EUROPEAN COMMISSION Brussels, 20.7.2021 COM(2021) 420 final 2021/0239(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing

(Text with EEA relevance) {SEC(2021) 391 final} - {SWD(2021) 190 final} - {SWD(2021) 191 final}



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL •Reasons for and objectives of the proposal Money laundering and terrorist financing pose a serious threat to the integrity of the EU economy and financial system and the security of its citizens. Europol has estimated that around 1% of the EU’s annual Gross Domestic Product is ‘detected as being involved in suspect financial activity’. In July 2019, following a number of prominent cases of alleged money laundering involving credit institutions in the Union, the Commission adopted a package analysing the effectiveness of the EU Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) regime as it stood at that time, and concluding that reforms were necessary. In this context, the EU’s Security Union Strategy for 2020-2025 highlighted the importance of enhancing the EU’s framework for anti-money laundering and countering terrorist financing in order to protect Europeans from terrorism and organised crime. On 7 May 2020 the Commission presented an Action Plan for a comprehensive Union policy on preventing money laundering and terrorist financing. In that Action Plan, the Commission committed to take measures in order to strengthen the EU’s rules on combating money laundering and terrorist financing and their implementation and defined six priorities or pillars: 1. Ensuring effective implementation of the existing EU AML/CFT framework, 2. Establishing an EU single rulebook on AML/CFT, 3. Bringing about EU-level AML/CFT supervision, 4. Establishing a support and cooperation mechanism for FIUs, 5. Enforcing EU-level criminal law provisions and information exchange, 6. Strengthening the international dimension of the EU AML/CFT framework. While pillars 1, 5 and 6 of the Action Plan are being implemented, the other pillars demand legislative action. This proposal for a Regulation is part of an AML/CFT package of four legislative proposals that is considered as one coherent whole, in implementation of the Commission Action Plan of 7 May 2020, creating a new and more coherent AML/CFT regulatory and institutional framework within the EU. The package encompasses: –this proposal for a Regulation on the prevention of the use of the financial system for the purposes of money laundering (ML) and terrorist financing (TF); –a proposal for a Directive establishing the mechanisms that Member States should put in place to prevent the use of the financial system for ML/TF purposes, and repealing Directive (EU) 2015/849; –a proposal for a Regulation creating an EU Authority for anti-money laundering and countering the financing of terrorism (‘AMLA’), and –a proposal for the recast of Regulation (EU) 2015/847 expanding traceability requirements to crypto-assets. This present legislative proposal, together with a proposal for a Directive and a proposal for a recast of Regulation (EU) 2015/847, fulfils the objective of establishing an EU single rulebook (pillar 2). Both the European Parliament and the Council lent their support to the plan set out by the Commission in the May 2020 Action Plan. In its resolution of 10 July 2020, the European Parliament called for strengthening Union rules and welcomed plans to overhaul the EU AML/CFT institutional set-up. On 4 November 2020, the ECOFIN Council adopted Conclusions supporting each of the pillars of the Commission’s Action Plan.

The need for harmonised rules across the internal market is corroborated by the evidence provided in the 2019 reports issued by the Commission. These reports identified that whereas the requirements of Directive (EU) 2015/849 are far-reaching, their lack of direct applicability and granularity led to a fragmentation in their application along national lines and divergent interpretations. This situation does not allow dealing effectively with cross-border situations and are therefore ill-suited to adequately protect the internal market. It also generates additional costs and burdens for operators providing cross-border services and causes regulatory arbitrage. To address the above issues and avoid regulatory divergences, all rules that apply to the private sector have been transferred to this proposal for an AML/CFT Regulation, whereas the organisation of the institutional AML/CFT system at national level is left to a Directive, in recognition of the need for flexibility for Member States in this area. However, the present proposal does not simply transfer provisions from the existing AML/CFT Directive to a Regulation; a number of changes of substance are made in order to bring about a greater level of harmonisation and convergence in the application of AML/CFT rules across the EU: –in order to mitigate new and emerging risks, the list of obliged entities is expanded to include crypto-asset service providers but also other sectors such as crowdfunding platforms and migration operators; –to ensure consistent application of rules across the internal market, requirements in relation to internal policies, controls and procedures are clarified, including in the case of groups, and customer due diligence measures are made more granular, with clearer requirements according to the risk level of the customer; –the requirements in relation to third countries are reviewed to ensure that enhanced due diligence measures are applied to those countries that pose a threat to the Union’s financial system; –requirements in relation to politically exposed persons are subject to minor clarifications, particularly as regards the definition of a politically exposed person; –beneficial ownership requirements are streamlined to ensure an adequate level of transparency across the Union, and new requirements are introduced in relation to nominees and foreign entities to mitigate risks that criminals hide behind intermediate levels; –to guide more clearly reporting of suspicious transactions, red flags raising suspicion are clarified, whereas disclosure requirements and private-to-private sharing of information remain unaltered; –in order to ensure full consistency with EU data protection rules, requirements for the processing of certain categories of personal data are introduced and a shorter time-limit is provided for retention of personal data; –the measures to mitigate the misuse of bearer instruments are strenghtened and a provision limiting the use of cash for large transactions is inserted in light of the proven low effect of the current approach relying on traders in goods for implementing AML/CFT requirements in relation to large cash payments. Having directly-applicable AML/CFT rules in a Regulation, with more detail than at present in Directive (EU) 2015/849, will not only promote convergence of application of AML/CFT measures across Member States, but will also provide a consistent framework against which AMLA will be able to monitor the application of such rules in its function as a direct supervisor of certain obliged entities. •Consistency with existing policy provisions in the policy area This proposal takes as its starting point the existing Directive (EU) 2015/849, as amended by Directive (EU) 2018/843. While it follows the current risk-based and comprehensive approach, it deepens and enhances it with a view to bringing about greater effectiveness and cross-border consistency of application of AML/CFT requirements. Building on the amendments introduced by Directive 2018/843, it streamlines beneficial ownership transparency across the internal market, addressing those aspects where a lack of granularity had created possibilities for criminals to exploit the weakest link. This proposal must be seen as part of a package, with the other legislative proposals which accompany it, fully consistent with one another. This proposal is consistent with the latest amendments to the recommendations of the Financial Action Task Force (FATF), and in particular in relation to the expansion of the scope of entities subject to AML/CFT requirements to include crypto-asset service providers and measures to be taken by obliged entities to assess and mitigate the risks of evasion of targeted financial sanctions. In line with FATF standards, this proposal ensures a consistent approach across the Union to the mitigation of risks deriving from bearer shares and bearer share warrants. Going beyond FATF standards, it tackles risks that are specific to the Union or that have Union-level impacts, such as those deriving from migration schemes or from large cash payments. •Consistency with other Union policies EU legislation on AML/CFT interacts with several pieces of EU legislation in the financial services and criminal law areas. This includes EU legislation on payments and transfers of funds (Payment Services Directive, Payment Accounts Directive, Electronic Money Directive). Some examples of how coherence with other EU legislation has been ensured are the following: –The inclusion of crypto asset service providers among the entities subject to AML/CFT rules and the introduction of information requirements for transfers of virtual assets will complement the recent Digital Finance Package of 24 September 2020 and will ensure full consistency between the EU framework and FATF standards. –The approach taken to identifying entities subject to AML/CFT rules will also ensure consistency with the recently adopted Regulation on European crowdfunding service providers, in that it subjects to EU AML/CFT rules crowdfunding platforms falling outside the scope of that Regulation, given that certain AML/CFT safeguards are contained in that Regulation for crowdfunding platforms subject to it. –The amendments to rules on Customer Due Diligence (CDD) include provisions to better frame CDD in cases where remote customer onboarding is carried out, coherent with the Commission’s proposed amendment to the eIDAS Regulation in relation to a framework for a European Digital Identity, including European digital identity wallets and relevant trust service, in particular electronic attestations of attributes. This is in line with the Digital Finance Strategy.

2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY •Legal basis This proposal for a regulation is based on Article 114 TFEU, the same legal basis as the current EU AML/CFT legal framework. Article 114 is appropriate considering the significant threat to the internal market caused by money laundering and terrorist financing, and the economic losses and disruption of functioning of the single market and reputational damage on a cross-border level which this can create at the level of the Union. •Subsidiarity In accordance with the principles of subsidiarity and proportionality as set out in Article 5 of the Treaty on European Union, the objectives of the proposal cannot be sufficiently achieved by Member States and can therefore be better achieved at the Union level. The proposal does not go beyond what is necessary to achieve those objectives. The 2019 Commission AML package highlighted how criminals have been able to exploit the differences among Member States’ AML/CFT regimes. Flows of illicit money and terrorist financing can damage the stability and reputation of the Union financial system and threaten the proper functioning of the internal market. Measures adopted solely at national level could have adverse effects on the internal market and contribute to fragmentation. EU action is justified in order to maintain a level playing field across the Union – with entities in all Member States subject to a consistent set of anti-money laundering and combating terrorist financing obligations. The cross-border nature of much money laundering and terrorist financing makes good cooperation between national supervisors and FIUs essential to prevent these crimes. Many entities subject to AML obligations have cross-border activities, and different approaches by national supervisors and FIUs hinder them in achieving optimal AML/CFT practices at group level. •Proportionality Proportionality has been an integral part of the impact assessment accompanying the proposal and all the proposed options in different regulatory fields have been assessed against the proportionality objective. The cross-border nature of much money laundering and terrorist financing requires a coherent and consistent approach across Member States based on a single set of rules in the form of a single rulebook. However, the present proposal does not adopt a maximum harmonisation approach, as being incompatible with the fundamental risk-based nature of the EU’s AML/CFT regime. In areas where specific national risks justify it, Member States remain free to introduce rules going beyond those laid out in the present proposal. •Choice of the instrument A Regulation of the European Parliament and of the Council is an appropriate instrument to contribute to the creation of a single rulebook, being directly and immediately applicable, and thus removing the possibility of differences in application in different Member States due to divergences in transposition. A directly-applicable set of rules at EU level is also needed in order to allow EU-level supervision of certain obliged entities, which is proposed in the draft regulation creating AMLA accompanying the present proposal. 3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS •Ex-post evaluations/fitness checks of existing legislation A full ex-post evaluation of the current EU AML/CFT regime has not yet taken place, against the background of a number of recent legislative developments. Directive (EU) 2015/849 was adopted on 20 May 2015, with a transposition deadline for Member States of 26 June 2017. Directive (EU) 2018/843 was adopted on 30 May 2018, with a transposition deadline of 10 January 2020. Transposition control is still ongoing. However, the Commission Communication of July 2019 and accompanying reports referred to above serve as an evaluation of the effectiveness of the EU AML/CFT regime as it stood at that point in time. •Stakeholder consultations The consultation strategy supporting this proposal was composed of a number of components: –A consultation on the roadmap announcing the Commission’s Action Plan. The consultation, on the Commission’s Have Your Say portal, ran between 11 February and 12 March 2020, and received 42 contributions from a range of stakeholders; –A public consultation on the actions put forward in the Action Plan, open to the general public and all stakeholder groups, launched on 7 May 2020, and open until 26 August. The consultation received 202 official contributions; –A targeted consultation of Member States and competent AML/CFT authorities. Member States had the opportunity to give their views in various meetings of the Expert Group on Money Laundering and Terrorist Financing, and EU FIUs made input in meetings of the FIU Platform and via written papers. The discussions were supported by targeted consultations of Member States and competent authorities, using questionnaires; –A request for advice from the European Banking Authority, made in March 2020; the EBA provided its opinion on 10 September; –On 23 July 2020, the EDPS issued an opinion on the Commission’s Action Plan;

–On 30 September 2020, the Commission organised a high-level conference, bringing together representatives from national and EU authorities, MEPs, private sector and civil society representatives and academia. Stakeholder input on the Action Plan was broadly positive. •Collection and use of expertise In preparing this proposal, the Commission relied on qualitative and quantitative evidence collected from recognised sources, including technical advice from the European Banking Authority. Information on enforcement of AML rules was also obtained from Member States via questionnaires. •Impact assessment This proposal is accompanied by an impact assessment, which was submitted to the Regulatory Scrutiny Board (RSB) on 6 November 2020 and approved on 4 December 2020. The same impact assessment also accompanies the other legislative proposals which are presented together with the present proposal. The RSB proposed various presentational improvements to the impact assessment in its positive opinion; these have been made. In the impact assessment the Commission considered three problems: lack of clear and consistent rules, inconsistent supervision across the internal market and insufficient coordination and exchange of information among FIUs. The first of those problems is relevant for the present proposal; on that problem the following options were considered: 1. EU rules would remain as they are with no modifications; 2. Ensure a greater level of harmonisation in the rules that apply to obliged entities and leave it to Member States to detail the powers and obligations of competent authorities; 3. Ensure a greater level of harmonisation in the rules that apply to entities subject to AML/CFT obligations and the powers and obligations of supervisors and FIUs; Based on the outcome of the impact assessment, option 3 is the preferred option. By introducing a consistent and more granular approach to the rules at EU level, it would allow to remove the current fragmentation both as regards AML/CFT obligations for obliged entities, and the activities of competent authorities. For obliged entities which are active cross-border, it will bring about a level playing field as regards AML/CFT rules and involve savings in implementation costs. Greater detection and deterrence of ML/TF will be promoted. Annex VI of the Impact Assessment examines the different areas for greater harmonisation of rules, including the list of obliged entities, CDD measures, CDD threshold for occasional transactions, AML/CFT policies, controls and procedures requirements, Crypto-Asset Service Providers and beneficial ownership transparency. Annex VIII of the Impact Assessment analyses a revised approach to third countries which pose a threat to the Union’s financial system and to the internal market as a whole; the present proposal implements that new approach. Annex IX of the Impact Assessment analyses the introduction of limits to large cash transactions; the present proposal implements that new approach. •Regulatory fitness and simplification Although, as noted above, no formal ex-post evaluation or fitness check of existing EU AML/CFT legislation has yet taken place, a number of points can be made with regard to elements of the proposal which will further simplification and improve efficiency. Firstly, the replacement of certain rules in a Directive with more harmonised and directly applicable rules in a Regulation will remove the need for transposition work in the Member States and facilitate doing business for cross-border entities in the EU. Moreover, the removal from the scope of the EU AML/CFT framework of traders in goods, linked to the proposed prohibition on cash operations over EUR 10 000, will release such traders from the administrative burden of applying AML/CFT requirements in relation to cash operations exceeding EUR 10 000. Finally, the greater degree of harmonisation of AML rules in a number of specific areas will facilitate the implementation of group-wide internal policies, controls and procedures across the internal market. •Fundamental rights The EU is committed to ensuring high standards of protection of fundamental rights. In particular, safeguards for the handling of personal data by obliged entities are introduced to ensure compliance with the relevant data protection requirements, and in particular in relation to certain categories of personal data of a more sensitive nature. 4.BUDGETARY IMPLICATIONS This Regulation has no budgetary implications.

5.OTHER ELEMENTS •Implementation plans and monitoring, evaluation and reporting arrangements The proposal includes a general plan for monitoring and evaluating the impact on the specific objectives, requiring the Commission to carry out a first review five years after the date of application of the Regulation (and every three years thereafter), and to report to the European Parliament and the Council on its main findings. The proposal for an AML/CFT Directive accompanying this present proposal has the same evaluation provisions, and the evaluation of the two instruments can be combined in one report. The review is to be conducted in line with the Commission’s Better Regulation Guidelines. •Detailed explanation of the specific provisions of the proposal Subject matter and scope, including list of Obliged Entities While most definitions are carried over from the current EU AML/CFT legislation, a number of definitions are added, adapted or updated. The range of entities defined as Obliged Entities under current EU AML/CFT legislation and thus subject to EU AML/CFT rules is amended in the following ways: the scope of crypto-asset service providers (CASPs) is aligned with that of the Financial Action Task Force and thus widened compared with the current Directive; crowdfunding service providers which fall outside the scope of Regulation (EU) 2020/1503 are added; creditors for mortgage and consumer credits as well as mortgage and consumer credit intermediaries that are not credit institutions or financial institutions are added to ensure a level playing field between operators providing the same kind of services; operators involved on behalf of third country nationals in the context of investor residence schemes are added; traders in goods are removed (hitherto, these had an obligation to report cash transactions of a value over EUR 10 000), except for dealers in precious metals and stones, who, given the exposure to money laundering and terrorist financing risks of the sector, should continue to apply AML/CFT requirements. Internal policies controls and procedures The requirement on obliged entities to have in place a policy to identify and assess the risks of money laundering and terrorist financing they are facing, with a risk-based approach, and to mitigate those risks builds on current EU AML/CFT legislation but provides more clarity on the requirements. Obliged entities must take all measures at the level of their management to implement internal policies, controls and procedures, including the appointment of a dedicated compliance manager, and ensure that responsible staff are appropriately trained. The requirement to allocate a member of the staff to the role of compliance officer and the tasks of such role are clarified. Clarifications are provided in relation to the requirements that apply to groups, to be further complemented by regulatory technical standards detailing minimum requirements, the role of parent entities that are not themselves obliged entities and the conditions under which other structures such as networks and partnerships should apply group-wide measures. The requirements applicable to groups with branches operating in third countries are maintained. Customer due diligence While most provisions on Customer Due Diligence (CDD) are carried over from existing EU AML/CFT legislation, a number of clarifications and additional details are laid down in this proposal regarding CDD. The fundamental objective of CDD is clarified as being to obtain sufficient knowledge of customers enabling obliged entities to determine the money laundering and terrorist financing risks of business relationships or occasional transactions and to decide the corresponding mitigating measures which they need to apply. More specific and detailed provisions are laid down on the identification of the customer and on the verification of the customer’s identity. The conditions for the use of electronic identification means as set out by Regulation (EU) No 910/2014 are clarified. AMLA is empowered and required to produce regulatory technical standards on the standard datasets for identifying natural and legal persons; these RTS will include specific simplified CDD measures that obliged entities may implement in case of lower risk situations identified in the Supranational Risk Assessment that the Commission is required to draw up. Rules on simplified and enhanced due diligence measures are detailed. Third country policy The policy regarding third countries is adapted. The Commission will identify third countries either taking into account the public identification by the relevant international standard-setter (the FATF) or on the basis of its own autonomous assessment. Third countries so identified by the Commission will be subjected to two different sets of consequences, proportionate to the risk they pose to the Union’s financial system: (i) third countries subject to all enhanced due diligence measures and to additional country-specific countermeasures; and (ii) third countries subject to country-specific enhanced due diligence measures. In principle, third countries “subject to a call for action” by the FATF will be identified by the Commission as high-risk third countries. Due to the persistent nature of the serious strategic deficiencies in their AML/CFT framework, all enhanced due diligence measures will apply to them as well as country-specific countermeasures to proportionately mitigate the threat. Third countries with compliance weaknesses in their AML/CFT regimes, defined as “subject to increased monitoring” by the FATF, will in principle be identified by the Commission and subject to country-specific enhanced due diligence measures, proportionate to the risks. The Commission may also identify third countries, which are not listed by the FATF, but which pose a specific threat to the Union’s financial system and which, on the basis of that threat, will be subject either to country-specific enhanced due diligence measures or, where appropriate, to all enhanced due diligence measures and to countermeasures. In assessing the level of threat stemming from those third countries, the Commission may build on the technical expertise of AMLA. Finally, AMLA will develop guidelines on money laundering and terrorist financing risks, trends and methods, which do not have a country-specific dimension, but rather stem from geographical areas outside the Union and advise obliged entities accordingly on the opportunity to implement measures to mitigate them. This revised approach to third countries aims at ensuring that external threats to the Union’s financial system and the proper functioning of the internal market are effectively mitigated, by implementing a harmonised approach at EU level and ensuring more granularity and proportionality in the definition of the consequences attached to the listing, on a risk-sensitive basis. Politically Exposed Persons (PEPs) The provisions on PEPs are based on the current AML/CFT legislation, with an obligation on Member States to draw up lists of functions which confer PEP status on their territory, and obligations on obliged entities to subject PEPs to enhanced CDD measures, on a risk-based approach. The requirements applicable to persons who no longer hold prominent public functions are laid down in legislation. Reliance and outsourcing Building on the current rules, the proposal clarifies the respective conditions for the resort to reliance on CDD already performed by other obliged entities and outsourcing of functions to other entities or service providers. The proposal maintains that in either situation the ultimate responsibility for conformity with the rules remains with the obliged entity. A risk-based approach must be applied and providers based in high-risk third countries, countries with compliance weaknesses as well as in any other country that poses a threat to the Union’s financial system must not be relied upon or outsourced functions to. Beneficial ownership information The provisions on beneficial ownership information in the proposal build on those in current EU AML/CFT legislation, including the concept of beneficial ownership and the requirement for all corporate and other legal entities to obtain and hold adequate, accurate and current beneficial ownership information. More detailed rules are provided to identify the beneficial owner(s) of corporate and other legal entities, and a harmonised approach to the identification of beneficial ownership is laid down. With regard to express trusts and similar legal entities or arrangements, provisions are provided to ensure the consistent identification of beneficial owners across Member States when similar situations are faced, including an empowerment for a Commission implementing act. The proposal includes disclosure requirements for nominee shareholders and nominee directors, and introduces the obligations to register their beneficial ownership in the Union for non-EU legal entities that either enter into a business relationship with an EU obliged entity or acquire real estate in the Union. Reporting obligations

The provisions on reporting of suspicious transactions to FIUs (or to a self-regulatory body, if a Member State would provide for that) are based on those in current EU AML/CFT legislation. Clearer rules are provided on how transactions are to be identified. In order to facilitate obliged entities’ compliance with their reporting obligations and allow for a more effective functioning of the FIUs’ analytical activities and cooperation, AMLA will develop draft implementing technical standards specifying a common template for the reporting of suspicious transactions to be used as a uniform basis throughout the EU. Data protection The EU General Data Protection Regulation (Regulation (EU) 2016/679) applies to the processing of personal data for the purposes of this proposal. The proposal clarifies the conditions that apply to the processing of certain categories of personal data of a more sensitive nature by obliged entities. Obliged entities must retain records of certain personal data for five years. Measures to mitigate the risks of misuse of bearer instruments The proposal contains a provision preventing traders in goods or services from accepting cash payments of over EUR 10 000 for a single purchase, while allowing Member States to maintain in force lower ceilings for large cash transactions. This ceiling does not apply to private operations between individuals. The Commission must assess the benefits and impacts of further lowering of this threshold within three years of application of the proposed Regulation. The provision and custody of anonymous crypto-asset wallets are prohibited. Companies that are not listed are prohibited from issuing bearer shares and are required to register those shares. The issuance of bearer share warrants is only allowed in intermediated form. Final provisions Provisions for the adoption by the Commission of delegated acts under Article 290 of the Treaty are laid down. The Regulation will enter into force on the twentieth day after publication in the Official Journal and become applicable 3 years after its entry into force. The Commission must review and evaluate this Regulation within five years of its application and every three years thereafter. 2021/0239 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing

(Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Central Bank, Having regard to the opinion of the European Economic and Social Committee, Acting in accordance with the ordinary legislative procedure, Whereas:

(1)Directive (EU) 2015/849 of the European Parliament and of the Council constitutes the main legal instrument for the prevention of the use of the Union financial system for the purposes of money laundering and terrorist financing. That Directive sets out a comprehensive legal framework, which Directive (EU) 2018/843 of the European Parliament and the Council further strengthened by addressing emerging risks and increasing transparency of beneficial ownership. Notwithstanding its achievements, experience has shown that further improvements should be introduced to adequately mitigate risks and to effectively detect criminal attempts to misuse the Union financial system for criminal purposes. (2)The main challenge identified in respect to the application of the provisions of Directive (EU) 2015/849 laying down obligations for private sector actors, the so-called obliged entities, is the lack of direct applicability of those rules and a fragmentation of the approach along national lines. Whereas those rules have existed and evolved over three decades, they are still implemented in a manner not fully consistent with the requirements of an integrated internal market. Therefore, it is necessary that rules on matters currently covered in Directive (EU) 2015/849 which may be directly applicable by the obliged entities concerned are addressed in a new Regulation in order to achieve the desired uniformity of application. (3)This new instrument is part of a comprehensive package aiming at strengthening the Union’s AML/CFT framework. Together, this instrument, Directive [please insert reference – proposal for 6th Anti-Money Laundering Directive - COM/2021/423 final], Regulation [please insert reference – proposal for a recast of Regulation (EU) 2015/847 - COM/2021/422 final] and Regulation [please insert reference – proposal for establishment of an Anti-Money Laundering Authority - COM/2021/421 final] will form the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the Union’s AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering and countering the financing of terrorism (‘AMLA’). (4)Money laundering and terrorist financing are frequently carried out in an international context. Measures adopted at Union level, without taking into account international coordination and cooperation, would have very limited effect. The measures adopted by the Union in that field should therefore be compatible with, and at least as stringent as actions undertaken at international level. Union action should continue to take particular account of the Financial Action Task Force (FATF) Recommendations and instruments of other international bodies active in the fight against money laundering and terrorist financing. With a view to reinforcing the efficacy of the fight against money laundering and terrorist financing, the relevant Union legal acts should, where appropriate, be aligned with the International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation adopted by the FATF in February 2012 (the ‘revised FATF Recommendations’) and the subsequent amendments to such standards. (5)Since the adoption of Directive (EU) 2015/849, recent developments in the Union’s criminal law framework have contributed to strengthening the prevention and fight against money laundering, its predicate offences and terrorist financing. Directive (EU) 2018/1673 of the European Parliament and of the Council has led to a common understanding of the money laundering crime and its predicate offences. Directive (EU) 2017/1371 of the European Parliament and of the Council defined financial crimes affecting the Union’s financial interest, which should also be considered predicate offences to money laundering. Directive (EU) 2017/541 of the European Parliament and of the Council has achieved a common understanding of the crime of terrorist financing. As those concepts are now clarified in Union criminal law, it is no longer needed for the Union’s AML/CFT rules to define money laundering, its predicate offences or terrorist financing. Instead, the Union’s AML/CFT framework should be fully coherent with the Union’s criminal law framework. (6)Technology keeps evolving, offering opportunities to the private sector to develop new products and systems to exchange funds or value. While this is a positive phenomenon, it may generate new money laundering and terrorist financing risks, as criminals continuously manage to find ways to exploit vulnerabilities in order to hide and move illicit funds around the world. Crypto-assets service providers and crowdfunding platforms are exposed to the misuse of new channels for the movement of illicit money and are well placed to detect such movements and mitigate risks. The scope of Union legislation should therefore be expanded to cover these entities, in line with the recent developments in FATF standards in relation to crypto-assets. (7)The institutions and persons covered by this Regulation play a crucial role as gatekeepers of the Union’s financial system and should therefore take all necessary measures necessary to implement the requirements of this Regulation with a view to preventing criminals from laundering the proceeds of their illegal activities or from financing terrorist activities. Measures should also be put in the place to mitigate any risk of non-implementation or evasion of targeted financial sanctions. (8)Financial transactions can also take place within the same group as way of managing group finances. However, such transactions are not undertaken vis-à-vis customers and do not require the application of AML/CFT measures. In order to ensure legal certainty, it is necessary to recognise that this Regulation does not apply to financial activities or other financial services which are provided by members of a group to other members of that group. (9)Independent legal professionals should be subject to this Regulation when participating in financial or corporate transactions, including when providing tax advice, where there is the risk of the services provided by those legal professionals being misused for the purpose of laundering the proceeds of criminal activity or for the purpose of terrorist financing. There should, however, be exemptions from any obligation to report information obtained before, during or after judicial proceedings, or in the course of ascertaining the legal position of a client, which should be covered by the legal privilege. Therefore, legal advice should remain subject to the obligation of professional secrecy, except where the legal professional is taking part in money laundering or terrorist financing, the legal advice is provided for the purposes of money laundering or terrorist financing, or where the legal professional knows that the client is seeking legal advice for the purposes of money laundering or terrorist financing. (10)In order to ensure respect for the rights guaranteed by the Charter of Fundamental Rights of the European Union (the ‘Charter’), in the case of auditors, external accountants and tax advisors, who, in some Member States, are entitled to defend or represent a client in the context of judicial proceedings or to ascertain a client's legal position, the information they obtain in the performance of those tasks should not be subject to reporting obligations. (11)Directive (EU) 2018/843 was the first legal instrument to address the risks of money laundering and terrorist financing posed by crypto-assets in the Union. It extended the scope of the AML/CFT framework to two types of crypto-assets services providers: providers engaged in exchange services between virtual currencies and fiat currencies and custodian wallet providers. Due to rapid technological developments and the advancement in FATF standards, it is necessary to review this approach. A first step to complete and update the Union legal framework has been achieved with Regulation [please insert reference – proposal for a Regulation on Markets in Crypto-assets, and amending Directive (EU) 2019/1937 - COM/2020/593 final], which set requirements for crypto-asset service providers wishing to apply for an authorisation to provide their services in the single market. It also introduced a definition of crypto-assets and crypto-assets services providers encompassing a broader range of activities. Crypto-asset service providers covered by Regulation [please insert reference – proposal for a Regulation on Markets in Crypto-assets, and amending Directive (EU) 2019/1937 - COM/2020/593 final] should also be covered by this Regulation, to mitigate any risk of misuse of crypto-assets for money laundering or terrorist financing purposes. (12)Crowdfunding platforms’ vulnerabilities to money laundering and terrorist financing risks are horizontal and affect the internal market as a whole. To date, diverging approaches have emerged across Member States as to the management of those risks. Regulation (EU) 2020/1503 of the European Parliament and of the Council harmonises the regulatory approach for business investment and lending-based crowdfunding platforms across the Union and ensures that adequate and coherent safeguards are in place to deal with potential money laundering and terrorist financing risks. Among those, there are requirements for the management of funds and payments in relation to all the financial transactions executed on those platforms. Crowdfunding service providers must either seek a license or partner with a payment service provider or a credit institution for the execution of such transactions. The Regulation also sets out safeguards in the authorisation procedure, in the assessment of good repute of management and through due diligence procedures for project owners. The Commission is required to assess by 10 November 2023 in its report on that Regulation whether further safeguards may be necessary. It is therefore justified not to subject crowdfunding platforms licensed under Regulation (EU) 2020/1503 to Union AML/CFT legislation. (13)Crowdfunding platforms that are not licensed under Regulation (EU) 2020/1503 are currently left either unregulated or to diverging regulatory approaches, including in relation to rules and procedures to tackle anti-money laundering and terrorist financing risks. To bring consistency and ensure that there are no uncontrolled risks in that environment, it is necessary that all crowdfunding platforms that are not licensed under Regulation (EU) 2020/1503 and thus are not subject to its safeguards are subject to Union AML/CFT rules in order to mitigate money laundering and terrorist financing risks. (14)Directive (EU) 2015/849 set out to mitigate the money laundering and terrorist financing risks posed by large cash payments by including persons trading in goods among obliged entities when they make or receive payments in cash above EUR 10 000, whilst allowing Member States to introduce stricter measures. Such approach has shown to be ineffective in light of the poor understanding and application of AML/CFT requirements, lack of supervision and limited number of suspicious transactions reported to the FIU. In order to adequately mitigate risks deriving from the misuse of large cash sums, a Union-wide limit to large cash transactions above EUR 10 000 should be laid down. As a consequence, persons trading in goods should no longer be subject to AML/CFT obligations. (15)Some categories of traders in goods are particularly exposed to money laundering and terrorist financing risks due to the high value that the small, transportable goods they deal with contain. For this reason, persons dealing in precious metals and precious stones should be subject to AML/CFT requirements. (16)Investment migration operators are private companies, bodies or persons acting or interacting directly with the competent authorities of the Member States on behalf of third-country nationals or providing intermediary services to third-country nationals seeking to obtain residence rights in a Member State in exchange of any kind of investments, including capital transfers, purchase or renting of property, investment in government bonds, investment in corporate entities, donation or endowment of an activity contributing to the public good and contributions to the state budget. Investor residence schemes present risks and vulnerabilities in relation to money laundering, corruption and tax evasion. Such risks are exacerbated by the cross-border rights associated with residence in a Member State. Therefore, it is necessary that investment migration operators are subject to AML/CFT obligations. This Regulation should not apply to investor citizenship schemes, which result in the acquisition of nationality in exchange for such investments, as such schemes must be considered as undermining the fundamental status of Union citizenship and sincere cooperation among Member States. (17)Consumer and mortgage creditors and intermediaries that are not credit institutions or financial institutions have not been subject to AML/CFT requirements at Union level, but have been subject to such obligations in certain Member States due to their exposure to money laundering and terrorist financing risks. Depending on their business model, such consumer and mortgage creditors and intermediaries may be exposed to significant money laundering and terrorist financing risks. It is important to ensure that entities carrying out similar activities that are exposed to such risks are covered by AML/CFT requirements, regardless of whether they qualify as credit institutions or financial institutions. Therefore, it is appropriate to include consumer and mortgage creditors and intermediaries that are not credit institutions or financial institutions but that are, as a result of their activities, exposed to money laundering and terrorist financing risks. (18)To ensure a consistent approach, it is necessary to clarify which entities in the investment sector are subject to AML/CFT requirements. Although collective investment undertakings already fell within the scope of Directive (EU) 2015/849, it is necessary to align the relevant terminology with the current Union investment fund legislation, namely Directive 2009/65/EC of the European Parliament and of the Council and Directive 2011/61/EU of the European Parliament and of the Council. Because funds might be constituted without legal personality, the inclusion of their managers in the scope of this Regulation is also necessary. AML/CFT requirements should apply regardless of the form in which units or shares in a fund are made available for purchase in the Union, including where units or shares are directly or indirectly offered to investors established in the Union or placed with such investors at the initiative of the manager or on behalf of the manager. (19)It is important that AML/CFT requirements apply in a proportionate manner and that the imposition of any requirement is proportionate to the role that obliged entities can play in the prevention of money laundering and terrorist financing. To this end, it should be possible for Member States in line with the risk base approach of this Regulation to exempt certain operators from AML/CFT requirements, where the activities they perform present low money laundering and terrorist financing risks and where the activities are limited in nature. To ensure transparent and consistent application of such exemptions across the Union, a mechanism should be put in place allowing the Commission to verify the necessity of the exemptions to be granted. The Commission should also publish such exemptions on a yearly basis in the Official Journal of the European Union. (20)A consistent set of rules on internal systems and controls that applies to all obliged entities operating in the internal market will strengthen AML/CFT compliance and make supervision more effective. In order to ensure adequate mitigation of money laundering and terrorist financing risks, obliged entities should have in place an internal control framework consisting of risk–based policies, controls and procedures and clear division of responsibilities throughout the organisation. In line with the risk-based approach of this Regulation, those policies, controls and procedures should be proportionate to the nature and size of the obliged entity and respond to the risks of money laundering and terrorist financing that the entity faces.

(21)An appropriate risk-based approach requires obliged entities to identify the inherent risks of money laundering and terrorist financing that they face by virtue of their business in order to mitigate them effectively and to ensure that their policies, procedures and internal controls are appropriate to address those inherent risks. In doing so, obliged entities should take into account the characteristics of their customers, the products, services or transactions offered, the countries or geographical areas concerned and the distribution channels used. In light of the evolving nature of risks, such risk assessment should be regularly updated. (22)It is appropriate to take account of the characteristics and needs of smaller obliged entities, and to ensure treatment which is appropriate to their specific needs, and the nature of the business. This may include exempting certain obliged entities from performing a risk assessment where the risks involved in the sector in which the entity operates are well understood. (23)The FATF has developed standards for jurisdictions to identify, and assess the risks of potential non-implementation or evasion of the targeted financial sanctions related to proliferation financing, and to take action to mitigate those risks. Those new standards introduced by the FATF today do not substitute nor undermine the existing strict requirements for countries to implement targeted financial sanctions to comply with the relevant United Nations Security Council Regulations relating to the prevention, suppression and disruption of proliferation of weapons of mass destruction and its financing. Those existing obligations, as implemented at Union level by Council Decisions 2010/413/CFSP and (CFSP) 2016/849 as well as by Council Regulations (EU) No 267/2012 and (EU) 2017/1509, remain strict rule-based obligations binding on all natural and legal persons within the Union. (24)In order to reflect the latest developments at international level, a requirement has been introduced by this Regulation to identify, understand, manage and mitigate risks of potential non-implementation or evasion of proliferation financing-related targeted financial sanctions at obliged entity level. (25)It is important that obliged entities take all measures at the level of their management to implement internal policies, controls and procedures and to implement AML/CFT requirements. While a person at management level should be identified as being responsible for implementing the obliged entity’s policies, controls and procedures, the responsibility for the compliance with AML/CFT requirements should rest ultimately with the governing body of the entity. Tasks pertaining to the day-to-day implementation of the obliged entity’s AML/CFT policies, controls and procedures should be entrusted to a compliance officer. (26)For effective implementation of AML/CFT measures, it is also vital that the employees of obliged entities, as well as their agents and distributors, who have a role in their implementation understand the requirements and the internal policies, controls and procedures in place in the entity. Obliged entities should put in place measures, including training programmes, to this effect. (27)Individuals entrusted with tasks related to an obliged entity’s compliance with AML/CFT requirements should undergo assessment of their skills, knowledge, expertise, integrity and conduct. Performance by employees of tasks related to the obliged entity’s compliance with the AML/CFT framework in relation to customers with whom they have a close private or professional relationship can lead to conflicts of interests and undermine the integrity of the system. Therefore, employees in such situations should be prevented from performing any tasks related to the obliged entity’s compliance with the AML/CFT framework in relation to such customers. (28)The consistent implementation of group-wide AML/CFT policies and procedures is key to the robust and effective management of money laundering and terrorist financing risks within the group. To this end, group-wide policies, controls and procedures should be adopted and implemented by the parent undertaking. Obliged entities within the group should be required to exchange information when such sharing is relevant for preventing money laundering and terrorist financing. Information sharing should be subject to sufficient guarantees in terms of confidentiality, data protection and use of information. AMLA should have the task of drawing up draft regulatory standards specifying the minimum requirements of group-wide procedures and policies, including minimum standards for information sharing within the group and the role and responsibilities of parent undertakings that are not themselves obliged entities. (29)In addition to groups, other structures exist, such as networks or partnerships, in which obliged entities might share common ownership, management and compliance controls. To ensure a level playing field across the sectors whilst avoiding overburdening it, AMLA should identify those situations where similar group-wide policies should apply to those structures. (30)There are circumstances where branches and subsidiaries of obliged entities are located in third countries where the minimum AML/CFT requirements, including data protection obligations, are less strict than the Union AML/CFT framework. In such situations, and in order to fully prevent the use of the Union financial system for the purposes of money laundering and terrorist financing and to ensure the highest standard of protection for personal data of Union citizens, those branches and subsidiaries should comply with AML/CFT requirements laid down at Union level. Where the law of a third country does not permit compliance with those requirements, for example because of limitations to the group's ability to access, process or exchange information due to an insufficient level of data protection or banking secrecy law in the third country, obliged entities should take additional measures to ensure the branches and subsidiaries located in that country effectively handle the risks. AMLA should be tasked with developing draft technical standards specifying the type of such additional measures. (31)Customer due diligence requirements are essential to ensure that obliged entities identify, verify and monitor their business relationships with their clients, in relation to the money laundering and terrorist financing risks that they pose. Accurate identification and verification of data of prospective and existing customers are essential for understanding the risks of money laundering and terrorist financing associated with clients, whether they are natural or legal persons. (32)It is necessary to achieve a uniform and high standard of customer due diligence in the Union, relying on harmonised requirements for the identification of customers and verification of their identity, and reducing national divergences to allow for a level playing field across the internal market and for a consistent application of provisions throughout the Union. At the same time, it is essential that obliged entities apply customer due diligence requirements in a risk-based manner. The risk-based approach is not an unduly permissive option for obliged entities. It involves the use of evidence-based decision-making in order to target more effectively the risks of money laundering and terrorist financing facing the Union and those operating within it. (33)Obliged entities should not be required to apply due diligence measures on customers carrying out occasional or linked transactions below a certain value, unless there is suspicion of money laundering or terrorist financing. Whereas the EUR 10 000 threshold applies to most occasional transactions, obliged entities which operate in sectors or carry out transactions that present a higher risk of money laundering and terrorist financing should be required to apply customer due diligence for transactions with lower thresholds. To identify the sectors or transactions as well as the adequate thresholds for those sectors or transactions, AMLA should develop dedicated draft regulatory technical standards. (34)Some business models are based on the obliged entity having a business relationship with a merchant for offering payment initiation services through which the merchant gets paid for the provision of goods or services, and not with the merchant’s customer, who authorises the payment initiation service to initiate a single or one-off transaction to the merchant. In such a business model, the obliged entity’s customer for the purpose of AML/CFT rules is the merchant, and not the merchant’s customer. Therefore, customer due diligence obligations should be applied by the obliged entity vis-a-vis the merchant. (35)Directive (EU) 2015/849, despite having harmonised the rules of Member States in the area of customer identification obligations to a certain degree, did not lay down detailed rules in relation to the procedures to be followed by obliged entities. In view of the crucial importance of this aspect in the prevention of money laundering and terrorist financing, it is appropriate, in accordance with the risk-based approach, to introduce more specific and detailed provisions on the identification of the customer and on the verification of the customer’s identity, whether in relation to natural or legal persons, legal arrangements such as trusts or entities having legal capacity under national law. (36)Technological developments and progress in digitalisation enable a secure remote or electronic identification and verification of prospective and existing customers and can facilitate the remote performance of customer due diligence. The identification solutions as set out in Regulation (EU) No 910/2014 of the European Parliament and of the Council and the proposal for an amendment to it in relation to a framework for a European Digital Identity enable secure and trusted means of customer identification and verification for both prospective and existing customers and can facilitate the remote performance of customer due diligence. The electronic identification as set out in that Regulation should be taken into account and accepted by obliged entities for the customer identification process. These means of identification may present, where appropriate risk mitigation measures are in place, a standard or even low level of risk. (37)To ensure that the AML/CFT framework prevents illicit funds from entering the financial system, obliged entities should carry out customer due diligence before entering into business relationships with prospective clients, in line with the risk-based approach. Nevertheless, in order not to unnecessarily delay the normal conduct of business, obliged entities may collect the information from the prospective customer during the establishment of a business relationship. Credit and financial institutions may obtain the necessary information from the prospective customers once the relationship is established, provided that transactions are not initiated until the customer due diligence process is successfully completed. (38)Depositors whose funds are the proceeds of money laundering should be excluded from repayment by a deposit guarantee scheme. To prevent that illicit funds are reimbursed to such depositors, credit institutions should, under the oversight of the supervisors, perform customer due diligence of their clients where the credit institutions have been determined failing or likely to fail, or when deposits are defined as unavailable. Credit institutions should report any suspicious transactions identified in the performance of such customer due diligence to the FIU. (39)The customer due diligence process is not limited to the identification and verification of the customer’s identity. Before entering into business relationships or carrying out occasional transactions, obliged entities should also assess the purpose and nature of a business relationship. Pre-contractual or other information about the proposed product or service that is communicated to the prospective customer may contribute to the understanding of that purpose. Obliged entities should always be able to assess the purpose and nature of a prospective business relationship in an unambiguous manner. Where the offered service or product enables customers to carry out various types of transactions or activities, obliged entities should obtain sufficient information on the intention of the customer regarding the use to be made of that relationship. (40)To ensure the effectiveness of the AML/CFT framework, obliged entities should regularly review the information obtained from their customers, in accordance with the risk-based approach. Obliged entities should also set up a monitoring system to detect atypical transactions that might raise money laundering or terrorist financing suspicions. To ensure the effectiveness of the transaction monitoring, obliged entities’ monitoring activity should in principle cover all services and products offered to customers and all transactions which are carried out on behalf of the costumer or offered to the customer by the obliged entity. However, not all transactions need to be scrutinised individually. The intensity of the monitoring should respect the risk-based approach and be designed around precise and relevant criteria, taking account, in particular, of the characteristics of the customers and the risk level associated with them, the products and services offered, and the countries or geographical areas concerned. AMLA should develop guidelines to ensure that the intensity of the monitoring of business relationships and of transactions is adequate and proportionate to the level of risk.

(41)In order to ensure consistent application of this Regulation, AMLA should have the task of drawing up draft regulatory technical standards on customer due diligence. Those regulatory technical standards should set out the minimum set of information to be obtained by obliged entities in order to enter into new business relationships with customers or assess ongoing ones, according to the level of risk associated with each customer. Furthermore, the draft regulatory technical standards should provide sufficient clarity to allow market players to develop secure, accessible and innovative means of verifying customers’ identity and performing customer due diligence, also remotely, while respecting the principle of technology neutrality. The Commission should be empowered to adopt those draft regulatory technical standards. Those specific tasks are in line with the role and responsibilities of AMLA as provided in Regulation [please insert reference – proposal for establishment of an Anti-Money Laundering Authority - COM/2021/421 final]. (42)The harmonisation of customer due diligence measures should not only seek to achieve consistent, and consistently effective, understanding of the risks associated with an existing or prospective customer regardless of where the business relationship is opened in the Union, and their harmonisation will help to achieve this aim. It should also ensure that the information obtained in the performance of customer due diligence is not used by obliged entities to pursue de-risking practices which may result in circumventing other legal obligations, in particular those laid down in Directive 2014/92 of the European Parliament and of the Council or Directive 2015/2366 of the European Parliament and of the Council, without achieving the Union’s objectives in the prevention of money laundering and terrorist financing. To enable the proper supervision of compliance with the customer due diligence obligations, it is important that obliged entities keep record of the actions undertaken and the information obtained during the customer due diligence process, irrespective of whether a new business relationship is established with them and of whether they have submitted a suspicious transaction report upon refusing to establish a business relationship. Where the obliged entity takes a decision to not enter into a business relationship with a prospective customer, the customer due diligence records should include the grounds for such a decision. This will enable supervisory authorities to assess whether obliged entities have appropriately calibrated their customer due diligence practices and how the entity’s risk exposure evolves, as well as help building statistical evidence on the application of customer due diligence rules by obliged entities throughout the Union. (43)The approach for the review of existing customers in the current AML/CFT framework is already risk-based. However, given the higher risk of money laundering, its predicate offences and terrorist financing associated with certain intermediary structures, that approach might not allow for the timely detection and assessment of risks. It is therefore important to ensure that clearly specified categories of existing customers are also monitored on a regular basis. (44)Risk itself is variable in nature, and the variables, on their own or in combination, may increase or decrease the potential risk posed, thus having an impact on the appropriate level of preventive measures, such as customer due diligence measures. (45)In low risk situations, obliged entities should be able to apply simplified customer due diligence measures. This does not equate to an exemption or absence of customer due diligence measures. It rather consists in a simplified or reduced set of scrutiny measures, which should however address all components of the standard customer due diligence procedure. In line with the risk-based approach, obliged entities should nevertheless be able to reduce the frequency or intensity of their customer or transaction scrutiny, or rely on adequate assumptions with regard to the purpose of the business relationship or use of simple products. The regulatory technical standards on customer due diligence should set out the specific simplified measures that obliged entities may implement in case of lower risk situations identified in the Supranational Risk Assessment of the Commission. When developing draft regulatory technical standards, AMLA should have due regard to preserving social and financial inclusion. (46)It should be recognised that certain situations present a greater risk of money laundering or terrorist financing. Although the identity and business profile of all customers should be established with the regular application of customer due diligence requirements, there are cases in which particularly rigorous customer identification and verification procedures are required. Therefore, it is necessary to lay down detailed rules on such enhanced due diligence measures, including specific enhanced due diligence measures for cross-border correspondent relationships. (47)Cross-border correspondent relationships with a third-country’s respondent institution are characterised by their on-going, repetitive nature. Moreover, not all cross-border correspondent banking services present the same level of money laundering and terrorist financing risks. Therefore, the intensity of the enhanced due diligence measures should be determined by application of the principles of the risk based approach. However, the risk based approach should not be applied when interacting with third-country’s respondent institutions that have no physical presence where they are incorporated. Given the high risk of money laundering and terrorist financing inherent in shell banks, credit institutions and financial institutions should refrain from entertaining any correspondent relationship with such shell banks. (48)In the context of enhanced due diligence measures, obtaining approval from senior management for establishing business relationships does not need to imply, in all cases, obtaining approval from the board of directors. It should be possible for such approval to be granted by someone with sufficient knowledge of the entity's money laundering and terrorist financing risk exposure and of sufficient seniority to take decisions affecting its risk exposure. (49)In order to protect the proper functioning of the Union financial system from money laundering and terrorist financing, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union (TFEU) should be delegated to the Commission to identify third countries, whose shortcomings in their national AML/CFT regimes represent a threat to the integrity of the Union’s internal market. The changing nature of money laundering and terrorist financing threats from outside the Union, facilitated by a constant evolution of technology and of the means at the disposal of criminals, requires that quick and continuous adaptations of the legal framework as regards third countries be made in order to address efficiently existing risks and prevent new ones from arising. The Commission should take into account information from international organisations and standard setters in the field of AML/CFT, such as FATF public statements, mutual evaluation or detailed assessment reports or published follow-up reports, and adapt its assessments to the changes therein, where appropriate. (50)Third countries “subject to a call for action” by the relevant international standard-setter (the FATF) present significant strategic deficiencies of a persistent nature in their legal and institutional AML/CFT frameworks and their implementation which are likely to pose a high risk to the Union’s financial system. The persistent nature of the significant strategic deficiencies, reflective of the lack of commitment or continued failure by the third country to tackle them, signal a heightened level of threat emanating from those third countries, which requires an effective, consistent and harmonised mitigating response at Union level. Therefore, obliged entities should be required to apply the whole set of available enhanced due diligence measures to occasional transactions and business relationships involving those high-risk third countries to manage and mitigate the underlying risks. Furthermore, the high level of risk justifies the application of additional specific countermeasures, whether at the level of obliged entities or by the Member States. Such approach would avoid divergence in the determination of the relevant countermeasures, which would expose the entirety of Union’s financial system to risks. Given its technical expertise, AMLA can provide useful input to the Commission in identifying the appropriate countermeasures. (51)Compliance weaknesses in both the legal and institutional AML/CFT framework and its implementation of third countries which are subject to “increased monitoring” by the FATF are susceptible to be exploited by criminals. This is likely to represent a risk for the Union’s financial system, which needs to be managed and mitigated. The commitment of these third countries to address identified weaknesses, while not eliminating the risk, justifies a mitigating response, which is less severe than the one applicable to high-risk third countries. In these cases, Union’s obliged entities should apply enhanced due diligence measures to occasional transactions and business relationships when dealing with natural persons or legal entities established in those third countries that are tailored to the specific weaknesses identified in each third country. Such granular identification of the enhanced due diligence measures to be applied would, in line with the risk-based approach, also ensure that the measures are proportionate to the level of risk. To ensure such consistent and proportionate approach, the Commission should be able to identify which specific enhanced due diligence measures are required in order to mitigate country-specific risks. Given AMLA’s technical expertise, it can provide useful input to the Commission to identify the appropriate enhanced due diligence measures. (52)Countries that are not publicly identified as subject to calls for actions or increased monitoring by international standard setters might still pose a threat to the integrity of the Union’s financial system. To mitigate those risks, it should be possible for the Commission to take action by identifying, based on a clear set of criteria and with the support of AMLA, third countries posing a specific and serious threat to the Union’s financial system, which may be due to either compliance weaknesses or significant strategic deficiencies of a persistent nature in their AML/CFT regime, and the relevant mitigating measures. Those third countries should be identified by the Commission. According to the level of risk posed to the Union’s financial system, the Commission should require the application of either all enhanced due diligence measures and country-specific countermeasures, as it is the case for high-risk third countries, or country-specific enhanced customer due diligence, such as in the case of third countries with compliance weaknesses. (53)Considering that there may be changes in the AML/CFT frameworks of those third countries or in their implementation, for example as result of the country’s commitment to address the identified weaknesses or of the adoption of relevant AML/CFT measures to tackle them, which could change the nature and level of the risks emanating from them, the Commission should regularly review the identification of those specific enhanced due diligence measures in order to ensure that they remain proportionate and adequate. (54)Potential external threats to the Union’s financial system do not only emanate from third countries, but can also emerge in relation to specific customer risk factors or products, services, transactions or delivery channels which are observed in relation to a specific geographical area outside the Union. There is therefore a need to identify money laundering and terrorist financing trends, risks and methods to which Union’s obliged entities may be exposed. AMLA is best placed to detect any emerging ML/TF typologies from outside the Union, to monitor their evolution with a view to providing guidance to the Union’s obliged entities on the need to apply enhanced due diligence measures aimed at mitigating such risks. (55)Relationships with individuals who hold or who have held important public functions, within the Union or internationally, and particularly individuals from countries where corruption is widespread, may expose the financial sector to significant reputational and legal risks. The international effort to combat corruption also justifies the need to pay particular attention to such persons and to apply appropriate enhanced customer due diligence measures with respect to persons who are or who have been entrusted with prominent public functions and with respect to senior figures in international organisations. Therefore, it is necessary to specify measures which obliged entities should apply with respect to transactions or business relationships with politically exposed persons. To facilitate the risk-based approach, AMLA should be tasked with issuing guidelines on assessing the level of risks associated with a particular category of politically exposed persons, their family members or persons known to be close associates. (56)In order to identify politically exposed persons in the Union, lists should be issued by Member States indicating the specific functions which, in accordance with national laws, regulations and administrative provisions, qualify as prominent public functions. Member States should request each international organisation accredited on their territories to issue and keep up to date a list of prominent public functions at that international organisation. The Commission should be tasked with compiling and issuing a list, which should be valid across the Union, as regards persons entrusted with prominent public functions in Union institutions or bodies. (57)When customers are no longer entrusted with a prominent public function, they can still pose a higher risk, for example because of the informal influence they could still exercise, or because their previous and current functions are linked. It is essential that obliged entities take into consideration those continuing risks and apply one or more enhanced due diligence measures until such time that the individuals are deemed to pose no further risk, and in any case for not less than 12 months following the time when they are no longer entrusted with a prominent public function. (58)Insurance companies often do not have client relationships with beneficiaries of the insurance policies. However, they should be able to identify higher risk situations, such as when the proceeds of the policy benefit a politically exposed person. To determine whether this is the case, the insurance policy should include reasonable measures to identify the beneficiary, as if this person were a new client. Such measures can be taken at the time of the payout or at the time of the assignment of the policy, but not later. (59)Close private and professional relationships can be abused for money laundering and terrorist financing purposes. For that reason, measures concerning politically exposed persons should also apply to their family members and persons known to be close associates. Properly identifying family members and persons known to be close associates may depend on the socio-economic and cultural structure of the country of the politically exposed person. Against this background, AMLA should have the task of issuing guidelines on the criteria to use to identify persons who should be considered as close associate. (60)The requirements relating to politically exposed persons, their family members and close associates, are of a preventive and not criminal nature, and should not be interpreted as stigmatising politically exposed persons as being involved in criminal activity. Refusing a business relationship with a person simply on the basis of a determination that they are a politically exposed person is contrary to the letter and spirit of this Regulation.

(61)In order to avoid repeated customer identification procedures, it is appropriate, subject to suitable safeguards, to allow obliged entities to rely on the customer information collected by other obliged entities. Where an obliged entity relies on another obliged entity, the ultimate responsibility for customer due diligence should remain with the obliged entity which chooses to rely on the customer due diligence performed by another obliged entity. The obliged entity relied upon should also retain its own responsibility for compliance with AML/CFT requirements, including the requirement to report suspicious transactions and retain records. (62)Obliged entities may outsource tasks relating to the performance of customer due diligence to an agent or external service provider, unless they are established in third countries that are designated as high-risk, as having compliance weaknesses or as posing a threat to the Union’s financial system. In the case of agency or outsourcing relationships on a contractual basis between obliged entities and external service providers not covered by AML/CFT requirements, any AML/CFT obligations upon those agents or outsourcing service providers could arise only from the contract between the parties and not from this Regulation. Therefore, the responsibility for complying with AML/CFT requirements should remain entirely with the obliged entity itself. The obliged entity should in particular ensure that, where an outsourced service provider is involved for the purposes of remote customer identification, the risk-based approach is respected. (63)In order for third party reliance and outsourcing relationships to function efficiently, further clarity is needed around the conditions according to which reliance takes place. AMLA should have the task of developing guidelines on the conditions under which third-party reliance and outsourcing can take place, as well as the roles and responsibilities of the respective parties. To ensure that consistent oversight of reliance and outsourcing practices is ensured throughout the Union, the guidelines should also provide clarity on how supervisors should take into account such practices and verify compliance with AML/CFT requirements when obliged entities resort to those practices. (64)The concept of beneficial ownership was introduced by Directive (EU) 2015/849 to increase transparency of complex corporate structures. The need to access accurate, up-to-date and adequate information on the beneficial owner is a key factor in tracing criminals who might otherwise be able to hide their identity behind such opaque structures. Member States are currently required to ensure that both corporate and other legal entities as well as express trusts and other similar legal arrangements obtain and hold adequate, accurate and current information on their beneficial ownership. However, the degree of transparency imposed by Member States varies. The rules are subject to divergent interpretations, and this results in different methods to identify beneficial owners of a given entity or arrangement. This is due, inter alia, to inconsistent ways of calculating indirect ownership of an entity or arrangement. This hampers the transparency that was intended to be achieved. It is therefore necessary to clarify the rules to achieve a consistent definition of beneficial owner and its application across the internal market. (65)Detailed rules should be laid down to identify the beneficial owners of corporate and other legal entities and to harmonise definitions of beneficial ownership. While a specified percentage shareholding or ownership interest does not automatically determine the beneficial owners, it should be one factor among others to be taken into account. Member States should be able, however, to decide that a percentage lower than 25% may be an indication of ownership or control. Control through ownership interest of 25% plus one of the shares or voting rights or other ownership interest should be assessed on every level of ownership, meaning that this threshold should apply to every link in the ownership structure and that every link in the ownership structure and the combination of them should be properly examined. (66)A meaningful identification of the beneficial owners requires a determination of whether control is exercised via other means. The determination of control through an ownership interest is necessary but not sufficient and it does not exhaust the necessary checks to determine the beneficial owners. The test on whether any natural person exercises control via other means is not a subsequent test to be performed only when it is not possible to determine an ownership interest. The two tests, namely that of control through an ownership interest and that of control via other means, should be performed in parallel. Control through other means may include the right to appoint or remove more than half of the members of the board of the corporate entity; the ability to exert a significant influence on the decisions taken by the corporate entity; control through formal or informal agreements with owners, members or the corporate entities, as well as voting arrangements; links with family members of managers or directors or those owning or controlling the corporate entity; use of formal or informal nominee arrangements. (67)In order to ensure effective transparency, the widest possible range of legal entities and arrangements incorporated or created in the territory of Member States should be covered by beneficial ownership rules. This includes legal entities other than corporate ones and arrangements similar to trusts. Due to differences in the legal systems of Member States, those broad categories encompass a variety of different organisational structures. Member States should notify to the Commission a list of the types of corporate and other legal entities where the beneficial owners is identified in line with the rules for the identification of beneficial owners for corporate entities. The Commission should make recommendations to Member States on the specific rules and criteria to identify the beneficial owners of legal entities other than corporate entities. (68)To ensure the consistent identification of beneficial owners of express trusts and similar legal entities, such as foundations, or arrangements, it is necessary to lay down harmonised beneficial ownership rules. Member States are required to notify to the Commission a list of the types of legal entities and legal arrangements similar to express trusts where the beneficial owners is identified according to the identification of beneficial owners for express trusts and similar legal entities or arrangements. The Commission should be empowered to adopt, by means of an implementing act, a list of legal arrangements and legal entities governed by national law of Member States, which have a structure or function similar to express trusts. (69)A consistent approach to the beneficial ownership transparency regime also requires ensuring that the same information is collected on beneficial owners across the internal market. It is appropriate to introduce precise requirements concerning the information that should be collected in each case. That information includes a minimum set of personal data of the beneficial owner, the nature and extent of the beneficial interest held in the legal entity or legal arrangement and information on the legal entity or legal arrangement. (70)Underpinning an effective framework on beneficial ownership transparency is the knowledge by corporate and other legal entities of the natural persons who are their beneficial owners. Thus, all corporate and other legal entities in the Union should obtain and hold adequate, accurate and current beneficial ownership information. That information should be retained for five years and the identity of the person responsible for retaining the information should be reported to the registers. That retention period is equivalent to the period for retention of the information obtained within the application of AML/CFT requirements, such as customer due diligence measures. In order to ensure the possibility to cross-check and verify information, for instance through the mechanism of discrepancy reporting, it is justified to ensure that the relevant data retention periods are aligned. (71)Corporate and other legal entities should take all necessary measures to identify their beneficial owners. There may however be cases where no natural person is identifiable who ultimately owns or exerts control over an entity. In such exceptional cases, provided that all means of identification are exhausted, the senior managing officials can be reported when providing beneficial ownership information to obliged entities in the course of the customer due diligence process or when submitting the information to the central register. Corporate and legal entities should keep records of the actions taken in order to identify their beneficial owners, especially when they rely on this last resort measure, which should be duly justified and documented. (72)There is a need to ensure a level playing field among the different types of legal forms and to avoid the misuse of trusts and legal arrangements, which are often layered in complex structures to further obscure beneficial ownership. Trustees of any express trust administered in a Member State should thus be responsible for obtaining and holding adequate, accurate and current beneficial ownership information regarding the trust, and for disclosing their status and providing this information to obliged entities carrying out costumer due diligence. Any other beneficial owner of the trust should assist the trustee in obtaining such information. (73)In view of the specific structure of certain legal entities such as foundations, and the need to ensure sufficient transparency about their beneficial ownership, such entities and legal arrangements similar to trusts should be subject to equivalent beneficial ownership requirements as those that apply to express trusts. (74)Nominee arrangements may allow the concealment of the identity of the beneficial owners, because a nominee might act as the director or shareholder of a legal entity while the nominator is not always disclosed. Those arrangements might obscure the beneficial ownership and control structure, when beneficial owners do not wish to disclose their identity or role within them. There is thus a need to introduce transparency requirements in order to avoid that these arrangements are misused and to prevent criminals from hiding behind persons acting on their behalf. Nominee shareholders and nominee directors of corporate or other legal entities should maintain sufficient information on the identity of their nominator as well as of any beneficial owner of the nominator and disclose them as well as their status to the corporate or other legal entities. The same information should also be reported by corporate and other legal entities to obliged entities, when customer due diligence measures are performed. (75)The risks posed by foreign corporate entities and legal arrangements, which are misused to channel proceeds of funds into the Union’s financial system, need to be mitigated. Since beneficial ownership standards in place in third countries might not be sufficient to allow for the same level of transparency and timely availability of beneficial ownership information as in the Union, there is a need to ensure adequate means to identify the beneficial owners of foreign corporate entities or legal arrangements in specific circumstances. Therefore, legal entities incorporated outside the Union and express trusts or similar legal arrangements administered outside the Union should be required to disclose their beneficial owners whenever they operate in the Union by entering into a business relationship with a Union’s obliged entity or by acquiring real estate in the Union. (76)In order to encourage compliance and ensure an effective beneficial ownership transparency, beneficial ownership requirements need to be enforced. To this end, Member States should apply sanctions for breaches of those requirements. Those sanctions should be effective, proportionate and dissuasive, and should not go beyond what is required to encourage compliance. Sanctions introduced by Member States should have an equivalent deterrent effect across the Union on the breaches of beneficial ownership requirements. (77)Suspicious transactions, including attempted transactions, and other information relevant to money laundering, its predicate offences and terrorist financing, should be reported to the FIU, which should serve as a single central national unit for receiving and, analysing reported suspicions and for disseminating to the competent authorities the results of its analyses. All suspicious transactions, including attempted transactions, should be reported, regardless of the amount of the transaction. Reported information may also include threshold-based information. The disclosure of information to the FIU in good faith by an obliged entity or by an employee or director of such an entity should not constitute a breach of any restriction on disclosure of information and should not involve the obliged entity or its directors or employees in liability of any kind. (78)Differences in suspicious transaction reporting obligations between Member States may exacerbate the difficulties in AML/CFT compliance experienced by obliged entities that have a cross-border presence or operations. Moreover, the structure and content of the suspicious transaction reports have an impact on the FIU’s capacity to carry out analysis and on the nature of that analysis, and also affects FIUs’ abilities to cooperate and to exchange information. In order to facilitate obliged entities’ compliance with their reporting obligations and allow for a more effective functioning of FIUs’ analytical activities and cooperation, AMLA should develop draft regulatory standards specifying a common template for the reporting of suspicious transactions to be used as a uniform basis throughout the Union. (79)FIUs should be able to obtain swiftly from any obliged entity all the necessary information relating to their functions. Their unfettered and swift access to information is essential to ensure that flows of money can be properly traced and illicit networks and flows detected at an early stage. The need for FIUs to obtain additional information from obliged entities based on a suspicion of money laundering or financing of terrorism might be triggered by a prior suspicious transaction report reported to the FIU, but might also be triggered through other means such as the FIU’s own analysis, intelligence provided by competent authorities or information held by another FIU. FIUs should therefore be able, in the context of their functions, to obtain information from any obliged entity, even without a prior report being made. Obliged entities should reply to a request for information by the FIU as soon as possible and, in any case, within five days of receipt of the request. In justified and urgent cases, the obliged entity should be able to respond to the FIU’s request within 24 hours. This does not include indiscriminate requests for information to the obliged entities in the context of the FIU's analysis, but only information requests based on sufficiently defined conditions. An FIU should also be able to obtain such information on a request made by another Union FIU and to exchange the information with the requesting FIU. (80)For certain obliged entities, Member States should have the possibility to designate an appropriate self-regulatory body to be informed in the first instance instead of the FIU. In accordance with the case-law of the European Court of Human Rights, a system of first instance reporting to a self-regulatory body constitutes an important safeguard for upholding the protection of fundamental rights as concerns the reporting obligations applicable to lawyers. Member States should provide for the means and manner by which to achieve the protection of professional secrecy, confidentiality and privacy.

(81)Where a Member State decides to designate such a self-regulatory body, it may allow or require that body not to transmit to the FIU any information obtained from persons represented by that body where such information has been received from, or obtained on, one of their clients, in the course of ascertaining the legal position of their client, or in performing their task of defending or representing that client in, or concerning, judicial proceedings, including providing advice on instituting or avoiding such proceedings, whether such information is received or obtained before, during or after such proceedings. (82)Obliged entities should exceptionally be able to carry out suspicious transactions before informing the competent authorities where refraining from doing so is impossible or likely to frustrate efforts to pursue the beneficiaries of a suspected money laundering or terrorist financing operation. However, this exception should not be invoked in relation to transactions concerned by the international obligations accepted by the Member States to freeze without delay funds or other assets of terrorists, terrorist organisations or those who finance terrorism, in accordance with the relevant United Nations Security Council resolutions. (83)Confidentiality in relation to the reporting of suspicious transactions and to the provision of other relevant information to FIUs is essential in order to enable the competent authorities to freeze and seize assets potentially linked to money laundering, its predicate offences or terrorist financing. A suspicious transaction is not an indication of criminal activity. Disclosing that a suspicion has been reported may tarnish the reputation of the persons involved in the transaction and jeopardise the performance of analyses and investigations. Therefore, obliged entities and their directors and employees should not inform the customer concerned or a third party that information is being, will be, or has been submitted to the FIU, whether directly or through the self-regulatory body, or that a money laundering or terrorist financing analysis is being, or may be, carried out. The prohibition of disclosure should not apply in specific circumstances concerning, for example, disclosures to competent authorities and self-regulatory bodies when performing supervisory functions, or disclosures for law enforcement purposes or when the disclosures take place between obliged entities that belong to the same group. (84)Criminals move illicit proceeds through numerous intermediaries to avoid detection. Therefore it is important to allow obliged entities to exchange information not only between group members, but also in certain cases between credit and financial institutions and other entities that operate within networks, with due regard to data protection rules. (85)Regulation (EU) 2016/679 of the European Parliament and of the Council applies to the processing of personal data for the purposes of this Regulation. The fight against money laundering and terrorist financing is recognised as an important public interest ground by all Member States. (86)It is essential that the alignment of the AML/CFT framework with the revised FATF Recommendations is carried out in full compliance with Union law, in particular as regards Union data protection law and the protection of fundamental rights as enshrined in the Charter. Certain aspects of the implementation of the AML/CFT framework involve the collection, analysis, storage and sharing of data. Such processing of personal data should be permitted, while fully respecting fundamental rights, only for the purposes laid down in this Regulation, and for carrying out customer due diligence, ongoing monitoring, analysis and reporting of unusual and suspicious transactions, identification of the beneficial owner of a legal person or legal arrangement, identification of a politically exposed person and sharing of information by credit institutions and financial institutions and other obliged entities. The collection and subsequent processing of personal data by obliged entities should be limited to what is necessary for the purpose of complying with AML/CFT requirements and personal data should not be further processed in a way that is incompatible with that purpose. In particular, further processing of personal data for commercial purposes should be strictly prohibited. (87)The revised FATF Recommendations demons