Financial Action Task Force 

Groupe d'action financière 

RBA GUIDANCE FOR LEGAL PROFESSIONALS 

 23 October 2008 
© FATF/OECD 2008 

All rights reserved. No reproduction, copy, transmission or translation of this 

publication may be made without written permission. 

Applications for permission to reproduce all or part of this publication should be made to: 

FATF Secretariat, OECD, 2 rue André Pascal 75775 Paris Cedex 16, France
TABLE OF CONTENTS 

SECTION ONE: USING THE GUIDANCE PURPOSE OF THE RISK-BASED 

APPROACH .............................................................................................................................. 4

Chapter One: Background and Context ................................................................................. 4

Chapter Two: The Risk-Based Approach – Purpose, Benefits and Challenges .................... 8

Chapter Three: FATF and the Risk-Based Approach .......................................................... 11

SECTION TWO: GUIDANCE FOR PUBLIC AUTHORITIES ............................................ 15

Chapter One: High-level principles for creating a risk-based approach .............................. 15

Chapter Two: Implementation of the Risk-Based Approach ............................................... 19

SECTION THREE: GUIDANCE FOR LEGAL PROFESSIONALS ON IMPLEMENTING 

A RISK-BASED APPROACH ................................................................................................ 25

Chapter One: Risk Categories .............................................................................................. 25

Chapter Two: Application of a Risk-Based Approach ........................................................ 31

Chapter Three: Internal Controls ......................................................................................... 34

ANNEXES .............................................................................................................................. 36 

ANNEX 1................................................................................................................................. 36

A. Financial Action Task Force Documents .................................................................. 36

B. Legislation/and Court Decisions ............................................................................... 36

C. Links to Information on the Supervisory Program in Certain Countries .................. 36

D. Guidance on the Risk-based Approach ..................................................................... 37

E. Other sources of information to help assist countries’ and legal professionals’ risk 

assessment of countries and cross-border activities ............................................................. 37

ANNEX 2................................................................................................................................. 39

ANNEX 3................................................................................................................................. 41
SECTION ONE: USING THE GUIDANCE 

PURPOSE OF THE RISK-BASED APPROACH 

Chapter One: Background and Context 

1. In June 2007, the FATF adopted Guidance on the Risk-Based Approach to Combating Money 

Laundering and Terrorist Financing: High Level Principles and Procedures, which includes guidance 

for public authorities and guidance for financial institutions. This was the culmination of extensive 

consultation between private and public sector members of an Electronic Advisory Group (EAG) 

established by the FATF. 

2. In addition to financial institutions, the FATF Recommendations also cover a number of 

designated non-financial businesses and professions (DNFBPs). At its June 2007 meeting, the FATF’s 

Working Group on Evaluation and Implementation (WGEI) endorsed a proposal to convene a meeting 

of the representatives from the DNFBPs to assess the possibility of developing Guidance on the riskbased approach for their sectors, using the same structure and style as the completed Guidance for 

financial institutions. 

3. This meeting was held in September 2007 and was attended by members of organisations 

which represent lawyers, notaries, trust and company service providers (TCSPs), accountants, casinos, 

real estate agents and dealers in precious metals and dealers in precious stones. This private sector 

group expressed an interest in contributing to FATF Guidance on implementing a risk-based approach 

for their sectors. The Guidance for the DNFBPs would follow the principles of the risk-based 

approach already established by FATF, and would highlight risk factors specific to the DNFBPs, as 

well as suggest mitigation strategies that fit with the particular activities and businesses of the 

DNFBPs. The FATF established another EAG to facilitate the work. 

4. The private sector group met again in December 2007 and was joined by a number of 

specialist public sector members. Separate working groups comprising public and private sectors 

members were established, and private sector chairs were appointed. 

5. The EAG continued work until this Guidance for legal professionals was presented to the 

WGEI. After further international consultation with both public and private sectors, the FATF adopted 

this Guidance at its October 2008 Plenary. Guidance for each of the other DNFBP sectors is being 

published separately. 

Purpose of the Guidance

6. The purpose of this Guidance is to: 

• Support the development of a common understanding of what the risk-based approach 

involves. 

• Outline the high-level principles involved in applying the risk-based approach. 

• Indicate good practice in the design and implementation of an effective risk-based approach. 

4 
7. However, it should be noted that applying a risk-based approach is not mandatory. A properly 

applied risk-based approach does not necessarily mean a reduced burden, although it should result in a 

more cost effective use of resources. For some countries, applying a rules-based system might be 

more appropriate. Countries1

 will need to make their own determinations on whether to apply a riskbased approach, based on their specific money laundering/terrorist financing risks, size and nature of 

the DNFBP activities, and other relevant information. The issue of timing is also relevant for 

countries that may have applied anti-money laundering/counter-terrorist financing (AML/CFT) 

measures to DNFBPs, but where it is uncertain whether the DNFBPs have sufficient experience to 

implement and apply an effective risk-based approach. 

Target Audience, Status and Content of the Guidance

8. This Guidance has been prepared for, and in relation to, legal professionals.2

 The legal 

professionals sector includes various professions, including lawyers and notaries, and in some 

countries there are also different categories of lawyers e.g. barristers and solicitors. Many legal 

professionals are required to comply with specific legislation and regulation and rules and regulations 

enacted or adopted by professional associations or other self regulatory organisations (SROs). The 

activities of legal professionals are very diverse, as are the legal and professional obligations with 

which they are required to comply. The specifics of an individual legal professional’s and/or a firm or 

other collection of legal professionals’ particular risk-based processes should accordingly be 

determined based on the activities undertaken by the legal professional, the ethical and existing 

supervisory structure for legal professionals and the susceptibility of a legal professional’s activities 

(both generally and particularly) to money laundering and terrorist financing. 

9. Legal professionals provide a range of services and activities that differ vastly, such as in 

their methods of delivery and in the depth and duration of the relationships formed with clients. This 

Guidance is written at a high level to take into account the differing practices of legal professionals in 

different countries, and the different levels and forms of supervision or monitoring that may apply. It 

is not intended as a template for national legislation imposing obligations on legal professionals or 

SROs. Each country and its national authorities should aim to establish an active dialogue with its 

legal professionals and other DNFBP sectors that will be mutually beneficial in establishing effective 

systems to combat money laundering and terrorist financing. 

10. The following general observations about legal professionals should help inform the 

approach. Consideration should also be given to the particular activities performed by legal 

professionals on a national, provincial, or local basis. Because legal professionals typically refer to 

those benefiting from their services as “clients” rather than “customers”, that term is thus generally 

used throughout this paper, except where specific terms of art such as “customer due diligence” and 

“know your customer” are used (in such cases a customer can be equated to a client). 

11. For purposes of this Guidance, legal professionals include both lawyers and notaries. 

• Lawyers are members of a regulated profession and are bound by their specific professional 

rules and regulations. Their work is fundamental to promoting adherence to the rule of law in 

the countries in which they practice. Lawyers hold a unique position in society by providing 

1

 All references in the FATF Recommendations and in this document to country or countries apply equally 

to territories or jurisdictions. 

2

 This refers to sole legal practitioners and partners or employed legal professionals within professional 

firms. It is not meant to refer to “internal” (i.e. in-house) professionals that are employees of other types of 

businesses, nor to legal professionals working for government agencies, who may already be subject to separate 

measures that would combat money laundering and terrorist financing. See FATF 40 Recommendations 

Glossary, definition of “Designated Non-Financial Businesses and Professions” (e). 

5 
access to law and justice for individuals and entities, assisting members of society to 

understand their increasingly complex legal rights and obligations, and assisting clients to 

comply with the law. Lawyers have their own professional and ethical codes of conduct by 

which they are regulated. Breaches of the obligations imposed upon them can result in a 

variety of sanctions, including disciplinary and criminal penalties. The provisions contained 

in this Guidance, when applied by each country, are subject to professional secrecy and legal 

professional privilege. As is recognised by the interpretative note to the FATF 

Recommendation 16, the matters that would fall under legal professional privilege or 

professional secrecy and that may affect any obligations with regard to money laundering and 

terrorist financing are determined by each country. Likewise, ethical rules that impose 

obligations, duties, and responsibilities on legal professionals vary by country. The legal 

professionals’ counseling and advisory role, especially in an increasing regional and global 

marketplace, does not generally involve a cash handling function. 

• Both civil and common law countries have notaries, but the roles of civil and common law 

notaries differ. Common law mainly differs from civil law in that precedents can be drawn 

from case law, while in civil systems codified rules are applied by judges to the cases before 

them. In some common law countries, the common law notary public is a qualified, 

experienced practitioner, trained in the drafting and execution of legal documents. In other 

common law countries, the notary public is a public servant appointed by a governmental 

body to witness the signing of important documents (such as deeds and mortgages) and 

administer oaths. Known only in civil law jurisdictions, civil law notaries are both members 

of an autonomous legal profession – although regulated by the law – and qualified public 

officials, as they are appointed by the State through a selective public contest among law 

graduates. Civil law notaries, who are bound by an obligation of impartiality with respect to 

both parties, must be regarded, in matters of real property (conveyancing), family law, 

inheritance and corporate legal services as practising non-contentious activities. They act as 

gatekeepers by drafting, ensuring the legality and certainty of the instruments and the 

authenticity of signatures presented to them; providing as well a public fiduciary function by 

performing the role of a trusted third party . Civil law notaries are obliged by law not to 

detach themselves from the core of the relationship, therefore making them responsible for all 

aspects of the deed. For this reason, civil law notaries are assigned functions of a public 

nature as part of their legal assignments. In civil law jurisdictions, notarial written documents 

are particular means of evidence, unlike in the common law systems, which are based on the 

free evidence of witnesses in court: special supreme State powers are devolved to civil law 

notaries and they can therefore assign “public authority” to each deed they perform. Thereby 

the civil law notary’s deed has a special effectiveness in a trial, whereby it is a means of 

peremptory binding evidence; furthermore, it is as judicially enforceable as a judgement; if it 

complies with the law, it can be registered on a public registry. Owing to these characteristics, 

civil law notaries play a different role in comparison to the services provided by other legal 

professionals. This Guidance does not cover those common law notaries who perform merely 

administrative acts such as witnessing or authenticating documents, as these acts are not 

specified activities. 

12. Recommendation 12 mandates that the requirements for customer due diligence requirements 

(CDD), record-keeping, and paying attention to all complex, unusual large transactions set out in 

Recommendations 5, 6, and 8 to 11 apply to DNFBPs in certain circumstances. Recommendation 12 

applies to legal professionals when they prepare for and carry out certain specified activities: 

• Buying and selling of real estate. 

• Managing of client money, securities or other assets. 

• Management of bank, savings or securities accounts. 

6 
• Organisation of contributions for the creation, operation or management of companies. 

• Creation, operation or management of legal persons or arrangements, and buying and selling 

of business entities. 

This Guidance has been prepared to assist legal professionals in those situations. Unless legal advice 

and representation consists of preparing for or carrying out transactions relating to these specified 

activities, it is not subject to the FATF Recommendations. The Recommendations would thus not 

cover, for example, an initial meeting before any preparatory work is carried out, or the usual level of 

advice given at legal aid or other “walk up” clinics. 

13. It is possible that more than one legal professional will be preparing for or carrying out a 

transaction, in which case they will all need to observe the applicable CDD and record-keeping 

obligations. However, several legal professionals may be involved in a transaction for a specified 

activity but not all are preparing for or carrying out the overall transaction. In that situation, those 

legal professionals providing advice or services (e.g. a local law validity opinion) peripheral to the 

overall transaction who are not preparing for or carrying out the transaction may not be required to 

observe the applicable CDD and record-keeping obligations. 

14. Recommendation 16 requires that FATF Recommendations 13 to 15 regarding reporting of 

suspicious transactions and AMLCFT controls, and Recommendation 21 regarding measures to be 

taken with respect to countries that do not or insufficiently comply with the FATF Recommendations, 

apply to DNFBPs subject to the certain qualifications. Specifically, Recommendation 16 applies to 

legal professionals when they engage in a financial transaction on behalf of a client, in relation to the 

activities referred to in Recommendation 12. Recommendation 16, however, provides that legal 

professionals are not required to report their suspicions if the relevant information was obtained in 

circumstances where they are subject to professional secrecy or legal professional privilege. The 

lawyer-client relationship is protected by law, regulations, and rules, and codes of conduct (such as 

legal professional privilege) in many countries, including in some countries by constitutional 

provisions. This is recognised by the Interpretative Note to Recommendation 16. 

15. The wider audience for this Guidance includes countries, regulators, and self-regulatory 

organisations (SROs), which are considering how to apply AML/CFT measures to legal professionals. 

Countries need to identify the most appropriate regime, tailored to address individual country risks, 

which takes into consideration the activities and professional and ethical codes of conduct of legal 

professionals in their countries. This regime should recognise the differences between the DNFBP 

sectors, as well as the differences between the DNFBPs (particularly legal professionals) and financial 

institutions. However, this Guidance does not override the purview of national authorities. The 

manner in which legal professionals, SROs, or other supervisory bodies approach their responsibilities 

under a risk-based CDD system must necessarily be informed by and conform with the existing legal 

and oversight framework within each country’s jurisdiction. 

• To the extent a country has adopted a risk-based approach regime, the legal professionals 

practising in that country should refer to that country’s guidance for that regime. 

• This Guidance does not supplant specific professional guidance issued by designated 

competent authorities or SROs in a particular country, and does not constitute a legal 

interpretation of AML or CFT obligations of legal professionals, and should not be relied on 

by legal professionals or the judiciary in determining whether a legal professional has 

complied with his or her AML or CFT obligations. 

16. The provisions in this Guidance are subject to applicable professional secrecy, legal 

professional privilege or rules of professional conduct, which are determined by each country.

7 
Chapter Two: The Risk-Based Approach – Purpose, Benefits and Challenges 

The purpose of the Risk-Based Approach 

17. The FATF Recommendations contain language that permits countries to some degree to adopt 

a risk-based approach to combating money laundering and terrorist financing. That language also 

authorises countries to permit DNFBPs to use a risk-based approach in applying certain of their AML 

and CFT obligations. 

18. By adopting a risk-based approach, it is possible to ensure that measures to prevent or 

mitigate money laundering and terrorist financing are commensurate with the risks identified. This 

will allow resources to be allocated in the most efficient ways. The principle is that resources should 

be directed in accordance with priorities so that the greatest risks receive the highest attention. The 

alternative approaches are that resources are either applied evenly, or that resources are targeted, but 

on the basis of factors other than risk. This can inadvertently lead to a ‘tick box’ approach with the 

focus on meeting regulatory requirements rather than on combating money laundering or terrorist 

financing efficiently and effectively. 

19. A number of the DNFBP sectors, including legal professionals, are already subject to 

regulatory or professional requirements (including as promulgated by SROs) that complement 

AML/CFT measures. For example, by virtue of their professional codes of conduct, many lawyers are 

already subject to an obligation to identify their clients (e.g. to check for conflict of interest) and the 

substance of the matter submitted to them by such clients, in order to appreciate the consequences that 

their advice may have. If a lawyer provides legal advice to a client that helps the client commit an 

offence, that lawyer may, depending on the lawyer’s state of knowledge, become an accomplice to the 

offence. This Guidance must be considered in the context of these professional and ethical codes of 

conduct. Where possible, it will be beneficial for legal professionals (and relevant authorities and 

SROs) to devise their AML/CFT policies and procedures in a way that harmonises with other 

regulatory or professional requirements. A risk-based AML/CFT regime should not impede free 

access to the services provided by legal professionals for legitimate purposes, but should create 

barriers to those who seek to misuse these services. 

20. A risk analysis must be performed to determine where the money laundering and terrorist 

financing risks are the greatest. Countries will need to identify the main vulnerabilities and address 

them accordingly. Legal professionals will need this assistance and information to help them to 

identify higher risk clients and services, including delivery channels, and geographical locations. 

These are not static assessments. They will change over time, depending on how circumstances 

develop, and how threats evolve. 

21. The strategies to manage and mitigate money laundering and terrorist financing are typically 

aimed at preventing the activity from occurring through a mixture of deterrence (e.g. appropriate 

CDD measures), detection (e.g. monitoring and suspicious transaction reporting), and record-keeping 

so as to facilitate investigations. 

22. Proportionate procedures should be designed based on assessed risk. Higher risk areas should 

be subject to enhanced procedures; this would include measures such as enhanced CDD checks and 

enhanced transaction monitoring. It also follows that in instances where risks are low, simplified, 

modified or reduced controls may be applied. 

23. There are no universally accepted methodologies that prescribe the nature and extent of a 

risk-based approach. However, an effective risk-based approach does involve identifying and 

categorising money laundering and terrorist financing risks and establishing reasonable controls based 

on risks identified. 

8 
24. An effective risk-based approach will allow legal professionals to exercise reasonable 

business and professional judgement with respect to clients. Application of a reasoned and wellarticulated risk-based approach will justify the judgements made with regard to managing potential 

money laundering and terrorist financing risks. A risk-based approach should not be designed to 

prohibit or impede legal professionals from continuing with legitimate practice – especially given 

their role in society and the proper functioning of the justice system - or from finding innovative ways 

to diversify or expand their practices. 

25. Regardless of the strength and effectiveness of AML/CFT controls, criminals will continue to 

attempt to move illicit funds undetected and will, from time to time, succeed. Criminals are more 

likely to target the DNFBP sectors, including legal professionals, if other routes become more 

difficult. For this reason, DNFBPs may be more or less vulnerable depending on the effectiveness of 

the AML/CFT procedures applied in other sectors. A risk-based approach allows DNFBPs, including 

legal professionals, to more efficiently and effectively adjust and adapt as new money laundering and 

terrorist financing methods are identified. 

26. A reasonably designed and effectively implemented risk-based approach can provide an 

appropriate and effective control structure to manage identifiable money laundering and terrorist 

financing risks. However, it must be recognised that any reasonably applied controls, including 

controls implemented as a result of a reasonably designed and effectively implemented risk-based 

approach, will not identify and detect all instances of money laundering or terrorist financing. 

Therefore, designated competent authorities, SROs, law enforcement, and judicial authorities must 

take into account and give due consideration to a well reasoned risk-based approach. When there is a 

failure to implement an adequately designed risk-based approach or failure of a risk-based programme 

that was not adequate in its design, designated competent authorities, SROs, law enforcement or 

judicial authorities should take action as necessary and appropriate. 

Potential Benefits and Challenges of the Risk-Based Approach 

Benefits 

27. The adoption of a risk-based approach to combating money laundering and terrorist financing 

can yield benefits for all parties, including the public. Applied effectively, the approach should allow 

a more efficient and effective use of resources and minimise burdens on clients. Focusing on higher 

risk threats should mean that beneficial outcomes can be achieved more effectively. 

28. For legal professionals, the risk-based approach allows the flexibility to approach AML/CFT 

obligations using specialist skills and responsibilities. This requires legal professionals to take a wide 

and objective view of their activities and clients. 

29. Efforts to combat money laundering and terrorist financing should also be flexible in order to 

adapt as risks evolve. As such, legal professionals should use their judgement, knowledge and 

expertise to develop an appropriate risk-based approach for their particular organisation, structure and 

practice activities. 

Challenges 

30. The risk-based approach is not necessarily an easy option and is challenging to both public 

and private sector entities. Some challenges may be inherent to the use of the risk-based approach. 

Others may stem from the difficulties in making the transition to a risk-based system. A risk-based 

approach requires resources and expertise to gather and interpret information on risks, both at the 

country and institutional levels, to develop procedures and systems, and to train personnel. It further 

requires that sound and well-trained judgement be exercised in the design and implementation of 

procedures, and systems. It will certainly lead to a greater diversity in practice that should lead to 

innovations and improved compliance. However, it may also cause uncertainty regarding 

9 
expectations, difficulty in applying uniform regulatory treatment, and lack of understanding by clients 

regarding information required. 

31. Implementing a risk-based approach requires that legal professionals have a sound 

understanding of the risks and are able to exercise sound judgement. This requires the building of 

expertise including for example, through training, recruitment, taking professional advice and 

‘learning by doing’. The process will always benefit from information sharing by designated 

competent authorities and SROs. The provision of good practice guidance is also valuable. 

Attempting to pursue a risk-based approach without sufficient expertise may lead to flawed 

judgements. Legal professionals may over-estimate risk, which could lead to wasteful use of 

resources, or they may under-estimate risk, thereby creating vulnerabilities. They, and (if applicable) 

their staff members, may be uncomfortable making risk-based judgements. This may lead to overly 

cautious decisions, or disproportionate time spent documenting the rationale behind a decision. This 

may also be true at various levels of management. However, in situations where management fails to 

recognise or underestimate the risks, a culture may develop that allows for inadequate resources to be 

devoted to compliance, leading to potentially significant compliance failures. 

32. Designated competent authorities and SROs should place greater emphasis on whether legal 

professionals have an effective decision-making process with respect to risk management. Sample 

testing may be used or individual decisions reviewed as a means to test the effectiveness of a legal 

professional’s overall risk management. Designated competent authorities and SROs should recognise 

that even though appropriate risk management structures and procedures are regularly updated, and 

the relevant policies, procedures, and processes are followed, decisions may still be made that are 

incorrect in light of additional information that was not reasonably available at the time. 

33. In implementing the risk-based approach, legal professionals should be given the opportunity 

to make reasonable judgements for their particular services and activities. This may mean that no two 

legal professionals and no two firms are likely to adopt the same detailed practices. Such potential 

diversity of practice will require that designated competent authorities and SROs make greater effort 

to identify and disseminate guidelines on sound practice, and may pose challenges for staff working to 

monitor compliance. The existence of good practice guidance, continuing legal education, and 

supervisory training, industry studies and other materials will assist the designated competent 

authority or an SRO in determining whether a legal professional has made sound risk-based 

judgements. 

34. Recommendation 25 requires adequate feedback to be provided to the financial sector and 

DNFBPs. Such feedback helps institutions, firms and businesses to more accurately assess the money 

laundering and terrorist financing risks and to adjust their risk programmes accordingly. This in turn 

makes the detection of suspicious activity more likely and improves the quality of any required 

suspicious transaction reports. As well as being an essential input to any assessment of country or 

sector wide risks, the promptness and content of such feedback is relevant to implementing an 

effective risk-based approach. 

The potential benefits and potential challenges can be summarised as follows: 

Potential Benefits: 

• Better management of risks and cost-benefits 

• Focus on real and identified threats 

• Flexibility to adapt to risks that change over time 

Potential Challenges: 

• Identifying appropriate information to conduct a sound risk analysis 

• Addressing short term transitional costs 

• Greater need for more expert staff capable of making sound judgements. Regulatory response to 

potential diversity of practice. 

10 
Chapter Three: FATF and the Risk-Based Approach 

35. The varying degrees of risk of money laundering or terrorist financing for particular types of 

DNFBPs, including legal professionals, or for particular types of clients, or transactions is an 

important consideration underlying the FATF Recommendations. According to the 

Recommendations, with regard to DNFBPs there are specific Recommendations where the degree of 

risk is an issue that a country either must take into account (if there is higher risk), or may take into 

account (if there is lower risk). 

36. The risk-based approach is either incorporated into the Recommendations (and the 

Methodology) in specific and limited ways in a number of Recommendations, or it is inherently part 

of or linked to those Recommendations. For instance, for DNFBPs, including legal professionals risk 

is addressed in three principal areas (a) Customer/client Due Diligence (R.5, 6, 8 and 9); (b) legal 

professionals and/or firms’ internal control systems (R.15); and (c) the approach of 

oversight/monitoring of DNFBPs, including legal professionals (R.24). 

Client Due Diligence (R. 5, 6, 8 and 9) 

37. Risk is referred to in several forms: 

a) Higher risk – Under Recommendation 5, a country must require its DNFBPs, 

including legal professionals, to perform enhanced due diligence for higher-risk clients, 

business relationships or transactions. Recommendation 6 (politically exposed persons) is an 

example of this principle and is considered to be a higher risk scenario requiring enhanced 

due diligence. 

b) Lower risk – A country may also permit legal professionals to take lower risk into 

account in deciding the extent of the CDD measures they will take (see Methodology criteria 

5.9). Legal professionals may thus reduce or simplify (but not avoid completely) the 

required measures. 

c) Risk arising from innovation – Under Recommendation 8, a country must require 

legal professionals to give special attention to the risks arising from new or developing 

technologies that might favour anonymity. 

d) Risk assessment mechanism – The FATF standards require that there be an adequate 

mechanism by which designated competent authorities or SROs assess or review the 

procedures adopted by legal professionals to determine the degree of risk and how they 

manage that risk, as well as to review the actual determinations themselves. This expectation 

applies to all areas where the risk-based approach applies. In addition, where the designated 

competent authorities or SROs have issued guidelines on a suitable approach to risk-based 

procedures, it will be important to establish that these have been followed. The 

Recommendations also recognise that country risk is a necessary component of any risk 

assessment mechanism (R.5 & R.9). 

Internal control systems (R.15) 

38. Under Recommendation 15, the development of “appropriate” internal policies, training and 

audit systems will need to include a specific, and ongoing, consideration of the potential money 

laundering and terrorist financing risks associated with clients, products and services, geographic 

areas of operation and so forth. The Interpretative Note to Recommendation 15 makes it clear that a 

country may allow legal professionals to have regards to the money laundering and terrorist financing 

risks, and to the size of the business, when determining the type and extent of measures required. 

11 
Regulation and oversight by designated competent authorities or SROs (R.24) 

39. Countries should ensure that legal professionals are subject to effective systems for 

monitoring and ensuring compliance with AML/CFT requirements. In determining whether the 

system for monitoring and ensuring compliance is appropriate, regard may be had to the risk of 

money laundering or terrorist financing in a given business, i.e. if there is a low risk then reduced 

monitoring measures may be taken. 

Applicability of the risk-based approach to terrorist financing 

40. There are both similarities and differences in the application of a risk-based approach to 

terrorist financing and money laundering. They both require a process for identifying and assessing 

risk. However, the characteristics of terrorist financing make its detection difficult and the 

implementation of mitigation strategies may be challenging due to considerations such as the 

relatively low value of transactions involved in terrorist financing, or the fact that funds can be 

derived from legitimate as well as illicit sources. 

41. Funds that are used to finance terrorist activities may be derived either from criminal activity 

or may be from legal sources, and the nature of the funding sources may vary according to the type of 

terrorist organisation. Where funds are derived from criminal activity, then traditional monitoring 

mechanisms that are used to identify money laundering may also be appropriate for terrorist 

financing, though the activity, which may be indicative of suspicion, may not be identified as or 

connected to terrorist financing. It should be noted that transactions associated with the financing of 

terrorism may be conducted in very small amounts, which in applying a risk-based approach could be 

the very transactions that are frequently considered to be of minimal risk with regard to money 

laundering. Where funds are from legal sources then it is even more difficult to determine if they 

could be used for terrorist purposes. In addition, the actions of terrorists may be overt and outwardly 

innocent in appearance, such as the purchase of materials and services to further their goals, with the 

only covert fact being the intended use of such materials and services purchased. Therefore, while 

terrorist funds may be derived from criminal activity as well as from legitimate sources, transactions 

related to terrorist financing may not exhibit the same traits as conventional money laundering. In all 

cases, however, legal professionals are not responsible for determining the type of underlying criminal 

activity or intended terrorist purpose. 

42. The ability of legal professionals to detect and identify potential terrorist financing 

transactions without guidance on terrorist financing typologies or unless acting on specific 

intelligence provided by the authorities is significantly more challenging than is the case for potential 

money laundering and other suspicious activity. Detection efforts, absent specific national guidance 

and typologies, are likely to be based on monitoring that focuses on transactions with countries or 

geographic areas where terrorists are known to operate or on the other limited typologies available 

(many of which are indicative of the same techniques as are used for money laundering). 

43. Specific individuals, organisations or countries may be the subject of terrorist financing 

sanctions, in a particular country. In such cases a listing of individuals, organisations or countries to 

which such sanctions apply and the obligations on legal professionals to comply with those sanctions 

are decided by individual countries and are not a function of risk. Legal professionals may commit a 

criminal offence if they undertake business with a listed individual, organisation or country, or its 

agent, in contravention of applicable sanctions. 

44. For these reasons, this Guidance has not comprehensively addressed the application of a riskbased process to terrorist financing. It is clearly preferable that a risk-based approach be applied 

where reasonably practicable, but further consultation with key stakeholders is required to identify a 

more comprehensive set of indicators of the methods and techniques used for terrorist financing, 

which can then be factored into strategies to assess terrorist financing risks and devise measures to 

mitigate them. DNFBPs, including legal professionals, would then have an additional basis upon 

12 
40-44 and such subsequent consultations when they occur. 

Limitations to the risk-based approach 

45. There are circumstances in which the application of a risk-based approach will not apply, or 

may be limited. There are also circumstances in which the application of a risk-based approach may 

not apply to the initial stages of a requirement or process, but then will apply to subsequent stages. 

The limitations to the risk-based approach are usually the result of legal or regulatory requirements 

that mandate certain actions to be taken. 

46. Requirements to freeze assets of identified individuals or entities, in countries where such 

requirements exist, are independent of any risk assessment. The requirement to freeze is absolute and 

cannot be impacted by a risk-based process. Similarly, while the identification of potential suspicious 

transactions can be advanced by a risk-based approach, in countries where such obligations exist, the 

reporting of such suspicious transactions, once identified, is not risk-based. (See paragraph 119.) 

47. CDD comprises several components – Identification and verification of the identity of clients 

and of beneficial owners, obtaining information on the purposes and intended nature of the business 

relationships and conducting ongoing due diligence. Of these components, the identification and 

verification of identity of clients are requirements that must be completed regardless of the risk-based 

approach. However, in relation to all other CDD components, a reasonably implemented risk-based 

approach may allow for a determination of the extent and quantity of information required, and the 

mechanisms to be used to meet these minimum standards. Once this determination is made, the 

obligation to keep records and documents that have been obtained for due diligence purposes, as well 

as transaction records, is not dependent on risk levels. 

48. Countries may allow legal professionals to apply reduced or simplified measures where the 

risk of money laundering or terrorist financing is lower. However, these reduced or simplified 

measures do not necessarily apply to all aspects of CDD. Where these exemptions are subject to 

certain conditions being met, it is necessary to verify that these conditions apply, and where the 

exemption applies under a certain threshold, measures should be in place to prevent transactions from 

being split artificially to avoid the threshold. Information beyond client identity, such as client 

location, may be needed to adequately assess risk. This will be an iterative process: the preliminary 

information obtained about a client should be sufficient to determine whether to go further, and in 

many cases client monitoring will provide additional information. 

49. Some form of monitoring is required in order to detect unusual and hence possibly suspicious 

transactions. Even in the case of lower risk clients, monitoring is needed to verify that transactions 

match the initial low risk profile and if not, trigger a process for appropriately revising the client’s risk 

rating. Equally, risks for some clients may only become evident once a relationship with a client has 

begun. This makes appropriate and reasonable monitoring of client transactions an essential 

component of a properly designed risk-based approach; however, within this context it should be 

understood that not all transactions or clients will be monitored in exactly the same way. Moreover, 

where there is an actual suspicion of money laundering or terrorist financing, this could be regarded as 

a higher risk scenario, and enhanced due diligence should be applied regardless of any threshold or 

exemption. Given the relationship between a legal professional and his/her client, the most effective 

form of ongoing monitoring will often be continued observance and awareness of a client’s activities 

by the legal professional. This requires legal professionals to be alert to this basis of monitoring and 

for training of legal professionals to take this feature into account. 

13 
Distinguishing Risk-Based Monitoring and Risk-Based Policies and Processes 

50. Risk-based policies and processes should be distinguished from risk-based monitoring by 

designated competent authorities or SROs. There is a general recognition within monitoring practice 

that resources should be allocated taking into account the risks posed by individual practices. The 

methodology adopted by the designated competent authorities or SROs to determine allocation of 

monitoring resources should cover the practice focus, the risk profile and the internal control 

environment, and should permit relevant comparisons between practices. Most fundamentally, such 

methodology needs to recognize that the relationship between the legal professional and the client is 

often an on-going one. The methodology used for determining the allocation of resources will need 

updating on an ongoing basis so as to reflect the nature, importance and scope of the risks to which 

individual practices are exposed. Consequently, this prioritisation should lead designated competent 

authorities or SROs to focus increased regulatory attention to legal professionals who engage in 

activities assessed to be of higher risk of money laundering or terrorist financing. 

51. However, it should also be noted that the risk factors taken into account to prioritise the 

designated competent authorities or SROs’ work will depend not only on the intrinsic risk associated 

with the activity undertaken, but also on the quality and effectiveness of the risk management systems 

put in place to address such risks. 

52. Since designated competent authorities or SROs should have already assessed the quality of 

risk management controls applied by legal professionals, it is reasonable that their assessments of 

these controls be used, at least in part, to inform money laundering and terrorist financing risk 

assessments conducted by individual firms or businesses. 

Summary box: A risk-based approach to countering money laundering and terrorist financing at the 

national level: key elements for success 

• Legal professionals, designated competent authorities and/or SROs should have access to reliable and 

actionable information about the threats. 

• There must be emphasis on cooperative arrangements among the policy makers, law enforcement, 

regulators, and the private sector. 

• Authorities should publicly recognise that the risk-based approach will not eradicate all elements of risk. 

• Authorities have a responsibility to establish an atmosphere in which legal professionals need not be 

afraid of regulatory sanctions where they have acted responsibly and implemented adequate internal systems 

and controls. 

• Designated competent authorities’ and/or SROs’ supervisory staff must be well-trained in the risk-based 

approach, both as applied by designated competent authorities/SROs and by legal professionals. 

14 
SECTION TWO: GUIDANCE FOR PUBLIC AUTHORITIES 

Chapter One: High-level principles for creating a risk-based approach 

53. The application of a risk-based approach to countering money laundering and the financing of 

terrorism will allow designated competent authorities or SROs and legal professionals to use their 

resources most effectively. This chapter sets out five high-level principles that should be considered 

by countries when designing a risk-based approach applicable to legal professionals. They could be 

considered as setting out a broad framework of good practice. 

54. The five principles set out in this Guidance are intended to assist countries in their efforts to 

improve their AML/CFT regimes. They are not intended to be prescriptive, and should be applied in a 

manner that is well-considered, is appropriate to the particular circumstances of the country in 

question and takes into account the way in which legal professionals are regulated in that country and 

the obligations they are required to observe. 

Principle One: Understanding and responding to the threats and vulnerabilities: a national risk 

assessment 

55. Successful implementation of a risk-based approach to combating money-laundering and 

terrorist financing depends on a sound understanding of the threats and vulnerabilities. Where a 

country is seeking to introduce a risk-based approach at a national level, this will be greatly aided if 

there is a national understanding of the risks facing the country. This understanding can flow from a 

national risk assessment that can assist in identifying the risks. 

56. National risk assessments should be tailored to the circumstances of each country. For a 

variety of reasons, including the structure of designated competent authorities or SROs and the nature 

of DNFBPs, including legal professionals, each country’s judgements about the risks will be unique, 

as will their decisions about how to implement a national assessment in practice. A national 

assessment need not be a single formal process or document. The desired outcome is that decisions 

about allocating responsibilities and resources at the national level are based on a comprehensive and 

current understanding of the risks. Designated competent authorities and SROs, in consultation with 

the private sector, should consider how best to achieve this while also taking into account any 

jurisdictional limitations of applying the risk-based approach to legal professionals, as well as any risk 

associated with providing information on money laundering and terrorist vulnerabilities. 

Principle Two: A legal/regulatory framework that supports the application of a risk-based 

approach 

57. Countries should consider whether their legislative and regulatory frameworks are conducive 

to the application of the risk-based approach. Where appropriate the obligations imposed should be 

informed by the outcomes of the national risk assessment. 

58. The risk-based approach does not mean the absence of a clear statement of what is required 

from the DNFBPs, including from legal professionals. However, under a risk-based approach, legal 

professionals should have a degree of flexibility to implement policies and procedures which respond 

appropriately to their own risk assessment. In effect, the standards implemented may be tailored 

15 
and/or amended by additional measures as appropriate to the risks of an individual legal professional 

and/or practice. The fact that policies and procedures, in accordance to the risk levels, may be applied 

to different services, clients and locations does not mean that policies and procedures need not be 

clearly defined. 

59. Basic minimum AML/CFT requirements can co-exist with a risk-based approach. Indeed, 

sensible minimum standards, coupled with scope for these to be enhanced when the risk justifies it, 

should be at the core of risk-based AML/CFT requirements. These standards should, however, be 

focused on the outcome (combating through deterrence, detection, and, when there is a requirement in 

a particular country, reporting of money laundering and terrorist financing), rather than applying legal 

and regulatory requirements in a purely mechanistic manner to every client. SROs may assist in the 

development of such standards for legal professionals.

Principle Three: Design of a monitoring framework to support the application of the risk-based 

approach 

60. In certain countries, SROs play a critical role in the regulation of legal professionals, which 

may be based on fundamental constitutional principles. Some SROs have the ability to audit or 

investigate their own members, although in some countries these powers may be limited to reviewing 

policies and procedures as opposed to specific clients and matters. Depending on the powers of and 

responsibilities accepted by SROs, SROs may be able to facilitate or ensure compliance by legal 

professionals with the relevant legislation and/or develop guidance relating to money laundering. In 

some countries, the SROs may provide a greater level of scrutiny than that which can be afforded by a 

government or regulatory AML program. SROs should be encouraged to work closely with domestic 

AML/CFT regulators. Countries should ensure that SROs have appropriate resources to discharge 

their AML/CFT responsibilities. In some cases, legal professionals may conduct activities falling 

within the scope of Recommendation 12 that under national law may also require supervision from 

appropriate authorities. 

61. Where appropriate, designated competent authorities and SROs should seek to adopt a riskbased approach to the monitoring of controls to combat money laundering and terrorist financing. 

This should be based on a thorough and comprehensive understanding of the types of activity carried 

out by legal professionals, and the money laundering and terrorist financing risks to which these are 

exposed. Designated competent authorities and SROs will probably need to prioritise resources based 

on their overall assessment of where the risks are in the legal professionals’ practices. 

62. Designated competent authorities and SROs with responsibilities other than those related to 

AML/CFT will need to consider these risks alongside other risk assessments arising from the 

designated competent authority’s or SRO’s wider duties. 

63. Such risk assessments should help the designated competent authority or SRO choose where 

to apply resources in its monitoring programme, with a view to using limited resources to achieve the 

greatest effect. A risk assessment may also indicate that the designated competent authority or SRO 

does not have adequate resources to deal with the risks. In such circumstances, the designated 

competent authority or SRO may need to obtain, where possible, additional resources or adopt other 

strategies to manage or mitigate any unacceptable residual risks. 

64. The application of a risk-based approach to monitoring requires that designated competent 

authorities’ and SROs’ staff be able to make principle-based decisions in a fashion similar to what 

would be expected from the staff of a legal professional’s practice. These decisions will cover the 

adequacy of the arrangements to combat money laundering and terrorist financing. As such, a 

designated competent authority or SRO may wish to consider how best to train its staff in the practical 

application of a risk-based approach to monitoring. This staff will need to be well-briefed as to the 

general principles of a risk-based approach, the possible methods of application, and what a riskbased approach looks like when successfully applied within the context of a national risk assessment. 

16 
Principle Four: Identifying the main actors and ensuring consistency 

65. Countries should consider who the main stakeholders are when adopting a risk-based 

approach to combating money laundering and terrorist financing. These will differ from country to 

country. Thought should be given as to the most effective way to share responsibility between these 

parties, and how information may be shared to best effect. For example, consideration may be given 

to which body or bodies are best placed to provide guidance to legal professionals about how to 

implement a risk-based approach to AML/CFT. 

66. A list of potential stakeholders may include the following: 

• Government – This may include legislature, executive, and judiciary. 

• Law enforcement agencies – This might include the police, customs and similar agencies. 

• The financial intelligence unit (FIU), security services, and other similar agencies. 

• Designated competent authorities/SROs (particularly bar associations and law societies). 

• The private sector – This might include legal professionals and law firms and legal 

professional organisations and associations such as national, state, local, and specialty 

professional societies and bar associations. 

• The public – Arrangements designed to counter money laundering and terrorist financing are 

ultimately designed to protect the law-abiding public. However, these arrangements may also 

act to place burdens on clients of legal professionals. 

• Others – Those who are in a position to contribute to the conceptual basis underpinning the 

risk-based approach, such stakeholders may include academia and the media. 

67. Clearly a government will be able to exert influence more effectively over some of these 

stakeholders than others. However, regardless of its capacity to influence, a government will be in a 

position to assess how all stakeholders can be encouraged to support efforts to combat money 

laundering and terrorist financing. 

68. A further element is the role that governments have in seeking to gain recognition of the 

relevance of a risk-based approach from designated competent authorities. This may be assisted by 

relevant authorities making clear and consistent statements on the following issues: 

• Legal professionals can be expected to have the flexibility to adjust their internal systems and 

controls taking into consideration lower and high risks, so long as such systems and controls 

are reasonable. However, there are also minimum legal and regulatory requirements and 

elements that apply irrespective of the risk level, such as minimum standards of CDD. 

• Acknowledging that a legal professional’s ability to detect and deter money laundering and 

terrorist financing may sometimes be necessarily limited and that information on risk factors 

is not always robust or freely available. There can therefore be reasonable policy and 

monitoring expectations about what a legal professional with good controls aimed at 

preventing money laundering and the financing of terrorism is able to achieve. A legal 

professional may have acted in good faith to take reasonable and considered steps to prevent 

money laundering, and documented the rationale for his/her decisions, and yet still be abused 

by a criminal. 

17 
• Acknowledging that not all high-risk situations are identical and as a result will not always 

require the application of precisely the same type of enhanced due diligence. 

Principle Five: Information exchange between the public and private sector 

69. Effective information exchange between the public and private sector will form an integral 

part of a country’s strategy for combating money laundering and terrorist financing. In some cases, it 

will allow the private sector to provide designated competent authorities and SROs with information 

they identify as a result of previously provided government intelligence. In countries where SROs 

regulate and monitor legal professionals for AML compliance, such SROs may well acquire 

information that would be relevant to a country’s strategy for combating money laundering and 

terrorist financing. To the extent that such information may be released in accordance with applicable 

laws, regulations, and rules, the results may be made available to the designated competent 

authorities. 

70. Public authorities, whether law enforcement agencies, designated competent authorities or 

other bodies, have privileged access to information that may assist legal professionals to reach 

informed judgements when pursuing a risk-based approach to counter money laundering and terrorist 

financing. Likewise, legal professionals are able to understand their clients’ legal needs reasonably 

well. It is desirable that public and private bodies work collaboratively to identify what information is 

valuable to help combat money laundering and terrorist financing, and to develop means by which 

this information might be shared in a timely and effective manner. 

71. To be productive, information exchange between the public and private sector should be 

accompanied by appropriate exchanges among public authorities. FIUs, designated competent 

authorities and law enforcement agencies should be able to share information and feedback on results 

and identified vulnerabilities, so that consistent and meaningful inputs can be provided to the private 

sector. All parties should of course, consider what safeguards are needed to adequately protect 

sensitive information held by public bodies from being disseminated in contravention of applicable 

laws and regulations. 

72. Relevant stakeholders should seek to maintain a dialogue so that it is well understood what 

information has proved useful in combating money laundering and terrorist financing. For example, 

the types of information that might be usefully shared between the public and private sector would 

include, if available: 

• Assessments of country risk. 

• Typologies or assessments of how money launderers and terrorists have abused DNFBPs, 

especially legal professionals. 

• Feedback on suspicious transaction reports and other relevant reports. 

• Targeted unclassified intelligence. In specific circumstances, and subject to appropriate 

safeguards and a country’s legal and regulatory framework, it may also be appropriate for 

authorities to share targeted confidential information with legal professionals. 

• Countries, persons or organisations whose assets or transactions should be frozen. 

73. When choosing what information can be properly and profitably shared, public authorities 

may wish to emphasise to legal professionals that information from public bodies should inform, but 

not be a substitute for legal professionals’ own judgements. For example, countries may decide not to 

create what are perceived to be definitive country-approved lists of low risk client types. Instead, 

18 
public authorities may prefer to share information on the basis that this will be one input into legal 

professionals’ decision making processes, along with any other relevant information that is available 

to legal professionals. 

Chapter Two: Implementation of the Risk-Based Approach 

Assessment of Risk to Inform National Priorities: 

74. A risk-based approach should be built on sound foundations: effort must first be made to 

ensure that the risks are well understood. As such, a risk-based approach should be based on an 

assessment of the threats. This is true whenever a risk-based approach is applied, at any level, whether 

by countries or individual legal professionals and/or firms. A country’s approach should be informed 

by its efforts to develop an understanding of the risks in that country. This can be considered as a 

“national risk assessment”. 

75. A national risk assessment should be regarded as a description of fundamental background 

information to assist designated competent authorities, law enforcement authorities, the FIU, financial 

institutions and DNFBPs to ensure that decisions about allocating responsibilities and resources at the 

national level are based on a practical, comprehensive and up-to-date understanding of the risks. 

76. A national risk assessment should be tailored to the circumstances of the individual country, 

both in how it is executed, and its conclusions, though countries should be mindful that money 

laundering and terrorist financing can often have an international dimension, and that such 

information may also add value to the national risk assessment. Factors that may influence the risk of 

money laundering and terrorist financing in a country could include the following: 

• Political environment. 

• Legal environment. 

• A country’s economic structure. 

• Cultural factors, and the nature of civil society. 

• Sources, location and concentration of criminal activity. 

• Size and composition of the financial services industry. 

• Ownership structure of financial institutions and DNFBPs businesses. 

• Size and nature of the activity carried out by DNFBPs, including legal professionals. 

• Corporate governance arrangements in relation to financial institutions and DNFBPs and the 

wider economy. 

• The nature of payment systems and the prevalence of cash-based transactions. 

• Geographical spread of the financial industry’s and DNFBPs’ operations and clients. 

• Types of products and services offered by the financial services industry and DNFBPs. 

• Types of customers/clients serviced by financial institutions and DNFBPs. 

• Types of predicate offences. 

19 
• Amounts of illicit money generated domestically. 

• Amounts of illicit money generated abroad and laundered domestically. 

• Main channels or instruments used for laundering or financing terrorism. 

• Sectors of the legal economy affected. 

• Underground/informal areas in the economy. 

77. Countries should also consider how an understanding of the risks of money laundering and 

terrorist financing can be best achieved at the national level. Relevant questions could include: Which 

body or bodies will be responsible for contributing to this assessment? How formal should an 

assessment be? Should the designated competent authority’s or SRO’s view be made public? These 

are all questions for the designated competent authority or SRO to consider. 

78. The desired outcome is that decisions about allocating responsibilities and resources at the 

national level are based on a comprehensive and up-to-date understanding of the risks. To achieve the 

desired outcome, designated competent authorities and SROs should ensure that they identify and 

provide DNFBPs (including legal professionals) with the information needed to develop this 

understanding and to design and implement measures to mitigate the identified risks. 

79. Developing and operating a risk-based approach involves forming judgements. It is important 

that these judgements are well informed. It follows that, to be effective, the risk-based approach 

should be information-based and include intelligence where appropriate. Effort should be made to 

ensure that risk assessments are based on fresh and accurate information. Governments utilising 

partnerships with law enforcement bodies, FIUs, designated competent authorities/SROs and legal 

professionals themselves, are well placed to bring their knowledge and expertise to bear in developing 

a risk-based approach that is appropriate for their particular country. Their assessments will not be 

static and will change over time, depending on how circumstances develop and how the threats 

evolve. As such, countries should facilitate the flow of information between different bodies, so that 

there are no institutional impediments to information dissemination. 

80. Whatever form they take, a national assessment of the risks, along with measures to mitigate 

those risks, can inform how resources are applied to combat money laundering and terrorist financing, 

taking into account other relevant country policy goals. It can also inform how these resources are 

most effectively assigned to different public bodies and SROs, and how those bodies make use of 

those resources in an effective manner. 

81. As well as assisting designated competent authorities and SROs to decide how to allocate 

funds to combat money laundering and terrorist financing, a national risk assessment can also inform 

decision-makers on the best strategies for implementing a regulatory regime to address the risks 

identified. An over-zealous effort to counter the risks could be damaging and counter-productive, 

placing unreasonable burdens on legal professionals. Alternatively, less aggressive efforts may not be 

sufficient to protect society from the threats posed by criminals and terrorists. A sound understanding 

of the risks at the national level could help obviate these dangers. 

Effective systems for monitoring and ensuring compliance with AML/CFT requirements – 

General Principles 

82. FATF Recommendation 24 requires that legal professionals should be subject to effective 

systems for monitoring and ensuring compliance with AML/CFT requirements. In determining 

whether there is an effective system, regard may be had to the risk of money laundering or terrorist 

financing in the sector. There should be a designated competent authority or SRO responsible for 

20 
monitoring and ensuring compliance by legal professionals; and the authority or SRO should have 

adequate powers and resources to perform its functions, including powers to monitor and sanction. 

Defining the acceptable level of risk 

83. The level of AML/CFT risk will generally be affected by both internal and external risk 

factors. For example, risk levels may be increased by internal risk factors such as weak compliance 

resources, inadequate risk controls and insufficient senior management involvement. External level 

risks may rise due to factors such as the action of third parties and/or political and public 

developments. 

84. As described in Section One, all activity involves an element of risk. Designated competent 

authorities and SROs should not prohibit legal professionals from conducting business with high risk 

clients. However, legal professionals would be prudent to identify, with assistance from this or other 

Guidance, the risks associated with acting for high risk clients. When applicable law prohibits legal 

professionals from acting for a client, the risk-based approach does not apply. 

85. However, this does not exclude the need to implement basic minimum requirements. For 

instance, FATF Recommendation 5 (that applies to legal professionals through the incorporation of 

R.5 into R.12) states that “where [the legal professional] is unable to comply with [CDD 

requirements], it should not open the account, commence business relations or perform the 

transaction; or should terminate the business relationship; and should consider making a suspicious 

transaction report in relation to the customer.” So the level of risk should strike an appropriate balance 

between the extremes of not accepting clients, and conducting business with unacceptable or 

unmitigated risk. As is recognised by the interpretative note to FATF Recommendation 16, however, 

in those countries where a reporting requirement has been adopted the matters that would fall under 

legal professional privilege or professional secrecy are determined by each country. 3

 

86. Where legal professionals implement a risk-based approach, designated competent authorities 

and SROs must expect legal professionals to put in place effective policies, programmes, procedures 

and systems to mitigate the risk and acknowledge that even with effective systems not every suspect 

transaction will necessarily be detected. They should also ensure that those policies, programmes, 

procedures and systems are applied effectively to prevent legal professionals from becoming conduits 

for illegal proceeds and ensure that they keep records and make reports (where obligated) that are of 

use to national authorities in combating money laundering and terrorist financing. Efficient policies 

and procedures will reduce the level of risks, but are unlikely to eliminate them completely. Assessing 

money laundering and terrorist financing risks requires judgement and is not an exact science. 

Monitoring aims at detecting unusual or suspicious transactions among an extremely large number of 

legitimate transactions; furthermore, the demarcation of what is unusual may not always be 

straightforward since what is “customary” may vary depending on the clients’ business. This is why 

developing an accurate client profile is important in managing a risk-based system. Moreover, 

although procedures and controls are frequently based on previous typologies, criminals will adapt 

their techniques, which may quickly limit the utility of such typologies. 

87. Additionally, not all high risk situations are identical, and therefore will not always require 

precisely the same level of enhanced due diligence. As a result, designated competent 

authorities/SROs will expect legal professionals to identify individual high risk categories and apply 

specific and appropriate mitigation measures. Further information on the identification of specific risk 

categories is provided in Section Three, “Guidance for Legal Professionals on Implementing a RiskBased Approach.” 

3

 See Annex 1 for a summary of decisions by judicial authorities on these issues. 

21 
Proportionate Supervisory/Monitoring Actions to support the Risk-Based Approach 

88. Designated competent authorities and SROs should seek to identify weaknesses through an 

effective programme of both on-site and off-site supervision, and through analysis of internal and 

other available information. 

89. In the course of their examinations, designated competent authorities and SROs should review 

a legal professional’s AML/CFT risk assessments, as well as its policies, procedures and control 

systems to arrive at an overall assessment of the risk profile of legal professionals’ practices and the 

adequacy of their mitigation measures. Where available, assessments carried out by or for legal 

professionals may be a useful source of information. The designated competent authority/SRO 

assessment of management’s ability and willingness to take necessary corrective action is also a 

critical determining factor. Designated competent authorities and SROs should use proportionate 

actions to ensure proper and timely correction of deficiencies, taking into account that identified 

weaknesses can have wider consequences. Generally, systemic breakdowns or inadequate controls 

will result in the most severe response. 

90. Nevertheless, it may happen that the lack of detection of an isolated high risk transaction, or 

of transactions of an isolated high risk client, will in itself be significant, for instance where the 

amounts are significant, or where the money laundering and terrorist financing typology is well 

known, or where a scheme has remained undetected for a long time. Such a case might indicate an 

accumulation of weak risk management practices or regulatory breaches regarding the identification 

of high risks, monitoring, staff training and internal controls, and therefore, might alone justify action 

to ensure compliance with the AML/CFT requirements. 

91. Designated competent authorities and SROs can and should use their knowledge of the risks 

associated with services, clients and geographic locations to help them evaluate legal professionals’ 

money laundering and terrorist financing risk assessments, with the understanding, however, that they 

may possess information that has not been made available to legal professionals and, therefore, legal 

professionals would not have been able to take such information into account when developing and 

implementing a risk-based approach. Designated competent authorities and SROs (and other relevant 

stakeholders) are encouraged to use that knowledge to issue guidelines to assist legal professionals in 

managing their risks. Where legal professionals are permitted to determine the extent of the CDD 

measures on a risk sensitive basis, this should be consistent with guidelines issued by their designated 

competent authorities and SROs4

. Guidance specifically designed for legal professionals is likely to 

be the most effective. An assessment of the risk-based approach will, for instance, help identify cases 

where legal professionals use excessively narrow risk categories that do not capture all existing risks, 

or adopt criteria that lead to the identification of a large number of higher risk relationships, but 

without providing for adequate additional CDD measures. 

92. In the context of the risk-based approach, the primary focus for designated competent 

authorities and SROs should be to determine whether or not the legal professional’s AML/CFT 

compliance and risk management programme is adequate to: (a) meet the minimum regulatory 

requirements, and (b) appropriately and effectively mitigate the risks. The monitoring goal is not to 

prohibit high risk activity, but rather to be confident that legal professionals have adequately and 

effectively implemented appropriate risk mitigation strategies. Appropriate authorities should, when 

considering taking action (including applying penalties and sanctions), take into account and give due 

consideration to the reasoned judgements of legal professionals who are implementing and/or 

operating an appropriate risk-based approach, which judgements, in hindsight, may ultimately be 

determined to have been incorrect. In some countries and situations, judicial authorities alone will 

determine whether the legal professional has complied with the obligation to exercise reasonable 

judgement. 

4

 FATF Recommendations 5 and 25, Methodology Essential Criteria 25.1 and 5.12. 

22 
93. Under FATF Recommendation 24, designated competent authorities and SROs should have 

adequate powers to perform their monitoring functions, including the power to impose adequate 

sanctions for failure to comply with statutory and regulatory requirements to combat money 

laundering and terrorist financing. Fines and/or penalties are not appropriate in all regulatory actions, 

nor will they be permissible in all jurisdictions, to correct or remedy AML/CFT deficiencies. 

However, subject to the requirements of this paragraph, competent authorities, judicial authorities and 

SROs must have the authority and willingness to apply appropriate sanctions in cases where 

substantial deficiencies exist. Often, action will take the form of a remedial programme through the 

normal monitoring processes. 

94. In considering the above factors it is clear that proportionate monitoring will be supported by 

two central features: 

a) Regulatory Transparency 

95. In the implementation of proportionate actions, regulatory transparency will be of paramount 

importance. Designated competent authorities and SROs are aware that legal professionals, while 

looking for professional freedom to make their own risk judgements, will also seek guidance on 

regulatory obligations. As such, the designated competent authority/SRO with AML/CFT 

supervisory/monitoring responsibilities should seek to be transparent in setting out what it expects, 

and will need to consider appropriate mechanisms of communicating these messages. For instance, 

this may be in the form of high-level requirements, based on desired outcomes, rather than detailed 

processes. If SROs responsible for the regulation of the relevant legal professionals (including 

regulation of AML risks) carry out regular AML compliance reviews of their members or otherwise 

take measures to supervise compliance, the form of an SRO monitoring programme should be 

determined by each SRO’s rules and regulations. 

96. No matter what individual procedure is adopted, the guiding principle will be that there is an 

awareness of legal responsibilities and regulatory expectations. In the absence of this transparency 

there is the danger that monitoring actions may be perceived as either disproportionate or 

unpredictable, which may undermine even the most effective application of the risk-based approach 

by legal professionals. 

b) General Education, Staff Training of Designated Competent Authorities, SROs, and Enforcement 

Staff 

97. SROs or other bodies that have a supervisory or educational role for legal professionals and 

legal professional organisations all have a stake in an effective risk-based system. This includes 

making available to legal professionals educational materials, further guidance and increasing 

awareness of money laundering concerns and risks. Central to the ability of legal professionals to seek 

to train and guard against money laundering effectively in a risk-based approach, is the provision of 

realistic typologies, particularly those where there is unwitting involvement.

98. In the context of the risk-based approach, it is not possible to specify precisely what a legal 

professional has to do, in all cases, to meet its regulatory obligations. Thus, a prevailing consideration 

will be how best to ensure the consistent implementation of predictable and proportionate monitoring 

actions. The effectiveness of monitoring training will therefore be important to the successful delivery 

of proportionate supervisory/monitoring actions. 

99. Training should aim to allow designated competent authorities/SRO staff to form sound 

comparative judgements about AML/CFT systems and controls. It is important in conducting 

assessments that designated competent authorities and SROs have the ability to make judgements 

regarding management controls in light of the risks assumed by firms and considering available 

industry practices. Designated competent authorities and SROs might also find it useful to undertake 

23 
comparative assessments so as to form judgements as to the relative strengths and weaknesses of 

different legal professional organisations’ arrangements. 

100. The training should include instructing designated competent authorities and SROs about how 

to evaluate whether senior management has implemented adequate risk management measures, and 

determine if the necessary procedures and controls are in place. The training should also include 

reference to specific guidance, where available. Designated competent authorities and SROs also 

should be satisfied that sufficient resources are in place to ensure the implementation of effective risk 

management. 

101. To fulfil these responsibilities, training should enable designated competent authorities and 

SROs monitoring staff to adequately assess: 

i. The quality of internal procedures, including ongoing employee training programmes and 

internal audit, compliance and risk management functions. 

ii. Whether or not the risk management policies and processes are appropriate in light of 

legal professionals’ risk profile, and are periodically adjusted in light of changing risk 

profiles. 

iii. The participation of senior management to confirm that they have undertaken adequate 

risk management, and that the necessary procedures and controls are in place. 

102. Educating legal professionals on AML/CFT issues and the risk-based approach is a key 

element of an effective risk-based approach. Designated competent authorities should thus consider, 

in discussion with SROs and legal professionals and other appropriate organisations, ways of 

encouraging educational bodies (such as universities and law schools) to include within the education 

and training of legal professionals at all levels appropriate references to AML/CFT laws and the 

appropriate role that legal professionals can play in combating money laundering and terrorist 

financing. 

24 
SECTION THREE: GUIDANCE FOR LEGAL PROFESSIONALS 

ON IMPLEMENTING A RISK-BASED APPROACH 

Chapter One: Risk Categories 

103. Potential money laundering and terrorist financing risks faced by legal professionals will vary 

according to many factors including the activities undertaken by the legal professional, the type and 

identity of client, and the nature of the client relationship and its origin. Legal professionals should 

identify the criteria that enable them to best assess the potential money laundering and where feasible 

terrorist financing risks their practices give rise to and should then implement a reasonable risk based 

approach based on those criteria. These criteria are not exhaustive and are not intended to be 

prescriptive, and should be applied in a manner that is well-considered, is appropriate to the particular 

circumstances of the country and takes into account the way in which legal professionals are regulated 

in that country and the obligations they are required to observe. 

104. Identification of the money laundering risks and terrorist financing risks associated with 

certain clients or categories of clients, and certain types of work will allow legal professionals to 

determine and implement reasonable and proportionate measures and controls to mitigate these risks. 

Although a risk assessment should normally be performed at the inception of a client relationship, for 

a legal professional, the ongoing nature of the advice and services the legal professional often 

provides means that automated transaction monitoring systems of the type used by financial 

institutions will be inappropriate for many legal professionals. The individual legal professionals 

working with the client are better positioned to identify and detect changes in the type of work or the 

nature of the client’s activities, this is because the lawyer’s knowledge of the client and its business 

will develop throughout the duration of what is expected to be a longer term relationship. Legal 

professionals will need to pay attention to the nature of the risks presented by isolated, small and 

short-term client relationships that, depending upon the circumstances, may be low risk (e.g. advice 

provided to walk-ups in a legal aid clinic). 

105. The amount and degree of monitoring will depend on the nature and frequency of the 

relationship. A legal professional may also have to adjust his or her risk assessment of a particular 

client based upon information received from a designated competent authority, SRO, or other credible 

sources. 

106. Money laundering and terrorist financing risks may be measured using various categories. 

Application of risk categories provides a strategy for managing potential risks by enabling legal 

professionals, where required, to subject each client to reasonable and proportionate risk assessment. 

The most commonly used risk criteria are: country or geographic risk; client risk; and risk associated 

with the particular service offered. The weight given to these risk categories (individually or in 

combination) in assessing the overall risk of potential money laundering or terrorist financing may 

vary from one legal professional and/or firm to another, particularly given the size, sophistication, 

nature and scope of services offered by the legal professional and/or firm. These criteria, however, 

should not be considered in isolation. Legal professionals, in light of their individual practices and 

based on their reasonable judgements, will need to assess independently the weight to be given to 

each risk factor. 

25 
107. Although there is no universally accepted set of risk categories, the examples provided in this 

Guidance are the most commonly identified risk categories. There is no single methodology to apply 

these risk categories, and the application of these risk categories is merely intended to provide a 

suggested framework for approaching the management of potential risks. 

Country/Geographic Risk

108. There is no universally agreed definition by either designated competent authorities, SROs, or 

legal professionals that prescribes whether a particular country or geographic area (including the 

country within which the legal professional practices) represents a higher risk. Country risk, in 

conjunction with other risk factors, provides useful information as to potential money laundering and 

terrorist financing risks. Money laundering and terrorist financing risks have the potential to arise 

from almost any source, such as the domicile of the client, the location of the transaction and the 

source of the funding. Countries that pose a higher risk include: 

• Countries subject to sanctions, embargoes or similar measures issued by, for example, the 

United Nations (UN). In addition, in some circumstances, countries subject to sanctions or 

measures similar to those issued by bodies such as the UN, but that may not be universally 

recognised, may be taken into account by a legal professional because of the standing of the 

issuer of the sanctions and the nature of the measures. 

• Countries identified by credible sources5

 as generally lacking appropriate AML/CFT laws, 

regulations and other measures. 

• Countries identified by credible sources as being a location from which funds or support are 

provided to terrorist organizations. 

• Countries identified by credible sources as having significant levels of corruption or other 

criminal activity. 

Client Risk

109. Determining the potential money laundering or terrorist financing risks posed by a client, or 

category of clients, is critical to the development and implementation of an overall risk-based 

framework. Based on its own criteria, a legal professional should seek to determine whether a 

particular client poses a higher risk and the potential impact of any mitigating factors on that 

assessment. Application of risk variables may mitigate or exacerbate the risk assessment. Categories 

of clients whose activities may indicate a higher risk include: 

• PEPs are considered as higher risk clients – If a legal professional is advising a client that is a 

PEP, or where a PEP is the beneficial owner of the client, with respect to the activities 

specified in Recommendation 12, then a legal professional will need to carry out appropriate 

enhanced CDD, as required by Recommendation 6. Relevant factors that will influence the 

extent and nature of CDD include the particular circumstances of a PEP, the PEP’s home 

country, the type of work the PEP is instructing the legal professional to perform or carry out, 

and the scrutiny to which the PEP is under in the PEP’s home country. 

5

 “Credible sources” refers to information that is produced by well-known bodies that generally are 

regarded as reputable and that make such information publicly and widely available. In addition to the FATF 

and FATF-style regional bodies, such sources may include, but are not limited to, supra-national or international 

bodies such as the International Monetary Fund, the World Bank, and the Egmont Group of Financial 

Intelligence Units, as well as relevant national government bodies and non-governmental organisations. The 

information provided by these credible sources does not have the effect of law or regulation and should not be 

viewed as an automatic determination that something is of higher risk. 

26 
• If a PEP is otherwise involved in a client (other than in the circumstances of 

Recommendation 6), then the nature of the risk should be considered in light of all relevant 

circumstances, such as: 

o The nature of the relationship between the client and the PEP. Even if the PEP does 

not have a controlling interest or a dominant position on the board or in management 

and therefore does not qualify as a beneficial owner, the PEP may nonetheless affect 

the risk assessment. 

o The nature of the client (e.g. is it a public listed company). 

o The nature of the services sought. For example, lower risks may exist where a PEP is 

not the client but a director of a client that is a public listed company and the client is 

purchasing real property for adequate consideration. 

• Clients conducting their business relationship or requesting services in unusual or 

unconventional circumstances (as evaluated in all the circumstances of the representation). 

• Clients where the structure or nature of the entity or relationship makes it difficult to identify 

in a timely fashion the true beneficial owner or controlling interests, such as the unexplained 

use of legal persons or legal arrangements, nominee shares or bearer shares. 

• Clients that are cash (and cash equivalent) intensive businesses including: 

o Money services businesses (e.g. remittance houses, currency exchange houses, casas 

de cambio, centros cambiarios, remisores de fondos, bureaux de change, money 

transfer agents and bank note traders or other businesses offering money transfer 

facilities). 

o Casinos, betting and other gambling related activities. 

o Businesses that while not normally cash intensive, generate substantial amounts of 

cash. 

• Where clients that are cash intensive businesses are themselves subject to and regulated for a 

full range of AML/CFT requirements consistent with the FATF Recommendations this may 

mitigate the risks. 

• Charities and other “not for profit” organisations (NPOs) that are not subject to monitoring or 

supervision (especially those operating on a “cross-border” basis) by designated competent 

authorities6

 or SROs. 

• Clients using financial intermediaries, financial institutions or legal professionals that are not 

subject to adequate AML/CFT laws and measures and that are not adequately supervised by 

competent authorities or SROs. 

• Clients having convictions for proceeds generating crimes who instruct the legal professional 

(who has actual knowledge of such convictions) to undertake specified activities on their 

behalf. 

• Clients who have no address, or multiple addresses without legitimate reasons. 

• Clients who change their settlement or execution instructions without appropriate explanation. 

6

 See Special Recommendation VIII. 

27 
• The use of legal persons and arrangements without any apparent legal or legitimate tax, 

business, economic or other reason. 

Service Risk

110. An overall risk assessment should also include determining the potential risks presented by 

the services offered by a legal professional, noting that the various legal professionals provide a broad 

and diverse range of services. The context of the services being offered or delivered is always 

fundamental to a risk-based approach. Any one of the factors discussed in this Guidance alone may 

not itself constitute a high risk circumstance. High risk circumstances can be determined only by the 

careful evaluation of a range of factors that cumulatively and after taking into account any mitigating 

circumstances would warrant increased risk assessment. When determining the risks associated with 

provision of services related to specified activities, consideration should be given to such factors as: 

• Services where legal professionals, acting as financial intermediaries, actually handle the 

receipt and transmission of funds through accounts they actually control in the act of closing a 

business transaction. 

• Services to conceal improperly beneficial ownership from competent authorities. 

• Services requested by the client for which the legal professional does not have expertise 

excepting where the legal professional is referring the request to an appropriately trained 

professional for advice. 

• Transfer of real estate between parties in a time period that is unusually short for similar 

transactions with no apparent legal, tax, business, economic or other legitimate reason.7

• Payments received from un-associated or unknown third parties and payments for fees in cash 

where this would not be a typical method of payment. 

• Transactions where it is readily apparent to the legal professional that there is inadequate 

consideration, such as when the client does not identify legitimate reasons for the amount of 

the consideration. 

• Administrative arrangements concerning estates where the deceased was known to the legal 

professional as being a person who had been convicted of proceeds generating crimes. 

• Clients who offer to pay extraordinary fees for services which would not ordinarily warrant 

such a premium. However, bona fide and appropriate contingency fee arrangements, where a 

legal professional may receive a significant premium for a successful representation, should 

not be considered a risk factor. 

• The source of funds and the source of wealth – The source of funds is the activity that 

generates the funds for a client, while the source of wealth describes the activities that have 

generated the total net worth of a client. 

• Unusually high levels of assets or unusually large transactions compared to what might 

reasonably be expected of clients with a similar profile may indicate that a client not 

otherwise seen as higher risk should be treated as such. Conversely, low levels of assets or 

low value transactions involving a client that would otherwise appear to be higher risk might 

allow for a legal professional to treat the client as lower risk. 

7

 See the FATF Typologies report Money Laundering and Terrorist Financing through the Real Estate 

Sector at http://www.fatf-gafi.org/dataoecd/45/31/40705101.pdf. 

28 
• Shell companies, companies with ownership through nominee shareholding and control 

through nominee and corporate directors8

. 

• Situations where it is difficult to identify the beneficiaries of trusts; this might include a 

discretionary trust that gives the trustee discretionary power to name the beneficiary within a 

class of beneficiaries and distribute accordingly the assets held in trust, and when a trust is set 

up for the purpose of managing shares in a company that can make it more difficult to 

determine the beneficiaries of assets managed by the trust9

; 

• Services that deliberately have provided or purposely depend upon more anonymity in the 

client identity or participants than is normal under the circumstances and experience of the 

legal professional. 

• Legal persons that, as a separate business, offer TCSP services should have regard to the 

TCSP Guidance, even if such legal persons are owned or operated by legal professionals. 

Legal professionals, however, who offer TCSP services should have regard to this Guidance, 

and should consider customer or service risks related to TCSPs such as the following: 

o Unexplained use of express trusts. 

o Unexplained delegation of authority by the client through the use of powers of attorney, 

mixed boards and representative offices. 

o In the case of express trusts, an unexplained relationship between a settlor and 

beneficiaries with a vested right, other beneficiaries and persons who are the object of a 

power. 

o In the case of an express trust, an unexplained (where explanation is warranted) nature of 

classes of beneficiaries and classes within an expression of wishes. 

Variables that May Impact Risk

111. Due regard must be accorded to the vast and profound differences in practices, size, scale and 

expertise, amongst legal professionals. As a result, consideration must be given to these factors when 

creating a reasonable risk-based approach and the resources that can be reasonably allocated to 

implement and manage it. For example, a sole practitioner would not be expected to devote an 

equivalent level of resources as a large law firm; rather, the sole practitioner would be expected to 

develop appropriate systems and controls and a risk-based approach proportionate to the scope and 

nature of the practitioner’s practice. 

112. A significant factor to consider is whether the client and proposed work would be unusual, 

risky or suspicious for the particular legal professional. This factor must always be considered in the 

context of the legal professional’s practice. A legal professional’s risk-based approach methodology 

may thus take into account risk variables specific to a particular client or type of work. Consistent 

with the risk-based approach and the concept of proportionality, the presence of one or more of these 

variables may cause a legal professional to conclude that either enhanced due diligence and 

monitoring is warranted, or conversely that normal CDD and monitoring can be reduced, modified or 

simplified. These variables may increase or decrease the perceived risk posed by a particular client or 

type of work and may include: 

8

 See also the FATF typologies report ‘‘The Misuse of Corporate Vehicles, including Trust and Company 

Service Providers” published 13 October 2006. 

9

 See also the FATF typologies report “The Misuse of Corporate Vehicles, including Trust and Company 

Service Providers” Annex 2 on trusts, for a more detailed description of “potential for misuse” of trusts. 

29 
• The nature of the client relationship and the client’s need for the legal professional to provide 

specified activities. 

• The level of regulation or other oversight or governance regime to which a client is subject. 

For example, a client that is a financial institution or legal professional regulated in a country 

with a satisfactory AML/CFT regime poses less risk of money laundering than a client in an 

industry that has money laundering risks and yet is unregulated for money laundering 

purposes. 

• The reputation and publicly available information about a client. Legal persons that are 

transparent and well known in the public domain and have operated for a number of years 

without being convicted of proceeds generating crimes may have low susceptibility to money 

laundering. 

• The regularity or duration of the relationship. 

• The familiarity of the legal professional with a country, including knowledge of local laws, 

regulations and rules, as well as the structure and extent of regulatory oversight, as the result 

of a legal professional’s own activities within the country. 

• The proportionality between the magnitude or volume and longevity of the client’s business 

and its legal requirements, including the nature of professional services sought. 

• Subject to other factors (including the nature of the services and the source and nature of the 

client relationship), providing limited legal services in the capacity of a local or special 

counsel may be considered a low risk factor. This may also, in any event, mean that the legal 

professional is not “preparing for” or “carrying out” a transaction for a regulated activity 

specified in Recommendation 12. 

• Significant and unexplained geographic distance between the legal professional organisation 

and the location of the client where there is no nexus to the type of work being undertaken. 

• Where a prospective client has instructed the legal professional to undertake a single 

transaction-based service (as opposed to an ongoing advisory relationship) and one or more 

other risk factors are present. 

• Risks that may arise from the use of new or developing technologies that permit non-face to 

face relationships and could favour anonymity. However, due to the prevalence of electronic 

communication between legal professionals and clients in the delivery of legal services, nonface to face interaction between legal professionals and clients should not, standing alone, be 

considered a high risk factor. For example, non-face to face, cross-border work for an 

existing client is not necessarily high risk work for certain organisations (such as regional, 

national or international law firms or other firms regardless of size that practice in that type of 

work) nor would customary services rendered by a sole practitioner on a local basis to a client 

in the local community who does not otherwise present increased risks. 

• The nature of the referral or origination of the client. A prospective client may contact a legal 

professional in an unsolicited manner or without common or customary methods of 

introduction or referrals, which may increase risk. By contrast, where a prospective client has 

been referred from another trusted source subject to an AML/CFT regime that is in line with 

the FATF standards, the referral may be considered a mitigating risk factor. 

• The structure of a client or transaction. Structures with no apparent legal, tax, business, 

economic or other legitimate reason may increase risk. Legal professionals often design 

30 
structures (even if complex) for legitimate legal, tax, business, economic or other legitimate 

reasons, in which case the risk of money laundering could be reduced. 

• Trusts that are pensions may be considered lower risk. 

Controls for Higher Risk Situations

113. Legal professionals should implement appropriate measures and controls to mitigate the 

potential money laundering and terrorist financing risks with respect to those clients that, as the result 

of the legal professional or firm risk-based approach, are determined to be higher risk. Paramount 

among these measures is the requirement to train legal professionals and appropriate staff to identify 

and detect changes in activity by reference to risk-based criteria. These measures and controls may 

include: 

• General training on money laundering methods and risks relevant to legal professionals. 

• Targeted training for increased awareness by the legal professionals providing specified 

activities to higher risk clients or to legal professionals undertaking higher risk work. 

• Increased levels of CDD or enhanced due diligence for higher risk situations. 

• Escalation or additional review and/or consultation by the legal professional or within a firm 

at the establishment of a relationship. 

• Periodic review of the services offered by the legal professional and/or firm to determine 

whether the risk of money laundering and terrorist financing occurring has increased. 

• Reviewing client relationships from time to time to determine whether the risk of money 

laundering and terrorist financing occurring has increased. 

• The same measures and controls may often address more than one of the risk criteria 

identified, and it is not necessarily expected that a legal professional establish specific 

controls targeting each risk criterion. 

Chapter Two: Application of a Risk-Based Approach 

Customer Due Diligence/Know Your Customer

114. Client Due Diligence/Know Your Client is intended to enable a legal professional to form a 

reasonable belief that it has appropriate awareness of the true identity of each client. The legal 

professional's procedures should apply in circumstances where a legal and professional is preparing 

for or carrying out10 the activities listed in Recommendation 12 and include procedures to: 

a) Identify and appropriately verify the identity of each client on a timely basis. 

b) Identify the beneficial owner, and take reasonable measures to verify the identity of the 

beneficial owner such that the legal professional is reasonably satisfied that it knows who the 

beneficial owner is. The general rule is that clients should be subject to the full range of CDD 

measures, including the requirement to identify the beneficial owner in accordance with this 

paragraph. The purpose of identifying beneficial ownership is to ascertain those natural 

persons who exercise effective control over a client, whether by means of ownership, voting 

10 See paragraphs 12-13 regarding when a legal professional would or would not be engaged in "preparing 

for" or "carrying out" transactions for clients, and hence the requirements of Recommendation 12 would apply. 

31 
rights or otherwise. Legal professionals should have regard to this purpose when identifying 

the beneficial owner. They may use a risk-based approach when determining the extent to 

which they are required to identify the beneficial owner, depending on the type of client, 

business relationship and transaction and other appropriate factors in accordance with 

Recommendation 5 and its Interpretative Note, § 9-1211. 

c) Obtain appropriate information to understand the client's circumstances and business 

depending on the nature, scope and timing of the services to be provided. This information 

may be obtained from clients during the normal course of their instructions to legal 

professionals. 

115. The starting point is for a legal professional to assess the risks that the client may pose taking 

into consideration any appropriate risk variables (and any mitigating factors) before making a final 

determination. The legal professional’s assessment of risk will then inform the overall approach to 

CDD requirements and appropriate verification. Legal professionals will reasonably determine the 

CDD requirements appropriate to each client given the legal professional’s familiarity with the client, 

which may include: 

• A standard level of CDD, generally to be applied to all clients. 

• The standard level being reduced after consideration of appropriate risk variables, and in 

recognised lower risk scenarios, such as: 

o Publicly listed companies (and their majority owned subsidiaries). 

o Financial institutions (domestic or foreign) subject to an AML/CFT regime consistent 

with the FATF Recommendations. 

o Government authorities and state run enterprises (other than those from sanctioned 

countries). 

• An increased level of CDD in respect of those clients that are reasonably determined by the 

legal professional to be of higher risk. This may be the result of the client’s business activity, 

ownership structure, particular service offered including work involving higher risk countries 

or defined by applicable law or regulation as posing higher risk, such as the risks outlined in 

paragraphs 108-109. 

Monitoring of Clients and Specified Activities

116. The degree and nature of monitoring by a legal professional will depend on the type of legal 

professional, and if it is a firm, the size and geographic ‘footprint’ of the firm, the AML/CFT risks 

that the firm has identified and the nature of the regulated activity provided. Given the nature of the 

advisory relationship legal professionals have with their clients and that an element of that advisory 

relationship will usually involve frequent client contact, monitoring is typically best achieved by 

trained individuals having contact with the client (either face to face or by other means of 

communication). For purposes of paragraphs 116 to 118 (and related paragraphs), “monitoring” does 

not oblige the legal professional to function as, or assume the role of, a law enforcement or 

investigative authority vis-a-vis his or her client. It rather refers to maintaining awareness throughout 

11 Legal professionals should have regard to the Interpretative Notes to Recommendation 5 and the 

AML/CFT 2004 Methodology Essential Criteria 5.5 and 5.8-5.12, which, among other things, provide more 

details on the measures that need to be taken to identify beneficial owners, and the impact of higher or lower 

risk on the required measures. 

32 
the course of work for a client to money laundering or terrorist financing activity and/or changing risk 

factors. 

117. Monitoring of these advisory relationships cannot be achieved solely by reliance on 

automated systems and whether any such systems would be appropriate will depend in part on the 

nature of a legal professional’s practice and resources reasonably available to the legal professional. 

For example, a sole practitioner would not be expected to devote an equivalent level of resources as a 

large law firm; rather, the sole practitioner would be expected to develop appropriate monitoring 

systems and a risk-based approach proportionate to the scope and nature of the practitioner’s practice. 

A legal professional’s advisory relationships are best monitored by the individuals having direct client 

contact being appropriately trained to identify and detect changes in the risk profile of a client. Where 

appropriate this should be supported by systems, controls and records within a framework of support 

by the firm (e.g. tailored training programs appropriate to the level of staff responsibility). 

118. Legal professionals should also assess the adequacy of any systems, controls and processes on 

a periodic basis. Monitoring programs can fall within the system and control framework developed to 

manage the risk of the firm. The results of the monitoring may also be documented. 

119. The civil law notary does not represent parties to a contract and therefore must maintain a fair 

position with regard to any duty to both parties. 

Suspicious Transaction Reporting

120. This Guidance does not address FATF Recommendations relating to suspicious transaction 

reporting (STR) and the proscription against “tipping off” those who are the subject of such reports. 

Different countries have undertaken different approaches to these Recommendations of the FATF. 

Where a legal or regulatory requirement mandates the reporting of suspicious activity once a 

suspicion has been formed, a report must be made and, therefore, a risk-based approach for the 

reporting of the suspicious activity under these circumstances is not applicable. STRs are not part of 

risk assessment, but rather reflect a response mechanism – typically to an SRO or government 

enforcement authority – once a suspicion of money laundering has been identified. For those reasons, 

this Guidance does not address those elements of the FATF Recommendations. 

Education, Training and Awareness

121. Recommendation 15 requires that legal professionals provide their staff with AML/CFT 

training, and it is important that legal professional staff receive appropriate and proportional training 

with regard to money laundering. For legal professionals, and those in smaller firms in particular, 

such training may assist with monitoring obligations. A legal professional’s commitment to having 

appropriate controls relies fundamentally on both training and awareness. This requires a firm-wide 

effort to provide all relevant legal professionals with at least general information on AML/CFT laws, 

regulations and internal policies. To satisfy a risk-based approach, particular attention should be given 

to risk factors or circumstances occurring in the legal professional’s own practice. In addition, 

governments, SROs and other representative bodies for both common and civil law notaries and bar 

associations should work with educational institutions to see that both legal professionals, and 

students taking courses to train for or become legal professionals, are educated on money laundering 

and terrorist financing risks. For example, bar societies and associations should be encouraged to 

produce continuing legal education programs on AML/CFT and the risk-based approach. 

122. Applying a risk-based approach to the various methods available for training, however, gives 

each legal professional flexibility regarding the frequency, delivery mechanisms and focus of such 

training. Legal professionals should review their own staff and available resources and implement 

training programs that provide appropriate AML/CFT information that is: 

• Tailored to the relevant staff responsibility (e.g. client contact or administration). 

33 
• At the appropriate level of detail (e.g. considering the nature of services provided by the legal 

professional). 

• At a frequency suitable to the risk level of the type of work undertaken by the legal 

professional. 

• Used to test to assess staff knowledge of the information provided. 

Chapter Three: Internal Controls 

123. Many DNFBPs differ significantly from financial institutions in terms of size. By contrast to 

most financial institutions, a significant number of DNFBPs have only a few staff. This limits the 

resources that small businesses and professions can dedicate to the fight against money laundering 

and terrorist financing. For a number of DNFBPs, a single person may be responsible for the 

functions of front office, back office, money laundering reporting, and senior management. This 

particularity of DNFBPs, including legal professionals, should be taken into account in designing a 

risk-based framework for internal controls systems. The Interpretative Note to Recommendation 15, 

dealing with internal controls, specifies that the type and extent of measures to be taken for each of its 

requirements should be appropriate having regard to the size of the business. 

124. To enable legal professionals to have effective risk-based approaches, the risk-based process 

must be a part of the internal controls of the legal professional or firm. Legal professionals operate 

within a wide range of differing business structures, from sole practitioners to large partnerships. 

These structures often mean that legal professionals’ businesses have a flat management structure and 

that most or all of the principals (or partners) of the firm hold ultimate management responsibility. In 

other organisations, legal professionals employ corporate style organisational structures with tiered 

management responsibility. In both cases the principals or the managers are ultimately responsible for 

ensuring that the organisation maintains an effective internal control structure. Engagement by the 

principals and managers in AML/CFT is an important aspect of the application of the risk-based 

approach since such engagement reinforces a culture of compliance, ensuring that staff adheres to the 

legal professional’s policies, procedures and processes designed to limit and control money 

laundering risks. 

125. The nature and extent of the AML/CFT controls, as well as meeting national requirements, 

need to be proportionate to the risk involved in the services being offered. In addition to other 

compliance internal controls, the nature and extent of AML/CFT controls will depend upon a number 

of factors, such as: 

• The nature, scale and complexity of a legal professional’s business. 

• The diversity of a legal professional’s operations, including geographical diversity. 

• The legal professional’s client, service and activity profile. 

• The degree of risk associated with each area of the legal professional’s operations. 

• The services being offered and the frequency of client contact (either in person or by other 

means of communication). 

126. Subject to the size and scope of the legal professional’s organisation, the framework of riskbased internal controls should: 

34 
• Have appropriate risk management systems to determine whether a client, potential client, or 

beneficial owner is a PEP. 

• Provide increased focus on a legal professional’s operations (e.g. services, clients and 

geographic locations) that are more vulnerable to abuse by money launderers. 

• Provide for periodic review of the risk assessment and management processes, taking into 

account the environment within which the legal professional operates and the activity in its 

marketplace. 

• Designate personnel at an appropriate level who are responsible for managing AML/CFT 

compliance. 

• Provide for an AML/CFT compliance function and review programme if appropriate given 

the scale of the organisation and the nature of the legal professional’s practice. 

• Inform the principals of compliance initiatives, identified compliance deficiencies and 

corrective action taken. 

• Provide for programme continuity despite changes in management or employee composition 

or structure. 

• Focus on meeting all regulatory record keeping or other requirements, as well as promulgated 

measures for AML/CFT compliance and provide for timely updates in response to changes in 

regulations. 

• Implement risk-based CDD policies, procedures and processes. 

• Provide for adequate controls for higher risk clients and services as necessary, such as review 

with or approvals from others. 

• Provide for adequate supervision and support for staff activity that forms part of the 

organisation’s AML/CFT programme. 

• Incorporate AML/CFT compliance into job descriptions and performance evaluations of 

relevant personnel. 

• Provide for appropriate training to be given to all relevant staff. 

• For groups, to the extent possible, provide a common control framework. 

35 
ANNEXES 

ANNEX 1 

SOURCES OF FURTHER INFORMATION 

Various sources of information exist that may help governments and legal professionals in their 

development of a risk-based approach. Although not an exhaustive list, this Annex 1 highlights a 

number of useful web-links that governments and legal professionals may wish to draw upon. They 

provide additional sources of information, and further assistance might also be obtained from other 

information sources such AML/CFT assessments. 

A. Financial Action Task Force Documents 

The Financial Action Task Force (FATF) is an inter-governmental body whose purpose is the 

development and promotion of national and international policies to combat money laundering and 

terrorist financing. Key resources include the 40 Recommendations on Money Laundering and 9 

Special Recommendations on Terrorist Financing, the Methodology for Assessing Compliance with 

the FATF Recommendations, the Handbook for Countries and Assessors, methods and trends 

(typologies) reports and mutual evaluation reports. 

www.fatf-gafi.org

B. Legislation/and Court Decisions 

The rulings by the ECJ of June 26th 2007 by the Belgium Constitution Court of January 23rd 2008 and 

the French Conseil d’État of April 10th, 2008 have confirmed that anti-money laundering regulation 

cannot require or permit the breach the lawyer’s duty of professional secrecy when performing the 

essential activities of the profession. In addition, the Court of First Instance in the Joined Cases T125/03 &T-253/03 Akzo Nobel Chemicals Ltd and Akcros Chemicals Ltd v Commission of the 

European Communities has recently restated the ruling in the AM&S case that professional secrecy 

“meets the need to ensure that every person must be able, without constraint, to consult a lawyer 

whose profession entails the giving of independent legal advice to all those in need of it (AM&S, 

paragraph 18). That principle is thus closely linked to the concept of the lawyer’s role as collaborating 

in the administration of justice by the courts (AM&S, paragraph 24). 

C. Links to Information on the Supervisory Program in Certain Countries 

Switzerland 

1. See articles 18 to 21 of the lawyers and notaries' SRO regulations (SRO SAV/SNV): 

www.sro-sav-snv.ch/fr/02_beitritt/01_regelwerke.htm/02_Reglement.pdf 

36 
2. See articles 38 and 45 to 47 of the lawyers and notaries' SRO statutes (SRO SAV/SNV): 

www.oad-fsa-fsn.ch/fr/02_beitritt/01_regelwerke.htm/01_Statuten.pdf

D. Guidance on the Risk-based Approach 

1. Law Society of Ireland: www.lawsociety.ie. 

2. Law Society of England and Wales: www.lawsociety.org.uk

3. Law Society of Hong Kong: www.hklawsoc.org.hk

4. Organisme d'autoréglementation de la fédération suisse des avocats et de la fédération suisse 

des notaires (SRO SAV/SNV): home page: www.sro-sav-snv.ch/

www.sro-sav-snv.ch/fr/02_beitritt/01_regelwerke.htm/02_Reglement.pdf (art. 41 to 46) 

5. The Netherlands Bar Association: www.advocatenorde.nl

6. The Royal Dutch Notarial Society: www.notaris.nl 

E. Other sources of information to help assist countries’ and legal professionals’ risk 

assessment of countries and cross-border activities 

In determining the levels of risks associated with particular country or cross border activity, legal 

professionals and governments may draw on a range of publicly available information sources, these 

may include reports that detail observance of international standards and codes, specific risk ratings 

associated with illicit activity, corruption surveys and levels of international cooperation. Although 

not an exhaustive list the following are commonly utilised: 

• IMF and World Bank Reports on observance of international standards and codes (Financial 

Sector Assessment Programme) 

o World Bank reports: www1.worldbank.org/finance/html/cntrynew2.html

o International Monetary Fund: 

www.imf.org/external/np/rosc/rosc.asp?sort=topic#RR 

o Offshore Financial Centres (OFCs) IMF staff assessments 

www.imf.org/external/np/ofca/ofca.asp

• Mutual evaluation reports issued by FATF Style Regional Bodies: 

1. Asia/Pacific Group on Money Laundering (APG) 

www.apgml.org/documents/default.aspx?DocumentCategoryID=8

2. Caribbean Financial Action Task Force (CFATF) 

www.cfatf.org/profiles/profiles.asp

3. The Committee of Experts on the Evaluation of Anti-Money Laundering Measures 

(MONEYVAL) 

www.coe.int/t/e/legal_affairs/legal_cooperation/combating_economic_crime/5_money_laundering/Evaluations/Reports_summaries

3.asp#TopOfPage

4. Eurasian Group (EAG) 

37 
www.eurasiangroup.org/index-7.htm

5. GAFISUD 

www.gafisud.org/miembros.htm

6. Middle East and North Africa FATF (MENAFATF) 

www.menafatf.org/TopicList.asp?cType=train

7. The Eastern and South African Anti Money Laundering Group (ESAAMLG) 

www.esaamlg.org/

8. Groupe Inter-gouvernemental d’Action contre le Blanchiment d’Argent (GIABA) 

www.giabasn.org/?lang=en&sid

• OECD Sub Group of Country Risk Classification (a list of country of risk classifications 

published after each meeting) 

www.oecd.org/document/49/0,2340,en_2649_34171_1901105_1_1_1_1,00.html

• International Narcotics Control Strategy Report (published annually by the US State 

Department) 

www.state.gov/p/inl/rls/nrcrpt/

• Egmont Group membership - Coalition of financial intelligence units that participate in regular 

information exchange and the sharing of good practice, acceptance as a member of the Egmont 

Group is based a formal procedure that countries must go through in order to be acknowledged 

as meeting the Egmont definition of an FIU. 

www.egmontgroup.org/

• Signatory to the United Nations Convention against Transnational Organized Crime 

www.unodc.org/unodc/crime_cicp_signatures_convention.html

• The Office of Foreign Assets Control (“OFAC”) of the US Department of the Treasury 

economic and trade, Sanctions Programmes

www.ustreas.gov/offices/enforcement/ofac/programs/index.shtml

• Consolidated list of persons, groups and entities subject to EU Financial Sanctions 

http://ec.europa.eu/comm/external_relations/cfsp/sanctions/list/consol-list.htm

• UN Security Council Sanctions Committee - Country Status: 

www.un.org/sc/committees/

38 
ANNEX 2 

GLOSSARY OF TERMINOLOGY 

Beneficial Owner 

Beneficial owner refers to the natural person(s) who ultimately owns or controls a client and/or the 

person on whose behalf a transaction is being conducted. It also incorporates those persons who 

exercise ultimate effective control over a legal person or arrangement. 

Competent authorities 

Competent authorities refers to all administrative and law enforcement authorities concerned with 

combating money laundering and terrorist financing, including the FIU and supervisors. 

Designated Non-Financial Businesses and Professions (DNFBPs) 

a. Casinos (which also includes internet casinos). 

b. Real estate agents. 

c. Dealers in precious metals. 

d. Dealers in precious stones. 

e. Lawyers, notaries, other independent legal professionals and accountants – this refers to sole 

practitioners, partners or employed professionals within professional firms. It is not meant to refer to 

‘internal’ professionals that are employees of other types of businesses, nor to professionals working 

for government agencies, who may already be subject to measures that would combat money 

laundering. 

f. Trust and Company Service Providers refers to all persons or businesses that are not covered 

elsewhere under the Recommendations, and which as a business, provide any of the following 

services to third parties: 

• Acting as a formation agent of legal persons.

• Acting as (or arranging for another person to act as) a director or secretary of a 

company, a partner of a partnership, or a similar position in relation to other legal persons.

• Providing a registered office; business address or accommodation, correspondence or 

administrative address for a company, a partnership or any other legal person or 

arrangement.

• Acting as (or arranging for another person to act as) a trustee of an express trust.

• Acting as (or arranging for another person to act as) a nominee shareholder for another 

person.

Express Trust 

Express trust refers to a trust clearly created by the settlor, usually in the form of a document e.g. a 

written deed of trust. They are to be contrasted with trusts which come into being through the 

operation of the law and which do not result from the clear intent or decision of a settlor to create a 

trust or similar legal arrangements (e.g. constructive trust). 

39 
FATF Recommendations 

Refers to the FATF Forty Recommendations and the FATF Nine Special Recommendations on 

Terrorist Financing.

Legal Person 

Legal person refers to bodies corporate, foundations, anstalt, partnerships, or associations, or any 

similar bodies that can establish a permanent client relationship with a legal professional or otherwise 

own property. 

Legal Professional 

In this Guidance, the term “Legal professional” refers to lawyers, civil law notaries, common law 

notaries, and other independent legal professionals. 

Politically Exposed Persons (PEPs) 

Individuals who are or have been entrusted with prominent public functions in a foreign country, for 

example Heads of State or of government, senior politicians, senior government, judicial or military 

officials, senior executives of state owned corporations, important political party officials. Business 

relationships with family members or close associates of PEPs involve reputational risks similar to 

those with PEPs themselves. The definition is not intended to cover middle ranking or more junior 

individuals in the foregoing categories. 

Self-regulatory organisation (SRO) 

A body that represents a profession (e.g. lawyers, notaries, other independent legal professionals or 

accountants), and which is made up of member professionals or a majority thereof, has a role (either 

exclusive or in conjunction with other entities) in regulating the persons that are qualified to enter and 

who practise in the profession, and also performs certain supervisory or monitoring type functions. 

For example, it would be normal for this body to enforce rules to ensure that high ethical and moral 

standards are maintained by those practising the profession. 

40 
41 

ANNEX 3 

MEMBERS OF THE ELECTRONIC ADVISORY GROUP 

FATF and FSRB members and observers 

Argentina; Asia Pacific Group (APG); Australia; Belgium; Azerbaijan; Canada; Chinese Taipei, 

China; European Commission (EC); Nigeria; France; Hong Kong, China; Italy; Japan; Luxembourg; 

MONEYVAL; Netherlands; New Zealand; Offshore Group of Banking Supervisors (OGBS); 

Portugal; Romania; Spain; South Africa; Switzerland; United Kingdom; United States. 

Dealers in precious metals and dealers in precious stones industries 

Antwerp World Diamond Centre, International Precious Metals Institute, World Jewellery 

Confederation, Royal Canadian Mint, Jewellers Vigilance Committee, World Federation of Diamond 

Bourses, Canadian Jewellers Association. 

Real estate industry 

International Consortium of Real Estate Agents, National Association of Estate Agents (UK), the 

Association of Swedish Real Estate Agents. 

Trust and company service providers industry 

The Society of Trust and Estate Practitioners (STEP), the Law Debenture Trust Corporation. 

Accountants 

American Institute of Certified Public Accountants, Canadian Institute of Chartered Accountants, 

European Federation of Accountants, German Institute of Auditors, Hong Kong Institute of Public 

Accountants, Institute of Chartered Accountants of England & Wales. 

Casino industry 

European Casino Association (ECA), Gibraltar Regulatory Authority, Kyte Consultants (Malta), 

MGM Grand Hotel & Casino, Unibet, William Hill plc. 

Lawyers and notaries 

Allens Arther Robinson, American Bar Association (ABA), American College of Trust and Estate 

Council, Consejo General del Notariado (Spain), Council of the Notariats of the European Union, 

Council of Bars and Law Societies of Europe (CCBE), International Bar Association (IBA), Law 

Society of England & Wales, Law Society of Upper Canada.