EUROPEAN COMMISSION Brussels, 20.7.2021 COM(2021) 421 final 2021/0240(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU) 1094/2010, (EU) 1095/2010 (Text with EEA relevance) {SWD(2021) 190, 191}

{SEC(2021) 391}



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL •Reasons for and objectives of the proposal Money laundering and terrorism financing (ML/TF) pose a serious threat to the integrity of the EU economy and financial system and the security of its citizens. Europol has estimated that around 1% of the EU’s annual Gross Domestic Product is ‘detected as being involved in suspect financial activity’. In July 2019, following a number of prominent cases of alleged money laundering taking place at EU credit institutions, the Commission adopted a set of document analysing the effectiveness and efficiency of the EU Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) regime as it stood at that time, and concluding that reforms were necessary, including in the areas of supervision and of cooperation between Financial Intelligence Units (FIUs). In this context, the EU’s Security Union Strategy for 2020-2025 highlighted the importance of enhancing the EU’s framework for anti-money laundering and countering terrorist financing in order to protect Europeans from terrorism and organised crime. On 7 May 2020, the Commission presented an Action Plan for a comprehensive Union policy on preventing money laundering and terrorism financing. In that Action Plan, the Commission committed to take measures in order to strengthen the EU’s rules on combating money laundering and terrorism financing and defined six priorities or pillars: 1.Ensuring effective implementation of the existing EU AML/CFT framework; 2.Establishing an EU single rulebook on AML /CFT; 3.Bringing about EU-level AML/CFT supervision; 4.Establishing a support and cooperation mechanism for Financial Intelligence Units; 5.Enforcing EU-level criminal law provisions and improving information exchange; and 6.Strengthening the international dimension of the EU AML/CFT framework. This legislative proposal aims to implement actions 3 and 4 of that Action Plan, while two accompanying legislative proposals aim to implement action 2, and contribute to action 6. Actions 1 and 5 do not require legislative action. The creation of an EU-level AML/CFT supervision and a support and coordination mechanism for Financial Intelligence Units has received support from the European Parliament and the Council: The European Parliament in its resolution of 10 July 2020 on a comprehensive Union policy on preventing money laundering and terrorist financing welcomed the Commission’s Action Plan and its intention to present an EU-level AML/CTF supervisor and an EU coordination and support mechanism for FIUs. The European Parliament further called upon the Commission to consider creating the EU coordination and support mechanism in the form of an EU FIU, to ensure that the responsibilities of the AML/CTF supervisor cover financial and non-financial obliged entities with direct supervision powers over certain obliged entities depending on their size or the risk they present, as well as supervision of the application of EU rules by national supervisors, a clear division of the respective powers of the EU and national supervisors and for the EU-level AML/CTF supervisor and EU FIU to be given budgetary and functional independence. In this context, the European Parliament observed that the proposed budgetary and human resources are not sufficient to provide full support to AML-related investigations and the existing coordination mechanisms and concluded that more human and financial resources should be allocated to the fight against money laundering. The Council is equally supportive of the Commission’s Action Plan in its Conclusions on anti-money laundering and countering the financing of terrorism of 5 November 2020. Among others, the Council invited the Commission to prioritise the establishment of EU level AML/CFT supervision and the coordination and support mechanism for FIUs. The EU AML/CFT supervisor should be equipped with competencies triggered on a purely risk-sensitive basis. The authority should be enabled to support national authorities and to promote supervisory convergence, also in the non-financial sector. To fulfil its task of direct supervision, the authority should establish joint supervisory teams, undertake general inspections and impose supervisory measures and administrative sanctions, while respecting the specificities of national systems and enforcement set-ups. The new supervisor should have an independent and autonomous governance structure and cooperate with other relevant EU and national authorities. For the establishment of a FIU coordination and support mechanism, the Council suggests giving the new authority a central role in strengthening and facilitating joint analysis between FIUs, supporting the FIUs’ analyses and promoting exchanges and capacity building among FIUs and also with other competent authorities. The governance of the coordination and support mechanism should be based on a governance that fully involves FIUs and respects FIUs’ core roles and responsibilities in operational independence and autonomy as well as security and confidentiality of financial intelligence. This proposal establishes the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (‘AMLA’ or ‘the Authority’). This new European authority is essential to address the current shortcomings in AML/CFT supervision in the Union: AML/CFT supervision within the EU is currently Member State-based. Its quality and effectiveness are uneven, due to significant variations in resources and practices across Member States. As recent cases of alleged money laundering involving EU credit institutions show, the approach to cross-border situations is not consistent. The report of the European Banking Authority (EBA) on approaches of competent authorities to AML/CFT supervision confirmed that despite progress, not all competent authorities are able to cooperate effectively with domestic and international stakeholders. The methods to identify risks and to apply the risk-based approach to supervision also diverge. While some risks remain national in nature, others are of horizontal nature or may impact the entire Union financial system. Member States stressed the need for a common, consistent methodology to assess and identify risks in reply to the targeted questionnaire circulated by the Commission as part of the public consultation launched when adopting the Action Plan on 7 May 2020. In addition to the divergences in supervisory powers already described, the EBA also noted that national AML/CFT supervisors might not always be willing to use the full set of powers available. This leads not only to inadequate supervision at national level, but also to insufficient supervision of professionals providing services across borders, which create risks for the whole single market. These findings were also broadly reaffirmed by the latest report of the European Court of Auditors. In order to address those shortcomings, the Authority will become a centrepiece of an integrated AML/CFT supervisory system, consisting of the Authority itself and the national authorities with an AML/CFT supervisory mandate (hereinafter ‘the supervisor authorities’). By directly supervising and taking decisions towards some of the riskiest cross-border financial sector obliged entities, the Authority will contribute directly to preventing money laundering and terrorism financing in the Union. During the last years, several incidents of a lack of proper implementation by firms and/or of adequate countermeasures taken by supervisors have been for discussion in the public domain. The establishment of direct European supervision of those entities that bear a high ML/FT risk will close these loopholes in particular for cross-border supervision. At the same time, it will coordinate national supervisory authorities and assist them to increase their effectiveness in enforcing the single rulebook and ensuring homogenous and high quality supervisory standards, approaches and risk assessment methodologies All recent major money laundering cases reported in the EU had a cross-border dimension. The detection of these financial movements is however left to the national FIUs and to cooperation among them. While this reflects the operational independence and autonomy of FIUs, the absence of a common structure to underpin this cooperation leads to situations where joint analyses are not performed for lack of common tools or resources. These divergences hamper cross-border cooperation, and thereby reduce the capacity to detect money laundering and terrorism financing early and effectively. This results in a fragmented approach that is exposed to misuse for money laundering and terrorist financing and that cannot timely identify trends and typologies at Union level. The new Authority should also play a vital role in improving the exchange of information and cooperation between FIUs. The Authority will serve as a support and coordination hub assisting their work on, inter alia, joint analyses of Suspicious Transaction Reports and Suspicious Activity Reports with significant cross-border footprint, and providing stable hosting of the FIU.net platform. Moreover, the Authority will enable a development of common reporting templates and standards to be used by EU FIUs.

Last but not least, the Authority will have powers to draft regulatory and implementing technical standards, guidelines and recommendations within the scope of its tasks, as well as to provide advice and input to the Commission and co-legislators on many aspects of AML/CFT policy, including on risks linked to jurisdictions outside the Union. • Consistency with existing policy provisions in the policy area The current legal framework for AML/CFT in the Union consists of the AML/CFT Directive and the Funds Transfer Regulation. This proposal is accompanied by three other proposals to amend the applicable EU law on AML/CFT: i.A new Regulation establishing a single rulebook for AML/CFT; ii.A new AML/CFT Directive, complementing the Regulation; and iii.A recast of Regulation 2015/847 on information accompanying transfers of funds. This package of four legislative proposals is considered as one coherent whole, in implementation of the Commission Action Plan on AML/CFT of 7 May 2020, creating a new and more stringent enforcement framework for AML/CFT rules in the Union. Having directly applicable AML/CFT rules in a regulation, with more detail than in the existing AML/CFT Directive, will not only promote convergence of supervisory and enforcement practices in Member States, but also provide rules for the Authority to apply itself as a direct supervisor of certain selected obliged entities. In the area of indirect supervision, and of coordination and support of FIUs, the proposals accompanying this proposal contain provisions empowering the Authority to draft various regulatory and implementing technical standards and to adopt guidelines and recommendations, thus laying down a defined role and function of the Authority. Support by the Authority on risk assessments and analyses to supervisory authorities and FIUs will also be a key function in the new AML/CFT enforcement architecture. The Authority will also support the Union’s policy on third countries as regards ML/TF threats from outside the Union. The Authority will cooperate in this respect with relevant Commission services, the European External Action Service (EEAS), EU bodies and agencies. • Consistency with other Union policies While the competence of the Authority will be limited to the scope of EU legislation on AML/CFT, that legislation itself interacts and is coherent with other legislation in the financial services and criminal law areas. This includes EU legislation on payments and transfers of funds (e.g. the Payment Services Directive, Payment Accounts Directive, and Electronic Money Directive). Regarding FIUs, the Directive facilitating the use of financial information for the prevention, detection, investigation or prosecution of certain criminal offences has also been taken into account. The competences of the Authority in the area of virtual assets are coherent with the Digital Finance Package published by the Commission on 24 September 2020. Good cooperation between the Authority and other relevant EU decentralised agencies and other EU and national bodies is provided for by provisions in the draft Regulation to this effect; these include the European Union Agency for Law Enforcement Cooperation (Europol), the European Anti-Fraud Office (OLAF), the European Public Prosecutor's Office (EPPO), the Single Supervisory Mechanism (SSM) at Union level and various national authorities, including prudential supervisors of financial institutions. To improve supervision and law enforcement across sectors, the Authority should enable effective information exchange between aforementioned authorities and create synergergies with these authorities where this could improve successful combatting of money laundering and terrorism financing. 2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY • Legal basis The proposal is based on Article 114 TFEU, the same legal basis as the current AML/CFT legal framework. Article 114 has been found appropriate for AML/CFT legislation considering, on the one hand, that a divergent development of national laws could disrupt the orderly functioning of the internal market; on the other hand, that money laundering and terrorism financing activities could try to take advantage of the free movement of capital and of the freedom to provide financial services, thereby causing economic losses, disruption of functioning of the single market, and reputational damage at the level of the Union. It is settled law that the EU legislature, acting under Article 114 TFEU, may deem it necessary to provide for the establishment of an EU body responsible for contributing to the implementation of a process of harmonisation. • Subsidiarity (for non-exclusive competence) The 2019 Commission AML/CFT package, composed of a Communication and four reports highlighted how criminals exploited the differences in the national implementation of the European AML/CFT regime across Member States. The cross-border nature of money laundering and terrorism financing makes good cooperation between national supervisors and FIUs essential to prevent these crimes. Many entities subject to AML/CFT obligations have cross-border activities, and different approaches by supervisory authorities and FIUs hinder the relevant entities in applying optimal AML/CFT practices at group level. Greater coordination at Union level, including a component of direct EU supervision of some of the riskiest entities, is needed to deal with these cross-border issues and to maximise the EU’s financial system capacity to both prevent and detect ML/TF. • Proportionality The cross-border nature of ML/TF requires enhanced action at Union level in order to bring about greater cooperation between supervisors and FIUs. However, as described in the Impact Assessment accompanying the present proposal, the options of subjecting all large or cross-border financial institutions to EU-level AML/CFT supervision, and of creating an FIU at EU level, have been rejected as disproportionate. • Choice of the instrument

A Regulation of the European Parliament and of the Council is the required instrument for the creation of a new EU agency. 3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS • Ex-post evaluations/fitness checks of existing legislation A full ex-post evaluation of the current EU AML/CFT regime, and of the exercise by the European Banking Authority of the AML/CFT competences which it assumed at the beginning of 2020, has not yet taken place, against the background of a number of recent legislative developments. The fourth AML Directive was adopted on 20 May 2015, with a transposition deadline for Member States of 26 June 2017. The fifth AML Directive was adopted on 30 May 2018, with a transposition deadline of 10 January 2020. Transposition control is still ongoing. However, the Commission Communication of July 2019 and accompanying reports referred to above serve as an evaluation of the effectiveness of the EU AML/CFT regime as it stood at that point in time. • Stakeholder consultations The consultation strategy on the Commission AML/CFT Action Plan was composed of a number of components: -A consultation on the roadmap announcing the Commission’s Action Plan. The consultation, on the Commission’s Have Your Say portal, ran between 11 February and 12 March 2020, and received 42 contributions from a range of stakeholders; -A public consultation on the actions put forward in the Action Plan, open to the general public and all stakeholder groups, launched on 7 May 2020, and open until 26 August. The consultation received 202 official contributions; -A targeted consultation of Member States and competent AML/CFT authorities. Member States had the opportunity to give their views in various meetings of the Expert Group on Money Laundering and Terrorist Financing, and EU FIUs made input in meetings of the FIU Platform and via written papers; -A request for advice from the European Banking Authority, made in March 2020; the EBA provided its opinion on 10 September 2020; -On 23 July 2020, the European Data Protection Supervisor issued an opinion on the Commission’s Action Plan; -On 30 September 2020, the Commission organised a high-level conference, bringing together representatives from national and EU authorities, MEPs, private sector and civil society representatives and academia. Stakeholder feedback on the Action Plan was broadly very positive, with majority support for an EU supervisor with competence for all obliged entities, financial and non-financial, and with direct supervisory powers over at least certain financial sector obliged entities. • Collection and use of expertise In preparing this proposal, the Commission relied on qualitative and quantitative evidence collected from recognised sources, including technical advice from the European Banking Authority. Information on enforcement of AML rules was also obtained from Member States via questionnaires and in the Expert Group on Money Laundering and Terrorist Financing. • Impact assessment This proposal is accompanied by an impact assessment, which was submitted to the Regulatory Scrutiny Board (RSB) on 6 November 2020 and approved on 4 December 2020. The same impact assessment also accompanies the two other legislative proposals which are presented together with the present proposal, a draft Regulation on AML/CFT, and a recast of Directive 2015/849 on AML/CFT. The RSB proposed various presentational improvements to the impact assessment in its positive opinion; these have been made. In the impact assessment the Commission considered separately the policy options regarding improving the effectiveness and consistency of anti-money laundering supervision, and increasing the level of cooperation and exchange of information among FIUs. Regarding supervision, the options considered are: (1)Anti-money laundering supervision would continue to be performed at national level, with the European Banking Authority in charge of overseeing this supervision in the financial sector (baseline scenario);

(2)Establish indirect oversight over all obliged entities: (3)Direct supervisory powers over selected risky obliged entities in the financial sector subject to AML/CFT requirements and indirect oversight over all other entities; (4)Direct EU-level anti-money laundering supervision of all obliged entities. Based on the outcome of the impact assessment, the preferred option is option 3, a combination of direct and indirect supervisory powers in an EU-level supervisory body in the form of a decentralised agency. Regarding cooperation and exchange of information among FIUs, the options considered are: (1)Financial intelligence units would continue to cooperate in the context of the EU FIUs’ Platform, which would be classed as a network (baseline scenario); (2)Transform the EU FIUs’ Platform into a comitology committee leaving it to the Commission to adopt implementing acts defining standards for FIUs; (3)The EU FIUs’ Platform would become an EU mechanism with power to issue guidelines and technical standards and to organise joint analyses and training, carry out trends and risks analysis; (4)The EU FIUs’ Platform would become an EU-level FIU, replacing national FIUs. Option 3, an EU-level coordination and support mechanism for FIUs, as part of an EU body, is the preferred option. The bundling of all these tasks in a new authority is an essential step to ensure the proper functioning of the new body as it shall cooperate with various stakeholders from the financial and the non-financial sector and coordinate the distinct functions of supervision and financial intelligence. After careful analysis, the option to assign the new tasks to existing bodies (for example the European Banking Authority) was dismissed for several reasons: Difficulties have been encountered with regard to exercising some of EBA’s current powers, especially those related to enforcement, due to specificities of the EBA governance model: EBA would need to have a dual decision-making model – one for existing functions other than AML, and another for AML tasks only Moreover, the synergy effects would be very limited as EBA has no experience with direct supervision of entities and would have to build up the relevant expertise, not only for the financial but also for the non-financial sector. This is also in line with the findings of the public consultation revealing low support for the European Banking Authority becoming the future EU AML/CFT supervisor. While one third of respondents did not express any opinion, only 19% of those who did supported the EBA. In addition, due to the novel nature of the tasks of the FIU support and coordination mechanism and the fact that no existing Union body has an appropriate legal mandate to carry out such tasks, a new specific agency for FIU support and coordination mechanism would likely be required. Combining both functions (supervision and FIU coordination) in a new authority should produce cost savings compared with two agencies and synergies can be anticipated. Having one AML Authority at Union level bringing under the same institutional umbrella different stages and elements for countering effectively money laundering and terrorist financing seems the only policy response that can account for the call for a comprehensive EU AML/CFT policy. • Regulatory fitness and simplification This proposal is an initiative to create a new EU agency, and does not repeal or simplify any existing legislation. It was examined whether existing EU agencies would be able to take up the full range of tasks proposed for the new AML Authority, and it was concluded that for legal and other reasons, this was not the case. Regarding simplification, it may be noted that those high-risk cross-border financial entities which will be directly supervised by the EU AML Authority will no longer have to deal with multiple AML supervisors in different Member States, which will simplify AML supervision for them. Also, the creation of an FIU coordination mechanism will simplify and facilitate cooperation between FIUs. • Fundamental rights The EU is committed to ensuring high standards of protection of fundamental rights. As an EU body, the Authority will be subject to the relevant data protection regulation in so far as it may handle any personal data. 4.BUDGETARY IMPLICATIONS The Authority will be a newly-created decentralised agency of the Union, funded partly from the EU budget and partly from fees levied from obliged entities that will be directly or indirectly supervised by the Authority. The methodology for selection of the entities subject to fees, and for the determination of the fees themselves, will be laid down in a Commission Delegated Act. The necessary human and budgetary resources of the Authority are determined by its tasks. Apart from central administration and management tasks, these fall into three main categories: i.direct supervision of certain selected financial sector obliged entities;

ii.indirect supervision of both financial sector and non-financial sector obliged entities through oversight of supervisors or self-regulatory bodies; and iii.a Coordination and Support Mechanism for Financial Intelligence Units of the EU. When staffed at full operational level, it is envisaged that the staff level of the Authority, all categories of staff combined, will be 250. The Authority will also take over the management of two existing infrastructures: i. the AML/CFT database, currently managed by the European Banking Authority and ii. the secure communication network for FIUs, FIU.net. These two infrastructures are already financed by the EU budget. Their overall incidence on the EU budget should thus only change to the extent that additional functionalities and other improvements are developed. The total annual expenditure of the Authority when fully operational has been calculated as EUR 45.6 million, of which approximately three quarters are expected to be financed from fees from obliged entities. The Authority will be established at the beginning of 2023, direct supervision will begin early 2026, and the Authority will therefore reach full resourcing at the end of 2025; 2026 will be the first year in which the Authority is fully resourced for a complete calendar year. The financial and budgetary impacts of this proposal are explained in detail in the legislative financial statement annexed to this proposal. 5.OTHER ELEMENTS • Implementation plans and monitoring, evaluation and reporting arrangements The Authority will be a newly-created decentralised agency of the Union, funded partly from the EU budget and partly from fees levied from obliged entities that will be directly or indirectly supervised by the Authority. The methodology for selection of the entities subject to fees, and for the determination of the fees themselves, will be laid down in a Commission Delegated Act. The necessary human and budgetary resources of the Authority are determined by its tasks. Apart from central administration and management tasks, these fall into three main categories: direct supervision of certain selected financial sector obliged entities; indirect supervision of both financial sector and non-financial sector obliged entities through oversight of supervisors or self-regulatory bodies; and a Coordination and Support Mechanism for Financial Intelligence Units of the EU. When staffed at full operational level, it is envisaged that the staff level of the Authority, all categories of staff combined, will be 250. The Authority will also take over the management of two existing infrastructures: i. the AML/CFT database, currently managed by the European Banking Authority and ii. the secure communication network for FIUs, FIU.net. These two infrastructures are already financed by the EU budget. Their overall incidence on the EU budget should thus only change to the extent that additional functionalities and other improvements are developed. The total annual expenditure of the Authority when fully operational has been calculated as EUR 45.6 million, of which approximately three quarters are expected to be financed from fees from obliged entities. The Authority will be established at the beginning of 2023, direct supervision will begin early 2026, and the Authority will therefore reach full resourcing at the end of 2025; 2026 will be the first year in which the Authority is fully resourced for a complete calendar year. The financial and budgetary impacts of this proposal are explained in detail in the legislative financial statement annexed to this proposal. • Detailed explanation of the specific provisions of the proposal The Authority will be a body with legal personality, in the form of an EU decentralised agency. It will act within the scope of EU legislation on AML/CFT, including a new AML/CFT Regulation which the Commission is proposing alongside the present proposal, amendments to the existing Directive (EU) 2015/849 and amendments to Regulation (EU) 2015/847. Its objective is the prevention of money laundering and terrorism financing in the Union, by contributing to enhanced supervision and improved cooperation between FIUs and supervisory authorities. The decision on the seat of the Authority should be taken in accordance with the relevant provisions of the Common Approach of the European Parliament, the Council of the EU and the European Commission on decentralised agencies. • Tasks and powers of the Authority (Articles 5 to Articles 44)

The tasks of the Authority can be divided in five areas: i.With respect to selected obliged entities, the Authority shall ensure group-wide compliance with the requirements laid down in AMLD/R and any other legally binding Union acts that impose AML/CFT-related obligations on financial institutions. It shall carry out supervisory reviews and assessments at individual entity and group-wide basis, participate in group-wide supervision, and develop and maintain up-to-date a system to assess the risks and vulnerabilities of the selected obliged entities. ii.With respect to financial supervisors, the Authority shall carry out periodic reviews to ensure that all financial supervisors have adequate resources and powers necessary for the performance of their tasks. It shall facilitate the functioning of the colleges and contribute to convergence of supervisory practices and promotion of high supervisory standards. It shall coordinate staff and information exchanges among financial supervisors in the Union and provide assistance to supervisors. iii.With respect to non-financial supervisors, including Self-Regulatory Bodies where appropriate, the Authority shall coordinate peer reviews of supervisory standards and practices and request non-financial supervisors to investigate possible breaches of requirements applicable to obliged entities and to consider imposing sanctions or remedial actions in respect of such breaches. It shall carry out periodic reviews and provide assistance to supervisors. Where supervision of specific sectors is delegated at the national level to self-regulatory bodies, the Authority shall exercise the tasks set out in the first subparagraph in relation to public bodies overseeing the activity of such self-regulatory bodies. iv.With respect to FIUs in the Member States, the Authority shall play a significant role in the conduct of joint analyses by FIUs, i.e. in the identification of relevant cases and the development of appropriate methods for the joint analyses of cross-border cases. Further, it shall make available to FIUs IT and artificial intelligence services and tools for secure information sharing, including through hosting of FIU.net. It shall promote expert knowledge on detection, analysis, and dissemination methods of suspicious transactions, provide specialised training and assistance to FIUs and prepare and coordinate threat assessments. v.The general powers of the Authority which relate to all aforementioned tasks will include the power to adopt regulatory technical standards and implementing technical standards where this is provided for in the applicable AML/CFT legislation, and a broad power to adopt guidelines or recommendations addressed to obliged entities, AML/CFT supervisors or FIUs. In the context of direct supervision, the Authority shall have the powers to adopt binding decisions, administrative measures, and pecuniary sanctions towards directly supervised obliged entities. In the context of indirect supervision, with respect to financial and non-financial supervisory authorities, the Authority shall have the powers to, inter alia, issue requests to act and instructions relating to the exercise of their own supervisory powers. • Direct supervision of selected financial sector obliged entities (Articles 12 to 27) The Authority will be the supervisor of a limited number of the riskiest cross-border financial sector obliged entities (‘selected obliged entities’). In addition, there is a procedure for it to take over from a national supervisory authorities supervision of any financial sector obliged entity in emergency circumstances if there are indications of breaches of AML/CFT legislation which are not being efficiently and adequately dealt with by a supervisory authority. A periodic selection of entities for direct supervision will take place every three years, on the basis of objective criteria. For the selection, entities must have activities in a minimum number of Member States, and in at least a certain number of these Member States, they must be categorised in the highest risk category by the supervisory authority, based on a harmonised risk assessment methodology. The Authority may take over supervision of an individual financial sector obliged entity where there have been problems related to compliance with applicable requirements at the level of the entity, and the relevant supervisory authority has not taken adequate measures to address non-compliance in a timely manner. The takeover can take place only following a procedure ending with a Commission Decision confirming the takeover. Before this, the Authority would enjoin the supervisory authority to take a specific action to remedy identified failings at the level of the obliged entity, the national authority would have failed to take such action within a provided timeframe, and the Authority would have brought the matter before the Commission, requesting a decision transferring supervisory competence. Supervision of directly supervised selected obliged entities will be undertaken by Joint Supervisory Teams led by the Authority but including staff of national supervisory authorities. On-site visits will be a part of supervision. The Authority will have the power to address binding decisions to such selected obliged entities and to impose administrative sanctions on legal entities up to a maximum of 10% of turnover or €10 million, whichever is higher. • Indirect supervision of non-selected obliged entities (Articles 25 to 27) and non- financial obliged entities (Articles 28 to 29) The indirect supervisory role of the Authority will be one of coordination and oversight of national AML/CFT supervisors, including self-regulatory bodies (SRBs) in certain Member States for certain non-financial Obliged Entities. Peer reviews and thematic reviews will be important tools to identify good and less good practices and ensure the high supervisory standards across the Union. The Authority will have the power to address guidelines opinions and recommendations to national supervisors and SRBs. • Coordination and Support Mechanism for Financial Intelligence Units (Articles 33-37) The Authority will have the power to adopt, via Implementing Technical Standards, binding templates and models for reporting of suspicious transactions and suspicious activity from obliged entities to FIUs, thus facilitating speedier and more efficient cooperation and information exchange between FIUs. It will promote and participate in organising joint analyses of certain cross-border suspicious transactions and activities. It will carry out reviews of the conduct, methods, and procedures for carrying out such joint analyses with an objective of constantly improving their effectiveness. Finally, it will host and manage FIU.net, a secure communication network between FIUs. • Organisation and governance of the Authority (Articles 45 to 63) The Authority will comprise of two collegial governing bodies, namely an Executive Board of five independent full time members and the Chair of the Authority and of a General Board composed of representatives of Member States. In order to deal with various tasks granted to the Authority, the General Board will have two alternative compositions – a supervisory composition with heads of public authorities responsibile for AML supervision, and FIU composition, with heads of FIUs in the Member States. Both compositions of the General Board shall be chaired by the Chair of the Authority. The General Board will, in appropriate composition depending on the subject-matter, adopt all regulatory instruments, draft Regulatory and Technical Implementing Standards, Guidelines and Recommendations. The General Board in supervisory composition may also provide its opinion on any decision vis-à-vis directly supervised selected obliged entities prepared by the Joint Supervisory team before the adoption of the final decision by the Executive Board. The Executive Board will be the governing body of the Authority. It will take all decisions towards individual obliged entities or individual supervisory authorities where the Authority is acting as a direct supervisor of selected obliged entities or as an indirect supervisor of non-selected obliged entities or non-financial obliged entities, having specific oversight powers towards their supervisory authorities. The Executive Board will also take the decisions regarding the draft budget and other matters relating to the administration, operations and functioning of the Authority. With respect to these particular decisions, a representative of the Commission shall have a right to vote. The Authority will have a Chair and an Executive Director. The Chair will shall represent the Authority and shall be responsible for preparing the work of the General Board and the Executive Board. The Executive Director will be in charge of the day-to-day management of the Authority and be administratively responsible as regards budget implementation, resources, staff and procurement in the Authority. The Chair of the Authority and the Executive Director will be selected following their individual selection procedures. There will be an Administrative Board of Review to deal with appeals against binding decisions of the Authority addressed to obliged entities under its direct supervision; decisions of the Administrative Board of Review will be appealable to the Court of Justice of the European Union. The Administrative Board of Review will be composed of individuals of high repute who will be tasked with hearing the administrative appeals of the selected obliged entities with regard to the binding decisions addressed to them by the Authority. The Administrative Board of Review Board may propose to alter or substitute the original decision by the Executive Board that is subject to an administrative appeal. The Executive Board shall take into account the opinion of the Administrative Board of Review Board, but shall not be bound by it. • Financial provisions (Articles 64 to 72)

The Authority will draw up an annual budget, which must be balanced, for adoption by the Budgetary Authority. It will adopt an internal Financial Regulation and anti-fraud measures. The Court of Auditors will comment on the draft budget and be competent to audit the Authority. The European Parliament will grant budgetary discharge, as for other decentralised agencies. The Authority’s revenues will come both from the EU budget and from fees levied on certain financial sector selected and non-selected obliged entities. The fees levied from selected and non-selected obliged entities will correspond to the costs incurred by the Authority for direct and indirect supervision of the financial sector obliged entities. A Commission delegated act will specify the sub-set of obliged entities subject to fees and will lay down the methodology for calculation of fees per obliged entity. • Staff regulation (Articles 73 to 76) and cooperation (Articles 77 to 81) The Authority will apply Staff Regulations (SR) and the Conditions of Employment of Other Servants (CEOS), including on professional secrecy and privleges and immunities. The rules on data protection and access to documents will set up an obligation to work closely with the European Data Protection Supervisor and Board. The Authority is required to cooperate in good faith with relevant external bodies, including EU bodies (Europol, European Supervisory Authorities, Single Supervisory Mechanism and the European Public Prosecutors’ Office), other relevant national competent authorities, such as prudential, resolution and DGS authorities, and third country authorities as appropriate. • Final provisions (Articles 82 to 93) The competences of the European Banking Authority in the area of AML/CFT are removed and transferred to the Authority. The Authority will be established at the beginning of 2023 and the activity of direct supervision will commence at the beginning of 2026. An evaluation will take explace by December 2029. 2021/0240 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU) 1094/2010, (EU) 1095/2010 (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee, Having regard to the opinion of the European Data Protection Supervisor, Acting in accordance with the ordinary legislative procedure,

Whereas: (1)Experience with the current Anti-Money Laundering and Countering the Financing of Terrorism (AML/CTF) framework, which heavily relies on the national implementation of AML/CFT measures, has disclosed weaknesses not only with regard to the efficient functioning of the AML/CFT framework of the Union but also with regards to integrating international recommendations. Those weaknesses lead to the emergence of new obstacles to the proper functioning of internal market both due to the risks within the internal market as well as external threats facing the internal market. (2)Cross-border nature of crime and criminal proceeds endanger Union financial system efforts relating to prevention of money laundering and financing of terrorism. Those efforts have to be tackled at Union level through the creation of an Authority responsible for contributing to the implementation of harmonised rules. In addition, the Authority should pursue a harmonised approach to strengthen the Union’s existing AML/CFT preventive framework, and specifically AML supervision and cooperation between FIUs. That approach should reduce divergences in national legislation and supervisory practices and introduce structures that benefit the smooth functioning of the internal market in a determined manner and should, consequently, be based on Article 114 TFEU. (3)Therefore, a European Authority for anti-money laundering and countering the financing of terrorism, the Anti-Money Laundering Authority (‘the Authority’) should be established. The creation of this new Authority is crucial to ensure efficient and adequate supervision of obliged entities having high inherent Money Laundering/Terrorist Financing (ML/TF) risk, strengthening common supervisory approaches for non-selected obliged entities and facilitating joint analyses and cooperation between Financial Investigation Units (FIUs). (4)This new instrument is part of a comprehensive package aiming at strengthening the Union’s AML/CFT framework. Together, this instrument, Directive [please insert reference – proposal for 6th Anti-Money Laundering Directive], Regulation [please insert reference – proposal for a recast of Regulation (EU) 2015/847] and Regulation [please insert reference – proposal for the Anti-Money Laundering Regulation] will form the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the Union’s AML/CFT institutional framework. (5)To bring AML/CFT supervision to an efficient and uniform level across the Union, it is necessary to provide the Authority with the following powers: direct supervision of a certain number of selected obliged entities of the financial sector; monitoring, analysis and exchange of information concerning ML/TF risks affecting internal market; coordination and oversight of AML/CFT supervisors of the financial sector; coordination and oversight of AML/CFT supervisors of the non-financial sector, including self-regulatory bodies and the coordination and support of FIUs. (6)Combining both direct and indirect supervisory competences over obliged entities, and also functioning as a support and cooperation mechanism for FIUs, is the most appropriate means of bringing about supervision and cooperation between FIUs at Union level. This should be achieved by creating an Authority which should combine independence and a high level of technical expertise and which should be established in line with the Joint Statement and Common Approach of the European Parliament, the Council of the European Union and the European Commission on decentralised agencies. (7)A seat agreement should be established between the Authority and the host Member State, stipulating the conditions of establishment of the seat and advantages conferred by the Member State on the Authority and its staff. (8)The powers of the Authority should allow it to improve AML/CFT supervision in the Union in various ways. With respect to selected obliged entities, the Authority should ensure group-wide compliance with the requirements laid down in the AML/CFT framework and any other legally binding Union acts that impose AML/CFT-related obligations on financial institutions. Furthermore, the Authority should carry out periodic reviews to ensure that all financial supervisors have adequate resources and powers necessary for the performance of their tasks. It should facilitate the functioning of the AML supervisory colleges and contribute to convergence of supervisory practices and promotion of high supervisory standards. With respect to non-financial supervisors, including self-regulatory bodies where appropriate, the Authority should coordinate peer reviews of supervisory standards and practices and request non-financial supervisors to investigate possible breaches of AML/CFT requirements. In addition, the Authority should coordinate the conduct of joint analyses by FIUs and make available to FIUs IT and artificial intelligence services and tools for secure information sharing, including through hosting of FIU.net. (9)With the objective to strengthen AML/CFT rules at Union level and to enhance their clarity while ensuring consistency with international standards and other legislation, it is necessary to establish the coordinating role of the Authority at Union level in relation to all types of obliged entities to assist national supervisors and promote supervisory convergence, in order to increase the efficiency of the implementation of AML/CFT measures, also in the non-financial sector. Consequently, the Authority should be mandated to prepare regulatory technical standards, to adopt guidelines, recommendations and opinions with the aim that where supervision remains at national level, the same supervisory practices and standards apply in principle to all comparable entities. The Authority should be entrusted, due to its highly specialised expertise, with the development of a supervisory methodology, in line with a risk-based approach. Certain aspects of the methodology, which can incorporate harmonised quantitative benchmarks, such as approaches for classifying the inherent risk profile of obliged entities should be detailed in directly applicable binding regulatory measures – regulatory or implementing technical standards. Other aspects, which require wider supervisory discretion, such as approaches to assessing residual risk profile and internal controls in the obliged entities should be covered by non-binding guidelines, recommendations and opinions of the Authority. The harmonised supervisory methodology should take due account of, and where appropriate, leverage the existing supervisory methodologies relating to other aspects of supervision of the financial sector obliged entities, especially where there is interaction between AML/CFT supervision and prudential supervision. Specifically, the supervisory methodology to be developed by the Authority should be complementary to guidelines and other instruments developed by the European Banking Authority detailing approaches of prudential supervisory authorities with respect to factoring ML/TF risks in prudential supervision, in order to ensure effective interaction between prudential and AML/CFT supervision. (10)The Authority should be empowered to develop regulatory technical standards in order to complete the harmonised rulebook established in the [please insert references – proposal for 6th Anti-Money Laundering Directive, Anti-money laundering Regulation and proposal for a recast of Regulation (EU) 2015/847]. The Commission should endorse draft regulatory technical standards by means of delegated acts pursuant to Article 290 TFEU in order to give them binding legal effect. They should be subject to amendment only in very restricted and extraordinary circumstances, since the Authority is the actor in close contact with and knowing best the AML/CFT framework. To ensure a smooth and expeditious adoption process for those standards, the Commission’s decision to endorse draft regulatory technical standards should be subject to a time limit. (11)The Commission should also be empowered to adopt implementing technical standards by means of implementing acts pursuant to Article 291 TFEU. (12)Since there are no sufficiently effective arrangements to handle AML/CFT incidents involving cross-border aspects it is necessary to put in place an integrated AML/CFT supervisory system at Union level that ensures consistent high-quality application of the AML/CFT supervisory methodology and promotes efficient cooperation between all relevant competent authorities. For these reasons, the Authority and national AML/CFT supervisory authorities (‘supervisory authorities’) should constitute an AML/CFT supervisory system. This would also benefit supervisory authorities when facing specific challenges, for example vis-à-vis an enhanced AML/CFT risk or due to a lack of resources, as within that system mutual assistance should be possible on request. This could involve exchange and secondments of personnel, training activities and exchanges of best practices. Furthermore, the Commission could provide technical support to Member States under Regulation (EU) 2021/240 of the European Parliament and of the Council to promote reforms aimed at reinforcement of the fight against money laundering. (13)Considering the important role of thematic reviews in AML/CFT supervision across the Union as they enable to identify and compare the level of exposure to risks and trends in relation to obliged entities under supervision, and that currently supervisors in different Member States do not benefit from these reviews, it is necessary that the Authority identifies national thematic reviews that have a similar scope and time-frame and ensures their coordination at the level of the Union. To avoid situations of possibly conflicting communications with supervised entities, the coordination role of the Authority should be limited to interaction with relevant supervisory authorities, and should not include any direct interaction with non-selected obliged entities. For the same reason, the Authority should explore the possibility of aligning or synchronising the timeframe of the national thematic reviews and facilitate any activities that the relevant supervisory authorities may wish to carry out jointly or similarly. (14)The efficient usage of data leads to better monitoring and compliance of firms. Therefore, both direct and indirect supervision by the Authority and supervisory authorities of all obliged entities across the system should rely on expedient access to relevant data and information about the obliged entities themselves and the supervisory actions and measures taken towards them. To that end, the Authority should establish a central AML/CFT database with information collected from all supervisory authorities, and should make such information selectively available to any supervisory authority within the system. This data should also cover withdrawal of authorisation procedures, fit and proper assessments of shareholders and members of individual obliged entities as this will enable relevant authorities to duly consider possible shortcomings of specific entities and individuals that might have materialised in other Member States. The database should also include statistical information about supervisory and other public authorities involved in AML/CFT supervision. Such information would enable effective oversight by the Authority of the proper functioning and effectiveness of the AML/CFT supervisory system. The information from the database would enable the Authority to react in a timely manner to potential weaknesses and cases of non-compliance by non-selected obliged entities. Pursuant to Article 24 of Council Regulation (EU) 2017/1939, the Authority will without undue delay report to the EPPO any criminal conduct in respect of which it could exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that Regulation. Pursuant to Article 8 of Regulation 883/2013, the Authority will transmit to OLAF without delay any information relating to possible cases of fraud, corruption or any other illegal activity affecting the financial interests of the Union. (15)With the objective of ensuring a more effective and less fragmented protection of the Union’s financial framework, a limited number of the riskiest obliged entities should be directly supervised by the Authority. As ML/TF risks are not proportional to the size of the supervised entities, other criteria should be applied to identify the most risky entities. In particular, two categories should be considered: high-risk cross-border credit and financial institutions with activity in a significant number of Member States, selected periodically; and, in exceptional cases, any entity whose material breaches of applicable requirements are not sufficiently or in a timely manner addressed by its national supervisor. Those entities would fall under the category of ‘selected obliged entities’. (16)The first category of credit and financial institutions, or groups of such institutions should be assessed every three years, based on a combination of objective criteria related to their cross-border presence and activity, and criteria related to their inherent ML/FT risk profile. Only large complex financial groups present in a number of Member States that could be more efficiently supervised at Union level should be included in the selection process. With respect to credit institutions, minimal cross-border presence for inclusion in the selection process should be based on the number of subsidiaries and branches in different Member States, because risky banking activities of significant volume require a local presence in a form of an establishment. Other financial sector entities may, in contrast, carry out activities that can be sufficiently risky from an ML/TF perspective by means of direct provision of services, for example via a network of agents, but may not have established subsidiaries or branches in a large number of Member States. Therefore, applying the same cross-border criteria, that is to say the one related to freedom of establishment, would result in scoping out large financial sector entities that can have a significant risk profile in a number of Member States, without being established there. Since the volume of activities via direct provision of services is generally smaller than the volume of activities carried out in a branch or a subsidiary, it is appropriate to consider only groups that are established in at least two Member States, but provide services directly or via a network of agents in at least eight more Member States. (17)In order to ensure that only the riskiest obliged entities among those with significant cross-border operations are supervised directly at the level of the Union, the assessment of their inherent risk should be harmonised. Currently, there are various national approaches and supervisory authorities use distinct benchmarks for assessment and classification of inherent ML/TF risk of obliged entities. Using these national methodologies for selection of entities for direct supervision at Union level could lead to a different playing field among them. Therefore, the Authority should be empowered to develop regulatory technical standards laying out a harmonised methodology and benchmarks for categorising the inherent ML/TF risk as low, medium, substantial, or high. The methodology should be tailored to particular types of risks and therefore should follow different categories of obliged entities which are financial institutions in accordance with the Regulation of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing [OP please insert the next number for COM(2021)420]. That methodology should be sufficiently detailed and should establish specific quantitative and qualitative benchmarks considering at least the risk factors related to types of customers served, products and services offered, and geographical areas, including third country jurisdictions that obliged entities operate in or are related to. Specifically, each assessed obliged entity would have its inherent risk profile classified in each Member State where it operates in a manner consistent with the classification of any other obliged entity in the Union. The quantitative and qualitative benchmarks would allow such classification to be objective and not dependent on the discretion of a given supervisory authority in a Member State, or the discretion of the Authority. (18)The final selection criterion should warrant a level playing field among directly supervised obliged entities, and to that end, no discretion should be left to the Authority or supervisory authorities in deciding on the list of obliged entities that should be subject to direct supervision. Therefore, where a given assessed obliged entity operates cross-border and falls within the high risk category in accordance with the harmonised methodology in a minimum number of Member States, it should be deemed a selected obliged entity. In case of credit institutions, the cross-border aspect should be addressed by including those credit institutions that are classified as high risk in at least four Member States and where in at least one Member State of those four the entity has been under supervisory or other public investigation for material breaches of AML/CFT requirements. In case of other financial institutions, the cross-border aspect should be addressed by including those financial institutions that are classified as high risk in at least one Member State where they are established and at least five other Member States where they operate by means of direct provision of services. (19)To provide transparency and clarity to the relevant institutions, the Authority should publish a list of the selected obliged entities within one month of commencement of a selection round, after verifying the correspondence of information provided by the financial supervisors to the cross-border activities criteria and the inherent risk methodology. Therefore it is important that at the beginning of each selection period, the relevant financial supervisors provide the Authority with up-to-date statistical information to determine the list of financial institutions eligible for assessment in accordance with the assessment entry criteria relating to their cross-border operations. In this context, the financial supervisors should inform the Authority about the inherent risk category that a financial institution falls into in their jurisdictions in accordance with the methodology laid down in the regulatory technical standards. The Authority should then assume the tasks related to direct supervision five months after the publication of the list. That time is needed to appropriately prepare the transfer of supervisory tasks from national to Union level, including the formation of a joint supervisory team, and adopting any relevant working arrangements with the relevant financial supervisors.

(20)To ensure legal certainty and a level playing field among selected entities, any selected entity should remain under direct supervision of the Authority for at least three years, even if since the moment of selection and in the course of the three years it ceases to meet any of the cross-border activity or risk-related criteria due to e.g. potential consolidation, expansion or re-allocation of activities carried out via establishments or freedom to provide services. The Authority should also ensure that sufficient time is allocated to preparation by the obliged entities and their supervisory authorities to the transfer of supervision from national to Union level. Therefore, each subsequent selection should commence six months before the end-date of the three year period of supervision of the previously selected entities. (21)The relevant actors involved in the application of the AML/CFT framework should cooperate with each other in accordance with the duty of sincere cooperation enshrined in the Treaties. In order to ensure that the AML supervisory system composed of the Authority and supervisory authorities functions as an integrated mechanism, and that jurisdiction-specific risks and local supervisory expertise are duly taken into account and well utilised, direct supervision of selected obliged entities should take place in the form of joint supervisory teams. These teams should be led by a staff member of the Authority coordinating all supervisory activities of the team. To ensure an adequate understanding of possible national specificities, the team leader (‘JST coordinator’) should be stationed in the Member State where a selected entity has its headquarter. The Authority should be in charge of establishment and composition of the joint supervisory team, and the local supervisors should ensure that a sufficient number of their staff members are appointed to the team, taking into account the risk profile of the selected entity in their jurisdiction. (22)To ensure that the Authority can fulfil its supervisory obligations in an efficient manner with regard to selected obliged entities, the Authority should be able to obtain any internal documents and information necessary for the exercise of its tasks and for that purpose have general investigation powers afforded to all supervisory authorities under national administrative law. (23)The Authority should have the power to require actions, internal to the entity, to enhance the compliance of obliged entities with the AML/CFT framework, including reinforcement of internal procedures and changes in the governance structure, going as far as removal of members of the management body, without prejudice to the powers of other relevant supervisory authorities of the same selected entity. Following relevant findings related to non-compliance or partial compliance with applicable requirements by the obliged entity, it should be able to impose specific measures or procedures for particular clients or categories of clients who pose high risks. On-site inspections should be a regular feature of such supervision. If a specific type of on-site inspection requires an authorisation by the national judicial authority, such authorisation should be applied for by the Authority. (24)The Authority should have a full range of supervisory powers in relation to directly supervised entities in order to ensure compliance with applicable requirements. These powers should apply in cases where the selected entity does not meet its requirements, in cases where certain requirements are not likely to be met, as well as in cases where internal process and controls are not appropriate to ensure sound management of selected obliged entity’s ML/FT risks. The exercise of these powers could be done by means of binding decisions addressed to selected individual obliged entities. (25)In addition to supervisory powers and in order to ensure compliance, in cases of material breaches of directly applicable requirements, the Authority should be able to impose administrative pecuniary sanctions on the selected obliged entities. Such sanctions should be proportionate and dissuasive, should have both punitive and deterrent effect, and should comply with the principle of ne bis in idem. The maximum amounts of pecuniary sanctions should be in line with those established by [please insert reference – 6th Anti-Money Laundering Directive] and available to all supervisory authorities across the Union. The basic amounts of these sanctions should be determined within the limits established by the AML/CFT framework, taking into account the nature of the requirements that have been breached. In order for the Authority to take aggravating or mitigating factors adequately into account, adjustments to the relevant basic amount should be possible. With the objective to achieve a timely change of the damaging business practice, the Executive Board of the Authority should be empowered to impose periodic penalty payments to compel the relevant legal or natural person to cease the relevant conduct. With the aim to heighten awareness of all obliged entities, by encouraging them to adopt business practices in line with the AML/CFT framework, the sanctions and penalties should be disclosed. The Court of Justice should have jurisdiction to review the legality of decisions adopted by the Authority, the Council and the Commission, in accordance with Article 263 TFEU, as well as for determining their non-contractual liability. (26)In order for the Authority and financial supervisors to communicate swiftly and efficiently within AML/CFT supervisory system and to enable more coherent decision-making processes, it is necessary to have specific arrangements for communication within that system. (27)For non-selected obliged entities, the AML/CFT supervision is to remain primarily at national level, with national competent authorities retaining full responsibility and accountability for direct supervision. The Authority should be granted adequate indirect supervisory powers to ensure that supervisory actions at national level are consistent and of a high quality across the Union. Therefore, it should carry out assessments of the state of supervisory convergence and publish reports with its findings. It should be empowered to issue guidelines and recommendations, addressed to both obliged entities as well as supervisory authorities, with a view to ensuring harmonised and high level supervisory practices across the Union. (28)Certain obliged entities in the financial sector that do not meet the requirements for regular selection might still have a high inherent profile from the money laundering and terrorism financing perspective, or might take on, change or expand activities that entail high risk, not mitigated with a commensurate level of internal controls, thus leading to material breaches of its AML/CFT requirements. If there are indications of possible material breaches of applicable AML/CFT requirements, they may be a sign of gross negligence on part of the obliged entity. The supervisory authority should in most cases be able to adequately respond to any possible breaches and prevent the risks from materialising and leading to gross negligence of AML/CFT requirements. However, in certain cases a national level response might not be sufficient or timely, especially when there are indications that material breaches at the level of the entity have already occurred. In those cases, the Authority should be able to request the local supervisor to take specific measures to remedy the situation, including requesting to issue financial sanctions. To prevent money laundering and terrorism risks from materialising, the deadline for action at national level should be sufficiently short. (29)The Authority should have the opportunity to request a transfer of supervisory tasks and powers relating to a specific obliged entity on its own initiative in case of inaction or failure to follow its instructions within the provided deadline. Since the transfer of tasks and powers over an obliged entity without the specific request of the financial supervisor to the Authority would require a discretionary decision on the part of the Authority, the Authority should address a specific request to that end to the Commission. In order for the Commission to be able to take a decision coherent with the framework of the tasks allocated to the Authority within the AML/CFT framework, the request of the Authority should enclose an appropriate justification, and should indicate a precise duration of the reallocation of tasks and powers towards the Authority. The timeframe for the reallocation of powers should correspond to the time the Authority requires to deal with the risks at entity level, and should not exceed three years. The Commission should adopt a decision transferring powers and tasks for supervising the entity to the Authority swiftly, and in any case within a month. (30)In order to improve supervisory practices in the non-financial sector, the Authority should carry out peer reviews of supervisory authorities in the non-financial sector, including public authorities overseeing self-regulatory bodies (SRBs), and publish reports with its findings; those could be accompanied by guidelines or recommendations addressed to the relevant public authorities, including public authorities overseeing SRBs. SRBs should be able to participate in peer reviews on a case-by-case basis where they have expressed their willingness to participate. (31)With the objective to increase the efficiency of the implementation of AML/CFT measures also in the non-financial sector, the Authority should also be able to investigate possible breaches or incorrect application of Union law by supervisory authorities in that sector, including public authorities overseeing SRBs. (32)In order to analyse suspicious activity affecting multiple jurisdictions, the relevant FIUs that received linked reports should be able to efficiently conduct joint analyses of cases of common interest. To this end, the Authority should be able to propose, coordinate and support with all appropriate means the joint analyses of cross-border suspicious transactions or activities. The joint analyses should be triggered where there is a need to conduct just such joint analyses pursuant to the relevant provisions in Union law. Upon the explicit consent of the FIUs participating in the joint analyses, the staff of the Authority supporting the conduct of joint analyses should be able to receive and process all necessary data and information, including the data and information pertaining to the analysed cases. (33)In order to improve the effectiveness of the joint analyses, the Authority should be able to initiate reviews of methods, procedures and conduct of the joint analyses, with the aim of determining the lessons learnt and of improving and promoting these analyses. The feedback on the joint analysis should enable the authority to issue conclusions and recommendations which would ultimately lead to the regular refinement and improvement of the methods and procedures for the conduct of joint analyses. (34)In order to facilitate and improve cooperation between FIUs and the Authority, including for the purposes conducting joint analyses, the FIUs should be able to delegate one staff member per FIU to the Authority on a voluntary basis. The national FIU delegates should support the Authority’s staff in carrying out all the tasks relating to FIUs, including the conduct of joint analyses and the preparation of threat assessments and strategic analyses of money laundering and terrorist financing threats, risks and methods. Apart from the joint analyses, the Authority should encourage and facilitate various forms of mutual assistance between FIUs, including training and staff exchanges in order to improve capacity building and enable the exchange of knowledge and good practices amongst FIUs. (35)The Authority should manage, host, and maintain FIU.net, the dedicated IT system allowing FIUs to cooperate and exchange information amongst each other and, where appropriate, with their counterparts from third countries and third parties. The Authority should, in cooperation with Member States, keep the system up-to-date. To this end, the Authority should ensure that at all times the most advanced available state-of-the-art technology is used for the development of the FIU.net, subject to a cost-benefit analysis. (36)In order to establish consistent, efficient and effective supervisory and FIU-related practices and ensure common, uniform and coherent application of Union law, the Authority should be able to issue guidelines and recommendations addressed to all or category of obliged entities and all or a category of supervisory authorities and FIUs. The guidelines and recommendations could be issued pursuant to a specific empowerment in the applicable Union acts, or on the own initiative of the Authority, where there is a need to strengthen the AML/CFT framework at Union level. (37)The establishment of a solid governance structure within the Authority is essential for ensuring effective exercise of the tasks granted to the Authority, and for an efficient and objective decision-making process. Due to the complexity and variety of the tasks conferred on the Authority in both the supervision and FIU areas, the decisions cannot be taken by a single governing body, as is often the case in decentralised agencies. Whereas certain types of decisions, such as decisions on adoption of common instruments, need to be taken by representatives of appropriate authorities or FIUs, and respect voting rules of the TFEU, certain other decisions, such as the decisions towards individual selected obliged entities, or individual authorities, require a smaller decision-making body, whose members should be subject to appropriate accountability arrangements. Therefore, the Authority should comprise a General Board, and an Executive Board composed of five full-time independent members and of the Chair of the Authority. (38)In order to ensure the relevant expertise, the General Board should have two compositions. For all the decisions on the adoption of acts of general application such as the regulatory and implementing technical standards, guidelines, recommendations, and opinions relating to FIUs, it should be composed of the heads of FIUs of Member States (‘General Board in FIU composition’). For the same types of acts related to direct or indirect supervision of financial and non-financial obliged entities, it should be composed of the heads of AML/CFT supervisors which are public authorities (‘General Board in supervisory composition’). All parties represented in the General Board should make efforts to limit the turnover of their representatives, in order to ensure continuity of the Board's work. All parties should aim to achieve a balanced representation between men and women on the General Board. (39)For a smooth decision making process, the tasks should be clearly divided: the General Board in FIU composition should decide on the relevant measures for FIUs, the General Board in supervisory composition should decide on delegated acts, guidelines and similar measures for obliged entities. The General Board in supervisory composition should also be able to provide its opinion and advice to the Executive Board on all draft decisions towards individual selected obliged entities proposed by the Joint Supervisory Teams. In absence of such opinion or advice, the decisions should be taken by the Executive Board. Whenever the Executive Board deviates from the advice provided by the General Board in supervisory composition in the final decision, it should explain the reasons thereof in writing.

(40)For the purposes of voting and taking decisions, each Member State should have one voting representative. Therefore, the heads of public authorities should appoint a permanent representative as the voting member of the General Board in supervisory composition. Alternatively, depending on the subject-matter of the decision or agenda of a given General board meeting, public authorities of a Member State may decide on an ad-hoc representative. The practical arrangements related to decision-making and voting by the General Board members in supervisory composition should be laid down in the Rules of Procedure of the General Board, to be developed by the Authority. (41)The Chair of the Authority should chair the General Board meetings and have a right to vote when decisions are taken by simple majority. The Commission should be a non-voting member on the General Board. To establish good cooperation with other relevant institutions, the General Board should also be able to admit other non-voting observers, such as a representative of the Single Supervisory Mechanism and of each of the three European Supervisory Authorities (EBA, EIOPA and ESMA) for the General Board in its Supervisory Composition and Europol, the EPPO and Eurojust for the General Board in its FIU composition, where matters that fall under their respective mandates are discussed or decided upon. To allow a smooth decision making process, decisions of the General Board should be taken by a simple majority, except for decisions concerning draft regulatory and implementing technical standards, guidelines and recommendations which should be taken by a qualified majority of Member State representatives in accordance with voting rules of the TFEU. (42)The governing body of the Authority should be the Executive Board composed of the Chair of the Authority and of five full time members, appointed by the General Board based on the shortlist by the Commission. With the aim of ensuring a speedy and efficient decision making process, the Executive Board should be in charge of planning and execution of all the tasks of the Authority except where specific decisions are explicitly allocated to the General Board. In order to ensure objectivity and appropriate rapidity of the decision-making process in the area of direct supervision of the selected obliged entities, the Executive Board should take all binding decisions addressed to selected obliged entities. In addition, together with a representative of the Commission the Executive Board should be collectively responsible for the administrative and budgetary decisions of the Authority. The consent of the Commission should be required when the Executive Board is taking decisions related to the budget administration, procurement, recruitment, and audit of the Authority, given that a portion of funding of the Authority will be provided from Union budget. (43)To allow for swift decisions, all decisions of the Executive Board, including the decision where the Commission has a right to vote, should be taken by simple majority, with the Chair holding a casting vote in case of a tied vote. To ensure sound financial management of the Authority, the Commission’s consent should be required for decisions related to budget, administration and recruitment. The voting members of the Executive Board other than the Chair should be selected by the General Board, based on a short-list established by the Commission. (44)To ensure the independent functioning of the Authority the five Members of the Executive Board and the Chair of the Authority should act independently and in the interest of the Union as a whole. They should behave, both during and after their term of office, with integrity and discretion as regards the acceptance of certain appointments or benefits. To avoid giving any impression that a Member of the Executive Board might use its position as a Member of the Executive Board of the Authority to get a high-ranking appointment in the private sector after his term of office and to prevent any post-public employment conflicts of interests, a cooling-off period for the five Members of the Executive Board, including the Chair of the Authority, should be introduced. (45)The Chair of the Authority should be appointed based on objective criteria by the Council after approval by the European Parliament. He or she should represent the Authority externally and should report on the execution of Authority’s tasks. (46)The Executive Director of the Authority should be appointed by the Executive Board based on a shortlist from the Commission. The Executive Director of the Authority should be a senior administrative official of the Authority, in charge of the day-to-day management of the Authority, and responsible for budget administration, procurement, and recruitment and staffing. (47)To protect effectively the rights of parties concerned, for reasons of procedural economy and to reduce the burden on the Court of Justice of the European Union, the Authority should provide natural and legal persons with the possibility to request a review of decisions taken under the powers related to direct supervision and conferred on the Authority by this Regulation and addressed to them, or which are of direct and individual concern to them. The independence and objectivity of the decisions taken by the Administrative Board of Review should be, among others, ensured by its composition of five independent and suitably qualified persons. Decisions of the Administrative Board of Review should be in turn appealable before the Court of Justice of the European Union. (48)To guarantee the proper functioning of the Authority, funding should be provided by a combination of fees levied on certain obliged entities and a contribution from the Union budget, depending on the tasks and functions. The budget of the Authority should be part of the Union budget, confirmed by the Budgetary Authority on the basis of a proposal from the Commission. The Authority should submit to the Commission a draft budget and an internal financial regulation for approval. (49)To ensure that the Authority can also fulfil its tasks as direct and indirect supervisor of obliged entities, an adequate mechanism for the determination and the collection of the fees should be introduced. As regards the fees levied on selected obliged entities and certain non-selected obliged entities, the methodology for their calculation and the process of collection of fees should be developed in a delegated act of the Commission. The methodology should be based on the risk of the directly and indirectly supervised entities as well as their turnover or revenue. (50)The rules on establishment and implementation of the budget of the Authority, as well as the presentation of annual accounts of the Authority, should follow the provisions of Commission Delegated Regulation (EU) 2019/715 as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of the European Anti-Fraud Office investigations. (51)In order to prevent and effectively combat internal fraud, corruption or any other illegal activity within the Authority, it should be subject to Regulation (EU, Euratom) No 883/2013as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of the European Anti-Fraud Office investigations. The Authority should accede to Interinstitutional Agreement concerning internal investigations by OLAF, which should be able, to carry out on-the-spot checks within the area of its competence. (52)As stated in the Cybersecurity Strategy for the European Union, it is essential to ensure a high level of cyber resilience in all EU institutions, bodies and agencies due to the increasingly hostile threat environment. The Executive Director must thus ensure appropriate IT risk management, a strong internal IT governance and sufficient IT security funding. The Authority shall work closely with the Computer Emergency Response Team of the European Union Institutions, Bodies and Agencies and report major incidents with 24 hours to CERT EU as well as to the Commission. (53)The Authority should be accountable to both the European Parliament and the Council for the execution of its tasks and implementation of this Regulation. The Chair of the Authority should present a respective report to the European Parliament, the Council and the Commission on a yearly basis. (54)The staff of the Authority should be composed of temporary agents, contractual agents and seconded national experts as well as national delegates placed at the disposition of the Authority by Union FIUs. The Authority, in agreement with the Commission, should adopt the relevant implementing measures in accordance with the arrangements provided for in Article 110 of the Staff Regulations. (55)To ensure that confidential information is treated accordingly, all members of the governing bodies of the Authority, all staff of the Authority, including seconded staff and staff placed at the disposition of the Authority, as well as any persons carrying out tasks for the Authority on a contractual basis, should be subject to obligation of professional secrecy, including any confidentiality restrictions and obligations stemming from the relevant provisions of Union legislation, and related to the specific tasks of the Authority. However, confidentiality and professional secrecy obligations should not prevent the Authority from cooperating with, exchanging or disclosing information to other relevant national or Union authorities or bodies, where it is necessary for the performance of their respective tasks and where such cooperation and exchange of information obligations are envisaged in Union law. (56)Without prejudice to the confidentiality obligations that apply to the Authority’s staff and representatives in accordance with the relevant provisions in Union law, the Authority should be subject to Regulation (EC) No 1049/2001 of the European Parliament and of the Council. In line with the confidentiality and professional secrecy restrictions related to supervisory and FIU support and coordination tasks of the Authority, such access should not be extended to confidential information handled by the staff of the Authority. In particular, any operational data or information related to such operational data of the Authority and of the EU FIUs that is in the possession of the Authority due to carrying out the tasks and activities related to support and coordination of FIUs should be deemed as confidential. With regard to supervisory tasks, access to information or data of the Authority, the financial supervisors, or the obliged entities obtained in the process of carrying out the tasks and activities related to direct supervision should in principle also be treated as confidential and not subject to any disclosure. However, confidential information listed that relates to a supervisory procedure can be fully or partially disclosed to the obliged entities which are parties to such supervisory procedure, subject to the legitimate interest of legal and natural persons other than the relevant party, in the protection of their business secrets. (57)Without prejudice to any specific language arrangements that could be adopted within AML supervisory system and with selected obliged entities, Council Regulation No 1 should apply to the Authority and any translation services which may be required for the functioning of the Authority should be provided by the Translation Centre for the Bodies of the European Union. (58)Without prejudice to the obligations of the Member States and their authorities, the processing of personal data on the basis of this Regulation for the purposes of the prevention of money laundering and terrorist financing should be considered necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Authority under Article 5 of Regulation (EU) 2018/1725 of the European Parliament and of the Council and Article 6 of Regulation 2016/679of the European Parliament and of the Council. When developing any instruments or taking any decisions that may have a significant impact on the protection of personal data, the Authority should closely cooperate, where relevant, with the European Data Protection Board established by Regulation (EU) 2016/679 and with the European Data Protection Supervisor established by Regulation (EU) 2018/1725 to avoid duplication. (59)The Authority should establish cooperative relations with the relevant Union agencies and bodies, including Europol, Eurojust, the EPPO, and the European Supervisory Authorities, namely the European Banking Authority, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority. To improve cross-sectoral supervision and a better cooperation between prudential and AML/CFT supervisors the Authority should also establish cooperative relations with the authorities competent for prudential supervision of financial sector obliged entities, including the European Central Bank with regard to matters relating to the tasks conferred on it by Council Regulation (EU) No 1024/2013, as well as with resolution authorities as defined in Article 3 of Directive (EU) 2014/59/EU of the European Parliament and the Council and designated Deposit Guarantee Schemes authorities as defined in Article 2 (1), point 18 of Directive 2014/49/EU of the European Parliament and the Council. To this end, the Authority should be able to conclude agreements or memoranda of understanding with such bodies, including with regard to any information exchange which is necessary for the fulfilment of the respective tasks of the Authority and these bodies. The Authority should make its best efforts to share information with such bodies on their request, within the limits posed by legal constraints, including data protection legislation. In addition, the Authority should enable effective information exchange between all financial supervisors in the AML/CFT supervisory system and the aforementioned authorities, such cooperation and information exchanges should take place in a structured and efficient way.

(60)Public-private partnerships (‘PPPs’) have become increasingly important cooperation and information exchange fora between FIUs, various national supervisory and law enforcement authorities and obliged entities in some Member States. Where the Authority would act as direct supervisor of selected obliged entities which are part of a PPP in any Member State, it could be beneficial for the Authority to also participate therein, on conditions determined by the relevant national public authority or authorities that set up such PPP, and with their explicit agreement. (61)Considering that cooperation between supervisory, administrative and law enforcement authorities is crucial for successful combatting of money laundering and terrorism financing, and certain Union authorities and bodies have specific tasks or mandates in that area, the Authority should make sure that it is able to cooperate with such authorities and bodies, in particular OLAF, Europol, Eurojust, and the EPPO. If there is a need to establish specific working arrangements or conclude Memoranda of Understanding between the Authority and these bodies and authorities, the Authority should be able to do so. The arrangement should be of strategic and technical nature, should not imply sharing of any confidential or operational information in possession of the Authority and should account for tasks already carried out by the other Union institutions, bodies, offices or agencies as regards the prevention of and fight against money laundering and terrorist financing. (62)Since both predicate offenses as well as the crime of money laundering itself often are of global nature, and given that the Union obliged entities also operate with and in third countries, effective cooperation with all the relevant third country authorities in the areas of both supervision and functioning of FIUs are crucial for strengthening the Union AML/CFT framework. Given the Authority’s unique combination of direct and indirect supervision and FIU cooperation-related tasks and powers, it should be able to take an active role in such external cooperation arrangements. Specifically, the Authority should be empowered to develop contacts and enter into administrative arrangements with authorities in third countries that have regulatory, supervisory and FIU-related competences. The Authority’s role could be particularly beneficial in cases where the interaction of several Union public authorities and FIUs with third country authorities concerns matters within the scope of the Authority’s tasks. In such cases, the Authority should have a leading role in facilitating this interaction. (63)Since the Authority will have a full range of powers and tasks related to direct and indirect supervision and oversight of all obliged entities, it is necessary that these powers remain consolidated within one Union body, and do not give rise to conflicting competences with other Union bodies. Therefore, the European Banking Authority should not retain its tasks and powers related to anti-money laundering and countering the financing of terrorism, and the respective articles in Regulation (EU) No 1093/2010 of the European Parliament and of the Council should be deleted. The resources allocated to the European Banking Authority for the fulfilment of those tasks should be transferred to the Authority. Considering that all three European Supervisory Authorities (EBA, ESMA and EIOPA) will be cooperating with the Authority, and may attend the meetings of the General Board in supervisory composition as observers, the same possibility should be afforded to the Authority in respect of meetings of the Board of Supervisors of the European Supervisory Authorities. In cases where the respective Boards of Supervisors discuss or decide on matters that are relevant for the execution of the Authority’s tasks and powers, the Authority should be able to participate in their meetings as an observer. The articles on the compositions of the Board of Supervisors in Regulation (EU) No 1093/2010, Regulation (EU) 1094/2010 of the European Parliament and the Council, and Regulation (EU) 1095/2010 of the European Parliament and the Council should therefore be amended accordingly. (64)The Authority should be fully operation by the beginning of 2024. This should give the Authority sufficient time to establish its headquarter in the Member State as determined by this Regulation. (65)The European Data Protection Supervisor has been consulted in accordance with Article 42 of Regulation (EU) 2018/1725 [and delivered an opinion on ...], HAVE ADOPTED THIS REGULATION: CHAPTER I ESTABLISHMENT, LEGAL STATUS AND DEFINITIONS Article 1 Establishment and scope of action 1.The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (‘the Authority’) is established as of 1 January 2023. 2.The Authority shall act within the powers conferred by this Regulation, in particular those set out in Article 6, and within the scope of Regulation (EU) 2015/847 of the European Parliament and of the Council, the Directive on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing Directive (EU)2015/849 [OP: please insert the next number of COM(2021)423] and the Regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing [OP: please insert the next number of COM(2021)422], including all directives, regulations and decisions based on those acts, of any further legally binding Union act which confers tasks on the Authority and of national legislation implementing the Anti-Money Laundering Directive [OP: please insert the next number of COM(2021)423] or other Directives conferring tasks on supervisory authorities. 3.The objective of the Authority shall be to protect the public interest, the stability of the Union’s financial system and the good functioning of the internal market by: (a)preventing the use of the Union’s financial system for the purposes of money laundering and terrorist financing; (b)contributing to identify and assess risks of money laundering and terrorist financing across the internal market, as well as risks and threats originating from outside the Union that are impacting, or have the potential to impact the internal market; (c)ensuring high-quality supervision in the area of anti-money laundering and countering the financing of terrorism (‘AML/CFT’) across the internal market; (d)contributing to supervisory convergence in the area of anti-money laundering and countering the financing of terrorism across the internal market; (e)contributing to the harmonisation of practices in the detection of cross-border suspicious flows of monies or activities by Financial Intelligence Units (‘FIUs’); (f)supporting and coordinating the exchange of information between FIUs and between FIUs and others competent authorities.

The provisions of this Regulation are without prejudice to the powers of the Commission, in particular pursuant to Article 258 TFEU, to ensure compliance with Union law. Article 2 Definitions 1.For the purposes of this Regulation, in addition to the definitions set out in Article 2 of [OP: please insert the reference to Anti-Money Laundering Regulation COM(2021)420] and Article 2 [OP: please insert the reference to 6th Anti-Money Laundering Directive COM(2021)423], the following definitions apply: (1)‘selected obliged entity’ means a credit institution, a financial institution, or a group of credit or financial institutions at the highest level of consolidation in the Union, which is under direct supervision by the Authority pursuant to Article 13; (2)‘non-selected obliged entity’ means a credit institution, a financial institution, or a group of credit institutions or financial institutions at the highest level of consolidation in the Union, other than a selected obliged entity; (3)‘AML/CFT supervisory system’ means the Authority and the supervisory authorities in the Member States; (4)‘non-financial supervisor’ means a supervisor in charge of obliged entities listed in Article 3 of [AMLR], other than credit and financial institutions. (5)‘non-AML/CFT authority’ means: (a)a competent authority as defined in Article 4(1), point (40) of Regulation (EU) No 575/2013 of the European Parliament and of the Council; (b)the European Central Bank when it c