EUROPEAN COMMISSION Brussels, 24.7.2019 SWD(2019) 650 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL

on the assessment of the risk of money laundering and terrorist financing affecting the internal market and relating to cross-border activities {COM(2019) 370 final}



Contents 1.INTRODUCTION 2.METHODOLOGY FOLLOWED FOR THE SUPRANATIONAL RISK ASSESSMENT 3.OUTCOMES OF THE SUPRANATIONAL RISK ASSESSMENT ANNEX 1 – RISK ANALYSIS BY PRODUCT/SECTOR Cash products 1. Cash couriers 2. Cash intensive business 3. High value banknotes 4. Payments in cash 5. Privately owned ATMs Financial sector 1. Deposits on accounts 2. Institutional investment sector — Banking 3. Institutional investment sector — Brokers 4. Corporate banking sector 5. Private banking sector 6. Crowdfunding 7. Currency exchange

8. E-money sector 9. Transfers of funds 10. Illegal transfers of funds — Hawala 11. Payment services 12. Virtual currencies and other virtual assets 13. Business loans 14. Consumer credit and lowvalue loans 15. Mortgage credit and highvalue asset-backed credits 16. Life insurance 17. Non-life insurance 18. Safe custody services Non-financial products 1. Creation of legal entities and legal arrangements 2. Business activity of legal entities and legal arrangements 3. Termination of legal entities and legal arrangements 4. High value goods – artefacts and antiquities 5. High value assets – Precious metals and precious stones 6. High value assets – other than precious metals and stones 7. Couriers in precious metals and stones 8. Investment real estate

9. Services provided by accountants, auditors, advisors, and tax advisors 10. Legal services from notaries and other independent legal professionals Gambling sector products 1. General description of the gambling sector 2. Betting 3. Bingo 4. Casinos 5. Gaming machines (outside casinos) 6. Lotteries 7. Poker 8. Online gambling Non-profit organisations 1. Collection and transfers of funds through a non-profit organisation (NPO) Professional sports 1. Investments in professional football and transfer agreements relating to professional football players Free-trade zones 1. Free ports Citizenship/residence 1. Citizenship investment programmes and investor residence schemes ANNEX 2 – EU legal framework on anti-money laundering and counter terrorist financing

ANNEX 3 – GLOSSARY ANNEX 4 – BIBLIOGRAPHY 1.INTRODUCTION The Financial Action Task Force (FATF) recommends that countries conduct risk assessments that take account of their capacity and experience in each sector subject to requirements on anti-money laundering and countering Terrorist Financing (AML/CFT). They should identify, assess and understand money laundering (ML) and terrorist financing (TF) risks, and take commensurate preventive measures. Acknowledging the importance of a supranational approach to risk identification, Directive (EU) 2015/849 (4th Anti-money Laundering Directive) mandates the Commission to conduct an assessment of specific ML/TF risks affecting the internal market and relating to cross border activities. The Commission published its first supranational risk assessment in 2017. Article 6(1) of the 4th Anti-money Laundering Directive also requires the Commission to update its report every two years (or more frequently if appropriate). The current exercise updates the information in the 2017 report, analyses the present ML/TF risks and proposes comprehensive action to address them. It assesses the degree to which the Commission’s recommendations for mitigating measures have been implemented and evaluates the remaining risks, taking into account new products and sectors. The details of the risk analysis for each sector and product are presented in Annex 1. 2.METHODOLOGY FOLLOWED FOR THE SUPRANATIONAL RISK ASSESSMENT This SNRA follows the methodology used for the 2017 SNRA, which provides a systematic analysis of the money laundering and terrorist financing risks linked to the methods used by perpetrators. The aim to identify circumstances in which services and products in a given sector could be abused for ML/TF purposes, without passing judgement on the sector as a whole. This SNRA focuses on vulnerabilities at EU level, in terms of both the legal framework and its effective application. It presents the main risks for the internal market in a wide range of sectors and the horizontal vulnerabilities that can affect those sectors. This report sets out mitigating measures that should be taken at EU and national level to address the risks and makes a number of recommendations for the various actors concerned. It does not prejudge the mitigating measures that some Member States have taken or may decide to take in response to national ML/TF risks. The mitigating measures in this report should therefore be considered a baseline that can be adapted, depending on the national measures already in place. Under Article 6(4) of the 4th Anti-money Laundering Directive, if Member States decide not to apply any of the previous SNRA recommendations, they should notify the Commission of their decision and provide a justification for it (‘comply or explain’). No such notification was received to date by the Commission. Process In preparing this report, the Commission carried out a broad consultation exercise with all relevant stakeholders, in the course of which it addressed various sectors through targeted questionnaires and dedicated workshops. The Commission consulted the Member States by means of a questionnaire in July 2018, with enclosures on: -national mitigating measures; -templates for financial and prosecution ML/TF data; and -emerging risks. By the end of 2018, the Commission had received 23 replies. Subsequently, Member States were further consulted in dedicated meetings of the Expert Group on Money Laundering and Terrorist Financing on 10 December 2018 and 11 February 2019.

In November-December 2018, the Commission held four workshops with privatesector stakeholders, one with representatives of financial institutions, two with ‘designated non-financial businesses and professions’ (DNFBPs) and one with civil society (NPOs) and academics. A second phase of this round of meetings took place in January 2019. The oral input from the private sector was complemented by 15 written replies. The Commission also consulted other regulatory agencies and authorities, such as Europol and the European supervisory authorities (ESAs). The purpose of this broad consultation was twofold: to follow up on the recommendations made in the 2017 and to update the supranational risk assessment. Finally, given the evolving nature of ML/TF threats and vulnerabilities, the supra-national risk assessment needs to take an integrated approach to assessing the effectiveness of national AML/CFT arrangements. In order to monitor their compliance with EU requirements, their implementation and their preventive capacity, the Commission takes due account of national risk assessments (NRAs) produced by the Member States to ensure the proper identification and mitigation of specific national risks. Individual sectors are responsible for a third layer of risk assessment that takes account of risk factors, including those relating to specific customers, countries, products, services, transactions and delivery channels. These three layers (supranational, national and sectoral) of risk assessment, along with risk mitigation, where appropriate feed into a comprehensive awareness and analysis of ML/TF risks in the EU in which different layers complement each other and are equally relevant. The Commission draws on and complements national and sectoral assessments by assessing risks that affect the Union internal market and are related to cross border activities. The legal framework The risk assessment needs to provide a snapshot of the money laundering and terrorist financing risks and requires a clear-cut timing. The assessment of risks affecting the EU was carried out at a time when the relevant legislative framework was still the 4th Anti-money Laundering Directive. Even though the 5th Anti-Money Laundering Directive was adopted, its transposition has not been completed yet. Therefore the supranational risk assessment is based on the EU legislation implemented at the time of the assessment. This is particularly important to stress since some sectors were not, or only limitedly, covered by the obligations in the 4th Anti-money Laundering Directive. Therefore the risk level may be assessed differently for those Member States having already applied the stricter regime. Nevertheless, changes brought by the 5th Anti-Money Laundering Directive to be transposed by January 2020 have been anticipated when defining the new mitigating measures. While the main EU instrument is the Anti-money Laundering Directive, the Union’s anti-Money Laundering and Countering Terrorist Financing legal framework is complemented by other EU legislation. An indicative list is attached in Annex 2. In addition, an index of abbreviations used in the risk analysis is attached in Annex 3 and a bibliography in Annex 4. 3.OUTCOMES OF THE SUPRANATIONAL RISK ASSESSMENT This supranational risk assessment focuses on the risks associated with each relevant sector and assesses the recommendations made to address the concerned risks. The Commission identified 47 products and services that it regards as potentially vulnerable to ML/TF risks at the level of the internal market, up from 40 in the 2017 assessment. These 47 products and services concern 11 sectors, including: -the 10 sectors or products identified in the 4th Anti-money Laundering Directive, i.e. credit and financial institutions, money remitters, currency exchange offices, highvalue goods and assets dealers, estate agents, trust and company service providers (TCSPs), auditors, external accountants and tax advisors, notaries and other independent legal professionals, and gambling service providers; -1 category of various different products not covered in the 4th Anti-money Laundering Directive, but considered relevant for the risk assessment, that encompasses cash-intensive businesses, virtual currencies, crowdfunding and non-profit organisations. This category also covers certain informal means, such as those used by Hawala and other informal value transfer service providers; and -four new products/services that were not assessed in the 2017 report, namely privately owned automated teller machines (ATMs), professional football, free ports; and investor citizenship and residence schemes (‘golden passports/visas’). In addition, this report contains an enhanced analysis of some services that were assessed in the 2017 report, namely FinTech; virtual currency exchange platforms and wallet providers; and bank accounts of non-residents. The descriptions and the assessments of many of the products/sectors analysed in the 2017 report have not been fundamentally modified over the last two years, while the revised Union AML/CFT legal framework has been significantly updated since 2017.

This assessment updates the information in the 2017 report, finetuning it in several areas (such as nonprofit organisations /NPOs), and updating figures and information sources. Also, this assessment is updated to include reference to the current Union AML/CFT legal framework, taking into account that most of the recommendations for mitigating measures in the 2017 SNRA are now included in the 5th Anti-money Laundering Directive. Moreover, special attention was paid to Member States’ implementing measures of the 4th Anti-money Laundering Directive, which had to be transposed by July 2017. Other mitigating measures recommended in the 2017 SNRA are currently accounted for by recent EU legislation such as Directive on company law or the new Cash Control Regulation. ANNEX 1 – RISK ANALYSIS BY PRODUCT/SECTOR This SNRA has followed a specific methodology involving systematic analysis of the ML/TF risks linked to perpetrators’ methods. The aim is to identify the circumstances under which the services and products a given sector provides could be abused for ML/TF purposes (without passing judgment on a sector as a whole). It is based on Directive (EU) 2015/849 (4th Anti-money Laundering Directive), which was the legislation in force at the time of the analysis. The 5th Anti-money Laundering Directive (Directive (EU) 2018/843) which amended the 4th Anti-money Laundering Directive, is considered part of the mitigating measures. Each risk is rated for threat and vulnerability. The ratings are on a scale from 1 to 4, as follows: 1) low significance (value: 1) 2) moderately significant (value: 2) 3) significant (value: 3) 4) very significant (value: 4) The ratings were used only to summarise the analysis. They should not be considered in isolation from the factual description of the risk.

Cash products 1. Cash couriers Product Cash couriers / cross external border cash movements General description of the sector and related product/activity concerned This assessment covers the supranational risks – i.e. cash entering/leaving the European Union at the EU external borders. The evolution of the international standards to control cross-border flows of cash, the evaluation of the extent to which this Regulation achieved its objectives, and the information received from Member States led the Commission to conclude that, while the overall performance of the Regulation was satisfactory, a number of areas should be strengthened to improve its functioning. In order to address these areas, and as part of the European Agenda on Security and Action Plan for strengthening the fight against terrorist financing, the Commission adopted a proposal for a new Cash Controls Regulation in December 2016. Following the legislative work with the European Parliament and the Council, the new Regulation (EU) No 2018/1672 was adopted in October 2018 and will enter into application in June 2021. Currently in application, the Cash Control Regulation (Regulation (EU) 1889/2005)establishes a uniform EU approach towards cash controls based on a mandatory declaration system. If a natural person entering or leaving the EU (including transiting) transports cash of a value of EUR 10 000 or more, he/she must declare these funds. The EUR 10 000 threshold is considered high enough not to burden the majority of travellers and traders with disproportionate administrative formalities. However, when there are indications of illegal activities linked with movements of cash lower than EUR 10 000, the collecting and recording of information related to these movements is also authorised. This provision was introduced in order to limit the practice of 'smurfing' or 'structuring', the practice of deliberately carrying amounts lower than the threshold with the intention to escape the obligation to declare (e.g. splitting the amount between different connected persons from a same group/family). Current rules on the movement of cash in and out of the EU have applied since 15 June 2007 and are an integral part of the EU's Anti Money Laundering and Terrorist Financing framework. The new Regulation updates these rules and complements the EU’s legal framework for the prevention of money laundering and terrorist financing set out in Directive 2015/849 as amended by Directive 2018/843. The new Cash Control Regulation, which will enter into application in 2021, improve the existing system of controls on cash entering or leaving the EU – the latest developments in international standards on combating money laundering and terrorism financing developed by the FATF will be reflected in EU legislation. Under the new Regulation, the definition of cash has been extended to cover not only currency and bearer negotiable instruments but also highly liquid commodities such as gold. The Regulation is also extended to cover cash that is sent by post, freight or courier shipment. In addition it enables Customs authorities to act on amounts lower than the declaration threshold of EUR 10 000, where there are suspicions of criminal activity while improving the exchange of information between authorities (Customs and Financial Intelligence Units) and Member States. The new legislation extends the obligation of any traveller entering or leaving the EU and carrying cash to a value of EUR 10 000 or more to declare it to the customs authorities. The declaration will be required irrespective of whether travellers are carrying the cash in person, in their luggage or means of transport. At the request of the authorities they will have to make it available to be checked. If the cash is sent by other means (“unaccompanied cash”), the relevant authorities will have the power to ask the sender or the recipient to make a disclosure declaration. The authorities will be able to carry out controls on any consignments, packages or means of transport which may contain unaccompanied cash. Member states will exchange information where there are indications that cash is related to criminal activity which could adversely affect the financial interests of the EU. This information will also be transmitted to the European Commission.

In addition the new Cash Controls Regulation provides in its Article 5 (4) that the risk assessments produced by the Commission and by FIUs should be taken into account by Customs authorities when establishing the common risk criteria framework for performing controls. The new regulation will not prevent member States from providing additional national controls on movements of cash within the Union under their national law, provided that these controls are in accordance with the Union's basic freedoms. Per year, on average 90 000 cash declarations are submitted, representing a total amount of around EUR 52 million. Customs controls detect 12,000 cases where cash was not declared representing around EUR 345 million per year. General comment This risk scenario is intrinsically linked to use of/payment in cash and to high value denomination banknotes risk scenario. Criminals or terrorist financiers who generate/accumulate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where one has easier access to placement in the legal economy. The characteristics of such locations are a predominant use of cash, more lax supervision of the financial system or stronger bank secrecy regulations. It may also be used by terrorists to transfer rapidly and safely funds from one location to another, including by using cash concealed in air transit. Cash couriers may use air, sea, road or rail transport to cross an EU external border. In addition, cash may be moved across external borders unaccompanied such as in containerised or other forms of cargo, or concealed in mail or post parcels. If perpetrators wish to move very large amounts of cash, often a valuable option is to conceal it in cargo that can be containerised or otherwise transported across borders. Perpetrators may also use sophisticated concealment methods of cash within goods which are either carried across the external border by a courier or are sent by regular mail or post parcel services. Although unaccompanied consignments tend to be smaller than those secreted within vehicles, or on the person of cash couriers, the use of high denomination banknotes can still result in seizures of significant value. Threat Terrorist financing The assessment of the TF threat related to cash couriers/unaccompanied cash movements shows that terrorist groups have made use of various techniques to move physical cash across the external borders, particularly in the case of larger organisations. This threat is particularly relevant for cash couriers from the EU to third countries. LEAs have seized large amounts of money in conflicts zones that was supposed to finance terrorist organisations. In addition, cases have been identified where (prospective) foreign terrorist fighters doubled as cash couriers to fund their travels and sojourn in conflict areas. These individuals typically carry lower amounts that are more difficult to detect and may not be subject to an obligation to declare incumbent on natural persons carrying EUR 10 000 Euro or more is cash. As it allows for anonymity, this modus operandi is perceived as attractive and fairly secure, despite still carrying some risks. That is the reason why this modus operandi shall also be considered in conjunction with the analysis of high denomination banknotes. The more high denomination banknotes are used, the easier the cash transportation is – although risks associated with acquiring high denomination notes (not readily available) may not outweigh the benefit of additional compactness. Cash transportation has been a recurring modus operandi for terrorist groups in Syria– although the average amounts carried by a foreign fighter leaving the EU may not be significant compared to locally available funds. The threat of cash transportation into the EU from a third country may also exist, in particular from countries exposed to TF risks or conflict areas (e.g. cash couriers from Syria, Gulf region, Russia into the EU have been reported). There are limited indications of high-value movements of cash into the Union (i.e. much in excess of the declaration threshold) for the purposes of terrorism financing. Cases have been identified concerning lower amounts and involving integration of cash amounts carried from third countries into the financial system/legal economy of the EU (analysed separately below). From a perpetrator risk-management perspective, sending cash through post or freight consignments, using multiple consignments each containing lower amounts presents a theoretically attractive option as there is no courier physically crossing the external border carrying the cash who could be intercepted. While customs controls may take place, these do not allow for the capture of all relevant data. Finally, perpetrators may also have an incentive to convert cash in other types of anonymous assets which are not subject to cash declarations (gold, prepaid cards - covered by separate analysed below). Conclusions: LEAs have gathered evidence that cash couriers are recurrently used by terrorist groups to finance their activities or fund FTF travels. Similarly to the analysis conducted on cash, the use by criminal elements or terrorist financiers of cash couriers present advantages since this modus operandi is easily accessible, with no specific planning or expertise required. In that context, the level of TF threat related to cash couriers is considered as very significant (level 4). Money laundering FATF Report: Money laundering through the physical transportation of cash (October 2015) Based on the working paper of the European Central Bank – consumer cash usage – a cross country comparison with payment diary survey data, the report noted that in the countries surveyed, between 46 % and 82 % of all financial transactions are conducted in cash, namely Australia (65 %), Austria (82 %), Canada (53 %), France (56 %), Germany (82 %) the Netherlands (52 %), and the United States of America (46 %).

With regard to an economy linked to transnational organised crime, the report pointed to physical transportation of cash across an international border, which is 'one of the oldest and most basic forms of money laundering' and is also used for terrorist financing. Although there is no reliable data on the amount of money ‘laundered’ in this way, the report estimated its volume to be between 'hundreds of billions and a trillion US dollars per year'. The report explained that the most frequently encountered and 'laundered' currencies are stable and widely used currencies such as the US dollar, the euro, the Swiss franc and the British pound, usually, with high denomination notes used. The report also highlighted that criminals exploit the existing cash declaration systems mechanisms, for example, by 'reusing cash declarations several times for the same purpose'. In the 2015 Europol report Why cash is still king?, law enforcement investigations confirm that cash, and in particular high denomination notes, are commonly used by criminal groups as a facilitator for money laundering. Operations themselves reveal huge sums of cash moved and stashed by criminals which are steadily invested and integrated in the legal economy in a multitude of ways which rid them of bulky cash holdings at risk of being confiscated. These methods require an army of criminal associates and complicit or negligent gatekeepers to ensure that their insertion in the legal economy doesn’t arouse suspicion. In the EU, the use of cash is still the main reason triggering suspicious transaction reports within the financial system, accounting for 34% of all reports. Criminals who generate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where one has easier access to placement in the legal economy, perhaps due to the predominant use of cash in some jurisdictions’ economies, more lax supervision of the financial system or stronger banking secrecy regulations, or because they may have greater influence in the economic and political establishment. Cash smuggling may occur at other stages and is also used by non-cash generating offences. For example cybercrimes such as phishing and hacking make use of money mules to receive and withdraw sums fraudulently obtained from victims’ bank accounts in cash. These funds are thereafter sent via wire transfer to other jurisdictions where they are collected in cash by a select number of individuals, likely for onward transportation. Since 2017, cash has remained a relevant threat in regards to money laundering. European investigations indicate that movements of cash inside the EU and outside are associated with criminal offences. The most relevant crime area is drug trafficking. Drug related cash proceeds generated through the sales and distribution of predominantly cocaine and hashish are accumulated and received by the designated collectors. The drug trafficking organizations (DTO) then engage with money brokers (traditionally outside of the EU), these brokers charge a commission for facilitating towards the DTOs the value of their proceeds. The brokers dispose of their own laundering networks in different countries. After the arrangement is made, the cash collectors deliver the cash proceeds to the designated intermediaries. From there the cash starts moving, crossing the EU towards the designated exit point or exiting directly the EU. The current legal framework in the EU has significantly hindered the opportunities for introducing into the financial system large amount of illegal drug proceeds. Because of this, money is used in Trade-Based Money Laundering (TBML) schemes or is transported out of the EU towards “cash friendlier” jurisdictions. Dubai and Beirut have in the last years shown steady presence as preferred cash destinations and growing financial hubs in the EU. The cash couriers are associated with the threat of the large denomination banknotes: 500 and 200 Euro. Conclusions: the level of ML threat related to cash couriers is considered as very significant (level 4) Vulnerability Terrorism Financing a) risk exposure The assessment of the TF vulnerability related to cash couriers shows that due to the nature of cash, the use of cash couriers allows significant volumes of transactions/transportation to take place speedily and anonymously. The cross-border aspect of this modus operandi increases the risk to involve geographical areas identified as high risks. b) risk awareness The legislation in place (mandatory cash declarations by natural persons at the external borders of the EU) has increased the risk awareness, at least as far as persons are concerned. Risk awareness exists for unaccompanied cash transportation, which is now covered by the new regulation – but is more limited. c) legal framework and controls There are controls in place through the mandatory declaration of cash transportation at the EU external borders (Cash Control Regulation) and the new regulation extends these customs controls to cash sent in postal parcels or freight shipments, to prepaid cards and to precious commodities such as gold, which were not previously subject to customs control. This legislation has increased the risk awareness, at least as far as natural persons are concerned. These cash declarations allow for easier detection of suspicious transactions and reporting to the FIUs. Where unaccompanied cash is concerned (cash sent through consignments or parcels) the new regulation enables the competent authorities to request the sender or the recipient, as the case may be, to make a disclosure declaration. The declaration will be done in writing or electronically using a standard form. The authorities will also have the power to carry out controls on any consignments, receptacles or means of transport which may contain unaccompanied cash. Conclusions: The risk exposure related to cash couriers by physical persons is intrinsically linked to the cash based activity (large volume, anonymity, speediness) - which is exacerbated by the fact that –especially within a terrorism context- the individual couriers often carry amounts below the declarative threshold. While the volume of cash couriers may be more important than for unaccompanied shipping, risk awareness and controls are in place. The use of cash couriers or methods to ship in/out of the EU unaccompanied cash coupled with the anonymity of cash and (at least with respect to unaccompanied cash) an imperfect control mechanism presents a significant challenge. While the volume of unaccompanied cash shipped in/out the EU is probably lower than for accompanied cash couriers, the risk awareness and controls of the latter pose a greater challenge.

In that context, the level of TF vulnerability related to cash couriers by natural persons is considered as significant (level 3). The level of TF vulnerability related to post/freight is considered as very significant considering the controls/legal framework in place, more than the inherent risk exposure (level 4). Money Laundering a) risk exposure The assessment of the ML vulnerability related to cash couriers shows that the risk exposure is intrinsically linked to the cash based activity (anonymity, speediness). Hence the risk exposure is particularly important for this modus operandi. b) risk awareness The legislation in place (mandatory cash declarations at the external borders for cash carried by natural persons) has increased the risk awareness, at least as far as persons are concerned. Risk awareness exists for unaccompanied physical cash transportation – but is more limited with regard to shipping/freight/couriers. c) legal framework and controls Similarly to TF, there are controls in place through the mandatory declaration of cash transportation at the EU external borders (Cash Control Regulation) by natural persons. These cash declarations allow an easier detection of suspicious transactions and are reported to the FIUs (although shortcomings in information sharing exist and enforcement in application may also vary between Member States). Where unaccompanied cash is concerned (cash sent through consignments or parcels) the new regulation allows the competent authorities to carry out risk analysis and concentrate their efforts on those shipments which they deem to present the highest risk, while not imposing systematic additional formalities. The disclosure obligation is subject to a threshold identical to that for cash carried by natural persons. Conclusions: The risk exposure related to cash couriers by physical persons is intrinsically linked to the cash based activity (large volume, anonymity, speediness). While the volume of cash couriers may be more important, the risk awareness and the controls in place exist. The use of cash couriers or methods to ship in/out of the EU unaccompanied cash coupled with the anonymity of cash and (at least with respect to unaccompanied cash) an imperfect control mechanism presents a significant challenge. While the volume of unaccompanied cash shipped in/out the EU is probably lower than for accompanied cash couriers, the risk awareness and controls in place pose a greater challenge. In that context, the level of ML vulnerability related to cash couriers by natural persons is considered as significant (level 3) and by post/freight is considered as very significant (level 4). Mitigating measures: The new Cash Controls Regulation, applicable from 3 June 2021, reinforces the existing rules on cash movements: • It enables authorities to act on amounts lower than the declaration threshold of EUR10 000, where there are suspicions of criminal activity, • Improves the exchange of information between authorities and Member States; • Enables competent authorities to demand disclosure for cash sent in unaccompanied consignments such as cash sent in postal parcels or freight shipments; • Extends the definition of 'cash' to also include precious commodities acting as highly liquid stores of value such as gold, and to prepaid payment cards which are currently not covered by the standard cash control declaration.





2. Cash intensive business Product Cash intensive business Sector Bars, restaurants, constructions companies, motor vehicle retailers, car washes, art and antique dealers, auction houses, pawnshops, jewelleries, textile retail, liquor and tobacco stores, retail/night shops, gambling services, strip clubs, massage parlours. General description of the sector and related product/activity concerned An interesting description of the use of cash has been described by the European Central Bank in its report Trends and developments in the use of euro cash over the past ten years (published as part of the ECB Economic Bulletin, Issue 6/2018). On 2 February 2016, the Commission published a Communication to the European Parliament and the Council on an Action Plan to further step up the fight against the financing of terrorism. The Action Plan built on existing EU rules in order to adapt to new threats and aimed to update EU policies in line with international standards. It discussed numerous issues and solutions in different fields related to terrorism financing. In the context of the Commission's action to extend the scope of the Regulation on controls of cash entering or leaving the European Union, reference was made to the appropriateness of exploring the relevance of potential upper limits to cash payments. The Action Plan also further noted that "Several Member States have in place prohibitions for cash payments above a specific threshold". However, such prohibitions have not been considered at EU level. The figure below outlines the cash payment restrictions currently in place in the EU Member States, as well as whether there are plans to adapt or change them. The first infographic shows that currently cash prohibition are enforced in 16 EU Member States. The thresholds vary from EUR 500 in Greece and EUR 1 000 in France to approximately EUR 13 800 in Croatia and EUR 15 000 in Poland. The Netherlands is the only country that has adopted a declaration obligation and the remaining 11 EU Member States do not have any cash limitations in place. In several EU Member States particular business sectors or consumers are exempted or targeted by the cash prohibitions. In France, Italy and Spain a distinction is made between residents in the respective countries and non-residents. In this sense, in France and Spain non-residents can perform payments up to a higher threshold (EUR 15 000), while in Italy, the general threshold is not applicable for non-residents. Other countries exclude from the cash restrictions particular sectors enabling professionals in those sectors perform transactions in cash above the generally applicable threshold. For instance in Denmark eleven professional categories including banks and lawyers, are exempted from the thresholds. In the cases of Belgium and Croatia, certain lower thresholds apply in certain sectors. For instance in Belgium cash transactions are completely banned in the real estate sector. Adoption of new cash payment prohibition is discussed in a number of countries, while others are considering of changing their current threshold. Belgium is considering expanding the scope of the restrictions and including all operations apart from individuals. Germany and Malta are considering adopting a cash payment prohibition. The issue is also discussed in Luxembourg and Croatia, without a concrete proposal for either more or less restrictive measures being prepared. The Czech Republic is the only country considering to move towards less restrictive measures.

The figure below indicates that six of the EU Member states, which have a cash payment prohibition in place, have lowered the threshold in the last seven years. Italy is the only EU Member State which adopted a cash payment prohibition at a lower threshold (EUR 1 000) and then raised it in 2016 to EUR 3 000. Description of the risk scenario Cash-intensive businesses are used by perpetrators: - to launder large amounts of cash, which are proceeds of criminal activity, by claiming that the funds originate from economic activities; - to launder amounts of cash, which are proceeds of criminal activity, by justifying its origin based on fictitious economic activities (both for goods and services); - to finance, through often small amounts of cash, terrorist activities without any traceability. General comment This risk scenario is intrinsically linked to use of/payment in cash and to high value denomination banknotes risk scenario. Threat Terrorist financing The assessment of the TF threat related to cash intensive business shows that cash intensive businesses are generally run by individuals through bars, restaurants, phone shops, etc. but are managed by a network of persons forming a terrorist organisation. In general, they are used to get clean cash in a speedy way (e.g. selling cars or jewelleries). However, this risk scenario is not used equally by all terrorist organisations (never seen for Daesh for instance) and not largely widespread as it requires capabilities to run the business. Conclusions: the elements gathered by the LEAs and FIUs show only few cases have been registered meaning that terrorist groups do not favour this risk scenario as it requires some technical expertise and investments to run the business in itself which makes this modus operandi less attractive. However, since this risk is not only hypothetical and that sleeper cells are active in cash-intensive businesses, the level of TF threat related to cash intensive business is considered as moderately significant (level 2). Money laundering The assessment of the ML threat related to cash intensive business shows that this modus operandi is exploited by criminals as it represents a viable option which is rather attractive and secure. It constitutes the easiest way to hide illegitimate proceeds of crime. However, as for TF, it requires a moderate level of expertise to be able to run the business and to escape detection. LEAs confirm that cash intensive businesses continue to be used to launder criminal proceeds. Conclusions: cash intensive businesses are favoured by criminal organisations to launder proceeds of crime. As it requires some level of expertise to run the business, the level of ML threat related to cash-intensive business is considered as significant (level 3). Vulnerability Terrorist financing The assessment of the TF vulnerability related to cash intensive business shows that the main factors are linked to the risk posed by cash.

a) risk exposure While cash intensive business is less attractive to terrorist organisations than to criminals (see threat assessment below), when they are used by terrorists they present some vulnerabilities because the underlying risk is the one related to cash. The vulnerability assessment of TF related to cash intensive business is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rationale. Cash intensive businesses allow the processing of a huge number of anonymous transactions which require no management of new technologies and tracking tools. Hence it has a high inherent risk exposure. b) risk awareness The risk awareness appears to be quite low because, even if large sums of cash can be obtained from cash intensive business, some FIUs notice that terrorist organisations seem to prefer lower denomination banknotes which are less easy to be considered as suspicious by obliged entities and LEAs. c) legal framework and controls in place The legal frameworks in place related to cash payment limitations that some Member States have introduced. This framework varies a lot from one Member State to another concerning cash controls and cash payment limitations and, thus, controls can potentially be inexistent. Conclusions: the vulnerability of cash intensive business is intrinsically linked to the vulnerabilities related to the use of cash in general. The variety of legal frameworks in place, the widespread use of cash in EU economies and the fact that the sector seems being not aware of this risk, the level of TF vulnerability related to cash intensive business is considered as very significant (level 4). Money laundering The assessment of the ML vulnerability related to cash intensive business shows that the main factors are linked to the risk posed by cash. a) risk exposure The vulnerability assessment of ML related to cash intensive business is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rational. Cash intensive businesses allow the processing of a huge number of anonymous transactions which require no management of new technologies and tracking tools. This risk exposure concerns cash payments both for goods and services. Hence it has a high inherent risk exposure. b) risk awareness Obliged entities are usually aware about the risk posed by cash – although controls are not easy to implement. However, for other professions not submitted to AML/CFT obligations, risk awareness remains a challenge. c) legal framework and controls in place Currently no upper limits to cash payments are in place at the EU-wide level. In its Action Plan for strengthening the fight against terrorism financing, the Commission already signalled upper limits to cash restrictions could be further explored as an additional initiative to complement the current European AML/CFT framework. The vulnerability of the sector is affected by the existence, or lack thereof, of rules relating to cash payment limitations: ·where cash limitation rules exist, ML vulnerabilities related to cash intensive business have been more easily mitigated thanks to the legal requirements which allow the refusal of cash payments above a certain threshold. In these cases, controls are in place and allow detecting red flags and suspicious transactions more easily. In addition, these cash payment thresholds are perceived by the sector and by LEAs as more efficient and, eventually, less burdensome than imposing customer due diligence measures. However, these legal businesses can also hide shadow and illicit activities which are able to circumvent the cash limitations. ·where cash limitations rules do not exist, and whilst the risk awareness is quite high, the sector does not know how to manage the risks. It has no tools to control and detect suspicions transactions. The result is that the number of suspicious transactions reports (STRs) is rather low, or even inexistent. Some Member States have introduced cash transaction reports to be declared for cash operations over a certain threshold. However, there is no common approach at EU level.

From an internal market perspective, the differences between Member States legislations on cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing in cash intensive business in another Member States having lower/no control on cash limitation. The existence of cash payments limitations in some Member States, and their absence in other Member States, creates the possibility to bypass the restrictions by moving to the Member States where there are no restrictions, whilst still conducting their terrorist or other illegal activities in the 'stricter' Member State. To increase vigilance and mitigate the risks posed by such cash payments, persons trading in goods are covered by the Directive to the extent that they make or receive cash payments of EUR 10 000 or more. This same threshold is further referred to by Directive 2018/843 (the 5th AML Directive). Member States are able to adopt lower thresholds, additional general limitations to the use of cash and further stricter provisions. However, the effectiveness of those measures is still limited given the number of STRs. The volume of STR reporting is generally low because cash transactions are difficult to detect, there is not much available information and dealers may lose their clients to the benefit of competitors applying looser controls. In addition, it may be difficult for a trader in high value goods to design an AML/CFT policy in the limited events where a cash transaction beyond the threshold takes place (i.e. it is not the sector in itself which is covered by AML/CFT regime – but only high value dealers faced with cash transactions beyond a threshold). For this reason, some Member States have extended the scope to cover certain sectors regardless of the use of cash. Some Member States have also decided to apply a general cash restriction regime at this threshold to reduce the risk of ineffective or cumbersome application of customer due diligence (CDD) rules by high value dealers. However, it does not mitigate situations of cash intensive business which are based on lower amount cash transactions – or a repeated number of low amount cash transactions. In addition, cash intensive businesses are inherently risky because there are no rules dealing with fit and proper testing of these businesses' managers. Some cash intensive businesses are more vulnerable than others because they may give rise to cash exchange more easily (motor retails or pawnshops). Conclusions: the risk exposure to ML of cash intensive businesses is influenced by the existence of legal cash limitations which are efficient to mitigate the risks but are not always sufficient. In a cross-border context, the variety of regulations on cash payments constitutes also a factor of vulnerabilities. When no rules are in place, the risk awareness of the sector is quite low, leading to few STRs to FIUs. Investigative capacities from LEAs are then quite limited. In light of this, the level of ML vulnerabilities related to cash intensive businesses is considered as very significant (level 4). Mitigating measures ·The Commission examined whether to swiftly reinforce the EU framework on the prevention of terrorism financing by enhancing transparency of cash payments through an introduction of a restriction of cash payments or by any other appropriate means. Organised crime and terrorism financing rely on cash for payments for carrying out their illegal activities and benefitting from them. By restricting the possibilities to use cash, the proposal would contribute to disrupt the financing of terrorism and especially money-laundering related activities, as the need to use non anonymous means of payment would either deter the activity or contribute to its easier detection and investigation. The report arrived to the conclusion that no further legislation in this regard would be proposed for the moment now. ·The Commission will continue to monitor the application of AML/CFT obligations by dealers in goods covered by the AMLD and further assess risks posed by providers of services accepting cash payments. It will further assess the added value and benefit for making additional sectors subject to AML/CFT rules. ·Member States should take into account in their national risk assessments the risks posed by payment in cash in order to define appropriate mitigating measures to address the risk. Member States should consider making sectors particularly exposed to money laundering and terrorist financing risks subject to the AML/CFT preventative regime based on the results of their NRA.



3. High value banknotes Product High value banknotes Sector / General description of the sector and related product/activity concerned

In spite of steady growth in non-cash payment methods and a moderate decline in the use of cash for payments, the total value of euro banknotes in circulation continues to rise year-on-year beyond the rate of inflation. Cash is largely used for low value payments and its use for transaction purposes is estimated to account for around one-third of banknotes in circulation. Meanwhile the demand for high denomination notes, such as the EUR 500 note, not commonly associated with payments, has been sustained. These are anomalies which may be linked to criminal activity. Perhaps the most significant finding around cash is that there is insufficient information around its use, both for legitimate and illicit purposes. The nature of cash and the nature of criminal finances mean that there is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. One of the few reliable figures available, that of the volume and value of bank notes issued and in circulation in the EU, leaves open questions around the use to which a large proportion of cash in issuance is put, especially when considering the EUR 500 note. From a total of approximately EUR 1 trillion banknotes in circulation as of end-2014, the use of a significant proportion of these remains unknown. Furthermore, the EUR 500 note alone accounts for over 30% of the value of all banknotes in circulation, despite it not being a common means of payment. Although it has been suggested that these notes are used for hoarding, this assumption is not proven. Even if this is the case, the nature of the cash being hoarded (criminal or legitimate) is unknown. On 4 May 2016, the Governing Council of the European Central Bank (ECB) decided to discontinue the production and issuance of the EUR 500 banknote. It did so taking into account the concerns of Europol and many Member States that this is a banknote that facilitates illicit activities. Based on the ECB’s decision, since 27 April 2019, the banknote has no longer been issued by central banks in the euro area, but continues to be legal tender and can be used as a means of payment. Description of the risk scenario Perpetrators use high value denominations, such as EUR 500 banknotes, to make the cash transportation easier (the larger the denomination, the more funds can be shrunk to take up less space). General comment This risk scenario is intrinsically linked to use of/payment in cash and to cash intensive business risk scenario Threat Terrorist financing The assessment of the TF threat related to high value denomination banknotes shows that terrorist groups are not keen on using high value denominations. They are not necessarily easy to access and, given that they can be detected quite easily they are not attractive for terrorist groups whose first objective is to get cash as quickly as possible. For the sake of discretion, terrorist groups tend to favour low denominations banknotes. LEAs have detected few cases which tend to demonstrate that the intent and capability are not really significant. Conclusions: in that context, the level of TF threat related to high value denominations banknotes is considered as moderately significant (level 2) Money laundering The assessment of the ML threat related to high value denomination banknotes shows that they are recurrently exploited by criminal organisations to launder proceed of crime. The risk related to high value banknotes is not limited to EUR 500 and as long as long large sums in cash are gathered they are considered as attractive by criminal organisations. It does not require any major planning or complex operation – i.e. perpetrators have the technical skills to easily use this product. It remains a "low cost" operation and allows storing of large amounts in very small volumes – which makes it very attractive for organised crime. It has been reported by law enforcement authorities (LEAs) that some criminal groups seek EUR 500 banknotes by paying a premium in order to get access to those large denominations; this demonstrates its attractiveness. Operations themselves reveal huge sums of cash moved and stashed by criminals which are steadily invested and integrated in the legal economy in a multitude of ways which rid them of bulky cash holdings at risk of being confiscated. These methods require numerous criminal associates and complicit or negligent gatekeepers to ensure that their insertion in the legal economy does not arouse suspicion. In the EU, the use of cash is still the main reason triggering suspicious transaction reports within the financial system, accounting for 34% of all reports. Criminals who generate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where one has easier access to placement in the legal economy, perhaps due to the predominant use of cash in some jurisdictions’ economies, more lax supervision of the financial system or stronger banking secrecy regulations, or because they may have greater influence in the economic and political establishment. Cash smuggling may occur at other stages and is also used by non-cash generating offences. For example cybercrimes such as phishing and hacking make use of money mules to receive and withdraw sums fraudulently obtained from victims’ bank accounts in cash. These funds are thereafter sent via wire transfer to other jurisdictions where they are collected in cash by a select number of individuals, likely for onward transportation. The cash couriers are associated with the threat of the large denomination banknotes: 500 and 200 Euro. These banknotes are not used as a legal tender and in fact in Europe in many locations they are not accepted as payment. The high denomination banknotes are used by criminals to store value or for transportation (decreased volume of high overall amount). For example, the safety deposit box of a Belgian underground operator identified during the investigation of laundering hashish proceeds of Moroccan organised criminal groups revealed predominantly 500 and 200 banknotes in overall value of 1 600 000 Euro.

Counterfeit euro banknotes continue to be trafficked in bulk on lorries, and by couriers. Post and parcel services are increasingly used to distribute counterfeit euro banknotes sold via online platforms. Currency counterfeiters continue to introduce counterfeit banknotes into circulation by purchasing low-value goods with high-value banknotes to receive legitimate currency in exchange. Conclusions: banknotes (EUR 500 but not only) are used recurrently by criminal organisations. This modus operandi is widely accessible and available at low cost. For ML purposes, it's quite easy to abuse and requires no specific planning or knowledge. In that context, the level of ML threat related to high value denomination banknotes is considered as very significant (level 4) Vulnerability Terrorist financing The assessment of TF vulnerability related to high value denomination banknotes shows that this product is as vulnerable for TF as for ML for the following reasons: a) risk exposure Large volume of high value denominations is in circulation, despite low use in commercial transactions. Cash still allows carrying transactions in an expedited, anonymous, and untraceable way. b) risk awareness Especially LEAs and FIUs have high risk awareness, as do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially Europol reports, point to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c) legal framework and controls in place Even if terrorist groups are less attracted to high value denomination banknotes, detection is quite difficult because there is no EU harmonisation concerning the legal framework related to the use of high value denomination banknotes. Controls are uneven; reports to FIUs are rather few, and most of the time they cannot distinguish between ML and TF. The use of high value denomination banknotes for ML purposes may be impacted by the ECB decision to gradually phase out EUR 500 because of the recognised links with criminal activities. However, the return rate is generally quite low and these banknotes may be still in use for a long time. Therefore, this cannot be seen as an immediate mitigation measure. Conclusions: from a vulnerability point of view, risk exposure is high, level of awareness is low and controls in place are not harmonised which create potential loopholes when cross-border transactions are at stake. In light of this, the level of TF vulnerability related to high value denomination banknotes is considered as very significant (level 4). Money laundering The assessment of ML vulnerability related to high value denomination banknotes shows the following features: a) risk exposure

High value denominations allow the storing/putting into circulation of large volumes of cash in a speedy and anonymous way. A large volume of high value denominations is in circulation, despite the low level of use in commercial transactions. Even if the use of high value denominations raises red flags, it remains that these denominations are not necessarily used for payments but rather to move funds. Large amounts can be stored in very small volumes. They are less easy to detect by financial intelligence units (FIUs) and obliged entities. b) risk awareness Especially LEAs and FIUs have high risk awareness, as do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially Europol reports, point to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c) legal framework and controls in place The use of high value denomination banknotes for ML purposes may be impacted by the ECB decision to gradually phase out EUR 500 because of the recognised links with criminal activities. However, the return rate is generally quite low and these banknotes may be still in use for a long time. The EUR 500 will remain legal tender and can therefore continue to be used as a means of payment and store of value. Therefore, this cannot be seen as an immediate mitigation measure. Conclusions: similarly to the outcomes of the assessment of the TF vulnerability related to high value denomination banknotes, the ML vulnerability related to these products is considered as very significant (level 4). Mitigating measures ·Monitoring of the return rate of EUR 500 banknotes will continue as well as an assessment of the evolution of the usage of the EUR 200 banknote.

4. Payments in cash Product Payments in cash Sector / General description of the sector and related product/activity concerned The European Central Bank (ECB) has conducted a comprehensive study to analyse the use of cash, cards and other payment instruments used at points of sale (POS) by euro area consumers in 2016. The survey results show that in 2016 cash was the dominant payment instrument at POS. In terms of number, 79% of all transactions were carried out using cash, amounting to 54% of the total value of all payments. Cards were the second most frequently used payment instrument at POS; 19% of all transactions were settled using a payment card. In terms of value, this amounts to 39% of the total value paid at POS. Thus it unquestionably remains the payment method of choice among consumers for low value transactions (i.e. less than 20 EUR). Description of the risk scenario Perpetrators frequently need to use a significant portion of the cash that they have acquired to pay for the illicit goods they have sold, to purchase further consignments, or to pay the various expenses incurred in transporting the merchandise to where it is required. Despite the advantages and disadvantages of dealing in cash (detailed earlier in this report) for criminal groups, there is often little choice. The criminal economy is still overwhelmingly cash based. This means that, whether they like it or not, perpetrators selling some form of illicit product are likely to be paid in cash. The more successful the perpetrators are and the more of the commodity they sell, the more cash they will generate. This can cause perpetrators significant problems in using, storing and disposing of their proceeds. Yet despite these problems, cash is perceived to confer some significant benefits on them. In addition, the objective of criminals is to launder large amounts of cash, which are proceeds of criminal activity, by claiming that the funds originate from economic activities. They may launder amounts of cash by justifying its origin based on fictitious economic activities (both for goods and services). Terrorists may finance, through often small amounts of cash, terrorist activities without any traceability (see general description under cash intensive business).

General comment This risk scenario is intrinsically linked to cash intensive business and high value denomination banknotes risk scenario. Threat Terrorist financing The assessment of the TF threat related to payments in cash shows that terrorist groups use recurrently cash, as this modus operandi is widely accessible and low cost. Cash is at the basis of all illicit trafficking and illicit purchase of products. In general, cash is really attractive, difficult (even impossible) to detect and does not require specific expertise to be used. Conclusions: based on the feedback from LEA and FIUs, the level of TF threat is considered as very significant (level 4). Money laundering The assessment of the ML threat related to payments in cash is considered as similar to the assessment of TF threat. For ML, cash is also the preferred option for criminals, which allows hiding illicit proceeds of crime easily and moving funds rapidly, including cross-border. As for TF, it does not require specific expertise, knowledge or planning capacities. Illegal cash is supplied to intermediaries to buy goods in countries with no or few restrictions on cash payments. Products purchased either hold considerable value, such as luxury goods, or for which there is a specific but considerable demand: such as vehicles (whether second-hand or luxury, construction machineries). Cash integration by buying from legitimate trading companies goods that are exported at market price is increasing. Conclusions: based on the feedback from law enforcement authorities (LEAs) and financial intelligence units (FIUs), the level of ML threat is considered as very significant (level 4). Vulnerability Terrorist financing The assessment of TF vulnerability related to payments in cash shows the following features:

a) risk exposure Cash payments allow speedy and anonymous transactions. The level of risk exposure is very high considering that large sums can also be moved across borders and may involve high risk customers and/or geographical areas. b) risk awareness Especially LEAs and FIUs have high risk awareness, and so do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially a Europol report, points to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c) legal framework and controls in place While cash payment limitations may allow a mitigation of the level of vulnerability, legal frameworks in place related to cash payment limitations vary a lot from one Member State to another and, therefore, controls can potentially be inexistent. From an internal market perspective, the differences between Member States legislations on cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing cash intensive business in another Member States having lower/no control on cash limitation. The 4th AML Directive provides that high value dealers accepting payment in cash beyond EUR 10 000 are subject to AML/CFT rules and have to apply customer due diligence (CDD) requirements. This obligation applies to any persons trading in goods when the payment is made in cash beyond EUR 10 000 – but it does not cover services, apart from gambling services, and in that case when carrying out transactions amounting to EUR 2 000. These same thresholds are followed by Directive 2018/843 (the 5th AML Directive). However, the effectiveness of those measures is still limited considering the number of STRs. The volume of STR reporting is generally low because cash transactions are difficult to detect, there are few available information and dealers may lose their clients for the benefit of competitors applying looser controls. For those Member States who have put in place currency transactions reports (CTR), most of the time they are not connected to any STR and the analysis cannot be conducted (for instance, large sums withdrawn from an ATM will trigger CTR but no specific suspicion is related to that and the FIU cannot launch any investigation). In addition, it may be difficult for a trader in high value goods to design an AML/CFT policy in the limited events where a cash transaction beyond the threshold takes place (i.e. it is not the sector in itself which is covered by AML/CFT regime – but only high value dealers faced with cash transactions beyond a threshold). For this reason, some Member States have extended the scope to cover certain sectors regardless of the use of cash. Some Member States have also decided to apply a general cash restriction regime at this threshold to reduce the risk of ineffective or cumbersome application of CDD rules by high value dealers. However, it does not mitigate situations of cash intensive business which are based on lower amount cash transactions – or a repeated number of low amount cash transactions. In any case, some competent authorities consider that even when cash payment limitations exist, enforcement of these limitations is very challenging and may limit their impact on TF activities. Conclusions: considering that cash payments may engage large transactions speedily and anonymously, including cross-border, that all sectors may potentially be exposed to cash payments and even if they are aware that these payments present some risks are not equipped to mitigate them (either because no framework/controls in place, or because enforcement of the controls is not efficient), the level of TF vulnerability related to payments in cash is considered as very significant (level 4). Money laundering The assessment of ML vulnerability related to payments in cash shows the following features: a) risk exposure

The sector shows the same vulnerability to TF as to ML. As for TF, cash payments allow speedy and anonymous transactions to launder proceeds of ML crime. The level of risk exposure is very high considering that large sums can also be moved across borders and may involve high risk customers and/or geographical areas. b) risk awareness Especially law enforcement authorities (LEAs) and financial intelligence units (FIUs) have high risk awareness, and so do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially the Europol report, points to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c) legal framework and controls in place While cash payment limitations may allow mitigating the level of vulnerability, legal frameworks in place related to cash payment limitations vary a lot from one Member State to another and, therefore, controls can potentially be inexistent. From an internal market perspective, the differences of Member States legislation in cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing cash intensive business in another Member States having lower/no control on cash limitation. The volume of reporting is very low because cash transactions are difficult to detect. For those Member States who have put in place CTR, most of the time they are not connected to any STR and the analysis cannot be conducted (for instance, large sums withdrawn from an ATM will trigger CTR but no specific suspicion is related to that and the FIU cannot trigger any investigation). In any case, some competent authorities consider that even when cash payment limitations exist, enforcement of these limitations is really challenging and may limit their impact on ML activities. Conclusions: considering that cash payments may engage large transactions speedily and anonymously, including across border, that all sectors may potentially be exposed to cash payments and even if they are aware that these payments present some risks are not equipped to mitigate them (either because no framework/controls in place, or because enforcement of the controls is not efficient), the level of ML vulnerability related to payments in cash is considered as very significant (level 4). Mitigating measures ·The Commission will continue to monitor the application of AML/CFT obligations by dealers in goods covered by the AMLD and further assess risks posed by providers of services accepting cash payments. It will further assess the added value and benefit for making additional sectors subject to AML/CFT rules. ·Member States should take into account in their NRA the risks posed by payment in cash in order to define appropriate mitigating measures suitable to address the risk. Member States should consider making sectors particularly exposed to money laundering and terrorist financing risks subject to the AML/CFT preventative regime based on the results of their NRA.





5. Privately owned ATMs Product Privately owned ATMs Sector / General description of the sector and related product/activity concerned A possible misuse of cash machines (ATMs) for money laundering purposes has been brought to the attention of LEAs. According to information received the legal possibility for private parties to buy and rent ATMs from wholesale suppliers is creating a loophole that criminals are taking advantage of. For many merchants, owners of clubs, bars and restaurants installing one of these ATMs has proven to be a business oriented decision – the client is offered the convenience to withdraw cash and the merchant is maximizing the probability that some of that cash will be spent in his business. Description of the risk scenario a) ATM loading options In order to load the machine one option is to use the services of cash management/cash delivery company. Another option for the merchant operating a business is to load the cash from his teller. This provides additional opportunities for traders to commit tax evasion by selling goods in exchange of cash without issuing receipts. They then simply place their black cash inside their ATM machine and wait for it to be taken by normal clients. At the end of the year such sales are never declared to their tax authority The third and most concerning option is simply to load the ATM with criminal cash. Intelligence gathered shows that in cases where criminal cash is used the modus operandi is the following: a courier delivers to the ATM owner/merchant criminal cash. It may derive from different cash generating activities like drug trafficking, illegal immigration, trafficking in human beings, labour and sexual exploitation, selling of counterfeit of smuggled goods, theft, robbery, etc. The criminal cash is then loaded into the machine. As unsuspecting customers or passers-by in need of cash are using their cards to withdraw cash the same amount is debited from their bank accounts and credited into the account of the owner of the ATM/merchant. Afterwards, he can simply transfer the money to any given account controlled by the criminal, minus the commission agreed upon. b) De-linking bank accounts and internationalization risks

An internationalized, potentially much more dangerous risk scenario appears when national regulations require that a private entity buying an ATM should upon its purchase provide a national bank account number which is linked to the ATM and its activities, but there is no requirement for the merchant to request cash for the ATM from the same bank account that he linked to his ATM or even from the same bank. A review of the companies offering private ATM services shows that there are several major suppliers, British and American, who have managed to make their business international. Important questions arise concerning the accounts to which these ATMs (sold by EU and US companies and present in EU countries) are linked. If they are linked to an EU national bank account, but physically present in another country, then it is virtually impossible to establish the origin of the cash being inserted in them. c) Tax evasion and fraud Private ATMs are also used for tax evasion and fraud especially as some cash-intensive business operators encourage their clients to extract cash for services that are not invoiced or recorded. The amount of money lost in tax revenues from tax evasion and fraud through private ATMs is more significant than the amount laundered. d) Micro-structuring by organized crime With respect to money laundering, private ATMs are often used to “microstructure” –depositing and withdrawing of small sums of money that are consistent with normal ATM withdrawal amounts, going undetected by bank controls. Organized crime members will make voluminous small daily cash deposits into 100 or more bank accounts using private ATMs to avoid triggering anti-money laundering reporting requirements. General comment Private ATMs tend to be located in cash-intensive businesses. In addition, privately owned ATMs can also be found in money service businesses (MSB). Taking into consideration the fact that the presence of an ATM in a MSB is illogical due to the nature of an MSB service and also the fact that many hawaladars’ side legal business is running an MSB or a currency exchange service, the risk of misuse can be clearly identified. Threat Terrorist financing There exist currently few especific assessments of the TF threat related to privately owned ATMs. Nevertheless, the combined assessment on payments in cash as well as the analysis on cash couriers show that this modus operandi is widely accessible and low cost. The threat of cash transportation into the EU from a third country may also exist, in particular from countries exposed to TF risks or conflict areas. Cases have been identified concerning low amounts and involving integration of cash carried from third countries into the financial system/legal economy of the EU (analysed in a separate section of this report). Conclusions: based on the feedback from LEA and FIUs, the level of TF threat is considered as very significant (level 4). Money laundering The assessment of the ML threat related to privately owned ATMs shows that this modus operandi is exploited by criminals as it represents a viable option which is rather attractive and secure. It constitutes an easy way to evade taxes and hide illegitimate proceeds of crime. However, as for TF, it requires a moderate level of expertise to be able to run the business and to escape detection. Conclusions: based on the feedback from LEA and FIUs, the level of ML threat is considered as very significant (level 4). Vulnerability Terrorist financing The assessment of the TF vulnerability related to privately owned ATMs shows that the main factors are linked to the risk posed by cash.

a) risk exposure The vulnerability assessment of TF related to privately owned ATMs is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rationale. Privately owned ATMs allow the processing of a huge number of anonymous transactions which require but an initial investment. Hence it has a high inherent risk exposure. b) risk awareness The risk awareness appears to be quite low. c) legal framework and controls in place The legal frameworks in place vary from one Member State to another and, thus, controls can potentially be inexistent. Conclusions: the vulnerability of privately owned ATMs is intrinsically linked to the vulnerabilities related to the use of cash in general. The widespread use of cash in EU economies and the fact that the sector seems being not aware of this risk, the level of TF vulnerability is considered as very significant (level 4). Mitigating measures Private ATM companies pose an increased risk to banks and should be treated as high-risk in money laundering compliance risk assessments. The risks for banks are not just financial but reputational. ·Firstly, customers who have privately owned or operated ATMs should be duly identified. ·Once the bank has identified an ATM owner or operator, it should obtain additional information to gain an understanding about the ATM owner/operators well as an understanding of the ATM owner’s procedures. ·After sufficient information is obtained, the sponsoring bank should implement a process to monitor the accounts of the ATM owners. The information obtained during the due diligence process should enable the bank to determine the amount of monitoring necessary as well as how often. ·Member States should guarantee the obligation to register, limit ownership, monitor, or examine privately owned ATMs – up to and including the obligation to link ATMs to a bank account of the Member Sate they are physically located in.

Financial sector 1. Deposits on accounts Product Deposits on accounts Sector Credit and financial institutions General description of the sector and related product/activity concerned As far as trends are concerned, according to data from the European Banking Federation since 1998, domestic or euro area deposit liabilities in the EU rose by 3.1% to €23.6 trillion in December 2017 (€17.5 trillion in the euro area and €5.3 trillion in the rest of the EU Member States). This was the highest level recorded, with the previous peak at €23.1 trillion in 2012. Deposits from other monetary financial institutions (MFIs) rose for the first time since 2011 to €7.1 trillion. Total deposits from non-monetary financial institutions, excluding central governments, grew by 2.5% in 2017 to €16.3 trillion in the EU at the end of 2017, with €12.1 trillion in deposits coming from the euro area.

Growth has been driven by an increase in deposits from households, which rose by 2.9% year on year to €9.1 trillion, and from non-financial corporations (NFCs), up by 6.7% to €3.2 trillion. Description of the risk scenario Perpetrators place the proceeds of crime into the financial system through the regulated credit and financial sector in order to hide its illegitimate origin. Terrorists, supporters or facilitators place funds from legitimate or criminal sources into the financial system with a view to using it for terrorist purposes. Money mule mechanisms may be used to transfer proceeds out of the banking sector using personal accounts, either through cybercrime (scamming, fake banking websites etc.) or through money value transfer services. ‘Bridge accounts’ are also used to launder money. These are accounts of legal or natural persons in the EU with the sole purpose of transferring funds to non-EU countries. Threat Terrorist financing The assessment of the terrorist financing threat related to deposits on account shows that this risk scenario concerns both the placing and withdrawing of funds (i.e. deposits on account and use of this account withdrawing those funds or transferring to another bank accounts). Account deposits are frequently used by terrorists, but also by relatives/friends; this extends the scope of the intent and capability analysis. Furthermore, law enforcement authorities have reported the use of forged or stolen documents by terrorists to open bank accounts. According to information from competent authorities, foreign terrorist fighters generally withdraw bank account deposits through ATMs located in high-risk non-EU countries or conflict zones in general, or in bordering countries. Terrorists outside conflict zones also withdraw funds through ATMs in order to pay in cash some of the expenses related to their operations. Anyhow, the use of deposit accounts for TF purposes may, in conflict zones, be complicated by difficulties to access funds, especially where access to ATMs or a functioning banking network is disrupted. The source of the funds deposited on bank accounts may come from both legitimate and non-legitimate origins. In general, using deposits accounts is easily accessible, especially when legitimate funds are used, and thus they do not trigger any suspicion when the bank account is opened. It appears that terrorist groups do not experience specific challenges in hiding the real beneficiary of the funds or the exact purpose of the transaction (destination of funds) given that they may still include family members or relatives in the ownership chain. This requires at least basic planning and basic knowledge of how banking systems work. At the same time, once executed, cash withdrawals allow cross-border movements, which makes this risk scenario rather attractive. Conclusions: terrorists groups rather frequently use deposits on account to easily enter cash in bank accounts and withdraw money for terrorist activities, although it requires some basic knowledge and planning capabilities to ensure that funds deposited appear legitimate. As a result, this method is rather attractive for terrorist groups. That being the case, the level of terrorist financing threat related to deposits on accounts is considered as significant/very significant (level 3/4). Money laundering The assessment of the money laundering threat related to deposits on account shows that this risk scenario concerns both the placing and withdrawal of funds (i.e. deposits in an account and subsequent use of this account, withdrawing money from that deposit account or transferring money to disguise the origin of funds). Deposits on account are frequently used by organised crime organisations, but also by relatives/close associates, which extends the scope of the intent and capability analysis. Law enforcement authorities report frequent use of this method since it is one of the easiest ways to integrate illicit funds into the financial system. Although in the case of small amounts of money, deep planning and knowledge of how banking systems work may not be necessary, in the case of a complex money laundering case involving funds deposited on accounts transiting via a chain of complex operations, more in-depth knowledge is necessary and perpetrators may use available expertise from intermediaries. Conclusions: In the light of the above threats, specially the use by criminal organizations, the level of the money laundering threat related to deposits on account is considered as very significant (level 4). Vulnerability Terrorist financing The assessment of terrorist financing vulnerability related to deposits on looked at the placement and withdrawing of funds a) risk exposure Banks continue to be exposed to terrorist financing risks: deposits on accounts represent the easiest way to introduce money into the financial system. In the case of the risk from terrorist financing, the risk exposure is even higher when the origin of funds is legitimate. The use of funds in deposit accounts for terrorist purposes is difficult to detect as low amounts of money are usually used by terrorist groups. When it comes to sending money to conflict zones, the terrorist financing risk is lower in deposits on accounts as perpetrators prefer the use of other products such as money value transfer services or E- money products.

b) risk awareness The risk awareness of credit and financial institutions is generally good, and the banking sector has put in place guidance to detect the relevant red flags on terrorist financing. However, systems and checks that firms put in place to mitigate the terrorist financing risk are similar to, and often the same as, the checks put in place for anti-money laundering purposes. Supervisors and law enforcement agencies are aware of vulnerabilities to terrorist financing and are proactively engaged with the sector. c) legal framework and checks Deposits on accounts have been covered by the framework on anti-money laundering (AML) and countering the financing of terrorism (CFT) since the first AML/CFT legislation at EU level in 1991. Checks in place are generally considered as efficient, although sanctions screening is not a substitute for effective CFT checks. Financial sanctions target individuals or groups that are already known to pose a threat, whereas the risk from terrorist financing often emanates from individuals who are not caught by the sanctions regime. This is why risk‐based AML/CFT checks, and transaction monitoring in particular, are key to an effective fight against terrorist financing. Usually, banks do not have access to relevant information that would help them identify terrorist financing risks before they materialise, as such information is often held by law enforcement agencies. Likewise, law enforcement agencies’ efforts to disrupt terrorist activities and networks can be hampered in cases where they are unable to obtain information about finance flows that only firms can provide. There are now initiatives at national and supranational levels to test how law enforcement agencies can provide firms with more specific and meaningful information on specific persons of interest, allowing firms to focus their transaction monitoring on these persons. Conclusions: risk exposure may be considered as quite high, and the sector, despite a good level of awareness, needs to improve the efficiency of checks to mitigate the terrorist financing risk. Engagement with law enforcement agencies is essential in this area. As a result, the level of terrorist financing vulnerability related to deposits on accounts is considered as significant (level 3). Money laundering Money laundering vulnerability mainly depends on the effectiveness of monitoring systems to detect suspicious transactions when cash enters bank accounts or transactions linked to cash. Vulnerability is also high when it comes to transfers of funds from high-risk customers. a) risk exposure Deposits on account represent the most straightforward way of introducing money from illicit activities into the financial system. There are high volumes of products where, in the case of cash, the origin of funds cannot be always traced. While deposits are a rather common practice for credit and financial institutions, they represent a high number of operations that may involve different kind of customers. Some customers may be high-risk because they are politically exposed or because they are identified as high-risk customers (i.e. some non-resident bank accounts in EU banks). The extensive use of cash in some sub‐sectors and in some Member States is considered by most supervisors to be one of the contributing factors that exposes the sector to money laundering vulnerabilities, particularly where the sector is made up of many retail banks. Supervisors also consider cross‐border activities as being exposed to a significant and very significant money laundering risk, particularly in those Member States that are known as international financial centres. Non‐resident customers from high‐risk jurisdictions and off‐shore companies also contribute to the increased inherent risk in this sector. In some Member States where the domestic deposit base is small to relative to the size of the financial sector, non-resident deposits, especially from bordering non-EU countries, are an attractive source of funding. However, experience of recent years has shown that such deposits, depending on the source jurisdiction and other circumstances, often required reinforced AML controls, which were not in place or not commensurate to the level of risk they presented. Excessive risk taking by credit intuitions resulted in significant exposure of the EU jurisdictions to the flow of funds of potentially suspicious origin from third countries. A recent trend is a steady decrease of the proportion of non-resident deposits in EU jurisdictions – due to both voluntary de-risking by the banking sector as well as public policies of the EU jurisdictions concerned. b) risk awareness The risk awareness is generally good, as the sector has in place guidance to detect the relevant red flags on money laundering. While the banking sector has an inherently high exposure to money laundering risks, it also has adequate tools to detect them. This is confirmed by a high levels of reporting. Financial intelligence units and law enforcement agencies are also well aware of the vulnerabilities of the sector and are proactively engaged with it. For supervisors, while the banking sector is considered inherently risky, as credit institutions are often the first entry point into the overall financial services sector, the concentration of firms rated at very significant risk is relatively small. However, in recent years, scandals in European banks has shown that weaknesses linked to customers from former Soviet republics increase the vulnerability to money laundering. c) legal framework and checks Deposits on accounts have been covered by the AML/CFT framework since the first AML/CFT legislation at EU level in 1991. Checks in place are considered as efficient, but it may be necessary to perform thematic supervision to check the effectiveness of the monitoring systems used to detect suspicious cash transactions, especially when legal entities and legal arrangements are involved. Supervisors are also concerned about checks put in place by credit institutions for managing risks associated with customers involving complex off‐shore structures; in particular, checks to identify and verify beneficial owners are considered insufficiently robust. Conclusions: the inherent money laundering risk associated with deposits is appropriately mitigated by credit institutions. However, there are still some concerns about the effectiveness of checks, in particular checks on customers with complex offshore structures and on foreign customers from high-risk jurisdictions. In this context, the level of money laundering vulnerability related to deposits on accounts/retail banking is considered as significant (level 3).

Mitigating measures For the Commission: ·deep review of the transposition of the 5th Anti-money Laundering Directive (AMLD), focusing on the provisions on beneficial ownership information, including the interconnection of beneficial owner registers at EU level; ·uniform practices in e-identification for the financial sector and introduction of standards to meet customer due diligence obligations with Reg-Tech companies; ·promote cooperation between law enforcement agencies and financial institutions to improve effectiveness of terrorist financing alert systems at supranational level. For Member States / competent authorities: ·public-private sector cooperation to exchange information related to terrorist financing ·thematic inspections focusing on: ·assessing the efficiency of monitoring systems for cash transactions and the placing of funds in bank accounts linked to the simultaneous transfer of funds to high-risk non-EU countries. ·effectiveness of customer due diligence and enhanced customer due diligence for legal entities and legal arrangements.

2. Institutional investment sector — Banking Product Deposits on accounts Sector Credit institutions - Institutional investment General description of the sector and related product/activity concerned The EU asset management sector is composed of two complementary pillars. The first pillar comprises the mutual fund industry, the ‘UCITS’ funds (€9.7 trillion of assets under management in 2017). The second pillar includes alternative investment funds (the alternative investment fund industry had a net asset value of 4.9 trillion euros at the end of 2017) such as hedge funds (11%), private equity (4%), funds of funds (16%) and real estate funds (11%). Assets managed in EU passed the EUR 15 trillion threshold at the end of 2017. The EU asset management industry serves both retail clients — usually composed of households and high net worth individuals — and institutional clients. Institutional clients comprise, for instance, insurance companies and pension funds, which accounted for 25% and 28% respectively of the total assets managed in EU at end-2016. Description of the risk scenario There are several scenarios where perpetrators can commit abuses against investors or financial markets, for instance, through integration of proceeds, such as title of shares to conceal beneficial ownership. Through fraud, or through market abuse (which comprises insider dealing, market manipulation, and unlawful disclosure of inside information, all of which are covered by the scope of the EU Market Abuse Regulation and the EU Criminal Sanctions for Market Abuse Directive), brokerage accounts, investment to justify criminal proceeds as profit, predicate investment fraud, or placement of proceeds using specialised high-return financial services. General comments This risk scenario can be seen as linked to the scenario for investment provided by brokers. It has been considered that as far as the money laundering vulnerability is concerned, the level of risk is higher for brokers.



Threat Terrorist financing The terrorist financing threat related to institutional investment could be significant if large amounts of legitimate funds are invested to finance terrorism, but when it comes to generating small amounts to commit terrorist attacks, the terrorist financing threat is not significant in this product/sector. Conclusion: the assessment of the terrorist financing threat related to institutional investment through banks is considered as less significant (level 1).

Money laundering The increasing role of facilitators in money laundering schemes can make the sector more exposed to such threats, although knowledge and technical expertise are needed to carry them out. Criminal organisations could rely on such facilitators to launder the proceeds of illegal activities. Although large amounts of funds can be gathered through this process, it is not easy to access, not financially viable (depending on the quality of investment) and in any case requires knowledge and technical expertise. Therefore, criminal organisations do not favour this kind of risk scenario, while the role of facilitators is essential when creating opaque structures to hide the proceeds of criminal activities. Nevertheless, a few methods for moving large illicit flows, prepared by highly skilled facilitators, have been identified over the last few years: -capital market commodity clients conducting over-the-counter future swaps through exchanges, and using illicit funds to settle once expired; -the simultaneous purchase, transfer and sale of securities across jurisdictions by two seemingly unrelated, but mutually controlled, entities; -capital market fixed income clients conducting bond trades on behalf of organised criminals, using illegitimate money to purchase bonds and then integrate funds into financial institutions after sale of those bonds. Conclusions: in this context, the assessment of the money laundering threat related to institutional investment through banks is considered as significant (level 3).

Vulnerability Terrorist financing Terrorist financing vulnerability related to institutional investment presents a less significant inherent risk. Risk factors (products, customers, geographies and delivery channels) do not favour the use of this product/sector for terrorist financing purposes. Perpetrators usually do not have the expertise to access the sector, while the low amounts of money used in terrorist attacks made other sectors more attractive for their purposes. Conclusion: in light of the above, the assessment of the terrorist financing vulnerability related to institutional investment through banks is considered as less significant (level 1). Money laundering The assessment of the money laundering vulnerability related to institutional investment — banks made the following findings: a) risk exposure The main factor that mitigates the inherent risk money of laundering is the low level of cash-based transactions, despite the fact that the sector is exposed to high-risk customers, including politically exposed persons, while the volume and level of cross-border transactions are high. To have access to the sector, perpetrators need to introduce money through the banking system, and hiding illegal money through opaque structures requires a high degree of expertise. Therefore, banks are a first barrier that mitigates the inherent money laundering risk. b) risk awareness Risk awareness in the sector is not high when transactions are performed out of the banking sector. This is because firms usually rely on banks to apply customer due diligence and monitoring when money enters bank accounts. Supervisors consider the overall risk of the sector moderately significant; however, the risk profile at firm level shows that a significant proportion of firms are classified as a less significant risk. Despite this, most supervisors consider this sector to pose a very significant cross-border risk. Another key risk this sector is exposed to is reconciling the anti-money laundering standards of the home and host Member States where there are branches of a group in different countries. According to financial intelligence