Nigel Kirby gave evidence.

Thank you for joining us, Mr Kirby. We have until 10.35 am. Would you briefly introduce yourself, please?

Nigel Kirby:

Good morning to the Chair and the Committee. I am currently the head of the group financial intelligence unit at Lloyds Banking Group. Across the industry, I am a representative on UK Finance’s information and intelligence committee and, for full transparency, as part of that I was deputy director of the economic crime command of the National Crime Agency.

Q It is good to have you here, Mr Kirby. Could you give us a little flavour of the kinds of trends and patterns of economic crime that you are seeing? How are criminals behaving? Are you seeing new trends domestically and internationally?

Nigel Kirby:

Perhaps I can give a couple of the examples that we used when we were speaking with the Home Office for the formation of the Bill. In one case that involved money laundering, Lloyds identified seven customers that were receiving cash payments into their accounts. We linked those seven customers because they used the same fraudulent documentation—a gas bill—to set up their accounts. They had all been linked using fraudulent IDs. They were sending money to one individual in another bank.

At the moment, we act on such cases by meeting our statutory obligations—we exited those customers—but from the criminal’s perspective, the second bank is not aware of the fact that they are receiving those funds, because we do not have the capability to share that information with them. Secondly, it is highly likely that those seven customers moved on to other banks and continued that activity because, again, at the moment we have no capability to share the information about our economic crime concerns in that space.

That is a fairly simple example, but to build on it, the same kinds of techniques were used to launder criminal funds in another case involving three companies that were banking with us. We recognised that they were receiving cash money from the same Post Office source. They were also receiving money from other companies in banks. That money all got consolidated and was sent out to, if you like, a fifth bank. I do not know what happened to it after that—we cannot see.

Q A fifth bank domestically or internationally?

Nigel Kirby:

It was, at that particular point, a UK domestic bank, yes. We have this sort of complexity of companies that are linked using different identities and are moving money around, layering it in the system, and sending it to other parts of the system. We are currently limited in what we are able to do.

On those three companies that we at Lloyds could see were receiving money from five other banks, at the time we could not inform those banks of our concerns or explore with them whether that money was legitimate—it is not all illegitimate; it could, of course be legitimate funding. Furthermore, when that money was consolidated and sent to another bank, we were unable to inform that bank.

Whatever the predicate crime—there are all sorts of predicate crimes—the layering is not that complex but it uses the banking system, across the banking system, to obfuscate and layer the funds, and then the criminals move on. The big challenge at the moment is that we can report those entities and companies, but they will just go and open up in another high street bank, and when they have exhausted the five major high street banks, they will go to the challenger banks, and when they have exhausted those, they will go to the fintechs. We are not aware of that in the way that other industries such as the motor industry might well be.

Q That is extremely helpful. To follow up, will the measures in the Bill go far enough to enable the critical data sharing and the ability to inform other banks of what you think is important? In doing that and in going as far as you feel is needed, are appropriate safeguards in place for some things that may be legitimate finance and able to be explained by visitors or customers?

Nigel Kirby:

To take the first question first—about whether the Bill goes far enough—I commend and compliment the Home Office. It worked with us on the Bill. This piece of legislation was, fortunately, done by the Home Office but using our case examples. The Home Office explored whether the Bill would work with the scenarios we gave them. That helped the information provisions to be pretty much in the right place. There is one key omission from our perspective; I can come back to that, if helpful. There is also one key dependency in another Bill—

Q Sorry, what is the omission?

Nigel Kirby:

The omission was referred to by Nick Van Benschoten: the civil liability protection. In the UK, we have real trust and confidence built up in voluntary information sharing with the National Crime Agency under section 7 of the Crime and Courts Act 2013. That has been the basis of our voluntary sharing, and we have built confidence in it over seven years.

The legislation has two limbs to civil liability protection—I will have to read my notes to make sure I do not make a mistake. The first limb is

“an obligation of confidence owed by the person making the disclosure”— that limb is also included in this Bill. The second limb that we rely on is

“any other restriction on the disclosure of information (however imposed)”— that limb is not included in the Bill.

Our position is that the Bill should align with the existing legislation that we are comfortable with. We would have more comfort in sharing and be more incentivised to share if we had the same protections as we have when we share with the National Crime Agency. The further observation is that there is not just one precedent; another piece of legislation, the Criminal Finances Act 2017—under section 11, I think—had sharing provisions with the purpose, in effect, of bringing better disclosures to the NCA. It had exactly the same two civil liability limbs, written in the same way. We believe that the second limb would be hugely helpful in doing things.

You might want to come back, but the other dependency that is key for us is that the Bill is drafted as an interlink with the GDPR, as you well know. That is wise, and one of the protections—that it has that link with the GDPR—but because the Bill has that interlink, the provisions in the GDPR are really important. I am aware that there is a draft Bill that has not yet been laid before Parliament and, again, we—my colleagues in UK Finance—have worked on that Bill. Absolutely key for us in the draft Bill is a legitimate interest for sharing, because that Bill sets out legitimate interests.

At the moment, the GDPR cites only fraud as a legitimate interest, and no other crimes. To be able to make the measure in this Bill work, we need the revised GDPR to have the “prevention, investigation” and “detection” of crime—what the GDPR says at the moment—to be for all crime as a key part, so we can make the interlink. Otherwise, we are restricted only to fraud, but do not include wider economic crime.

Q That is really interesting. I want to pick up a little on what you said earlier about receiving banks and where fraud has been against some of your customers. The Treasury Committee, in our report into economic crime, discussed fraud on online platforms, and the level of it. I understand from speaking to some of your colleagues in the past that that has been increasing. If someone tries to buy something on Facebook but is defrauded, the bank of that person will refund them. There is no obligation on the platform to take any action, and the receiving bank of the person who has done the fraud will take no action either. Could more be done in the Bill to break those types of transactions, with fraud being perpetrated on online platforms? What is the wider impact on the banking system?

Nigel Kirby:

Your question is specifically about fraud and what we can do in that space. I suggest that tackling fraud is a shared responsibility. When you look at a typical fraud, you have the payment platform, as you mention; you have a sending bank and a receiving bank, and you have the victim. To tackle it, we need to look at the whole ecosystem, as Nick said, and have an approach that works. I am not convinced that there are things that one can put into the Bill for that—it is the wider point of the whole ecosystem coming together for any fraud strategy moving forward, how we tackle that and how we incentivise the right behaviours for tackling fraud in future.

Q Would a wider “failure to prevent economic crime” obligation be useful in that regard?

Nigel Kirby:

When looking at enacting new legislation, I would go back to the purpose. Putting my NCA hat on, rather than from a Lloyds perspective, I was involved in two pieces of quite significant legislative change: the introduction of asset forfeiture orders in the Global Finance Act, and the change in the sanctions penalty from two years to seven years. That was done very much on an operational need basis. As an organisation, we were able to put out the operational perspective of the gap—the fact that we could not use certain powers because, in the sanctions case, of the length of the sentence. There was a big gap in the ability to seize assets from a civil regime.

In whatever we look at, it is important that we understand that gap from an operational perspective. It is clear and compelling that by having new legislation, that gap gets filled. The other point is that there is the resource and the ability to use the legislation when it comes forward.

Q Finally, do you have any comments on the changes being made to the suspicious activity report regime in the Bill?

Nigel Kirby:

I would leave those to UK Finance; it is not my area of expertise. Our nominated office in Lloyds feeds into UK Finance so we get the whole industry.

Q I want to come back to the issue of GDPR, if I may. The whole ethos sitting behind the GDPR legislation is to defend the subject that the information is about. As you just highlighted, that feels really incompatible with having information sharing for the purposes of combating crime. I just want a better feel from you of how much of a barrier that will be. Is it a barrier or is it tying our hands behind our back to use the issues in the Bill? How much more do we have to challenge the ethos behind GDPR for us to build a system that is fit for purpose?

Nigel Kirby:

I can link this to your question on safeguards. Coming from a law enforcement background, I believe that safeguards for members of the public are really important in this space, and I am used to following those. GDPR does not stop us from doing some things. It provides a set of safeguards for what we do.

When you look at what the Bill does on safeguards—I am trying to answer both questions—it makes it very clear that we share this information when certain conditions apply, such as exit or restriction, or we need the relevant actions, which would be the prevention and detection investigations for economic crime. Those safeguards are built into the Economic Crime and Corporate Transparency Bill.

In GDPR you already have safeguards in place. The first safeguard is: do we have a legitimate interest to share? That is precisely my point, Minister, about our needing to have legitimate interests to share—prevent all crime, not just fraud. Then you have a necessity limb to this. Is what we want to share targeted? Is it proportionate? Is there a less intrusive way? From a law enforcement perspective, we look at whether our actions are proportionate and collateral intrusion. There is a balancing act sitting there as a third limb, on ensuring that the legitimate interest of the public is not unduly overridden. I actually support the fact that there are safeguards in GDPR; I think that is the right thing to have. I support the fact that we need to meet those to be able to share information, but in doing so in that particular space, we need to be able to have sufficient breadth to be able to share across all economic crime and not just fraud.

Q That is very helpful. It feels to me that we have got to a position with GDPR where the practical implementation has gone beyond that safeguarding, actually, but we could tackle this by, perhaps, a much fuller statement and guidance about how we expect people to respect the protections but also the obligations that exist in terms of tackling crime.

Nigel Kirby:

I think it would be very helpful to have, on the obligations, clear guidance from somewhere like the Information Commissioner’s Office—it has got good guidance, to be fair—as we move through this. Should the Bill be enacted and become legislation, guidance across the industry and from the relevant Government sectors or law enforcement sectors on how we do this and come together in the same way as we came together through the Bill, would be important and give clarity, because, as I am sure you are aware, Minister, there are different interpretations of things, different views and different risk appetites. That is normal in business. The views, legal interpretations and risk appetites will always be different, but where there is guidance to help us through this, with a positive intent from Parliament, that is always really helpful.

Q That has been really helpful on the information. I think that a slight Amendment to what we are doing would help the GDPR issue.

I want to take you back—I could not quite hear what you said to Alison—to the SARs regime, if I may. It may not be your area of expertise, but it is a very important instrument for informing the enforcement agencies of where there may be a problem. The system is clearly broken—hundreds of thousands of SARs are landing on the desks of enforcement agencies. And we had the idea that they could be put into categories—risk categorised. I wonder whether you are able to comment on that at all, because if currently there is just a tick box—you send off your SARs and you have done it—too often the banks then carry on doing business with a suspicious person. Is there room in the Bill for doing something more on that regime, to ensure that the enforcement agencies are more effective in rooting out economic crime?

Nigel Kirby:

I think the SARs regime and the Proceeds of Crime Act 2002 itself actually need—well, not necessarily to be turned upside down, but to be looked at as a whole. I think an individual focus just on some aspect of SARs probably would not change the system in any particular—

Q So you think SARs are okay.

Nigel Kirby:

Just to be very clear, I am here from Lloyds Banking Group; I will answer this question from my former role at the NCA—from that perspective. SARs do have huge value in what they do; the idea that they just go to a box and are not used is not entirely correct. One of the things the UK has done with SARs, which is world leading and others are quite jealous of, is that they are accessible to a wide range of investigators. It is not about following each one up. There is a database. A wide range of financial investigators can see them and they are held there for six years, as legislation allows. So there is a huge use there.

Also, Dame Margaret, we need to think about this. There is the SARs regime and there is the SARs reform work that is being led; investment is going to be put forward there. I would suggest that we need to see what differences the SARs reform makes first.

Q Okay, I hear that. I have one final thing to ask. Looking at your background, I see that you have spent a lot of time in the public enforcement realm. From that experience, and looking at the Bill today, do you think that there are any glaring gaps that we ought to be reflecting on?

Nigel Kirby:

Reflecting back and particularly focusing on this area, as I am sure you do, we need to build and are building on the public-private relationships we have had. One Member mentioned Singapore and Holland, but actually, from the perspective of a private-public partnership, how we operate together and particularly the joint money laundering intelligence taskforce, we are seen as world-leading in that space. There is something there about building on that as we move forward and bringing in other sectors, which I know the NCA does. In this particular space, the enablers, as they are sometimes referred to—the telcos, the ISPs, the social media companies—being brought into that public-private partnership and building on what we have is important.

The Bill brings forward private-private relationships, and I think that is important. Hitherto, the information-sharing provisions have all relied on the NCA gateways. There is a throttle there, in terms of capacity. Widening that out so that private-private can share and be the frontline, in many ways, to help to prevent and detect is an important way forward.

Broadening out, there are a couple of elements in the legislation that we need to look at. For us, one is about friction in the system. We have a very quick payment system in the UK; when you pay, you press the button and off it goes. That is something we have got used to as a public and as a banking industry. It is unhelpful when you are looking to put legitimate targeted friction into a system to temporarily stop what I will call economic crime, because it is not just fraud, although it includes that.

Q So crypto is a bad thing, is it? It goes very quick. There is no friction.

Nigel Kirby:

Respectfully, I think that is a different question.

You asked me to put my other hat on, Dame Margaret. Looking at the scale of fraud—you know, you have got it here; you are familiar with it—and the number of victims and the cost to the UK, it is time for the UK and those with the power to do so to either think about fraud as a strategic policing requirement or, going even further, ask whether it is now a national security threat. I do not just mean with that label—that is really important. You can put a label on these things, but if it could be classed as a national security threat and have the available resources brought together from our national agencies and national policing, that might have a greater impact for the public.

Q Thank you, Mr Kirby. You have used terms such as “world-leading” and spoken quite positively about what is happening in the UK. I have to say, as an interested observer, it does not look like that to me. London has generally become known as the laundromat for dirty money, particularly from Russian oligarchs and others. Money laundering prosecutions have dropped by 35% over the past five years in the UK. In March 2022, the budget of the NCA’s international corruption unit was cut by 13.5% to £4.3 million, leaving corruption investigators massively outgunned by the oligarchs.

I have two questions. First, I am trying to understand why you have this sense of optimism, because it looks like a pretty dire situation to me. Our enforcement agencies have been starved of the resources and capabilities they need. Secondly, you have had a long career in the NCA and in enforcement; I am sure you are still in touch with some of your former colleagues. If you had to define the resources they need, what extra would they need to be able to turn this situation around? It would be great to hear from you on that.

Nigel Kirby:

For clarity, I used “world-leading” specifically in reference to private-public partnerships and what we are doing for voluntary information sharing. Look at the joint money laundering intelligence taskforce and the facts in that space: it has supported 950 investigations that have led directly to 280 arrests, with £86 million secured. There are some hard figures around here that are different. When I was in law enforcement, we had law enforcement from other countries coming to ask how we did it, including Singapore and Holland. I am in the private sector now, and we have private sector colleagues coming to ask us how do we do that part. That is just a part of the ecosystem that is important—

Point taken.

Nigel Kirby:

If I misled you or you took it that way, that was not intended.

On your question about if I were still there, I am sure that Graeme Biggar, the DG of NCA, will have plans for what that could look like. When I was there, we certainly put forward evidence-based propositions such as, “If there were x amount of funding, these are the extra capabilities we could bring and this is the impact we believe it could have.” I am afraid my contacts are not close enough now to know the detail of that.

Q Very diplomatically put. Would you agree that the Bill will not be worth the paper it is written on if the enforcement agencies are not properly resourced to do the job?

Nigel Kirby:

I fully agree that we need enforcement to be properly resourced with the right capabilities to be able to deliver what it is asked to do.

Q Just to crystallise this, in your first answer, you described quite a simple layering exercise of money moving through five different banks, and you said that was a difficult problem to stop. Does this Bill help us stop that problem that you just described?

Nigel Kirby:

Well, it does not stop that in the UK because our financial system launderers are in there, but what we can do is to prevent them from continuing to abuse the financial system. Take the example I gave with the five other banks—four were sending money—that were involved with Lloyds. The Bill will allow us to have a conversation with the four banks that were sending money into our companies, and to say “In relation to our responsibility for understanding due diligence, money laundering and so on, can we share information on those four companies so we can better understand those flows from those companies?” That is important, because some of them may have been legitimate and some may have been illegitimate, but that will help us to define the good from the bad in that particular space. It will also act as an alert trigger for those other four banks to have a look if they have not done so already.

An intelligence-led approach would say, “Lloyds has a concern about these four companies” and it could look further into the matter and do an investigation into its own relationship with its customer. The other element on all that money that came through to us—it was in the millions—that went out to a fifth bank, which I will call bank F, is that we could alert that bank about our money laundering concerns, provided we had exited those three companies, which we did. If that bank had not already picked it up with its transaction monitoring, it would have an intelligence-led trigger to be able to do its own investigations, and to stop that and report it to the authorities.

The final and important part of this is the indirect part—we call it the utility. The ability to better share this information for others is important because. If all those companies were exited out of the financial system by the five banks involved, it is highly likely that they would go on and open up accounts with other banks. This Bill gives us the opportunity to be alerted to that and to take the appropriate action and due diligence that we need.

Q The second problem that is often described by banks to me is that they have to spread their compliance resource very thinly across a large customer base, rather than focusing it on a smaller group where they suspect there is more harm at work. Is that a scenario you recognise, and does this Bill help you focus compliance resource on the potential high-harm customers who we should be worried about?

Nigel Kirby:

It is an important point in terms of focusing on risk. We are having a conversation at the moment in industry with law enforcement and a regulator about how we can define where the high priorities are and how we can focus our resources on them, while meeting regulatory requirements and the law enforcement perspective. It would be helpful—we refer to it as dial up, down down—in terms of resource to be able to move to a space where our voluntary discretionary resource could be targeted in exactly the way you suggest, because there is a lot of voluntary discretionary resource in this space.

Q But this Bill does not help you in that squaring of the circle.

Nigel Kirby:

Not in the sense of prioritising what the highest threats are and where we should be. That is to the best of my knowledge. Just for clarity, I am not familiar with every aspect of the Bill.

We have literally one minute.

Q I have a question about automatic strike-off procedures for companies that may have bank accounts with you and where that company may have been involved in economic crime and then is automatically struck off. Do you have concerns about that process and whether there should be reform?

Nigel Kirby:

I think, with respect, that “automatic strike-off procedures” are your words, not mine. I used the fact of us taking an approach and considering whether to exit—that might be a similar thing—a customer. We take this really seriously. We look to understand whether we have economic crime concerns about those consumers. There is a range of things that we can do in that space. The ultimate one is about exit. We would exit that relationship, which is contractual, so we are able to do that. But there are other things that we do, and one is actually to speak to the customer and understand that transaction. We see some unusual transactions, but we have a conversation.

It is more about Companies House automatic strike-off—but they might be your customers.

Order. I am terribly sorry; we do have to leave it there. I must cut it off on the dot. Mr Kirby, thank you very much for joining us.