· the sectors that are not included in the scope of the Directive (EU) 2015/849 but were considered relevant for the risk assessment, such as use of cash, virtual currencies, crowdfunding or non-profit organisations. It also covers certain illegal means used by perpetrators such as Hawala and other similar informal value transfer services providers.

·the sectors defined by Directive (EU) 2015/849, i.e. credit and financial institutions, money remitters, currency exchange offices, high value goods and assets dealers, estate agents, trust and company service providers, auditors, external accountants and tax advisors, notaries and other independent legal professionals, gambling service providers.

Through the implementation of the SNRA methodology and based on the internal and external input received, the Commission has identified 40 products or services that are considered potentially vulnerable to ML and TF risks at the level of the internal market. These 40 products cover 11 professionals sectors, including:

As additional documents, an index of abbreviations used in the risk analysis and a list of bibliography are attached in Annex 7 and Annex 8.

This framework is complemented by other EU legislation. An indicative list of such other relevant legislation is attached as Annex 6.

·Regulation (EC) No 1781/2006 of the European Parliament and of the Council of 15 November 2006 on information on the payer accompanying transfers of funds

·Commission Directive 2006/70/EC of 1 August 2006 laying down implementing measures for Directive 2005/60/EC of the European Parliament and of the Council as regards the definition of ‘politically exposed person’ and the technical criteria for simplified customer due diligence procedures and for exemption on grounds of a financial activity conducted on an occasional or very limited basis

·Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing

Therefore, at the time of this analysis, the applicable legal framework was:

Therefore the supranational risk assessment is based on the EU legislation implemented at the time of the assessment. This is particularly important to stress since some sectors were not, or only limitedly, covered by the obligations in Directive 2005/60 (EC). Therefore the risk level may be assessed differently for those Member States having already applied the stricter regime of Directive (EU) 2015/849.

The risk assessment needs to provide a snapshot of the money laundering and terrorist financing risks and requires a clear-cut timing. The assessment of risks affecting the EU was carried out at a time when the relevant legislative framework was still Directive 2005/60 (EC). Even though Directive (EU) 2015/849 was adopted in May 2015, its transposition has not been completed yet . In addition, in the aftermath of the terrorist attacks and after the revelations of the Panama Papers, the Commission adopted a new legislative proposal to revise through a targeted approach, the AML/CFT legal framework. In this legislative proposal, new mitigating measures are also proposed; these new measures could not be taken into consideration, as the text is still under negotiation and has not entered into force yet.

The legal framework in place is one of the key criteria to assess the level of risks. It is possible to mitigate risks through effective application of rules and controls. When assessing a risk, it is important to acknowledge if the existing legal framework is commensurate to the risks inherent to a specific sector, or if it covers only marginally those risks.

In addition, the EGMLTF collected statistics on the number of obliged entities and suspicious transaction reports (STRs) by Member States. The results were used for the risk assessment and are attached as Annexes 4 and 5.

The Commission also conducted three rounds of consultation with representatives of the private sector and civil society. These led to a better understanding of the private sector's practices in term of AML/CFT internal controls and policies. The consultations also helped to better identify what the private sector needs to improve its sectorial risk assessment and the implementation of its obligations.

This analysis was conducted over the last 2 years. The Commission organised a series of meetings to identify the relevant modi operandi (scoping), carry out the analysis (risk analysis) and define mitigating measures (risk management). In addition to internal Commission expertise gathered from all relevant departments, the level of risks has been defined through a series of meetings organised with experts from the Member States (including regulators, supervisors, police, intelligence services, Financial Intelligence Units) and EU bodies (Europol, European Supervisory Authorities). Six workshops were organised in 2015-2016 with those experts to analyse both the risks of money laundering and terrorist financing. Further consultation was carried out in the context of the Commission's experts groups (EU's FIU platform, Expert Group on Money Laundering and Terrorist Financing (EGMLTF), Expert Group on Gambling Services).

Based on the criteria for the threat and vulnerability, each product/service is qualified from a low to moderately to highly significant level of risk. The supranational risk assessment covers both current risks posed by sectors covered by AML/CFT obligations and emerging risks.

(2) the potential weaknesses of these same products or services which allow terrorist groups or organised crime organisations to misuse them for illicit purposes (i.e. level of vulnerability). The weaknesses are assessed according to three criteria: (i) inherent risk exposure of the product/service due to its inherent characteristics (based on the product, geographical or customer risks); (ii) risk awareness of the sector/competent authorities that these products/services may be misused (organisational framework of the sector, availability of a risk assessment, level of suspicious transactions reporting); and (iii) legal framework and controls in place (existing legal framework, current implementation of the controls and of the customer due diligence requirements, level of cooperation with competent authorities).

(1) the "likelihood" of terrorist groups or organised crime organisations misusing products/services provided by this relevant sector for illicit purposes (i.e. level of threat). This level of threat is determined by the intent and the actual capacity of perpetrators to use those modi operandi.

The methodology provides a common understanding for assessing the risks. The risks are defined as "the ability of a threat to exploit the vulnerability" of a sector for the purpose of money laundering or terrorist financing. The methodology is therefore based on two major components for assessing each relevant sector:

The Commission drew up a specific methodology for conducting this assessment as a guarantee of a robust and reliable process. This methodology covers key aspects such as methodological guidelines, governance, working arrangements and project charter. The relevant documents are attached as Annexes 2 and 3.

Terrorist financing means the provisions or collection of funds, by any means, directly or indirectly, with the intention that they be used or in the knowledge that they are used, to carry out terrorist activities. Funds can be raised from legitimate sources (personal donations, charitable organisations…) or criminal sources (drug trade, fraud…).

(3) integration: The criminal proceeds are now fully integrated into the financial system and can be used for any purpose. The money is returned to the criminal from what seem to be legitimate sources (normal business or personal transaction).

(2) layering: money launderers move funds from one country to another, the aim of this phase is to separate the illicit money from it source.

(1) placement: in this phase money is placed into the legitimate financial system. It is the most risky phase.

The process serves to making the origin appear legitimate and leaving no link to the real source of the funds, their real owner or intended beneficiary. The cycle of money laundering is separate in three processes.

- the participation in, association to commit, attempts to commit and aiding, abetting, facilitating and counselling the commission of any of the actions referred to in previous points converting or transferring of property, concealing and disguising the identity of illegally obtained proceeds.

- the acquisition, possession or use of property, knowing, at the time of receipt, that such property was derived from criminal activity or from an act of participation in such an activity;

- the concealment or disguise of the true nature, source, location, disposition, movement, rights with respect to, or ownership of, property, knowing that such property is derived from criminal activity or from an act of participation in such an activity;

- the conversion or transfer of property, knowing that such property is derived from criminal activity or from an act of participation in such activity, for the purpose of concealing or disguising the illicit origin of the property or of assisting any person who is involved in the commission of such an activity to evade the legal consequences of that person's action;

Definitions of money Laundering and terrorist financing used in the methodology and the risk assessment

·Insurance corporations (ICs): ICs are financial corporations or quasi-corporations that are principally engaged in financial intermediation as a consequence of the pooling of risks, mainly in the form of direct insurance or reinsurance. There are 3 387 ICs in the euro area and 627 ICs in the non-euro area in Q3-2016.

·Payment statistics relevant institutions (PSRIs): PSRIs are payment service providers (including electronic money issuers) and payment system operators. PSRIs offer payment services and/or are entitled to do so. They can be classified in different institutional sectors. In Q4-2015, the euro area had 5 768 PSRIs and the non-euro area 1 423 PSRIs.

·Financial vehicle corporations (FVCs): FVCs are undertakings set up under national or Community law which i) carry out securitisation transactions primarily and are insulated from the risk of bankruptcy or any other default of the originator; and; b) issue securities, securitisation fund units, other debt instruments and/or financial derivatives and/or legally or economically own assets underlying the issuance of securities, securitisation fund units, other debt instruments and/or financial derivatives offered for sale to the public or sold on the basis of private placements. There were 3 676 FVCs in the euro area and 14 FVCs in the non-euro area in Q4-2016.

·Investment funds (IFs): IFs are collective investment undertakings that: i) invest in financial and non-financial assets, within the meaning of the European system of national and regional accounts in the Community (ESA 95), their objective being to invest capital raised from the public; and ii) are set up under Community or national law. In March 2017, there was a total of 52 295 funds in the euro area and 3 570 in the non-euro area.

·Monetary financial institutions (MFIs): MFIs are resident credit institutions as defined in EU law, and other resident financial institutions. Their business is to receive deposits and/or close substitutes for deposits from entities other than MFIs. They also grant credits and/or make investments in securities, for their own account (at least in economic terms). In March 2017, there were 7 517 MFIs in the EU in total.

In terms of size of the EU financial system, the ECB maintains lists of the following five groups of institutions, based on information provided regularly by all members of the European System of Central Bank. This information covers the following institutions:

Total assets of these credit institutions headquartered in the EU evolved from EUR 33 798 billion to EUR 33 974 billion bn over the period December 2015 to September 2016.

The EU financial sector is one of the largest in the world. According to the consolidated banking data published by the European Central Bank , 3172credit institutions were headquartered in the EU in September 2016representing total assets of EUR 33 974 billion. In 2015, the number of employees of domestic credit institutions amounted to 2 864 106 individuals in the EU. The EU structural financial indicators provide further information about the structure of the EU financial sector and the market concentration. The number of credit institutions slightly decreased over the last year.

More specifically, the EU is one of the three largest global players for international trade, next to the United States and China. In 2014, the EU’s exports of goods were equivalent to 15.0% of the world total. They were surpassed for the first time since the EU was founded by China's exports of goods (15.5 %), but were still ahead of the United States (12.2 %), which had a larger share of world imports (15.9 %) than the EU (14.8 %) or China (12.9 %). Europe is the world’s largest exporter of manufactured goods and services, and is itself the biggest export market for around 80 countries. The EU’s trade in goods with the rest of the world was worth EUR 3 517 billion in 2015.

Given the large size of the EU internal market in relation to the rest of the world and its significance in in the financial sector, the supranational risk assessment (SNRA) is particularly important, both for the EU but also for non-EU countries.

(iv) the Commission's report should be made available to Member States and obliged entities to help them to identify, understand, manage and mitigate the risks of money laundering and terrorist financing. Every two years, this report should be revised on the basis of the findings of the regular risk assessments and the actions taken based on those findings.

(iii) the Commission's risk assessment should take the form of a report identifying, analysing and evaluating the risks of money laundering and terrorist financing. In addition, the Commission should make recommendations to Member States on the measures suitable for addressing the identified risks. Member States should follow these recommendations on a "comply or explain" basis.

(ii) the input the Commission should consider when conducting the assessment should include the Joint Committee of the European Supervisory Authorities' affecting the European Union's financial sector , the expertise of Member States representatives competent for anti-money laundering and countering financing of terrorism (AML/CFT), and input from the Financial Intelligence Units and other relevant EU-level bodies.

(i) the scope of the assessment should cover the risks of money laundering (ML) and terrorist financing (TF) affecting the internal market and relating to cross-border activities. It should include the areas of the internal market that are at greatest risks; the risks associated with each relevant sector and the most widespread means used by criminals by which to launder illicit proceeds.

The risk assessment provides a tool for the Commission to understand risks and elaborate policies that address risks of money laundering and terrorist financing in the internal market. As outlined in the European Security Agenda, assessing money laundering and terrorist financing risks is considered a key priority in designing the Commission's internal security strategy . It is also listed as one of the key deliverables in the Commission's action plan on strengthening the fight against terrorist financing . This was echoed by the Council of the EU which specifically requested that the assessment focus on terrorist financing and emerging risks such as virtual currencies . The Council invited the Commission to carry out this assessment as a matter of priority .

As required under Article 6 of Directive (EU) 2015/849, this paper complements the first Commission Report on the assessment of the risks of money laundering and terrorist financing affecting the internal market and relating to cross-border activities "the Report") . It aims to provide a factual overview of the risk analysis performed on the different sectors in the internal market. The details of the risk analysis are presented in Annex 1.

on the assessment of the risks of money laundering and terrorist financing affecting the internal market and relating to cross-border activities

EUROPEAN COMMISSION Brussels, 26.6.2017 SWD(2017) 241 final COMMISSION STAFF WORKING DOCUMENT

Accompanying the document Report from the Commission to the European Parliament and to the Council on the assessment of the risks of money laundeirng and terrorist financing affecting the internal market and relating to cross-border situations {COM(2017) 340 final}



TABLE OF CONTENT Annex 1 - RISK ANALYSIS BY PRODUCTS Annex 2 – PROJECT CHARTER Annex 3 - METHODOLOGY FOR THE SUPRANATIONAL RISK ASSESSMENT OF MONEY LAUNDERING AND TERRORIST FINANCING RISKS Annex 4 – OVERVIEW OF ENTITIES SUBJECT TO THE AML/CFT FRAMEWORK Annex 5 – STATISTICS ON SUSPICIOUS TRANSACTION REPORTS Annex 6 - EU LEGISLATION RELEVANT IN THE AML/CFT FIELD Annex 7 - GLOSSARY Annex 8 - BIBLIOGRAPHY



ANNEX 1 - RISK ANALYSIS BY PRODUCTS























The SNRA was carried out following a defined methodology allowing a systematic analysis of the ML or TF risks linked to modi operandi used by perpetrators. The aim was not to pass judgment on a sector as a whole, but to identify the circumstances according to which the services and products it delivers or provides could be abused for TF or ML purposes. This SNRA is based on Directive 2005/60/EC (3AMLD) which was the legislation in force at the time of the analysis. It describes the areas in which, at the time, the EU legal framework was not as harmonised or complete as it would be once the forthcoming revisions of 3AMLD had taken effect. In particular, Directive (EU) 2015/849 (4AMLD) shall be transposed by 26 June 2017. Since the 4AMLD was not yet transposed at the time of the analysis, it was not considered as part of the legal framework in place for the risk analysis. The 4AMLD and its upcoming revision (COM(2016) 450) are, however, considered as part of the mitigating measures. For each risk, a rating has been defined for the threat and vulnerability based on the criteria defined in the methodology (see annex 3). Those ratings are determined on a scale from 1 to 4 as follows: 1) Lowly significant (value: 1)

2) Moderately significant (value: 2) 3) Significant (value: 3) 4) Very significant (value: 4) Those ratings were used only to synthesise the analysis. They should not be considered in isolation from the factual description of the risk.



Contents Cash products Cash couriers Cash intensive business High value banknotes Payments in cash Financial sector products Retail financial sector – deposits on accounts Institutional investment sector - Banking

Institutional investment sector - Brokers Corporate banking sector Private banking sector Crowdfunding Currency exchange E-money sector Transfers of funds Illegal transfers of funds - Hawala Payment services Virtual currencies Business loans Consumer credit and low value loans Mortgage credit and high value asset-backed credits Life-Insurance Non-Life Insurance Safe custody services Non-financial products Creation legal entities and legal arrangements Business activity of legal entities and legal arrangements Termination of legal entities and legal arrangements

High value goods – artefacts and antiquities High value assets – Precious metals and precious stones High value assets – other than precious metals and stones Couriers in precious metals and stones Investment real estate Services from accountants, auditors, tax advisors Legal service from notaries and other independent legal professionals Gambling sector products General description of the gambling sector Betting Bingo Casinos Gaming machines (outside casinos) Lotteries Poker Online gambling Non-for-profit organisations Collect and transfers of funds through a Non-Profit Organisation (NPO) Horizontal vulnerabilities Vulnerabilities linked to financial supervision

Vulnerabilities linked to Financial Intelligence Units



Cash products



Cash couriers Product Cash couriers / cross external border cash movements General description of the sector and related product/activity concerned

This assessment covers the supranational risks – i.e. cash entering/leaving the European Union at the EU external borders. The Cash Control Regulation establishes a uniform EU approach towards cash controls based on a mandatory declaration system. If a natural person entering or leaving the EU (including transiting) transports cash of a value of EUR 10 000 or more, he/she must declare these funds. The EUR 10 000 threshold is considered high enough not to burden the majority of travellers and traders with disproportionate administrative formalities. However, when there are indications of illegal activities linked with movements of cash lower than EUR 10 000, the collecting and recording of information related to these movements is also authorised. This provision was introduced in order to limit the practice of 'smurfing' or 'structuring', the practice of deliberately carrying amounts lower than the threshold with the intention to escape the obligation to declare (e.g. splitting the amount between different connected persons from a same group/family). The Cash Control Regulation is aimed at aligning EU legislation with the requirements of the FATF's Recommendation 32 on cash couriers and with the highest global AML/CFT standards. The definition of cash in the Cash Control Regulation matches the definition used by the FATF for Recommendation 32 on cash couriers and includes:

¬Currency, i.e. banknotes and coins that are in circulation as a medium of exchange.

¬Bearer-negotiable instruments (BNI) As the Cash Control Regulation mirrors the definition of 'cash' used in the supra-national standard (FATF recommendation 32), gold, precious metals or stones, electronic cash cards and casino chips are currently not included in the definition of cash. Statistics: On average, 100 000 cash control declarations are submitted annually in the EU, representing a total amount declared between 60-70 billion Euro. While amounts of undeclared or incorrectly declared cash which have been detected by authorities are highly variable (240 Mio – 1.5 billion Euro/year), on average approximately 300 Mio Euro per year is detected following controls. Statistics show a sustained, high level of cash declarations over the years and also a significant increase in the number of recordings at the EU border in recent years. It is difficult to pinpoint the exact combination of reasons behind these trends based on the available data. General comment (where relevant) This risk scenario is intrinsically linked to use of/payment in cash and to high value denomination banknotes risk scenario. Criminals or terrorist financiers who generate/accumulate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where one has easier access to placement in the legal economy. The characteristics of such locations are a predominant use of cash, more lax supervision of the financial system or stronger bank secrecy regulations. It may also be used by terrorists to transfer rapidly and safely funds from one location to another, including by using cash concealed in air transit. Cash couriers may use air, sea or rail transport to cross an EU external border. In addition, cash may be moved across external borders unaccompanied such as in containerised or other forms of cargo, or concealed in mail or post parcels. If perpetrators wish to move very large amounts of cash, often a valuable option is to conceal it in cargo that can be containerised or otherwise transported across borders. Perpetrators may also use sophisticated concealment methods of cash within goods which are either carried across the external border by a courier or are sent by regular mail or post parcel services. Although unaccompanied consignments tend to be smaller than those secreted within vehicles, or on the person of cash couriers, the use of high denomination banknotes can still result in seizures of significant value. Threat Terrorist financing The assessment of the TF threat related to cash couriers/unaccompanied cash movements shows that terrorist groups have made use of various techniques to move physical cash across the external borders, particularly in the case of larger organisations. This threat is particularly relevant for cash couriers from the EU to third countries. LEAs have seized large amounts of money in conflicts zones that was supposed to finance terrorist organisations. In addition, cases have been identified where (prospective) foreign terrorist fighters doubled as cash couriers to fund their travels and sojourn in conflict areas. These individuals typically carry lower amounts that are more difficult to detect and may not be subject to an obligation to declare incumbent on natural persons carrying EUR 10 000 Euro or more is cash. As it allows for anonymity, this modus operandi is perceived as attractive and fairly secure, despite still carrying some risks. That is the reason why this modus operandi shall also be considered in conjunction with the analysis of high denomination banknotes. The more high denomination banknotes are used, the easier the cash transportation is – although risks associated with acquiring high denomination notes (not readily available) may not outweigh the benefit of additional compactness. Cash transportation is a recurring modus operandi for terrorist groups in Syria / ISIL occupied territories – although the average amounts carried by a foreign fighter leaving the EU may not be significant compared to locally available funds. The threat of cash transportation into the EU from a third country may also exist, in particular from countries exposed to TF risks or conflict areas (e.g. cash couriers from Syria, Gulf region, Russia into the EU have been reported). There are limited indications of high-value movements of cash into the Union (i.e. much in excess of the declaration threshold) for the purposes of terrorism financing. Cases have been identified concerning lower amounts and involving integration of cash amounts carried from third countries into the financial system/legal economy of the EU (analysed in a separate fiche). From a perpetrator risk-management perspective, sending cash through post or freight consignments, using multiple consignments each containing lower amounts presents a theoretically attractive option as there is no courier physically crossing the external border carrying the cash who could be intercepted. While customs controls may take place, these do not allow for the capture of all relevant data. Finally, perpetrators may also have an incentive to convert cash in other types of anonymous assets which are not subject to cash declarations (gold, prepaid cards - covered by separate fiche). Conclusions: LEAs have gathered evidence that cash couriers are recurrently used by terrorist groups to finance their activities or fund FTF travels. Similarly to the analysis conducted on cash, the use by criminal elements or terrorist financiers of cash couriers present advantages since this modi operandi is easily accessible, with no specific planning or expertise required. In that context, the level of TF threat related to cash couriers is considered as very significant (level 4). Money laundering The assessment of the ML threat related to cash couriers presents some commonalities with TF threats. Organised crime organisations also recurrently make use of cash couriers for the same reasons: easily accessible, no expertise, no planning and low cost. This modus operandi is very attractive for organised crime since it offers an alternative vs. the use of the formal financial sector to move funds while allowing full anonymity. Numerous cases of suspicious cash transports have been reported by law enforcement authorities (either in connection with predicate offenses to money-laundering such as drug trafficking and other serious crimes or as separate incidents). Similarly cases were reported for other types of cash-like instruments (gold, anonymous prepaid cards), which are outside the scope of this fiche (see separate fiches). Since specific controls are focusing on physical transportation by natural persons, perpetrators may find sending cash by post/freight/shipping more attractive and more secure. There is anecdotal evidence that this modus operandi was used but the size of the problem is difficult to quantify (see IA on CCR revision). Conclusions: the level of ML threat related to cash couriers is considered as very significant (level 4) Vulnerability Terrorism Financing (a) risk exposure: The assessment of the TF vulnerability related to cash couriers shows that due to the nature of cash, the use of cash couriers allows significant volumes of transactions/transportation to take place speedily and anonymously. The cross-border aspect of this modus operandi increases the risk to involve geographical areas identified as high risks. (b) risk awareness: The legislation in place (mandatory cash declarations by natural persons at the external borders of the EU) has increased the risk awareness, at least as far as persons are concerned. Risk awareness exists for unaccompanied cash transportation – but is more limited. (c) legal framework and controls: There are controls in place through the mandatory declaration of cash transportation at the EU external borders (Cash Control Regulation). This legislation has increased the risk awareness, at least as far as natural persons are concerned. These cash declarations allow for easier detection of suspicious transactions and reporting to the FIUs (although shortcomings in information sharing exist). Where unaccompanied cash is concerned (cash sent through consignments or parcels) the present legal framework relies mainly on customs controls, which do not allow the capture of all relevant data. Conclusions: The risk exposure related to cash couriers by physical persons is intrinsically linked to the cash based activity (large volume, anonymity, speediness) - which is exacerbated by the fact that –especially within a terrorism context- the individual couriers often carry amounts below the declarative threshold. While the volume of cash couriers may be more important than for unaccompanied shipping, risk awareness and controls are in place. The use of cash couriers or methods to ship in/out of the EU unaccompanied cash coupled with the anonymity of cash and (at least with respect to unaccompanied cash) an imperfect control mechanism presents a significant challenge. While the volume of unaccompanied cash shipped in/out the EU is probably lower than for accompanied cash couriers, the risk awareness and controls of the latter pose a greater challenge. In that context, the level of TF vulnerability related to cash couriers by natural persons is considered as significant (level 3). The level of TF vulnerability related to post/freight is considered as very significant considering the controls/legal framework in place, more than the inherent risk exposure (level 4). Money Laundering (a) risk exposure The assessment of the ML vulnerability related to cash couriers shows that the risk exposure is intrinsically linked to the cash based activity (anonymity, speediness). Hence the risk exposure is particularly important for this modus operandi. (b) risk awareness The legislation in place (mandatory cash declarations at the external borders for cash carried by natural persons) has increased the risk awareness, at least as far as persons are concerned. Risk awareness exists for unaccompanied physical cash transportation – but is more limited with regard to shipping/freight/couriers. (c) legal framework and controls Similarly to TF, there are controls in place through the mandatory declaration of cash transportation at the EU external borders (Cash Control Regulation) by natural persons. These cash declarations allow an easier detection of suspicious transactions and are reported to the FIUs (although shortcomings in information sharing exist and enforcement in application may also vary between Member States). Where unaccompanied cash is concerned (cash sent through consignments or parcels) the present legal framework relies mainly on customs controls, which do not allow the capture of all relevant data. Conclusions: The risk exposure related to cash couriers by physical persons is intrinsically linked to the cash based activity (large volume, anonymity, speediness). While the volume of cash couriers may be more important, the risk awareness and the controls in place exist. The use of cash couriers or methods to ship in/out of the EU unaccompanied cash coupled with the anonymity of cash and (at least with respect to unaccompanied cash) an imperfect control mechanism presents a significant challenge. While the volume of unaccompanied cash shipped in/out the EU is probably lower than for accompanied cash couriers, the risk awareness and controls in place pose a greater challenge. In that context, the level of ML vulnerability related to cash couriers by natural persons is considered as significant (level 3) and by post/freight is considered as very significant (level 4). Mitigating measures The Commission will present a legislative proposal revising the cash control Regulation to further mitigate those risks. In order to provide competent authorities with adequate tools, the proposal intends to: ·Enable authorities to act on amounts lower than the declaration threshold of EUR10 000, where there are suspicions of criminal activity, ·Improve the exchange of information between authorities and Member States; ·Enable competent authorities to demand disclosure for cash sent in unaccompanied consignments such as cash sent in postal parcels or freight shipments; ·Extend the definition of 'cash' to also include precious commodities acting as highly liquid stores of value such as gold, and to prepaid payment cards which are currently not covered by the standard cash control declaration.



Cash intensive business Product Cash intensive business Sector sectors of bars, restaurants, constructions companies, motor vehicle retailers, car washes, art and antique dealers, auction houses, pawnshops, jewelleries, textile retail, liquor and tobacco stores, retail/night shops, gambling services General description of the sector and related product/activity concerned An interesting description of the use of cash has been described by the European Central Bank in its report Consumer cash usage. A cross-country comparison with payment diary survey data (ECB Working Paper Series, no 1685, 2014) < https://www.ecb.europa.eu/pub/pdf/scpwps/ecbwp1685.pdf > Concerning cash limitations, 12 Member States (Germany, Estonia, Ireland, Cyprus, Lithuania, Luxembourg, Malta, Netherlands, Austria, Finland, Sweden, United Kingdom) do not have any restrictions on cash payments. In most countries, large value cash payments triggered obligations under the anti-money laundering provisions of the Directive or national legislation – along the following lines: (the previous chart ignores the absence of restriction for non-business transactions between private persons) The following general observations can be made: ·Limitations typically apply to transactions in both national and foreign currencies, the limit being in such case the equivalent of the national limit in that currency. ·Limitations apply to single payments exceeding the thresholds, but legislations often consider that multiple payments connected to a single operation should be considered as one. ·Limitations always concern at least businesses and transactions between businesses and customers. Non-business transactions between natural persons are often not concerned by the limitation (BE, DK, GR, ES, FR, HR, LV, HU, PL, PT). ·Limitations typically apply to transactions in cash (i.e. banknotes). Some national legislations extend explicitly the limitations to bearer instruments (ES, IT) Description of the risk scenario Cash intensive business is used by perpetrators: - to launder large amounts of cash, which are proceeds of criminal activity, by claiming that the funds originate from economic activities; - to launder amounts of cash, which are proceeds of criminal activity, by justifying its origin based on fictitious economic activities (both for goods and services) - to finance, through often small amounts of cash, terrorist activities without any traceability General comment (where relevant) This risk scenario is intrinsically linked to use of/payment in cash and to high value denomination banknotes risk scenario. Threat Terrorist financing The assessment of the TF threat related to cash intensive business shows that cash intensive businesses are generally run by individuals through bars, restaurants, phone shops but are managed by a network of persons forming a terrorist organisation. In general, they are used to get clean cash in a speedy way (e.g. selling cars or jewelleries). However, this risk scenario is not used equally by all terrorist organisations (never seen for Daesh for instance) and not largely widespread as it requires capabilities to run the business. Conclusions: the elements gathered by the LEAs and FIUs show only few cases have been registered meaning that terrorist groups do not favour this risk scenario as it requires some technical expertise and investments to run the business in itself which makes this modus operandi less attractive. However, since this risk is not only hypothetical and that sleeper cells are active in cash intensive businesses, the level of TF threat related to cash intensive business is considered as moderately significant (level 2). Money laundering The assessment of the ML threat related to cash intensive business shows that this modus operandi is exploited by criminals as it represents a viable option which is rather attractive and secure. It constitutes the easiest way to hide illegitimate proceeds of crime. However, as for TF, it requires a moderate level of expertise to be able to run the business and to escape detection. Conclusions: cash intensive businesses are favoured by criminal organisations to launder proceeds of crime. As it requires some level of expertise to run the business, the level of ML threat related to cash intensive business is considered as significant (level 3). Vulnerability Terrorist financing The assessment of the TF vulnerability related to cash intensive business shows that the main factors are linked to the risk posed by cash. (a) risk exposure While cash intensive business is less attractive to terrorist organisations than to criminals (see threat assessment below), when they are used by terrorists they present some vulnerabilities because the underlying risk is the one related to cash. The vulnerability assessment of TF related to cash intensive business is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rationale. Cash intensive businesses allow the processing of a huge number of anonymous transactions which require no management of new technologies and tracking tools. Hence it has a high inherent risk exposure. (b) risk awareness The risk awareness appears to be quite low because, even if large sums of cash can be obtained from cash intensive business, some FIUs notice that terrorist organisations seem to prefer lower denomination banknotes which are less easy to be considered as suspicious by obliged entities and LEAs. (c) legal framework and controls in place The legal frameworks in place related to cash payment limitations that some Member States have introduced. This framework varies a lot from one Member State to another concerning cash controls and cash payment limitations and, thus, controls can potentially be inexistent. Conclusions: the vulnerability of cash intensive business is intrinsically linked to the vulnerabilities related to the use of cash in general. The variety of legal frameworks in place, the widespread use of cash in EU economies and the fact that the sector seems being not aware of this risk, the level of TF vulnerability related to cash intensive business is considered as very significant (level 4). Money laundering The assessment of the ML vulnerability related to cash intensive business shows that the main factors are linked to the risk posed by cash. (a) risk exposure The vulnerability assessment of ML related to cash intensive business is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rational. Cash intensive businesses allow the processing of a huge number of anonymous transactions which require no management of new technologies and tracking tools. This risk exposure concerns cash payments both for goods and services. Hence it has a high inherent risk exposure. (b) risk awareness Obliged entities are usually aware about the risk posed by cash – although controls are not easy to implement. However, for other professions not submitted to AML/CFT obligations, risk awareness remains a challenge. (c) legal framework and controls in place There is no uniform level of controls at EU level, for instance through common rules on cash limitations or cash transactions reports. The vulnerability of the sector is affected by the existence, or lack thereof, of rules relating to cash payment limitations: ·where cash limitation rules exist, ML vulnerabilities related to cash intensive business have been more easily mitigated thanks to the legal requirements which allow the refusal of cash payments above a certain threshold. In these cases, controls are in place and allow detecting red flags and suspicious transactions more easily. In addition, these cash payment thresholds are perceived by the sector and by LEAs as more efficient and, eventually, less burdensome than imposing customer due diligence measures. However, these legal businesses can also hide shadow and illicit activities which are able to circumvent the cash limitations. ·where cash limitations rules do not exist, and whilst the risk awareness is quite high, the sector does not know how to manage the risks. It has no tools to control and detect suspicions transactions. The result is that the number of STRs is rather low, or even inexistent. Some Member States have introduced cash transaction reports to be declared for cash operations over a certain threshold. However, there is no common approach at EU level. From an internal market perspective, the differences between Member States legislations on cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing in cash intensive business in another Member States having lower/no control on cash limitation. The existence of cash payments limitations in some Member States, and their absence in other Member States, creates the possibility to bypass the restrictions by moving to the Member States where there are no restrictions, whilst still conducting their terrorist or other illegal activities in the 'stricter' Member State. The 3rd AML Directive provides that high value dealers accepting payment in cash beyond EUR 15 000 are subject to AML/CFT rules and have to apply CDD requirements. This obligation applies to any persons trading in goods when the payment is made in cash beyond EUR 15 000 – but it does not cover services. However, the effectiveness of those measures is still limited given the number of STRs. The volume of STR reporting is generally low because cash transactions are difficult to detect, there is not much available information and dealers may lose their clients to the benefit of competitors applying looser controls. In addition, it may be difficult for a trader in high value goods to design an AML/CFT policy in the limited events where a cash transaction beyond the threshold takes place (i.e. it is not the sector in itself which is covered by AML/CFT regime – but only high value dealers faced with cash transactions beyond a threshold). For this reason, some Member States have extended the scope to cover certain sectors regardless of the use of cash. Some Member States have also decided to apply a general cash restriction regime at this threshold to reduce the risk of ineffective or cumbersome application of CDD rules by high value dealers. However, it does not mitigate situations of cash intensive business which are based on lower amount cash transactions – or a repeated number of low amount cash transactions. In addition, cash intensive businesses are inherently risky because there are no rules dealing with fit and proper testing of these businesses' managers. Some cash intensive businesses are more vulnerable than others because they may give rise to cash exchange more easily (motor retails or pawnshops). Conclusions: the risk exposure to ML of cash intensive businesses is influenced by the existence of legal cash limitations which are efficient to mitigate the risks but are not always sufficient. In a cross-border context, the variety of regulations on cash payments constitutes also a factor of vulnerabilities. When no rules are in place, the risk awareness of the sector is quite low, leading to few STRs to FIUs. Investigative capacities from LEAs are then quite limited. In light of this, the level of ML vulnerabilities related to cash intensive businesses is considered as very significant (level 4). Mitigating measures ·The Commission examines launching an initiative to swiftly reinforce the EU framework on the prevention of terrorism financing by enhancing transparency of cash payments through an introduction of a restriction of cash payments or by any other appropriate means. Organised crime and terrorism financing rely on cash for payments for carrying out their illegal activities and benefitting from them. By restricting the possibilities to use cash, the proposal would contribute to disrupt the financing of terrorism, as the need to use non anonymous means of payment would either deter the activity or contribute to its easier detection and investigation. Any such proposal would also aim at harmonising restrictions across the Union, thus creating a level playing field for businesses and removing distortions of competition in the internal market. It would additionally foster the fight against money laundering, tax fraud and organised crime. ·The Commission will continue to monitor the application of AML/CFT obligations by dealers in goods covered by the AMLD and further assess risks posed by providers of services accepting cash payments. It will further assess the added value and benefit for making additional sectors subject to AML/CFT rules. ·Member States should take into account in their national risk assessments the risks posed by payment in cash in order to define appropriate mitigating measures such as the introduction of cash limits for payments, Cash Transaction Reporting systems, or any other measures suitable to address the risk. Member States should consider making sectors particularly exposed to money laundering and terrorist financing risks subject to the AML/CFT preventative regime based on the results of their NRA.



High value banknotes Product High value banknotes Sector / General description of the sector and related product/activity concerned In spite of steady growth in non-cash payment methods and a moderate decline in the use of cash for payments, the total value of euro banknotes in circulation continues to rise year-on-year beyond the rate of inflation. Cash is largely used for low value payments and its use for transaction purposes is estimated to account for around one-third of banknotes in circulation. Meanwhile the demand for high denomination notes, such as the EUR 500 note, not commonly associated with payments, has been sustained. These are anomalies which may be linked to criminal activity. Perhaps the most significant finding around cash is that there is insufficient information around its use, both for legitimate and illicit purposes. The nature of cash and the nature of criminal finances mean that there is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. One of the few reliable figures available, that of the volume and value of bank notes issued and in circulation in the EU, leaves open questions around the use to which a large proportion of cash in issuance is put, especially when considering the EUR 500 note. From a total of approximately EUR 1 trillion banknotes in circulation as of end-2014, the use of a significant proportion of these remains unknown. Furthermore, the EUR 500 note alone accounts for over 30% of the value of all banknotes in circulation, despite it not being a common means of payment. Although it has been suggested that these notes are used for hoarding, this assumption is not proven. Even if this is the case, the nature of the cash being hoarded (criminal or legitimate) is unknown. Description of the risk scenario Perpetrators use high value denominations, such as EUR 500 banknotes, to make the cash transportation easier (the larger the denomination, the more funds can be shrunk to take up less space). General comment (if relevant) This risk scenario is intrinsically linked to use of/payment in cash and to cash intensive business risk scenario Threat Terrorist financing The assessment of the TF threat related to high value denomination banknotes shows that terrorist groups are not really keen in using high value denominations. They are not necessarily easy to access and, given that they can be detected quite easily they are not attractive for terrorist groups whose first objective is to get cash as quickly as possible. For sake of discretion, terrorist groups tend to favour low denominations banknotes. LEAs have detected few cases which tend to demonstrate that the intent and capability are not really significant. Conclusions: in that context, the level of TF threat related to high value denominations banknotes is considered as moderately significant (level 2) Money laundering The assessment of the ML threat related to high value denomination banknotes shows that they are recurrently exploited by criminal organisations to launder proceed of crime. The risk related to high value banknotes is not limited to EUR 500 and as long as long large sums in cash are gathered they are considered as attractive by criminal organisations. It does not require any major planning or complex operation – i.e. perpetrators have the technical skills to easily use this product. It remains a "low cost" operation and allows storing of large amounts in very small volumes – which makes it very attractive for organised crime. It has been reported by LEAs that some criminal groups seek EUR 500 banknotes by paying a premium in order to get access to those large denominations; this demonstrates its attractiveness. Conclusions: banknotes (EUR 500 but not only) are used recurrently by criminal organisations. This modus operandi is widely accessible and available at low cost. For ML purposes, it's quite easy to abuse and requires no specific planning or knowledge. In that context, the level of ML threat related to high value denomination banknotes is considered as very significant (level 4) Vulnerability Terrorist financing The assessment of TF vulnerability related to high value denomination banknotes shows that this product is as vulnerable for TF as for ML for the following reasons: (a) risk exposure Large volume of high value denominations is in circulation, despite low use in commercial transactions. Cash still allows carrying transactions in an expedited, anonymous, and untraceable way. (b) risk awareness Especially LEAs and FIUs have high risk awareness, as do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially Europol reports, point to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. (c) legal framework and controls in place Even if terrorist groups are less attracted to high value denomination banknotes, detection is quite difficult because there is no EU harmonisation concerning the legal framework related to the use of high value denomination banknotes. Controls are uneven; reports to FIUs are rather few, and most of the time they cannot distinguish between ML and TF. The use of high value denomination banknotes for ML purposes may be impacted by the ECB decision to gradually phase out EUR 500 (may 2016) because of the recognised links with criminal activities. However, the return rate is generally quite low and these banknotes may be still in use for a long time. Therefore, this cannot be seen as an immediate mitigation measure. Conclusions: from a vulnerability point of view, risk exposure is high, level of awareness is low and controls in place are not harmonised which create potential loopholes when cross-border transactions are at stake. In light of this, the level of TF vulnerability related to high value denomination banknotes is considered as very significant (level 4). Money laundering The assessment of ML vulnerability related to high value denomination banknotes shows the following features: (a) risk exposure High value denominations allow the storing/putting into circulation of large volumes of cash in a speedy and anonymous way. A large volume of high value denominations is in circulation, despite the low level of use in commercial transactions. Even if the use of high value denominations raises red flags, it remains that these denominations are not necessarily used for payments but rather to move funds. Large amounts can be stored in very small volumes. They are less easy to detect by FIUs and obliged entities. (b) risk awareness Especially LEAs and FIUs have high risk awareness, as do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially Europol reports, point to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. (c) legal framework and controls in place The use of high value denomination banknotes for ML purposes may be impacted by the ECB decision to gradually phase out EUR 500 (May 2016) because of the recognised links with criminal activities. The issuance of the EUR 500 will be stopped around the end of 2018. However, the return rate is generally quite low and these banknotes may be still in use for a long time. The EUR 500 will remain legal tender and can therefore continue to be used as a means of payment and store of value. Therefore, this cannot be seen as an immediate mitigation measure. Conclusions: similarly to the outcomes of the assessment of the TF vulnerability related to high value denomination banknotes, the ML vulnerability related to these products is considered as very significant (level 4). Mitigating measures ·Monitoring of the return rate of EUR 500 banknotes will be conducted as well as an assessment of the evolution of the usage of the EUR 200 banknote.



Payments in cash Product Payments in cash Sector / General description of the sector and related product/activity concerned Certain studies suggest that cash transactions have been moderately declining at a rate of between 1.3 – 3.3% per year7. This appears to correspond with available information around the growth of non-cash payment methods (an increase of about 4.2% for Europe8) and information on EU citizens’ access to banking services (around 89% of adults have bank accounts compared to just 41% in the developing world)9. However payments in cash are still widespread; according to ECB data, 87% of all transactions below EUR 20 are still made in cash. 7 http://www.richmondfed.org/publications/research/working_papers/2014/ pdf/wp14-09.pdf 8 http://www.ecb.europa.eu/press/pr/date/2013/html/pr130910.en.html 9 http://elibrary.worldbank.org/doi/pdf/10.1596/1813-9450-6025 Description of the risk scenario Perpetrators frequently need to use a significant portion of the cash that they have acquired to pay for the illicit goods they have sold, to purchase further consignments, or to pay the various expenses incurred in transporting the merchandise to where it is required. Despite the advantages and disadvantages of dealing in cash (detailed earlier in this report) for criminal groups, there is often little choice. The criminal economy is still overwhelmingly cash based. This means that, whether they like it or not, perpetrators selling some form of illicit product are likely to be paid in cash. The more successful the perpetrators are and the more of the commodity they sell, the more cash they will generate. This can cause perpetrators significant problems in using, storing and disposing of their proceeds. Yet despite these problems, cash is perceived to confer some significant benefits on them. In addition, the objective of criminals is to launder large amounts of cash, which are proceeds of criminal activity, by claiming that the funds originate from economic activities. They may launder amounts of cash, which are proceeds of criminal activity, by justifying its origin based on fictitious economic activities (both for goods and services). Terrorists may finance, through often small amounts of cash, terrorist activities without any traceability (see general description under cash intensive business). General comment (where relevant) This risk scenario is intrinsically linked to cash intensive business and high value denomination banknotes risk scenario. Threat Terrorist financing The assessment of the TF threat related to payments in cash shows that terrorist groups use recurrently cash, as this modus operandi is widely accessible and low cost. Cash is at the basis of all illicit trafficking and illicit purchase of products. In general, cash is really attractive, difficult (even impossible) to detect and does not require specific expertise to be used. Conclusions: based on the feedback from LEA and FIUs, the level of TF threat is considered as very significant (level 4). Money laundering The assessment of the ML threat related to payments in cash is considered as similar to the assessment of TF threat. For ML, cash is also the preferred option for criminals, which allows hiding illicit proceeds of crime easily and moving funds rapidly, including cross-border. As for TF, it does not require specific expertise, knowledge or planning capacities. Conclusions: based on the feedback from LEA and FIUs, the level of ML threat is considered as very significant (level 4). Vulnerability Terrorist financing The assessment of TF vulnerability related to payments in cash shows the following features: (a) risk exposure Cash payments allow speedy and anonymous transactions. The level of risk exposure is very high considering that large sums can also be moved across borders and may involve high risk customers and/or geographical areas. (b) risk awareness Especially LEAs and FIUs have high risk awareness, and so do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially a Europol report, points to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. (c) legal framework and controls in place While cash payment limitations may allow a mitigation of the level of vulnerability, legal frameworks in place related to cash payment limitations vary a lot from one Member State to another and, therefore, controls can potentially be inexistent. From an internal market perspective, the differences between Member States legislations on cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing cash intensive business in another Member States having lower/no control on cash limitation. The 3rd AML Directive provides that high value dealers accepting payment in cash beyond EUR 15 000 are subject to AML/CFT rules and have to apply CDD requirements. This obligation applies to any persons trading in goods when the payment is made in cash beyond EUR 15 000 – but it does not cover services. However, the effectiveness of those measures is still limited considering the number of STRs. The volume of STR reporting is generally low because cash transactions are difficult to detect, there are few available information and dealers may lose their clients for the benefit of competitors applying looser controls. For those Member States who have put in place CTR, most of the time they are not connected to any STR and the analysis cannot be conducted (for instance, large sums withdrawn from an ATM will trigger CTR but no specific suspicion is related to that and the FIU cannot launch any investigation). In addition, it may be difficult for a trader in high value goods to design an AML/CFT policy in the limited events where a cash transaction beyond the threshold takes place (i.e. it is not the sector in itself which is covered by AML/CFT regime – but only high value dealers faced with cash transactions beyond a threshold). For this reason, some Member States have extended the scope to cover certain sectors regardless of the use of cash. Some Member States have also decided to apply a general cash restriction regime at this threshold to reduce the risk of ineffective or cumbersome application of CDD rules by high value dealers. However, it does not mitigate situations of cash intensive business which are based on lower amount cash transactions – or a repeated number of low amount cash transactions. In any case, some competent authorities consider that even when cash payment limitations exist, enforcement of these limitations is very challenging and may limit their impact on TF activities. Conclusions: considering that cash payments may engage large transactions speedily and anonymously, including cross-border, that all sectors may potentially be exposed to cash payments and even if they are aware that these payments present some risks are not equipped to mitigate them (either because no framework/controls in place, or because enforcement of the controls is not efficient), the level of TF vulnerability related to payments in cash is considered as very significant (level 4). Money laundering The assessment of ML vulnerability related to payments in cash shows the following features: (a) risk exposure The sector shows the same vulnerability to TF as to ML. As for TF, cash payments allow speedy and anonymous transactions to launder proceeds of ML crime. The level of risk exposure is very high considering that large sums can also be moved across borders and may involve high risk customers and/or geographical areas. (b) risk awareness Especially LEAs and FIUs have high risk awareness, and so do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially the Europol report, points to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. (c) legal framework and controls in place While cash payment limitations may allow mitigating the level of vulnerability, legal frameworks in place related to cash payment limitations vary a lot from one Member State to another and, therefore, controls can potentially be inexistent. From an internal market perspective, the differences of Member States legislation in cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing cash intensive business in another Member States having lower/no control on cash limitation. The volume of reporting is very low because cash transactions are difficult to detect. For those Member States who have put in place CTR, most of the time they are not connected to any STR and the analysis cannot be conducted (for instance, large sums withdrawn from an ATM will trigger CTR but no specific suspicion is related to that and the FIU cannot trigger any investigation). In any case, some competent authorities consider that even when cash payment limitations exist, enforcement of these limitations is really challenging and may limit their impact on ML activities. Conclusions: considering that cash payments may engage large transactions speedily and anonymously, including across border, that all sectors may potentially be exposed to cash payments and even if they are aware that these payments present some risks are not equipped to mitigate them (either because no framework/controls in place, or because enforcement of the controls is not efficient), the level of ML vulnerability related to payments in cash is considered as very significant (level 4). Mitigating measures ·The Commission examines launching an initiative to swiftly reinforce the EU framework on the prevention of terrorism financing by enhancing transparency of cash payments through an introduction of a restriction of cash payments or by any other appropriate means. Organised crime and terrorism financing rely on cash payments for carrying out their illegal activities and benefitting from them. By restricting the possibilities to use cash, the proposal would contribute to disrupt the financing of terrorism, as the need to use non anonymous means of payment would either deter the activity or contribute to its easier detection and investigation. Any such proposal would also aim at harmonising restrictions across the Union, thus creating a level playing field for businesses and removing distortions of competition in the internal market. It would additionally foster the fight against money laundering, tax fraud and organised crime. ·The Commission will continue to monitor the application of AML/CFT obligations by dealers in goods covered by the AMLD and further assess risks posed by providers of services accepting cash payments. It will further assess the added value and benefit for making additional sectors subject to AML/CFT rules. ·Member States should take into account in their national risk assessments the risks posed by payment in cash in order to define appropriate mitigating measures such as the introduction of cash limits for payments, Cash Transaction Reporting systems, or any other measures suitable to address the risk. Member States should consider making sectors particularly exposed to money laundering and terrorist financing risks subject to the AML/CFT preventative regime based on the results of their NRA. Financial sector products Retail financial sector – deposits on accounts

Product Deposits on accounts Sector Credit and financial institutions General description of the sector and related product/activity concerned As far as trends are concerned, according to data from the European Banking Federation since 1998, the total stock of deposits in the EU contracted slightly, by 2.4% in 2013, but returned to a pattern of growth in 2014 (+0.2%). While the contraction in 2013 was generated in the euro area, the rise from 2014 onwards is only attributable to the euro area countries where bank deposits expanded by EUR171.3 billion or 1.0%. At the same time, non-euro area EU countries’ deposits contracted by EUR127.9 billion or 2.4%. In total, the 76.7% of all EU deposits are held by banks headquartered in the euro area. This share has changed very marginally in the last few years. Description of the risk scenario Perpetrators place the proceeds of crime into the financial system through the regulated credit and financial sector in order to hide its illegitimate origin. Terrorists, supporters or facilitators place funds from legitimate sources into the financial system with a view of using it for terrorist purposes. Money mules mechanisms may be used to transfer proceeds out of the banking sector using personal accounts either through cybercrime (scamming, fake banking websites etc.), money value transfer services. Threat Terrorist financing The assessment of the TF threat related to deposits on account /retail banking shows that this risk scenario concerns both placing funds and withdrawing funds (i.e. deposits on account and use of this account). It is frequently used by terrorists but also by relatives/friends and this extends the scope of the intent and capability analysis. Furthermore, law enforcement authorities have reported the use of forged or stolen documents by terrorists to open bank accounts. According to information from competent authorities, foreign terrorist fighters are generally withdrawing bank accounts' deposits through ATMs located in high risk third countries or conflict zones in general or in bordering countries. Terrorists outside conflict zones also withdraw funds through ATMs in order to pay in cash some of the expenses related to their operations. The source of the funds deposited on bank accounts may come from both legitimate and non-legitimate origins. In general, this modus operandi is easily accessible especially when legitimate funds are used, and thus they do not trigger any suspicion when the bank account is opened. It appears that terrorist groups do not have specific challenges in hiding the real beneficiary of the funds or the exact purpose of the transaction (destination of funds) given that they may still include family members or relatives in the ownership chain. Concerning cash withdrawals, it may be more challenging if the terrorist organisation cannot access ATM-related to banks in conflict zones. It requires at least basic planning and basic knowledge of how banking systems work. At the same time, once executed, cash withdrawals allow cross-border movements which make this risk scenario rather attractive. Conclusions: terrorists groups use rather frequently this easily accessible modus operandi, although it requires some basic knowledge and planning capabilities to ensure that funds deposited are legitimate. The identity of the beneficiary of funds can be hidden. This modus operandi is rather attractive for terrorist groups. In that context, the level of TF threat related to deposits on accounts is considered as significant/very significant (level 3/4) Money laundering The assessment of the ML threat related to deposits on account /retail banking shows that this risk scenario concerns both placing funds and withdrawing funds (i.e. deposits on account and use of this account). It is frequently used by organised crime organisations but also by relatives/close associates which extends the scope of the intent and capability analysis. Law enforcement authorities reported a frequent use of this modus operandi since it one of the easiest way to integrate illicit funds into the financial system. It does not require planning and knowledge of how banking systems work, and it is low cost. Also complex money laundering cases were reported with funds deposited on accounts transiting via a chain of complex operations. For such complex schemes, perpetrators may use available expertise from intermediaries. Conclusions: the level of ML threat related to deposits on account is considered as very significant (level 4). Vulnerability Terrorist financing The assessment of the TF vulnerability related to deposits on account /retail banking shows that as far as the placement and withdrawing of funds is concerned: (a) risk exposure: Deposits on accounts represent, by definition, high volumes of products where, in the case of cash, the origin of funds cannot be always traced. When traced through electronic payments, the origin of funds might be legitimate. In such case, the use made by those funds may trigger a link to terrorist activities. When used by terrorist organisations, funds may come from high risk third countries. (b) risk awareness: The risk awareness of credit and financial institutions is quite good due to the fact that the sector has put in place guidance to detect the relevant red flags on TF. While the sector is inherently highly exposed to TF risks, it has the adequate tools to detect these risks. This is confirmed by a good level of reporting. However, CDD and risk indicators are not always sufficient to detect a link to terrorist activities due to the legitimate origin of the funds. FIUs and LEAs are also well aware about the vulnerabilities of the sector and are proactively engaged with the sector. This is confirmed by the typology project launched by the Egmont group on ISIL. Nevertheless, some weaknesses remain in the supervision aspects. (c) legal framework and controls Retail banking services/deposits on accounts (including from cash) are covered by the AML/CFT framework since the first AML/CFT legislation at EU level in 1991. Controls in place are generally considered as efficient. Obliged entities are applying CDD measures including monitoring and reporting of STRs in an effective way. It is nevertheless important to mention that new risks and opportunities may emerge with FinTech/RegTech. Conclusions: although the risk exposure may be considered as quite high (significant level of transactions), the sector shows a good level of awareness to the risk vulnerability and is able to put in place the relevant red flags. The legal framework and controls are the basis of a good level of reporting. In that context, the level of TF vulnerability related to deposits on accounts/retail banking is considered as moderately significant (level 2). Money laundering The assessment of the ML vulnerability related to deposits on account /retail banking shows that it shares the same features as the TF vulnerability assessment. (a) risk exposure: Deposits on accounts represent, by definition, high volumes of products where in the case of cash, the origin of funds cannot be always traced. While rather common practice for credit and financial institutions, deposits represent a high number of operations that may involve different kind of customers (some may present factors of high risks, either because they are politically exposed persons or because they are based in areas identified as high risks). (b) risk awareness: The risk awareness is quite good due to the fact that the sector has put in place guidance to detect the relevant red flags on ML. While the sector is inherently highly exposed to ML risks, it has adequate tools to detect these risks. This is confirmed by a good level of reporting. FIUs and LEAs are also well aware about the vulnerabilities of the sector and are proactively engaged with the sector. Nevertheless, some weaknesses remain in the supervision aspects. (c) legal framework and controls Retail banking services provided by financial institutions and cash deposits to credit institutions are covered by the AML/CFT framework since the first AML/CFT legislation at EU level in 1991. Controls in place are considered as efficient. It is nevertheless important to mention that new risks and opportunities may emerge with FinTech/RegTech. Conclusions: similarly to what has been analysed under the TF vulnerability part, deposits on accounts are less exposed to ML risks due to the good functioning of the controls and a good level of awareness from the sector. In that context, the level of ML vulnerability related to deposit on accounts/retail banking is considered as moderately significant (level 2). Mitigating measures ·The Commission proposed to reinforce the Directive (EU) 2015/849 by putting forward targeted amendments as presented in the Commission's proposal adopted in July 2016 (see COM(2016)450): (i) broadening the scope and reinforcing accessibility of beneficial ownership information for legal entities and legal arrangements. This will also include interconnection of beneficial ownership registers at EU level. (ii) clarifying explicitly that electronic identification means as set out in Regulation (EU) No 910/2014 ("e-IDAS") can be used for meeting CDD requirements. ·The Commission will launch further analysis in order to identify risks and opportunities in FinTech/RegTech. The Commission FinTech Task Force will assess technological developments, technology enabled services and business models, will determine whether existing rules and policies are fit for purpose and will identify options and proposals to harness opportunities or address possible risks. .

·The Commission will carry out a study mapping and analysing on-boarding bank practices across the EU and any next steps will be assessed. ·The ESAs should provide updated guidelines on internal governance further clarifying expectations with regard to the functions of the compliance officer in financial institutions s. The Commission services will further analyse whether those guidelines allow a sufficient reinforcement of the position of the AML/CFT – compliance officer.



Institutional investment sector - Banking Product Deposits on accounts Sector Credit institutions - Institutional investment General description of the sector and related product/activity concerned The EU asset management sector is composed of two pillars that are complementing each other. The first pillar comprises the mutual fund industry, the so-called UCITS funds (EUR8 tr of assets under management). The second pillar includes alternative investment funds such as hedge funds, private equity, venture capital or real estate funds (EUR3 tr of assets under management). Description of the risk scenario Perpetrators are using institutional investors to invest in shares for integration of proceeds, title of shares to conceal beneficial ownership, frauds for predicate offence (e.g. insider dealing); brokerage accounts; investment to justify criminal proceeds as profit; predicate investment fraud. Placement of proceeds by using specialised, high-return financial services. General comments This risk scenario should be linked to the one related to institutional investment provided by brokers. It has been considered that as far as the ML vulnerability is concerned, the level of risk is higher for brokers. Threat Terrorist financing The assessment of the TF threat related to institutional investment- banks (securities, asset management, and investment) has been considered in conjunction with ML schemes related to institutional investment in order to hide the illegal origin of the funds. In that context, the TF threat does not benefit from a separate assessment. Conclusion: in light of this, the assessment of the TF threat related to institutional investment through banks is considered as moderately significant (level 2). Money laundering The assessment of the ML threat related to institutional investment- banks (securities, asset management, and investment) shows that criminal organisations do not favour this kind of risk scenario. Although large amount of funds can be gathered through this process, it is not easy to access, not financially viable (depends on the quality of investment) and in any case, it requires knowledge and technical expertise. It is very close to wealth management financial services. However, perpetrators may have increased intention to use this modus operandi when they can rely on more complex planning carried out by facilitators for this type of services. Conclusions: in that context, the assessment of the ML threat related to institutional investment through banks is considered as moderately significant (level 2). Vulnerability Terrorist financing The assessment of the TF vulnerability related to institutional investment - banks (securities, asset management, and investment) has been considered in conjunction with ML schemes related to institutional investment. In that context, the TF vulnerability does not benefit from a separate assessment. Conclusion: in light of this, the assessment of the TF vulnerability related to institutional investment through banks is considered as moderately significant (level 2). Money laundering The assessment of the ML vulnerability related to institutional investment - banks (securities, asset management, and investment) shows that: (a) risk exposure: The inherent risk is potentially high due to the nature of customers. This sector is mostly exposed to high risk customers including PEPs. The volume of transactions concerned is significant, also in term of amounts with a high level of cross-border transactions. (b) risk awareness: According to FIUs, the level of STRs is quite low in respect to the volume of transactions concerned. At the same time, financial transactions concerned are more complex and the suspicious ones are probably less easy to detect by obliged entities. The fact that the service is provided by a credit institution limits the vulnerabilities given that credit institutions are obliged to fulfil a number of basic compliance requirements for all activities and apply the same level of controls whatever the financial services concerned. Nevertheless, based on the information received, it seems that supervisors could not show a sound understanding of the operational AML/CFT risks posed by this specific type of business activity. (c) legal framework and controls: Institutional investments through banks are covered by AML/CFT requirements at EU level. However, the quality of this legal framework's implementation is questionable. In the investment field, the client manager has a vested interest in conducting the business relationship (reward/salary) and this may lead him/her to margin of complaisance in the implementation of CDD. It is also important to mention that new risks and opportunities may emerge with FinTech/RegTech. Conclusions: the risk exposure is inherently high due to the nature of the customer and the large amounts linked to the transactions. However, when provided by a bank, the investment service is quite well framed and controlled. The low level of STRs may be justified by the fact that due to the complexity of the transaction, few suspicious cases arose (in general, these transactions are approved by senior manager). In light of this, the ML vulnerability related to institutional investment provided through banking institutions is considered as moderately significant (level 2). Mitigating measures ·The Commission proposed to reinforce the Directive (EU) 2015/849 by putting forward targeted amendments as presented in the Commission's proposal adopted in July 2016 (see COM(2016)450): (i) broadening the scope and reinforcing accessibility of beneficial ownership information for legal entities and legal arrangements. This will also include interconnection of beneficial ownership registers at EU level. (ii) clarifying explicitly that electronic identification means as set out in Regulation (EU) No 910/2014 ("e-IDAS") can be used for meeting CDD requirements ·The Commission will launch further analysis in order to identify risks and opportunities on FinTech/RegTech. The Commission FinTech Task Force will assess technological developments, technology enabled services and business models, will determine whether existing rules and policies are fit for purpose and identify options and proposals to harness opportunities or address possible risks.

The Commission will carry out a study mapping and analysing on-boarding bank practices across the EU and any next steps will be assessed. ·Updated guidelines on internal governance further clarifying expectations with regard to the functions of the compliance officer in financial institutions should be provided by the ESAs and the Commission will further analyse whether those guidelines allow the position of the AML/CFT – compliance officer to be sufficiently reinforced. ·An analysis of operational AML/CFT risks linked to the business/business model in the institutional investment sector should be provided by the ESAs. . ·Further guidance for the application of beneficial ownership identification for providers of investment funds, especially in situations presenting a higher risk of ML/TF should be provided by the ESAs



Institutional investment sector - Brokers Product Deposits on accounts Sector Investments firms - Institutional investment General description of the sector and related product/activity concerned The EU asset management sector is composed of two pillars that are complementing each other. The first pillar comprises the mutual fund industry, so-called UCITS funds (EUR8 tr of assets under management). The second pillar includes alternative investment funds such as hedge funds, private equity, venture capital or real estate funds (EUR3 tr of assets under management). Description of the risk scenario Perpetrators are using institutional investors to invest in shares for integration of proceeds, title of shares to conceal BO, frauds for predicate offence (e.g. insider dealing); brokerage accounts; investment to justify criminal proceeds as profit; predicate investment fraud. Placement of proceeds by using specialised, high-return financial services. General comments This risk scenario should be linked to the one related to institutional investment provided by banks. It has been considered that as far as the ML vulnerability is concerned, the level of risk is lower for banks. Threat Terrorist financing The assessment of the TF threat related to institutional investment - brokers (securities, asset management, and investment) has been considered in conjunction with ML schemes related to institutional investment - brokers. In that context, the TF threat does not benefit from a separate assessment. Conclusion: in that context, the assessment of the TF threat related to institutional investment through brokers is considered as moderately significant (level 2). Money laundering The assessment of the ML threat related to institutional investment - brokers (securities, asset management, and investment) shows that criminal organisations do not favour this kind of risk scenario. Although large amount of funds can be gathered through this process, it is not easy to access, not financially viable (depends on the quality of investment) and in any case, it requires knowledge and technical expertise. It is very close to wealth management financial services. However, there may be intention when perpetrators can rely on more complex planning and use facilitators for this type of services. Conclusions: in that context, the assessment of the ML threat related to institutional investment through brokers is considered as moderately significant (level 2). Vulnerability Terrorist financing The assessment of the TF vulnerability related to institutional investment-brokers (securities, asset management, and investment) has been considered in conjunction with ML schemes related to institutional investment - brokers. In that context, the TF vulnerability does not benefit from a separate assessment. Conclusion: the risk exposure is inherently high due to the nature of the customer and the large amounts linked to the transactions. In addition, when provided by a broker/asset manager, the level of controls may be less efficient than when provided by a credit institution. In that context, the TF vulnerability related to institutional investment provided through brokers/asset managers is considered as significant (level 3). Money laundering The assessment of the ML vulnerability related to institutional investment -brokers (securities, asset management, and investment) shows that: (a) risk exposure: The inherent risk is potentially high due to the nature of customers. This sector is mostly exposed to high risk customers including PEPs. The volume of transactions concerned is significant, also in terms of amounts with a high level of cross-border transactions. (b) risk awareness: According to FIUs, the level of STRs is quite low in respect to the volume of transactions concerned. At the same time, the financial transactions concerned are complex and the suspicious transactions are probably less easy to detect by obliged entities. The fact that the service is provided by a broker affects the level of vulnerabilities which is considered as higher than the one concerning credit institutions. Competent authorities consider that asset managers are less equipped than credit institutions to detect suspicious transactions and apply the lowest controls on this kind of business relationships which constitute, most of the time, their core business. The competition component is not negligible and some cases have been identified where brokers accept to apply lower controls to attract more customers. Based on the information received, it seems that supervisors could not show a sound understanding of the operational AML/CFT risks posed by this specific type of business activity. (c) legal framework and controls: Institutional investments through brokers are covered by AML/CFT requirements at EU level. However, the quality of this legal framework's implementation is questionable. Competent authorities considered that the implementation of AML/CFT rules is less efficient for brokers than for credit institutions. In the investment field, the client manager has a vested interest in conducting the business relationship (reward/salary) and this may lead him/her to be more complacent in the implementation of CDD. Conclusions: the risk exposure is inherently high due to the nature of the customer and the large amounts linked to the transactions. In addition, when provided by a broker/asset manager, the level of controls may be less efficient than when provided by a credit institution. In that context, the ML vulnerability related to institutional investment provided through brokers/asset managers is considered as significant (level 3). Mitigating measures ·The Commission proposed to reinforce the Directive (EU) 2015/849 by putting forward targeted amendments as presented in the Commission's proposal adopted in July 2016 (see COM(2016)450): (i) broadening the scope and reinforcing accessibility of beneficial ownership information for legal entities and legal arrangements. This will also include interconnection of beneficial ownership registers at EU level. (ii) clarifying explicitly that electronic identification means as set out in Regulation (EU) No 910/2014 ("e-IDAS") can be used for meeting CDD requirements ·The Commission will launch further analysis in order to identify risks and opportunities on FinTech/RegTech. The Commission FinTech Task Force will assess technological developments, technology enabled services and business models, will determine whether existing rules and policies are fit for purpose and identify options and proposals to harness opportunities or address possible risks. .

·The Commission will carry out a study mapping and analysing on-boarding bank practices across the EU and any next steps will be assessed. ·Updated guidelines on internal governance further clarifying expectations with regard to the functions of the compliance officer in financial institutions should be provided by the ESAs and the Commission will further analyse whether those guidelines allow the position of the AML/CFT – compliance officer to be to sufficiently reinforced. ·An analysis of operational AML/CFT risks linked to the business/business model in the institutional investment sector as well as further guidance for the application of beneficial ownership identification for providers of investment funds, especially in situations presenting a higher risk of ML/TF should be provided by the ESAs. ·A sufficient number of on-site inspections that is commensurate to the ML/TF risks identified should be conducted by supervisors. In this context, supervisors should assess the implementation of rules with regard to identification of beneficial ownership (compliance with the BO definition). ·Member States' supervisors should carry out within 2 years, a thematic inspection on institutional investment, with a particular focus on brokers, except for those that carried out recently such thematic inspections. The results of the thematic inspections should be communicated to the Commission.



Corporate banking sector Product Deposits on accounts Sector Credit institutions - Corporate banking Description of the risk scenario Perpetrators use cash front businesses to inject proceeds into legal economy using company accounts with multi-signatories Threat Terrorist financing The assessment of the TF threat related to corporate banking has been considered as in conjunction with ML schemes related to corporate banking in order to hide the illegal origin of the funds. In that context, the TF threat does not benefit from a separate assessment. Conclusions: this modus operandi is used by criminals and, from LEAs perspective, requires only moderate levels of knowledge and expertise. In that context, the level of TF threat related to corporate banking is considered as significant (level 3). Money laundering The assessment of the ML threat related to corporate banking shows that this risk scenario has been recurrently used for ML schemes. While it requires more sophistication than the retail financial sector, depending on the financial service concerned, this level of sophistication is lowered (for instance, personal documentation is required only if there is demand for a credit loan). Nevertheless, given the level of sophistication that corporate banking operations require, in general the conduct of money laundering activities should involve the complicity of financial/legal intermediaries that shall be paid for their "services". This is a parameter that may have an impact on the intent component. Conclusions: this modus operandi is used by criminals and, from LEAs perspective, requires only moderate levels of knowledge and expertise. In that context, the level of ML threat related to corporate banking is considered as significant (level 3). Vulnerability Terrorist financing The assessment of the TF vulnerability related to corporate banking has been considered as in conjunction with ML schemes related to corporate banking. In that context, the TF vulnerability does not benefit from a separate assessment. Conclusions: the level of TF vulnerability related to corporate banking is considered as moderately significant (level 2). Money laundering The assessment of the ML vulnerability related to corporate banking shows that: (a) risk exposure: The inherent risk is potentially high due to the nature of customers. Indeed, corporate banking is, by definition, used by companies where the identification of the beneficial owner constitutes a particular point of vulnerability. The structure of the business relationship (more complex) and the transactions concerned (larger amounts than in retail payments) as well as the risk linked to forged documentation affect the level of risk exposure. (b) risk awareness: The sector appears quite aware of its risks. It has developed tools in order to trigger adequate red flags. FIUs have confirmed this element mentioning that a high number of STRs was received on this matter. Based on the information received, it seems that supervisors could not show a sound understanding of the operational AML/CFT risks posed by this specific type of business activity. (c) legal framework and controls: Corporate banking is covered by AML/CFT requirements at EU level. This framework is considered as satisfactory as the one covering other financial activities undertaken by credit institutions. It is also important to mention that new risks and opportunities may emerge with FinTech/RegTech. Conclusions: corporate banking presents some vulnerability due to customers' risk factors. However, the legal framework in place is considered as adapted to these vulnerabilities and credit institutions involved in corporate banking activities are aware of the ML risks and equipped to address them. In that context, the level of ML vulnerability related to corporate banking is considered as moderately significant (level 2). Mitigating measures For the Commission ·The Commission proposed to reinforce the Directive (EU) 2015/849 by putting forward targeted amendments as presented in the Commission's proposal adopted in July 2016 (see COM(2016)450): (i) broadening the scope and reinforcing accessibility of beneficial ownership information for legal entities and legal arrangements. This will also include interconnection of beneficial ownership registers at EU level. (ii) clarifying explicitly that electronic identification means as set out in Regulation (EU) No 910/2014 ("e-IDAS") can be used for meeting CDD requirements ·Launching further analysis in order to identify risks and opportunities on FinTech/RegTech. The Commission set up a FinTech Task Force with the objective of assessing technological developments, technology enabled services and business models, determine whether existing rules and policies are fit for purpose and identify options and proposals to harness opportunities or address possible risks. ·The Commission will carry out a study mapping and analysing on-boarding bank practices across the EU and any next steps will be assessed. For the European Supervisory Authorities ·ESAs to provide for updated guidelines on internal governance further clarifying expectations with regard to the functions of the compliance officer in financial institutions. The Commission will further analyse whether those guidelines allow the position of the AML/CFT – compliance officer to be sufficiently reinforced. ·In the context of the update of the Joint Committee of the ESAs' joint opinion on risks of ML and TF ESAs should provide an analysis of operational AML/CFT risks linked to the business/business model in the corporate banking sector. For competent authorities/self-regulatory bodies ·Authorities/self-regulatory bodies should provide training sessions and guidance on risk factors with specific focus on non-face-to-face business relationships; off-shore professional intermediaries or customers or jurisdictions; complex/shell structures. ·Self-regulatory bodies/competent authorities should conduct thematic inspections on how beneficial owner identification requirements are implemented. ·Annual r