A risk management programme for a small law practice
What a South African law practice's FIC Act risk management and compliance programme should cover, and how to keep the client evidence behind it.
By Achekam · · 5 min read · For Legal businesses in South Africa
A two-partner practice in a provincial town rarely thinks of itself as a target for money launderers. Yet a property transfer, a trust account deposit or the formation of a company for a new client are exactly the services criminals look for, and the Financial Intelligence Centre Act treats attorneys accordingly.
The heart of what the Act asks is a written risk management and compliance programme, usually shortened to RMCP. Large firms have compliance departments to write and run one. A small practice has the principal, a bookkeeper and perhaps a secretary. This article sets out what the programme has to deal with, how to keep it proportionate, and how to hold on to the client evidence it depends on.
Is your practice an accountable institution?
The Financial Intelligence Centre (FIC) lists as accountable institutions, under item 1, attorneys practising for their own account, including conveyancers and notaries. The same item covers advocates referred to in section 34(2)(a)(ii) of the Legal Practice Act and commercial juristic entities under section 34(7) of that Act. The FIC points readers to PCC 47A for its interpretation of that item.
For most small practices the answer is therefore yes. Being on the list is what brings in the duties below, whether or not the practice handles large sums.
What section 42 asks the programme to record
The FIC states that section 42 of the FIC Act requires every accountable institution to have an RMCP that documents two things:
- the practice's money laundering, terrorist financing and proliferation financing risks; and
- the processes, systems and controls it uses for customer due diligence, record keeping and reporting.
The Law Society of South Africa says the same in its POPIA guidelines for attorneys: each attorney, as an accountable institution, must develop, document, maintain and implement the programme. All four verbs matter. A template downloaded and filed in a drawer has been developed and documented, but it has not been maintained or implemented.
A useful way to write a small practice's RMCP is to start with the work it actually does. A practice that does mostly labour matters and wills faces different exposure from one that does conveyancing and company formations for foreign buyers. Name the services, name the kinds of clients, and say for each which features raise or lower the risk: cash deposits, clients the practice never meets in person, complex trust structures, urgency without explanation.
Knowing the client before the mandate is signed
The LSSA's guidelines state that an attorney must establish and verify the identity of a prospective client before entering a client relationship. The order matters. Identity checks that happen after the first trust deposit has landed are checks done too late.
In practice the RMCP should say, in plain steps:
- what the practice collects from an individual client, and how it checks it;
- what it collects from a company, close corporation, partnership or trust;
- who in the practice may accept a new client, and who decides the difficult ones; and
- what happens when a client cannot or will not provide what is asked for.
Looking through companies and trusts
The FIC states that accountable institutions must establish the beneficial owner of a client that is a legal person, partnership or trust. The beneficial owner is the natural person who owns or exercises effective control over it, and the practice must take reasonable steps to verify that person's identity.
Take a family trust buying a holiday flat. The trust deed names trustees and beneficiaries, but the RMCP should tell staff to establish who actually controls the trust and to verify that person, not just to file the letter of authority. For a company client, the same thinking applies to the shareholder register and whoever stands behind a holding company.
The FIC's guidance for the legal sector
The FIC's page for legal practitioners directs them to PCC 53 on Risk Management and Compliance Programmes, Directive 6 on risk and compliance returns, and its revised sector risk assessment for the legal sector. Reading the sector risk assessment before writing your own risk section saves effort: it describes how the FIC sees the legal sector's exposure, and your programme can then explain how your practice's work compares.
You will find all three documents linked from the FIC's page for legal practitioners, alongside the list of which practitioners are accountable institutions.
Five years of records you can actually find
The FIC states that accountable institutions must keep records of client information, transactional information and regulatory reports for at least five years from the end of the business relationship, the conclusion of a once-off transaction, or the submission of a report to the FIC.
That clock starts at the end, not the beginning. A client the practice has acted for since 2012 still has an open relationship, so the identity documents from that first instruction must still be on file. The RMCP should say where these records live and how someone would find them if an inspector asked.
How Achekam can hold the evidence
Achekam does not write an RMCP, verify identity or decide whether a client is acceptable. Those are judgements the practice makes. What it can do is keep the evidence of those judgements in one place:
- Document Centre stores files in folders. The practice can keep one folder per client with the identity documents, beneficial ownership records and the completed due diligence form, tag them, search them and archive them when the matter closes. A replacement document becomes a new version and the earlier versions remain.
- Fingerprints on every file. Every stored file gets a SHA-256 fingerprint, executable files are refused by default, and each upload passes a malware check (ClamAV where the server is configured for it, otherwise a built-in heuristic check).
- Signatures tied to the client. An e-signing envelope with a signer from outside the business must be linked to a client or a CRM lead before it goes out, so a signed client declaration sits against the right client rather than in someone's inbox.
Archiving rather than deleting is the right habit here: the five-year period runs after the relationship ends, and the folder must still be there when it does. Read organising matter files and versions in one store for a folder structure, and POPIA and a law practice's client files for the privacy side of holding identity documents. The question of when a closed file may finally go is covered in retaining closed client files.
A practical next step
Download PCC 53 and the legal sector risk assessment, set aside an afternoon, and write the first draft of your programme around the services you really offer. Then check that every current client's identity evidence is filed where your programme says it will be.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
