Rule 66 Rules of Professional Conduct for Legal Practitioners

Rule 66 of the Rules of Professional Conduct for Legal Practitioners (RPC) 2023 is about Documentation of risks. It is under Part III (Risk Based Approach and Client Due Diligence) of Chapter 2 (Guidelines and Rules on Anti-money Laundering and Combating Financing of Terrorism for Legal Practitioners) of the Rules. It provides as follows:

The following rules shall guide the documentation of ail risks assessment—
(a) all risk assessments shall be documented and a legal practitioners or firms shall always understand their ML and TF risks :
(b) a legal practitioner or law firm shall conduct a documented risk assessment for each client ;

(c) a documented risk assessment may cover a range of specific risks and categorize same into geographic, clients-based, or service-based risks :
(d) each of these risks may be assessed using indicators such as low risk, medium risk and high risk, and a short explanation of the reasons for each attribution should be included and an overall assessment of risk determined :

(e) an action plan (if required) should be outlined to accompany the assessment and dated. and action plans may help identify potential red flags, facilitate risk assessment, and decide on CDD measures to be applied ;
(f) in assessing the risk profile of the client, reference shall be made to the relevant targeted financial sanctions lists to confirm that neither the client nor the beneficial owner is designated and included in any of them.

(g) risk assessment of this kind should not only be carried out for each specific client and service on an individual basis, but also to assess and document the risks on a firm-wide basis, and to keep risk assessment up to date through monitoring of the client relationship :
(h) the internal Risk Assessment Guidelines (RAG) shall be made accessible to all legal practitioners in the law firm having to perform AML and CFT duties and proper safeguards should also be put in place to ensure privacy of clients ;

(i) where legal practitioners or law firms are involved in longer term transactions, risk assessments should be undertaken at suitable intervals across the lifespan of the transaction, to ensure that no significant risk factors have changed in the intervening period ; and
(j) a final risk assessment should be undertaken before a transaction is completed, allowing time for any required suspicious transaction report to be filed,