A wealth management firm has neither a compliance department nor a dedicated compliance function. Yet it is subject to the same substantive obligations as organizations a hundred times its size. The question, therefore, is not whether the framework applies, but how to tailor it so that it integrates into the firm’s actual operations without becoming a mere formality on paper.
The system must be tailored to available resources while remaining in compliance with regulatory requirements. A concise, written system that is actually implemented is more robust in the event of an audit than extensive documentation that is disconnected from actual practice.
What doesn't depend on the size of the firm
Proportionality applies to the organization, resources, and level of formalization of the system, based in particular on the nature and volume of activities, the client profile, and the risks to which the professional is exposed. It does not call into question the existence of the applicable obligations.
The obligations set forth at AML-CFT that apply to a wealth management firm depend on the regulatory status under which it operates. When it acts as a financial investment advisor or under another status that falls within the scope of regulated entities, it must comply with the corresponding obligations at AML-CFT .
What Proportionality Really Means
Proportionality relates to the administrative burden. A firm may summarize its risk mapping in two pages, while a bank may produce fifty. It may formalize its due diligence procedures in a single document, whereas a financial institution maintains a comprehensive set of guidelines.
The principle of proportionality does not allow for the elimination of any of these components. Rather, it allows for adjusting their scope and complexity based on the volume of transactions, the nature of the operations, and the available resources. A five-person firm without a compliance department can thus tailor its compliance framework to its specific structure.
However, it cannot be reduced to a collection of unclassified documents or to a policy based on principles with no evidence of implementation. The chosen organizational structure must always make it possible to demonstrate that the required due diligence has actually been performed.
Determining the Level of Risk Classification
Risk mapping AML-CFT is a legal requirement under the Monetary and Financial Code. It must identify the vulnerabilities specific to the firm’s operations, classify them according to their severity, and justify the measures taken in response. It is not merely a standard table filled out once and for all; rather, it provides the framework that guides every decision related to vigilance.
Key Areas of Focus for a Law Firm
A mapping strategy tailored to a wealth management firm can be structured around three key areas: clientele, products and services offered, and geographic regions. A client residing in France, whose assets are held in France and whose financial situation is straightforward, has a low-risk profile.
A client who is a tax resident abroad, whose assets are spread across multiple jurisdictions, and who holds an elected office or an executive position requires heightened vigilance. The risk assessment framework does not cover every possible scenario; rather, it establishes the criteria for classifying such cases on a case-by-case basis.
Products and services are also included in the analysis. A euro-denominated life insurance policy held for twenty years has a different profile than a large unit-of-account premium followed by a rapid surrender. The analysis identifies when a transaction deviates from normal practice and warrants further review.
The update and its log
The mapping must be reviewed regularly and updated whenever significant changes in business activity, clientele, risks, or the applicable regulatory framework warrant it. Different versions must allow for tracking of updates made. During an audit, a firm that produces a risk map dated within the current year, consistent with its actual business activities, and showing evidence of a review demonstrates a sound system. This is not the case for a document that has remained unchanged for three years and contains no mention of a review.
Screening: the point where the manual falls short
Screening involves verifying that a customer or beneficial owner is not listed on any international sanctions or embargo lists or as a politically exposed person. This requirement applies from the outset of the business relationship and continues for its entire duration.
The Initial Inquiry
Manually checking a sanctions list when establishing a business relationship is still feasible, since the public lists are accessible. The Council of the European Union publishes the restrictive measures currently in force, the Ministry of Economy maintains a dedicated portal, and the FATF publishes its lists of high-risk jurisdictions.
A law firm can consult these sources on a case-by-case basis, keep a record of the verification, and file the results in the client’s case file. The problem lies not in the initial inquiry, but in the follow-up over time.
Tracking Updates
Sanctions lists and lists of politically exposed persons are continuously updated. A person who is not on a list in January may appear on it in March, while a country may be subject to a new restrictive measure at any time. The duty of diligence is therefore not limited to a check conducted at the outset of a business relationship. The diligence exercised throughout the business relationship must take into account relevant developments that could affect a customer’s status or risk level. For a large portfolio, automation can facilitate this monitoring and ensure its traceability.
At this point, manual processing becomes untenable. Re-examining several hundred relationships every time a list is updated, documenting each verification, and archiving each negative result cannot reasonably be done by hand. An otherwise sound case then becomes difficult to defend, due to the lack of a record confirming that the old portfolio was re-examined.
An automated screening solution, such as our screening and monitoring solutions, makes it possible to review the portfolio every time a list is updated, track each verification, and maintain evidence of ongoing monitoring. The cost of such a solution must be weighed against the cost that would result from a lack of traceability during an audit.
High-net-worth clients and politically exposed persons
Statistically, the client base of a wealth management advisor involves a greater number of situations requiring review than that of a credit intermediary or a distributor of retail savings products. Elected offices, executive positions, the personal circles of high-profile individuals, as well as assets held through legal structures or spread across multiple countries are common in this segment.
What " PEP " Status Triggers
The identification of a politically exposed person triggers the application of the additional due diligence measures provided for by regulations, particularly with regard to understanding the business relationship, the source of the assets and funds in question, and enhanced monitoring of the business relationship.
A firm cannot simply collect identification documents and have clients sign a standard KYC form. It must demonstrate that it has understood the client’s financial situation, verified the consistency between reported income and the amounts invested, and then maintained a record of its verifications. The issue of politically exposed persons in the fight against money laundering justifies this requirement.
Family and Friends
The definition of a politically exposed person extends to immediate family members and individuals known to be closely associated with such a person. A client may not be a “ PEP ” themselves, but may fall into this category because of their relationship with a politically exposed person. The due diligence process is therefore not limited to the direct client; it also covers “ Beneficial Owners,” agents, and beneficial owners.
Cross-Border Heritage Sites
Assets held in part abroad, a client who is a tax resident outside France, or a transaction involving funds from a third country require heightened vigilance. The firm must verify that the country of origin of the funds is not on the FATF or European Union lists, and then maintain a record of this verification.
Cross-border high-net-worth clients do not necessarily pose a high risk. However, they may present situations in which risk must be assessed on a case-by-case basis and for which simplified due diligence does not apply.
What Can't Be Delegated
A firm can rely on a platform, a consortium, or a shared back office to collect documents, perform screening, manage archiving, and produce compliance files. Our partnership dedicated to wealth management advisors illustrates this possibility for structured support. The professional may delegate certain operational tasks to a service provider or rely on a third party under the conditions set forth by regulations. However, the professional remains responsible for complying with h AML-CFT obligations and for the decisions that fall under his or her purview.
What a platform can support
A platform can support several operational functions:
- automated screening of sanctions lists and lists of politically exposed persons;
- tracking updates;
- secure archiving of supporting documents for five years;
- the preparation of compliance reports and the provision of documentation in the event of an audit;
- the provision of an input interface and alerts when a match is found in a list;
- maintaining a complete record of the audits performed.
These functions fall under the category of tools and may be outsourced. A platform may flag a match or provide the information needed to analyze it; it is up to the professional to address this alert and, when a freeze order applies, to fulfill the corresponding obligations.
What's Left for the Professional
The professional remains responsible for assessing the risk, deciding whether or not to continue the business relationship, and ensuring the ability to produce evidence during an audit. A platform may alert the professional that a client appears on a sanctions list. It cannot decide on the professional’s behalf whether to freeze the assets, refuse the business relationship, or apply enhanced due diligence and its triggers.
The professional remains subject to the obligations set forth at AML-CFT. Delegating tasks does not transfer responsibility for compliance. In the event of an audit, it is the professional—not the platform—who is responsible for justifying their decisions.
Put together a solid case for an audit
A compliance file must enable the professional to demonstrate that they have fulfilled their due diligence obligations to the competent authority or body, depending on the legal status under which they operate. It contains the following elements:
- a written and dated policy;
- a risk assessment updated at least once a year;
- proportionate vigilance procedures;
- customer profiles, along with identification documents and risk assessments;
- evidence of screening at the onset of the relationship and evidence of follow-up over time;
- proof of retention for five years.
A proportionate measure is not a minimal measure. It is a measure that is appropriate, implemented, and traceable. The True Cost of Noncompliance is measured in terms of administrative penalties, the risk of having one’s certification revoked, and a loss of credibility.
A firm that can demonstrate that it has categorized its clients, screened its portfolio, tracked updates to the lists, and retained evidence has a defensible system in place. Conversely, a firm that cannot produce any record of these due diligence measures cannot defend the robustness of its system.
Frequently Asked Questions
Is a CGP subject to the requirements of the “ AML-CFT ”?
Yes. Wealth management advisors and financial investment advisors are regulated professionals. They must identify their clients and Beneficial Owners, classify each client relationship according to a justified risk level, exercise proportionate due diligence, screen clients against sanctions lists and lists of politically exposed persons, and report any suspicions.
Does the size of the firm affect the requirements?
It changes the methods, but not the principle. Proportionality relates to the organization of the system—specifically, the length of procedures, the frequency of internal controls, and the degree of automation. It does not concern the existence of the obligations themselves. A concise, written system that is actually implemented is more robust in the event of an audit than extensive documentation that is disconnected from the firm’s actual practices.
Why do high-net-worth clients require special attention?
Statistically, it involves a greater number of situations requiring review, including elected offices, leadership positions, the associates of politically exposed persons, and assets held by entities or distributed across multiple countries. The status of a politically exposed person does not preclude any relationship. It triggers heightened vigilance, which must be documented in the file.
Can a company delegate its compliance AML-CFT to a platform or an association?
A platform, a consortium, or a shared back office may handle certain tasks, such as collecting documents, screening, and archiving. The professional remains subject to and responsible for his or her due diligence obligations. Risk assessment, the decision whether or not to continue the relationship, and the ability to produce evidence during an audit cannot be delegated.
Where does manual processing reach its limits?
Manual processing reveals its limitations during portfolio reviews. Checking a sanctions list when establishing a new business relationship is still feasible to do manually. However, keeping track of updates to these lists for several hundred existing relationships is not. A case that is otherwise sound then becomes difficult to defend, due to the lack of documentation proving that the legacy portfolio was reviewed.
