Risk Update March 2023

ChatGPT (‘Conversational Generative Pre-Training Transformer’) and the release of GPT-4 is dominating the news. Some firms are investing in it, and some are banning their staff from using it. Risks include breaching confidentiality, advice which is entirely plausible but wrong, copyright breaches, and breaches of data protection legislation. It has been demonstrated that it can pass the US bar exam and the Gazette reported that the previous version GPT-3 had a reasonable attempt at the Solicitors Qualifying Examination.

Links to guidance from The Council of Bars and Law Societies of Europe, newly updated Guidance on AI and data protection from the Information Commissioner’s Office (15 March 2023), and a National Cyber Security Centre blog, ChatGPT and large language models: what’s the risk? are on www.legalrisk.co.uk/News.

Firms which are considering using third party vendors of AI services will need to consider carefully the implications in relation to information security.

Extensive guidance and publications have been produced since our January Risk Update. These include guidance on Suspicious Activity Reports (SARs) from the National Crime Agency (NCA) and The Law Society, an Updated NCA guidance note: Requesting a defence from the NCA under POCA and TACT, and the NCA SARs Annual Report 2022.

The Financial Action Task Force (FATF) published a Report of the outcomes from the FATF Plenary in Paris, 22-24 February 2023, with South Africa and Nigeria added to the ‘grey list’ of jurisdictions subject to increased monitoring, Guidance on Beneficial Ownership of Legal Persons, and a report on Countering Ransomware Financing.

The Legal Sector Affinity Group (LSAG) published an Advisory Notice – Chinese underground banking and funds from China. The advisory notice states that ‘[misleading] the Chinese authorities about the reasons for a currency transfer is not a crime in the UK’, though it may cause doubts about the legitimacy of the source of funds.

The Advisory Notice goes on to advise that ‘Legal sector supervisors would not necessarily expect firms to make SARs where the only issue is that the purpose of the transaction was misrepresented to the Chinese government. We would, however, expect proper source of funds and/or wealth checks to support a decision not to submit a SAR.’

If we have a concern, it arises from our experience of investigations by the Solicitors Regulation Authority (SRA) resulting in recommendations of disciplinary action with the benefit of hindsight and reliance on guidance published after the events in question. We have assisted solicitors in this situation with the benefit of our experience of advising on AML issues over 20 years, and extensive material providing objective evidence of the standards of practice applicable in earlier years, including authoritative publications and training materials and audit of a large number of firms.

Several firms and individuals have been fined by the SRA and Solicitors Disciplinary Tribunal for failing to have a Practice Wide Risk Assessment (PWRA) and other AML breaches. We have assisted firms in preparing their PWRAs. The SRA is continuing with its inspection of firms for AML compliance.

Finally on AML – a reminder that discrepancy reporting under The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 extends to the Register of Overseas Entities at Companies House from 1 April 2023.

Links to all the above publications and the Regulations are on www.legalrisk.co.uk/News.

There are three key areas for change taking effect on 1 April 2023: a reduction in the time limits for bringing complaints, a discretion to dismiss or discontinue complaints, and a discretion to decline to issue an ombudsman decision. These necessitate changes to firms’ client care and complaints documentation. Suggested wording is contained in guidance from LeO – see the link on www.legalrisk.co.uk/News.

Client terms – Outside Counsel Guidelines, Master Letters of Engagement or similar – may contain a number of traps, and there are the risks of partners agreeing them without reference to the firm’s General Counsel or other management, or inadvertent acceptance through billing processes.

Some current issues include provisions which purport to prevent firms from complying with statutory and insurance-related breach reporting obligations, diversity and representation requirements which may breach data protection legislation, and indemnification provisions which may give rise to insurance coverage issues.

Other problems include definitions of ‘the client’, which may extend not only to (unidentified) subsidiaries and affiliates, but we have even encountered attempts to include the client’s customers. Practical problems can arise, as illustrated by a US decision in Harbour Antibodies BV v Teneobio, Inc. Civ. No. 21-1807 (MN) (D.C. Del. 2022) where a conflict arose in connection with an affiliate which was acquired a week after the firm had done its conflicts check.

The Office for the Implementation of Financial Sanctions (OFSI) has published updated guidance, OFSI enforcement and monetary penalties for breaches of financial sanctions with further explanation on ownership and control.

The Data Protection and Digital Information (No. 2) Bill was published on 8 March 2023 and aims to reform the UK’s data protection framework while retaining the UK’s adequacy status under the EU’s General Data Protection Regulation. Among the planned reforms, the draft contains a number of proposed changes relating to legitimate interests.

We have advised many firms on making block notifications to their insurers of circumstances which may give rise to claims by home-buyers arising from onerous ground rent and other leasehold provisions and on a variety of coverage issues, including dispute resolution.

Legal Futures has reported on a claim by Arrassey Properties which was dismissed by Her Honour Judge Baucher in Central London County Court, holding that the advice given was appropriate at the time (2006). While all cases will be fact-specific, the judgment (which is in fact dated 15 July 2022) may provide some comfort for many law firms and their insurers.

The SRA has applied to the Legal Services Board for approval of rule changes relating to the proposed taking over of the Solicitors Indemnity Fund.

An important decision in Baxter v Doble [2023] EWHC 486 (KB) casts the net widely on the question of what constitutes ‘conduct of litigation’ for the purposes of Schedule 2 of the Legal Services Act 2007. The case involved a person who was not qualified as a lawyer assisting a landlord as a litigant in person through her company. A link to the judgment is on www.legalrisk.co.uk/News.

We have advised many firms on issues relating to reserved legal activities, including in the context of outsourcing arrangements.

The SRA has applied to the Legal Services Board for approval of changes to regulatory arrangements in respect of the SRA’s disciplinary and financial penalty processes, including provision for hearings which have been rare in the past, but may become more com-mon with the increase in fining powers (now £25,000 for recognised bodies).

The paper also refers to matters which are outside the scope of the application but contextually important – in any case involving sexual misconduct, discrimination or any form of harassment, a financial penalty will only be considered in exceptional circumstances, a 5 per cent cap for fines based on domestic turnover, and a pilot on personal impact statements in relation to sexual misconduct, discrimination and harassment cases.

We advise many firms and individuals facing investigation by the SRA and disciplinary proceedings.