This Practice Note explains the regulatory requirement to identify and assess organisation-wide risks as set out in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), SI 2017/692, as amended. It provides guidance that is of general application. You should check whether the MLR 2017 contain additional or varied requirements for your sector and whether your regulatory body has any additional, sector-specific requirements in relation to risk assessment. The MLR 2017 do not prescribe any methodolgy and there is no single mandatory format. You should ensure you are thorough. Look at what you do and what you do not do. But no matter how thorough your risk assessment or how appropriate your controls, some criminals may still succeed in exploiting your organisation for criminal purposes. A comprehensive and documented organisation-wide risk assessment, combined with written records of decisions made on individual customers and transactions will help you to justify your decisions and actions to law enforcement agencies

Lawyers generally have a reputation among business people for being risk averse. In-house and compliance lawyers cannot be excessively risk averse—they have to embrace risk, know how to identify it and act appropriately. If not, they will become an unnecessary obstruction in their organisation, stopping legitimate business initiatives and alienating themselves from their business colleagues. In-house lawyers and compliance professionals work with legal and regulatory risk all the time. To add maximum value to your business, you should also participate in the assessment and management of your organisation's non-legal risks. This Practice Note provides guidance on how to identify and evaluate risk across your business. Managing risk is not a one-off event—it is an ongoing process, as illustrated below: This Practice Note covers the following stages from the lifecycle: • establish the organisation's risk appetite—see Precedent: Risk appetite statement • gather risk information from internal stakeholders—see Precedent: Risk questionnaire • review available risk information to identify risks—see Precedent: Risk audit • evaluate and record risks—see Precedent: Risk register What

Special category personal data is particularly sensitive or private and therefore merits special protection. Special category personal data is closely linked with: • freedom of thought, conscience and religion • freedom of expression • freedom of assembly and association • the right to bodily integrity • the right to respect for private and family life, or • freedom from discrimination There is a presumption that special category personal data should be treated with greater care because collecting and using it is more likely to interfere with these fundamental rights or open someone up to discrimination. This Practice Note assumes an understanding of what personal data is. It explains what constitutes special category personal data and provides practical guidance on when and how you can process it. This Practice Note does not cover criminal offence data, to which separate rules apply. This is most likely to be relevant to private sector commercial organisations in the employment relationship—see Practice Note: Criminal offence data—employment data protection issues. There is also separate

Solicitors and law firms often provide legal services to clients who are going through some of the most difficult times in their lives. Some of these clients may be vulnerable and it is essential that they are able to exercise their rights. This Practice Note aims to help firms identify vulnerable clients and explains how best to respond to their particular attributes, needs and circumstances. Practice Note: Vulnerable clients—regulatory requirements sets out the regulatory requirements that apply in relation to vulnerable clients under the: • SRA Standards and Regulations, supplemented by SRA guidance • Equality Act 2010 • Mental Capacity Act 2005 • data protection regime This Practice Note provides guidance on adult vulnerable clients. It does not provide specific guidance in relation to minors. Helping vulnerable people to understand their legal problems and access justice effectively is of huge benefit in terms of upholding the rule of law and protecting the public. There are also benefits for firms and consumers, including: • supporting the safety and wellbeing

Commissions constitute the giving of a financial advantage. Not all commissions will be bribes. The most common occurrence of a commission is where an advantage is paid by a seller or purchaser to a third party or fiduciary for facilitating or brokering the sale of goods or services. They are accepted practice in several sectors, but an expected advantage can give rise to the real risk of improper performance of functions. Commissions may be facilitation payments, where they are paid for the performance (or faster performance) of an existing duty (see Practice Note: Facilitation payments under the Bribery Act 2010). If a commission is a facilitation payment, it will be unlawful. The Serious Fraud Office (SFO) has said it will prosecute where the Code for Crown Prosecutors, Full Code Test is met; that is to say there is a realistic prospect of conviction on the evidence, and it is in the public interest to do so. In cases where prosecution is not appropriate, the SFO may still use powers

Offset arrangements arise where an additional investment, payment or other industrial, commercial or economic benefit is offered or required as a condition of an organisation’s tender, normally as part of a public procurement contract. Such arrangements, common in the aerospace and defence industries, may also be called offset agreements, industrial benefit, industrial participation, industrial co-operation, juste retour or counter-trade. An offset arrangement is usually required by purchasing states to compensate high procurement costs, or to enable countries to gain access to advanced technologies or jobs. Many jurisdictions incorporate offset arrangements into their evaluation criteria for bids and give significant weight thereto. Types of offset arrangement—direct or indirect Direct offset A direct offset is where the offset is directly related to the underlying contract, such as the manufacture of a component in the purchasing territory. Indirect offset Indirect offset arises where the supplier or its government is required to purchase or invest in subject-matter unrelated to the underlying agreement. This may be within the same sector or something

This is a practical step-by-step ‘how to’ guide for a UK private company to implement a growth share arrangement over its shares for key employees. For more detailed information on certain of the steps involved, see Practice Note: Practical steps involved in implementing growth shares. 1. Confirm that growth shares are appropriate First, consider whether growth shares are appropriate for the company and its commercial objectives. Check in particular: • whether a statutory tax-advantaged alternative structure—such as enterprise management incentive (EMI) or company share option plan (CSOP) options—would be preferable • whether the company has realistic potential for material future growth • whether an exit, IPO or other liquidity event is expected • whether the existing shareholder base and capital structure can accommodate a new class of shares For more information on the relevant considerations, see Practice Note: Growth shares (value shares). For a comparison of growth share arrangements with a share option scheme structure, see Practice Note: Growth shares—practical examples and comparisons with options. 2. Agree the commercial structure As

Complaints are a business risk that cannot be avoided completely. It is an SRA regulatory requirement to have a complaints handling procedure, but it also makes business sense that they be handled and managed effectively. There are two key components to an effective complaints procedure: • an external client-facing complaints policy—see Precedent: External complaints policy—law firms • an internal complaints handling procedure through which complaints can be received, recorded, investigated and resolved—see Precedent: Internal complaints handling procedure—law firms This Practice Note is a How-to guide providing practical guidance on implementing and maintaining internal complaints handling procedures for law firms, including governance, recording, signposting, training, monitoring and review. It focuses on the systems, roles and processes firms must have in place to comply with regulatory requirements and support effective complaints handling. See Practice Note: Complaints—law firms. There are separate How-to-guides covering: • How to handle a complaint step by step—law firms • How to manage complaints raising additional considerations—law firms • How to handle a complaint referred to the Legal Ombudsman—law firms Key

EU analysis: Frauke Tepe and Lucas Mayr of Osborne Clarke consider the anticipated EU AI Act in relation to contracts concerning the development and licensing of AI systems. It is now a certainty: the European law on artificial intelligence, the EU AI Act, is coming. With the announcement of an agreement in the trilogue negotiations on 8 December 2023, it is likely that the EU AI Act will be passed before the end of the legislative period and the European elections in June 2024. Although the exact content of the AI Act is not yet known, the drafts of the European Commission and Council of the EU as well as information regarding the agreement have become available via parliamentary representatives—and there already is a great need for action when concluding contracts on AI systems.

Organisations often overlook data protection by design and default (DPbDD) when they are considering their UK GDPR compliance obligations. This is understandable, as DPbDD is an intangible, all-pervading concept that can be difficult to translate into specific actions, particularly compared to other discrete requirements of the UK GDPR. However, there is a dedicated section in the UK GDPR about DPbDD (Article 25) and extensive guidance published by the Information Commission’s Office (ICO): ICO, UK GDPR guidance and resources, Data protection by design and default. In essence, DPbDD involves considering data protection and privacy issues upfront in everything you do. This means you have to integrate data protection into your processing activities and business practices, from the design stage right through the lifecycle. Following a DPbDD approach from the start, rather than the end: • will help you comply with many other parts of the UK GDPR—see UK GDPR requirements • can reduce longer-term costs by preventing the need for future large-scale redesigns when data protection issues arise • can

The legal industry is undergoing a rapid transformation, with technology playing a pivotal role in reshaping how legal services are delivered. As discussed in Practice Note: Legal tech—why is it important to in-house lawyers and how to build the team of the future, legal tech refers to tools and solutions which can support legal professionals in their work, or directly deliver legal services to an end-user. With advancements in artificial intelligence (AI), machine learning, and natural language processing, the potential for legal tech to enhance efficiency, accuracy, and strategic value is greater than ever before. However, simply adopting legal tech is not enough. For in-house legal teams to truly harness its power, careful planning and thoughtful implementation are essential. It is not just about adopting new software or automation tools, it is about integrating these technologies in a way that aligns with the broader goals of the business and the legal team’s role within it. To successfully implement legal tech, legal teams must not

What are the statutory time limits for implementing planning permission? Planning permissions do not last forever. Sections 91 and 92 of the Town and Country Planning Act 1990 (TCPA 1990) require that every planning permission must contain a planning condition limiting the time within which the permission can be implemented. Local planning authorities (LPAs) have discretion under TCPA 1990, ss 91 and 92 to grant planning permission for such periods as they consider appropriate. The usual position is that: • in the case of a full planning permission, development must be commenced within three years (in England) or five years (in Wales) of the grant of permission, unless a planning condition states otherwise • in the case of an outline planning permission relating to land in England, any application for the approval of a reserved matter must be made not later than the expiration of three years beginning with the date of the grant of outline planning permission and the development to which the permission relates must be begun not later than the expiration of two years from the