first determined that none of the relevant exceptions to ascertaining beneficial ownership apply, e.g. the client is a publicly listed company). The information provided by the client should then be appropriately confirmed by reference to public registers and other third party sources where possible. This may require further and clarifying questions to be put to the immediate client. The goal is to ensure that the legal professional is reasonably satisfied about the identity of the beneficial owner. For more practical guidance on
beneficial ownership, refer to the guidance in Box 2. 20 For further information legal professionals can refer to the FATF Guidance on Transparency and Beneficial Ownership.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 23 © 2019 | FATF Risk of criminality. Although the implementation of a RBA should not impair a client’s right of access to justice, legal professionals and their firms must be alert to ML/TF risks posed by the services they provide to avoid the possibility that they may unwittingly commit or become an accessory to the commission of a substantive offence of ML/TF. There have been examples of unwitting involvement of or negligence on the part of legal professionals or complicit professionals intentionally enabling the laundering of proceeds of crime. Legal professionals and firms should protect themselves from misuse by criminals and terrorists. This may include restricting the method and source of payments (e.g. cash payments above a monetary threshold, unexplained third party payments) for the services being provided, dictating greater focus on monitoring and reporting of clients and their funds for unusual or suspicious activity. Interplay between the requirement to comply with AML/CFT obligations and the principle of legal professional privilege and professional secrecy as applicable. Where legal professional privilege does apply, many countries provide exceptions in law that allow legal professionals to make disclosures of suspicion of ML/TF without incurring penalties or liability or breaching ethical obligations and in others to provide an exception to disclosure if the information is directly encompassed by a legitimate claim of privilege. However, legal professionals may be cautious of making disclosures that would otherwise breach privilege or confidentiality rules due to uncertainties in the application of these exceptions, lack of adequate information or training in relation to these rules, the complexities of their clients’ situations or a combination of these factors. Criminals may misperceive that legal professional privilege and professional secrecy will delay, obstruct or prevent investigation or prosecution by authorities if they utilise the services of a legal professional. Criminals may also seek out legal professionals (over other non-legal professions) to perform the services listed in R.22 with the specific criminal intent of concealing their activities and identity from authorities through professional privilege/secrecy protections.

Allocating responsibility under a RBA
78. An effective risk-based regime builds on and reflects a country’s legal and
regulatory approach, the nature, diversity and maturity of its financial sector and its risk profile. Legal professional should identify and assess their own ML/TF risk taking account of the NRAs in line with R.1, as well as the national legal and regulatory framework, including any areas of prescribed significant risk and mitigation measures. Legal professionals are required to take appropriate steps to identify and assess their ML/TF risks and have policies, controls and procedures that enable them to manage and mitigate effectively the risks that have been identified. 21 Where ML/TF risks are higher, legal professionals should always apply enhanced CDD, although national law or regulation might not prescribe exactly how these higher risks are to be mitigated (e.g. varying the degree of enhanced ongoing monitoring).
79. Strategies adopted by legal professionals to mitigate ML/TF risks should take
into account the applicable national legal, regulatory and supervisory frameworks. When deciding the extent to which legal professionals can take measures to mitigate risk, countries should consider the ability of the sector to effectively identify and manage ML/TF risks as well as the expertise and resources of their supervisors to adequately supervise and take action to address any failures. Countries may also consider evidence from competent authorities on the level of compliance in the sector, and the sector’s approach to dealing with ML/TF risk. Countries whose services sectors are emerging or whose legal and supervisory frameworks are still developing may determine that legal professionals are not fully equipped to effectively identify and manage ML/TF risk. In such cases, a more prescriptive implementation of the AML/CFT requirements may be appropriate until the understanding and experience of the sector is strengthened.22
80. Legal professionals should not be exempted from AML/CFT supervision even
where their compliance controls are adequate. However, the RBA allows competent authorities to focus more supervisory resources on higher risk entities. Identifying ML/TF risk
81. Access to accurate, timely and objective information on ML/TF risks is
essential for an effective RBA. INR.1.3 requires countries to have mechanisms to provide appropriate information on the results of the risk assessments to all relevant competent authorities, financial institutions and legal professionals. Where information is not readily available, for example where competent authorities have inadequate data to assess risks, are unable to share relevant information on ML/TF risks and threats, or where access to information is restricted by censorship or data protection provisions, it will be difficult for legal professionals to correctly identify ML/TF risk.
82. R.34 requires competent authorities, supervisors and SRBs to establish
guidelines and provide feedback to financial institutions and DNFBPs. Such guidelines and feedback help institutions and businesses to identify the ML/TF risks and to adjust their risk mitigating programmes accordingly. 21 R.1 and IN.1. 22 This could be based on a combination of elements described in Section II, as well as objective criteria such as mutual evaluation reports, follow-up reports or Financial Sector Assessment Program (FSAP) evaluations.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 25 © 2019 | FATF Assessing ML/TF risk
83. Assessing ML/TF risk requires countries, competent authorities and legal
professionals to determine how the ML/TF threats identified will affect them. They should analyse the information to understand the likelihood of these risks occurring, and the impact that these would have, on the individual legal professionals, the entire sector and on the national economy. As a starting step, ML/TF risks are often classified as low, medium-low, medium, medium-high and high. Assessing ML/TF risk goes beyond the mere gathering of quantitative and qualitative information, without its proper analysis; this information forms the basis for effective ML/TF risk mitigation and should be kept up-to-date to remain relevant.23
84. Competent authorities, including supervisors and SRBs should employ skilled
and trusted personnel, recruited through fit and proper tests, where appropriate. They should be technically equipped commensurate with the complexity of their responsibilities. Legal professionals and law firms that are required to routinely conduct a high volume of enquiries when on-boarding clients, e.g. because of the size and geographic footprint of the firm, may also consider engaging skilled and trusted personnel who are appropriately recruited and checked. Such law firms are also likely to consider using the various technological options (including artificial intelligence) and software programs that are now available to assist law firms in this regard.
85. Law firms should develop internal policies, procedures and controls, including
appropriate compliance management arrangements, and adequate screening procedures to ensure high standards when hiring employees. Law firms should also develop an ongoing employee training programme. They should be trained commensurate with the complexity of their responsibilities. Mitigating and managing ML/TF risk
86. The FATF recommendations require that when applying a RBA, legal
professionals should appropriately mitigate and manage the risks that they identify. Mitigating practices will invariably include initial and ongoing CDD, internal policies, training, and procedures to address the vulnerabilities faced in the legal professional’s particular context. Legal professional should take enhanced measures to manage the ML/TF risks identified. This section does not attempt to exhaustively list the mitigating practices that may be employed by legal professionals. Instead, it provides select examples to illustrate how legal professionals might choose to address particular risks under the RBA.24
87. The FATF Recommendations require that, when applying a RBA, legal
professionals, countries, competent authorities and SRBs decide on the most appropriate and 23 FATF (2013a), paragraph 10. See also Section I D for further detail on identifying and assessing ML/TF risk. Also refer to The FATF Guidance on National Money Laundering and Terrorist Financing Risk Assessment (February 2013). 24 For information on ways in which legal professionals might mitigate their ML/TF vulnerabilities, see Section 2 of this Guidance and chapters III and IV of the separate publication: “A Lawyer’s Guide to Detecting and Preventing Money Laundering” published in October 2014 by a collaboration of the International Bar Association, American Bar Association and the Council of Bars and Law Societies of Europe.

effective way to mitigate the ML/TF risk they have identified. They should take enhanced measures to manage and mitigate situations when the ML/TF risk is higher. In lower risk situations, less stringent measures may be applied:25 a) Countries may decide not to apply some of the FATF Recommendations requiring DNFBPs to take certain actions, provided (i) there is a proven low risk of money laundering and terrorist financing, this occurs in strictly limited and justified circumstances and it relates to a particular type of DNFBP or (ii) a financial activity is carried out by a natural or legal person on an occasional or very limited basis such that there is a low risk of ML/TF, according to the exemptions of INR 1.6. b) Countries looking to apply simplified measures should conduct an assessment to ascertain the lower risk connected to the category of clients or services, establish a threshold for the lower level of the risks involved, and define the extent and the intensity of the required AML/CFT measures, provided that the specific conditions required for one of the exemptions of INR 1.6 are met. Specific Recommendations set out in more detail how this general principle applies to particular requirements.26 Developing a common understanding of the RBA
88. The effectiveness of a RBA depends on a common understanding by competent
authorities and legal professionals of what the RBA entails, how it should be applied and how ML/TF risks should be addressed. In addition to a legal and regulatory framework that spells out the degree of discretion, legal professionals should deal with the risks they identify. Following a consultative process, competent authorities should issue RBA guidance to legal professionals on meeting and managing their legal and regulatory AML/CFT obligations. Supporting ongoing and effective communication between competent authorities and legal professionals is essential.
89. Competent authorities should acknowledge that not all legal professionals will
adopt identical AML/CFT controls in a risk-based regime. On the other hand, legal professionals should understand that a RBA does not exempt them from applying effective AML/CFT controls.
25. Subject to the national legal framework providing for Simplified CDD. 26 For example, R.22 on CDD.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 27 © 2019 | FATF
Section III – Guidance for legal professionals
Risk identification and assessment
90. Potential ML/TF risks faced by legal professionals will vary according to many
factors including the activities undertaken by them, the type and identity of the client, and the nature and origin of the client relationship. When applying the RBA, legal professionals and firms should bear in mind that specified activities have been found to be more susceptible to ML/TF activities because they involve the movement or management of client assets; this susceptibility may be heightened when these activities are conducted on a crossborder basis. These specified activities include:
a) buying and selling of real estate; b) managing of client money, securities or other assets; c) management of bank, savings or securities accounts; d) organisation of contributions for the creation, operation or management of companies; and e) creating, operating or management of legal persons or arrangements and buying and selling of business entities.
91. Although a client’s right of access to advice and justice should not be adversely
affected by the implementation of the RBA, legal professionals and their firms must remain alert to ML/TF risks posed by the services they provide to avoid unwittingly committing or becoming an accessory to the commission of a ML/TF offence. Legal professionals and law firms must protect themselves from unwitting involvement in ML/TF; such involvement not only presents reputational risk to the individuals concerned, the law firm and the legal profession at large, it is also unacceptable for the legal profession to allow itself to be misused by criminals.
92. Legal professionals should perform a risk assessment of the client at the
inception of a client relationship. Such risk assessment may well be informed by findings of the NRA, the supra-national risk assessments, sectoral reports conducted by competent authorities on ML/TF risks that are inherent in legal services/sector, risk reports in other jurisdictions where the legal professional is based, and any other information which may be relevant to assess the risk level particular to their legal practice. For example, press articles and other widely available public information highlighting issues that may have arisen in particular jurisdictions. Legal professionals may also draw references to FATF Guidance on indicators and risk factors27. During the course of a client relationship, procedures for ongoing monitoring and review of the client/transactional risk profile are also important. Competent authorities should consider how they can best alert legal professionals to the findings of any national risk assessments, the supra-national risk assessments and any other information that may be relevant to assess the risk level particular to a legal practice in the relevant country.
93. Due to the nature of services that a legal professional generally provides,
automated transaction monitoring systems of the type used by financial institutions will not be appropriate for most legal professionals. The legal professional’s knowledge of the client 27 FATF Report on Vulnerabilities in the Legal Sector (2013), Chapters 4 and 5.

and its business will develop throughout the duration of a longer term and interactive professional relationship (in some cases, such relationships may exist for short term clients as well, e.g. for property transactions). Although individual legal professionals are not expected to investigate their client’s affairs, they may be well positioned to identify and detect changes in the type of work or the nature of the client’s activities in the course of the business relationship. Legal professionals should consider the nature of the risks presented by short-term client relationships that may inherently, but not necessarily be low risk (e.g. one-off client relationship involving simple transactions). Legal professionals should also be mindful of the subject matter of the professional services (the engagement) being sought by an existing or potential client and the related risks.
94. Identification of the ML/TF risks associated with certain clients or categories
of clients, and certain types of work will allow legal professionals to determine and implement reasonable and proportionate measures and controls to mitigate such risks. The risks and appropriate measures will depend on the nature of the legal professional’s role and involvement. Circumstances may vary considerably between professionals who represent clients in a single transaction, those involved in a long term advisory relationship and those who are engaged for distinct and discrete purposes including, for example, civil law notaries and local counsel engaged in a specific jurisdiction within a transaction.
95. The amount and degree of ongoing monitoring and review will depend on the
nature and frequency of the relationship, along with the comprehensive assessment of client/transactional risk. A legal professional may also have to adjust the risk assessment of a particular client based upon information received from a designated competent authority, SRB or other credible sources (including a referring legal professional).
96. Legal professionals may assess ML/TF risks by applying various categories.
This provides a strategy for managing potential risks by enabling legal professionals, where required, to subject each client to reasonable and proportionate risk assessment.
97. The most commonly-used risk categories are:
a) country or geographic risk; b) client risk; and c) risk associated with the particular service offered.
98. The weight given to these risk categories (individually or in combination) in
assessing the overall risk of potential ML/TF may vary given the size, sophistication, nature and scope of services provided by the legal professional and/or law firm. These criteria, however, should be considered holistically and not in isolation. Legal professionals, based on their individual practices and reasonable judgements, will need to independently assess the weight to be given to each risk factor.
99. Although there is no universally accepted set of risk categories, the examples
provided in this Guidance are the most commonly identified risk categories. There is no single methodology to apply these risk categories and the application of these risk categories is intended to provide a suggested framework for approaching the assessment and management of potential ML/TF risks. For smaller law firms and sole practitioners, it is advisable to look at the services they offer (e.g. providing company management services may entail greater risk than other services).
100. Criminals deploy a range of techniques and mechanisms to obscure the
beneficial ownership of assets and transactions. Many of the common

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 29 © 2019 | FATF mechanisms/techniques have been compiled by FATF in the previous studies, including the 2014 FATF Guidance on Transparency and Beneficial Ownership and the 2018 Joint FATF and Egmont Group Report on Concealment of Beneficial Ownership. Legal professionals may refer to the studies for more details on the use of obscuring techniques and relevant case studies.
101. A practical starting point for law firms (especially smaller firms) and legal
professionals (especially sole practitioners) would be to take the following approach. Many of these elements are critical to satisfying other obligations owed to clients, such as fiduciary duties, and as part of their general regulatory obligations:
a) Client acceptance and know your client policies: identify the client and its beneficial owners and the true “beneficiaries” of the transaction. Obtain an understanding of the source of funds and source of wealth of the client where required, its owners and the purpose of the transaction. b) Engagement acceptance policies: understand the nature of the work. Legal professionals should know the exact nature of the service that they are providing and have an understanding of how that work could facilitate the movement or obscuring of the proceeds of crime. Where a legal professional does not have the requisite expertise, the legal professional should not undertake the work. c) Understand the commercial or personal rationale for the work: legal professionals need to be reasonably satisfied that there is a commercial or personal rationale for the work undertaken. Legal professionals however are not obliged to objectively assess the commercial or personal rationale if it appears reasonable and genuine. d) Be attentive to red flag indicators: exercise vigilance in identifying and then carefully reviewing aspects of the transaction if there are reasonable grounds to suspect that funds are the proceeds of a criminal activity, or related to terrorist financing. Subject to qualifications set forth in this Guidance, these cases would trigger reporting obligations. Documenting the thought process may be a viable option to assist in interpreting/assessing red flags/indicators of suspicion. e) Then consider what action, if any, needs to be taken and have an action plan: the outcomes of the above action (i.e. the comprehensive risk assessment of a particular client/transaction) will dictate the level and nature of the evidence/documentation collated under a firm’s CDD/EDD procedures (including evidence of source of wealth or funds). f) Documentation: legal professionals should adequately document and record steps taken under a) to e). Country/Geographic risk
102. There is no universally agreed definition by competent authorities, SRBs or
legal professionals that prescribes whether a particular country or geographic area (including the country within which the legal professional practices) represents a higher risk. Country risk, in conjunction with other risk factors, provides useful information on ML/TF risks. Geographic risks of ML/TF may arise in a variety of circumstances, including from the

domicile of the client, the location of the transaction or the source of the wealth or funds. Factors that are generally agreed to place a country in a higher risk category include:
a) Countries/areas identified by credible sources28 as providing funding or support for terrorist activities or that have designated terrorist organisations operating within them. b) Countries identified by credible sources as having significant levels of organised crime, corruption, or other criminal activity, including source or transit countries for illegal drugs, human trafficking and smuggling and illegal gambling. c) Countries subject to sanctions, embargoes or similar measures issued by international organisations such as the United Nations. d) Countries identified by credible sources as having weak governance, law enforcement, and regulatory regimes, including countries identified by FATF statements as having weak AML/CFT regimes, and in relation to which financial institutions (as well as DNFBPs) should give special attention to business relationships and transactions. Countries identified by credible sources to be uncooperative in providing beneficial ownership information to competent authorities, a determination of which may be established from reviewing FATF mutual evaluation reports or reports by organisations that also consider various co-operation levels such as the OECD Global Forum reports on compliance with international tax transparency standards.29 Client risk
103. Determining the potential ML/TF risks posed by a client or category of clients
is critical to the development and implementation of an overall risk-based framework. Based on their own criteria, law firms and legal professionals should seek to determine whether a particular client poses a higher risk and the potential impact of any mitigating factors on that assessment. Application of risk variables may mitigate or exacerbate the risk assessment. Categories of clients whose activities may indicate a higher risk include:
a) PEPs and persons closely associated with or related to PEPs, are considered as higher risk clients (Please refer to the FATF Guidance (2013) on PEPs for further guidance on how to identify PEPs). 28 “Credible sources” refers to information that is produced by reputable and universally recognised international organisations and other bodies that make such information publicly and widely available. In addition to the FATF and FATF-style regional bodies, such sources may include, but are not limited to, supra-national or international bodies such as the International Monetary Fund, the World Bank and the Egmont Group of Financial Intelligence Units. 29 www.oecd-ilibrary.org/taxation/global-forum-on-transparency-and-exchange-of-information-fortax-purposes-peer-reviews_2219469x

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 31 © 2019 | FATF Box 2. Particular considerations for PEPs and source of funds and wealth If a legal professional is advising a PEP client, or where a PEP is the beneficial owner of assets in a transaction, appropriate enhanced CDD is required if a specified activity under R.22 is involved. Such measures include, obtaining senior management (e.g. senior partner, managing partner or executive partner) approval before establishing a business relationship, taking reasonable measures to establish the source of wealth and source of funds of clients and beneficial owners identified as PEPs, and conducting enhanced ongoing monitoring on that relationship. The source of funds and the source of wealth are relevant to determining a client’s risk profile. The source of funds is the activity that generates the funds for a client (e.g. salary, trading revenues, or payments out of a trust). Source of funds relates directly to the economic origin of funds to be used in a transaction. This is likely to be received via a bank account. Generally, this would be evidenced by bank statements or similar documentation showing from where funds in an account originated such as receipt of salary. Source of wealth describes the activities that have generated the total net worth of a client (e.g. ownership of a business, inheritance, or investments). Source of wealth is the origin of the accrued body of wealth of an individual. Understanding source of wealth is about taking reasonable steps, commensurate with risk to be satisfied that the funds to be used in a transaction appear to come from a legitimate source. While source of funds and wealth may be the same for some clients, they may be partially or entirely different for other clients. For example, a PEP who receives a modest official salary, but who has substantial funds, without any apparent business interests or inheritance, might raise suspicions of bribery, corruption or misuse of position. Under the RBA, legal professionals should satisfy themselves that adequate information is available to assess a client’s source of funds and source of wealth as legitimate with a degree of certainty that is reasonable and proportionate to the risk profile of the client. Relevant factors that influence the extent and nature of CDD include the particular circumstances of a PEP, PEPs separate business interests and the time those interests prevailed in relation to the public position, whether the PEP has access to official funds, makes decisions regarding the allocation of public funds or public procurement contracts, the PEP’s home country, the type of activity that the PEP is instructing the legal professional to perform or carry out, whether the PEP is domestic or international, particularly having regard to the services asked for, and the scrutiny to which the PEP is under in the PEP’s home country. If a PEP is otherwise involved with a client, then the nature of the
risk should be considered in light of all relevant circumstances, such as:
a) the nature of the relationship between the client and the PEP: If the client is a trust, company or legal entity, even if the PEP is not a natural person exercising effective control or the PEP is merely a discretionary

beneficiary who has not received any distributions, the PEP may nonetheless affect the risk assessment. b) the nature of the client (e.g. where it is a public listed company or regulated entity who is subject to and regulated for a full range of AML/CFT requirements consistent with FATF Recommendations, the fact that it is subject to reporting obligations will be a relevant factor. c) the nature of the services sought. For example, lower risks may exist where a PEP is not the client but a director of a client that is a public listed company or regulated entity and the client is purchasing property for adequate consideration. Higher risks may exist where a legal professional is involved in the movement or transfer of funds/assets, or the purchase of high value property or assets. b) Clients conducting their business relationship or requesting services in unusual or unconventional circumstances (as evaluated taking into account all the circumstances of the client’s representation). c) Clients where the structure or nature of the entity or relationship makes it difficult to identify in a timely manner the true beneficial owner or controlling interests or clients attempting to obscure understanding of their business, ownership or the nature of their transactions, such as:
i. Unexplained use of shell and/or shelf companies, front company, legal
entities with ownership through nominee shares or bearer shares, control through nominee and corporate directors, legal persons or legal arrangements, splitting company formation and asset administration over different countries, all without any apparent legal or legitimate tax, business, economic or other reason.
ii. Unexplained use of informal arrangements such as family or close
associates acting as nominee shareholders or directors.
iii. Unusual complexity in control or ownership structures without a clear
explanation, where certain circumstances, structures, geographical locations, international activities or other factors are not consistent with the legal professionals’ understanding of the client’s business and economic purpose. d) Client companies that operate a considerable part of their business in or have major subsidiaries in countries that may pose higher geographic risk. e) Clients that are cash (and/or cash equivalent) intensive businesses. Where such clients are themselves subject to and regulated for a full range of AML/CFT requirements consistent with the FATF Recommendations, this will aid to mitigate the risks. These may include, for example:
i. Money or Value Transfer Services (MVTS) businesses (e.g. remittance
houses, currency exchange houses, casas de cambio, centros cambiarios, remisores de fondos, bureaux de change, money transfer agents and bank note traders or other businesses offering money transfer facilities).

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 33 © 2019 | FATF
ii. Operators, brokers and others providing services in virtual assets.
iii. Casinos, betting houses and other gambling related institutions and
activities.
iv. Dealers in precious metals and stones.
f) Businesses that while not normally cash intensive appear to have substantial amounts of cash. g) Businesses that rely heavily on new technologies (e.g. online trading platform) may have inherent vulnerabilities to exploitation by criminals, especially those not regulated for AML/CFT. h) Non-profit or charitable organizations engaging in transactions for which there appears to be no logical economic purpose or where there appears to be no link between the stated activity of the organization and the other parties in the transaction. i) Clients using financial intermediaries, financial institutions or legal professionals that are not subject to adequate AML/CFT laws and measures and that are not adequately supervised by competent authorities or SRBs. j) Clients who appear to be acting on somebody else’s instructions without disclosing the identity of such person. k) Clients who appear to actively and inexplicably avoid face-to-face meetings or who provide instructions intermittently without legitimate reasons and are otherwise evasive or very difficult to reach, when this would not normally be expected. l) Clients who request that transactions be completed in unusually tight or accelerated timeframes without a reasonable explanation for accelerating the transaction, which would make it difficult or impossible for the legal professionals to perform a proper risk assessment. m) Clients with previous convictions for crimes that generated proceeds, who instruct legal professionals (who in turn have knowledge of such convictions) to undertake specified activities on their behalf. n) Clients who have no address, or who have multiple addresses without legitimate reasons. o) Clients who have funds that are obviously and inexplicably disproportionate to their circumstances (e.g. their age, income, occupation or wealth). p) Clients who change their settlement or execution instructions without appropriate explanation. q) Clients who change their means of payment for a transaction at the last minute and without justification (or with suspect justification), or where there is an unexplained lack of information or transparency in the transaction. This risk extends to situations where last minute changes are made to enable funds to be paid in from/out to a third party.

r) Clients who insist, without reasonable explanation, that transactions be effected exclusively or mainly through the use of virtual assets for the purpose of preserving their anonymity. s) Clients who offer to pay unusually high levels of fees for services that would not ordinarily warrant such a premium. However, bona fide and appropriate contingency fee arrangements, where legal professionals may receive a significant premium for a successful representation, should not be considered a risk factor. t) Unusually high levels of assets or unusually large transactions compared to what might reasonably be expected of clients with a similar profile may indicate that a client not otherwise seen as higher risk should be treated as such. u) Where there are certain transactions, structures, geographical location, international activities or other factors that are not consistent with the legal professional’s understanding of the client’s business or economic situation. v) The legal professional’s client base includes industries or sectors where opportunities for ML/TF are particularly prevalent30. w) Clients who apply for residence rights or citizenship in a jurisdiction in exchange for capital transfers, purchase of property or government bonds, or investment in corporate entities in that jurisdiction. x) Clients who are suspected to be engaged in falsifying activities through the use of false loans, false invoices, and misleading naming conventions. y) The relationship between employee numbers/structure and nature of the business is divergent from the industry norm (e.g. the turnover of a company is unreasonably high considering the number of employees and assets compared to similar businesses). z) Client seeking advice or implementation of an arrangement that has indicators of a tax evasion purpose, whether identified as the client’s express purpose, in connection with a known tax evasion scheme or based on other indicators from the nature of the transaction. aa) The transfer of the seat of a company to another jurisdiction without any genuine economic activity in the country of destination poses a risk of creation of shell companies that might be used to obscure beneficial ownership. bb)Sudden activity from a previously dormant client without clear explanation. cc) Client that start or develop an enterprise with unexpected profile or abnormal business cycles or client that enters into new/emerging markets. Organised criminality generally does not have to raise capital/debt, often making them first into a new market, especially where this market may be retail/cash intensive. 30 See the FATF Report on Money Laundering and Terrorist Financing: Vulnerabilities of Legal Professionals (June 2013).

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 35 © 2019 | FATF dd)Indicators that client does not wish to obtain necessary governmental approvals/filings. ee) Reason for client choosing the firm is unclear, given the firm’s size, location or specialisation. ff) Frequent or unexplained change of client’s professional adviser(s) or members of management. gg) The client is reluctant to provide all the relevant information or legal professionals have reasonable suspicion that the provided information is incorrect or insufficient. hh)Clients seeking to obtain residents rights or citizenship in the country of establishment of the legal professional, in exchange for capital transfers, purchase of property or government bonds, or investment in corporate entities. Transaction/Service risk
104. An overall risk assessment of a client should also include determining the
potential risks presented by the services offered by a legal professional, given the nature of such services, noting that legal professionals provide a broad and diverse range of services. The context of the services being offered or delivered is always fundamental to a RBA. Any one of the factors discussed in this Guidance alone may not itself constitute a high-risk circumstance but the factors should be considered cumulatively and holistically. When determining the risks associated with the provision of services related to specified activities, consideration and appropriate weight should be given to such factors as:
a) Services where legal professionals, effectively acting as financial intermediaries, handle the receipt and transmission of funds through accounts they control in the act of facilitating a business transaction. b) Services that allow clients to deposit/transfer funds through the legal professional’s trust account that are not tied to a transaction for which the legal professional is performing or carrying out activities specified in R.22. c) Services where the client may request financial transactions to occur outside of the legal professional’s trust account (the account held by the legal professional for the client) (e.g. through the firm’s general account and/or a personal or business account held by the legal professional himself/herself). d) Services where legal professionals may in practice represent or assure the client’s standing, reputation and credibility to third parties, without a commensurate knowledge of the client’s affairs. e) Services that are capable of concealing beneficial ownership from competent authorities. 31 31 For further details on the difficulties presented by arrangements which conceal beneficial ownership see joint FATF and Egmont group report “Vulnerabilities Linked to the Concealment of Beneficial Ownership” published in July 2018.

f) Services requested by the client for which the legal professional does not have expertise excepting where the legal professional is referring the request to an appropriately trained professional for advice. g) Services that rely heavily on new technologies (e.g. in relation to initial coin offerings or virtual assets) that may have inherent vulnerabilities to exploitation by criminals, especially those not regulated for AML/CFT. h) Transfer of real estate or other high value goods or assets between parties in a time period that is unusually short for similar transactions with no apparent legal, tax, business, economic or other legitimate reason.32 i) Payments received from un-associated or unknown third parties and payments in cash where this would not be a typical method of payment. j) Transactions where it is readily apparent to the legal professional that there is inadequate consideration, especially where the client does not provide legitimate reasons for the amount of the consideration. k) Administrative arrangements concerning estates where the deceased was known to the legal professional as being a person who had been convicted of proceeds generating crimes. l) The use of shell companies, companies with ownership through nominee shares or bearer shares and control through nominee and corporate directors without apparent legal, tax, business, economic or other legitimate reason. 33 m) Situations where advice on the setting up of legal arrangements may be misused to obscure ownership or real economic purpose (including changes of name/corporate seat or on establishing complex group structures). This might include advising in relation to a discretionary trust that gives the trustee discretionary power to name a class of beneficiaries that does not include the real beneficiary (e.g. naming a charity as the sole discretionary beneficiary initially with a view to adding the real beneficiaries at a later stage). It might also include situations where a trust is set up for the purpose of managing shares in a company with the intention of making it more difficult to determine the beneficiaries of assets managed by the trust. 34 n) Services that have deliberately provided, or depend upon, more anonymity in relation to the client’s identity or regarding other participants, than is normal under the circumstances and in the experience of the legal professional. o) Settlement of default judgments or alternative dispute resolutions is made in an atypical manner (e.g. if satisfaction of a settlement or judgment debt is made too readily). 32 See the FATF Typologies report Money Laundering and Terrorist Financing through the Real Estate Sector. 33 See also the FATF typologies report ‘‘The Misuse of Corporate Vehicles, including Trust and Company Service Providers” published 13 October 2006. 34 See also the FATF typologies report “The Misuse of Corporate Vehicles, including Trust and Company Service Providers” Annex 2 on trusts, for a more detailed
description of “potential for misuse” of trusts.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 37 © 2019 | FATF p) Use of virtual assets and other anonymous means of payment and wealth transfer within the transaction without apparent legal, tax, business, economic or other legitimate reason. q) Transactions using unusual means of payment (e.g. precious metals or stones). r) The postponement of a payment for an asset or service delivered immediately to a date far from the moment at which payment would normally be expected to occur, without appropriate assurances that payment will be made. s) Unexplained establishment of unusual provisions in credit arrangements that do not reflect the commercial position between the parties. Arrangements that may be abused in this way might include unusually short/long amortisation periods, interest rates materially above/below market rates, or unexplained repeated cancellations of promissory notes/mortgages or other security instruments substantially ahead of the maturity date initially agreed. t) Transfers of goods that are inherently difficult to value (e.g. jewels, precious stones, objects of art or antiques, virtual assets), where this is not common for the type of client, transaction or with the legal professional’s normal course of business, such as a transfer to a corporate entity, or generally without any appropriate explanation. u) Successive capital or other contributions in a short period of time to the same entity with no apparent legal, tax, business, economic or other legitimate reason. v) Acquisitions of businesses in liquidation with no apparent legal, tax, business, economic or other legitimate reason. w) Power of representation given in unusual conditions (e.g. when it is granted irrevocably or in relation to specific assets) and the stated reasons for these conditions are unclear or illogical. x) Transactions involving closely connected persons and for which the client and/or its financial advisors provide inconsistent or irrational explanations and are subsequently unwilling or unable to explain by reference to legal, tax, business, economic or other legitimate reason. y) Legal persons that, as a separate business, offer TCSP services should have regard to the TCSP Guidance,35 even if such legal persons are owned or operated by legal professionals. Legal professionals, however, who offer TCSP services should have regard to this Guidance, and should consider customer or service risks related to TCSPs such as the following:
i. Unexplained delegation of authority by the client through the use of
powers of attorney, mixed boards and representative offices.
ii. Provision of registered office facilities and nominee directorships
without proper explanations.
iii. Unexplained use of discretionary trusts.
35 See the FATF Guidance on the Risk-Based Approach for Trust and Company Service Providers, published in July 2019

iv. In the case of express trusts, an unexplained relationship between a
settlor and beneficiaries with a vested right, other beneficiaries and persons who are the object of a power. z) In the case of an express trust, an unexplained (where explanation is warranted) nature of classes of beneficiaries aa) Services where the legal professional acts as a trustee/director that allows the client’s identity to remain anonymous. bb)Situations where a nominee is being used (e.g. friend or family member is named as owner of property/assets where it is clear that the friend or family member is receiving instructions from the beneficial owner), with no apparent legal, tax, business, economic or other legitimate reason. cc) Unexplained use of pooled client accounts or safe custody of client money or assets or bearer shares, where allowed, without justification. dd)Commercial, private, or real property transactions or services to be carried out by the client with no apparent legitimate business, economic, tax, family governance, or legal reasons. ee) Suspicion of fraudulent transactions or transactions which are improperly accounted for. These might include:
i. Over or under invoicing of goods/services.
ii. Multiple invoicing of the same goods/services.
iii. Falsely described goods/services
iv. Over or under shipments (e.g. false entries on bills of lading).
v. Multiple trading of goods/services.
Variables that may influence risk assessment
105. While all legal professionals should follow robust standards of due diligence
in order to avoid regulator arbitrage, due regard should be accorded to differences in practices, size, scale and expertise amongst legal professionals, as well as the nature of the clients they serve. As a result, consideration must be given to these factors when creating a RBA that complies with the existing obligations of legal professionals. Certain notaries, for example, are subject to an array of duties as public officeholders. By contrast, legal professionals do not have such extensive public duties, but are nearly universally subject to duties of professional secrecy and an obligation to uphold their clients’ rights of legal professional privilege to their communications. Legal professionals with distinct “public” roles within national legal systems should carefully consider the interaction of their particular duties with the RBA outlined in this Guidance.
106. The particular responsibilities, status and role of the legal professional will, in
general, have a significant influence on what is appropriate for risk assessment. For example, in many civil law jurisdictions, notaries do not represent parties to a contract and are not intermediaries. They are obliged to be impartial and independent, advising both parties bearing in mind any disparity of power between them. Notaries carry duties as public office holders. These duties will influence the scope of what the notary must do to assess the ML/TF risk and how to act based on that assessment. Notaries should be conscious of the

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 39 © 2019 | FATF respectability they can add to documents, and the value this can add to those whose motives are nefarious.
107. Consideration should be given to the resources that can be reasonably
allocated to implement and manage an appropriately developed RBA. For example, a sole practitioner would not be expected to devote an equivalent level of resources as a large firm; rather, the sole practitioner would be expected to develop appropriate systems and controls and a RBA proportionate to the scope and nature of the practitioner’s practice and its clients. Small firms serving predominantly locally based and low risk clients cannot generally be expected to devote a significant amount of senior personnel’s time to conducting risk assessments. It may be more reasonable for sole practitioners to rely on publicly available records and information supplied by a client for a risk assessment than it would be for a large law firm having a diverse client base with different risk profiles. However, where the source is a public registry, or the client, there is always potential risk in the correctness of the information. Sole practitioners and small firms may also be regarded by criminals as more of a target for money launderers than large law firms. Legal professionals in many jurisdictions and practices are required to conduct both a risk assessment of the general risks of their practice, and of all new clients and current clients engaged in one-off specific transactions. The emphasis must be on following a RBA.
108. A significant factor to consider is whether the client and proposed work would
be unusual, risky or suspicious for the particular legal professional. This factor must be considered in the context of the legal professional’s practice, as well as the legal, professional, and ethical obligations in the jurisdiction(s) of practice. A legal professional’s RBA methodology may thus take account of risk variables specific to a particular client or type of work. Consistent with the RBA and proportionality, the presence of one or more of these variables may cause a legal professional to conclude that either enhanced CDD and monitoring is warranted, or conversely that standard CDD and monitoring can be reduced, modified or simplified. When reducing, modifying or simplifying CDD, legal professionals should always adhere to the minimum requirements as set out in national legislation. These variables may increase or decrease the perceived risk posed by a particular client or type of work and may include:
a) The nature of the client relationship and the client’s need for the legal professional to prepare for or carry out specified activities. b) The level of regulation or other oversight or governance regime to which a client is subject. For example, a client that is a financial institution or legal professional regulated in a country with a satisfactory AML/CFT regime poses less risk of ML/TF than a client in an industry that has ML/TF risks and yet is unregulated for ML/TF purposes. c) The reputation and publicly available information about a client. Legal persons that are transparent and well known in the public domain and have operated for a number of years without being convicted of proceed generating crimes may have low susceptibility to money laundering. This may not be the case where such a legal person is in financial distress or in a situation of liquidation/insolvency. d) The regularity, depth or duration of the client relationship may be a factor that lowers or heightens risk (dependant on the nature of the relationship).

e) The familiarity of the legal professional with a country, including knowledge of local laws, regulations and rules, as well as the structure and extent of regulatory oversight, as the result of a legal professional’s own activities. f) The proportionality between the magnitude or volume and longevity of the client’s business and its legal requirements, including the nature of services sought. g) Subject to other factors (including the nature of the services and the source and nature of the client relationship), providing limited legal services in the capacity of a local or special counsel may be considered a low risk factor. This may also, in any event, mean that the legal professional is not “preparing for” or “carrying out” a transaction for a specified activity identified in R.22. h) Significant and unexplained geographic distance between the legal professional and the location of the client where there is no nexus to the type of activity being undertaken. i) Where a prospective client has instructed the legal professional to undertake a single transaction-based service (as opposed to an ongoing advisory relationship) and one or more other risk factors are present. j) Where the legal professional knows that a prospective client has used the services of a number of legal professionals for the same type of service over a relatively short period of time. k) Risks that may arise from non-face-to-face relationships and could favour anonymity. Due to the prevalence of electronic communication between legal professionals and clients in the delivery of legal services, non-face-to-face interaction between legal professionals and clients would not be considered a high risk factor on its own. The treatment of non-face-to-face communications should always be subject to the approach taken by legislation and regulators in the relevantjurisdiction. l) The nature of the referral or origin of the client. A prospective client may contact a legal professional in an unsolicited manner or without common or customary methods of introduction or referrals, which may indicate increased risk. By contrast, where a prospective client has been referred from another trusted source or a source regulated for AML/CFT purposes (e.g. from another legal professional), the referral may be considered a mitigating risk factor. m) The structure of a client or transaction. Structures with no apparent legal, tax, business, economic or other legitimate reason may increase risk. Legal professionals often design structures (even if complex) for legitimate legal, tax, business, economic or other legitimate reasons, in which circumstances there may not be an indicator of increased risk of ML/TF. Legal professionals should satisfy themselves of a reasonable need for such complex structures in the context of the transaction. n) Trusts that are pensions may be considered lower risk.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 41 © 2019 | FATF Documentation of risk assessments
109. Several jurisdictions mandate various documentation requirements in
connection with AML/CFT.36 Legal professionals must always understand their ML/TF risks (for clients, countries or geographic areas, services, transactions or delivery channels). They should document those assessments to be able to demonstrate their basis. However, competent authorities or SRBs may determine that individual documented risk assessments are not required, if the specific risks inherent to the sector are clearly identified and understood.37
110. Legal professionals may fail to satisfy their AML/CFT obligations, for example
by relying completely on a checklist risk assessment where there are other clear indicators of potential illicit activity. Completing risk assessments in a time efficient yet comprehensive manner has become more important as legal professionals are now obliged in various jurisdictions to conduct a documented risk assessment for each client and share it with supervisory authorities when required.
111. A documented risk assessment may cover a range of specific risks by breaking
them down into the three common categories highlighted above: (a) geographic risks, (b) client-based risks and (c) service-based risks. These three risk categories have been identified and explained in the guide: “A Lawyer’s Guide to Detecting and Preventing Money Laundering”.38 The guide also provides graphic illustrations and case studies of how to assess risk under these three categories. In practice, risk factors could be categorised differently in different jurisdictions. However, all relevant risk factors should be considered.
112. Each of these risks could be assessed using indicators such as low risk,
medium risk and/or high risk. A short explanation of the reasons for each attribution should be included and an overall assessment of risk determined. An action plan39 (if required) should then be outlined to accompany the assessment and dated. Action plans can help identify potential red flags, facilitate risk assessment and decide on CDD measures to be applied. A simple template of risk assessment may be as below, for instance:
Geographic risk Client-based risk Service-based risk Low/medium/high risk Low/medium/high risk Low/medium/high risk Explanation Overall assessment: Low/Medium/High risk Action plan
113. A risk assessment of this kind should not only be carried out for each specific
client and service on an individual basis, as required, but also to assess and document the risks on a firm-wide basis, and to keep risk assessment up-to-date through monitoring of the 36 For example, the European Union law places an obligation on legal professionals working in an AML-regulated service to document risk assessments and ensure they are kept up to date (Article 8 of the Fourth Anti-Money Laundering Directive (EU) 2015/849). 37 Paragraph 8 of INR.1 38 A Lawyer’s Guide to Detecting and Preventing Money Laundering, is a collaborative publication of the International Bar Association, the American Bar Association and the Council of Bars and Law Societies of Europe, published in October 2014. 39 “Action plans” are described in some jurisdictions as the “document your thought process” form.

client relationship. The written risk assessment should be made accessible to all professionals having to perform AML/CFT duties. Proper safeguards should be put in place to ensure privacy of clients.
114. Where legal professionals are involved in longer term transactions, risk
assessments should be undertaken at suitable intervals across the life of the transaction, to ensure no significant risk factors have changed in the intervening period (e.g. new parties to the transaction, new sources of funds etc.). See [3.4.2] Ongoing monitoring of clients and special activities.
115. A final risk assessment should be undertaken before a transaction has
completed, allowing time for any required STR to be filed and any authority to move or transfer assets to be obtained from law enforcement (in countries where this is applicable). Risk management and mitigation
116. Identification and assessment of the ML/TF risks associated with certain
clients or categories of clients, and certain types of work will allow legal professionals to determine and implement reasonable and proportionate measures and controls to mitigate such risks. The risks and appropriate measures will depend on the nature of the legal professional’s role and involvement. Circumstances may vary considerably between professionals who represent clients directly and those who are engaged for distinct purposes including, for example, civil law notaries. In high risk scenarios, legal professionals must consider the extent to which they might be involved in unwittingly enabling the substantive offence of ML/TF by providing a legal service even with the application of enhanced CDD measures. Under such scenario, legal professionals should consider not to provide services or establish/continue business relationship with the client.
117. Legal professionals should implement appropriate measures and controls to
mitigate the potential ML/TF risks for those clients that, as the result of a RBA, are determined to be higher risk. These measures should be tailored to the specific risks faced, both to ensure the risk is adequately addressed and to assist in the appropriate allocation of finite resources for CDD. Paramount among these measures is the requirement to train legal professionals and appropriate staff to identify and detect relevant changes in client activity by reference to risk-based criteria. These measures and controls may include:
a) General training on ML/TF methods and risks relevant to legal professionals. b) Targeted training for increased risk awareness by the legal professionals providing specified activities to higher risk clients or to legal professionals undertaking higher risk work. c) Increased or more appropriately targeted CDD or enhanced CDD for higher risk clients/situations that concentrate on providing a better understanding about the potential source of risk and obtaining the necessary information to make informed decisions about how to proceed (if the transaction/ business relationship can be proceeded with). This could include training on when and how to ascertain evidence and record source of wealth and beneficial ownership information if required. d) Periodic review of the services offered by the legal professional and/or law firm, and the periodic evaluation of the AML/CFT framework applicable to the law firm or legal professional and the law firm’s own AML/CFT procedures, to

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 43 © 2019 | FATF determine whether the ML/TF risk has increased and adequate controls are in place to mitigate those increased risks. e) Reviewing client relationships on a periodic basis to determine whether the ML/TF risk has increased. Initial and ongoing CDD (R.10 and 22)
118. CDD measures should allow a legal professional to establish with reasonable
certainty the true identity of each client. The legal professional's procedures should apply in circumstances where a legal professional is preparing for or carrying out40 the specified activities listed in R.22 and include procedures to:
a) Identify and appropriately verify the identity of each client on a timely basis. b) Identify the beneficial owner, and take reasonable measures to verify the identity of the beneficial owner on risk-sensitive basis such that the legal professional is reasonably satisfied that it knows who the beneficial owner is. The general rule is that clients should be subject to the full range of CDD measures, including the requirement to identify the beneficial owner in accordance with R.10. The purpose of identifying beneficial ownership is to ascertain those natural persons who exercise effective influence or control over a client, whether by means of ownership, voting rights or otherwise. Legal professionals should have regard to this purpose when identifying the beneficial owner. They may use a RBA to determine the extent to which they are required to verify the identity of beneficial owner, depending on the type of client, business relationship and transaction and other appropriate factors in accordance with R.10 and INR.10 as articulated in the following box. This information is in many circumstances critical to helping legal professionals avoid conflicts of interest with other clients. Box 3. Beneficial ownership information obligations (see R.10, R.22 and INR.10) R.10 sets out the instances where legal professionals will be required to take steps to identify and verify beneficial owners, including when there is a suspicion of ML/TF, when establishing business relations, or where there are doubts about the veracity of previously provided information. INR.10 indicates that the purpose of this requirement is two-fold: first, to prevent the unlawful use of legal persons and arrangements, by gaining a sufficient understanding of the client to be able to properly assess the potential ML/TF risks associated with the business relationship; and, second, to take appropriate steps to mitigate the risks. Legal professionals should have regard to these purposes when assessing what steps are reasonable to take to verify beneficial ownership, commensurate with the level of risk.41 At the outset of determining beneficial ownership, steps should be taken to identify how the immediate client can be identified. Legal professionals can 40 See paragraphs 17-22 above for further information on when a legal professional would or would not be considered engaged in "preparing for" or "carrying out" transactions for clients, and hence when the requirements of R.22 would apply. 41 For more information and guidance relating to beneficial ownership information please refer to AML/CFT 2013 Methodology Criteria 10.5 and 10.8-10.12.

verify the identity of a client by, for example meeting the client in person and then verifying their identity through the production of a passport/identity card and documentation confirming his/her address. Legal professionals can further verify the identity of a client on the basis of documentation or information obtained from reliable, publicly available sources (which are independent of the client). A more difficult situation arises where there is a beneficial owner who is not the immediate client (e.g. in the case of companies and other entities). In such a scenario reasonable steps must be taken so that the legal professional is satisfied about the identity of the beneficial owner and takes reasonable measures to verify the beneficial owner’s identity. This likely requires taking steps to understand the ownership and control of a separate legal entity that is the client and may include conducting public searches as well as by seeking information directly from the client. Legal professionals will likely need to obtain the following information for a client that is a legal entity:
a) the name of the company; b) the company registration number; c) the registered address and/ or principal place of business (if different); d) the identity of shareholders and their percentage ownership; e) names of the board of directors or senior individuals responsible for the company’s operations; f) the law to which the company is subject and its constitution; and g) the types of activities and transactions in which the company engages. To verify the information listed above, legal professional may use sources such as the following:
a) constitutional documents (such as a certificate of incorporation, memorandum and articles of incorporation/association); b) details from company registers; c) shareholder agreement or other agreements between shareholders concerning control of the legal person; and d) filed audited accounts. Legal professionals should adopt a RBA to verify beneficial owners of an entity. It is often necessary to use a combination of public sources and to seek further confirmation from the immediate client that information from public sources is correct and up-to-date or to ask for additional documentation that confirms the beneficial ownership and company structure. The obligation to identify beneficial ownership does not end with identifying the first level of ownership, but requires reasonable steps to be taken to identify the beneficial ownership at each level of the corporate structure until an ultimate beneficial owner is identified. c) Obtain appropriate information to understand the client's circumstances and business depending on the nature, scope and timing of the services to be provided including, where necessary, the source of funds of the client. This

information may be obtained from clients during the normal course of their instructions to legal professionals. d) Conduct ongoing CDD on the business relationship and scrutiny of transactions throughout the course of that relationship to ensure that the transactions being conducted are consistent with legal professional’s knowledge of the client, its business and risk profile, including where necessary, the source of funds. Ongoing due diligence ensures that the documents, data or information collected under the CDD process are kept upto-date and relevant by undertaking reviews of existing records, particularly for higher-risk categories of clients. Undertaking appropriate CDD may also facilitate the accurate filing of STRs to an FIU where required, or to respond to requests for information from an FIU and law enforcement agencies.
119. The starting point is for legal professionals to assess the risks that the client
may pose taking into consideration any appropriate risk variables (and any mitigating factors) before making a final determination to accept the client, reject the client, or request additional information. In many situations and in many jurisdictions this risk assessment is required to be documented and kept in the client’s file. The legal professional should review this file as necessary, especially in a situation where the client looks to engage in a one-off or atypical transaction or where new red flags arise. The legal professional’s risk assessment should inform the overall approach to CDD and appropriate verification. Legal professionals should reasonably determine the CDD requirements appropriate to each client, which may include:
a) Standard CDD: A standard level of CDD, generally to be applied to all clients to whom specified services are provided. b) Simplified CDD: The standard level being reduced after consideration of appropriate risk variables, and in recognised lower risk scenarios, such as:
i. Publicly listed companies traded on certain exchanges (and their majority
owned subsidiaries). Although it should not be assumed that all publicly listed companies will qualify for simplified CDD, for example appropriate levels of reporting to the market will be a factor to take into account, as well as geographic risk factors.
ii. Financial institutions and other businesses and professions (domestic or
foreign) subject to an AML/CFT regime consistent with the FATF Recommendations.
iii. Public administration or enterprises (other than those from countries that
are being identified by credible sources as having inadequate AML/CFT systems, being the subject of sanctions, embargos or similar measures issued by the United Nations, having significant levels of corruption or other criminal activity or providing funding or support for terrorist activities, or having designated terrorist organisations operating within their country). c) Enhanced CDD: An increased level of CDD for those clients that are reasonably determined by the legal professional to be of higher risk. This may be the result of the client’s business activity, ownership structure, particular service offered including work involving higher risk countries or defined by applicable law or regulation as posing higher risk.

Where the legal professional is unable to comply with the applicable CDD
requirements, they should not carry out the transaction nor commence business relations, or should terminate the business relationship and consider filing an STR in relation to the client.
A RBA means that legal professionals should perform varying levels of work
according to the risk level. For example, where the client or the owner of the controlling interest is a public company that is subject to regulatory disclosure requirements, and that information is publicly available, fewer checks may be appropriate. In the case of trusts, foundations or similar legal entities where the beneficiaries are distinct from the legal owners of the entity, it will be necessary to form a reasonable level of knowledge and understanding of the classes and nature of the beneficiaries; the identities of the settlor, trustees or natural persons exercising effective control; and an indication of the purpose of the trust. Legal professionals will need to obtain a reasonable level of comfort that the declared purpose of the trust is in fact its true purpose.
The following box provides a non-exhaustive list of examples of standard,
enhanced and simplified CDD:
Box 4. Examples of Standard/Simplified/Enhanced CDD measures (see also INR.10) Standard CDD

Identifying the client and verifying that client’s identity using
reliable, independent source documents, data or information
Identifying the beneficial owner, and taking reasonable measures
on a risk-sensitive basis to verify the identity of the beneficial owner, such that the legal professional is satisfied about the identity of beneficial owner. For legal persons and arrangements, this should include understanding the ownership and control structure of the client and gaining an understanding of the client’s source of wealth and source of funds, where required
Understanding and obtaining information on the purpose and
intended nature of the business relationship
Conducting ongoing due diligence on the business relationship and
scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the business and risk profile of the client, including, where necessary, the source of wealth and funds Simplified CDD
Limiting the extent, type or timing of CDD measures
Obtaining fewer elements of client identification data
Altering the type of verification carried out on client’s identity
Simplifying the verification carried out on client’s identity

Inferring the purpose and nature of the transactions or business
relationship established based on the type of transaction carried out or the relationship established
Verifying the identity of the client and the beneficial owner after the
establishment of the business relationship
Reducing the frequency of client identification updates in the case
of a business relationship
Reducing the degree and extent of ongoing monitoring and scrutiny
of transactions
Enhanced CDD
Obtaining additional client information, such as the client’s
reputation and background from a wider variety of sources before the establishment of the business relationship and using the information to inform the client risk profile
Carrying out additional searches (e.g. internet searches using
independent and open sources) to better inform the client risk profile (provided that the internal policies of legal professionals should enable them to disregard source documents, data or information, which is perceived to be unreliable)
Where appropriate, undertaking further searches on the client or
beneficial owner to specifically understand the risk that the client or beneficial owner may be involved in criminal activity
Obtaining additional information about the client's source of wealth
or funds involved to seek to ensure they do not constitute the proceeds of crime. This could include obtaining appropriate documentation concerning the source of wealth or funds
Seeking additional information and, as appropriate, substantiating
documentation, from the client about the purpose and intended nature of the transaction or the business relationship
Increasing the frequency and intensity of transaction monitoring.
Enhanced CDD may also include lowering the threshold of
ownership (e.g. below 25%), to ensure complete understanding of the control structure of the entity involved. It may also include looking further than simply holdings of equity shares, to understand the voting rights of such holders. Ongoing monitoring of clients and specified activities (R.10 and 23)

The degree and nature of ongoing monitoring by a legal professional will
depend on the type of legal professional, and if it is a law firm, the size and geographic ‘footprint’ of the law firm, the ML/TF risks that the law firm has identified and the nature of the specified activity and services provided. In many instances, client information must already be monitored in this fashion to satisfy legal professionals’ other obligations (e.g. legal, professional, or ethical) to both their clients and as part of their general regulatory

obligations. For example, legal professionals may need to have a full and up-to-date understanding of their clients’ business to fully satisfy fiduciary duties towards their clients. In some jurisdictions, ethical or professional obligations may require a legal professional to discontinue their representation of a client on learning/knowing certain adverse information or in case of reasonable grounds to suspect that the client is involved in an ML/TF offence. Monitoring is often best achieved by individuals having contact with the client (either faceto-face or by other means of communication).
124. Ongoing monitoring of the business relationship should be carried out on a
risk related basis, to ensure that legal professionals are aware of any changes in the client’s identity and risk profile established at client acceptance. This requires an appropriate level of scrutiny of activity during the relationship, including enquiry into source of funds where necessary, to judge consistency with expected behaviour based on accumulated CDD information.
125. In larger law firms serving clients with a wide range of operations, legal
professionals with regular contact with the client may be narrowly focused on one aspect of the client’s business and/or need for specific advice. In these circumstances, it may be more effective to have screening processes and tools to identify potential risks that are generic to the client’s overall business, and that can then be flagged for the attention of legal professionals who have the most client contact. However, monitoring does not require legal professionals to function as, or assume the role of, a law enforcement or investigative authority vis-a-vis the client. It rather refers to maintaining awareness throughout the course of work for a client to the possibility of ML/TF activity and/or changes in the clients activities/personnel and/or other changing risk factors.
126. Monitoring of these advisory relationships cannot be achieved solely by
reliance on automated systems and whether any such systems would be appropriate will depend in part on the nature of a legal professional’s practice and resources reasonably available to the legal professional. For example, a sole practitioner would not be expected to devote an equivalent level of resources as a large law firm; rather, the sole practitioner would be expected to develop appropriate monitoring systems and a RBA proportionate to the scope and nature of the practitioner’s practice. A legal professional’s advisory relationships may well be best monitored by the individuals having direct client contact being appropriately trained to identify and detect changes in the risk profile of a client. Where appropriate this should be supported by systems, controls and records within a framework of support by the firm (e.g. tailored training programs appropriate to the level of staff responsibility, the role each staff member plays in the AML/CFT process at the firm and the types and volumes of clients and transaction for which the firm provided services).
127. Legal professionals should assess the adequacy of any systems, controls and
processes on a periodic basis. Monitoring programs should fall within the system and control framework developed to manage the risk of the firm. Certain jurisdictions may require that the results of the monitoring be documented.
128. The civil law notaries do not generally represent parties to a contract and
therefore must maintain a fair position with regard to any duty to both parties.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 49 © 2019 | FATF Suspicious transaction reporting, tipping-off, internal control and higher-risk countries (R.23)
129. R.23 sets out obligations for legal professionals on reporting and tipping-off,
internal controls and higher-risk countries as set out in R.20, R.21, R.18 and R.19. Suspicious transaction reporting and tipping-off (R.20, R.21 and 23)
130. R.23 requires legal professionals to report suspicious transactions set out in
R.20, when on behalf of, or for a client, they engage in a financial transaction in relation to the activities described in R.22. Subject to certain limitations, such reporting is not required if the relevant information is directly encompassed within a legitimate claim of professional secrecy or legal professional privilege. Legal professionals should be alert to these obligations in addition to separate requirements in their jurisdictions regarding tipping-off. These obligations, where they apply, can carry serious penalties when not properly complied with. As specified under INR.23, where legal professionals seek to dissuade a client from engaging in illegal activity, this does not amount to tipping-off.
131. Where a legal or regulatory requirement mandates the reporting of suspicious
activity once a suspicion has been formed, a report must always be made promptly and, therefore, a RBA for the reporting of the suspicious activity under these circumstances is not applicable. STRs are not part of risk assessment, but rather reflect a response mechanism – typically to an FIU or SRB once a suspicion has been formed. Legal professionals have an obligation not to facilitate illegal activity, so if there are suspicions, they could contact their FIU or SRB for guidance, obtain independent legal advice, if necessary and do not provide services to that person/company and report the transaction or the attempted transaction. Legal professionals may be asked to advise a client on the client's own obligation to report suspicious activity. In doing so, the legal professional may become aware of the subject matter giving rise to the suspicion. In these circumstances, the legal professional will need to consider whether it should file an STR where required. In the context of an international law firm, which may have a global Money Laundering Reporting Officer (MLRO), where a reportable suspicion arises in relation to a client, the MLRO need not necessarily make a report to the FIU in each jurisdiction where a client has a relationship but, rather, in the jurisdictions with a nexus to the matter giving rise to the suspicion. Internal controls (R.18 and 23)
132. Legal professionals differ significantly from financial institutions in terms of
size. By contrast to most financial institutions, a significant number of legal professionals have only a few staff. This limits the resources that small businesses and professions can dedicate to the fight against ML/TF. For a number of legal professionals, a single person may be responsible for the functions of front office, back office, reporting, and senior management. This dimension of a legal professional’s practice environment should be taken into account in designing a risk-based framework for internal controls systems. INR.18 specifies that the type and extent of measures to be taken for each of its requirements should be appropriate having regard to the size, nature and risk profile of the business.
133. The risk-based process must be a part of the internal controls of the legal
professional or law firm. Legal professionals operate within a wide range of differing business structures, from sole practitioners to large, multi-national partnerships. In smaller legal practices, legal professionals’ businesses tend to have a flat management structure and

accordingly, most or all of the principals (or partners) of the firm hold ultimate management responsibility. In other organisations, legal professionals employ corporate style organisational structures with tiered management responsibility. In both cases the principals or the managers are ultimately responsible for ensuring that the organisation maintains an effective internal control structure; regardless of the size of the legal practice, legal professionals are generally responsible for the actions of their partners and staff. Engagement by the principals and managers in AML/CFT is an important aspect of the application of the RBA since such engagement reinforces a culture of compliance, ensuring that staff adheres to the legal professional’s policies, procedures and processes to manage effectively ML/TF risks.
134. The nature and extent of the AML/CFT controls, as well as meeting national
legal requirements, need to be proportionate to the risk involved in the services being offered. In addition to other compliance internal controls, the nature and extent of AML/CFT controls will encompass a number of aspects, such as:
a) the nature, scale and complexity of a legal professional’s business. b) the diversity of a legal professional’s operations, including geographical diversity. c) the legal professional’s client, service and activity profile. d) the degree of risk associated with each area of the legal professional’s operations. e) the services being offered and the frequency of client contact (either by faceto-face meetings or by other means of communication).
135. Subject to the size and scope of the legal professional’s organisation, the
framework of risk-based internal controls should:
a) have appropriate risk management systems to determine whether a client, potential client, or beneficial owner is a PEP; b) provide for adequate controls for higher risk clients and services as necessary (e.g. additional due diligence, obtaining information on the source of wealth and funds of a client, escalation to senior management or additional review and/or consultation by the legal professional or within a law firm); c) provide increased focus on a legal professional’s operations (e.g. services, clients and geographic locations) that are more vulnerable to abuse for ML/TF; d) provide for periodic review of the risk assessment and management processes, taking into account the environment within which the legal professional operates and the services it provides; e) designate personnel at an appropriate level who are responsible for managing AML/CFT compliance; f) provide for an AML/CFT compliance function and review programme as appropriate given the scale of the organisation and the nature of the legal professional’s practice; g) inform the principals of compliance initiatives, identified compliance deficiencies and corrective action taken;

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 51 © 2019 | FATF h) provide for programme continuity despite changes in management or employee composition or structure; i) focus on meeting all regulatory measures for AML/CFT compliance, including record-keeping requirements and provide for timely updates in response to changes in regulations; j) implement risk-based CDD policies, procedures and processes, including review of client relationships from time to time to determine the level of ML/TF risks; k) provide for adequate supervision and support for staff activity that forms part of the organisation’s AML/CFT programme; l) incorporate AML/CFT compliance into job descriptions of relevant personnel; m) for legal professionals that share a common arrangement in some way (e.g. alliances of law firms), to the extent possible, provide a common control framework; n) adhere to country specific legislative requirements (such as residence requirements); o) provide for policies and procedures to ensure staff awareness of STR filing requirements; and p) implement a documented program of ongoing staff AML/CFT awareness and training.
136. Same measures and controls may often address more than one of the risk
criteria identified, and it is not essential that a legal professional establish specific controls targeting each risk criterion.
137. Legal professionals should consider using reputable technology-driven
solutions to minimise the risk of error and find efficiencies in their AML/CFT processes. As these solutions are likely to become more affordable, and more tailored to the legal profession as they continue to develop, this may be particularly important for smaller law firms that may be less able to commit significant resources of time to these activities. Under R.17, the ultimate responsibility for CDD measures should remain with legal professionals relying on the technology-driven solutions utilized.
138. At larger law firms, senior management should have a clear understanding of
ML/TF risks to manage the affairs of the law firm and to ensure adequate procedures are put in place to identify, manage, control and mitigate risks effectively. The RBA to AML/CFT needs to be embedded in the culture of law firms and the legal profession generally. Internal mechanisms to ensure compliance
139. Legal professionals (and where relevant senior management and the board of
directors (or equivalent body)) should monitor the effectiveness of internal controls. If they identify any weaknesses in those internal controls, improved procedures should be designed.
140. The most effective tool to monitor the internal controls is a regular (typically
at least annually) independent (internal or external) compliance review. If carried out internally, a staff member who may have a good working knowledge of the law firm’s AML/CFT internal control framework, policies and procedures and is sufficiently senior to

challenge them should perform the review. The person conducting an independent review should not be the same person who designed or implemented the controls being reviewed. The compliance review should include a review of CDD documentation to confirm that staff are properly applying the law firm’s procedures.
141. If the compliance review identifies areas of weakness and makes
recommendations on how to improve the policies and procedures, then senior management should monitor how the law firm is acting on those recommendations.
142. Legal professionals should review their firm-wide risk assessments regularly
and make sure that policies and procedures continue to target those areas where the ML/TF risks are highest. Vetting and recruitment
143. Legal professionals should consider the skills, knowledge and experience of
staff for AML/CFT both before they are appointed to their role and on an ongoing basis. The level of assessment should be proportionate to their role in the firm and the ML/TF risks they may encounter. Assessment may include criminal records checking and other forms of preemployment screening such as credit reference checks and background verification (as permitted under national legislation) for key staff positions. Education, training and awareness
144. R.18 requires that legal professionals provide their staff with AML/CFT
training. For legal professionals, and those in smaller law firms in particular, such training may also assist with raising awareness of monitoring obligations, and may also satisfy some jurisdictions’ continuing legal education obligations. A legal professional’s commitment to having appropriate controls in place relies fundamentally on both training and awareness. This requires a firm-wide effort to provide all relevant legal professionals with at least general information on AML/CFT laws, regulations and internal policies.
145. Firms should provide targeted training for increased awareness by the legal
professionals providing specified activities to higher risk clients or to legal professionals undertaking higher risk work. Training should also be targeted towards the role that individual legal professionals perform in the AML/CFT process. This could include false documentation training for those undertaking identification and verification duties, or training regarding red flags for those undertaking client/transactional risk assessment.
146. Training is not necessarily resource-intensive and it can take many forms.
Training can include group study where one member of staff outlines to other staff, relevant guidance, credible sources of information on legal sector risk or firm policies and/or provides regular email updates.
147. Case studies (both fact-based and hypotheticals) are a good way of bringing
the regulations to life and making them more comprehensible. Legal professionals must also be alert to the interaction with, and importance of legal professional privilege and professional secrecy in relation to AML/CFT laws in their particular jurisdictions.42 Likewise, legal professionals should be aware of the scope of application of the legal professional 42 See also the FATF Report on Vulnerabilities in the Legal Sector (2013), Chapter 4 “ML Typologies”.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 53 © 2019 | FATF privilege and professional secrecy in their jurisdictions, i.e. the cases and scenarios that fall under its application and those outside its scope.
148. In line with a RBA, particular attention should be given to risk factors or
circumstances occurring in the legal professional’s own practice. In addition, competent authorities, SRBs and representative bodies for both common and civil law notaries and law societies should work with educational institutions to ensure that the curriculum addresses ML/TF risks. The same training should also be made available for students taking courses to train to become legal professionals. For example, law societies and bar associations should be encouraged to produce jurisdiction-specific guidance based on this Guidance (such as the ABA’s Voluntary Good Practices Guidance), offer continuing legal education programs on AML/CFT and the RBA and large law firms should be encouraged to conduct in-house training programs on AML/CFT and the RBA.
149. The overall RBA and the various methods available for training and education
gives legal professionals flexibility regarding the frequency, delivery mechanisms and focus of such training. Legal professionals should review their own staff and available resources and implement training programs that provide appropriate AML/CFT information that is:
a) tailored to the relevant staff responsibility (e.g. client contact or administration); b) at the appropriate level of detail (e.g. considering the nature of services provided by the legal professional); c) at a frequency suitable to the risk level of the type of work undertaken by the legal professional; and d) used to assess staff knowledge of the information provided. Higher-risk countries (R.19 and 23)
150. Consistent with R.19, legal professionals should apply enhanced CDD
measures (also see box in paragraph 102 above), proportionate to the risks, to business relationships and transactions with clients from countries for which this is called for by the FATF.

Section IV- Guidance for supervisors
151. The RBA to AML/CFT aims to develop prevention or mitigation measures,
which are commensurate with the risks identified. This applies to the way supervisory authorities allocate their resources. R.28 requires that legal professionals are subject to adequate AML/CFT regulation and supervision. Supervisors and SRBs have different roles across jurisdictions and this section should be read in the context of what is applicable for a specific jurisdiction. Whichever model of supervision (i.e. by a designated supervisor or a SRB) is adopted by a country, it should be effective.
152. In many jurisdictions, supervisors and SRBs take an active role in identifying
ML/TF risks and may take a direct approach to regulating legal professionals’ obligatory responsibilities both generally and with regards to AML/CFT. Supervisors or SRBs should identify the particularities of the sector, assess its risks, controls and procedures in order to efficiently allocate its resources. In particular, supervisors for legal professionals should clearly allocate responsibility for managing AML/CFT related activity, where they are also responsible for other regulatory areas.
153. Although a country may have a legal framework that does not fully
accommodate the supervision of legal professionals in the manner described in this Section, the supervision of legal professionals in that country should nonetheless include as a minimum:
a) A requirement that legal professionals perform risk assessment at firm, client and transactional level. b) A requirement that legal professionals perform appropriate risk-based CDD. c) Procedures that ensure the system for licensing legal professionals prevents criminals from becoming legal professionals. d) Procedures determined to ensure prompt investigation of legal professional misuse of client/ trust funds or alleged involvement in ML/TF schemes. e) A requirement that legal professionals complete periodic continuing legal education in CDD and AML/CFT topics. f) A requirement that legal professionals report suspicious transactions, comply with tipping-off and confidentiality requirements, internal controls requirements and higher-risk countries requirements. g) A requirement that legal professionals adequately document risk assessment, CDD and other AML related decisions and processes undertaken. Risk-based approach to supervision
154. R.28 requires that legal professionals are subject to adequate AML/CFT
regulation and supervision for monitoring compliance. A RBA to AML/CFT means that the measures taken to reduce ML/TF are proportionate to the risks. Supervisors and SRBs should supervise more effectively by allocating resources to areas of higher ML/TF risk. While it is each country’s responsibility to ensure there is an adequate national framework in place in relation to regulation and supervision of legal professionals, any relevant supervisors and

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 55 © 2019 | FATF SRBs should have a clear understanding of the ML/TF risks present in the relevant jurisdiction.43 Supervisors and SRBs’ role in supervision and monitoring
155. Countries can ensure that legal professionals are subject to effective oversight
through the supervision performed by a SRB, provided that such an SRB can ensure that its members comply with their obligations to combat ML/TF. A SRB is a body representing a profession (e.g. legal professionals, notaries, other independent legal professionals, accountants or TCSPs) that has a role (either exclusive or in conjunction with other entities) in regulating the persons who are qualified to enter and practise in the profession. A SRB also may perform supervisory or monitoring functions (e.g. to enforce rules to ensure that high ethical and moral standards are maintained by those practising the profession).
156. Supervisors and SRBs should have appropriate powers to perform their
supervisory functions (including powers to monitor and to impose effective, proportionate and dissuasive sanction), and adequate financial, human and technical resources. Supervisors and SRBs should determine the frequency and intensity of their supervisory or monitoring actions on a RBA, taking into account inherent ML/TF risks in the legal sector, and mitigation by legal professionals and their firms.
157. Countries should ensure that supervisors and SRBs are equipped in
identifying and sanctioning non-compliance by its members. Countries should also ensure that SRBs are well-informed about the importance of AML/CFT supervision, including enforcement actions as needed.
158. Supervisors and SRBs should clearly allocate responsibility for managing
AML/CFT related activity, where they are also responsible for other regulatory areas. Countries should also address the risk that AML/CFT supervision by SRBs could be hampered by conflicting objectives pertaining to the SRB’s role in representing their members, while also being obligated to supervise them. If a SRB contains members of the supervised population, or represents those people, the relevant person should not continue to take part in the monitoring/ supervision of their practice/law firm to avoid conflicts of interest. This institutional conflict may be particularly relevant when it comes to enforcement, including sanctions, which should be sufficient to have a deterrent effect and also remove the benefits of non‐compliance. Background: national frameworks and understanding ML/TF risk- the role of countries
159. Countries should ensure that the extent to which a national framework allows
legal professionals to apply a RBA should also reflect the nature, diversity and maturity of the sector, and its risk profile as well the ML/TF risks associated with individual legal professionals.
160. Access to information about ML/TF risks is essential for an effective RBA.
Countries are required to take appropriate steps to identify and assess ML/TF risks on an ongoing basis in order to (a) inform potential changes to the country’s AML/CFT regime, including changes to laws, regulations and other measures; (b) assist in the allocation and prioritisation of AML/CFT resources by competent authorities; and (c) make information 43 See INR 28.1.

available for AML/CFT risk assessments conducted by legal professionals and the jurisdiction’s national assessment of risk. Countries should keep the risk assessments up-todate and should have mechanisms to provide appropriate information on the results to competent authorities, SRBs and legal professionals.44 In situations where some legal professionals have limited capacity to identify ML/TF risks, countries should work with the sector to understand their risks.
161. Supervisors and SRBs should, as applicable draw on a variety of sources to
identify and assess ML/TF risks. These may include, but will not be limited to, the jurisdiction’s national risk assessments, supra-national risk assessments, domestic or international typologies and supervisory expertise, as well as FIU feedback. The necessary information can also be obtained through appropriate information-sharing and collaboration among AML/CFT supervisors, when there are more than one for different sectors (legal professionals, accountants and TCSPs).
162. Competent authorities may also consider undertaking a targeted sectoral risk
assessment to get a better understanding of the specific environment in which legal professionals operate in the country and the nature of services provided by them.
163. Supervisors and SRBs should understand the level of inherent risk including
the nature and complexity of services provided by the legal professional. Supervisors and SRBs should also consider the type of services the legal professional is providing as well as its size and business model (e.g. whether it is a sole practitioner), corporate governance arrangements, financial and accounting information, delivery channels, client profiles, geographic location and countries of operation. Supervisors and SRBs should also consider the controls legal professionals have in place (e.g. the quality of the risk management policy, the functioning of the internal oversight functions and the quality of oversight of any outsourcing and subcontracting arrangements). Supervisors should note that under the RBA, particularly in the legal profession sector, given their diversity in scale, functions and number, there may be valid reasons for differences among risks and controls. There is therefore no one-size-fits-all approach. In evaluating the adequacy of their RBA, supervisors should take into consideration the circumstances of these differences.
164. Supervisors and SRBs should seek to ensure that their supervised populations
are fully aware of, and compliant with measures to identify and verify a client, the client’s source of wealth and funds where required, along with measures designed to ensure transparency of beneficial ownership, as these are cross-cutting issues that affect several aspects of AML/CFT.
165. To further understand the vulnerabilities associated with beneficial
ownership, with a particular focus on the involvement of professional intermediaries, supervisors should stay abreast of research papers published by international bodies. 45 Useful reference include the Joint FATF and Egmont Group Report on Concealment of Beneficial Ownership published in July 2018.
166. Supervisors and SRBs should review their assessment of legal professionals’
ML/TF risk profiles periodically, including when circumstances change materially or relevant new threats emerge and appropriately communicate this assessment to the legal professional community. 44 See INR 1.3. 45 Such as the FATF, the OECD, the WB, the IMF and the UNODC.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 57 © 2019 | FATF Mitigating and managing ML/TF risk
167. Supervisors and SRBs should take proportionate measures to mitigate and
manage ML/TF risk. Supervisors and SRBs should determine the frequency and intensity of these measures based on their understanding of the inherent ML/TF risks. Supervisors and SRBs should consider the characteristics of the legal professionals, particularly their role as professional intermediaries. It is essential to have a clear understanding of the ML/TF risks:
(a) present in the country; and (b) associated with the type of legal professionals and their clients, products and services.46
168. Supervisors and SRBs should take into account the risk profile of legal
professionals when assessing the adequacy of internal controls, policies and procedures. 47
169. Supervisors and SRBs should develop a means of identifying which legal
professionals or classes of legal professionals are at the greatest risk of being used by criminals and communicate those findings to the legal professionals. This involves considering both the probability and impact of ML/TF risk.
170. Probability means the likelihood of ML/TF taking place as a consequence of
the activity undertaken by legal professionals and the environment in which they operate. The risk can also vary depending on other factors:
a) service and product risk (the likelihood that products or services can be used for ML/TF); b) client risk (the likelihood that clients’ funds may have criminal origins); c) nature of transactions (e.g. frequency, volume and counterparties); d) geographical risk (whether the legal professional, its clients or other offices perform specified activities in riskier locations); and e) other indicators of risk are based on a combination of objective factors and experience, such as the supervisor’s wider work with the legal professional as well as information on legal professional’s compliance history, complaints about the legal professional or about the quality of the legal professional’s internal controls. Other such factors may include information from government/law enforcement sources, whistle-blowers or negative news reports in credible media, particularly those related to predicate offences for ML/TF or to financial crimes.
171. In adopting a RBA to supervision, supervisors may consider allocating
supervised entities sharing similar characteristics and risk profiles into groupings for supervision purposes. Examples of characteristics and risk profiles could include the size of business, type of clients serviced and geographic areas of activities. The setting up of such groupings could allow supervisors to take a comprehensive view of the sector, as opposed to an approach where the supervisors concentrate on the individual risks posed by the individual firms. If the risk profile of a legal professional within a grouping changes, supervisors may reassess the supervisory approach, which may include removing the firm from the grouping. 46 See INR 28.2. 47 See INR 28.3

Supervisors and SRBs should also consider the impact, (i.e. the potential harm
caused) if the legal professional or firm facilitates, unwittingly or otherwise, ML/TF. A small number of legal professionals may cause a high level of harm, including reputational harm to the profession. This can depend on:
a) size (i.e. turnover), number and type of clients, number of office locations, value of transactions, and b) links or involvement with other businesses (which could affect the susceptibility to being involved in ‘layering’ activity, e.g. concealing the origin of the transaction with the purpose to legalise the asset).
Supervisors and SRBs should update the risk assessment on an ongoing basis.
The result from the assessment will help determine the resources the supervisor will allocate to the supervision of the legal professionals.
Supervisors or SRBs should consider whether legal professionals meet the
ongoing requirements for continued participation in the profession as well as assessments of competence and of fitness and character. This will include whether the legal professional meets expectations related to AML/CFT compliance. This will take place both when a supervised entity joins the profession, and on an ongoing basis thereafter.
If a jurisdiction chooses to classify an entire sector as higher risk, it should be
possible to differentiate among categories of legal professionals based on various factors such as their client base, countries they deal with and applicable AML/CFT controls. Other determinative factors may include (a) whether the legal professional conducts litigation or transactional business; (b) whether the clients of the legal professional’s firm are in the private or public sector; or (c) whether the legal professional’s business is internationally or domestically focused.
Supervisors and SRBs should acknowledge that in a risk-based regime, not all
legal professionals will adopt identical AML/CFT controls and that an isolated incident where the legal professional is part of an illegal transaction unwittingly does not necessarily invalidate the integrity of a legal professional’s AML/CFT controls. At the same time, legal professionals should understand that a flexible RBA does not exempt them from applying effective AML/CFT controls. Supervision of the RBA Licensing or Registration
R.28 requires a country to ensure that regulated entities including legal
professionals are subject to regulatory and supervisory measures to ensure compliance by the profession with AML/CFT requirements.
R.28 requires the supervisor or SRB to take the necessary measures to prevent
criminals or their associates from being professionally accredited or holding or being the beneficial owner of a significant or controlling interest in an accredited legal professional entity (where this is permitted under national law and regulations) or holding a management function in a legal professional entity. This may be achieved through the evaluation of these persons through a “fit and proper” test.
A licensing or registration mechanism is one of the means to identify legal
professionals to whom the regulatory and supervisory measures, including the “fit and

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 59 © 2019 | FATF proper” test should be applied. It also enables the identification of the population of legal professionals, for the purposes of assessing and understanding the ML/TF risks for the country, and the action that should be taken to mitigate them in accordance with R.1. Not all jurisdictions take this approach, and the application and precise objectives of licensing and registration differ among the jurisdictions that do use these mechanisms.
180. Licensing or registration provides a supervisor or SRB with the means to fulfil
a “gatekeeper” role over who can enter a profession in which many individuals will be required to undertake the specified activities set forth in R.22. Not all accredited legal professionals who are appropriately licensed or registered may be performing the specified activities under R.22. There is no requirement for separate licensing or registration of legal professionals on the basis of their practice areas under the FATF Recommendations. Supervisors and SRBs should ensure that their supervisory efforts are directed at legal professionals whose practices involve the specified activities under R.22. Licensing or registration should also ensure that upon qualification, legal professionals are subject to AML/CFT compliance monitoring.
181. As appropriate, the supervisor or SRB should actively identify individuals and
businesses who should be supervised by using intelligence from other competent authorities (e.g. FIUs, company registry, or tax authority), information from financial institutions and DNFBPs, complaints by the public and open source information from advertisements and business and commercial registries, or any other sources that indicates that there are unsupervised individuals or businesses providing the specified activities under R.22.
182. Licensing or registration frameworks should define the activities that are
subject to licensing or registration, prohibit unlicensed or unregistered individuals or businesses providing these activities and set out measures for both refusing licences or registrations and for removing “bad actors”.
183. The terms “licensing” or “registration” are not interchangeable. Licensing
regimes generally tend to operate over financial institutions and impose mandatory minimum requirements based upon Core Principles on issues such as capital, governance, and resourcing to manage and mitigate prudential, conduct as well as ML/TF risks on an ongoing basis. Some jurisdictions have adopted similar licensing regimes for legal professionals, generally where legal professionals carry out trust and corporate services, to encompass aspects of conduct requirements in managing the higher level of ML/TF risks that have been identified in that sector.
184. A jurisdiction may have a registration framework over the entire DNFBP
sector, including legal professionals or have a specific registration framework for each constituent of a DNFBP. Generally, a supervisor or SRB carries out the registration function.
185. The supervisor or SRB should ensure that requirements for licensing or
registration and the process for applying are clear, objective, publicly available and consistently applied. Determination of the licence or registration should be objective and timely. A SRB could be responsible for both supervision and for representing the interest of its members. The SRB should ensure that registration decisions are taken separately and independently from its activities regarding member representation. Fit and proper tests
186. A fit and proper test provides a possible mechanism for a supervisor or SRB to take the necessary
measures to prevent criminals or their associates from owning, controlling or holding a

management function in a legal professional. Such tests are used in relation to legal professionals in some jurisdictions and may be used by supervisors or SRBs to ensure compliance with AML/CFT requirements.
187. In accordance with R.28, the supervisor or SRB should establish the integrity
of every beneficial owner, controller and individual holding a management function in a legal professional.
188. In some jurisdictions, a “fit and proper test” forms a fundamental part of
determining whether to license or register the applicant and whether on an ongoing basis the licensee or registrant (including its owners and controllers, where applicable) remains fit and proper to continue in that role. The initial assessment of an individual’s fitness and propriety is a combination of obtaining information from the individual and corroborating elements of that information against independent credible sources to determine whether the individual is fit and proper to hold that role.
189. The process for determining fitness and propriety generally requires the
applicant to complete a questionnaire. The questionnaire could gather personal identification information, residence and employment history, and require disclosure by the applicant of any convictions or adverse judgements, including pending prosecutions and convictions. Elements of this information should be corroborated to establish the bona fides of an individual. Such checks could include enquiries about the individual with law enforcement agencies and other supervisors, or screening the individual against independent electronic search databases. The personal data collected should be kept confidential.
190. The supervisor or SRB should also ensure that on an ongoing basis that those
holding or being the beneficial owner of significant or controlling interest in and individuals holding management functions are fit and proper. A fit and proper test should apply to new owners, controllers and individuals holding a management function. The supervisor or SRB should consider reviewing the fitness and propriety of these individuals arising from any supervisory findings, receipt of information from other competent authorities; or open source information indicating significant adverse developments. Guarding against “brass-plate” operations
191. The supervisor or SRB should ensure that its licensing or registration
requirements require the applicant to have a meaningful relationship with the country. Depending on the circumstances, a business with only staff who do not possess the professional requirements of a legal professional might not be licensed or registered.
192. A supervisor or SRB should consider the ownership and control structure of
the applicant to make a licensing or registration decision, where applicable. Factors to take into account could include consideration of where the beneficial owners and controllers reside and the type and quality of its management, including directors, managers and compliance officers.
193. The supervisor or SRB should consider whether the ownership and control
structure of law firms unduly hinders its identification of the beneficial owners and controllers or presents obstacles to applying effective supervision.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 61 © 2019 | FATF Monitoring and supervision
194. Supervisors and SRBs should take measures to effectively monitor legal
professionals providing specified legal services through on-site and off-site supervision. The nature of this monitoring will depend on the risk profiles prepared by the supervisor or SRB and the connected risk-based approach. Supervisors and SRBs may choose to adjust:
a) the level of checks required to perform their licensing/registration function:
where the ML/TF risk associated with the sector is low, the opportunities for ML/TF associated with a particular business activity may be limited, and approvals may be made on a review of basic documentation. Where the ML/TF risk associated with the sector is high, supervisors and SRBs may ask for additional information. b) the type of on-site or off-site AML/CFT supervision: supervisors and SRBs may determine the correct mix of on-site and off-site supervision of legal professionals. Off-site supervision may involve analysis of annual independent audits and other mandatory reports, identifying risky intermediaries (i.e. on the basis of the size of the firms, involvement in cross-border activities, or specific business sectors), automated scrutiny of registers to detect missing beneficial ownership information and identification of persons responsible for the filing. It may also include undertaking thematic reviews of the sector, making compulsory the periodic information returns from firms. Off-site supervision alone may not be appropriate in higher risk situations. On-site inspections may involve reviewing AML/CFT internal policies, controls and procedures, interviewing members of senior management, compliance officer and other relevant staff, considering gatekeeper’s own risk assessments, spot checking CDD documents and supporting evidence, looking at reporting of ML/TF suspicions in relation to clients, legal professionals and other matters, which may be observed in the course of an on-site visit and where appropriate, sample testing of reporting obligations. c) the frequency and nature of ongoing AML/CFT supervision: supervisors and SRBs should proactively adjust the frequency of AML/CFT supervision in line with the risks identified and combine periodic reviews and ad hoc AML/CFT supervision as issues emerge (e.g. as a result of whistleblowing, information from law enforcement, or other supervisory findings resulting from legal professionals’ inclusion in thematic review samples). d) the intensity of AML/CFT supervision: supervisors and SRBs should decide on the appropriate scope or level of assessment in line with the risks identified, with the aim of assessing the adequacy of legal professionals’ policies and procedures that are designed to prevent them from being abused. Examples of more intensive supervision could include: detailed testing of systems and files to verify the implementation and adequacy of the legal professionals’ risk assessment, CDD, reporting and record-keeping policies and processes, internal auditing, interviews with operational staff, senior management and the Board of Directors and AML/CFT assessment in particular lines of business.
195. Supervisors and SRBs should use their findings to review and update their
ML/TF risk assessments and, where necessary, consider whether their approach to AML/CFT supervision and the existing AML/CFT rules and guidance remain adequate. Whenever

appropriate, and in compliance with relevant confidentiality requirements, these findings should be communicated to legal professionals to enable them to enhance their RBA.
196. Record keeping and quality assurance are important, so that supervisors can
document and test the reasons for significant decisions relating to AML/CFT supervision. Supervisors should have an appropriate information retention policy and be able to easily retrieve information while complying with the relevant data protection legislation. Record keeping is crucial and fundamental to the supervisors’ work. Undertaking adequate quality assurance is also fundamental to the supervisory process to ensure decisionmaking/sanctioning is consistent across the supervised population. Enforcement
197. R.28 requires supervisors or SRB to have adequate powers to perform their
functions, including powers to monitor compliance by legal professionals. R.35 requires countries to have the power to impose sanctions, whether criminal, civil or administrative, on DNFBPs, to include legal professionals when providing the services outlined in R.22(d). Sanctions should be available for the directors and senior management of the firm when a legal professional fails to comply with requirements.
198. Supervisors and SRBs should use proportionate actions, including a range of
supervisory interventions and corrective actions to ensure that any identified deficiencies are addressed in a timely manner. Sanctions may range from informal or written warning, censure and reprimand to punitive measures (including disbarment and criminal prosecutions where appropriate) for more egregious non-compliance, as identified weaknesses can have wider consequences. Generally, systemic breakdowns or significantly inadequate controls will result in more severe supervisory response.
199. Enforcement by supervisors and SRBs should be proportionate while having a
deterrent effect. Supervisors and SRBs should have (or should delegate to those who have) sufficient resources to investigate and monitor non-compliance. Enforcement should aim to remove the benefits of non-compliance. Guidance
200. Supervisors and SRBs should communicate their regulatory expectations. This
should be done through a consultative process after meaningful engagement with relevant stakeholders, including legal professionals. This guidance may be in the form of high-level requirements based on desired outcomes, risk-based rules, and information about how supervisors interpret relevant legislation or regulation, or more detailed guidance about how particular AML/CFT controls are best applied. This could include guidance to clarify the interpretation and application of professional privilege and secrecy principle in the context of the nature of services provided by legal professionals.
201. Guidance issued to legal professionals should also discuss ML/TF risk within
their sector and outline ML/TF indicators (i.e. red flags) and methods of risk assessment to help them identify suspicious transactions and activity. All such guidance should preferably be consulted on, where appropriate, and drafted in ways that are appropriate to the context of the role of supervisors and SRBs in the relevant jurisdiction.
202. Where supervisors’ guidance remains high-level and principles-based, this
may be supplemented by further guidance written by the legal profession, which may cover operational and practical issues, and be more detailed and explanatory in nature. Training

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 63 © 2019 | FATF events may also provide an effective means to ensure legal professionals awareness and compliance with AML/CFT responsibilities. Where supervisors cooperate to produce combined guidance across sectors, supervisors should ensure this guidance adequately addresses the diversity of roles that come within the guidance’s remit, and that such guidance provides practical direction to all its intended recipients. The private sector guidance should be consistent with national legislation and with any guidelines issued by competent authorities with regard to the legal profession and be consistent with all other legal requirements and obligations.
203. Supervisors should consider communicating with other relevant domestic
supervisory authorities to secure a coherent interpretation of the legal obligations and to minimise disparities across sectors (such as legal professionals, accountants and TCSPs). Multiple guidance should not create opportunities for regulatory arbitrage. Relevant supervisory authorities should consider preparing joint guidance in consultation with the relevant sectors, while recognising that in many jurisdictions legal professionals will consider that separate guidance targeted at the legal profession will be the most appropriate and effective form.
204. Information and guidance should be provided by supervisors in an up-to-date
and accessible format. It could include sectoral guidance material, findings of thematic reviews, training events, newsletters, internet-based material, oral updates on supervisory visits, meetings and annual reports. Training
205. Supervisors and SRBs should ensure that their staff, and other relevant
employees are trained to assess the quality of ML/TF risk assessments and to consider the adequacy, proportionality, effectiveness, and efficiency of the AML/CFT policies, procedures and internal controls. It is recommended that the training has a practical basis/dimension. Supervisory staff should recognise that in implementing the RBA, legal professionals should make reasonable judgements for their particular services and activities. This may mean that no two legal professionals and no two firms are likely to adopt the same detailed practices.
206. Training should allow supervisory staff to form sound judgments about the
quality of the risk assessments made by legal professionals and the adequacy and proportionality of AML/CFT controls of legal professionals. It should also aim at achieving consistency in the supervisory approach at a national level, in cases where there are multiple competent supervisory authorities or when the national supervisory model is devolved or fragmented. Endorsements
207. Supervisors should avoid mandating the use of AML/CFT systems, tools or
software of any third party commercial providers to avoid conflicts of interest in the effective supervision of firms. Information exchange
208. Supervisors should encourage the information exchange between the public
and private sector and within private sector (e.g. between financial institutions and legal professionals) is important for combating ML/TF. Information sharing and intelligence sharing arrangements between supervisors and public authorities (such as Financial

Intelligence Units and law enforcement), where applicable should be robust, secure and subject to compliance with national legal requirements.
209. The type of information that could be shared between the public and private
sectors include:
a) ML/TF risk assessments; b) Typologies (i.e. case studies) of how money launderers or terrorist financers have misused legal professionals; c) feedback on STRs and other relevant reports; d) targeted unclassified intelligence. In specific circumstances, and subject to appropriate safeguards such as confidentiality agreements, it may also be appropriate for authorities to share targeted confidential information with legal professionals as a class or individually; and e) countries, persons or organisations whose assets or transactions should be frozen pursuant to targeted financial sanctions as required by R.6.
210. Domestic co-operation and information exchange between FIU and
supervisors of legal professionals and among competent authorities including law enforcement, intelligence, FIU, tax authorities, supervisors and SRBs is also important for effective monitoring/supervision of the sector. Such co-operation and co-ordination may help avoid gaps and overlaps in supervision and ensure sharing of good practices and findings. Such intelligence should also inform a supervisor’s risk-based approach to supervisory assurance. Intelligence about active misconduct investigations and completed cases between supervisors and law enforcement agencies should also be encouraged where appropriate. When sharing information, protocols and safeguards should be implemented in order to protect personal data.
211. Cross border information sharing of authorities and private sector with their
international counterparts is of importance in the legal sector, taking into account the multijurisdictional reach of many legal professionals. Supervision of beneficial ownership and source of funds/wealth requirements
212. The FATF Recommendations require competent authorities to have access to
adequate, accurate and timely information on the beneficial ownership and control of legal persons (R.24). In addition, countries must take measures to prevent the misuse of legal arrangements for ML/TF, in particular ensuring that there is adequate, accurate and timely information on express trusts (R.25). Implementation of the FATF Recommendations on beneficial ownership has proven challenging. As a result, the FATF developed the FATF Guidance on Transparency and Beneficial Ownership to assist countries in their implementation of R.24 and R.25, as well as R.1 as it relates to understanding the ML/TF risks of legal persons and legal arrangements. The FATF and Egmont Group also published the Report on Concealment of Beneficial Ownership in July 2018 which identified issues to help address the vulnerabilities associated with the concealment of beneficial ownership.
213. R.24 and R.25 require countries to have mechanisms to ensure that
information provided to registries is accurate and updated on a timely basis and that beneficial ownership information is accurate and current. To determine the adequacy of a system for monitoring and ensuring compliance, countries should have regard to the risk of

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 65 © 2019 | FATF AML/CFT in given businesses (i.e. if there is a proven higher risk then higher monitoring measures should be taken). Legal professionals must, however, be cautious in blindly relying on the information contained in registries. Ongoing monitoring is important during a relationship to detect unusual and potentially suspicious transactions as a result of a change in beneficial ownership, as registries are unlikely to provide such information on a dynamic basis.
214. Those responsible for company formation and the creation of legal
arrangements fulfil a key gatekeeper role to the wider financial community through the activities they undertake in the formation of legal persons and legal arrangements or in their management and administration. The guidance in relation to beneficial ownership information in this section is intended for legal professionals who are involved in such arrangements by acting in the capacity of a formation agent, company director, company secretary, office for service, nominee or other similar capacity.
215. Legal professionals are also required to undertake and document adequate
risk assessment of clients/transactions to fully understand the nature of the underlying clients’ business activity. Evidence could include business plans/governance documents, financial statements and company registry filings.
216. As DNFBPs, legal professionals are required to apply CDD measures to
beneficial owners of legal persons and legal arrangements to whom they are providing advice or formation services. In some countries, a legal professional may be required for registering a legal person and will be responsible for providing basic and/or beneficial ownership information to the registry. A number of countries have notarial systems where a notary will attest to the accuracy of registry filings.
217. In their capacity as company directors, trustees or foundation officials of these
legal persons and legal arrangements, legal professionals often represent these legal persons and legal arrangements in their dealings with other financial institutions and DNFBPs that are providing banking or audit services to these types of client.
218. These financial institutions and other DNFBPs may request the CDD
information collected and maintained by legal professionals, who because of their role as director or trustee, will act as the principal point of contact with the legal person or legal arrangement. These financial institutions and other DNFBPs may never meet the beneficial owners of the legal person or legal arrangement.
219. Under R.28, countries should ensure that legal professionals are subject to
effective systems for monitoring and ensuring compliance with AML/CFT requirements, which includes identifying the beneficial owner/s and taking reasonable measures to verify them. R.24 and R.25, which deal with transparency of beneficial ownership of legal persons and legal arrangements, require countries to have mechanisms for ensuring that adequate, accurate and up-to-date information is available on a timely basis on these legal entities.
220. In accordance with R.28, legal professionals should be subject to risk-based
supervision by a supervisor or SRB covering the beneficial ownership and record-keeping requirements of R.10 and R.11. The supervisor or SRB should have the supervisory framework, which can help in ascertaining that accurate and current basic and beneficial ownership information on legal persons and legal arrangements is maintained and will be available on a timely basis to competent authorities.

The supervisor or SRB should analyse the adequacy of the procedures and the
controls, which legal professionals have established to identify and record the beneficial owner. In addition, they should undertake sample testing of client records on a representative basis to gauge the effectiveness of the application of those measures and the accessibility of accurate beneficial ownership information.
During on-site and offsite inspections, the supervisor or SRB should examine
the policies, procedures and controls that are in place for on-boarding of new clients to establish what information and documentation is required where the client is a natural person or legal person or arrangement. The supervisor or SRB should verify the adequacy of these procedures and controls to identify beneficial owners to understand the ownership and control structure of these legal persons and arrangements and to ascertain the business activity. For example, self-declaration on beneficial ownership provided by the client without any other mechanism to verify the information may not be adequate in all cases.
Sample testing of records will assist the supervisor or SRB in determining
whether controls are effective for the accurate identification of beneficial ownership, accurate disclosure of that information to relevant parties and for establishing if that information is readily available. The extent of testing will be dependent on risk but the records selected should reflect the profile of the client base and include both new and existing clients.
The supervisor or SRB should consider the measures the legal professional has
put in place for monitoring changes in the beneficial ownership of legal persons and legal arrangements to whom they provide services to ensure that beneficial ownership information is accurate and current and to determine how timely updated filings are made, where relevant to a registry.
During examinations, the supervisor or SRB should consider whether to verify
the beneficial ownership information available on the records of the legal professional with that held by the relevant registry, if any. The supervisor or SRB may also consider information from other competent authorities such as FIUs, public reports and information from other financial institutions or DNFBPs, to verify the efficacy of the legal professional’s controls. Sources of funds and wealth
Legal professionals should be subject to risk-based supervision by a
supervisor or SRB covering the requirements to identify and evidence the source of funds and source of wealth for higher risk clients to whom they provide services. The supervisor or SRB should have the supervisory framework, which can help in ascertaining that accurate and current information on sources of funds and wealth is properly evidenced and available on a timely basis to competent authorities. The supervisor or SRB should analyse the adequacy of the procedures and the controls, which legal professionals have established to identify and record sources of wealth in arrangements. Nominee arrangements
A nominee director is a person who has been appointed to the Board of
Directors of the legal person who represents the interests and acts in accordance with instructions issued by another person, usually the beneficial owner.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 67 © 2019 | FATF
228. A nominee shareholder is a natural or legal person who is officially recorded
in the register of members and shareholders of a company as the holder of a certain number of specified shares, which are held on behalf of another person who is the beneficial owner. The shares may be held on trust or through a custodial agreement.
229. In a number of countries, legal professionals act or arrange for another person
(either an individual or corporate) to act as a director and act or arrange for another person (either an individual or corporate) to act as a nominee shareholder for another person as
part of their professional services. In accordance with R.24, one of the mechanisms to ensure
that nominee shareholders and directors are not misused is by subjecting these legal professionals to licensing and recording their status in company registries. Countries may rely on a combination of measures in this respect.
230. There are legitimate reasons for a legal professional to act as or provide
directors to a legal person or act or provide nominee shareholders. These may include the settlement and safekeeping of shares in listed companies where post traded specialists act as nominee shareholders. However, nominee director and nominee shareholder arrangements can be misused to hide the identity of the true beneficial owner of the legal person. There may be individuals prepared to lend their name as a director or shareholder of a legal person on behalf of another without disclosing the identity of the person from whom they will take instructions from or whom they represent. They are sometimes referred to as “strawmen”.
231. Nominee directors and nominee shareholders can create obstacles to
identifying the true beneficial owner of a legal person, particularly where the status is not disclosed. This is because it will be the identity of the nominee that is disclosed in the corporate records of the legal person held by a registry and in the company records at its registered office. Company law in various countries does not recognise the status of a nominee director because in law it is the directors of the company who are liable for its activities and the directors have a duty to act in the best interest of the company.
232. The supervisor or SRB should be aware that undisclosed nominee
arrangements may exist. They should consider whether undisclosed nominee arrangements would be identified and addressed during their on-site and offsite inspections and examination of the policies, procedures, controls and client records of the legal professional, including the CDD process and ongoing monitoring by the legal professional.
233. An undisclosed nominee arrangement may exist where there are the following
(non-exhaustive) indicators:
a) the profile of a director or shareholder is inconsistent with the activities of the company; b) the individual holds numerous appointments to unconnected companies; c) a director’s or shareholder’s source of wealth is inconsistent with the value and nature of the assets within the company; d) funds into and out of the company are sent to, or received from unidentified third party/ies; e) the directors or shareholders are accustomed to acting on instruction of another person; and

f) requests or instructions are subject to minimal or no scrutiny and/or responded to extremely quickly without challenge by the individual/s purporting to act as the director/s.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 69 © 2019 | FATF
Annex 1: Beneficial ownership information in relation to a trust or other legal
arrangements to whom a legal professional provides services

Taking a RBA, the amount of information that should be obtained by the legal
professional will depend on whether the legal professional is establishing or administering the trust, company or other legal entity or is acting as or providing a trustee or director of the trust, company or other legal entity. In these cases, a legal professional will be required to understand the general purpose behind the structure and the source of funds in the structure in addition to being able to identify the beneficial owners and controlling persons. A legal professional who is providing other services (e.g. acting as registered office) to a trust, company or other legal entity will be required to obtain sufficient information to enable it to be able to identify the beneficial owners and controlling persons of the trust, company or other legal entity.
A legal professional that is not acting as trustee may, in appropriate
circumstances, rely on a synopsis prepared by another legal professional or accountant or TCSP providing services to the trust or relevant extracts from the trust deed itself to enable the legal professional to identify the settlor, trustees, protector (if any), beneficiaries or natural persons exercising effective control. This is in addition to the requirement, where appropriate, to obtain evidence to verify the identity of such persons as discussed below. In relation to a trust
As described above, depending on the services being provided to the trust, a
legal professional should have policies and procedures in place to identify the following and verify their identity using reliable, independent source documents, data or information (provided that the legal professional’s policies should enable it to disregard source documents, data or information that are perceived to be unreliable) as described in more detail below:
i. the settlor;
ii. the protector;
iii. the trustee(s), where the legal professional is not acting as trustee;
iv. the named beneficiaries or class of beneficiaries, and
v. any other natural person actually exercising effective control over the trust.
Settlor a) A settlor is generally any person (or persons) by whom the trust is made. A person is a settlor if he or she has provided (or has undertaken to provide) property or funds directly or indirectly for the trust. This requires there to be an element of bounty (i.e. the settlor must be intending to provide some form of benefit rather than being an independent third party transferring something to the trust for full consideration). b) A settlor may or may not be named in the trust deed. Legal professionals should have policies and procedures in place to identify and verify the identity of the real economic settlor.

c) A legal professional establishing on behalf of a client or administering a trust, company or other legal entity or otherwise acting as or providing a trustee or director of a trustee, company or other legal entity should have policies and procedures in place (using a RBA) to identify the source of funds in the trust, company or other legal entity. d) It may be more difficult (if not impossible) for older trusts to identify the source of funds, where contemporaneous evidence may no longer be available. Evidence of source of funds may include reliable independent source documents, data or information, share transfer forms, bank statements, deeds of gift or letter of wishes. e) Where assets have been transferred to the trust from another trust, it will be necessary to obtain this information for both transferee and transferor trust. Beneficiaries a) Legal professionals should have policies and procedures in place, adopting a RBA to enable them to form a reasonable belief that they know the true identity of the beneficiaries of the trust, and taking reasonable measures to verify the identity of the beneficiaries, such that the legal professionals are satisfied that they know who the beneficiaries are. This does not require the legal professional to verify the identity of all beneficiaries using reliable, independent source documents, data or information but the legal professionals should at least identify and verify the identity of beneficiaries who have current fixed rights to distributions of income or capital or who actually receive distributions from the trust (e.g. a life tenant). b) Where the beneficiaries of the trust have no fixed rights to capital and income (e.g. discretionary beneficiaries), legal professionals should obtain information to enable them to identify the named discretionary beneficiaries (e.g. as identified in the trust deed). c) Where beneficiaries are identified by reference to a class (e.g. children and issue of a person) or where beneficiaries are minors under the law governing the trust, although legal professionals should satisfy themselves that these are the intended beneficiaries (e.g. by reference to the trust deed), they are not obliged to obtain additional information to verify the identity of the individual beneficiaries referred to in the class unless or until the trustees determine to make a distribution to such beneficiary. d) In some trusts, named individuals only become beneficiaries on the happening of a particular contingency (e.g. on attaining a specific age or on the death of another beneficiary or the termination of the trust period). In this case, a legal professional is not required to obtain additional information to verify the identity of such contingent beneficiaries unless or until the contingency is satisfied or until the trustees decide to make a distribution to such a beneficiary. e) A legal professional who administers the trust or company or other legal entity owned by a trust or otherwise
provides or acts as trustee or director to the trustee, company or other legal entity should have procedures in place so that there is a requirement to update the information provided if named beneficiaries are added or removed from the class of beneficiaries, or beneficiaries receive distributions or benefits for the first time after the

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 71 © 2019 | FATF information has been provided, or there are other changes to the class of beneficiaries. f) A legal professional is not obliged to obtain other information about beneficiaries other than to enable the legal professional to satisfy itself that it knows who the beneficiaries truly are or identify whether any named beneficiary or beneficiary who has received a distribution from a trust is a PEP. Natural person exercising effective control a) A legal professional providing services to the trust should have procedures in place to identify any natural person exercising effective control over the trust. b) For these purposes "control" means a power (whether exercisable alone or jointly with another person or with the consent of another person) under the trust instrument or by law to:
i. dispose of or invest (other than as an investment manager) trust
property;
ii. direct, make or approve trust distributions;
iii. vary or terminate the trust;
iv. add or remove a person as a beneficiary or to or from a class of
beneficiaries; and/or
v. appoint or remove trustees.
c) A legal professional who administers the trust or otherwise acts as trustee must, in addition, also obtain information to satisfy itself that it knows the identity of any other individual who has power to give another individual “control” over the trust; by conferring on such individual powers as described in paragraph (b) above. Corporate settlors and beneficiaries
4. These examples are subject to the more general guidance on what information
should be obtained by the legal professional to enable it to identify settlors and beneficiaries. It is not intended to suggest that a legal professional must obtain more information about a beneficiary that is an entity where it would not need to obtain such information if the beneficiary is an individual. a) In certain cases, the settlor, beneficiary, protector or other person exercising effective control over the trust may be a company or other legal entity. In such a case, a legal professional should have policies and procedures in place to enable it to identify (where appropriate) the beneficial owner or controlling person in relation to the entity. b) In the case of a settlor which is a legal entity, a legal professional should satisfy itself that it has sufficient information to understand the purpose behind the formation of the trust by the entity. For example, a company may establish a trust for the benefit of its employees or a legal entity may act as nominee for an individual settlor or on the instructions of an individual who has provided funds to the legal entity for this purpose. In the case of a legal entity acting as nominee for an individual settlor or on the instructions of an individual, the legal professional should take steps to satisfy itself as to the identity of the economic settlor of the trust (i.e. the person who has provided funds to the

legal entity to enable it to settle funds into the trust) and the controlling persons in relation to the legal entity at the time the assets were settled into trust. If the corporate settlor retains powers over the trust (e.g. a power of revocation), the legal professional should satisfy itself that it knows the current beneficial owners and controlling persons of the corporate settlor and understands the reason for the change in ownership or control. c) In the case of a beneficiary which is an entity (e.g. a charitable trust or company), a legal professional should satisfy itself that it understands the reason behind the use of an entity as a beneficiary. If there is an individual beneficial owner of the entity, the legal professional should satisfy itself that it has sufficient information to identify the individual beneficial owner. Individual and Corporate trustee a) Where a legal professional is not itself acting as trustee, it is necessary for the legal professional to obtain information to enable it to identify and verify the identity of the trustee (s) and, where the trustee is a corporate trustee, identify the corporate entity, obtain information on the identity of the beneficial owners of the trustee, and take reasonable measures to verify their identity. b) Where the trustee is a listed entity (or an entity forming part of a listed group) or an entity established and regulated to carry on trust business in a jurisdiction identified by credible sources as having appropriate AML/CFT laws, regulations and other measures, the legal professional should obtain information to enable it to satisfy itself as to the identity of the directors or other controlling persons. The legal professional can rely on external evidence, such as information in the public domain, to satisfy itself as to the beneficial owner of the regulated trustee (e.g. the website of the body that regulates the trustee and of the regulated trustee itself). c) It is not uncommon for families to set up trust companies to act for trusts for the benefit of that family. These are typically called private trust companies and may have a restricted trust licence that enables them to act as trustee for a limited class of trusts. Such private trust companies are often ultimately owned by a fully regulated trust company as trustee of another trust. In such a case, the legal professional should satisfy itself that it understands how the private trust company operates and the identity of the directors of the private trust company and, where relevant, the owner of the private trust company. Where the private trust company is itself owned by a listed or regulated entity as described above, the legal professional does not need to obtain detailed information to identify the directors or controlling persons of that entity that acts as shareholder of the private trust company. Individual and Corporate protector a) Where a legal professional is not itself acting as a protector and a protector
has been appointed, the legal professionals should obtain information to identify and verify the identity of the protector. b) Where the protector is a legal entity, the legal professional should obtain sufficient information that it can satisfy itself who is the controlling person and beneficial owner of the protector, and take reasonable measure to verify their identity.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 73 © 2019 | FATF c) Where the protector is a listed entity (or an entity forming part of a listed group) or an entity established and regulated to carry on trust business in a jurisdiction identified by credible sources as having appropriate AML/CFT laws, regulations and other measures, the legal professional should obtain information to enable it to satisfy itself as to the identity of the directors or other controlling persons. The legal professional can rely on external evidence, such as information in the public domain to satisfy itself as to the beneficial owner of the regulated protector (e.g. the website of the body that regulates the protector and of the regulated protector itself).

Annex 2: Sources of further information

Various sources of information exist that may help governments and legal
professionals in their development of a RBA. Although not an exhaustive list, this
Annex highlights a number of useful web-links that governments and legal
professionals may wish to draw upon. They provide additional sources of information, and further assistance might also be obtained from other information sources such as AML/CFT assessments. Legislation and Court Decisions
The rulings by the ECJ of June 26th, 2007 by the Belgium Constitution Court of
January 23rd 2008 and the French Conseil d’État of April 10th, 2008 confirmed that AML/CFT regulation cannot require or permit the breach of the legal professional’s duty of professional secrecy when performing the essential activities of the profession.
The Court of First Instance in the Joined Cases T-125/03 &T-253/03 Akzo Nobel
Chemicals Ltd and Akcros Chemicals Ltd v Commission of the European Communities has restated the ruling in the AM&S case that professional secrecy “meets the need to ensure that every person must be able, without constraint, to consult a legal professional whose profession entails the giving of independent legal advice to all those in need of it (AM&S, paragraph 18). That principle is thus closely linked to the concept of the legal professional’s role as collaborating in the administration of justice by the courts (AM&S, paragraph 24).
In Judgement of the Court (Grand Chamber) of 26 June 2007 in Case C-305/05 in a
question referred for a preliminary ruling, the Court holds that “the obligations of information and of cooperation with the authorities responsible for combating money laundering […] and imposed on legal professionals by Article 2a(5) of Directive 91/30848, account being taken of the second subparagraph of Article 6(3)49 thereof, do not infringe the right to a fair trial as guaranteed by Article 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms and
Article 6(2) EU”. The Court reaches this conclusion by considering that: (i)
obligations of information and cooperation apply to legal professionals only in so far as they advise their client in the preparation or execution of certain transactions; (ii) as soon as the legal professional acting in connection with a transaction is called upon for assistance in defending the client or in representing him before the courts, or for advice as to the manner of instituting or avoiding judicial proceedings, that 48 Article 2a(5) of Directive 91/308 listed the specified transactional activities in whose performance legal professionals were to be considered as obliged entities. 49 According to which “Member States shall not be obliged to apply the obligations laid down in paragraph 1 to notaries, independent legal professionals, auditors, external accountants and tax advisors with regard to information they receive from or obtain on one of their clients, in the course of ascertaining the legal position for their client or performing their task of defending or representing that client in, or concerning, judicial proceedings, including advice on instituting or avoiding proceedings, whether such information is received or obtained before, during or after such proceedings”.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 75 © 2019 | FATF legal professional is exempt from the obligations of information and cooperation, regardless of whether the information has been received or obtained before, during or after the proceedings. An exemption of that kind safeguards the right of the client to a fair trial; (iii) the requirements relating to the right to a fair trial do not preclude the obligations of information and cooperation from being imposed on legal professionals acting specifically in connection with the specified activities, in cases where the second subparagraph of Article 6(3) of that directive does not apply, where those obligations are justified by the need to combat money laundering effectively, in view of its evident influence on the rise of organised crime”50.
5. Michaud v. France case of 6 December 2012. This case concerned the obligation
on French legal professionals to report their suspicions regarding possible ML activities by their clients. Among other things, the applicant, a member of the Paris Bar and the Bar Council, submitted that this obligation, which resulted from the transposition of European directives, was in conflict with Article 8 of the European Convention on Human Rights, which protects the confidentiality of lawyer-client relations.
6. The European Court of Human Rights in its judgement held that there had been no
violation of Article 8 of the Convention. While stressing the importance of the confidentiality of lawyer-client relations and of legal professional privilege, it considered, however, that the obligation to report suspicions pursued the legitimate aim of prevention of disorder or crime, since it was intended to combat ML and related criminal offences, and that it was necessary in pursuit of that aim. The Court held that the obligation to report suspicions, as implemented in France, did not interfere disproportionately with legal professional privilege, since legal professionals were not subject to the above requirement when defending litigants and the legislation had put in place a filter to protect professional privilege, thus ensuring that legal professionals did not submit their reports directly to the authorities, but to the president of their Bar association.
7. Directive (EU) 2015/849 (AMLD) provides:
‒ Art. 2 AMLD: 1. This Directive shall apply to the following obliged entities: […] (3) the following natural or legal persons acting in the exercise of their professional activities: […] (b) notaries and other independent legal professionals, where they participate, whether by acting on behalf of and for their client in any financial or real estate transaction, or by assisting in the planning or carrying out of transactions for their client concerning the: (i) buying and selling of real property or business entities; (ii) managing of client money, securities or other assets; (iii) opening or management of bank, savings or securities accounts (iv) organisation of contributions necessary for the creation, operation or management of companies; (v) creation, operation or management of trusts, companies, foundations, or similar structures;
8. Art. 34(2):“Member States shall not apply the obligations laid down in Article 33(1)
to notaries, other independent legal professionals, auditors, external accountants and tax advisors only to the strict extent that such exemption relates to information that they receive from, or obtain on, one of their clients, in the course of ascertaining the legal position of their client, or performing their task of 50 http://curia.europa.eu/juris/liste.jsf?language=en&num=C-305/05

defending or representing that client in, or concerning, judicial proceedings, including providing advice on instituting or avoiding such proceedings, whether such information is received or obtained before, during or after such proceedings”51.
9. In the United States there is a “crime-fraud” exception to attorney-client privilege.
See, e.g. Am. Law Institute, Restatement of the Law Third, Restatement of the Law Governing Lawyers §82 Client Crime or Fraud (2000). As the U.S. Supreme Court observed, “[i]t is the purpose of the crime-fraud exception to the attorney-client privilege to assure that the ‘seal of secrecy’ … between legal professional and client does not extend to communications ‘made for the purpose of getting advice for the commission of a fraud.’” United States v. Zolin, 491 U.S. 554, 562 (1989) (internal citation omitted). Before determining whether this exception applies, there must be a showing of “a factual basis adequate to support a good faith belief by a reasonable person that in camera review of the materials may reveal evidence to establish a claim that the crime-fraud exception applies.” Id. at 572. Under case law in the U.S. further developing this principle, the crime-fraud exception can apply even where the attorney acts innocently—“the lawyers’ innocence does not preserve the attorney-client privilege against the crime-fraud exception. The privilege is the client’s, so it is the client’s knowledge and intentions that are of paramount concern to the application of the crime-fraud exception; the attorney need know nothing about the client’s ongoing or planned illicit activity for the exception to apply.” United States v. Chen, 99 F.3d 1495, 1504 (9th Cir. 1996) (internal quotations omitted). Under these principles, persons (both legal and natural) have been obliged to disclose pursuant to subpoenas or other legal process factual information that otherwise would have been subject to attorney-client privilege. See, e.g. In re Grand Jury, 705 F.3d 133, 155-61 (3d Cir. 2012). Guidance on the Risk-based Approach

Law Society of Ireland: www.lawsociety.ie52.
Law Society of England and Wales: www.lawsociety.org.uk
Law Society of Hong Kong: www.hklawsoc.org.hk
Organisme d'autoréglementation de la Fédération Suisse des Avocats et de la
Fédération Suisse des Notaires (SRO SAV/SNV): home page: snv.ch/www.srosav-snv.ch/fr/02_beitritt/01_regelwerke.htm/02_Reglement.pdf (art.41 to 46)
The Netherlands Bar Association: www.advocatenorde.nl
The Royal Dutch Notarial Society: www.notaris.nl
The American Bar Association Voluntary Good Practices Guidance for Legal
professionals to Detect and Combat Money Laundering and Terrorist Financing, published 23 April 2010, available on the ABA website:
www.americanbar.org.
51 Article 33(1) of the Directive refers to reporting STRs to the FIU 52 AML guidance and other AML resources available to solicitors in Ireland by logging into the members area www.lawsociety.ie/aml

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 77 © 2019 | FATF
8. The American Bar Association Standing Committee on Ethics and Professional
Responsibility Formal Opinion 463 on the Voluntary Good Practices Guidance, published 23 May, 2013, available on the ABA website: www.americanbar.org.
9. A Lawyer’s Guide to Detecting and Preventing Money Laundering,
collaborative publication of the International Bar Association, the American Bar Association and the Council of Bars and Law Societies of Europe, published October 2014, available on the IBA website: www.ibanet.org.
10. The FATF Report on Money Laundering and Terrorist Financing
Vulnerabilities of Legal Professionals, 2013, Chapters 4 and 5.
11. Comparative research published by the Solicitors Regulation Authority about
ML/TF vulnerabilities observed by the SRA in England and Wales.
12. Comparative Guidance for the legal sector in England and Wales, published by
the Legal Sector Affinity Group and approved by HM Treasury.
Other sources of information to help assist countries’ and legal professionals’ risk assessment of countries and cross-border activities
10. In determining the levels of risks associated with particular country or cross border
activity, legal professionals and governments may draw on a range of publicly available information sources. These may include reports that detail observance of international standards and codes, specific risk ratings associated with illicit activity, corruption surveys and levels of international co-operation. A nonexhaustive list is as follows:
i. IMF and World Bank Reports on observance of international standards and
codes (Financial Sector Assessment Programme)
WB reports:
http://documents.worldbank.org/curated/en/docsearch/documenttype/904559 a. IMF: www.imf.org/external/NP/rosc/rosc.aspx
ii. OECD Sub Group of Country Risk Classification (a list of country of risk
classifications published after each meeting) www.oecd.org/trade/topics/export-credits/arrangement-and-sectorunderstandings/financing-terms-and-conditions/country-riskclassification/
iii. Egmont Group of financial intelligence units that participate in regular
information exchange and the sharing of good practice www.egmontgroup.org/
iv. Signatory to the United Nations Convention against Transnational
Organized Crime www.unodc.org/unodc/crime_cicp_signatures_convention.html
v. The Office of Foreign Assets Control (“OFAC”) of the US Department of the
Treasury economic and trade, Sanctions Programmes www.ustreas.gov/offices/enforcement/ofac/programs/index.shtml

vi. Consolidated list of persons, groups and entities subject to EU Financial
Sanctions: https://data.europa.eu/euodp/data/dataset/consolidated-listof-persons-groups-and-entities-subject-to-eu-financial-sanctions
vii. Joint Guidelines of the European Supervisory Authorities (ESA) on antimoney laundering risk and counter terrorist financing https://esas-jointcommittee.europa.eu/Publications/Guidelines

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 79 © 2019 | FATF
Annex 3: Glossary of terminology
Beneficial Owner
Beneficial owner refers to the natural person(s) who ultimately owns or controls a customer and/or the natural person on whose behalf a transaction is being conducted. It also includes those persons who exercise ultimate effective control over a legal person or arrangement. Competent Authorities Competent authorities refers to all public authorities with designated responsibilities for combating money laundering and/or terrorist financing. In particular, this includes the FIU; the authorities that have the function of investigating and/or prosecuting money laundering, associated predicate offences and terrorist financing, and seizing/freezing and confiscating criminal assets; authorities receiving reports on cross-border transportation of currency and bearer negotiable instruments (BNIs); and authorities that have AML/CFT supervisory or monitoring responsibilities aimed at ensuring compliance by financial institutions and DNFBPs with AML/CFT requirements. SRBs are not to be regarded as a competent authorities. Core Principles Core Principles refers to the Core Principles for Effective Banking Supervision issued by the Basel Committee on Banking Supervision, the Objectives and Principles for Securities Regulation issued by the International Organization of Securities Commissions, and the Insurance Supervisory Principles issued by the International Association of Insurance Supervisors. Designated Non-Financial Businesses and Professions (DNFBPs) Designated non-financial businesses and professions means:
a) Casinos (which also includes internet and ship based casinos). b) Real estate agents. c) Dealers in precious metals. d) Dealers in precious stones. e) Lawyers, notaries, other independent legal professionals and accountants – this refers to sole practitioners, partners or employed professionals within professional firms. It is not meant to refer to ‘internal’ professionals that are employees of other types of businesses, nor to professionals working for government agencies, who may already be subject to AML/CFT measures. f) Trust and Company Service Providers refers to all persons or businesses that are not covered elsewhere under the FATF Recommendations, and which as a business, provide any of the following services to third parties:
o Acting as a formation agent of legal persons; o Acting as (or arranging for another person to act as) a director or secretary of a company, a partner of a partnership, or a similar position in relation to other legal persons;

o Providing a registered office; business address or accommodation, correspondence or administrative address for a company, a partnership or any other legal person or arrangement; o Acting as (or arranging for another person to act as) a trustee of an express trust or performing the equivalent function for another form of legal arrangement; o Acting as (or arranging for another person to act as) a nominee shareholder for another person. Express Trust Express trust refers to a trust clearly created by the settlor, usually in the form of a document e.g. a written deed of trust. They are to be contrasted with trusts that come into being through the operation of the law and that do not result from the clear intent or decision of a settlor to create a trust or similar legal arrangements (e.g. constructive trust). FATF Recommendations Refers to the FATF 40 Recommendations. Legal Person Legal person refers to any entities other than natural persons that can establish a permanent client relationship with a legal professional or otherwise own property. This can include bodies corporate, foundations, anstalt, partnerships, or associations and other relevantly similar entities. Legal Professional In this Guidance, the term “Legal professional” refers to lawyers, civil law notaries, common law notaries, and other independent legal professionals. Politically Exposed Persons (PEPs) Foreign and domestic PEPs are individuals who are or have been entrusted by a foreign country or domestically with prominent public functions, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials. Persons who are or have been entrusted with a prominent function by an international organisation refers to members of senior management, i.e. directors, deputy directors and members of the board or equivalent functions. The definition of PEPs is not intended to cover middle ranking or more junior individuals in the foregoing categories. Red Flags Any fact or set of facts or circumstances that, when viewed on their own or in combination with other facts and circumstances, indicate a higher risk of illicit activity. A “red flag” may be used as a short hand for any indicator of risk that puts an investigating legal professional on notice that further checks or other appropriate safeguarding actions will be required. The mere presence of a red flag indicator is not necessarily a basis for a suspicion of ML or TF, as a client may be able to provide a legitimate explanation. Red flag indicators should assist legal professionals in applying a risk-based approach to their CDD requirements. Where there are a number

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 81 © 2019 | FATF of red flag indicators, it is more like4ly that a legal professional should have a suspicion that ML or TF is occurring. Self-regulatory body (SRB) A SRB is a body that represents a profession (e.g. legal professionals, notaries, other independent legal professionals or accountants), and which is made up of members from the profession, has a role in regulating the persons who are qualified to enter and who practise in the profession, and also performs certain supervisory or monitoring type functions. Such bodies should enforce rules to ensure that high ethical and moral standards are maintained by those practising the profession. Supervisors Supervisors refers to the designated competent authorities or non-public bodies with responsibilities aimed at ensuring compliance by financial institutions (“financial supervisors”) and/or DNFBPs with requirements to combat money laundering and terrorist financing. Non-public bodies (which could include certain types of SRBs) should have the power to supervise and sanction financial institutions or DNFBPs in relation to the AML/CFT requirements. These non-public bodies should also be empowered by law to exercise the functions they perform, and be supervised by a competent authority in relation to such functions.

Annex 4: Supervisory practices for implementation of the RBA
Ireland
AML/CFT Compliance Monitoring in Ireland
The Law Society of Ireland is the educational, representative and regulatory body of the solicitors' profession in Ireland. In addition to the statutory functions it exercises under the Solicitors Acts, the Society is also the competent authority for the monitoring of solicitors for the purposes of compliance with Ireland’s anti-money laundering and counter-terrorist financing laws under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 as amended. The Society uses a risk-based system when choosing firms for inspection in addition to conducting a number of random inspections. For many years, firms have been chosen for inspection on the basis of pre-determined risk factors which trigger an accounts inspection. These risk factors include:

complaints by the public
previous investigation experience
the contents of the firm’s annual reporting accountant’s report
delays in complying with filing obligations in relation to accountants
reports and practicing certificates
professional indemnity insurance issues
judgement debts
media reports
notifications of concern by government authorities including An Garda
Síochána and the Revenue Commissioners
AML/CFT compliance checks are carried out in conjunction with the Society’s financial regulation of solicitors’ firms. When AML/CFT deficiencies are discovered, targeted standalone checks are implemented until any deficiencies are satisfactorily removed. The process available to compel compliance and used in the past is outlined below.
If a solicitor fails to implement procedures to combat ML/TF, a report is
submitted to the Regulation of Practice Committee who will require the solicitor to provide it with a copy of their new written AML/CFT procedures and evidence that those procedures have been communicated to all staff and will be implemented in full.
Where it is suspected that a solicitor has committed a substantive
offence of ML/TF or failed to fulfil reporting obligations, the matter is referred to the Money Laundering Reporting Committee of the Law Society for appropriate action.
The experience of the Law Society to date has been that the failure to
implement AML/CFT procedures tends to reflect a failure of the solicitor to implement satisfactory procedures to ensure compliance with the

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 83 © 2019 | FATF Solicitors Act, in particular the provisions of the Solicitors Accounts Regulations. When a solicitor fails to implement satisfactory procedures to ensure compliance with the Solicitors Accounts Regulations and with the Solicitors (ML and TF) Regulations, the Society will re-investigate the firm until such time that satisfactory procedures have been put in place. If the solicitor does not implement satisfactory procedures, the matter may be referred to the Solicitors Disciplinary Tribunal.

If it comes to the attention of the Law Society that a solicitor has been
engaged in dishonesty particularly in relation to clients’ monies (which may occur in parallel with activity suspected to be related to ML/TF), a number of sanctions can be applied, including:
‒ An application to the President of the High Court for an Order immediately suspending that solicitor from practice. ‒ An application for an Order that no bank shall make any payment from any bank account held by that solicitor or under that solicitor’s control. ‒ An application for an Order that any documents held by the solicitor be immediately delivered to the Law Society or its nominee.
In addition to supervision, the Law Society also engages in a range of
other AML/CFT outreach and engagement activities including:
‒ Awareness raising via a dedicated AML web resource hub, eZine articles, Gazette and email alerts ‒ The development of AML Guidance Notes - these are comprehensive notes covering all AML/CFT obligations and ML/TF risks, which follow a question and answer format for ease of reference. They also contain a dedicated chapter providing a non-exhaustive list of indicators of potential suspicious circumstances. ‒ In November 2018, supplementary guidance was provided to solicitors to help with new obligations which transpose 4AMLD. Topics covered include how to conduct a Business Risk Assessment, update Policies, Controls and Procedures, and carry out Customer Risk Assessments and 4AMLD changes to CDD measures. ‒ Tailored guidance via an Anti-Money Laundering Helpline. This helpline receives queries from solicitors about AML on a daily basis and provides real-time specific guidance. The helpline provides a vital confidential support service to solicitors when navigating potential red flags and deciding whether or not to proceed with a legal service. The Society’s guidance is to document their thought process with a particular emphasis on the risk of committing the substantive offence of money laundering should they provide a legal service which may exhibit red flags. In this way, the service can help prevent unwitting facilitation of money laundering by solicitors. ‒ AML Education is provided to trainee solicitors attending qualifying courses in the Law Society. In addition, for qualified solicitors, AML modules feature on the Law Society’s Diploma and CPD courses. Throughout 2017, for example, the Society delivered extensive AML training across the country and online through a total of 9 seminars with 2 379 attendees.

CPD Regulations 2015 (S.I. No. 480/2015) require firms to appoint an
AML Compliance Partner (failure to do so will mean that each partner in the firm will be designated as an AML Compliance Partner). The AML Compliance Partner must annually undertake a minimum of 3 hours training in regulatory matters, of which at least 2 hours shall be accounting and AML compliance. Training during 2017 has had a measurable impact on the awareness of solicitors of their AML obligations and ML/TF risks evidenced by increased demand for AML guidance in the days following an AML seminar. France The CARPA is a verification and regulation system under the responsibility of the Bar Council in France. It applies to all handling of funds received by lawyers on behalf of their clients. It conducts verification under the authority of the Chairman of the Bar Council and has a role in the fight against ML/TF. TRACFIN, the French FIU has an interest in the CARPA, guaranteeing the traceability of all financial flows. The rules of the CARPA system are as follows:
Any handling of funds made by a lawyer must be related to a legal or judicial act. Any handling of funds made by a lawyer on behalf of his clients must be routed through CARPA (with the sole exception that trusts do not enter into the scope of intervention of CARPA in the current state of the law). The bank account is opened in the name of CARPA, in which the funds received by the lawyers are deposited on behalf of their clients. A lawyer cannot receive funds or give instructions to pay them to the beneficiaries without the prior verification of CARPA exercised under the authority and the responsibility of the Bar Council and of the Chairman of the Bar Council. The verifications concern, in particular:
i. the nature and the description of the case;
ii. the origin of the funds;
iii. the destination of the funds;
iv. the actual beneficiary of the transaction; and
v. the connection between the financial payment and the legal
or judicial transaction carried out by the lawyer in the framework of his professional activity. CARPA can reject a transaction if it cannot verify the above elements. The CARPA is not a financial institution and is backed by a bank. As the CARPA is under the authority of the Bar Council and the Chairman of the Bar Council, lawyers have the obligation to provide the necessary explanations for the CARPA to operate without being able to rely upon professional secrecy (which would apply if they were dealing with a bank). The controls thus exercised by the CARPA on the one hand and by its bank

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 85 © 2019 | FATF on the other intersect in a complementary way with regard to professional secrecy. Malaysia AML/CFT Supervisory Practices of Legal Professionals in Malaysia A. Fit and Proper Requirements – Self-Regulatory Bodies (SRBs) In Malaysia, the legal professionals are regulated under the Legal Profession Act 1976, Advocate Ordinance Sabah 1953 and Advocate Ordinance Sarawak 1953, respectively. Prior to admission to the Bar, they are subject to appropriate market entry controls in which they are required to fulfil the “fit and proper” requirements under their respective governing legislation. Practising certificates will be subsequently issued by the High Court of Malaya and High Court of Sabah and Sarawak in conjunction with the respective SRBs for legal professionals, i.e. Bar Council Malaysia (BC) and Sabah Law Society (SLS) as the SRBs, as well as Advocates Association of Sarawak (AAS). B. AML/CFT Risk-based Supervision – Bank Negara Malaysia (BNM) Under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), BNM is the designated supervisory authority for the AML/CFT supervision of the Designated Non-Financial Businesses and Professions (DNFBPs) & Other Financial Institutions in Malaysia, including legal professionals. BNM adopts a risk-based approach supervision on legal professionals, in which the differentiation is guided by the outcome of the National Risk Assessment (NRA) and the application of Risk-Based Supervisory Framework for DNFBPs and Other Financial Institutions (D’SuRF), as follows:
i. National Risk Assessment (NRA) 2017
Malaysia’s third iteration of the NRA in 2017 comprising assessment of ML/TF inherent risk and overall control effectiveness had stipulated the legal professionals’ net ML and TF risks as “MEDIUM HIGH” and “MEDIUM” level, respectively, as exacerbated by the sector’s marginal control, as follows:
ML TF
Inherent Risk Medium Inherent Risk Low
Control Marginal Control Marginal
Net Risk Medium High Net Risk Medium
ii. Risk-Based Supervisory Framework for DNFBPs and Other
Financial Institutions (D’SuRF)

D’SuRF encapsulates end-to-end governance and supervisory process, riskbased application of supervisory tools. In line with the ML/TF rating of the sector and the application of D’SuRF, the frequency and intensity of monitoring on legal professionals are guided accordingly to include a range of supervisory tools, as follows:
On-site Examination
Firms are selected based on a robust selection process under the D’SuRF, which is in line with the risk profile of the reporting institutions (RIs). The on-site examination is in-depth, with assessments covering the RIs’ inherent risk and quality of risk management. In applying RBA, BNM imposes post-onsite follow-up measures for RIs with heightened risks. This includes requiring the RI to submit proposals to BNM on planned measures to rectify any supervisory issues and progress report until full rectification. The D’SuRF sets the deadline for both submissions. The follow-up measures have been imposed on a number of legal firms selected for on-site examination, highlighting the higher risk of the sector and consistent with the most recent NRA results. Off-site Monitoring and Supervisory Outreach Activities Apart from on-site examinations, BNM employs a range of off-site monitoring and supervisory outreach activities, aimed to elevate awareness and guide the implementation of the AMLA requirements by legal professionals. These off-site tools are also deployed according to the RBA, whereby the intensity and frequency for the legal professions is relatively higher compared to other sectors. Among the off-site monitoring, includes the submission of Data and Compliance Reports and internal audit reports. In addition, BNM and the relevant SRBs conduct periodic nationwide AML/CFT outreach and awareness programmes. Spain General Council of the Notariat of Spain – Money Laundering Centralised Prevention Body On 28/12/2005 the Spanish General Council of the Notariat established, pursuant to Ministerial Order 2963/2005, of 20 September 2005, regulating the Centralised Prevention Body, a body specialising in the self-regulation of notarial organisation, as permitted by the INR.23 “Countries may allow lawyers, notaries, other legal professionals and independent accountants to send their STRs to their appropriate selfregulatory organisations, provided that there are adequate forms of cooperation between these organisations and the FIU.” This Body takes on certain obligations in the name of notaries:

Transaction’s analysis.

Communication of suspicious transactions to the FIU.
Preparation of sector risk analysis
Preparation of risk-based AML/TF Internal Policies and
Procedures.
Definition of risk indicators for the notarial sector.
Training of notaries and employees.
Supervision of the fulfilment of AML/CTF obligations by notaries.
It intersects between the FIU and notaries, with the generic mission of intensifying collaboration between the notariat and authorities in fight against ML/TF. It has drawn up guides, manuals, FAQ documents, best practice documents; prepared in-house databases to improve the application of CDD at notary offices; resolved more than 7 000 consultations from notary offices; designed on-line training programmes; developed in-person training courses for notaries and employees; established a single matrix of common risk indicators; conducted a sectoral risk analysis; implemented remote supervision of all notary offices and in-person supervision at over 80 notarial practices, among other activities. The AML system used by Spain’s notaries represents a considerable advance for Public Authorities, which thanks to its implementation now have access to:
A new source of valuable information: notarial indexes (a single
database with information on all the public instruments and policies notarised and witnessed in the country). This information, processed in an integrated and automated manner to detect potential ML/TF operations
A body with AML specialists operating the database, who manage
the database, analyse and report to the FIU high-risk operations on behalf of notaries and who can analyse not only the transactions of each notary office (as would be the case if there were no centralised body) but all notary offices together. The system also offers advantages for notaries, who can delegate the management of (and in practice are relieved from) some of their duties (analysing and, where applicable, reporting operations with evidence of ML/TF, training, internal procedures, etc.) to a team of experts working on their behalf.

General Council of the Notariat of Spain – Practices for Due Diligence: Beneficial Ownership Database On 24 March 2012, the General Council of the Notariat resolved to set up the "Beneficial Ownership Database" ("Base de Datos de Titular Real", or "BDTR") personal data filing system, and in compliance with data protection regulations published this resolution in the Official State Gazette on 28 April 2012. The resolution allowed for information to be accessed:

By notaries, as they are subject to AML obligations.
By the Executive Service of the Commission for the Prevention of
Money Laundering and Monetary Offences (Spanish FIU) to fulfil the tasks entrusted to the Service.
By the court, taxation, law enforcement and administrative
authorities responsible for the prevention and investigation of money laundering.
By other parties subject to Prevention of Money Laundering Act
10/2010, of 28 April 2010, on the terms set out therein.
Article 6 of Royal Decree 304/2014, of 5 May, approving the Regulation
of Prevention of Money Laundering and Terrorist Financing Act 10/2010, of 28 April, established in Spanish law that “for fulfilment of the obligation to identify and verify the identity of the beneficial owner established in this
article, the parties subject to this Act may access the database of beneficial
ownership of the General Council of the Notariat …” As a result, not only notaries but also all parties subject to AML requirements may consult the BDTR to facilitate compliance with Due Diligence obligations. This thus allows the FIU and Law Enforcement Agencies to obtain information on owners with a percentage of less than 25% (full corporate regime) at Spanish private limited liability companies, on any given date. They may also request information on which companies a natural person owns (reverse beneficial ownership) on any given date. Two levels of information quality is ensured:
Information based on a statement to a public official (foreign
companies, foundations, associations, Spanish corporations).
Information verified in accordance with the sale and purchase
transaction of the shares of Spanish Private Limited Liability Companies. The General Council of the Notariat has established agreements with associations of parties subject to AML obligations (banks, savings banks, investment firms, auditors, lawyers, lottery agencies, credit institutions,

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 89 © 2019 | FATF casinos, etc.) and has provided the information called for in more than 2 000 000 requests made to these applicants. UK Supervisory Approach of the Solicitors Regulation Authority The Solicitors Regulation Authority (SRA) regulates solicitors and their firms, as well as other lawyers and non-lawyer managers working in law firms across England and Wales. The SRA also regulates those working as registered European lawyers or registered foreign lawyers. The SRA seeks to protect the public by ensuring that solicitors meet high standards and by acting when risks are identified. With regards to the Money Laundering Regulations, two thirds of firms that the SRA supervises (67%) offer services that fall within scope, the two main categories being acting as an independent legal professional or acting as a trust or company services provider There are significant barriers to entry to the profession. Requirements include having a qualifying law degree, followed by the Legal Practice Course and then a two-year period of recognised training incorporating the Professional Skills Course. Character and suitability test is also conducted before admission to the roll of solicitors. The SRA requires firms to obtain approval of owners and managers. Firms are required to have Compliance Officers of Legal Practice (COLPs) and Compliance Officers of Financial Administration (COFAs) approved by the SRA. They should have sufficient seniority and independence. Firms are also required to declare whether they are doing work within scope of the Money Laundering Regulations. Those firms in scope of the Regulations must submit an additional application form to declare any individual who is applying to register as a beneficial owner, officer or manager (BOOM). Risk-based approach The SRA carries out both qualitative and quantitative risk assessment of how the regulated community is exposed to ML/TF. Each firm is given a risk rating, which informs the supervisory approach of the SRA. Supervisory activities fall into two broad categories: i) reactive work (responding to concerns and breaches); and ii) proactive work (e.g. engaging with firms to prevent breaches, identify potential breaches, explore risks, enhance risk understanding and provide evidence of poor and good behaviours). The SRA uses the information/intelligence that it receives to build a firm’s profile. The assessment takes into account the specific breach alleged, the severity of the allegation, the quality of the information and their ability to investigate. Information is coded and then RAG rated (red, amber or green, with red being the most severe). Reports received are risk assessed and conduct matters are created for

matters assessed as high or medium. Those with an AML/CFT angle often leads to an onsite investigation where the main issues are considered, and a fact-based report produced. Enforcement: The SRA has a number of enforcement tools. This includes letter of advice, finding and warning, reprimand, severe reprimand and rebuke, based on the gravity of violation. The SRA also has powers to impose fines on individuals and firms. In cases of serious misconduct, the SRA can refer a case to the Solicitors Disciplinary Tribunal, which can impose higher fines and also has powers to suspend or strike off. The SRA has the power to disqualify individuals from involvement in specific roles in certain types of firms. It can also prosecute for information offences or acting as a bogus firm and can revoke authorisations or withdraw approvals. The SRA can also prevent non-lawyers from working within legal businesses. US Fit and Proper requirements: Lawyers53 in the United States The discussion below describes the fit and proper requirements in the US, which is the country with the largest number of lawyers subject to an alternative supervisory system. The highest court of the state in which a lawyer is licensed is responsible for adopting the version of the Model Rules of Professional Conduct applicable in that state and for enforcing the duties of lawyers under those rules. State bar associations or independent agencies created by court rules serve as licensing, regulatory, and disciplinary agencies of the court. The US system regulates lawyers throughout their careers and includes rigorous controls on lawyers. These controls begin with the rules on the bar admission and are designed, among other things, to prevent criminals from becoming or controlling lawyers and to detect effectively any breaches that might occur. Entry Requirements: Legal education in the US is a post graduate program, not an undergraduate program and most US jurisdictions require their bar examination applicants to have attended an ABAapproved law school. The US has a unified legal profession, which means that US lawyers who perform “transactional” legal work need to be licensed by state supreme courts and their disciplinary agencies, as do those lawyers who litigate cases in front of a court tribunal. As part of the mandatory licensing process, prospective lawyers are subject to a series 53 The term “Lawyers” is intentionally used in this discussion of the situation in the US as opposed to legal professionals as the requirements described do not extend to all legal professionals within the US.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 91 © 2019 | FATF of requirements to ensure they possess the necessary character and fitness to sit for the bar examination and to practice law. Applicants to US law schools need to disclose any criminal convictions or other encounters with the legal system. Ongoing Requirements: US lawyers must renew their licenses annually. The requirements for renewal include mandatory compliance with rules of professional conduct, mandatory rules about accounts involving client funds, and additional rules that vary from state to state and include matters such as mandatory continuing education requirements, random audits of client trust accounts, and programs designed to identify and assist lawyers with substance abuse and mental health issues. US lawyers have mandatory obligations to report wrongdoing by other lawyers and failure to comply subject a lawyer to discipline. Many states require lawyers to self-report criminal convictions to the lawyer disciplinary agency.

Annex 5: Examples of Red flags highlighting suspicious activities or transactions
for legal professionals54 a) The transaction is unusual, e.g.:
‒ the type of operation being notarised is clearly inconsistent with the size, age, or activity of the legal entity or natural person acting; ‒ the transactions are unusual because of their size, nature, frequency, or manner of execution; ‒ there are remarkable and highly significant differences between the declared price and the approximate actual values in accordance with any reference which could give an approximate idea of this value or in the judgement of the legal professional; ‒ legal person or arrangement, including NPOs, that request services for purposes or transactions, which are not compatible with those declared or not typical for those organisations. ‒ the transaction involves a disproportional amount of private funding, bearer cheques or cash, especially if it is inconsistent with the socioeconomic profile of the individual or the company’s economic profile. b) The customer or third party is contributing a significant sum in cash as collateral provided by the borrower/debtor rather than simply using those funds directly, without logical explanation. c) The source of funds is unusual:
‒ third party funding either for the transaction or for fees/taxes involved with no apparent connection or legitimate explanation; ‒ funds received from or sent to a foreign country when there is no apparent connection between the country and the client; ‒ funds received from or sent to high-risk countries. d) The client is using multiple bank accounts or foreign accounts without good reason. e) Private expenditure is funded by a company, business or government. f) Selecting the method of payment has been deferred to a date very close to the time of notarisation, in a jurisdiction where the method of payment is usually included in the contract, particularly if no guarantee securing the payment is established, without a logical explanation. g) An unusually short repayment period has been set without logical explanation. h) Mortgages are repeatedly repaid significantly prior to the initially agreed maturity date, with no logical explanation. 54 See also the Joint FATF and Egmont Group Report on Concealment of Beneficial Ownership, July 2018, Annex E – Indicators of concealed beneficial ownership.

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 93 © 2019 | FATF i) The asset is purchased with cash and then rapidly used as collateral for a loan. j) There is a request to change the payment procedures previously agreed upon without logical explanation, especially when payment instruments are suggested that are not appropriate for the common practice used for the ordered transaction. k) Finance is provided by a lender, either a natural or legal person, other than a credit institution, with no logical explanation or economic justification. l) The collateral being provided for the transaction is currently located in a highrisk country. m) There has been a significant increase in capital for a recently incorporated company or successive contributions over a short period of time to the same company, with no logical explanation. n) There has been an increase in capital from a foreign country, which either has no relationship to the company or is high risk. o) The company receives an injection of capital or assets in kind that is excessively high in comparison with the business, size or market value of the company performing, with no logical explanation. p) There is an excessively high or low price attached to the securities transferred, with regard to any circumstance indicating such an excess (e.g. volume of revenue, trade or business, premises, size, knowledge of declaration of systematic losses or gains) or with regard to the sum declared in another operation. q) Large financial transactions, especially if requested by recently created companies, where these transactions are not justified by the corporate purpose, the activity of the customer or the possible group of companies to which it belongs or other justifiable reasons.

Annex 6: Members of the RBA Drafting Group
FATF Members and observers
Office Country/Institution
Sarah Wheeler (Co-chair) Office for Professional Body AML Supervision (OPBAS), FCA UK Sandra Garcia (Co-chair) Department of Treasury USA Erik Kiefel FinCen Helena Landstedt and Josefin Lind County Administrative Board for Stockholm Sweden Charlene Davidson Department of Finance Canada Viviana Garza Salazar Central Bank of Mexico Mexico Fiona Crocker Guernsey Financial Services Commission Group of International Finance Centre Supervisors (GIFCS) Ms Janice Tan Accounting and Regulatory Authority Singapore Adi Comeriner Peled Ministry of Justice Israel Richard Walker Financial Crime and Regulatory Policy, Policy & Resources Committee Guernsey Selda van Goor Central Bank of Netherlands Netherlands Natalie Limbasan Legal Department OECD Accountants Member Office Institution Michelle Giddings (Co-chair) Professional Standards Institute of Chartered Accountants of England & Wales Amir Ghandar Public Policy & Regulation International Federation of Accountants Legal professionals and Notaries Member Office Institution Stephen Revell (Co-chair) Freshfields Bruckhaus Deringer International Bar Association Keily Blair Economic Crime, Regulatory Disputes department PWC, UK Mahmood Lone Regulatory issues and complex cross-border disputes Allen & Overy LLP, UK Amy Bell Law Society’s Task Force on ML Law Society, UK William Clark ABA’s Task Force on Gatekeeper Regulation and the Profession American Bar Association (ABA) Didier de Montmollin Founder DGE Avocats, Switzerland Ignacio Gomá Lanzón Alexander Winkler CNUE’s Anti-Money Laundering working group Council of the Notariats of the European Union (CNUE) Notary office Austria Rupert Manhart Anti-money laundering Committee Council of Bars and Law Societies of Europe Silvina Capello UINL External consultant for AML/CFT issues International Union of Notariats (UINL)

GUIDANCE FOR A RISK-BASED APPROACH FOR LEGAL PROFESSIONALS │ 95 © 2019 | FATF FATF Members and observers Office Country/Institution TCSPs Member Office Institution John Riches (Co-chair) and Samantha Morgan RMW Law LLP Society of Trust and Estate Practitioners (STEP) Emily Deane Technical Counsel Paul Hodgson Butterfield Trust (Guernsey) Ltd The Guernsey Association of Trustees Michael Betley Trust Corporation International Paula Reid A&L Goodbody A&L Goodbody, Ireland

Similar documents from other regulators