Rule 71 Rules of Professional Conduct for Legal Practitioners

Rule 71 of the Rules of Professional Conduct for Legal Practitioners (RPC) 2023 is about Reporting Obligations. It is under Part III (Risk Based Approach and Client Due Diligence) of Chapter 2 (Guidelines and Rules on Anti-money Laundering and Combating Financing of Terrorism for Legal Practitioners) of the Rules. It provides as follows:

(1) A legal practitioner or law firm shall have a system clearly setting out the requirements for filing Suspicious Transaction Reports (STRs) to the NBAAMLC for onward transmission to the NFIU.

(2) Once a reasonable suspicion has been formed of suspicious activity, a report shall be made promptly, failure of which amounts to a misconduct and being liable to disciplinary proceedings in accordance with the Act.

(3) STRs are not part of risk assessment, but rather reflect a response mechanism to reasonably formed suspicions.

(4) A law firm or legal practitioner shall develop an effective internal controls structure against ML and TF.

(5) For the purposes of paragraph (4) of this rule measures to be adopted include—
(a) the law firm or legal practitioner’s practice environment should be designed considering a risk-based framework for internal controls system ;
(b) the type and extent of measures to be taken by a law firm or legal practitioner for each of its requirements should be appropriate having regard to the size, nature, and risk profile of the business ;
(c) the risk-based process shall be a part of the internal controls of the law firm or legal practitioner ; and

(d) legal practitioners or law firms shall ensure engagement by the principals or managers with staff in AML and CFT related matters as such engagement reinforces culture of compliance, ensuring that staff adheres to the law firm or legal practitioner’s policies, procedures, and processes to effectively manage ML and TF risks.

(6) The nature and extent of AML and CFT controls will depend upon
several factors, such as the —
(a) nature, scale, and complexity of a legal practitioner’s business ;
(b) diversity of a legal practitioner’s operations, including geographical diversity ;
(c) legal practitioner’s client, service, and activity profile ;
(d) degree of risk associated with each area of the legal practitioner’s operations ; and
(e) services being offered and the frequency of client contact, either by face-to-face meetings or by other means of communication.

(7) Subject to the size and scope of the legal practitioner’s organization, the framework of risk-based internal controls should—
(a) have appropriate risk management systems to determine whether a client, potential client, or beneficial owner is a PEP or a person subject to applicable financial sanctions ;
(b) provide for adequate controls for higher risk clients and services as necessary (including additional due diligence, obtaining information on the source of wealth and funds of a client, escalation, or additional review and/or consultation by the legal practitioner or within a law firm) ;
(c) provide increased focus on a legal practitioners’ operations (e.g. services, clients and geographic locations) that are more vulnerable to abuse for ML/TR;
(d) provide for periodic review of the risk assessment and management processes ;
(e) designate personnel at an appropriate level who are responsible for managing AML and CFT compliance ;

(f) provide for an AML andCFT compliance function and review programme as appropriate given the scale of the organization and the nature of the legal practitioners’ practice :
(g) inform the principals of compliance initiatives, identified compliance deficiencies and corrective action taken ;
(h) provide for programme continuity despite changes in management or employee composition or structure ;
(i) focus on meeting all regulatory measures for AML and CFT compliance, including record-keeping requirements and provide for timely updates in response to changes ;

(j) implement risk based CDD policies, procedures and processes, including review of client relationships from time to time to determine the level of ML and TF risks ;
(k) provide for adequate supervision and support for staff activity that forms part of the organization’s AML and CFT programme ;
(J) incorporate AML and CFT compliance into job descriptions of relevant personnel ;
(m) provide for policies and procedures to ensure staff awareness of STR filing requirements ; and
(n) implement a documented program of ongoing staff AML and CFT awareness and training.

(8) Law firms or legal practitioners may employ same measures and controls to address more than one of the identified risks in the organization, and it is not mandatory that a legal practitioner establish specific controls targeting each risk criterion.

(9) For the purpose of paragraph (8) of this rule, following may be considered—
(a) law firms or legal practitioners may consider using reputable technology-driven solutions to minimize the risk of error and find efficiencies in their AML and CFT processes ;

(b) senior management of law firms should have a clear understanding of ML and TF risks to manage the affairs of the law firm and to ensure procedures are put in place to identify, manage, control, and mitigate risks effectively, and the RBA to AML and CFT shall be embedded in the culture of law firms
and the legal profession generally ;
(c) law firms or legal practitioners shall monitor the effectiveness of its internal controls, by conducting a regular, independent and compliance review and where any weakness is identified, improved procedures should be designed.

(d) law firm or legal practilioners should review their firm-wide risk assessments regularly and make sure that policies and procedures continue to target those areas where the ML and TF risks are highest ; and
(e) law firms or legal practitioners shall consider the skills, knowledge, and experience of staff in relation to AML and CFT before they are appointed to their roles on an ongoing basis.