Why are law firms so weird? Or at least when it comes to KYC...

Admittedly, the first time I spent time with compliance people from a law firm, I walked out frustrated. It was as if they had not understood anything related to basic AML and KYC processes and procedures.

After my second meeting, I realized that I was the one who did not understand.

Even more importantly, there are things that everyone can learn from this - especially if they work in a fund or asset manager.

The big difference between Know Your Customer (KYC) performed in, e.g., a bank and a law firm, is the customer/client perspective versus the case perspective. In a law firm, it's all about the case.

Here are a few examples of how to think if you perform KYC in a law firm:

➡️ In a law firm, you don't have a client if the client doesn't have any active cases. The case (e.g., a lawyer advising the client) is the product, and when there is no case, there is no product. Compare this to a bank customer who continuously has live products such as accounts and investments.

➡️ This means clients can be “on pause” until the next case starts. Once a case starts, you must check if you have KYC on the client. If it is a repeat client (very likely), you just need to check if it's up to date and mark the client “AML OK”. If it's been a while, you may need to reach out to the client and get updated information. Sanctions, PEP, and adverse media screening must be updated in case you don't have monitoring on.

➡️ A case can consist of several clients, opposing counterparties in the case, banks, other law firms, etc. Thereby, the case becomes a “project” where you must secure that each party, including their related parties (UBOs, directors, etc.), have proper KYC and screening status. Some parties need full KYC, others you can't get KYC on (e.g., the opposing counterparty), but you must ensure their sanctions status is ok.

➡️ The risk scoring will blow your mind. Each client will have a risk score, but it's connected to the last case. The risk scoring of the case is critical, as this drives the KYC you need to perform on each client. Therefore, the case most often impacts the client's risk score rather than vice versa. However, a PEP status in a client or related party can reverse impact the risk score of the case.

➡️ Time-stamped documentation of the KYC, the screening status, the risk level, and the overall comments of the clients and the case must be in place during multiple time points of the case. You need to know and document what you had available when starting the case, but also be able to take new “snapshots” of the files if the case changes.

To support this, you need some pretty advanced technology.

Funds and asset managers could learn a lot, as they have the same problem when they work with investment projects, where you have investors, co-investors, banks, the target company or asset, subcontractors, etc.

‍

***************

WANT MORE? SOME RELATED KYC ARTICLES

The Importance of KYC and Screening for Law Firms

Learnings after watching "Den Sorte Svane" (The Black Swan)

The Global Impact of the Danish Documentary "Den Sorte Svane" on the Compliance Industry

KYC Is Outdated. It’s Time for Know-Your-Counterparty (KYCp)

Initial Thoughts on the June 2024 AML/CFT legislative package in its Official Journal

‍

‍