FATF: One year on

Introduction 

The Financial Action Task Force (FATF) is an intergovernmental organisation established to set recommendations and monitor global standards in respect of anti-money laundering (AML) and counter-terrorist financing (CFT). In 2019, FATF conducted an on-site assessment of the UAE’s operation to meet FATF’s recommendations. This visit was the basis for the publication in April 2020 of a Mutual Evaluation Report (MER), which identified risks and concerns in the UAE’s approach and effectiveness in combatting AML and CFT. In March 2022, following an observation period and a further report, the UAE was placed on the “Grey List” of countries under increased monitoring by FATF’s International Co-operation Review Group (ICRG).

Since the MER, the UAE Government has made strong political commitments to strengthen the country’s AML/CTF regime and agreed with ICRG on an action plan to address the issues identified by FATF. These commitments have been met with substantive action and are taking effect, as reflected in the statement released by FATF at the conclusion of its February 2023 Plenary session in Singapore, observing that the UAE had “demonstrated significant progress [to strengthen the effectiveness of its AML/CFT regime]” referencing amongst other matters the sustained increase in outbound MLA requests to help facilitate the investigation of terrorist financing and money laundering.

FATF also used this opportunity to identify four areas in which the UAE should continue to implement its FATF action plan. The final step involved, “…demonstrating a sustained increase in effective investigations and prosecutions of different types of ML cases consistent with UAE’s risk profile”. The importance of this step cannot be underestimated as it is a vital metric in determining the practical use being made of the increased MLA requests and intelligence sharing.

It is in that context, and as the first anniversary of the UAE’s Grey Listing approaches, that it seems an appropriate moment to take stock of the approach adopted by the UAE’s main regulatory and enforcement bodies in this period.

DIFC - Dubai Financial Services Authority (DFSA)

Most regulators would argue that AML is always been a key focus of their attention. Given the length of time investigations can take and their confidential nature that is not always an easy fact to gage. However, looking at the published DFSA Decision Notices it is evident that there is a notable shift in the subject of enforcement action from jurisdictional breaches (e.g. operating from the DIFC without a licence) to breaches of the DFSA’s own rules on AML practice and procedure. The most substantive action was published in November 2022, when the DFSA issued a Decision Notice against Bank of Singapore (BOS) for failing to implement and maintain adequate systems and controls over a five-year period, in contravention of the DFSA’s Rules in its AML Module. The imposition of a significant fine on BOS of US$1,120,000 (after 30% reduction for settlement) reflects the seriousness of the breaches and the DFSA’s view of them. The content of the Decision Notice is recommended reading for any compliance professional dealing with DFSA regulated entities, setting out as it does fundamental expectations for an authorised firm’s AML systems and controls.

This enforcement action was followed by fines for less substantive but nevertheless serious AML failings in January 2023, when Decision Notices were issued against two companies for repeatedly filing late AML Returns (the annual submission of which is a mandatory requirement for all Authorised Firms and vital to the DFSA’s ability to analyse data and trends on a key part of their Financial Crime Prevention programme). This first was Nasco France SAS, who were fined USD 8,000 after filing a late AML Return for three consecutive years (the latest period being 14 days after the deadline). Up next were EY Law LLP, fined USD 12,000 for late filing of its AML Return on two consecutive occasions (the latest period being 31 days after the deadline for submission). Interestingly for firms to note is that the DFSA considered the late submission fees imposed on both firms at the time of the breaches were not sufficient to address its broader concerns in respect of repeated misconduct, nor deter similar action in the future.

Other than the late filing, the DFSA made no criticism was made of the content of the AML Returns in either matter, and no breaches of relevant systems and controls were identified. As to the reason for it taking action in these cases, the DFSA emphasised the “repeated” nature of the breaches by each of the respondents.

Given the facts of these matters, the issuing of a Decision Notice is a clear sign to the market that the DFSA intend to take a robust approach to breaches of the Rules in its AML Module, irrespective of the nature of the breach.

Whether intentional or happenstance, this trend for enforcing AML breaches is consistent with the DFSA’s recently published Business Plan for 2023/2024 in which AML/CTF enforcement is flagged as a key regulatory priority. Combined with the fact that their Abraaj-related investigations now appear closed, and in light of FATF’s progress report, we anticipate more of the DFSA’s focus in the next twelve months will be on supervision and enforcement of AML related breaches. Whether this will result in more substantive actions such as BOS, or a continuation of enforcement action for repeated administrative failures remains to be seen.

ADGM - Financial Services Regulatory Authority (FSRA)

The last two quarters of 2022 saw increased regulatory enforcement action in the Abu Dhabi Global Market, including issuance of the first penalty for AML related breaches. In August 2022, the FSRA issued a Final Notice against Wise Nuqud Ltd, imposing a fine of $360,000 for contraventions of its Anti-Money Laundering and Sanctions Rules and Guidance Rulebook. This was a significant investigation into a licenced money service provider and may well be a sign of the FSRA’s increased willingness and ability to actively pursue such breaches (see my earlier post for details and take-aways on this case).

Throughout 2022 the FSRA also issued Penalty Notices against Reporting Financial Institutions who failed to conduct due diligence procedures and maintain records in breach of its regulations covering the OECD’s Common Reporting Standards (CRS). These regulations form part of the UAE’s CRS Compliance programme and set out the self-certification requirements RFIs thought their SEOs and Money Laundering Report Officers should follow. These form an important but understated part of the UAE’s anti-money laundering protections and compliance with them is key.

The FSRA has historically shown an appetite for issuing Final Notices against authorised firms who submitted late annual AML Returns – albeit no such actions have been taken since May 2021. Like the DFSA, it will be interesting to see the extent to which this forms part of the FSRA’s approach to AML supervision and enforcement in the next twelve months.

UAE Central Authority 

The UAE Central Bank, through its Anti-Money Laundering and Combatting the Financing of Terrorism Supervision Department (AMLD), continues to contribute to the UAE’s National Action Plan to implement FATF’s recommendations. This includes supervision of Licenced Financial Institutions (LFIs) to ensure adherence to the UAE’s AML/CFT regulatory framework and imposing sanctions for breaches of the same. In February 2023 a fine of USD 490,000 was imposed on a finance company for breaching the UAE’s AML/CFT laws. Press reporting suggested that the breaches related to “high risk” and “repeated” violations of AML laws compounded by a weak compliance culture and a lack of sufficient systems and controls to prevent AML breaches.

It is anticipated that the AMLD will continue to supervise and issue significant fines for AML. One thing to look out for is whether there is a change in policy in naming the firms involved and the precise legislative provisions that have been breached. Such transparency would undoubtedly assist those operating the UAECB’s supervision and practitioners advising them.

Ministry of Economy (MoE)

In December 2022, penalties amounting to AED3.2 million were imposed by the Ministry of Economy on six companies for violating AML/CFT laws and failing to have measures in place to identify financial crime risk. The precise details of the companies and the violations were not disclosed, but the types of companies involved can likely be gleaned from the fact that the MoE’s remit is to conduct regular inspections on the activities falling under the designated non-financial business companies, such as dealers in precious metals and stones, real estate agents, auditors and corporate service providers.

There is no reason to assume that this was an isolated investigation and it would not be surprising to see the MoE further exert its influence in the next twelve months over those it authorises. As with the AMLD, the same hope applies in respect of transparency in identifying those in breach and the related laws.

The Securities & Commodities Authority (SCA)

The SCA has a specific mandate to monitor the compliance of SCA-licenced entities for AML/CTF actions. Of note in the last twelve months is the SCA’s efforts at developing virtual asset investment regulations to cover onshore UAE, as part of which it completed consultation with authorities in the UAE to ensure this sector was alive to the money laundering and terrorist financing risks and that it would be able to adhere to FATF recommendations and requirements.

The adoption of regulation in the NFT/crypto-arena is certainly one to keep an eye on over the next 12 months, particularly in light of the issuance of the Virtual Assets and Related Activities Regulations 2023 (the Regulations) by the Dubai Virtual Asset Regulatory Authority. This new area of virtual asset regulation is one FATF are likely to scrutinise for strict and enforceable AML/CFT protections, particularly given the rise in NFT fraud currently promulgating the market.

Criminal Prosecution

In January 2022, a new criminal Penal Code (Federal Law 31 of 2021) came into force, adding to an existing set of money laundering laws and regulation in the UAE. Although no official data is available, anecdotal evidence strongly suggests that money laundering prosecutions and convictions continue to rise, assisted in no short manner by the introduction of specialist anti-money laundering courts in 2021. Reported criminal enforcement action include the conviction of 18 individuals charged with laundering AED 185 million over a six-year period, and a three year prison term and a fine of AED 14.7 million for an individual charged with laundering public funds. We expect the prosecution of money laundering to continue to make headlines, along with an increase in related bribery and corruption offences.

Conclusion 

The next FATF Plenary in scheduled to be held in Paris in June 2023. While this may be a step too soon for the UAE’s removal from the Grey List, the consistent progress made by the country in satisfying the FATF Action Plan suggests that this cannot be too far away. The spotlight in the interim will remain on the work being done to implement the regulatory and legislative framework in place, nowhere more so than on the enforcement bodies referred to above.