Publicity notice

Regulatory penalties for AML breaches

In terms of Regulation 5.25 of the ICAS Anti-Money Laundering Regulations (the AML Regulations), notice is given that the Authorisation Committee (the Committee) has applied regulatory penalties to nine firms for failing to comply with their statutory obligations under anti-money laundering legislation as required in terms of Regulation 4.16 of the AML Regulations. The penalties ranged from £100 to £1,500. 

The areas of non-compliance included:

• Failures in connection with the firm’s process for considering and making Suspicious Activity Reports (SARs). For example, there were delays between the date of internal reports being made to the money laundering reporting officer, and SARs being submitted to National Crime Agency.

• Failures to undertake an annual compliance review.

• Failures to adequately document the firm’s AML policies or procedures.

• Failures to conduct a whole firm risk assessment.

• A lack of adequate training of the firm’s employees.

• Failures to cooperate with ICAS. Firms are required to cooperate fully and promptly with the Committee and ICAS staff and use best endeavours to accommodate the monitoring process. 

• Failures to provide full and accurate information when completing the ICAS AML Declaration. For example, there was a failure to fully disclose high-risk client businesses.

• Failures in connection with the firm’s customer due diligence (CDD) requirements. These include failures to: (i) identify and verify all directors and business owners, officers, and managers (BOOMs), (ii) complete risk assessments for all clients, (iii) record sufficient evidence of ongoing due diligence, (iv) ensure Know Your Client information is sufficiently detailed, (v) consider the potential requirement for Enhanced Due Diligence (EDD), and (vi) adequately follow-up on risks which are identified. In two cases, a penalty was applied to the firm for a failure to apply appropriate EDD in sufficient depth for a single high-risk client.

In determining the amount of the penalties, the Committee had regard to the ICAS AML Regulatory Actions Guidance, which was revised in April 2025. As a temporary measure, during the transition to the revised Guidance, the Committee has decided that the firms should not be named when the penalties are publicised. 

Wbg (Audit Limited)  

In terms of Regulation 7.14(b) of the Audit Regulations, notice is hereby given that the ICAS Authorisation Committee has applied a regulatory penalty of £15,000 to the audit-registered firm of Wbg (Audit) Limited (Firm number 4401).

The firm has acknowledged that it:

1. failed to advise ICAS of the appointment of a principal of the firm, and to apply to ICAS for affiliate status for him, in breach of Regulation 2.03 and 2.11 of the Audit Regulations; and

2. failed to identify and respond to changes in the firm’s circumstances leading to a principal in the firm also being a company director of an audit client, in breach of Regulation 3.02, 3.04, and 3.06 of the Audit Regulations and the fundamental principle of objectivity contained in the Code of Ethics.

Darren McDonald

In terms of Regulation 5.30 of the Public Practice Regulations, notice is hereby given that the ICAS Authorisation Committee has applied a regulatory penalty of £4,100 to Darren McDonald CA, of Granite Accountants (Aberdeen) Limited, in respect that between April 2019 and December 2025 he engaged in practice without holding a practising certificate, in breach of Regulation 3 of the Public Practice Regulations.