Lawyers Covered - July 2024

It can be tough for busy lawyers to find enough time to service clients, make it safely through the regulation obstacle course, win new work and keep up-to-date with developments, but we've got you covered! Welcome to the July edition of our Lawyers Liability & Regulatory Update, in which we highlight the last month's key developments affecting lawyers and the professional risks they face.

More than their fair share? Most-complained about conveyancing firms set to foot more of the Ombudsman bill

Licensed conveyancing firms which generate a greater number of complaints to the Legal Ombudsman will face increased fees, says the industry's regulator – the Council for Licensed Conveyancers (CLC).  

Unlike the SRA (whose fees are not linked to the number of complaints generated), the CLC has been charging a levy to the most complained-about firms since 2022.  Currently, 70% of the CLC's contribution to the cost of the Legal Ombudsman is met via a "service availability" fee, payable by all CLC-regulated firms.  The remaining 30% comes from a "service usage" charge, payable by firms that provoke disproportionate levels of referrals to the Legal Ombudsman.  The CLC is consulting on whether to move to a 50:50 split, shifting even more of the burden onto complaint-generating practices.  

The proposal, if it is accepted, will increase pressure on firms to handle complaints in-house to avoid referrals being made to the Legal Ombudsman.  Some may see it as unfair that the usage levy is based on the number of investigations opened by the Ombudsman, rather than the complaints which are upheld – meaning that some firms will pay more despite not being at fault.  The changes will certainly incentivise firms to get their in-house complaints procedures in order.  

It remains to be seen whether other regulators, such as the SRA, will follow suit in introducing a "polluter-pays" mechanism to their Legal Ombudsman levy.  

August start date for new SRA anti-money laundering and sanctions data requirements

From August 2024 the COLP or MLRO or MLCO or an authorised signatory of every SRA regulated firm has been asked to provide information to the SRA about the work their firm does within the scope of the Money Laundering Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, any contact or involvement the firm has with the sanctions regime and persons designated under that regime and any suspicious activity reports the firm has submitted to the National Crime Agency.  The data collected will assist the SRA to determine its programme of inspections and the guidance it produces for the profession.  The information must be submitted via a questionnaire on the SRA's electronic portal.  A specimen version of the 44 question questionnaire can be found on the SRA portal here.  All firms must submit a questionnaire even if they do not carry out any work in the subject areas.  No specific deadline for submission of the questionnaires has been given, but the request is made under Rule 3.3 of the Code of Conduct for Firms, which requires a prompt, as well as full and accurate, response. 

SRA consults the legal sector on proposed changes to their fining framework  

The SRA is conducting a consultation from the 28 June to 20 September 2024 on their proposed changes to the SRA Fining Guidance. The regulator is seeking feedback in response to the new unlimited fining powers granted under the Economic Crime and Corporate Transparency Act (ECCTA 2023). The ECCTA 2023 grants the SRA unlimited fining authority for misconduct related to economic crimes, a significant increase from their previous limit of £25,000. The SRA is now contemplating updates to the fining guidance to strengthen the deterrent effect of fines. The proposed changes include the introduction of new penalty bands which could attract fines over 25% of annual domestic turnover or in some cases global turnover. For further detail see our article here.

Increasing sophistication of gen-AI assisted deepfake fraud

It was reported earlier this year that a Hong Kong subsidiary of British engineering company Arup fell victim to a startlingly convincing deepfake fraud and lost HK$200m (£20m) as a result, making it the world's biggest known deepfake scam. The fraudsters reportedly used generative AI to create digital masks and voice emulators of the firm's CEO and financial director, which enabled the fraudsters to appear as the CEO and FD and speak with their voice on a video conference call with an unlucky employee in the firm's finance department.  The fraudsters, posing as the CEO and FD, convinced the employee to make 15 transfers, which they described as urgent and needed for a confidential transaction. Arup's chief information officer told the media that he hoped Arup's experience would help raise awareness of the increasing sophistication of cyber attacks. This latest attack came only a week after the world's biggest advertising group was targeted in an elaborate deepfake scam. Earlier this year, the Solicitors Regulation Authority warned lawyers of the risks posed by "deepfake" technology, which the SRA said could "impersonate a real person’s appearance convincingly". Similarly, Interpol's financial fraud assessment warned in March 2024 that organised crime groups are increasingly using AI, large language models and cryptocurrencies combined with phishing- and ransomware-as-a-service business models to commit more sophisticated and professional fraud campaigns at relatively little cost.

It appears that the fraudsters had video and audio clips from the real CEO and FD to create the digital masks. Companies may therefore want to consider which senior employees appear in publicly available videos and audio recordings. In addition, companies in all sectors should ensure that employees are trained on what to do in a situation where they are asked by senior members of the company to make urgent transfers.  Most companies now train employees on how to spot email phishing scams as part of their cyber security training, but the increasing sophistication and impact of generative AI may mean that many companies need to urgently overhaul their training programmes. This will come into particularly sharp focus for large corporates who will need to ensure that they have adequate measures in place to prevent fraud once the reforms under the Economic Crime and Corporate Transparency Act 2023 come into force. 

• On 2 May, 6 June and 4 July 2024, the Law Society announced that the Hong Kong Solicitors Indemnity Fund would be launching a digital platform for submission of indemnity scheme renewal documents. Phase 1 requires all law firms to submit an online application for indemnity form for 2024/25 to the scheme manager on or before 15 August 2024 using the digital platform. Phase 2 is intended to take place by the end of 2024 or in early 2025, when law firms will submit their quarterly return forms online to the scheme manager. 

• On 30 May 2024, the Law Society updated its Guidance Note on "Digitisation of Documents", following feedback on the original guidance given in September 2022. While it is not compulsory for a law firm to digitise their documents, electronic (and "Cloud") storage is increasingly the norm. The Guidance Note allows for documents received in hard copy format to be converted into electronic format provided that the electronic records are accurate copies of the originals, securely stored (whether in a "Cloud" inside or outside Hong Kong) and accessible at all times in Hong Kong in the same way as physical documents would be. 

• In April 2024, the Law Society announced that it had published a Position Paper on "The Impact of Artificial Intelligence on the Legal Profession". The paper adopts a three-phased approach; namely, inform (and educate), engage (and consult) and implement (in particular, adopt ethical standards and best practices). The Law Society has also set up a dedicated "AI Resources Hub" on the members' zone of its website and asked members (solicitors) to complete a confidential "AI Transformation in Legal Practice Survey" by 30 August 2024.

Additional Contributors: Sally Lord, Aimee Talbot and Catherine Zakarias-Welch.