EUROPEAN COMMISSION Strasbourg, 5.7.2016 SWD(2016) 223 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Directive of the European Parliament and the Council amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive 2009/101/EC {COM(2016) 450 final}

{SWD(2016) 224 final}



Table of Contents Context and Introduction Part I 1. Background and policy context 2. Problem definition 2.1Problem 1: Suspicious transactions involving high-risk third countries are not efficiently monitored due to unclear and uncoordinated customer due diligence requirements 2.1.1 Context 2.1.2 The problem 2.1.3 The problem drivers 2.1.4 The effects of the problem 2.1.5 The size of the problem/Baseline scenario 2.2Problem 2: Suspicious transactions made through Virtual Currencies are not sufficiently monitored by the authorities, which are unable to link identities and transactions 2.2.1 Context 2.2.2 The problem 2.2.3 The problem drivers 2.2.4 The effects of the problem 2.2.5 The size of the problem/Baseline scenario 2.3Problem 3: Current measures to mitigate ML/TF risks associated with anonymous prepaid instruments are not sufficient

2.3.1 Context 2.3.2 The problem 2.3.3 The problem drivers 2.3.4 The effects of the problem 2.3.5 The size of the problem/Baseline scenario 2.4Problem 4: FIUs have limitations in the timely access to – and exchange of – information held by obliged entities 2.4.1 Context 2.4.2 The problem 2.4.3 The problem drivers 2.4.4 The effects of the problem 2.4.5 The size of the problem/Baseline scenario 2.5Problem 5: FIUs lack access or have delayed access to information on the identity of holders of bank and payment accounts 2.5.1 Context 2.5.2 The problem 2.5.3 The problem drivers 2.5.4 The effects of the problem 2.5.5 The size of the problem/Baseline scenario 3. EU right to act and subsidiarity 4. Policy objectives 5. Policy options

5.1.Option 1: Maintaining the status quo 5.2.Option 2: Non-regulatory option 5.3.Option 3: Regulatory options 5.3.1 Improving the effectiveness of EU policy for high-risk third countries via a harmonised EU approach for enhanced due diligence measures to be applied by obliged entities 5.3.2 Improving the detection of suspicious virtual currency transactions and increasing the transparency of such transactions by linking them to identified persons 5.3.3 Reducing the misuse of anonymous prepaid instruments by further reducing the exemption regime for anonymous prepaid cards under the 4AMLD 5.3.4 Improving FIUs' access to – and the exchange of – information held by obliged entities 5.3.5 Providing FIUs (and potentially other AML/CFT competent authorities) with an efficient mechanism to ensure timely access to information on the identity of holders of bank and payment accounts 6. Analysis of the impact of the policy options proposed 6.1. Option 1: Maintaining the status quo 6.2. Option 2: Non regulatory option 6.3. Option 3: Regulatory options 6.3.1 Improving the effectiveness of EU policy for high-risk third countries via a harmonised EU approach for enhanced due diligence measures to be applied by obliged entities 6.3.2 Improving the detection of suspicious VC transactions and increase the transparency of such transactions by linking them to identities 6.3.3 Reducing the misuse of anonymous prepaid instruments by further reducing the exemption regime for anonymous prepaid cards under the 4AMLD 6.3.4 Improving FIUs' access to - and exchange of - information held by obliged entities 6.3.5 Providing FIUs (and potentially other AML/CFT competent authorities) with an efficient mechanism to ensure timely access to information on the identity of holders of bank and payment accounts 7. Discarded options 8. Preferred option 8.1Improving the effectiveness of EU policy for high-risk third countries via a harmonised EU approach for enhanced due diligence measures to be applied by Member States and obliged entities

8.2Improving the detection of suspicious virtual currency transactions and increasing their transparency by linking them to identities 8.3Reducing the misuse of anonymous prepaid instruments by further reducing the exemption regime for anonymous prepaid cards under the 4AMLD 8.4Improving FIUs' access – and exchange of – information held by obliged entities 8.5Providing FIUs (and potentially other AML/CFT competent authorities) with an efficient mechanism to ensure timely access to information on the identity of holders of bank and payment accounts 9. Monitoring, transposition and evaluation Part II 1. Background and political context 2. Overall situation and objectives 3. EU right to act and subsidiarity 4. Policy Objectives 5. Policy Options and Analysis 5. 1. Certain intermediary entities are particularly susceptible to hide illicit money 5.1.1. Need to update the beneficial ownership information for certain trusts, other legal arrangements and legal entities such as foundations (systematic review and monitoring of certain existing customers) 5.1.2. The ownership threshold of 25% applies both to genuine commercial corporate entities, and intermediary structures that adopt a corporate form 5. 2. Publicity of the beneficial ownership registers for legal entities 5.2.1. Public access to the beneficial ownership registers for legal entities (such as companies) 5.3. Trusts are not sufficiently transparent 5.3.1. Registration of trusts - territorial dimension and scope 5.3.2. Public access to the beneficial ownership registers for legal arrangements (such as trusts) 5.4. Certain public authorities lack information

5.4.1. Problem definition 5.4.2. Problem drivers 5.4.3. Regulatory options 6. Monitoring, transposition and evaluation Annexes ANNEX 1: Procedural information ANNEX 2: Stakeholder consultation ANNEX 3: Who is affected by the initiative and how? ANNEX 4: Enhanced Customer Due Diligence ANNEX 5: Virtual currencies and prepaid instrumnents ANNEX 6: FIUs ANNEX 7: Mechanisms for timely access to information on holders of bank and payments accounts ANNEX 8: Discarded options ANNEX 9: Non-regulatory options ANNEX 10: Glossary



Context and Introduction This impact assessment, proposing modifications to Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, consists of two parts.

Part 1 relates to five targeted amendments to this Directive to strengthen the EU's existing framework to fight terrorism and terrorist financing. Part 2 concerns targeted amendments to this Directive to enhance transparency of beneficial owners of corporate entities and trusts.



Part I 1. Background and policy context On 20 May 2015, a new framework on anti-money laundering and counter-terrorist financing ("AML/CFT") was adopted. These new rules are, to a large extent, based on the international standards issued by the Financial Action Task Force (FATF) and consist of: (I)Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing ("4AMLD"), and (II)Regulation (EU) 2015/847 on information accompanying transfers of funds ("FTR"). The transposition date for the 4AMLD and the entry into force of the FTR is 26 June 2017. Consequently, the transposition is ongoing in the vast majority of Member States. The challenge for the AML/CFT framework is to ensure that the EU rules – and their enforcement – keep pace with evolving trends, developments in technology and the seemingly limitless ingenuity of criminals to exploit any gaps or loopholes in the system. The recent terrorist attacks – which took place only few months after the adoption of the 4AMLD - underline the need for the EU to step up further its fight against terrorism and terrorism financing. Terrorist organisations and individual terrorists need financing in order to maintain their networks, recruit and supply terrorist fighters, and commit terrorist acts. Cutting off sources of finance, making it harder to escape detection when using these funds, and using any information from the financing process to best effect makes a powerful contribution to the fight against terrorism. Although the challenge of how to tackle terrorist financing is not new, new trends have emerged, seen in particular in terrorist organisations such as the Islamic State of Iraq and the Levant (ISIL) and among foreign terrorist fighters. The above led to a reflection on the new challenges and threats posed by terrorist financing. In particular, this includes discussions at the FATF which raised, in a session in December 2015, the need to ensure sufficient powers and information-sharing among authorities to prevent against the risks posed by terrorist financing. This has resulted in the Commission examining some policy options aimed at ensuring Financial Intelligence Units ("FIUs") cooperate with one another and have timely access to relevant information, amongst others through the use of a centralised bank account register or equivalent mechanism. Some ambiguity relating to FIU powers and cooperation has also recently been highlighted through Commission transposition workshops for the 4AMLD. The EU has also been criticised in recent months about shortcomings relating to FIU cooperation, following both the Paris and Brussels attacks. While the 4AMLD prevents the use of the traditional financial system for the purposes of money laundering and terrorist financing, some services are becoming increasingly popular as alternative financial systems and remain outside the scope of EU legislation or benefit from exemptions that may no longer be justified. Innovation in financial services and technological change, for all their benefits, create new opportunities which may be abused to conceal terrorist financing. The attacks raised question-marks about the risks relating to anonymity for instruments which fall partially or wholly outside the scope of the EU rulebook. It is essential that the AML/CFT framework evolves to respond to new and emerging threats and that preventive measures are put in place to address existing gaps before those risks materialise. Concern emerged, in particular, with regard to prepaid cards which were used in the Paris attacks to book hotels and rent cars. Although prepaid cards present important economic benefits, their use in terrorist attacks raises the question about the take-up of such instruments and how their use should expand safely vis-à-vis other fully regulated alternatives (credit and debit cards).

For virtual currencies, the policy problem is similar, relating again to anonymity. Some Member States have reported that they have seen money laundering issues arise with respect to virtual currencies and see a possibility of these being used to fund terrorism. Many warnings have been made by international authorities about these risks, but they came too late in the 4AMLD negotiation process to be integrated into this instrument. Since then, a large number of Member States have taken steps unilaterally (or plan to) in order to regulate virtual currencies. Contacts with the virtual currency industry also indicated that a large part of the sector would welcome EU legislation in the field AML/CFT. Finally, industry in particular sees value in harmonising the enhanced due diligence that should be applied to high-risk third countries. Feedback from industry highlighted inconsistencies across the EU for transacting with high-risk jurisdictions adding regulatory cost and complexity, and creating reputational concern about doing business with such territories. Although none of the abovementioned subjects are really new - some of them have even been debated during the negotiations but were not withheld as there was at that time no sense of urgency - the terrorist attacks that took place in the aftermath of the adoption of the 4AMLD made both the Member States and the Commission conscious of the need to address these issues without delay, knowing that the ink of the 4AMLD was still drying. The abovementioned recent game changers also show that money laundering, terrorist financing and organised crime remain significant problems which should be addressed at Union level. Some Member States already voiced their intention to take action in the abovementioned areas. However, uncoordinated action may reduce the good functioning of financial intelligence at EU level, and create gaps or weak spots that can be exploited by criminals and terrorists to channel their funds in and out the EU financial system, thus threatening the good functioning of the Internal Market. Taking into account the above and the Conclusions of the extraordinary JHA Council of 20 November 2015 and of the ECOFIN of 8 December 2015, the Commission published on 2 February 2016 a Communication with an Action Plan to further step up the fight against the financing of terrorism. The Action Plan builds on existing EU rules to adapt to new threats and seeks to update EU policies in line with international standards. The Action Plan focusses on two main strands of action: tracing terrorists through financial movements and preventing them from moving funds or other assets, and ensure that financial movements can wherever possible help law enforcement to trace terrorists and stop them from committing crimes; disrupting the sources of revenue used by terrorist organisations, by targeting their capacity to raise funds. One of the key actions of the Action Plan concerns the commitment of the Commission to present – at the latest by the second quarter of 2016 – legislative proposals to amend the 4AMLD in five specific and targeted areas: Enhanced due diligence measures/counter-measures with regard to high-risk third countries Virtual currency exchange platforms Prepaid instruments The access of Financial Intelligence Units (FIUs) to – and exchange of – information (to strengthen FIU powers and cooperation) The access of FIUs to centralised bank and payment account registers or electronic data retrieval systems The aim of these amendments is to contribute to the first strand of the Action Plan: the amendments will further strengthen the existing legal AML/CFT framework, by (i) taking preventive steps with respect to anonymous instruments that may be used by terrorists and (ii) enhancing the transparency of financial streams linked to terrorism. Insight into terrorist fund transfers, which will be helped in particular by strengthening the powers of FIUs, will not only contribute to the freezing and seizure of such funds, but will also help to identify and unravel the terrorist networks and the individuals involved in these networks, thus contributing to the prevention of terrorist acts. These five proposed amendments can also be directly linked to a number of other initiatives of the Action Plan, such as for example (i) the adoption of the EU list of high risk third countries, (ii) the reinforcement of the cooperation between FIUs through appropriate measures (FIU mapping), (iii) the legislative proposal harmonising money laundering criminal offences and sanctions, and (iv) the exploration of the possibility of introducing a self-standing legislative instrument to allow for a broader consultation of bank and payment account registers, beyond the scope of the 4AMLD. On 12 February 2016, the ECOFIN Council called on the Commission to submit its amendments as soon as possible and no later than Q2 2016. 2. Problem definition While the recent amendment of the EU AML/CFT framework presents a major step forward in the prevention of money laundering and terrorist financing ("ML/TF"), by integrating the 2012 FATF standards into EU law, the latest terrorist attacks have shown that further steps to improve this framework are needed, especially (but not exclusively) where the detection of TF flows is concerned. Therefore, and notwithstanding the fact that the transposition of the Directive is still ongoing, the Commission decided on 2 February 2016 to re-open the 4AMLD on the aforementioned five specific issues.

These issues should be seen as stand-alone areas of action, based on recent experience and the wide-ranging discussion that has followed the terrorist attacks in Europe. But they can also be viewed as inter-related, in that they collectively strengthen the level of prevention across the EU against terrorist financing. All five initiatives will contribute to lifting/reducing of anonymity or enhancing transparency of criminal and terrorist financing flows, and will therefore directly or indirectly improve financial intelligence at EU level and protect the EU Internal Market against ML and TF threats. Moreover, the two initiatives regarding FIUs, will also directly improve financial intelligence (including exchange of information) at EU level. Consequently, they will cumulatively ensure that the regulatory perimeter is appropriately drawn to tackle unacceptable levels of anonymity and to ensure that there is sufficient oversight, powers, and cooperation to ensure that public authorities are able to credibly defend the EU from the risks it faces. 2.1 Problem 1: Suspicious transactions involving high-risk third countries are not efficiently monitored due to unclear and uncoordinated customer due diligence requirements 2.1.1 Context The risk based approach is a cornerstone principle of the AML/CFT framework and is fully implemented in the context of the 4AMLD. This principle is essential to an efficient allocation of resources when applying AML/CFT rules, by ensuring that measures to prevent or mitigate ML/TF are commensurate with the risks identified. Nevertheless, the 4AMLD has recognised specific situations where the risk based approach is to be complemented with a common approach regarding enhanced measures to be applied by all obliged entities. This is the case for instance for cross-border correspondent banking relationships, for business relationships with politically exposed persons, or when dealing with natural or legal entities established in third countries identified by the Commission as high-risk third countries. In all these situations, obliged entities shall apply enhanced customer due diligence measures (ECDD measures). At FATF level, the geographical/country risk is defined through two FATF public documents that are issued three times a year. At European level, the geographical/country risk is one of the factors to be considered when conducting the risk assessment. The identification of high-risk third countries is ensured at several levels: At the level of obliged entities, where risks factors related to countries or geographical areas may form part of their risk assessment at Member State level, where risks factors related to countries or geographical areas may form part of their national risk assessment at European Union level, where the Commission has to identify high-risk third countries via delegated acts. The list of the Commission shall be established taking into consideration strategic deficiencies in the following areas: (i) the legal and institutional AML/CFT framework in the third county; (2) the powers and procedures of the third country's competent authorities for preventing ML/TF; and (iii) the effectiveness of the AML/CFT system in addressing ML/TF risks in the third country. The Commission will take into account relevant evaluations, assessments and reports drawn up by international organisations and standards setters, such as FATF in particular. This list will complement the lists adopted at national and sectorial level. For higher risk business relationships, the FATF recommendations give some examples of ECDD measures that can be applied by countries and obliged entities to mitigate the risks. In the case of such high-risk third countries, the business relationships may also be subjected to counter-measures in the event that the country concerned has not demonstrated any commitment to improve their AML/CFT regime and presents "on-going and substantial ML/TF risks for the international financial system". While the ECDD measures consist mainly in an enhanced monitoring of transactions (including on the customer, the purpose of the business relationship or the source of funds) and constitute the basic requirements to apply when dealing with countries presenting strategic deficiencies in their AML/CFT regime, the counter-measures have stronger effects, since they range from systematic reporting mechanisms, to a prohibition against establishing subsidiaries, to the limitation of business relationships or financial transactions (see also Annex 4). 2.1.2 The problem Unlike the FATF recommendations, the 4AMLD does not prescribe the nature of the ECDD measures or counter-measures that shall be applied by obliged entities and Member States towards high-risk third countries designated by the Commission. It only refers to a general requirement to apply ECDD measures in such circumstances. Furthermore, no reference is made to situations where counter-measures shall be applied. The 4 AMLD puts more emphasis on clarifying the factors to be considered (such as geography, customer type, delivery channel etc.) to apply either ECDD or simplified customer due diligence measures, than on clarifying the nature of these ECDD measures. In addition to the uncertainty regarding when ECDD measures shall apply, this approach fails to provide a common, global response by the EU to the risk posed by high-risk third countries, even though such countries pose a common risk across the Internal Market. In particular:

some national AML/CFT regimes already provide for a complete set of requirements related to transactions involving high-risk third countries, i.e. the requirement to apply ECDD measures to high-risk third countries, as well as the nature of those ECDD measures. Example 1: The AML/CFT law of Member State X states: "When dealing with natural or legal entities established in a third country identified by (decree/law n°…) as high-risk third countries, obliged entities shall apply one or all of the following ECDD measures: a) additional information on the customer b) additional information on the intended nature of the business relationship c) information on the source of funds or source of wealth of the customer d) information on the reasons for the intended or performed business relationship e) approval of senior management to commence or continue the business relationship f) enhanced monitoring of the business relationship g) requiring the first payment to be carried out through an account in the customer's name with a bank subject to similar CDD standards" other national AML/CFT regimes are less detailed, keeping a general reference to ECDD measures applicable to FATF lists of high-risk third countries with no further indication as to the type or nature of the measures that should be applied. Example 2: The AML/CFT law of Member State X states: "When dealing with natural or legal entities established in a third country identified by FATF as high-risk third countries, obliged entities shall apply ECDD measures. other national AML/CFT regimes are silent as regards the legal framework applicable to high-risk third countries. In such cases, the management of high-risk third countries is left to the obliged entities' discretion. Example 3: The AML/CFT law of Member State X states

"When assessing the risks of ML/TF, obliged entities shall take into account the geographical risk factors". 2.1.3 The problem drivers The lack of clear provisions concerning the nature and type of ECDD measures or counter-measures that should apply for dealings with high-risk third countries creates legal uncertainty regarding the specific steps that obliged entities should take to ensure adequate and robust due diligence. It also leads to discrepancies between different sets of national legislation (whereby more lenient legislation may potentially allow terrorists or criminals groups to transfer illicit funds more easily). These 'gaps' between national laws are much more worrying when the strategic deficiencies relating to a particular high-risk third country refer to basic and fundamental elements of an AML/CFT system (i.e. criminalisation of ML/TF, implementation of customer due diligence, requirements related to record keeping or requirements to report suspicious transactions), which merit specific and efficient monitoring. 2.1.4 The effects of the problem In the absence of unambiguous and detailed provisions related to ECDD measures, obliged entities may fail to detect efficiently suspicious transactions involving third countries, recognised at EU level as being risky, because of the inadequacy of their monitoring process. In turn, this may also incur reputational risk. The variety of national practices towards high-risk third countries may also challenge the added-value of the EU listing process of those countries, provided by Article 9 of the Directive, if the same level and type of ECDD measures is not ensured. Without a corresponding harmonised approach, the EU listing may not achieve its desired effect: the lack of clear requirements may weaken the level of controls applied to transactions involving high-risk third countries in some Member States, resulting in suspicious transactions going undetected; criminals would have the possibility to exploit potential loopholes or take advantage of more lenient legislation through regulatory arbitrage. Example 4 (hypothetical): In Member State A, obliged entities shall only obtain additional information on the customer when dealing with natural or legal entities established in a third country identified as high risk. In Member State B, in the same circumstances, obliged entities shall apply the full range of ECDD measures (i.e. obtaining additional information on the customer, on the intended nature of the business relationship, on the source of funds, on the reasons for the intended or performed transaction, as well as obtaining senior management approval to commence the business relationship and an enhanced monitoring of the business relationship). Terrorists or criminals established in the designated high-risk third country C will decide to place or transfer proceeds of crime through credit or financial institutions governed by less stringent legislation, i.e. Member State A. Indeed, in Member State A the terrorist or criminal will be asked to provide additional information on the status of his customer only (where fake documents may easily be used), while in Member State B more complete enhanced monitoring (sources of funds, intent of the business relationship, senior management approval) will be less easy to circumvent. Under this scenario, the detection of a suspicious transaction will be easier in Member State B. it may create an unlevel playing field between obliged entities when national requirements are not the same and do not involve the same investment from an IT or administrative point of view. The more ECDD measures that are applied, the more filters and red flags may be included in the monitoring system of an obliged entity. Example 5 (hypothetical): When opening an account for Mr xxx established in a designated high-risk third, bank A will only require from Mr xxx to fill in an extended questionnaire to have additional information on him, while bank B will require from Mr xxx to fill in several questionnaires to have additional information on him, the source of his funds, and the purpose of his transactions. Depending on the level of the ECDD requirements, bank B will also have to ask for the approval of senior management of the bank, via a formal procedure. 2.1.5 The size of the problem/Baseline scenario

The number of affected obliged entities depends on their level of business exposure with high-risk third countries. Financial institutions such as credit institutions, payment institutions, electronic money institutions and money value transfer services are the key actors concerned and can reach a very high number at EU level. Other professional sectors such as gambling service providers, legal professionals or insurance service providers are also relevant sectors exposed to this problem, but to a lesser extent given the nature of their activities. Business exposure to high-risk third countries Do you currently conduct business relationships or transactions with clients that are natural or legal persons from countries that are identified by the FATF as presenting AML/CFT strategic deficiencies? 81% of positive responses What is the volume of activities undertaken by your institution/group, directly or via branches or subsidiaries, in countries that are identified by the FATF as presenting AML/CFT strategic deficiencies? "very low", "negligible", "insignificant expression", "1-4 per year", "289 customers", "less than 1%", "1,56% of the customer base". One specific case: money remitters - business exposure - volume of activities - money remitters located within the EEA are not so much directly exposed (i.e. through having direct business relationships with entities/persons from such countries). However, as these remitters are generally part of a worldwide financial group, they are often indirectly exposed. - data related to the volume of activities are not available Source: Extracts from written consultation organised in February 2016 – 21 respondents' professionals federations or organisations It depends also on the scope of high-risk third countries at stake and the circumstances when ECDD measures are applied. As regards the scope of high-risk third countries concerned, obliged entities shall rely on several sources, potentially cumulatively, i.e.: a)the countries listed by the Commission which have strategic deficiencies in their national AML/CFT regimes posing significant threats to the financial system of the Union; b)the countries listed by the FATF which are identified in the two FATF public documents of February 2016; c)the countries listed by Member States or obliged entities themselves because of the strategic deficiencies identified in the context of their national or sectorial risk assessment. As regards the ECDD measures applied towards designated high-risk third countries, obliged entities tend to use the examples of ECDD measures provided by the FATF recommendation but not in the same circumstances: a)some obliged entities systematically require additional information on the customer when dealing with high-risk third countries, while others apply this requirement on a case-by-case basis; b)some obliged entities rely on external sources to check the source of funds while others use extensive questionnaires addressed to the customer; c)some obliged entities systematically escalate the decision to undertake the transaction to their senior management or the money laundering risk officer while others rely on senior management approval only in specific circumstances, such as where politically exposed persons are concerned by the transaction. All 28 Member States are potentially impacted by this problem as they are all covered by the requirements of 4AMLD. 2.2 Problem 2: Suspicious transactions made through Virtual Currencies are not sufficiently monitored by the authorities, which are unable to link identities and transactions 2.2.1 Context

Virtual currencies ("VCs") are a digital representation of value that is neither issued by a central bank or public authority nor necessarily attached to a fiat currency ("FC"), but is used by natural or legal persons as a means of exchange and can be transferred, stored or traded electronically. There are hundreds of VCs on the market and the most well-known is "Bitcoin" which accounts for 90% of the total market capitalisation of VCs. Various stakeholders are involved in the VC industry, with the main actors being: users (investors, merchants, consumers using VCs to make payments or buy from merchants accepting VCs) miners, that validate transactions and receive VCs as rewards for their work wallet providers where users may hold their VC accounts and which can be divided into two categories: software wallets providers (i.e. applications to access VC networks and providing public information such as balances of VCs), and custodial wallets providers (which hold the private key of VC users and have control over VCs. We would include multi-signature wallets under this category, i.e. wallets for which the private keys are shared by more than one user in addition to the wallet provider). Compared to traditional financial services, custodial wallet providers that provide VC wallets to their users can be seen as financial institutions that provide bank or payment accounts to their customers. When such fund transfers are done between financial institutions, this is regulated by the Fund Transfer Regulation. However, the same transfer in VCs – trough VC wallets held by VC wallet providers – is unregulated. exchange platforms, engaged in the exchange of VCs for FCs, FCs for VCs, or VCs for other brands of VCs. Compared to traditional financial services, they are the "bureau de change" of the virtual currency world. Automated Teller Machines (ATMs) are included under this category. 2.2.2 The problem VCs have various characteristics that may allow them to be used as alternative channels for criminals looking to transact or transfer money electronically (see drivers). The main issue is their anonymity. The story of Ali Shukri Amin who provided instructions over Twitter on how to use Bitcoin to mask the provision of funds to Daesh is an example of the risks brought by VCs. Various cases involving the use of VCs to buy guns have also been reported. Example 6: Amin tweeted a link to an article he had written entitled "Bitcoin wa' Sadaqat al-Jihad" (Bitcoin and the Charity of Jihad). The article discussed how to use bitcoins and how jihadists could utilise this currency to fund their efforts. The article explained what bitcoins were, how the bitcoin system worked and suggested using Dark Wallet, a new bitcoin wallet, which keeps the user of bitcoins anonymous. The article included statements on how to set up an anonymous donations system to send money, using bitcoin, to the mujahedeen. Source: extract from the FATF report - Emerging Terrorist Financing Risks – October 2015 Moreover, VC market players, be they users (traders, suppliers, customers), 'miners', currency exchange platforms or wallet providers are currently not regulated at EU level nor in most EU Member States at national level. As a consequence, no one is under the obligation to report any suspicious transactions to an FIU (even though some do it spontaneously) and authorities lack information on such transactions. Creating measures that cover one or various market players who act as major gateways to the VC environment could help lift, at least partially, this anonymity. These market players could perform user identity checks as well as report suspicious transactions. Virtual currency exchange platforms (including some ATMs equipped with such functionalities) where one can buy or sell virtual currency units in exchange for fiat currencies, could play that role of gatekeeper between the virtual sphere and the real 'world'. The same approach could apply to custodial wallet providers which offer in the virtual sphere the equivalent of a bank account where to store one's virtual currencies. Miners, however, do not fall under this category, as they have no specific interactions with users. Moreover, most of them are located in China which would make any initiative largely impossible to enforce. Users' identity is of difficult access and a number of users may be attracted primarily by the anonymity offered by virtual currencies and could therefore be more reluctant to willingly contribute to the sanitisation of the market. However, there may be other users primarily interested by the economic dimension of that market, because it constitutes a support for (speculative) investment or offers lower transaction cost for cross-border payments, who might be ready to divulge their identity in order to bring more transparency in the market, contributing thereby to improving its reputation and in turn its greater use. Although the use of VCs is currently still limited, such currencies create new economic opportunities for online payments. Therefore, any new policy in this field should respect the test of necessity and proportionality, and be genuinely designed to protect specific public policy objectives. 2.2.3 The problem drivers

In contrast to traditional financial services, VC users' identities are unknown. Major VC schemes such as Bitcoin have anonymity by design. Attempting to find out users' identities requires enormous effort as no identity is linked to transactions. Authorities have to track transactions to a point where the identity may have been linked to an account or address (e.g. wallet providers or exchange platforms). As VC users are not covered by any EU legislation and no AML/CFT requirements are imposed on market players that could trigger customer due diligence (unlike for more traditional financial services), authorities have to use other more complex techniques. These include tracking IP addresses to put an identity on an account, which generates certain costs (it would take several hours' labour to investigate and make associated requests to internet service providers). Finally, VCs benefit from a growing network of acceptance (retailers online or offline, products and services available) and have numerous points of convertibility into FCs (through exchange platforms, ATMs or person-to-person transactions). As a consequence, the primary area of concern today is where VCs are exchanged for FCs and enter the real economy. It should be noted though that the risks posed today may evolve as the network of acceptance of VCs continues to grow (see figures for number of wallets and estimations on the number of users and merchants accepting virtual currencies in Annex 5). There might come a point in time when there will no longer be a need to convert VCs back into FCs if VCs become widely accepted and used. 2.2.4 The effects of the problem The anonymity of VCs, their growing acceptance, and the capacity to go from the VC environment to the FC environment with ease, turn VCs into a potential vehicle for criminal activity (including ML/TF). 2.2.5 The size of the problem/Baseline scenario Inaction at EU level could prompt measures to be taken at national level, leading to inconsistent approaches and regulatory arbitrage within the EU. Annex 5 provides an overview of the heterogeneous measures already taken or announced across the EU. Continued increase of the usage of VCs will influence the potential consequences of the problem. Even though the full scale of misuse of VCs is unknown, its market value is already above €7 billion worldwide. 2.3 Problem 3: Current measures to mitigate ML/TF risks associated with anonymous prepaid instruments are not sufficient 2.3.1 Context In Europe, the prepaid instrument market essentially is a prepaid card market. Prepaid cards started developing at the end of the 1990s as an alternative to debit cards (which require the existence of a payment account at a bank or a financial institution) and to credit cards (which require the card issuer to evaluate the cardholder's minimum level of creditworthiness).

Prepaid cards began as a device used to pay for goods and services where the issuer does not need to conduct any analysis on the cardholder's credit standing, and the cardholder does not have to bear the costs for opening and maintaining a payment account. There are basically two main categories of prepaid cards: 'closed-loop' prepaid cards, for purchases at a single merchant or among a limited network of merchants, and 'open-loop' / general purpose prepaid cards. General purpose prepaid cards are further divided into two sub-categories: reloadable cards and non-reloadable cards. Many of these cards need to be activated online to become operational. The prepaid card market is partially subject to AML/CFT requirements today. The 3AMLD provides that holders of prepaid cards shall be subject to customer due diligence (CDD) for non-reloadable cards with a storage exceeding €250 (for intra-EU use, up to €500 for domestic use) and for reloadable cards for yearly reloads in excess of €2500. As a consequence, a large part of the EU prepaid card market is already subject to customer due diligence. This is the case typically for travel cards – a substitute to travellers cheques – corporate cards, social benefit cards and for general purpose prepaid cards that are used like a debit or a credit card (all the more so when linked to a bank account). The market segment of prepaid cards subject to CDD will be further extended by the 4AMLD which (i) reduces the exemption threshold for reloadable cards by introducing a monthly (maximum reload and maximum spending limit of €250) rather than a yearly limit beyond which CDD will have to be performed, and (ii) requires additional conditions for the cards (reloadable or not) to benefit from the CDD exemption, notably that the payment instrument is used exclusively to purchase goods and services (and not for peer-to-peer payments) and that the payment instrument cannot be funded with anonymous electronic money. CDD has to be performed by the issuers of prepaid instruments covered by the Second Electronic Money Directive. Such issuers are regulated as 'obliged entities' under the 4AMLD. Card schemes and distributors of prepaid instruments are outside the scope of both Directives. 2.3.2 The problem The TF risk posed by prepaid cards is essentially linked to anonymous prepaid cards run on domestic or international schemes. These are general purpose non-reloadable cards with a nominal value of €250 or less, as well as those general purpose reloadable cards which can be reloaded up to €2500 over a year without being mandatorily subject to CDD. Although anonymity may be considered an advantage to protect the privacy of 'good-faith' users, privacy may also be misused to finance criminal activities. The key question is how to address the concerns raised by the anonymity of general purpose cards without wiping out the benefits that these instruments offer in their normal use (financial inclusion, protection against fraud, payment of social benefits), and shifting the risk to other less detectable means of payments, notably cash. Therefore, from a fundamental rights perspective, the question whether it is worth further regulating a fast-changing and potentially beneficial market deserves to be examined further, and the test of proportionality and necessity needs to be taken into account when assessing the options. The issuance and acceptance of prepaid cards takes place under a regulated framework both within the EU and globally. In principle, prepaid card issuers – in accordance with European AML/CTF legislation – have to subject buyers of those cards to CDD. However, both the 3AMLD and the 4AMLD grant Member States the option to exempt from such requirements low nominal value cards or cards with a limited usage as these in principle present low ML/TF risks. Under the 3AMLD, all but three Member States decided to apply this exemption. In the context of the implementation of the 4AMLD, six Member States have already decided not to apply the exemption and seven have not yet taken a decision. The remaining 15 Member States will apply the exemption offered by the 4AMLD (which is stricter than under the 3AMLD, notably with regard to reloadable cards). Even within a regulated environment, law enforcement authorities (in the US and in Europe) have encountered misuse of prepaid cards in relation to criminal activities (drug trafficking, human trafficking, prostitution etc.), illegal labour and tax evasion leveraging the anonymity offered by some of these cards. Example 7: The investigation into the November 2015 attacks in Paris has revealed that a prepaid reloadable card issued in the EU was used for the rental of flats in Alfortville as well as the rental of cars for the commando. That card had been reloaded many times with individual reloads in excess of €750 EUR. Whilst electronic means are traceable after-the-event (unlike cash) and thus it was possible to know that a given card was reloaded many times, if the card is CDD-exempt

(as in this case), it is not possible to attach a name to the holder of the card. The Belgian press recently reported that Salah Abdeslam, one of the protagonists of the Paris attacks, had used an anonymous prepaid card to move around in Europe over a period of time before his arrest. The concerns of the law enforcement authorities vis-à-vis the misuse of prepaid cards have been exacerbated as a result of the security shift that has followed the 2015 Paris attacks. The degree of anonymity subsisting in the prepaid card market, although significantly reduced under the 4AMLD, is not considered acceptable. Additional efforts are expected to further reduce anonymity in that sector, considering that the social convenience offered by prepaid cards does not have to necessarily equate with anonymity.

2.3.3 The problem drivers Existing EU legislation follows a 'risk-based approach' on how to tackle ML and TF. On that basis, when meeting certain conditions, Member States are granted the possibility to exempt prepaid cardholders from CDD, which leads to anonymous transactions. At the same time, CDD implies compliance costs and administrative burden for prepaid card issuers. Compliance costs could – if excessive – finally lead to the disappearance of products which (i) constitute an efficient alternative to cash, allowing their users to buy goods or services in non-face to face environments, in particular online, (ii) from an AML/CFT viewpoint, remain far more traceable than cash for ex-post investigations, even where exempted, and (iii) present a clear social interest (financial inclusion, protection against fraud, payment of social benefits). Restrictions could also lead to distribution through bank networks only, which might be an issue for the unbanked.

2.3.4 The effects of the problem The anonymity of prepaid cards is seen as an asset by criminals, all the more so as the acceptance of prepaid cards in the Union is relatively high and their spread is widening. Whilst prepaid cards are more traceable than cash in ex-post investigations, they are also less detectable physically. Where police or customs dogs are trained to detect bulks of bank notes, they cannot do so for plastic cards. Furthermore, for reloadable cards, where the money is not loaded on the card chip (i.e. in most cases), law enforcement authorities cannot know what amount of money is accessible via the card. This will however be addressed for part by the 4AMLD which imposes a €250 cap on general purpose reloadable prepaid cards both in respect of spending and reloading capacity. 2.3.5 The size of the problem/Baseline scenario The exact size of the EU prepaid card market is difficult to assess as no public statistics are available. Based on industry estimates, the EU market in transaction value would represent about €19 to 20 billion (compared to €2 400 billion transaction value for debit and credit cards in the Union in 2014), of which about €11 billion relates to anonymous prepaid cards. There are relatively abundant FATF typologies on the misuse of prepaid cards for ML purposes. It is, however, not possible to provide a full scale as to their misuse in terms of transaction value compared to their legitimate use. At the same time, anonymity is used as a selling argument by a number of issuers and this market segment, whilst relatively small, still represents a sizeable grey area. Failure to act at EU level would lead to the persistence of a non-negligible regulatory and security gap in the EU framework. Member States have the option under EU law not to exempt prepaid cards from CDD. A higher number of Member States (six or seven) are contemplating doing so under the 4AMLD. At the same time, if the current exemption is not more strictly framed, as the appreciation of risk may vary across Member States, additional measures will be taken at national level to address the existing risk linked to the anonymity of prepaid cards. These measures, uncoordinated, would lead to inconsistent approaches, a patchy Single Market and a risk of regulatory arbitrage between Member States depending on the strength of their AML/CFT rules vis-à-vis prepaid cards, with displacements of issuing activities. To avoid or reduce the risk of circumvention related to the use of foreign prepaid cards in the EU, the adoption of similar standards by the FATF would be appropriate. In the meantime, conditions of equivalence might need to be defined in EU law to prevent the misuse in the territory of the Union of cards issued in jurisdictions with lesser AML/CTF requirements. 2.4 Problem 4: FIUs have limitations in the timely access to – and exchange of – information held by obliged entities 2.4.1 Context FIUs are public authorities that collect and analyse information (a.o. suspicious transaction reports ("STRs")) they receive from obliged entities (e.g. credit and financial institutions) under the 4AMLD. The regulation of obliged entities under the 4AMLD aims to establish a mechanism to detect suspicious transactions and underlying criminal activity, in order to prevent and combat ML and TF. In the event that their analysis reveals a suspicion of ML or TF, FIUs are also responsible for disseminating the results of their analysis and any additional relevant information to competent (law enforcement) authorities. FIUs are also empowered to take urgent action, such as the suspension of financial transactions. 2.4.2 The problem

Some FIUs are not yet able to obtain additional information from obliged entities, unless the same obliged entity has previously filed an STR. As a consequence, those FIUs are not able to further analyse a suspicion of ML or TF, which hinders their capability. Similarly, it impedes effective cooperation between FIUs as some FIUs, in turn, cannot further process a request for information submitted by another EU FIU. In addition, some FIUs do not directly have access to information held by obliged entities – but rely on a third party to access this information (e.g. prosecutor or judicial authority). Such indirect access increases the delay for the FIU in accessing information held by obliged entities. Such delays are particularly problematic where an FIU needs to rapidly access information in view of taking a decision for suspending/withholding consent for processing a transaction. Especially in cases involving terrorism financing, it remains of paramount importance that information flows quickly without undue delays. In practice, delays negatively affect cooperation between EU FIUs. Moreover, in some cases, the third party may impose further restrictions, conditions or limitations when such access is sought following a request from another EU FIU. As a consequence, some third parties are also in a position to refuse the provision of information following a request from an FIU of another Member State. The abovementioned concerns and the demand to tackle them have been tabled by the Council on 20 November 2015, following the Paris terrorist attacks.

2.4.3 The problem drivers The 4AMLD already provides that FIUs "shall be able to obtain additional information from obliged entities", and does not make any reference in this respect to the necessity of filing a prior STR. In this respect, the 4AMLD follows standards set by the FATF in its Recommendation 29 on FIUs (cf. text in Annex 6). However, the necessity of having a prior STR filing has been continuously questioned at international level, notably at the FATF. The latter recently confirmed that no prior STR filing was needed. However, it appears that differences in interpretation of the international standards in this field have impeded full effect of this provision across Member States. Furthermore, as stated above, the procedures in place in certain Member States require a third party authorisation for the FIU to request information from obliged entities. This practice was reflected in the adopted wording of article 31(1) (b) of the 4AMLD which provides that obliged entities should provide the information to the FIU "directly or indirectly" at its request. Hence the provisions of the 4AMLD are insufficient in this regard. 2.4.4 The effects of the problem The analysis function of an FIU is seriously limited if it cannot obtain additional information from an obliged entity in the event of a suspicion of ML/TF. It negatively impacts on its core functions and impedes effective cooperation and information-sharing with other EU FIUs. Similarly, the indirect access by FIUs to information held by obliged entities provokes further delays. The third party's authorisation may also be refused and hence a request from another FIU may not be processed. Example 8: the following illustrative examples were provided by FIUs with regard to the effects of the problem: -In several cases, other Member States' FIUs were unable to request and provide to FIU A the bank statements and data about authorised representatives and the ultimate beneficial owner because of domestic legislation. Those FIUs would have been able to do so if there was an ongoing criminal investigation or if the information was contained in the FIU database (i.e. a previous STR about the same case was filed to the FIU by an obliged entity). -The FIU of country B received an STR from an obliged entity in country B concerning the transfer of €600 000 coming to the bank account of the foreign company AB from the foreign bank account of the same company. The representative of the company AB intended to withdraw money in cash. The bank postponed the transaction, performed CDD and filed an STR. The FIU of country B asked the FIU of country C to check the foreign bank account of the company AB and the origin of funds. The FIU of country C provided information that company AB and its bank account were not listed in the FIU database. The FIU of country C was not able to ask the bank to check the origin of funds. Due to the lack of information, financial funds were unblocked and paid to the representative of the company AB. After two weeks, the FIU of country B received information from foreign banks concerning the fraudulent origin of funds. -For some FIUs, the access to financial information required a judicial procedure and, in this case, it is difficult to cooperate with administrative FIUs. -The FIU of Member State F is not authorised to obtain additional information in the course of its analysis.

-The FIU of Member State G can obtain additional information in the course of its analysis if there is a domestic STR. However, a foreign FIU request (based on a STR in this other Member State) is not considered equivalent with a domestic STR for Member State G. Hence it does not trigger analysis or does not allow for exchange of information between those FIUs. 2.4.5 The size of the problem/Baseline scenario FIUs have confirmed that the current practice has a disruptive effect on cooperation and impedes their effective work. It appears that a number of Member States have limitations regarding access to information and exchange of information between FIUs. Notably, even if only one FIU lacks those powers, this would undermine the EU's analysis capacity due to the high level of integration of the EU financial market. FIUs have reported several cases where another FIU did not have the authority to obtain additional information from obliged entities. In addition, some FIUs were not in a position to reply to a counterpart's request because they did not have direct access to the information. In sum, FIUs are not able to access all the information they need and to exchange such information with other FIUs. Ultimately, this leads to situations where money launderers or terrorists may misuse the financial system without the FIU being able to intervene. These problems have been reported for several years now. The Member States concerned have not voluntary changed those practices. 2.5 Problem 5: FIUs lack access or have delayed access to information on the identity of holders of bank and payment accounts 2.5.1 Context In order to adequately fulfil their duties, as stated under point 2.4.1 above, FIUs need to have – in a timely manner – a comprehensive picture of all financial transactions conducted by persons involved in suspicious transactions. In a number of Member States, information at national level allowing the identification of bank and payments accounts belonging to one person is fragmented and therefore either not accessible to FIUs at all, or not accessible in a timely manner. 2.5.2 The problem Lack of access or delayed access to information on the identity of holders of bank and payment accounts by FIUs hampers the detection of financial flows relating to terrorism, both nationally and at EU level. Certain Member States have put in place adequate mechanisms to tackle this problem - such as centralised banking registries or electronic data retrieval systems which contain/retrieve such information (as encouraged in recital 57 of the 4AMLD, and required by the FATF standards). However, there is no obligation at EU level to do so. Moreover, not all Member States that currently have such mechanisms in place allow their FIUs to have access to those systems. Therefore, in Member States which do not have such mechanisms in place, FIUs wanting to obtain a list of all the bank and payment accounts held by a person suspected of ML or TF need to formulate a "blanket request" to all credit and payment institutions in their country. This is time consuming and creates unnecessary cost (cf. table in Annex 7). It may also result in the dissemination of personal data in a non-targeted way to financial institutions, which can create problems from a data protection and fundamental rights perspective. Moreover, in most Member States, sending blanket requests is - from a cost and administrative perspective - simply not a feasible option. In such cases, this will lead to non-action by FIUs. As a consequence, FIUs are unable to exchange relevant information relating to ML and TF with their EU and non EU-counterparts, which complicates cross-border preventative action. The latter is an essential component in the fight against ML and TF.

Example 9: The FIU of Member State (MS) A receives an STR with regard to a suspicious transaction conducted by Mr. X on a bank account in MS A. As Mr. X is a resident of MS B, the FIU of MS A informs the FIU of MS B of this information. Hypothesis 1: MS B has a register enabling the FIU to identify the holders of bank and payment accounts. Upon receipt of the information from the FIU of MS A, the FIU of MS B will enter a query with regard to Mr. X in the register, and instantly receive the result. The search shows that Mr. X holds 2 bank accounts in MS B: one in bank Y, and one in bank Z. The FIU of MS B immediately contacts both banks and blocks the accounts, on which apparently money of criminal origin coming from a company O, having its registered office in MS C, was transferred. Law enforcement authorities seize the illicit funds on both bank accounts in MS B. Furthermore, the FIU of MS B informs the FIU of MS C of this information, thus allowing authorities in MS C to further investigate company O. Hypothesis 2: MS B is a medium size country with a medium size financial sector. MS B does not have a register of accountholders, but the FIU of MS B sends out blanket requests to all bank and payment institutions in MS B. This procedure has a certain cost (cf. Annex 7 for the annual costs) and takes approximately 3 days to 1 week (first, the requests need to be sent out, then all financial institutions need to search their files to check if Mr. X is one of their clients, and finally, they all need to reply to the FIU whether Mr. X is one of their clients or not). By using the blanket requests, the FIU of MS B receives information showing that Mr. X holds 2 bank accounts in MS B: one in bank Y, and one in bank Z. The FIU of MS B immediately contacts both banks. Unfortunately, the day before, Mr. X has transferred the money from criminal origin on those two bank accounts to another account in MS D. Consequently, the money cannot be blocked/seized anymore. Also, Mr. X, alerted by the fact that his account in MS A was investigated by law enforcement authorities, informed company O in MS C of this, following which company O immediately closed down its bank account. Hypothesis 3: MS B is a large country with a big financial sector. MS B does not have a register of accountholders, and its FIU does not use blanket requests, which are considered as unworkable, taking into account the costs and administrative burden linked to this technique for a country of that size. After having received info from the FIU of MS A, the FIU of MS B remains unaware of the accounts of Mr. X in MS B with banks Y and Z. Also, FIU B remains unaware of the fact that company O channels criminal money from MS C into these two accounts. Consequently, the FIU/law enforcement authorities of MS B cannot block/seize the funds on those two accounts, and Company O remains entirely undetected. The need for FIUs to have a fast access to necessary information to perform their duties has also been tabled by the Council on 20 November 2015, following the Paris terrorist attacks. 2.5.3 The problem drivers In order to adequately fulfil their duties, FIUs need to have – in a timely manner - the fullest picture of all financial flows relating to persons involved in suspicious transactions. The current European AML/CFT framework does not require Member States to set up mechanisms allowing FIUs to get timely access to information on the identity of holders of bank and payment accounts. 2.5.4 The effects of the problem Delayed access, or non-access, to this information results in FIUs having no view or only a partial view on criminal or terrorist financial flows (cf. case example, hypothesis 2 and 3) by which to analyse ML/TF suspicions. As (part of) the illicit funds remain undetected, those funds cannot be blocked or frozen, and remain available in the financial system in order to be laundered or used for terrorist activities. Finally, FIUs are unable to exchange relevant information relating to ML and TF with their EU and non EU-counterparts, which complicates cross-border preventative action.

2.5.5 The size of the problem/Baseline scenario The table in Annex 7 gives an anonymised overview of the current situation in the 16 Member States that have or are in the process of putting in place automated mechanisms that enable them to identify holders of bank and payment accounts. In principle, an FIU should check the identity of the holders of bank and payment accounts (through a search request) for every STR it receives, or at least be able to do so (see sample table in Annex 7 with total number of STRs per year and per Member State (MS), ranging from 510 to 118.559 STRs). If no such automated mechanisms are available, FIUs should (at least theoretically) gather this information by issuing blanket requests for each STR they receive, resulting in very significant annual administrative costs (both for FIUs and the financial sector). The cost for such blanket requests is illustrated by the sample table in Annex 7 (ranging from approximately. €94 000 to €245 000 000 per year).

Improvements in dealing with the lack of access or delayed access by FIUs to information on the identity of holders of bank and payment accounts may come from more Member States putting in place automated mechanisms at national level allowing for timely access to such information. As a consequence, the traceability of criminal and terrorist financing flows, both nationally and cross border, could also be facilitated and increased. However, it cannot be assumed that uncoordinated action at Member State level would produce sufficient effects, as this depends on the level of commitment across all Member States. Weak spots, that can be exploited by criminals and terrorists to channel their funds in and out the EU financial system, will remain in the EU. 3. EU right to act and subsidiarity The legal basis of the initiative will be article 114 TFEU. This initiative aims at providing a harmonised approach to swiftly strengthen the EU's existing framework for the prevention of ML and, in particular, TF on a limited number of identified subjects. The problems related to the effective detection of criminal and terrorist financing flows have a cross-border dimension. An ineffective AML/CFT framework in one Member State may be exploited by criminals and have consequences on other Member States. It is therefore important to have a harmonised framework at EU level. The FATF is currently also examining what further action can be taken to strengthen the fight against TF. However, this work will take time and even if this leads to a change in the FATF standards (which is not certain), those standards would not be legally binding. Consequently, if the FATF were to modify its standards, these would still need to be translated into EU law and aligned with the existing provisions of the 4AMLD (which in itself constitutes a transposition of the current FATF standards). As massive flows of illicit money and TF can damage the stability and reputation of the financial sector and threaten the internal market, any measures adopted solely at national level could have adverse effects on the EU Single Market, and result in fragmentation. This is particularly the case with virtual currencies where there is currently no European consistent approach of this phenomenon (see Annex 5). The measures taken by Member States are heterogeneous, in their definitions of what virtual currencies are (units of accounts/financial instruments for Germany, scriptural money for Luxemburg, means of payments for Sweden …) as well as in the requirements (authorisation, registration, banking or payment license) which should apply to those providers engaged in VC exchange. This continued trend would lead to regulatory arbitrage. Moreover, some planned measures are not sufficiently addressing the identified problems leaving major market players (such as custodial wallet providers) outside of the regulatory scope. In the area of prepaid cards, the temptation for Member States will be between suppressing all CDD exemptions for prepaid cards, which in some circumstances might give rise to issues of proportionality and necessity, and adopting a varying range of supplementary national measures for prepaid cards to qualify for an exemption. That approach would undermine the Single Market for those instruments. With regard to enhanced CDD measures towards high risk third countries, differences in Member States approaches and practices can lead to gaps and discrepancies in the management of business relationships involving high risk third countries, thus allowing criminals and terrorists to exploit potential loopholes or take advantage of more lenient legislation through regulatory arbitrage, in order to channel their funds in and out the EU. In the area of FIUs it cannot be assumed that uncoordinated action at Member State level would produce sufficient effects, as this depends on the level of commitment across all Member States: (i) the survey conducted under this impact assessment shows that – despite the recommendation formulated in recital 57 of the 4AMLD - not all Member States are planning to put in place centralized registries or mechanisms enabling the identification of holders of bank and payment accounts, and (ii) the clarifications provided by the FATF on the interpretation of the standards regarding the powers of FIUs are currently still not shared by certain Member States. This is also why Member States, at the JHA Extraordinary Council of 20 November 2015 and at the ECOFIN Councils of 3 December 2015 and 12 February 2016, besides the political message they sent about their unity in the fight against terrorism and terrorist financing, supported the need for action at European level, calling on the Commission to act swiftly. As a result, those Member States that were considering revising their national AML/CFT legislation decided to stop their work and rather wait for the coordinated European response. The European level is seen as the proper one by Member States themselves in terms of effectiveness and efficiency. Finally, it is also to be highlighted that a strongly integrated EU legislation in the field of AML/CFT will also allow the EU to more effectively contribute to the standard-setting process in the relevant international fora (such as for example in the FATF, MONEYVAL,…).

4. Policy objectives General objective prevent ML and TF by more effective detection of criminal and terrorist financing flows

Specific objectives improve the detection of suspicious transactions coming from or going to high-risk third countries through more legal certainty for obliged entities as regards the ECDD measures which need to be applied protect the financial system of the EU internal market from ML/TF risks through a global EU response to threats posed by high-risk third countries improve the detection of suspicious virtual currency transactions and increase the transparency of such transactions by linking them to identities reduce the misuse of anonymous prepaid instruments for the purpose of ML/TF improve FIUs' access to – and exchange of - information held by obliged entities improve swift access by FIUs to relevant information on the identity of holders of bank and payment accounts avoid (i) the use of blanket requests that are costly and delay the collection of such information, or (ii) the non-action of FIUs linked to lack of efficient mechanisms to collect the information 5. Policy options 5.1. Option 1: Maintaining the status quo See sections regarding the size of the problem/Baseline scenario. 5.2. Option 2: Non-regulatory option A mapping exercise is currently being conducted within the FIU Platform to identify practical obstacles to access to, exchange and use of information as well as operational cooperation. Consequently, the option of an EU FIU assisting and supporting Member States FIUs was discarded in the current impact assessment, pending the result of this mapping exercise. In addition to this, the Commission is also conducting a supranational assessment of money laundering and terrorist financing risks (as foreseen under the 4AMLD), which could lead to the formulation of Recommendations to Member States. The Commission is also deepening its engagement within international fora dealing with counter-terrorist financing in order to enhanced the need for cooperation and exchange of information on this strategic field. In particular, the Commission is closely involved in the implementation of the FATF strategy on combatting terrorist financing. Regarding prepaid cards, card schemes have the ability to impose through contractual arrangements specific AML/CTF obligations on the prepaid card issuers they work with. See Annex 9 for more details on the non-regulatory options. 5.3. Option 3: Regulatory options A regulatory option implies a legislative modification of the existing AML/CFT framework. Legislative options, to address the five specific objectives can be summarised as follows:

5.3.1 Improving the effectiveness of EU policy for high-risk third countries via a harmonised EU approach for enhanced due diligence measures to be applied by obliged entities 5.3.1.1 Option A – to provide a prescriptive list of enhanced customer due diligence measures and require obliged entities to apply at least all of them when dealing with high-risk third countries designated by the Commission This option will consist in establishing an EU list of ECDD measures that should be applied by obliged entities to enhance the monitoring of financial transactions involving high-risk third countries listed by the Commission. This list of ECDD measures would rely on the seven measures already provided by FATF recommendations (see point 2.1.1) and already well known by obliged entities and Member States. They will consist in (i) requiring additional information on the customer, (ii) the source of funds, (iii) the intended nature of the business relationship and (iv) the reasons for the intended or performed transaction, together with (v) the approval of senior management to commence or continue the business relationship, (vi) the conducting of enhanced monitoring of the business relationship (such as increasing the number and timing of controls applied, and selecting patterns of transaction that need further examination) and (vii) the requirement that the first payment shall be carried out through an account in the customer's name with a bank subject to similar CDD standards. In addition, this option would require obliged entities to apply all these ECDD measures to business relationships they conduct with high-risk third countries. The ECDD measures will be considered as a minimum set of requirements imposed by all Member States. Obliged entities and Member States would still be allowed to provide, at national level, complementary ECDD measures, in addition to the minimum set of requirements mentioned above. 5.3.1.2 Option B – to provide a prescriptive list of enhanced customer due diligence measures and an illustrative list of counter-measures, and require obliged entities to apply at least all the ECDD measures and/or, where appropriate, one of the countermeasures when dealing with high-risk third countries designated by the Commission This option is based on option A combined with a list of counter-measures. In accordance with the FATF recommendations, counter-measures are currently applied to two countries (Iran and North Korea) as they present serious strategic AML/CFT deficiencies (see list of countermeasures in Annex 4). While the list of ECDD measures would remain mandatory and common to all EU Member States, the list of counter-measures would be presented as illustrative only and mainly bring legal certainty as regards the nature of such counter-measures. These counter-measures would be primarily applicable to high-risk countries identified in FATF recommendations (see point 2.1.1. footnote 7), but could be extended to other countries listed by the Commission where appropriate. Under this option, obliged entities and Member States will still be allowed to provide, at national level, complementary ECDD measures, in addition to the minimum set of requirements mentioned above. 5.3.1.3 Option C – to provide a prescriptive list of enhanced customer due diligence measures and an illustrative list of counter-measures, and require obliged entities to apply all of the ECDD measures and/or, where appropriate, one of the countermeasures when dealing with high-risk third countries identified at EU, national and sectorial level. This option is based on option B but would apply not only to the financial transactions involving high-risk third countries listed by the Commission, but also to high-risk third countries identified by the Member States in their national legislation and by obliged entities themselves in the context of their sectorial risk assessments. Under this option, the abovementioned list of seven ECDD measures will apply to all high-risk third countries identified, whatever the source of this identification. 5.3.1.4 Stakeholder views on the problem and options

Member States were consulted about the opportunity to put in place a harmonised and coordinated EU policy towards high-risk third countries. 23 Member States agreed that there was a need for a minimum degree of harmonisation in this field. Only three Member States disagreed with the approach suggested under options A and B, arguing that it would go against a risk-based approach. 21 organisations were consulted. Some of their members already implement option A, given that they apply the whole range of above-mentioned ECDD measures to all of the high-risk third countries identified by FATF (in particular). For those who do not apply this global approach, option A is recognised as beneficial as it will give clearer guidance on how to manage business relationships with high-risk third countries and will enhance their capabilities to verify the data provided by a customer to detect suspicious activities. From a technical point of view, stakeholders saw it as an improvement for the risk management processes, in particular because the process will be automated and will limit manual checking. A harmonised approach was also viewed as a way to minimise operational and reputational risk and achieve a more consistent interpretation of ECDD obligations, ensuring a level-playing field. Concerning the implementation of counter-measures, it seems that obliged entities do not properly make use of counter-measures within the meaning of the FATF recommendations. On the basis of the feedback received from the written consultation, while an important number of obliged entities indicate that they apply counter-measures, it appears that only a few of them apply counter-measures falling under the FATF definition (such as limitation of transactions, termination of business relationship etc.). In other cases, so-called "counter-measures" are much more similar to complementary ECDD or only ECDD. Obliged entities see in option B an opportunity to bring legal clarity to the issue. Some obliged entities expressed concern about cost implications (IT costs) and the potential administrative burden caused by overly prescriptive rules. They insisted on the need to combine the intended coordinated policy with the principle of the risk-based approach. For this reason, both private sector representatives and Member States were not supportive of option C, which was considered to be excessive and not to reflect the principle of a risk-based approach. While the EU list of high-risk third countries could lawfully trigger the same level of ECDD measures all over the EU, obliged entities consider that their own list of high-risk third countries still benefits from applying a risk-based approach, with appropriate customer due diligence measures depending on the specific national or sectorial contexts. In the specific case of money value transfers services, only 3 contributions were received and reflected very different views: -two representatives of the sector indicated that the lack or minimum harmonisation of AML/CFT rules involved managing one-off regulatory requirements which are time-consuming and costly. A greater harmonisation of AML/CFT rules across the EU would also contribute to reducing the risks of misuse by increasing the levels of compliance. A harmonised regime was perceived as improving the ability to limit risk, in particular for activities that are conducted in different jurisdictions. One actor, in particular, indicated that its current ECDD program with high risk countries was already very robust and in line with the Commission's harmonisation plan, and that no major impact was expected. -one representative of this sector, while recognising that the impact on its business would be very limited, indicated a preference to stick to the risk-based approach, because of the potential risk that disproportionate rules may hamper legitimate remittance flows to high-risk jurisdictions. When asked about the cost implications of a harmonised approach on ECDD measures, obliged entities were not able to provide concrete information, since they do not include such parameters in their internal auditing systems. 5.3.2 Improving the detection of suspicious virtual currency transactions and increasing the transparency of such transactions by linking them to identified persons Legislative options to reduce VCs' anonymity could range from light options (such as imposing few requirements on one or various market players in order to lift anonymity at a designated point in time), to a total ban of the activity if considered too high a risk for criminal purposes. Reducing or lifting VC's anonymity can be done through targeting three players within the virtual currency ecosystem: users, exchange platforms and custodial wallet providers. The remaining major stakeholder (so-called 'miners'), are more difficult to reach as most of them are located in China (see discarded options). The three above options to tackle anonymity will therefore be examined on a stand-alone basis as well as in combination, as several market players can be targeted simultaneously. The objective is to reduce anonymity as much as possible and targeting only one category of players may not be sufficient. 5.3.2.1 Targeting users Users include consumers and retailers using VCs as an investment product or as a means of exchange for buying/selling products or services. They transact using VC addresses. Their identities are never exchanged online which makes transactions anonymous and opaque to law enforcement authorities.

Option A - lift VCs' anonymity through the mandatory registration of users Under this option, different levels of anonymity could be envisaged. If registration is mandatory, it could link registration and access to the payments network (for example by making use of Legal Entity Identifiers (LEI) mandatorily for VC transactions). Option B – reduce VCs' anonymity through the voluntary self-registration of users This option would offer users a clearly defined voluntary channel to 'self-identify' (e.g. to the national FIU), or some other national or international bodies/registries such as the European Banking Authority). Anonymity in payments could still be upheld (e.g. using public key infrastructures) but authorities combating financial crime could rapidly verify identities of registered users. 5.3.2.2 Targeting exchange platforms In order to acquire VCs, VC exchange platforms are a major gateway. Requesting exchange platforms to collect identities implies submitting them to one of the two following options. Option C - lift VCs' anonymity through the regulation of exchange platforms under the 4AMLD This option would make VC exchange platforms obliged entities under 4AMLD, requesting them to verify the identity of their customers and report suspicious transactions that may involve ML or TF to FIUs. In practice, the obligations that would fall on exchange platforms under the 4AMLD are the ones described in Article 11 of the 4AMLD which mainly consist in applying CDD measures when establishing a business relationship, when carrying out an occasional transaction above €15 000 or when there is a suspicion of ML or TF regardless of any derogation. Customer due diligence measures consist in identifying the customer and verifying his identity on the basis of documents, data or information obtained from a reliable and independent source, identifying the beneficial owner, assessing and, as appropriate, obtaining information on the purpose and intended nature of the business relationship and conducting ongoing monitoring of the business relationship including scrutiny of transactions undertaken throughout the course of the relationship. Option D - lift VCs' anonymity through the regulation of VC exchange platforms under the revised Directive on Payment Services (PSD2)

PSD2 goes further than 4AMLD. On top of the AML/CFT requirements which it automatically imposes, by reference to the 4AMLD, on the entities that fall under its scope, the PSD2 also establishes a licensing obligation for regulated entities, minimum capital requirements, safeguarding requirements, and consumer protection rules. Submitting exchange platforms to PSD2 would automatically bring exchange platforms under 4AMLD (option C) but would also submit them to broader consumer protection rules, licensing requirements and safeguarding requirements. The VC exchange platforms would be regulated as any other payment service provider and will gain a higher degree of legitimacy as would the virtual currency market in itself. Having recourse to PSD2 would (i) require that VC currency exchange platforms comply with many other provisions of PSD2 (licensing, capital requirements, information, etc) which they would need more time to conform to, and (ii) would go beyond the current focus of the IA on strengthening the fight against terrorist financing. 5.3.2.3 Targeting custodial wallet providers Contrary to software wallet providers (which provide applications or programs running on users' hardware (computer, smartphone, tablet…) to access public information from a distributed ledger and access the network), custodial wallet providers include the custody of the user’s public and private key (fully or shared with one or more customers). Compared to traditional financial services, custodial wallet providers are quite similar to financial institutions holding bank or payment accounts. With a growing network of acceptance, the need to "cash-out" of VCs and exchange them for FCs might decrease with time. This trend would increase further if VCs became less volatile. Option E - lift VCs' anonymity through the regulation of custodial wallet providers under 4AMLD Like option C, option E would imply that custodial wallet providers perform CDD and report suspicious transactions. Option F - lift VCs' anonymity through the regulation of custodial wallet providers under PSD2 Similar to option D, using PSD2 for custodial wallet providers would mean bringing custodial wallet providers automatically under 4AMLD and introducing broader consumer protection rules, safeguarding of funds etc. via their regulation under PSD2. 5.3.2.4 Stakeholder views on the problem and options

While consumers expressed some concern in reducing the anonymity of VCs, they concurred with the need to have 'gate-keepers' that manage the control of users' identities when needed (options C, D, E and F). All Member States were consulted and 27 supported option C with one exception having a preference for option D. Option E was also envisaged by some Member States even though not presented in the questionnaire. Any option involving PSD2 (Options D and F) would not receive the support of most Member States – they considered that this would give too much legitimacy to VCs and drive consumers to believe VCs are safe and sound products in contrast to the list of risks enumerated in the EBA Opinion, which is referred to in Annex 5. The EBA in its Opinion considered that a welcomed first step in regulating the virtual currency sphere would consist in reducing the risks linked to anonymity by bringing VC currency exchange platforms in the scope of the 4AMLD (equivalent to option C). EBA however also suggests a long term approach that would aim to provide a full regulatory regime for virtual currencies. Finally, the VC industry was generally favourable to legislation that would primarily give them more legitimacy and, secondly, would help to differentiate between players that make the most concerted efforts to track criminals from bona-fide users. Options A and B were only tested with some relevant stakeholders (i.e. consumers/users, experts), with a preference emerging for option B. 5.3.3 Reducing the misuse of anonymous prepaid instruments by further reducing the exemption regime for anonymous prepaid cards under the 4AMLD A number of options have been considered to further restrict the exemption regime for anonymous prepaid cards under the 4AMLD. Some of these options are of a legislative nature, others are non-regulatory (e.g. targeted geographical or sectoral restrictions to the use of prepaid cards) and are explained in Annex 9. Some options have been subject to an impact assessment, others have been discarded at an earlier stage and are referred to in Section 7 as well as in Annex 8.The following options have been considered in more detail and their impact assessed in Section 6. These options all have for objective to reduce the current exemption perimeter for prepaid cards, ranging from the total suppression of existing exemptions, to a partial suppression when cards are used online and/or a lowering of the threshold above which CDD has to be conducted. The different options are assessed in terms of effectiveness and efficiency, considering market effects both on the supply side (card issuers, distributors) and the demand side (consumers, notably the unbanked people). Options B and C can be combined. 5.3.3.1 Option A - Suppressing all the existing exemptions of 4AMLD for prepaid instruments (i.e. suppression of Article 12 of the 4AMLD) All anonymous prepaid cards, reloadable or not, would become subject to CDD (identification and verification of the identity of the cardholder) from the first euro. Identification of the cardholder and registration of their identity would have to be carried out from the outset, either by the distributor or by the issuer upon activation of the card. It should be noted that at least 3 Member States have already chosen this option under the 3AMLD and that 6 or 7 Member States are envisaging it in the context of the implementation of the 4AMLD into national law. 5.3.3.2 Option B - Eliminating anonymity for the online use of prepaid cards (reloadable or not) Under this option, the current €250 threshold for use of prepaid cards in face-to-face situations would remain as it is under the 4AMLD. However, there would be no threshold for the online use of those cards. This option leaves the current exemption of Article 12 of the 4AMLD unchanged as far as prepaid cards are used in face-to-face situations. In non face-to-face environments (where cash cannot be used), prepaid cards would only be able to be used after the cardholder had been subject to appropriate CDD measures (i.e. verified identification). This option is less stringent than option A as it limits the suppression of the card exemption to the sole online use of the prepaid card. The view is that cardholders would be more inclined to go through a CDD process online as this would be lumped up with the activation of the card for online use. CDD can be conducted at a distance by the card issuers with the assistance of CDD service providers which would scan online the ID document presented by a cardholder and having its authenticity verified against different databases, and then verify the address by cross-checking data with bank account , phone or mobile number information. This is also a sector which FinTechs are investing in, including in trying to leverage the e-IDAS regulation. Within the next 3 to 5 years, the cost of performing CDD at a distance is likely to drop significantly, as that market develops. 5.3.3.3 Option C - Minimising anonymity by lowering the €250 thresholds both for reloadable and non-reloadable prepaid cards

Markets have not made full use of the €250 threshold for non-reloadable prepaid cards, as most cards of that type sold in retail stores carry values ranging from 10, 20, 50 to 100/150 euros (or £100). This option would propose halving the current threshold in the 4AMLD (to €125) or a return to the initial threshold of the 3AMLD (€150). This option will have no immediate effect for non-reloadable cards as the market offer is in its majority already below this threshold. It will however have a long term in possibly reducing that market segment under normal inflation conditions. This option will however directly affect reloadable prepaid cards as CDD requirements will cut in at an earlier stage of use of the card. 5.3.3.4 Option D - Minimising anonymity by applying simplified customer due diligence from the 1st euro and verifying identity at a later stage, e.g. upon the crossing of a threshold, e.g. €250 Under this Option, simplified CDD would be applied at the time of the purchase of the prepaid card. The buyer would be required to show an ID document (as, for example, is the case for the purchase of tobacco or alcohol to avoid minors having access to such products). The formal verification of the buyer's identity would take place at a later stage, e.g. after some usage of the card, or upon the crossing of a threshold. This option, based on a suggestion from industry is inspired by the simplified due diligence approach foreseen under Article 15 of the 4AMLD. However, its blanket application to all anonymous prepaid cards would raise questions of proportionality and effectiveness. 5.3.3.5 Option E – Lowering the thresholds under the 4AMLD for non-reloadable cards and requesting the application of CDD (simultaneous identification and verification of identity) for reloadable cards from the first euro Contrary to Option B where the emphasis is put on the use of the card (offline vs. online), under this option, the requirements vary according to the nature of the card. This option consists in lowering the existing threshold for non-reloadable cards from €250 to €150, and in suppressing the current threshold for reloadable cards, which are the closest proxy to a debit card or a credit card (which are currently already subject to CDD) and for which there is some logic in applying similar CDD requirements in terms both of timing and intensity. 5.3.3.6 Stakeholder views on the problem and options Member States were fairly divided on the various options available. About half of the Member States supported a mandatory online identification when activating a prepaid card. There was no fixed view on the thresholds to apply for CDD for both reloadable and non-reloadable prepaid instruments. Consumer organisations were of the view that a decision on these matters was the responsibility of public authorities. They nevertheless expressed the need to preserve the financial inclusion dimension offered by prepaid cards. They therefore expressed a preference for the options that would present value in limiting risks whilst allowing for continued provision of services to the unbanked. Industry was not in favour of any change in legislation, considering that the 4AMLD still to be transposed into national law is much stricter than the 3AMLD in respect of general purpose reloadable cards. The main concerns for card issuers is to perform CDD as late as possible in the lifetime of a prepaid card, or at least not before the cardholder has had time to appreciate the instrument, is therefore likely to use it repeatedly, and even to upgrade the card in its functionalities (moving for instance from a non-reloadable card to a reloadable card). This repeated use of the card in many business models is a source of revenue generation which will make the absorption of CDD costs easier for card issuers. This approach, of course, creates an inherent tension with a public policy whose goal is to lift or reduce anonymity as soon as possible and hence to have CDD being performed as early as possible. Prepaid card issuers are of the view that Option A might eliminate non-reloadable prepaid cards from the market or at least their distribution via the retail channels (supermarkets, newsagents, tobacconists), as these products are low value, low margin ones and could with difficulty absorb CDD costs. As a matter of fact, the non-reloadable prepaid segment is regulatory driven, because issuers prefer to eschew CDD and only sell prepaid cards with nominal values below threshold. Consumers are concerned that the unbanked part of a population might be deprived of a useful payment tool that gives them access to e-commerce and cheaper products and services. This concern is at least partly mitigated by the Payment Account Directive which foresees that any person lawfully residing in the EU can have access to a basic bank account equipped with a debit card. Option B is a less stringent variation of Option A. It better takes into account the wish of consumer organisations that the unbanked continue to have access to general purpose prepaid instruments, as the online performance of CDD will not affect distribution channels and notably retail distribution. Card issuers, notably those who may have a range of products concentrated on the low value non-reloadable cards, are likely to continue challenging the suppression of the CDD exemption for the online use of such cards, as it will mean that they will have to absorb CDD costs upfront, unless they charge an upfront fee to the cardholder. Following discussions with market players with regard to Option C, it appeared that the AML/CFT legislation through the setting of CDD exemption thresholds shaped the market for non-reloadable cards. In practice, no such cards can be found in the market with a value in excess of €250. More surprisingly, the core market for non-reloadable cards is represented by cards with values ranging from €25 to €150 (or up to £100). The lowering of the current AML/CFT threshold, for instance from €250 to €125 or €150, would therefore leave prepaid card issuers unaffected, as market needs for non-reloadable cards could still be served without having to perform CDD (and consequently having to support related costs). Re-aligning the 4AMLD threshold for non-reloadable prepaid cards on that of the original 3AMLD (i.e. €150) will have no effect on today's market but will bite in the future in an inflationary context.

The main impact therefore concerns reloadable general purpose prepaid cards, which are the closest means of payment to a debit card linked to a payment account (the latter is regulated under today's AML/CFT requirements subject to a full CDD). Option D is the one favoured by industry. Its additional requirements are only marginal compared to those defined by the current 4AMLD. Option E is a less stringent alternative to Option B. It is therefore more palatable to industry than Option B as reloadable cards are – by definition - more likely than non-reloadable cards to be used many times and therefore offer better prospects in terms of CDD cost absorption. 5.3.4 Improving FIUs' access to – and the exchange of – information held by obliged entities 5.3.4.1 Option A – aligning EU law with the latest international standards on AML/CFT in this field and clarifying FIU powers Under this option, the 4AMLD would be amended to clarify that an FIU shall obtain available information from any obliged entity in the event of a suspicion relating to ML/TF, even if this obliged entity did not previously report an STR. Such an approach is in line with international standards and the interpretation on the methodology agreed by FATF in October 2015. It follows that this approach shall also be applied when an FIU receives a request from another FIU to obtain additional information from an obliged entity. Similarly, the 4AMLD would be clarified by ensuring that obliged entities should provide all necessary information directly to the FIU at its request. This is also consistent with the 4AMLD provisions on the operational independence and autonomy of FIUs. Obtaining information from obliged entities is part of the core business of their analysis function – and hence would be considered as a task to be performed directly by an autonomous FIU. 5.3.4.2 Option B: Establishing a single European FIU to receive, analyse and disseminate results to national competent authorities Under this option, the EU would establish a single European