Where the FCA finds that firms are in material breach of the AML Regulations, supervisors will require that a remediation plan is put in place by the firm, typically under the direction of a skilled person. To minimise the financial crime risk, the FCA may seek to restrict the activities of the firm until it is satisfied that the firm is compliant.
Historically the FCA's approach is to restrict the firm from taking on new customers or new high-risk customers. For example, in its 2013/2014 annual report into money laundering the FCA reported that it had obtained voluntary undertakings from six banks, including a large UK institution, that they would not enter into certain types of high-risk relationships until AML control weaknesses had been corrected.
More recently, in 2017 Commerzbank agreed to implement business restrictions, which included temporarily ceasing onboarding new high-risk customers, and in 2018, as part of enforcement proceedings, the FCA imposed a restriction on Canara Bank preventing it from accepting deposits from any new customers. The restriction was limited to new customers "to ensure that it does not impact upon current deposit account holders".
However, in 2020 the FCA has embarked on a new approach to AML failure, which can be illustrated by examining how the FCA dealt with one firm - ePayments Systems Limited (ePayments). ePayments is an electronic money institution authorised by the FCA under the Electronic Money Regulations. ePayments is one of the biggest digital payments companies in the UK with over a million individual accounts and over 1,000 business accounts.
On 11 February 2020 the Financial Conduct Authority (FCA) imposed a requirement upon ePayments which prevented it from conducting any business with customers categorised by ePayments as "corporate, individuals and/or freelancer customers". The requirement not only prevented ePayments from taking on new customers, crucially it also prevented ePayments from undertaking any business with existing customers, even preventing the closure of accounts or making repayments to existing customers. Overnight, and without notice, the FCA had effectively frozen over one million accounts operated by customers, the vast majority of which are almost certainly entirely legitimate. ePayments itself told customers that "Following a review by the [FCA] of [ePayments] anti-money laundering systems and controls, a number of weaknesses have been identified which require urgent remediation to ensure that our customers can enjoy a safe and secure platform."
Customers might have expected the "urgent remediation" to result in the unfreezing of accounts in a matter of days. However it was not until 25 February 2021 (over a year later) that the FCA permitted the firm to begin the process of refunds to customers (subject to obtaining the FCA's consent in each case). The latest update from ePayments of 28 April 2021 explains that the process has now been approved for low and medium risk Individual customers. Other customers (including corporate customers) will still have to wait.
This case is not an isolated example of the new approach. In response to a Mishcon de Reya information request, the FCA has told us that, because of failures to comply with their obligations under the Regulations it imposed similar requirements (which went as far as preventing the return of monies or assets to existing customers) on two other firms in 2020 and a further firm in 2021. In contrast, the FCA did not impose any requirements in the years from 2018 to 2019.
If this is the FCA's new approach to AML non-compliance, it's an approach that is unwelcome. Whilst its actions clearly minimise the risk of financial crime, it is at the expense of many thousands of customers, who through no fault of their own, find that their accounts are frozen with no access to their funds.
Of course, asset freezing orders are not new and they exist as part of both civil and criminal litigation. However, they are invariably obtained because of concerns about the bona fides of the account holder (not the bank or financial institution). Furthermore, the courts recognise the draconian nature of asset freeze orders and rules are in place to ensure that they are obtained on proper grounds, are limited in time, and appropriate procedures exist to challenge them.
In contrast, the action taken by the FCA to freeze the accounts of thousands of customers has been taken through a purely administrative act, without the scrutiny of any court, on evidence that customers are not entitled to see and without any process in place for customers to challenge.
There is another consequence of the FCA's action – the impact on competition. It is inconceivable that the FCA would seek to impose similar account freezing requirements on a major bank – the macro-economic consequences would be enormous and the Prudential Regulation Authority would simply not allow it.
The FCA professes to welcome innovation and competition in payment systems. Christopher Woolard, former acting CEO of the FCA, said in a speech in 2017 "changes are welcome, as competition has long been a concern in the retail banking industry". However, the message the FCA is sending with these actions is that if you choose to depart from the established banking sector for payment services and pick the wrong provider, you run the risk of your monies being frozen for an indefinite period.
The FCA has three statutory operational objectives. These are to secure an appropriate degree of protection for consumers, to protect and enhance the integrity of the UK financial system, and to promote effective competition in the interests of consumers. Clearly, in these cases, the FCA considers the second of these objectives to outrank the other two.
In our view, the FCA needs to re-assess its priorities in these cases. The risks of allowing customers to make a one-off closing payment to an account (in their name) at another regulated financial institution (which has its own obligations to undertake customer due diligence) are low. In contrast, the distress, inconvenience and cost to innocent customers by these actions is obvious. The FCA is perhaps fortunate that no disgruntled customer has yet sought to challenge the FCA's actions though judicial review. However, if a customer is big enough and angry enough, that could well happen.
For firms subject to the AML Regulations, these cases are salutary reminders that the FCA supervisory response to AML failures may be significantly worse than any enforcement action, and in the worst cases, the enforcement and supervisory responses will go hand in hand.