10 May NZ Law Firms – What is the real cost of achieving AML/CFT compliance?
As New Zealand law firms are getting ready for life under the AML/CFT regime, the cost of compliance is coming sharply into focus and is receiving increasing attention as firms realise what is involved, and the impact it may have on the ability to undertake client work ahead of the 1st July deadline.
Since the beginning of the year, Initialism has been working with law firms across New Zealand. Our extensive engagement with law firms the length and breadth of New Zealand, has provided significant insight into the effort and therefore the real costs faced by law firms in getting to grips with compliance with the AML/CFT Act.
The costs of non-compliance are well articulated, and firms should keep in mind that the penalties for breaching the AML/CFT Act are significant:
– Partners could be fined up to $200,000 personally and/or face a term of imprisonment of up to two years.
– The law firm could incur a fine as high as $2,000,000.
Examples of breaches include:
– Failure to establish, implement, or maintain a ML/TF risk assessment and AML/CFT programme
– Failure to conduct customer due diligence
– Failure to report prescribed transactions
– Failure to report suspicious activity
If conduct leading to the breach of the Act is knowingly or recklessly undertaken then the fines escalate up to $300,000 personally and/or a term of imprisonment of up to two years for partners, and up to $5,000,000 for a firm.
Whilst no law firm envisages being non-compliant, the way that compliance is achieved, and the effort required, can have significant costs both financially and from the perspective of impact on the business.
Cost and benefit was a key consideration when bringing DNFBPs into the New Zealand AML/CFT regime. However, the costs of bringing DNFBPs, including lawyers, into the regime was only really tackled at a macro (industry) level.
In 2016, the New Zealand Ministry of Justice (MoJ) commissioned Deloitte to assess the cost of DNFBPs, including lawyers, becoming AML/CFT compliant. Their report was published in September 2016.
DNFBPs are required to put in place the same regime as financial institutions, and the Deloitte Report concluded that in New Zealand the initial cost of compliance for all DNFBPs could be as high as NZ$313,000,000, with the cost for the legal profession of up to NZ$80,900.00.
The Deloitte Report identifies that the initial compliance costs stem from the development and implementation of the ML/FT risk assessment and AML/CFT programme.
Whilst not all firms are the same size or have the same complexity, the Deloitte Report further establishes that the cost for a law firm to become compliant would average out at NZ$37.76 on a client or matter/transaction basis.
Assuming a law firm is handling 1000 matters a year, or around 20 matters a week, the Deloitte Report analysis would mean the cost of achieving AML/CFT compliance for that law firm would be circa NZ$37,760.
The same report estimated that the per client cost for accountancy firms, who need to be compliant by 1st October 2018, would average out to be NZ$64.40 on a client or matter/transaction basis.
This higher cost per client for accountants is in part because the legal profession is already tightly regulated under the Lawyers and Conveyancers Act 2006, and through the New Zealand Law Society.
The Deloitte Report also identified that the reason for the variation of costs between lawyers and accountants was:
– Lawyers have a stable client base with previous experience of providing identity information in relation to legal transactions, which allows for efficiency in CDD.
– A lawyer’s existing ‘Trust Account supervisor’ could become the natural default AML/CFT Officer, where accountants do not usually employ people in similar roles.
– Adapting to the AML/CFT regulations will be less onerous for lawyers than those sectors without similar experience of managing legislative requirements.
– The level of maturity within the accounting sector is quite variable.
– Client Management Systems are not as centralised as might be anticipated in the accountancy profession, making CDD more challenging.
– The franchise model in the accountancy profession may present challenges with both AML/CFT costs, as well as clarity of roles and responsibilities.
Whilst the cost estimates in the Deloitte Report were based on a number of assumptions, it is our experience that the Deloitte Report’s initial cost estimates are broadly in line with reality, with initial cost estimates of between NZ$30,000 and NZ$40,000 not unrealistic for law firms who follow an in-house model of developing AML/CFT compliance.
Many of the law firms that Initialism has engaged with, estimate a time-based effort to develop an ML/TF risk assessment and AML/CFT programme of between 60 and 100 hours. Law firms break down this time effort into various phases:
– Research phase 30 – 50 hours
– Development phase 20 – 50 hours
– Completion phase 40-50 hours
– Implementation phase 80 – 120 hours
The research phase involves reading material, including the AML/CFT Act and various DIA Guidance, as well as attending information sessions and webinars.
It is our experience and understanding that the research work has been undertaken by both a partner and practice management, with the partner putting in the lion’s share of the work.
The development phase involves understanding and interpreting the requirements within the Act and Guidance into workable approaches and solutions for the law firm, as well as putting in place a structure to document the ML/TF risk assessment and AML/CFT programme. The development phase also requires heavy partner input, with the partners taking the lead in developing the ML/TF risk assessment and the AML/CFT programme.
The next phase of completing an ML/TF risk assessment and drafting/developing an AML/CFT programme, law firm’s estimate, will take an additional 40 to 50 hours. The completing and drafting phase is also another partner input-heavy task, with the partners taking the lead.
There is then further work effort required to implement the AML/CFT programme, through the adjustment of existing procedures and processes and the development of additional procedures. The implementation phase appears to be falling to the practice management staff with oversight from the partner.
Law firms estimate the implementation phase (so long as the requirements within the AML/CFT programme are clear and unambiguous) results in an additional time effort of around 80 hours (2 weeks) to 160 hours (4 weeks).
As a result, it clear that a partner, who is a senior fee earner, is being required to spend significant time away from the business of servicing clients in order to get to grips with AML/CFT at the research development, completion and implementation phases, which could impact their ability to focus on fee earning business.
Using a notional partner hourly rate of $250, and without factoring in the time of practice management staff, the costs mount up:
– Research phase (30 to 50 hours) $7,500 to $12,500
– Development phase (20 to 50 hours) $5,000 to $12,500
– Complete phase (40 to 50 hours) $10,000 to $12,500
– Implementation Phase (40 to 80 hours) $10,000 to $20,000
This equates to a cost in time not working on billable client matters of between $12,500 and $25,000 just to understand what is required and to develop and deliver the foundational documents required by the AML/CFT Act.
The completion and drafting/development activity with a work effort of between 40 to 50 hours will have negative impact on fee earning of between $10,000 and $12,500.
Implementation brings further costs and lost billable hours. It is our experience that refining and developing the internal processes and procedures necessary to implement AML/CFT could have a time cost of between a week (40 hours) and two weeks (80 hours) of partner’s time.
Implementation, based on a $250 per hour rate, would equate to a time cost of $10,000 to $20,000. This is in addition to the $12,500 to $25,000 cost of understanding what compliance means and developing the foundational documents.
These costs do not include the practice management time spent working on AML/CFT, which can also be considerable. In some law firms AML/CFT has pulled the practice managers away from routine tasks required to run the business and/or put an additional strain on already over-stretched resources.
Given that the 1st July deadline is fast approaching, and the estimated elapsed times estimated above, it is now a reality for firms trying to tackle this in-house that the opportunity and ability to balance getting to grips with AML/CFT whilst undertaking fee-generating client work is fast disappearing.
With less than 9 weeks left to become AML/CFT compliant, law firms who have not yet made substantive progress, at a minimum, of completing the research and development phases, face the real possibility of the partners and practice management tasked with AML/CFT compliance being required to devote a significant amount of their capacity in May/June to AML/CFT to get it implemented ahead of the 1st July deadline.