Judgment — ECLI:EU:C:2016:154
Date: 2016-03-10
Language of the case: Spanish
Court formation: Fifth Chamber
Subject matter: Right of establishment;Free movement of capital;Internal market - Principles;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling;Reference for a preliminary ruling - inadmissible
Origin: Spain

summary, provisions such as Articles 8 or 13 of the Money Laundering Directive leave Member States a significant degree of freedom, in implementing that directive, in precisely how they give effect to the obligations to provide for different types of due diligence, depending on the circumstances at issue and in accordance with their overarching obligations to evaluate risk and to put into place laws that require measures to be applied which are commensurate with the identified risk and which comply with other applicable obligations under EU law. Article 5 then provides for a further margin of freedom as it permits Member States to adopt or retain ‘stricter provisions’ where they deem them necessary, provided that in so doing they respect their obligations under EU law. May credit institutions supervise the customer due diligence measures adopted by payment institutions (Questions 2(a) and 2(c)(ii))? 100. In Question 2(a), the referring court seeks guidance as to the supervision powers of credit institutions, under the Money Laundering Directive and the Payment Services Directive, in relation to the operations and due diligence procedures and measures of payment institutions who are their customers. Question 2(c)(ii), which is closely related, asks whether a credit institution may assess the due diligence measures applied by a payment institution. 101. I understand these questions to be based on the assumption that Safe’s accounts were closed because Safe failed to provide information requested by the banks in the context of customer due diligence measures applied by the latter. The closure should therefore be considered as a means of enforcing Safe’s obligations under the Money Laundering Directive, and possibly the Payment Services Directive, for which only the competent authorities, not the banks, are competent. (43) 102. I do not see how the banks’ action can be construed as being supervisory in nature. The Money Laundering Directive concerns customer due diligence requirements which apply to covered entities, not to customers because of their status as customers. The directive does not require customers to provide covered entities with the information which the latter must obtain and verify in order to satisfy their own customer due diligence obligations. Thus, for example, Article 8 describes elements of a business relationship about which information is to be obtained and verified. It does not specify that national law must provide that the information is to be obtained from the customer and that the latter is, pursuant to the Money Laundering Directive as properly implemented, required to respond to such requests (even if the customer has a strong interest in doing so in order to avoid the consequences described under Article 9(5)). (44) 103. As a result, action of the kinds provided for in the first subparagraph of Article 9(5) (including, where a business relationship has already been established, termination of that relationship) is the consequence of a covered entity’s inability to comply with the customer due diligence obligations under Article 8(1)(a) to (c) as implemented by the Member States. That consequence is justified by the resulting risk that customers, transactions and relationships are (or may be) used for money laundering or terrorist financing purposes. 104. Article 9(5) does not depend, for its application, on why a covered entity cannot comply with the required customer due diligence measures under Article 8(1)(a) to (c). Thus, the fact that a covered entity’s customers do not cooperate by providing information enabling it to comply with national law implementing Article 8 is neither necessary nor always sufficient to trigger the consequences set out in Article 9(5). 105. It is true that Article 37 of the Money Laundering Directive requires competent authorities to monitor effectively and to take the necessary measures to ensure that covered entities, including credit institutions and payment institutions applying customer due diligence measures to any of their customers, comply with that directive. As Advocate General Bot has put it, the effectiveness of customer due diligence and disclosure measures is assured by conferring powers of supervision and penalties on the competent national authorities. (45) I agree with him that the customer due diligence, reporting, supervision and monitoring measures together constitute preventive and dissuasive measures to combat money laundering and financing of terrorism effectively, and to safeguard the soundness and integrity of the financial system. 106. However, that does not imply that covered entities, when acting on the basis of national laws implementing Articles 8 and 9 of the Money Laundering Directive, assume the supervisory role that is reserved to the competent authorities. 107. Nor does it mean that covered entities may undermine the supervision tasks which competent authorities under Article 21 of the Payment Services Directive are to exercise over payment institutions to verify compliance with the provisions of Title II (‘Payment service providers’) in that directive. (46) Whilst those authorities might, in appropriate circumstances, withdraw the registration of agents, the branch or the payment institution itself pursuant to that directive, (47) such powers coexist with the preventive measures to be applied by covered entities and the supervisory powers of competent authorities under the Money Laundering Directive. Is a specific justification needed in order to exercise the right to apply (enhanced) customer due diligence measures, or is it sufficient that the customer carries out a risky activity (Question 2(b))? If specific justification is needed, what criteria apply (Question 2(c)(i) to (iii))? 108. If Member States may authorise or require credit institutions to apply customer due diligence measures to a payment institution, the referring court asks, by Questions 2(b) and 2(c)(i) to (iii), in essence whether such measures can be based merely on the general type of activity pursued by that payment institution or whether individual acts of that institution must be analysed. 109. I recall that the questions arise in the context of a dispute involving covered entities which claim to have based their customer due diligence measures on national law applicable to situations that the legislator has deemed to present high risk (such as the provision of services to send money) and that are not listed in Article 13. Moreover, I have already addressed what is required in case of suspicion of money laundering within the meaning of Article 7(c). (48) 110. I therefore understand Questions 2(b) and 2(c)(i) to (iii) to relate to circumstances in which a Member State is acting within the freedom left to it by the Money Laundering Directive. 111. When a Member State acts within that freedom, it must nevertheless exercise that competence in accordance with EU law, in particular the basic freedoms guaranteed by the Treaties. (49) The Court has accepted that the objective of combating the use of the financial system for money laundering or terrorist financing, which underlies the Money Laundering Directive, is to be balanced against the protection of other interests, including the freedom to provide services. Thus, in Jyske Bank Gibraltar, the Court in essence found that restrictions on the freedom to provide services resulting from an information requirement ‘in so far as such legislation seeks to strengthen, in compliance with [EU] law, the effectiveness of the fight against money laundering and terrorist financing’ were permissible. (50) Where (as here) EU law has not been completely harmonised, national legislation which restricts basic freedoms may be justified because it meets an overriding requirement relating to the public interest, if that interest is not already safeguarded by the rules to which the service provider is subject in the Member State in which he is established, in so far as it is appropriate to secure the attainment of the aim which it pursues and does not go beyond what is necessary in order to attain it. (51) 112. The Court has already accepted that preventing and combating money laundering and terrorist financing are legitimate objectives which concern the protection of public order and can justify a barrier to the freedom to provide services. (52) 113. Is national law such as that at issue appropriate to secure the attainment of that objective because it helps to reduce the risk and, more generally, genuinely reflects a concern to attain the objective in a consistent and systematic manner? (53) A national law that identifies, following an appropriate risk assessment (including in relation to customers which are payment institutions), a high risk with respect to a type of (for example) customer, country, product or transaction and that on that basis authorises or even requires covered entities to apply, following their own individualised risk assessment, appropriate customer due diligence measures seems to me to satisfy that requirement. 114. Assessing whether the national law is proportionate involves determining the level of protection desired by the Member State with respect to the identified level of risk of money laundering and terrorist financing. I read the Money Laundering Directive as confirming that Member States may set, for example, a level of protection that is higher than that chosen by the EU legislator, identify other situations of (high) risk and authorise or require customer due diligence measures other than those foreseen by that directive. 115. Where they do so, Member States may, for example, identify the specific measures to be applied in certain specified situations or give covered entities discretion to apply, based on an appropriate risk assessment, the measures deemed to be commensurate with the risk at issue in a specified situation. In either event, Member States must guarantee that the enhanced customer due diligence measures applied are based on assessing the existence and level of a risk of money laundering or terrorist financing with respect to a customer, business relationship, account, product or transaction, as the case may be. Without such assessment, it is not possible for either the Member State or, where relevant, a covered entity to decide in an individual case what measures to apply. And, where there is no risk of money laundering or terrorist financing, preventive action cannot be taken on those (legitimate) grounds. 116. That risk assessment must take into account, at least, all relevant facts capable of showing the (level of) risk of one of the types of conduct that are to be considered as money laundering or terrorist financing. Such risks (and their level) can depend on, inter alia, customers, countries or geographic areas, products, services, transactions or delivery channels. Thus, it may be necessary to ascertain, based on any information already available, (for example) who is involved in a transfer of property, the origin of that property, the rights transferred, whether there was knowledge of criminal activity, the degree of involvement of particular persons and entities in the acquisition, possession, use or transfer of property, the purpose of any transaction or relationship, the geographic scope of any operation involving the property, the value of the property or a transaction involving that property, or the regularity or duration of the business relationship. 117. Such an assessment makes it possible in general and in individual cases to decide how to manage the risk by adopting appropriate measures. In choosing such measures, it is necessary (for both Member States and, where relevant, covered entities) to assess how far the perceived risk is already managed and the desired level of protection already secured by other measures, including those based on the Money Laundering Directive, the Payment Services Directive and other EU (or national) legislation. It is probably unlikely that a single customer due diligence or other measure can eliminate any risk of money laundering or terrorist financing. Rather, EU legislation suggests that Member States must adopt many different types of response to such risks. 118. Moreover, whether a national law is proportionate will also depend on the degree to which the customer due diligence measures for which it provides may intrude upon other protected rights and interests under EU law, such as the protection of personal data (Article 8 of the Charter) and the principle of free competition between entities operating in the same market. Their objectives must be balanced against such other legitimate interests. 119. Finally, whether a national law is proportionate will depend on whether there are alternative, less restrictive means to achieve the same level of protection. Thus, for example, rather than a blanket law that assumes that sending funds abroad will always be high risk, (54) a law that differentiates between transferee countries (based on the risk which sending money there presents) or requires covered entities so to differentiate may be less restrictive and yet still achieve the Member State’s desired level of protection. Customer due diligence measures and the protection of personal data (Question 3(a) and (b)) 120. By Question 3(b), the referring court in essence asks whether the Personal Data Directive precludes Member States from requiring payment institutions to provide data regarding the identity of their customers to credit institutions, which are in direct competition with them, in the context of enhanced customer due diligence measures applied by the latter. Question 3(a) is similar, though it refers neither to any specific provision of EU law nor to the competitive relationship between the payment institution and the credit institutions (but, conversely, does refer to data pertaining to recipients of funds transmitted through Safe’s accounts). 121. Some doubts have arisen as to whether Question 3 is admissible, because BBVA insists that it has never asked for personal data regarding Safe’s customers or recipients of the transmitted funds; it sought only information regarding the agents who acted on behalf of Safe and used Safe’s accounts. 122. If BBVA’s presentation of the facts is correct and corresponds also with what happened in the dispute between the two other banks and Safe, Question 3 would indeed appear not to be relevant to the resolution of the dispute in the main proceedings. However, it is well established that it is not for the Court to ascertain and assess the facts which have given rise to the dispute. That task is the prerogative of national courts (55) and their jurisdiction in that regard is a matter of national law. I shall therefore answer Question 3 in so far as possible. 123. Covered entities, such as credit institutions and payment institutions, may need to collect and verify data pertaining to at least their own customers either in accordance with the Money Laundering Directive or, if subject to stricter provisions as permitted by Article 5 of that directive, under other rules of national law that are consistent with EU law. Where this involves treatment of personal data falling within the scope of the Personal Data Directive (the Money Laundering Directive is not very specific in this regard), the requirements under both directives apply in principle. Recital 33 in the preamble to the Money Laundering Directive confirms this with respect to the disclosure of information under Article 28. So does recital 48, which refers to respecting fundamental rights, thus including the protection of personal data under Article 8 of the Charter. 124. I see no basis for reading ‘the customer’ in either Article 8(1)(a) (56) or Article 13 so as to refer also to the customer(s) of the customer of the covered entity. These provisions essentially concern the relationship between a covered entity and its customer(s) and transactions undertaken in the context of that relationship. It is of course true that Article 13(4)(c) lists measures to establish the source of wealth and funds involved in a business relationship or transaction with politically exposed persons residing in another Member State or a third country. However, nothing in the request for a preliminary ruling suggests that that is the situation here. 125. That said, I think that the Money Laundering Directive does not necessarily preclude national laws which require or authorise a covered entity, where justified, to obtain information about the customers of its customer. Information about those customers might be relevant to assessing whether the customer of the covered entity, its transactions and business relationships present risks of money laundering or terrorist financing. 126. I do not therefore accept that a covered entity under the Money Laundering Directive may never be authorised or required under national law to seek information about the customers of its own customers in order to prevent money laundering or terrorist financing. Nor does the Personal Data Directive, in particular Article 7, appear to preclude processing of personal data in such circumstances. 127. However, such national laws must also be consistent with that Member State’s other obligations under EU law, including the requirements of the Personal Data Directive and Articles 8 and 52(1) of the Charter. Conclusion 128. In the light of all the above considerations, I suggest that the Court should answer the Audiencia Provincial de Barcelona (Spain) to the effect that: – Notwithstanding the derogation in Article 11(1), Articles 7 and 13 of Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing require Member States to ensure that covered entities apply, in situations involving customers who are themselves covered entities under that directive, (i) standard customer due diligence measures under Articles 8 and 9(1) where there is suspicion of money laundering or terrorist financing within the meaning of Article 7(c); and (ii) enhanced customer due diligence measures under Article 13 in situations foreseen under that provision. – ‘A suspicion of money laundering or terrorist financing’ within the meaning of Article 7(c) of Directive 2005/60 arises in particular where, taking into account the individual circumstances of a customer and his transactions (including with respect to the use and management of his account(s)), there are some verifiable grounds showing a risk that money laundering or terrorist financing exists or will occur in relation to that customer. Article 11(1) does not derogate from Article 7(c). Regardless of any derogation, exemption or threshold and thus regardless of whether the customer is or is not a covered entity, Article 7(c) provides that customer due diligence measures are always required where there is suspicion of money laundering or terrorist financing. Where such a suspicion arises, a Member State is therefore precluded from allowing or requiring simplified customer due diligence measures to be applied. – The fact that the customer is itself an entity covered by Directive 2005/60 does not mean that a Member State must not require enhanced customer due diligence measures within the meaning of Article 13 of that directive to be applied with respect to that customer if, despite the guarantees already provided by Directive 2005/60 and other EU legislation, there exists a higher risk of money laundering and terrorist financing as foreseen by that provision. Article 11 only derogates from standard customer due diligence measures in situations of lower risk. Since it does not refer to Article 13, it has no bearing on the customer due diligence that is required where there is a higher risk. – Even where Member States have properly transposed Articles 7, 11 and 13 of Directive 2005/60 into national law, Article 5 permits them to adopt or retain in force stricter provisions that seek to strengthen the fight against money laundering or terrorist financing, and confirms that Directive 2005/60 merely provides for a minimum level of harmonisation. The remit of Article 5 of Directive 2005/60 is not limited to the provisions in Chapter II (‘Customer due diligence’) of that directive. A Member State may therefore provide for customer due diligence measures to be applied by a credit institution in relation to a payment institution even where the conditions of Article 11(1) are satisfied and in situations other than those listed in Articles 7 and 13, where this is justified and otherwise consistent with EU law. – When Member States act within the freedom left them by Article 5 of Directive 2005/60, they must nevertheless exercise that competence in accordance with EU law, in particular the basic freedoms guaranteed by the Treaties. Where (as here) EU law has not been completely harmonised, national legislation which restricts basic freedoms may be justified because it meets an overriding requirement relating to the public interest, in so far as it is appropriate to secure the attainment of the aim which it pursues and does not go beyond what is necessary in order to attain it. – Assessing whether the national law is proportionate involves determining the level of protection desired by the Member State with respect to the identified level of risk of money laundering and terrorist financing. Member States may set a level of protection that is higher than that chosen by the EU legislator, identify other situations of (high) risk and authorise or require other customer due diligence measures. Member States must guarantee that the enhanced customer due diligence measures applied are based on assessing the existence and level of a risk of money laundering or terrorist financing with respect to a customer, business relationship, account, product or transaction, as the case may be. In choosing what measures to apply, it is necessary (for both Member States and, where relevant, covered entities) to assess how far the perceived risk is already managed and the desired level of protection already secured by other measures, including those based on Directive 2005/60, Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market and other EU (or national) legislation. Whether a national law is proportionate will also depend on the degree to which the customer due diligence measures for which it provides may intrude upon other protected rights and interests under EU law, such as the protection of personal data (Article 8 of the Charter of Fundamental Rights of the European Union) and the principle of free competition between entities operating in the same market. Finally, whether a national law is proportionate will depend on whether there are alternative, less restrictive means to achieve the same level of protection. – Covered entities under Directive 2005/60 may not undermine the supervision tasks which competent authorities under Article 21 of Directive 2007/64 are to exercise over payment institutions to verify compliance with the provisions of Title II (‘Payment service providers’) of the latter directive. Whilst those authorities might, in appropriate circumstances, withdraw the registration of agents, the branch or the payment institution itself pursuant to that directive, such powers coexist with the preventive measures to be applied by covered entities and the supervisory powers of competent authorities under Directive 2005/60. – Directive 2005/60 does not necessarily preclude national laws which require or authorise a covered entity, where justified, to obtain information about the customers of its customer. However, such national law must also be consistent with that Member State’s other obligations under EU law, including the requirements of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Articles 8 and 52(1) of the Charter of Fundamental Rights of the European Union. 1 Original language: English. 2 For the definitions of ‘credit institution’ and ‘payment institution’ under the relevant EU law, see points 16, 17 and 44 below. 3 Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing (OJ 2005 L 309, p. 15), as last amended by Directive 2010/78/EU of the European Parliament and of the Council of 24 November 2010 (OJ 2010 L 331, p. 120). 4 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), as amended in certain respects by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003 (OJ 2003 L 284, p. 1). 5 Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council (‘Unfair Commercial Practices Directive’) (OJ 2005 L 149, p. 22). 6 Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC (OJ 2007 L 319, p. 1), as amended. 7 See also point 72 below. 8 A more recent version dates from February 2012: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation: The FATF Recommendations (‘the 2012 FATF Recommendations’). Both versions are available on the FATF’s website: http://www.fatf-gafi.org/. 9 See point 29 below. 10 Directive 2000/12/EC of the European Parliament and of the Council of 20 March 2000 relating to the taking up and pursuit of the business of credit institutions (OJ 2000 L 126, p. 1), as amended. 11 Directive 2006/48/EC of the European Parliament and of the Council of 14 June 2006 relating to the taking up and pursuit of the business of credit institutions (OJ 2006 L 177, p. 1). This directive repealed Directive 2000/12. 12 See point 44 below. 13 The full definition of a ‘payment institution’ is found in Article 4(4) of the Payment Services Directive: see point 44 below. 14 See also point 29 below. 15 Implementing rules were adopted in Commission Directive 2006/70/EC of 1 August 2006 laying down implementing measures for Directive 2005/60/EC of the European Parliament and of the Council as regards the definition of ‘politically exposed person’ and the technical criteria for simplified customer due diligence procedures and for exemption on grounds of a financial activity conducted on an occasional or very limited basis (OJ 2006 L 214, p. 29). Whilst that directive lays down implementing measures as regards, inter alia, technical criteria for assessing whether situations represent a low risk of money laundering or terrorist financing as referred to in Article 11(2) and (5) of the Money Laundering Directive, it does not cover Article 11(1). 16 See point 32 below. 17 See Article 2(c) of the Unfair Commercial Practices Directive. 18 Article 10 concerns simplified measures but with regard to products or transactions. 19 Namely, credit institutions or financial institutions as listed in Article 2(1)(1) and (2) of the Money Laundering Directive. 20 See 2003 FATF Recommendations, Introduction, footnote 1, and 2012 FATF Recommendations, Introduction, page 7. The Commission is listed as one of the FATF’s Members. 21 See, for example, judgment in Jyske Bank Gibraltar, C‑212/11, EU:C:2013:270 (‘judgment in Jyske Bank Gibraltar’), paragraphs 46 and 63. 22 See point 7 above. 23 See judgment in Jyske Bank Gibraltar, paragraph 38 and case-law cited. 24 Article 2(a) of the Unfair Commercial Practices Directive. 25 Judgment in Zentrale zur Bekämpfung unlauteren Wettbewerbs, C‑59/12, EU:C:2013:634, paragraph 33. 26 See, for example, Articles 8(2) and 34(1) of and recitals 22 and 24 in the preamble to the Money Laundering Directive. 27 There may be other circumstances in which such a risk is found to exist. 28 Such as Articles 22(1)(a), 24 and 27. 29 I note that, whilst the Money Laundering Directive does not appear to define the term ‘product’, the context in which this term is used suggests that it is intended to cover various financial and commercial offerings. 30 See also interpretative note 9 to recommendation 5 of the 2003 FATF Recommendations. 31 See also interpretative note 10 to recommendation 5 of the 2003 FATF Recommendations. 32 See recitals 22 and 24 in the preamble to the Money Laundering Directive. See also recommendation 1 of the 2012 FATF Recommendations. 33 See, for example, Articles 17 and 21 of the Payment Services Directive. 34 For example, other EU legislation relating to the combating of money laundering and terrorist financing includes: Regulation (EC) No 1781/2006 of 15 November 2006 on information on the payer accompanying transfers of funds (OJ 2006 L 345, p. 1); Regulation (EC) No 1889/2005 of 26 October 2005 on controls of cash entering or leaving the Community (OJ 2005 L 309, p. 9); Regulation (EC) No 2580/2001 of 27 December 2001 on specific restrictive measures directed against certain persons and entities with a view to combating terrorism (OJ 2001 L 344, p. 70). 35 The FATF has also taken the position that the risk-based approach is not a ‘zero failure’ approach and there might be occasions where an institution has taken all reasonable measures to identify and mitigate the risk but is still being used for money laundering and terrorist financing. See FATF, Guidance for a Risk-Based Approach – The Banking Sector (October 2014), point 10. 36 This implication was the basis for the European Parliament’s proposal to exclude (what is now) Article 7(c) from the derogation: see Report on the proposal for a directive of the European Parliament and of the Council on the prevention of the use of the financial system for the purpose of money laundering, including terrorist financing (COM(2004)0448 – C6-0143/2004 – 2004/0137(COD)), p. 43. 37 This is also consistent with the 2003 FATF Recommendations. Interpretative note 13 to recommendation 5 states that ‘[s]implified [customer due diligence] measures are not acceptable whenever there is suspicion of money laundering or terrorist financing or specific higher risk scenarios apply’. See also interpretative note 2 to recommendation 1 of the 2012 FATF Recommendations. 38 It is true that Member States must provide for similar obligations in situations other than those listed in paragraphs 2 to 4, which represent a high risk of money laundering or terrorist financing and which meet the technical criteria established in implementing measures taken by the Commission based on Article 40(1)(c). As far as I can see, such implementing measures have not yet been adopted. 39 See point 54 above. 40 Judgment in Jyske Bank Gibraltar, paragraph 61. 41 See judgment in Jyske Bank Gibraltar, paragraph 61. 42 See points 108 to 119 below. 43 See Article 21 of the Payment Services Directive. 44 See also recital 10 in the preamble to the Money Laundering Directive. 45 Opinion of Advocate General Bot in Jyske Bank Gibraltar, C‑212/11, EU:C:2012:607, point 61. 46 That title includes Article 17(1) of the Payment Services Directive. 47 See Article 17(6) of the Payment Services Directive. 48 See points 81 and 82 above. 49 See, for example, judgment in Commission v Portugal, C‑438/08, EU:C:2009:651, paragraph 27 and case-law cited. 50 Judgment in Jyske Bank Gibraltar, paragraph 49, read together with paragraphs 59 and 60. 51 Judgment in Jyske Bank Gibraltar, paragraphs 57 to 60 (and, in particular, case-law cited at paragraph 60). 52 Judgment in Jyske Bank Gibraltar, paragraphs 62 to 64 and 85 and case-law cited. 53 Judgment in Jyske Bank Gibraltar, paragraph 66 and case-law cited. 54 Interpretative note 15, read together with interpretative note 14, to the 2012 FATF Recommendations contains examples that offer guidance on what are helpful indicators of a high risk. However, the text of note 14 expressly states that these examples may not be relevant in all circumstances. Under item (c) are listed: private banking, anonymous transactions, non-face-to-face business relations or transactions, payment received from unknown or un-associated third parties. 55 See, for example, the judgments in Accor, C‑310/09, EU:C:2011:581, paragraph 37 and case-law cited, and ProRail, C‑332/11, EU:C:2013:87, paragraph 30 and case-law cited. 56 That being so, I do accept that that provision must be interpreted as covering also all those whose conduct, when acting in the capacity of agent, engages the responsibility of the entity for which they act. Article 9(4), which refers to transactions being carried out by ‘the customer or on its behalf’, confirms this reading of Article 8(1)(a). That interpretation is also in conformity with recommendation 5 of the 2003 FATF Recommendations and its interpretative note 4 according to which, where the customer is a legal person, the customer due diligence measure of identifying it and verifying its identity includes the obligation to ‘[v]erify that any person purporting to act on behalf of the customer is so authorised, and identify that person’. See also interpretative note 4 to recommendation 10 of the 2012 FATF Recommendations.