The Thursday Redemption
On Thursday afternoon a relationship manager receives an email from a long-standing client, a UK-resident sole trader in construction, asking to redeem £380,000 and pay it to a new account at a different bank. The email comes from the address on file, uses the client's usual sign-off, and says he is 'moving banks, please action today - completion is tomorrow'. The receiving account name is 'M. Kowalski Trading Ltd'; the verified account on file is in the name 'Marek Kowalski'. The RM calls the mobile number on file, the client answers, confirms the request, and becomes irritated when asked to come in and sign a form. There has been no other activity on the account for 14 months. The RM's manager is on leave and the RM asks you to approve the payment so it goes out today.
1. What verification is required before this payment can be released, and is the returned phone call sufficient?
Read the worked answer
The phone call is necessary but not sufficient. The classic weakness is that the number itself may have been compromised - SIM swap and number porting are routine in authorised push payment fraud, and a fraudster who controls the email account may also control the phone. The call confirms someone answered; it does not confirm the caller is the client.
What is actually required:
- An independent call-back to a number from the firm's own verified records, not one supplied in the current correspondence, ideally at a time when a scripted challenge can be used (known transactions, account details last confirmed in person).
- Documentary support for the new account: a bank statement or a letter from the receiving bank, or a video/in-person verification against identity documents.
- Resolution of the name mismatch. 'M. Kowalski Trading Ltd' is a different legal person from 'Marek Kowalski'. Even if the client controls the company, the firm needs the entity's details, its ownership and control, and its relationship to the client before treating the account as verified.
- A check of the email headers for spoofing, and of the audit trail for any mailbox rule or forwarding change.
- Enhanced monitoring on the account afterwards.
On the facts, the payment should not go out today. Urgency, a change of bank details, a dormant account and a name mismatch are the standard pattern. A short delay to a genuine client is a service issue; a release to a fraudster is a loss the firm may have to reimburse.
2. Does this require a suspicious activity report, and can the firm pay while it decides?
Read the worked answer
The facts raise suspicion, so an internal report to the MLRO is mandatory and the MLRO decides whether to file with the National Crime Agency. The suspicion is built from the combination - dormancy, urgency, new payee, name mismatch, and resistance to verification - not from any single item.
Can the firm pay while it decides? Only with a lawful basis. If the firm wants to proceed while suspicion exists, it needs either appropriate consent or a defence, which in practice means a report requesting consent and waiting out the notice period. That notice period is measured in working days, not hours, so 'today' is not achievable if the firm is honest about its suspicion. Refusing or delaying the payment requires no consent.
Two prohibitions to keep separate:
- Tipping off - the firm must not tell the client or anyone else that a report has been made or is contemplated.
- But the firm may warn the client that it suspects fraud on the account. If the client is the likely victim, warning him is the right thing to do and does not disclose the report. The line is: 'we are not able to release this yet, we need to verify it with you' is fine; 'we have filed a report about you' is not.
An internal note recording the decision, the reasoning and the timing is essential, because the firm will be asked later why it did or did not act.
3. The client later gives a convincing explanation for the company name, and provides a bank statement that matches. What now?
Read the worked answer
A convincing explanation plus an independent document shifts the assessment, but it does not close the file. What to do:
- Verify the document independently - call the receiving bank's published number to confirm the account exists in that name, rather than accepting the statement as written.
- Complete customer due diligence on the entity, not just on the individual: who owns and controls the company, and whether the client is its controller. If not, the firm may be paying a third party's account with the client's money, which is a separate set of questions.
- Re-run the independent call-back using the verified number, on a different day.
- Record the rationale for proceeding, and let the MLRO decide whether the report is withdrawn or filed.
- Apply enhanced monitoring to the account for a defined period.
If any of these steps fails, the firm does not pay and offers the client a route it can control - a payment to the existing verified account, or an in-branch instruction. Being wrong in the direction of caution is recoverable; being wrong in the direction of release usually is not.