ADM Investor Services FCA Final Notice: £6.47 Million AML Systems and Controls Fine

Some AML failings are not new. They are old policies, old risk assessments and old warnings that nobody acted on. In September 2023 the Financial Conduct Authority (FCA) issued a final notice fining ADM Investor Services International Limited (ADMISI), a London multi-asset brokerage, £6,470,600 for failing to have adequate anti-money laundering (AML) systems and controls between 30 September 2014 and 31 October 2016. The FCA announced the fine on 2 October 2023. It is still one of the clearest FCA notices on the basics: a business-wide risk assessment, a customer risk assessment that actually discriminates between customers, proper handling of politically exposed persons (PEPs), and a money laundering reporting officer (MLRO) whose reports tell the board something. To build your own AML knowledge, see our CPD courses.

This guide is based on the FCA's final notice dated 29 September 2023 and its press release. We read them through a summarising tool, so check every figure against the notice before you quote it.

The firm and its risk profile

ADMISI is a full-service multi-asset brokerage covering markets such as energy, base metals, foreign exchange, cocoa and grains, and it offers contracts for difference (CFDs). As at May 2016 the notice records 1,238 open corporate accounts and 1,034 open individual accounts, with clients from more than 70 jurisdictions. It had 41 clients classed as PEPs and 37 open accounts linked to countries on its own "Jurisdiction Red List". During the relevant period 32% of the firm's gross profit came from high-risk clients. That profile matters: a firm with a high share of higher-risk clients needs stronger controls, not weaker ones.

The penalty

The FCA imposed a penalty under section 206 of the Financial Services and Markets Act 2000. Before a 30% settlement discount for early agreement it would have been £9,243,738. The FCA found a single breach, of Principle 3, which requires a firm to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems. It said the firm failed to meet its obligations under the systems and controls rules (SYSC 6.1.1R and 6.3.1R) and the Money Laundering Regulations 2007. The FCA treated the breach as negligent and noted that it continued for over two years after the FCA had raised concerns.

The ten failings the FCA lists

1. No firm-wide risk assessment. ADMISI completed a business-wide financial crime risk assessment only in July 2016.
2. Outdated policies. AML policies did not meet the regulations or FCA rules, referred to the 1993 Regulations, and were largely unchanged for about 13 years.
3. A too-simple customer risk assessment. It did not cover jurisdiction, product, activity or corporate structure, and allowed PEPs to be rated "medium risk".
4. Not applied to older clients. The customer risk assessment was not applied to clients onboarded before November 2014.
5. No enhanced due diligence procedure for PEPs, and inaccurate PEP records.
6. Weak ongoing monitoring of due diligence information. About 3,500 know-your-customer review cases were open in March 2016.
7. Inadequate enhanced due diligence and monitoring for some high-risk clients.
8. MLRO reports that did not identify weaknesses in AML controls.
9. Poor training records.
10. An internal audit function that missed the failings and rated them in a misleading way.

Our guide to the CB Payments final notice shows the same pattern of onboarding high-risk customers without strong enough controls, and our Monzo case study shows how the FCA treats repeated failings.

A history of warnings

The notice sets out a long timeline. In February and March 2014 the FCA carried out a periodic assessment of AML controls, and on 16 April 2014 it sent written feedback identifying weaknesses. On 30 September 2014 ADMISI attested that its remediation was complete. It was then required to complete a risk mitigation programme, submitting a revised risk management framework in March 2015. After an AML visit in May 2016 the FCA wrote in June 2016 describing significant failings. On 23 August 2016 ADMISI entered a voluntary requirement that barred new business with PEPs, clients in 97 listed high-risk countries and clients rated high risk, while allowing existing clients in 24 of those countries to continue subject to enhanced due diligence reviews. The requirement was lifted after the relevant period.

How the FCA set the figure

The FCA used relevant revenue of £112,045,314 and assessed the breach at seriousness level 4, which applies 15% of relevant revenue and gives £16,806,797. The firm argued that its business was lower risk than retail banking and that exchange and clearing fees of £35,796,926 should be excluded from revenue. The FCA rejected both arguments, saying the weaknesses were firm-wide and persistent. It halved the figure for proportionality to £8,403,398 and then increased it by 10% for the previous warnings, reaching £9,243,738. There was no financial benefit to remove and no mitigating factor identified. The 30% discount produced the final £6,470,600.

Remediation and cooperation

ADMISI retained external compliance consultants, redrafted its AML policies in October 2016 (which the FCA found adequate), and outsourced its regulatory internal audit to a third party in 2017, with reviews every six months. The FCA acknowledged the remedial action, described the failings as historic and noted the firm cooperated. The notice makes no criticism of anyone other than the firm.

Practical lessons

• Do a business-wide risk assessment first. Everything else, including customer risk ratings, hangs from it.
• Make risk ratings discriminate. A model that lets PEPs be rated medium risk is not doing its job.
• Refresh policies when the law changes. Policies that still refer to 1993 rules are a red flag in themselves.
• Apply new standards to the back book. Existing clients need the same review as new ones.
• Make MLRO and audit reports useful. They should tell the board what is wrong.
• Treat a regulator's feedback as a deadline. The FCA added 10% to the figure because the firm had been warned.

Frequently asked questions

How much was ADMISI fined?

£6,470,600, after a 30% early settlement discount from £9,243,738.

Which period did the notice cover?

30 September 2014 to 31 October 2016.

Why does a 2023 notice cover 2014 to 2016?

FCA investigations and enforcement can take years. The FCA can still act on past failings, and published notices stay useful as case studies.

What we could not confirm

We read the FCA notice and press release through a summarising tool. The notice contains two different dates for the FCA's June 2016 letter, and the text we read does not describe events after 2018. Please check all figures against the notice.