EUROPEAN COMMISSION Brussels, 27.10.2022 SWD(2022) 344 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL





on the assessment of the risk of money laundering and terrorist financing affecting the internal market and relating to cross-border activities {COM(2022) 554 final}



Table of Contents INTRODUCTION3 ANNEX 1 – RISK ANALYSIS BY PRODUCT/SECTOR5 I.CASH -RELATED PRODUCTS6

1. Cash couriers6 2. Cash intensive business14 3. High value banknotes22 4. Payments in cash27 5. Privately owned ATMs33 II.FINANCIAL SECTOR37 1. Retail banking sector (formerly “Deposits on accounts”) 37 2. Retail and Institutional investment sector (formerly “Institutional investment sector — Banking”) 43 3. Corporate banking sector48 4. Private banking sector51 5. Crowdfunding54 6. Currency exchange60 7. E-money65 8. Transfers of funds and money remittance (formerly “Transfers of funds”) 74 9. Illegal transfers of funds — Hawala81 10. Payment services86 11. Crypto-assets (formerly “Virtual currencies and other virtual assets”) 94 12. Business loans104 13. Consumer credit and low-value loans107 14. Mortgage credit and high-value asset-backed credits112

15. Life insurance116 16. Non-life insurance121 17. Safe custody services125 III.NON-FINANCIAL SECTOR129 1. Trusts129 2. Nominees138 3. Companies144 4. High value goods – artefacts and antiquities153 5. High value assets – Precious metals and precious stones164 6. High value assets – other than precious metals and stones171 7. Couriers in precious metals and stones175 8. Investment real estate179 9. Services provided by accountants, auditors, advisors, and tax advisors185 10. Legal services from notaries and other independent legal professionals194 IV.GAMBLING201 1. Betting203 2. Bingo209 3. Casinos212 4. Gaming machines (outside casinos) 217 5. Lotteries222

6. Poker 226 7. Online gambling230 V.NON-PROFIT ORGANISATIONS (NPO) 238 1.Collection and transfers of funds through a NPO238 VI.PROFESSIONAL SPORTS247 1.Investments in professional football and transfer agreements247 VII.FREE-TRADE ZONES256 1.Free Zones256 VIII.CITIZENSHIP-RESIDENCE265 1.Investor citizenship and residence schemes265 RISK MATRIX BY PRODUCT/SECTOR – Comparative table 2017-2019-2022 275 ANNEX 2 – METHODOLOGY277 ANNEX 3 – EU LEGAL FRAMEWORK 288 ANNEX 4 - GLOSSARY291 ANNEX 5 - BIBLIOGRAPHY294

1. INTRODUCTION This Supra-National Risk Assessment (SNRA) follows the methodology used for the 2017 and 2019 SNRAs, which provides a systematic analysis of the money laundering and terrorist financing risks linked to the methods used by perpetrators. The aim is to identify circumstances in which services and products in a given sector could be abused for money laundering (ML) or terrorist financing (TF) purposes, without passing judgement on the sector as a whole. As with its previous editions, this SNRA focuses on vulnerabilities at EU level, in terms of both the legal framework and its effective application. It presents the main risks for the internal market in a wide range of sectors and the horizontal vulnerabilities that can affect those sectors. This report sets out mitigating measures that should be taken at EU and national level to address the risks and makes a number of recommendations for the various actors concerned. It does not prejudge the mitigating measures that some Member States have taken or may decide to take in response to national ML/TF risks. The mitigating measures in this report should therefore be considered a baseline that can be adapted, depending on the national measures already in place. Under Article 6(4) of Directive 2015/849 (‘the 4th Anti-Money Laundering Directive’) as modified by Directive 2018/843 (‘the 5th Anti-Money Laundering Directive’), hereby ‘the Anti-Money Laundering Directive’ or ‘the AMLD’, if Member States decide not to apply any of the previous SNRA recommendations, they should notify the Commission of their decision and provide a justification for it (‘comply or explain’). No such notification was received to date by the Commission. Process followed for the 3rd edition of the Commission SNRA The Commission has built this third edition of the SNRA updating the analysis and conclusions of its second edition as well as further consulting individual experts, private stakeholders (representative organizations at EU level) and national authorities. These consultations have taken place from 2020 to 2022. The Commission also consulted other regulatory agencies and national authorities, such as Europol, the European supervisory authorities (ESAs) and the FIUs’ Platform (FIUnet). The purpose of this consultation exercise was twofold: to follow up on the recommendations made in the 2019 SNRA and to update and further fine-tune its analysis and conclusions, mainly as regards quantitative data and perceived risk levels. Finally, given the evolving nature of ML/TF threats and vulnerabilities, the SNRA takes an integrated approach to assessing the effectiveness of national AML/CFT arrangements. In order to monitor their compliance with EU requirements, their implementation and their preventive capacity, the Commission assessment takes due account of national risk assessments (NRAs) produced by the Member States to ensure the proper identification and mitigation of specific national risks. Individual sectors are also assessed taking stock of their relevant risk factors, including those relating to specific customers, countries, products, services, transactions and delivery channels. These three layers (supranational, national and sectoral) of risk assessment, along with risk mitigation, where appropriate feed into a comprehensive awareness and analysis of ML/TF risks in the EU in which different layers complement each other and are equally relevant. The Commission draws on and complements national and sectoral assessments by assessing risks that affect the Union internal market and are related to cross border activities. During this exercise Commission analysis has also benefited from the audit conducted by the European Court of Auditors (ECA) during 2019-2020. This audit has led to the adoption by the ECA of a special report. The conclusions of the ECA report as well as the methodology followed by the Commission in its SNRAs are further discussed under Annex 2 (“Methodology”). The legal framework

The risk assessment needs to provide a snapshot of the money laundering and terrorist financing risks and requires a clear-cut timing. The assessment of risks affecting the EU was carried out at a time when the relevant legislative framework was the 4th Anti-money Laundering Directive as modified by the 5th Anti-Money Laundering Directive. Transposition deadline for the latter elapsed on January 20, 2020. At the time of drafting this report, all Member States save the Netherlands have declared a complete transposition. While the main EU instrument is the Anti-money Laundering Directive, the Union’s anti- Money Laundering and Countering Terrorist Financing legal framework is complemented by other EU legislation. An indicative list is attached in Annex 3. In addition, an index of abbreviations used in the risk analysis is attached in Annex 4 and a bibliography in Annex 5. ANNEX 1 – RISK ANALYSIS BY PRODUCT/SECTOR This SNRA has followed a specific methodology involving systematic analysis of the ML/TF risks linked to perpetrators’ methods. The aim is to identify the circumstances under which the services and products a given sector provides could be abused for ML/TF purposes (without passing judgment on a sector as a whole). Methodology is presented in detail in Annex 2. It is based on Directive (EU) 2015/849 (4th Anti-money Laundering Directive) as modified by Directive (EU) 2018/843 (the AMLD). Each risk is rated for threat and vulnerability. The ratings are on a scale from 1 to 4 and coloured for easy identification as follows: 1)low significance – value: 1, 2)moderately significant – value: 2,

3)significant – value: 3, 4)very significant – value: 4, The ratings were used only to summarise the analysis. They should not be considered in isolation from the factual description of the risk. The final (or residual) risk level is ultimately determined by combination between the threat versus vulnerability. The risk matrix determining this risk level is based on a weighting of 40% (threat) + 60% (vulnerability) – assuming that the vulnerability component has more capacity in determining the risk level. The risk matrix: T h r e a t Very significant 2,2 2,8 3,4 4 Significant 1,8 2,4 3 3,6 Moderately significant 1,4 2 2,6 3,2 Lowly significant 1 1,6 2,2 2,8 Lowly significant Moderately significant Significant Very significant Vulnerability Then, the residual risk level is presented for every product/sector in a graded table: RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH 3,6 – 4 Very significant VERY HIGH CASH-RELATED PRODUCTS 1. Cash couriers Product Cash couriers / cross external border cash movements Sector This assessment covers the supranational risks – i.e. cash entering/leaving the European Union at the EU external borders. Since 15 June 2007, movements of cash entering or leaving the EU had been governed by Regulation 1889/2005, which implements Recommendation 32 of FATF on cash couriers at EU level. That Regulation is an integral part of the EU’s Anti-Money Laundering and Terrorist Financing framework. As part of the European Agenda on Security and Action Plan for strengthening the fight against terrorist financing, the Commission adopted a proposal for a Cash Controls Regulation in December 2016. Regulation (EU) 2018/1672 was adopted in October 2018 and has entered into application on 3rd June 2021 (the new Cash Controls Regulation). Regulation 1889/2005 established a uniform EU approach towards cash controls based on a mandatory declaration system. If a natural person entering or leaving the EU (including transiting) with cash of a value of EUR 10 000 or more, they should declare them to the relevant customs authorities. The EUR 10 000 threshold is considered high enough not to burden the majority of travellers and traders with disproportionate administrative formalities. However, when there were indications of illegal activities linked with movements of cash lower than EUR 10 000, the collecting and recording of information related to these movements was also authorised. This provision was introduced in order to limit the practice of 'smurfing' or 'structuring', the practice of deliberately carrying amounts lower than the threshold with the intention to escape the obligation to declare (e.g. splitting the amount between different connected persons from a same group/family). In keeping with the latest developments in international standards on combating money laundering and terrorism financing developed by the FATF, the new Cash Controls Regulation has significantly beefed up controls both in terms of scope and in terms of authorities’ powers: ·In terms of scope, under the new Cash Controls Regulation, the definition of cash has been extended to cover not only currency and bearer negotiable instruments (e.g. cheques or money orders) but also commodities used as highly-liquid stores of value such as gold. Its scope was also extended to cover cash that is sent by post, freight or courier shipment;

·The new Cash Controls Regulation also provides for the obligation for any traveller entering or leaving the EU and carrying cash to a value of EUR 10 000 or more to declare it to the customs authorities. The declaration is required irrespective of whether travellers are carrying the cash in person, in their luggage or means of transport and the cash has to be made available for control; ·Moreover, where the cash is sent by other means (“unaccompanied cash”), the relevant authorities have the power to ask the sender or the recipient to make a disclosure declaration. The authorities are able to carry out controls on any consignments, packages or means of transport which may contain unaccompanied cash. ·The new Cash Controls Regulation enables Customs authorities to act on amounts lower than the threshold of EUR 10 000, where there are indications that cash is related to criminal activity. In addition, the Regulation further enhances coordination of actions across authorities: ·The new Regulation improves the exchange of information between authorities (Customs and Financial Intelligence Units) and Member States. ·In case where there are indications that cash is related to criminal activity which could adversely affect the financial interests of the EU, this information is also transmitted to the European Commission, the European Public Prosecutor’s Office and to Europol, where they are competent to act; ·The new Cash Controls Regulation provides in its Article 5(4) that the risk assessments produced by the Commission and by national Financial Intelligence Units (FIUs) will be taken into account when establishing the common risk management framework for performing controls. The new Cash Controls Regulation does not prevent Member States from providing additional national controls on movements of cash within the Union under their national law, provided that these controls are in accordance with the Union's fundamental freedoms. Before the pandemic, per year on average there were around 110 000 cash cases, representing a total amount of around EUR 55 billion. Customs controls detected around 13 000 cases where cash was not declared or was incorrectly declared representing around EUR 364 million per year. As of the second quarter of 2020, due to the pandemic, travel was severely disrupted and, consequently also the physical movement of cash resulting to lower values of cash controls declarations (and non- declared cash or incorrect declarations) than the previous years. For 2020, there were almost 57 000 cash cases, representing a total amount of around EUR 37 billion. Customs controls detected almost 9 000 cases where cash was not declared or was incorrectly declared representing around EUR 245 million. Description of the risk scenario This risk scenario is intrinsically linked to use of/payment in cash and to high value denomination banknotes risk scenario. Criminals or terrorist financiers who generate/accumulate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where access to placement in the legal economy is easier. This includes locations characterised by a predominant use of cash, more lax supervision of the financial system or stronger bank secrecy regulations. Terrorists may also transfer rapidly and safely funds from one location to another, including by using cash concealed in air transit. Cash couriers may use air, sea, road or rail transport to cross an EU external border. In addition, cash may be moved across external borders unaccompanied such as in containerised or other forms of cargo, or concealed in mail or post parcels. To move very large amounts of cash, perpetrators often conceal it in cargo that can be containerised or otherwise transported across borders. Perpetrators may also use sophisticated concealment methods of cash within goods which are either carried across the external border by a courier or are sent by regular mail or post parcel services. Although unaccompanied consignments (except cargo) tend to be smaller than those secreted within vehicles, or on the person of cash couriers, the use of high denomination banknotes can still result in seizures of significant value. On the other hand, the seizure of large amounts of cash within EU is also possible. It is not only important to control EU external borders, but also the intra-EU transportation of cash. This fact is relevant because of the different intra-EU rules that Member States have regarding the use of cash to, for instance, purchase goods, deposit in bank accounts, etc. Additionally, the external borders are not monitored with the same efficiency level. Criminals know that fact, and they try to cross the most permeable borders with cash, even if they have to drive thousands of kilometres within EU. National thresholds of intra-EU movements of cash exist in some Member States: in Spain, for instance, it is EUR 100 000 for internal travel and EUR 10 000 when crossing borders. Example: Cash generated by criminal activities laundered by the purchase of high value goods and properties (Europol Report “Why is cash still king”)

Money from the sale of drugs was collected in Member State 1 and its laundering was orchestrated through the movement of cash by couriers acting as mules from Member States 1 to Member States 2, where cash was used to buy gold. Thereafter, gold was transported to and made into jewellery in a third country. A key organiser admitted laundering EUR 36 million since 2010 and sending 200 kg of gold from EU to the third country. The network collected about EUR 170 million per year. A cash payment threshold in Member State 2 would have reduced the profitability of this criminal scheme (as intermediaries have to be paid and multiplying transactions to change cash into gold by non-professional would have aroused more suspicion). Threat Terrorist financing Terrorist groups have made use of various techniques to move physical cash across the external borders, particularly in the case of larger organisations. This includes the following: ·The threat is particularly relevant for cash couriers from the EU to third countries. Law enforcement authorities have seized large amounts of money in conflicts zones that was supposed to finance terrorist organisations; ·Cases have been identified where (prospective) foreign terrorist fighters doubled as cash couriers to fund their travels and sojourn in conflict areas. These individuals typically carry lower amounts that are more difficult to detect and may not be subject to an obligation to declare incumbent on natural persons carrying EUR 10 000 Euro or more is cash. As it allows for anonymity, this modus operandi is perceived as attractive and fairly secure, despite still carrying some risks. That is the reason why this modus operandi shall also be considered in conjunction with the analysis of high denomination banknotes. The more high denomination banknotes are used, the easier the cash transportation is – although risks associated with acquiring high denomination notes (not readily available) may not outweigh the benefit of additional compactness. Cash transportation has been a recurring modus operandi for terrorist groups in Syria– although the average amounts carried by a foreign fighter leaving the EU may not be significant compared to locally available funds; ·The threat of cash transportation into the EU from a third country may also exist, in particular from countries exposed to TF risks or conflict areas (e.g. cash couriers from Syria, Gulf region, Russia into the EU have been reported). There are limited indications of high-value movements of cash into the Union (i.e. much in excess of the declaration threshold) for the purposes of terrorism financing. Cases have been identified concerning lower amounts and involving integration of cash amounts carried from third countries into the financial system/legal economy of the EU (analysed separately below). From a perpetrator risk-management perspective, sending cash through post or freight consignments, using multiple consignments each containing lower amounts presents a theoretically attractive option as there is no courier physically crossing the external border carrying the cash who could be intercepted. While customs controls may take place, these do not allow for the capture of all relevant data. Finally, perpetrators may also have an incentive to convert cash in other types of anonymous assets which are not subject to cash declarations (e.g. prepaid cards). Conclusions: LEAs have gathered evidence that cash couriers are recurrently used by terrorist groups to finance their activities or fund FTF travels. Similarly to the analysis conducted on cash, the use by criminal elements or terrorist financiers of cash couriers present advantages since this modus operandi is easily accessible, with no specific planning or expertise required. In that context, the level of TF threat related to cash couriers is considered as very significant (level 4). Money laundering Threats posed by cash couriers have been documented in the FATF Report: Money laundering through the physical transportation of cash (October 2015). That report points to physical transportation of cash across an international border, as 'one of the oldest and most basic forms of money laundering'. Transportation of cash is also used for terrorist financing. Although there is no reliable data on the amount of money ‘laundered’ in this way, the report estimated its volume to be between 'hundreds of billions and a trillion US dollars per year'. The report explains that the most frequently encountered and 'laundered' currencies are stable and widely used currencies such as the US dollar, the euro, the Swiss franc and the British pound, usually, with high denomination notes used. The report also highlights that criminals exploit the existing cash declaration systems mechanisms, for example, by 'reusing cash declarations several times for the same purpose'. In the above-mentioned 2015 Europol report “Why cash is still king?”, law enforcement investigations confirm that cash, and in particular high denomination notes, are commonly used by criminal groups as a facilitator for money laundering. Operations have revealed huge sums of cash moved and stashed by criminals which are steadily invested and integrated in the legal economy in a multitude of ways which rid them of bulky cash holdings at risk of being confiscated. These methods require an army of criminal associates and complicit or negligent gatekeepers to ensure that their insertion in the legal economy doesn’t arouse suspicion. In the EU, the use of cash is still the main reason triggering suspicious transaction reports within the financial system, accounting for 34% of all reports. Criminals who generate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where access to placement in the legal economy is easier (in particular due to the predominant use of cash in some jurisdictions’ economies, more lax supervision of the financial system or stronger banking secrecy regulations, or because criminals may have greater influence in the economic and political establishment). Cash smuggling may occur at other stages and is also used by non-cash generating offences. For example cybercrimes such as phishing and hacking make use of money mules to receive and withdraw sums fraudulently obtained from victims’ bank accounts in cash. These funds are thereafter sent via wire transfer to other jurisdictions where they are collected in cash by a select number of individuals, likely for onward transportation. Since 2017, cash has remained a relevant threat in regard to money laundering. European investigations indicate that movements of cash inside the EU and outside are associated with criminal offences. The most relevant crime area is drug trafficking. Drug related cash proceeds generated through the sales and distribution of predominantly cocaine and hashish are accumulated and received by the designated collectors working for a money laundering controller network. The money laundering controller networks provide money laundering as a service -cash out, cash in and payment for third parties- to any criminal organisation that approaches them. They offer similar services than financial institutions do, but outside of the regulated financial framework.

The drug trafficking organizations (DTO) then engage with money laundering controller networks(traditionally outside of the EU)these controllers charge a commission for facilitating towards the DTOs the value of their proceeds. The money laundering controller networks dispose of their own cash pool in different countries operated by coordinators and cash collectors. After the arrangement is made, the cash collectors deliver the cash proceeds to the designated intermediaries. From there the cash starts moving, crossing the EU towards the designated exit point (still within the EU) or exiting directly the EU. The current legal framework in the EU has significantly hindered the opportunities for introducing into the financial system large amount of illegal drug proceeds. Because of this, money is used in Trade-Based Money Laundering (TBML) schemes or is transported out of the EU towards “cash friendlier” jurisdictions. Turkey, Dubai and Beirut have in the last years shown steady presence as preferred cash destinations and growing financial hubs in the EU. The use of cash, sometimes in conjunction with other tools such as trade-based transactions, crypto currencies and hawala, is also an essential part of the drug trade, all the way from street level to purchase in production countries. Europol Financial Intelligence Public Private Partnership (EFIPPP) information extracted from typologies: Traffic of human beings: Organised crime groups involved in this traffic send cash/invest illegal profits in the country of origin: using cash couriers and Money Service Businesses (MSBs)(Western Union, MoneyGram) and / or invest in real estate, luxury vehicles and cash intensive businesses. In case of use of cash couriers: difficulty in financial detection. Illegal trade: Related to drugs, organised networks of ‘collectors’ physically gather and transport criminal proceeds in the form of cash, precious metals and jewellery. Match-fixing/betting: a ML indicator is the widespread use of cash couriers, MSBs and increasingly e-wallets payment service providers to transfer the proceeds of crime linked to sports corruption cases and to fuel online betting accounts for large-scale match-fixing operations. ML Controller Networks: the movement of value by cash couriers is one of the techniques mentioned. Cash carriers collect the ill-gotten funds –usually cash- to be transported to the required destination. Conclusions: the level of ML threat related to cash couriers is considered as very significant (level 4) Vulnerability Terrorist financing a)Risk exposure The cash couriers are associated with the threat of the large denomination banknotes: 500 (no longer issued since April 2019) and 200 Euro. The assessment of the TF vulnerability related to cash couriers shows that due to the nature of cash, the use of cash couriers allows significant volumes of transactions/transportation to take place speedily and anonymously. The cross-border aspect of this modus operandi increases the risk to involve geographical areas identified as high risks b)Risk awareness The legislation in place (mandatory cash declarations by natural persons at the external borders of the EU) has increased the risk awareness, at least as far as persons are concerned. Risk awareness exists for unaccompanied cash transportation, which is now covered by the new Cash Control Regulation – but is more limited. c) Legal framework and checks There are controls in place through the mandatory declaration of cash transportation at the EU external borders. Under the new Cash Controls Regulation these controls are extended to cash sent in postal parcels or freight shipments, and to commodities used as highly- liquid stores of value such as gold, which were not previously subject to cash controls. This legislation has also increased the risk awareness. Where unaccompanied cash is concerned (cash sent through consignments or parcels) the new Cash Controls Regulation enables the competent authorities to request the sender or the recipient, as the case may be, to make a disclosure declaration The authorities will also have the power to carry out controls on any consignments, receptacles or means of transport which may contain unaccompanied cash.. The declarations and disclosure declarations are done in writing or electronically using a standard form. These cash declarations allow for more effective reporting to the FIUs.

Conclusions: The risk exposure related to cash couriers by physical persons is intrinsically linked to the cash based activity (large volume, anonymity, speediness) - which is exacerbated by the fact that – especially within a terrorism context – the individual couriers often carry amounts below the declarative threshold. While the volume of cash couriers may be more important than for unaccompanied shipping, risk awareness and controls are in place. The use of cash couriers or methods to ship in/out of the EU unaccompanied cash coupled with the anonymity of cash and (at least with respect to unaccompanied cash) an imperfect control mechanism presents a significant challenge. While the volume of unaccompanied cash shipped in/out the EU is probably lower than for accompanied cash couriers, the risk awareness and controls of the latter pose a greater challenge. In that context, the level of TF vulnerability related to cash couriers by natural persons is considered as significant (level 3). The level of TF vulnerability related to post/freight is considered as very significant considering the controls/legal framework in place, more than the inherent risk exposure (level 4). Money laundering a)Risk exposure The risk exposure is intrinsically linked to the cash based activity (anonymity, speediness). Hence the risk exposure is particularly important for this modus operandi. b)Risk awareness The legislation in place (mandatory cash declarations at the external borders for cash carried by natural persons) has increased the risk awareness, at least as far as persons are concerned. Risk awareness exists for unaccompanied physical cash transportation – but is more limited with regard to shipping/freight/couriers. c)Legal framework and checks Similarly to TF, there are controls in place through the mandatory declaration of cash transportation at the EU external borders (Cash Controls Regulation) by natural persons. These cash declarations allow an easier detection of suspicious transactions and are reported to the FIUs (although shortcomings in information sharing exist and enforcement in application may also vary between Member States). Where unaccompanied cash is concerned (cash sent through consignments or parcels) the new Regulation allows the competent authorities to carry out risk analysis and concentrate their efforts on shipments deemed to present the highest risk, while not imposing systematic additional formalities. The disclosure obligation is subject to a threshold identical to that for cash carried by natural persons. Conclusion: The risk exposure related to cash couriers by physical persons is intrinsically linked to the cash based activity (large volume, anonymity, speediness). While the volume of cash couriers may be more important, the risk awareness and the controls in place exist. The use of cash couriers or methods to ship in/out of the EU unaccompanied cash coupled with the anonymity of cash and (at least with respect to unaccompanied cash) an imperfect control mechanism presents a significant challenge. While the volume of unaccompanied cash shipped in/out the EU is probably lower than for accompanied cash couriers, the risk awareness and controls in place pose a greater challenge. In that context, the level of ML vulnerability related to cash couriers by natural persons is considered as significant (level 3) and by post/freight is considered as very significant (level 4).

Risk level As regards terrorist financing, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as very significant (4). RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH As regards money laundering, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as significant/very significant (level 4). RISK RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH Conclusions: estimated risk level for both, terrorist financing and money laundering is VERY HIGH. Mitigating measures The new Cash Controls Regulation, applicable from 3 June 2021, has reinforced the existing rules on cash movements: ·It enables authorities to act on amounts lower than the declaration threshold of EUR 10 000, where there are indications that cash is related to criminal activity; ·Improves the exchange of information between authorities and Member States; ·Enables competent authorities to demand disclosure for cash sent in unaccompanied consignments such as cash sent in postal parcels or freight shipments; ·Extends the definition of 'cash' to also include commodities used as highly-liquid stores of value such as gold. For the Member States: ·Given the difficulties caused by non-harmonised intra-EU movements of cash rules, Member States could consider aligning those national thresholds. ·Considering the cross-border nature of ML and TF, Member States should seek international cooperation encourage relevant authorities in charge of preventing and combatting ML and TF to request support from agencies such as Europol. In particular, relevant authorities in Member States should consider reporting to Europol the cash seizures and related information (destination/origin/type of banknotes…).

2. Cash intensive business Product Cash intensive business Sector Cash intensive businesses include bars, restaurants, constructions companies, motor vehicle retailers, car washes, art and antique dealers, auction houses, pawnshops, jewelleries, textile retail, liquor and tobacco stores, retail/night shops, gambling services, strip clubs, massage parlours. An insightful description of the use of cash features in European Central Bank’s report “Trends and developments in the use of euro cash over the past ten years” (published as part of the ECB Economic Bulletin, Issue 6/2018). In terms of transactions, 83% of the transactions in restaurants, bars and cafés and for hotels and accommodation were made using cash while this share was 48% in shops selling durable goods. In order to increase vigilance and mitigate the risks posed by cash payments, the AML Directive subjects persons trading in goods to AML/CFT requirements when they make or receive cash payments of 10 000 EUR or more, including through linked payments. This measure does not amount to a blanket restriction on the use of cash, and its effectiveness heavily hinges on faithful adherence and implementation by private sector as well as effective oversight on part of national public authorities. Therefore, the Directive recognises that Member States may take different approaches, and allows them to lower the above threshold, introduce additional general limitations to the use of cash, or adopt other stricter measures. Measures adopted at national level vary from one Member State to another: ·Currently, 19 Member States have introduced or are introducing limitations to cash payments , ranging from EUR 500 in Greece to EUR 10 300 in the Czech Republic, with an average value of about EUR 4 500 ; ·The situation is constantly evolving, with Malta having recently introduced a limit of EUR 10 000 to payments in cash for some sectors, and other Member States having decided or planning to lower these limits (e.g. Denmark is planning to lower the limit to DKK 20 000 / EUR 2 700 and Italy will see its limit lowered to EUR 1 000 as of 2022); ·In three cases (France, Italy and Spain), higher thresholds apply to non-residents (between EUR 10 000 and EUR 15 000); ·In Hungary and Poland limits apply only to business-to-business (B2B) transactions, while some countries such as Slovenia have set different thresholds for business-to-consumers (B2C) and B2B transactions; ·Among the countries that have not set any limit to cash payments, Ireland and Sweden allow traders to refuse payments in cash.

The graph below summarises the situation across EU Member States. Green: no cash limits set – HU, PL: limits only apply to business-to-business transactions The map below provides a graphical representation of the intensity of the cash limits set (from the darkest to the lightest blue), where they exist, and where countries without cash limits are located. The map shows that generally neighbouring EU countries have applied different thresholds or often taken different approaches (limit/no limit), which impacts on the effectiveness of the national measures. In its Report to the European Parliament and the Council on restrictions on payments in cash of 12 June 2018, the Commission noted that introducing cash limits at EU level could have potential benefits on fighting money laundering. The report also concluded that diverging national provisions on payments in cash distort competition in the internal market, leading to potential relocations of businesses across borders, in particular for some specific sectors relying significantly on cash transactions, such as jewellery or car dealers. The report finally noted that diverging national restrictions potentially create loopholes allowing the bypassing of national cash payment limits, therefore decreasing their efficiency. The Action plan for a comprehensive Union policy on preventing money laundering and terrorist financing, adopted by the Commission in May 2020, noted the different approaches taken by Member States to mitigate the ML/TF risks associated with cash. The Action Plan pointed out that the introduction of ceilings for large cash payments is one of the measures that could deliver a reinforced AML/CFT rulebook. In reaction to the Action Plan, the Council conclusions of 17 June 2020 on enhancing financial investigations to fight serious and organised crime noted that the analytical work done by the Commission and Europol shows that criminals use cash payments to launder money and to finance terrorism. The conclusions called on the Commission to re-engage in a discussion with Member States on the need for a legislative limitation on cash payments at EU level. Against this background, the Commission has proposed in its AML package published on 20 July 2021 a ceiling on cash payment. According to Commission’s proposal, traders in good or services will be prevented from accepting cash payments of over EUR 10 000 for a single purchase, while allowing Member States to maintain in force lower ceilings for large cash transactions. This ceiling does not apply to private operations between individuals. The Commission will assess the benefits and impacts of further lowering of this threshold within three years of application of the proposed Regulation. Description of the risk scenario Cash-intensive businesses are used by perpetrators: ·to launder large amounts of cash, which are proceeds of criminal activity, by claiming that the funds originate from economic activities; ·to launder amounts of cash, which are proceeds of criminal activity, by justifying its origin based on fictitious economic activities (both for goods and services);

·to finance, through often small amounts of cash, terrorist activities without any traceability. This risk scenario is intrinsically linked to the use of/payment in cash and to the high value denomination banknotes risk scenario. It must be noted that diverging national restrictions weaken the effectiveness of national cash threshold, by displacing illegal activities from a Member State with cash payment restrictions to a neighbour with more lenient restrictions or no restrictions at all. This was confirmed by anti-mafia prosecutors at the Commission’s High-Level Conference on AML/CFT of 30 September 2020, who noted that the absence of cash ceilings in many EU Member States facilitates laundering of proceeds for organised crime across the EU. Threat Terrorist financing Cash intensive businesses are generally run by individuals through bars, restaurants, phone shops, etc. but are managed by a network of persons forming a terrorist organisation. In general, they are used to get clean cash in a speedy way (e.g. selling cars or jewelleries). However, this risk scenario is not used equally by all terrorist organisations (never seen for Daesh for instance) and not largely widespread as it requires capabilities to run the business. . Conclusions: The elements gathered by the LEAs and FIUs show only few cases have been registered meaning that terrorist groups do not favour this risk scenario as it requires some technical expertise and investments to run the business in itself which makes this modus operandi less attractive. However, since this risk is not only hypothetical and that sleeper cells are active in cash-intensive businesses, the level of TF threat related to cash intensive business is considered as moderately significant (level 2). Money laundering Cash intensive business is exploited by criminals as it represents a viable option which is rather attractive and secure. It constitutes the easiest way to hide illegitimate proceeds of crime. However, as for TF, it requires a moderate level of expertise to be able to run the business and to escape detection. Law enforcement authorities confirm that cash intensive businesses continue to be used to launder criminal proceeds. Conclusions: cash intensive businesses are favoured by criminal organisations to launder proceeds of crime. As it requires some level of expertise to run the business, the level of ML threat related to cash-intensive business is considered as significant (level 3).

Vulnerability Terrorist financing a) Risk exposure While cash intensive business is less attractive to terrorist organisations than to criminals (see threat assessment below), when they are used by terrorists they present some vulnerabilities because the underlying risk is the one related to cash. The vulnerability assessment of TF related to cash intensive business is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rationale. Cash intensive businesses allow the processing of a huge number of anonymous transactions which require no management of new technologies and tracking tools. Hence it has a high inherent risk exposure. b) Risk awareness The risk awareness appears to be quite low because, even if large sums of cash can be obtained from cash intensive business, some FIUs notice that terrorist organisations seem to prefer lower denomination banknotes which are less easy to be considered as suspicious by obliged entities and LEAs. c) Legal framework and checks The legal frameworks in place related to cash payment limitations that some Member States have introduced. This framework varies a lot from one Member State to another concerning cash controls and cash payment limitations and, thus, controls can potentially be inexistent. Conclusions: The vulnerability of cash intensive business is intrinsically linked to the vulnerabilities related to the use of cash in general. The variety of legal frameworks in place, the widespread use of cash in EU economies and the fact that the sector seems being not aware of this risk, the level of TF vulnerability related to cash intensive business is considered as very significant (level 4). Money laundering The assessment of the ML vulnerability related to cash intensive business shows that the main factors are linked to the risk posed by cash. a)Risk exposure The vulnerability assessment of ML related to cash intensive business is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rational. Cash intensive businesses allow the processing of a huge number of anonymous transactions which require no management of new technologies and tracking tools. This risk exposure concerns cash payments both for goods and services. Hence it has a high inherent risk exposure. b)Risk awareness The risk awareness appears to be quite low because, even if large sums of cash can be obtained from cash intensive business, some FIUs notice that terrorist organisations seem to prefer lower denomination banknotes which are less easy to be considered as suspicious by obliged entities and LEAs. c)Legal framework and checks Pending the adoption of Commission’s proposal on cash ceiling by the European Parliament and Council, currently no upper limits to cash payments are in place at the EU-wide level. The vulnerability of the sector is affected by the existence, or lack thereof, of rules relating to cash payment limitations: ·where cash limitation rules exist, ML vulnerabilities related to cash intensive business have been more easily mitigated due to the legal requirements which allow the refusal of cash payments above a certain threshold. In these cases, controls are in place and allow detecting red flags and suspicious transactions more easily. In addition, these cash payment thresholds are perceived by the sector and by LEAs as more efficient and, eventually, less burdensome than imposing customer due diligence measures. However, these legal businesses can also hide shadow and illicit activities which are able to circumvent cash limitations. ·where cash limitations rules do not exist, and whilst the risk awareness is quite high, the sector does not know how to manage the risks. It has no tools to control and detect suspicions transactions. The result is that the number of suspicious transactions reports (STRs) is rather low, or even inexistent.

Some Member States have introduced cash transaction reports to be declared for cash operations over a certain threshold. However, there is no common approach at EU level. From an internal market perspective, the differences between Member States legislations on cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing in cash intensive business in another Member States having lower/no control on cash limitation. The existence of cash payments limitations in some Member States, and their absence in other Member States, creates the possibility to bypass the restrictions by moving to the Member States where there are no restrictions, whilst still conducting their terrorist or other illegal activities in the 'stricter' Member State. To increase vigilance and mitigate the risks posed by such cash payments, persons trading in goods are covered by the AML Directive to the extent that they make or receive cash payments of EUR 10 000 or more. Member States are able to adopt lower thresholds, additional general limitations to the use of cash and further stricter provisions. However, the effectiveness of those measures is still limited given the number of STRs. The volume of STR reporting is generally low because cash transactions are difficult to detect, there is not much available information and dealers may lose their clients to the benefit of competitors applying looser controls. In addition, it may be difficult for a trader in high value goods to design an AML/CFT policy in the limited events where a cash transaction beyond the threshold takes place (i.e. it is not the sector in itself which is covered by AML/CFT regime – but only high value dealers faced with cash transactions beyond a threshold). For this reason, some Member States have extended the scope to cover certain sectors regardless of the use of cash. Some Member States have also decided to apply a general cash restriction regime at this threshold to reduce the risk of ineffective or cumbersome application of customer due diligence (CDD) rules by high value dealers. However, it does not mitigate situations of cash intensive business which are based on lower amount cash transactions – or a repeated number of low amount cash transactions. This is the reason why the Commission has proposed in its AML package proposed on 20 July 2021 the introduction of a cash ceiling of EUR 10 000. In addition, cash intensive businesses are inherently risky because there are no rules dealing with fit and proper testing of these businesses' managers. Some cash intensive businesses are more vulnerable than others because they may give rise to cash exchange more easily (motor retails or pawnshops). Conclusions: The risk exposure to ML of cash intensive businesses is influenced by the existence of legal cash limitations which are efficient to mitigate the risks but are not always sufficient. In a cross-border context, the variety of regulations on cash payments constitutes also a factor of vulnerabilities. When no rules are in place, the risk awareness of the sector is quite low, leading to few STRs to FIUs. As a result, subsequent information for investigations by LEAs are then quite limited. In light of this, the level of ML vulnerabilities related to cash intensive businesses is considered as very significant (level 4). Risk level As regards terrorist financing, the level of threat has been assessed as moderately significant (2), while the level of vulnerability has been assessed as very significant (4). RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM → 2,6 – 3,5 Significant HIGH 3,6 – 4 Very significant VERY HIGH As regards money laundering, the level of threat has been assessed as significant (3), while the level of vulnerability has been assessed as significant/very significant (level 4). RISK RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH Conclusions: estimated risk level for terrorist financing is HIGH and for money laundering VERY HIGH. Mitigating measures ·Money laundering and terrorist financing risks have not been sufficiently mitigated by the requirement for traders in goods to be subject to anti-money laundering rules when making or receiving cash payment of EUR 10 000. At the same time, differences in approaches among Member States have created loopholes within the internal market. The Commission deems it therefore necessary to propose a Union-wide limit to large cash payments of EUR 10 000. Member States should be able to adopt lower thresholds and further stricter provisions to mitigate the risk of money laundering and terrorist financing. ·The Commission will continue to monitor the application of limits to large cash payments across Member States. According to Commission’s proposal for a Regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing published on 20 July, the Commission intends to present by 3 years from the date of application of that Regulation a report assessing the need and proportionality of further lowering the limit for large cash payments. ·Member States should take into account in their national risk assessments the risks posed by payment in cash in order to define appropriate mitigating measures. Member States should consider making sectors particularly exposed to money laundering and terrorist financing risks subject to the AML/CFT preventative regime based on the results of their NRA. In that respect, Commission’s proposal for a Directive on the mechanisms for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing allows Member States to extend the application of money laundering requirements to sectors not covered in the scope of the Regulation. For this purpose, should the proposal be adopted, Member States will have to notify and explain their intention to the Commission that will adopt an Opinion on these plans.

·Considering the cross-border nature of ML and TF, Member States should seek international cooperation encourage relevant authorities in charge of preventing and combatting ML and TF to request support from agencies such as Europol.

3. High value banknotes Product High value banknotes Sector In spite of a steady growth in non-cash payment and a moderate decline in the use of cash for payments, the total value of euro banknotes in circulation continues to rise year-on-year beyond the rate of inflation. This trend is referred to as “the paradox of banknotes”: the demand for euro banknotes has constantly increased while the use of banknotes for retail transactions seems to have decreased. According to the ECB, this seemingly counterintuitive paradox can be explained by demand for banknotes as a store of value in the euro area (e.g. euro area citizens holding cash savings) coupled with demand for euro banknotes outside the euro area. Cash is largely used for low value payments and its use for transaction purposes is estimated to account for less than one-third of banknotes in circulation. Meanwhile the demand for high denomination notes, such as the EUR 500 note, not commonly associated with payments, has been sustained in spite of the EUR 500 note not being issued anymore since April 2019. These are anomalies which may be linked to criminal activity. There is insufficient information around the use of cash, both for legitimate and illicit purposes. The nature of cash and the nature of criminal finances mean that there is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. The ECB only provides broad estimates. While statistics exist on the volume and value of bank notes issued and in circulation in the EU, the question remains as to the use of a large proportion of cash in issuance especially when considering the EUR 500 note. The use of a significant proportion of banknotes remains unknown. Furthermore, the EUR 500 note accounts for 13,2% of the value of all banknotes in circulation, despite it not being a common means of payment. The EUR 200 and EUR 100 banknote account respectively for 10,2% and 23,5%. Although it has been suggested that these notes are used for hoarding, this assumption is not proven. Even if this is the case, the nature of the cash being hoarded (criminal or legitimate) is unknown. As evidenced in the Chart 1.1.2 above, the EUR 200 banknote whose circulation has significantly increased tends to replace the EUR 500 banknote since 2019. On 4 May 2016, the Governing Council of the European Central Bank (ECB) decided to discontinue the production and issuance of the EUR 500 banknote. It did so taking into account the concerns of Europol and many Member States that this is a banknote that facilitates illicit activities. Based on the ECB’s decision, since 27 April 2019, the banknote has no longer been issued by central banks in the euro area, but continues to be legal tender and can be used as a means of payment. Description of the risk scenario

Perpetrators use high value denominations, such as EUR 500 banknotes, to make the cash transportation easier (the larger the denomination, the more funds can be shrunk to take up less space). This risk scenario is intrinsically linked to use of/payment in cash and to cash intensive business risk scenario. Threat Terrorist financing The assessment of the TF threat related to high value denomination banknotes shows that terrorist groups are not keen on using high value denominations. They are not necessarily easy to access and, given that they can be detected quite easily they are not attractive for terrorist groups whose first objective is to get cash as quickly as possible. For the sake of discretion, terrorist groups tend to favour low denominations banknotes. Law enforcement authorities have detected few cases which tend to demonstrate that the intent and capability are not really significant. Conclusions: in that context, the level of TF threat related to high value denominations banknotes is considered as moderately significant (level 2) Money laundering The assessment of the ML threat related to high value denomination banknotes shows that they are recurrently exploited by criminal organisations to launder proceed of crime. The risk related to high value banknotes is not limited to EUR 500 and as long as long large sums in cash are gathered they are considered as attractive by criminal organisations. It does not require any major planning or complex operation – i.e. perpetrators have the technical skills to easily use this product. It remains a "low cost" operation and allows storing of large amounts in very small volumes – which makes it very attractive for organised crime. It has been reported by law enforcement authorities that some criminal groups seek EUR 500 banknotes by paying a premium in order to get access to those large denominations; this demonstrates its attractiveness. Operations themselves reveal huge sums of cash moved and stashed by criminals which are steadily invested and integrated in the legal economy in a multitude of ways which rid them of bulky cash holdings at risk of being confiscated. These methods require numerous criminal associates and complicit or negligent gatekeepers to ensure that their insertion in the legal economy does not arouse suspicion. In the EU, the use of cash is still the main reason triggering suspicious transaction reports within the financial system, accounting for 34% of all reports. Criminals who generate cash proceeds seek to aggregate and move these profits from their source, either to repatriate funds or to move them to locations where one has easier access to placement in the legal economy, perhaps due to the predominant use of cash in some jurisdictions’ economies, more lax supervision of the financial system or stronger banking secrecy regulations, or because they may have greater influence in the economic and political establishment. Cash smuggling may occur at other stages and is also used by non-cash generating offences. For example cybercrimes such as phishing and hacking make use of money mules to receive and withdraw sums fraudulently obtained from victims’ bank accounts in cash. These funds are thereafter sent via wire transfer to other jurisdictions where they are collected in cash by a select number of individuals, likely for onward transportation. The cash couriers are associated with the threat of the large denomination banknotes: 500 and 200 Euro. These banknotes are not used as a legal tender and in fact in Europe in many locations they are not accepted as payment. The high denomination banknotes are used by criminals to store value or for transportation (decreased volume of high overall amount). For example, the safety deposit box of a Belgian underground operator identified during the investigation of laundering hashish proceeds of Moroccan organised criminal groups revealed predominantly 500 and 200 banknotes in overall value of 1 600 000 Euro. Counterfeit euro banknotes continue to be trafficked in bulk on lorries, and by couriers. Post and parcel services are increasingly used to distribute counterfeit euro banknotes sold via online platforms. Currency counterfeiters continue to introduce counterfeit banknotes into circulation by purchasing low-value goods with high-value banknotes to receive legitimate currency in exchange. Conclusions: banknotes (EUR 500 but not only) are used recurrently by criminal organisations. This modus operandi is widely accessible and available at low cost. For ML purposes, it is quite easy to abuse and requires no specific planning or knowledge. In that context, the level of ML threat related to high value denomination banknotes is considered as very significant (level 4) Vulnerability Terrorist financing a) Risk exposure Large volume of high value denominations is in circulation, despite low use in commercial transactions. Cash still allows carrying transactions in an expedited, anonymous, and untraceable way.

b) Risk awareness Especially LEAs and FIUs have high risk awareness, as do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially Europol reports, point to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c) Legal framework and checks Even if terrorist groups are less attracted to high value denomination banknotes, detection is quite difficult because there is no EU harmonisation concerning the legal framework related to the use of high value denomination banknotes. Controls are uneven; reports to FIUs are rather few, and most of the time they cannot distinguish between ML and TF. The use of high value denomination banknotes for ML purposes may be impacted by the ECB decision to gradually phase out EUR 500 because of the recognised links with criminal activities. However, the return rate is generally quite low and these banknotes may be still in use for a long time. Therefore, this cannot be seen as an immediate mitigation measure. Conclusions: from a vulnerability point of view, risk exposure is high, level of awareness is low and controls in place are not harmonised which create potential loopholes when cross-border transactions are at stake. In light of this, the level of TF vulnerability related to high value denomination banknotes is considered as very significant (level 4). Money laundering a)Risk exposure High value denominations allow the storing/putting into circulation of large volumes of cash in a speedy and anonymous way. A large volume of high value denominations is in circulation, despite the low level of use in commercial transactions. Even if the use of high value denominations raises red flags, it remains that these denominations are not necessarily used for payments but rather to move funds. Large amounts can be stored in very small volumes. They are less easy to detect by FIUs and obliged entities. b)Risk awareness Especially LEAs and FIUs have high risk awareness, as do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially Europol reports, point to the blind spot in risk awareness (i.e. the precise use of high 27 value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c)Legal framework and checks The use of high value denomination banknotes for ML purposes may be impacted by the ECB decision to gradually phase out EUR 500 because of the recognised links with criminal activities. However, the return rate is generally quite low and these banknotes may be still in use for a long time. The EUR 500 will remain legal tender and can therefore continue to be used as a means of payment and store of value. Therefore, this cannot be seen as an immediate mitigation measure. Risk level As regards terrorist financing, the level of threat has been assessed as moderately significant (2), while the level of vulnerability has been assessed as very significant (4).

RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM → 2,6 – 3,5 Significant HIGH 3,6 – 4 Very significant VERY HIGH As regards money laundering, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as very significant (level 4). RISK RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH Conclusions: estimated risk level for terrorist financing is HIGH and for money laundering VERY HIGH. Mitigating measures Monitoring of the return rate of EUR 500 banknotes will continue as well as an assessment of the evolution of the usage of the EUR 200 banknote. ·Considering the cross-border nature of ML and TF, Member States should seek international cooperation and encourage relevant authorities in charge of preventing and combatting ML and TF to request support from agencies such as Europol.

4. Payments in cash Product Payments in cash Sector According to a December 2020 ECB’s study on the payment attitudes of consumers in the euro area (SPACE) , consumers still predominantly use cash for Point of Sale (POS) and Person-to-person (P2P) payments: ·73% of the volume of POS and P2P transactions was carried out using cash as a payment instruments; ·In value terms, cash transactions accounted for 48% of all transactions; ·Cash usage of 79% in terms of number of transactions. The significant difference between number of transactions and value is due to the more frequent use of cash for low-value transactions. As shown in the ECB SPACE study, for both POS and P2P, payments below EUR 15 represent most of the transactions. 92% of payments below EUR 5 are made in cash while only 33% of transactions above EUR 100 (which represent only 3% of all POS and P2P transactions) are paid in cash. Use of payment instrument at POS and P2P, by value range (x-axis: percentage, share in all transactions; y-axis: value, transactions)

Sources: ECB, De Nederlandsche Bank, Dutch Payments Association and Deutsche Bundesbank While the increase in banknote circulation has been abnormally high during the COVID-19 pandemic, the use of cash payment has been only slightly impacted. According to ECB SPACE survey, almost half of the respondents reported that they used cards and cash in a similar way. Nevertheless, 40% of respondents used contactless payment more often and the same percentage of respondents declared that they used cash much less often or somewhat less often as they did before the start of the Pandemic. Description of the risk scenario This risk scenario is intrinsically linked to cash intensive business and high value denomination banknotes risk scenario. Perpetrators frequently need to use a significant portion of the cash that they have acquired to pay for the illicit goods they have sold, to purchase further consignments, or to pay the various expenses incurred in transporting the merchandise to where it is required. Despite the advantages and disadvantages of dealing in cash (detailed earlier in this report) for criminal groups, there is often little choice. The criminal economy is still overwhelmingly cash based. This means that, whether they like it or not, perpetrators selling some form of illicit product are likely to be paid in cash. The more successful the perpetrators are and the more of the commodity they sell, the more cash they will generate. This can cause perpetrators significant problems in using, storing and disposing of their proceeds. Yet despite these problems, cash is perceived to confer some significant benefits on them. In addition, the objective of criminals is to launder large amounts of cash, which are proceeds of criminal activity, by claiming that the funds originate from economic activities. They may launder amounts of cash by justifying its origin based on fictitious economic activities (both for goods and services). Terrorists may finance, through often small amounts of cash, terrorist activities without any traceability (see general description under cash intensive business). In the European Supervisory Authorities’ Joint Opinion of 2019, the risk deriving from the use of cash was one of the key concerns for competent authorities. According to EBA, the risk continues to be relevant for a much smaller proportion of competent authorities. Some competent authorities noted in that regard an increase in the use of contactless methods of payment, which has since been exacerbated in the current context of COVID-19. Threat Terrorist financing Terrorist groups use recurrently cash, as this modus operandi is widely accessible and low cost. Cash is at the basis of all illicit trafficking and illicit purchase of products. In general, cash is really attractive, difficult (even impossible) to detect and does not require specific expertise to be used. Europol Financial Intelligence Public Private Partnership (EFIPPP) information/ indicators extracted from typologies: Infiltration in legal economy typology: ·The cash intensity of an economy, as well as possible limits on cash payments, are geographical indicators to determine the vulnerability to infiltration. ML through real estate typology: ·Purchases, rental payments, return of deposit made in cash or monetary instruments, sometimes in combination with unusual advanced payments. ·Bank accounts opened in the name of non-financial professionals in order to carry out various financial transactions (e.g. depositing cash, issuing and cashing cheques, sending and receiving international fund transfers).

·Criminals may use illicit cash to acquire cheap real estate in crisis-hit (COVID-19) sectors as a cover to move funds or aiming at the economic exploitation of the property or subsequent sale due to expected price increases. ·Payment for construction of renovation of real estate via unreported cash payments. Also rental payments or return of deposits in cash. Illegal trade typology: ·Regarding the illegal trade in tobacco, an indicator is that payments are made to unrelated third parties via: i) Cash. ii) Wire transfers. iii) Checks, bank drafts or postal money orders from unrelated third parties. Cash based payments are also used in illegal wildlife trade. . Conclusions: Based on the feedback from LEAs and FIUs, the level of TF threat is considered as very significant (level 4). Money laundering The assessment of the ML threat related to payments in cash is considered as similar to the assessment of TF threat. For ML, cash is also the preferred option for criminals, which allows hiding illicit proceeds of crime easily and moving funds rapidly, including cross-border. As for TF, it does not require specific expertise, knowledge or planning capacities. Illegal cash is supplied to intermediaries to buy goods in countries with no or few restrictions on cash payments. Products purchased either hold considerable value, such as luxury goods, or for which there is a specific but considerable demand: such as vehicles (whether second-hand or luxury, construction machineries). Cash integration by buying from legitimate trading companies goods that are exported at market price is increasing. Conclusions: based on the feedback from law enforcement authorities (LEAs) and financial intelligence units (FIUs), the level of ML threat is considered as very significant (level 4). Vulnerability Terrorist financing a) Risk exposure Cash payments allow speedy and anonymous transactions. The level of risk exposure is very high considering that large sums can also be moved across borders and may involve high risk customers and/or geographical areas. b) Risk awareness Especially LEAs and FIUs have high risk awareness, and so do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature points to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c) Legal framework and checks While cash payment limitations may allow a mitigation of the level of vulnerability, legal frameworks in place related to cash payment limitations vary a lot from one Member State to another and, therefore, controls can potentially be inexistent. From an internal market perspective, the differences between Member States legislations on cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing cash intensive business in another Member States having lower/no control on cash limitation.

The 4th AML Directive provides that high value dealers accepting payment in cash beyond EUR 10 000 are subject to AML/CFT rules and have to apply customer due diligence (CDD) requirements. This obligation applies to any persons trading in goods when the payment is made in cash beyond EUR 10 000 – but it does not cover services, apart from gambling services, and in that case when carrying out transactions amounting to EUR 2 000. These same thresholds are followed by Directive 2018/843 (the 5th AML Directive). However, the effectiveness of those measures is still limited considering the number of STRs. The volume of STR reporting is generally low because cash transactions are difficult to detect, there are few available information and dealers may lose their clients for the benefit of competitors applying looser controls. For those Member States who have put in place currency transactions reports (CTR), most of the time they are not connected to any STR and the analysis cannot be conducted (for instance, large sums withdrawn from an ATM will trigger CTR but no specific suspicion is related to that and the FIU cannot launch any investigation). In addition, it may be difficult for a trader in high value goods to design an AML/CFT policy in the limited events where a cash transaction beyond the threshold takes place (i.e. it is not the sector in itself which is covered by AML/CFT regime – but only high value dealers faced with cash transactions beyond a threshold). For this reason, some Member States have extended the scope to cover certain sectors regardless of the use of cash. Some Member States have also decided to apply a general cash restriction regime at this threshold to reduce the risk of ineffective or cumbersome application of CDD rules by high value dealers. However, it does not mitigate situations of cash intensive business which are based on lower amount cash transactions – or a repeated number of low amount cash transactions. Against this background, in its proposal for an AML package presented on 20 July 2021, the Commission has proposed to prevent traders in good or services from accepting cash payments of over EUR 10,000 for a single purchase, while allowing Member States to maintain in force lower ceilings for large cash transactions. This ceiling does not apply to private operations between individuals. As a consequence of the introduction of cash limits, traders in goods would be removed from the list of obliged entities. Going forward, the Commission will assess the benefits and impacts of further lowering this threshold within three years of application of the proposed Regulation. It must be noted that some competent authorities consider that even when cash payment limitations exist, enforcement of these limitations is very challenging and may limit their impact on TF activities. Conclusions: considering that cash payments may engage large transactions speedily and anonymously, including cross-border, that all sectors may potentially be exposed to cash payments and even if they are aware that these payments present some risks are not equipped to mitigate them (either because no framework/controls in place, or because enforcement of the controls is not efficient), the level of TF vulnerability related to payments in cash is considered as very significant (level 4). Money laundering a)Risk exposure The sector shows the same vulnerability to TF as to ML. As for TF, cash payments allow speedy and anonymous transactions to launder proceeds of ML crime. The level of risk exposure is very high considering that large sums can also be moved across borders and may involve high risk customers and/or geographical areas. b)Risk awareness Especially LEAs and FIUs have high risk awareness, and so do obliged entities subject to AML/CFT obligations. Risk awareness of sectors not covered by AML/CFT obligations or cash limitations obligations remains challenging. Existing literature, especially the Europol report, points to the blind spot in risk awareness (i.e. the precise use of high value denominations, difference of issuance between Member States, disconnection with GDP). There is little, if any, reliable data available on the scale and use of cash by ordinary citizens, let alone by criminals. c)Legal framework and checks While cash payment limitations may allow mitigating the level of vulnerability, legal frameworks in place related to cash payment limitations vary a lot from one Member State to another and, therefore, controls can potentially be inexistent. From an internal market perspective, the differences of Member States legislation in cash limitations increases the vulnerability for the internal market; perpetrators may more easily circumvent controls in their country of origin by investing cash intensive business in another Member States having lower/no control on cash limitation. The volume of reporting is very low because cash transactions are difficult to detect. For those Member States who have put in place CTR, most of the time they are not connected to any STR and the analysis cannot be conducted (for instance, large sums withdrawn from an ATM will trigger CTR but no specific suspicion is related to that and the FIU cannot trigger any investigation). In any case, some competent authorities consider that even when cash payment limitations exist, enforcement of these limitations is really challenging and may limit their impact on ML activities. Conclusions: considering that cash payments may engage large transactions speedily and anonymously, including across border, that all sectors may potentially be exposed to cash payments and even if they are aware that these payments present some risks are not equipped to mitigate them (either because no framework/controls in place, or because enforcement of the controls is not efficient), the level of ML vulnerability related to payments in cash is considered as very significant (level 4).

Risk level As regards terrorist financing, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as very significant (4). RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH As regards money laundering, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as significant/very significant (level 4). RISK RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH Conclusions: estimated risk level for both, terrorist financing and money laundering is VERY HIGH. Mitigating measures ·The Commission will continue to monitor the application of AML/CFT obligations by dealers in goods covered by the AMLD and further assess risks posed by providers of services accepting cash payments. It will further assess the added value and benefit for making additional sectors subject to AML/CFT rules. ·Member States should take into account in their NRA the risks posed by payment in cash in order to define appropriate mitigating measures suitable to address the risk. Member States should consider making sectors particularly exposed to money laundering and terrorist financing risks subject to the AML/CFT preventative regime based on the results of their NRA. ·The prohibition of payments in cash for some types of dangerous products – like those included in national databases on dangerous chemical products – should be considered. ·Considering the cross-border nature of ML and TF, Member States should seek international cooperation and encourage relevant authorities in charge of preventing and combatting ML and TF to request support from agencies such as Europol. In the Commission proposed AML Regulation , Member States will keep the possibility to extend the scope of application to other sectors not covered in the scope of that Regulation. For this purpose, Member States would have to notify and explain their intention to the Commission and suspend the effect of such extension for 6 months, during which time the Commission will adopt an Opinion on the plans. The Commission may then choose to propose legislation at Union level.

5. Privately owned ATMs Product Privately owned ATMs Sector Sector There exists a growing use of privately owned cash machines (ATMs) across the Union and its possible misuse for money laundering purposes has been brought to the attention of LEAs. According to information received the legal possibility for private parties to buy and rent ATMs from wholesale suppliers is creating a loophole that criminals are taking advantage of. For many merchants, owners of clubs, bars and restaurants installing one of these ATMs has proven to be a business-oriented decision – the client is offered the convenience to withdraw cash and the merchant is maximizing the probability that some of that cash will be spent in his business. Private ATMs tend to be located in cash-intensive businesses. In addition, privately owned ATMs can also be found in money service businesses (MSB). Taking into consideration the fact that the presence of an ATM in a MSB is illogical due to the nature of an MSB service and also the fact that many hawaladars’ side legal business is running an MSB or a currency exchange service, the risk of misuse can be clearly identified. In addition, privately owned ATM may be used to purchase virtual currencies. Description of the risk scenario a)ATM loading options In order to load the machine one option is to use the services of cash management/cash delivery company. Another option for the merchant operating a business is to load the cash from his teller. This provides additional opportunities for traders to commit tax evasion by selling goods in exchange of cash without issuing receipts. They then simply place their black cash inside their ATM machine and wait for it to be taken by normal clients. At the end of the year such sales are never declared to their tax authority. The third and most concerning option is simply to load the ATM with criminal cash. Intelligence gathered shows that in cases where criminal cash is used the modus operandi is the following: a courier delivers to the ATM owner/merchant criminal cash. It may derive from different cash generating activities like drug trafficking, illegal immigration, trafficking in human beings, labour and sexual exploitation, selling of counterfeit of smuggled goods, theft, robbery, etc. The criminal cash is then loaded into the machine. As unsuspecting customers or passers-by in need of cash are using their cards to withdraw cash the same amount is debited from their bank accounts and credited into the account of the owner of the ATM/merchant. Afterwards, he can simply transfer the money to any given account controlled by the criminal, minus the commission agreed upon.

b)De-linking bank accounts and internationalization risks An internationalized, potentially much more dangerous risk scenario appears when national regulations require that a private entity buying an ATM should upon its purchase provide a national bank account number which is linked to the ATM and its activities, but there is no requirement for the merchant to request cash for the ATM from the same bank account that he linked to his ATM or even from the same bank. This hampers the proper monitoring by banks. A review of the companies offering private ATM services shows that there are several major suppliers, British and American who have managed to make their business international. Important questions arise concerning the accounts to which these ATMs (sold by EU and US companies and present in EU countries) are linked. If they are linked to an EU national bank account, but physically present in another country, then it is virtually impossible to establish the origin of the cash being inserted in them. c)Tax evasion and fraud Private ATMs are also used for tax evasion and fraud especially as some cash-intensive business operators encourage their clients to extract cash for services that are not invoiced or recorded. The amount of money lost in tax revenues from tax evasion and fraud through private ATMs is more significant than the amount laundered. d)Micro-structuring by organized crime With respect to money laundering, private ATMs are often used to “microstructure” – depositing and withdrawing of small sums of money that are consistent with normal ATM withdrawal amounts, going undetected by bank controls. Organized crime members will make voluminous small daily cash deposits into 100 or more bank accounts using private ATMs to avoid triggering anti-money laundering reporting requirements. Threat Terrorist financing There exist currently few specific assessments of the TF threat related to privately owned ATMs. Nevertheless, the combined assessment on payments in cash as well as the analysis on cash couriers show that this modus operandi is widely accessible and low cost. The threat of cash transportation into the EU from a third country may also exist, in particular from countries exposed to TF risks or conflict areas. Cases have been identified concerning low amounts and involving integration of cash carried from third countries into the financial system/legal economy of the EU (analysed in a separate section of this report). Conclusions: based on the feedback from LEA and FIUs, the level of TF threat is considered as very significant (level 4). Money laundering The assessment of the ML threat related to privately owned ATMs shows that this modus operandi is exploited by criminals as it represents a viable option which is rather attractive and secure. It constitutes an easy way to evade taxes and hide illegitimate proceeds of crime. However, as for TF, it requires a moderate level of expertise to be able to run the business and to escape detection. This modus operandi is also used to purchase virtual currency, as reported by FIUs and confirmed by EUROPOL: As there exists not harmonised or control of crypto-ATM, it is easy to deposit cash in those crypto ATM to transform cash into crypto. Conclusions: based on the feedback from LEA and FIUs, the level of ML threat is considered as very significant (level 4). Vulnerability Terrorist financing a) risk exposure

The vulnerability assessment of TF related to privately owned ATMs is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rationale. Privately owned ATMs allow the processing of a huge number of anonymous transactions which require but an initial investment. Hence it has a high inherent risk exposure. b) risk awareness The risk awareness appears to be quite low. c) legal framework and checks According to the EU legal framework, the service of cash withdrawal can be offered by unregulated entities (i.e. not subject to AML/CFT requirement). The legal frameworks in place vary from one Member State to another and, thus, controls can potentially be inexistent. Conclusions: the vulnerability of privately owned ATMs is intrinsically linked to the vulnerabilities related to the use of cash in general. The widespread use of cash in EU economies and the fact that the sector seems being not aware of this risk, the level of TF vulnerability is considered as very significant (level 4). Money laundering a)risk exposure The vulnerability assessment of money laundering related to privately owned ATMs is intrinsically linked to the assessment related to the use of/payments in cash in general and can follow the same rationale. Privately owned ATMs allow the processing of a huge number of anonymous transactions which require but an initial investment. Hence it has a high inherent risk exposure. b)risk awareness The risk awareness appears to be quite low. c) legal framework and checks According to the EU legal framework, the service of cash withdrawal may be offered by unregulated entities (i.e. not subject to AML/CFT requirement). The legal frameworks in place vary from one Member State to another and, thus, controls can potentially be inexistent. Conclusions: the vulnerability of privately owned ATMs is intrinsically linked to the vulnerabilities related to the use of cash in general. The widespread use of cash in EU economies and the fact that the sector seems being not aware of this risk, the level of money laundering vulnerability is considered as very significant (level 4). Risk level As regards terrorist financing, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as very significant (4). RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH

As regards money laundering, the level of threat has been assessed as very significant (4), while the level of vulnerability has been assessed as significant/very significant (level 4). RISK RISK 1 – 1,5 Lowly significant LOW 1,6 – 2,5 Moderately significant MEDIUM 2,6 – 3,5 Significant HIGH → 3,6 – 4 Very significant VERY HIGH Conclusions: estimated risk level for both, terrorist financing and money laundering is VERY HIGH. Mitigating measures Private ATM companies pose an increased risk to banks and should be treated as high-risk in money laundering compliance risk assessments. The risks for banks are not just financial but reputational. ·Firstly, customers who have privately owned or operated ATMs should be duly identified. ·Once the bank has identified an ATM owner or operator, it should obtain additional information to gain an understanding about the ATM owner/operators well as an understanding of the ATM owner’s procedures. ·After sufficient information is obtained, the sponsoring bank should implement a process to monitor the accounts of the ATM owners. The information obtained during the due diligence process should enable the bank to determine the amount of monitoring necessary as well as how often. ·Member States should guarantee the obligation to register, limit ownership, monitor, or examine privately owned ATMs – up to and including the obligation to link ATMs to a bank account of the Member Sate they are physically located in. · An enhanced collaboration with customs agency will help acquire further information on the importation of AML machines. ·Considering the cross-border nature of ML and TF, Member States should seek international cooperation and encourage relevant authorities in charge of preventing and combatting ML and TF to request support from agencies such as Europol. FINANCIAL SECTOR 1. Retail banking sector Product Retail deposits on accounts (excluding private banking) Sector Credit and financial institutions General description of the sector and related product/activity concerned

European Union total deposits was reported at EUR 14,8 billion in October 2021. The data reached an all-time high of EUR 15,3 billion in May 2021 and a record low of EUR 3,7 USD billion in October 2000. This is the sum of all deposits by non-financial corporates, households, insurance corporates, pension funds and other financial intermediaries, which covers all Monetary Financial Institutions (MFIs). In Euro area, the European Central Bank reported the total of EUR 8,665.6 billion of deposits vis-à-vis other Euro area residents in Q3 of 2021. This figure similarly includes both retail and corporate deposits. In terms of trends, the global pandemic has driven an increase in savings by households, which is reflected in the increase of the total deposits from around EUR 12,4 trillion in January 2020 in the wake of the pandemics to current EUR 14,8 trillion in Q3 2021. The level of deposits has only started to decrease in May 2021, reflecting a tentative return to normalised consumer spending behaviour. Description of the risk scenario Money launderers place the proceeds of crime into the financial system through the regulated credit and financial sector in order to hide its illegitimate origin. Terrorists, supporters or facilitators place funds from legitimate or criminal sources into the financial system with a view to using it for terrorist purposes. Money mule mechanisms may be used to transfer proceeds out of the banking sector using personal accounts, either through cybercrime (scamming, fake banking websites etc.) or through money value transfer services. ‘Bridge accounts’ are also used to launder money. These are accounts of legal or natural persons in the EU with the sole purpose of transferring funds to non-EU countries. Natural persons may open bank accounts based on fake identification documents. Usage of such bank accounts to collect and transfer money from illegal sources (i.e. to introduce resources to the banking system and to further transfer these). Threat Terrorist financing The assessment of the terrorist financing threat related to deposits on account shows that this risk scenario concerns both the placing and withdrawing of funds (i.e. deposits on account and use of this account withdrawing those funds or transferring to another bank accounts). Account deposits are frequently used not only by terrorists, but also by their relatives/friends; this extends the scope of the intent and capability analysis. Furthermore, law enforcement authorities have reported the use of forged or stolen documents by terrorists to open bank accounts. According to information from competent authorities, terrorist fighters generally withdraw bank account deposits through ATMs located in high-risk non-EU countries or conflict zones in general, or in bordering countries. Terrorists outside conflict zones also withdraw funds through ATMs in order to pay in cash some of the expenses related to their operations. The use of deposit accounts for TF purposes may, in conflict zones, be complicated by difficulties to access funds, especially where access to ATMs or a functioning banking network is disrupted. The source of the funds deposited on bank accounts may come from both legitimate and non-legitimate origins. In general, deposits accounts are easily accessible, especially when legitimate funds are used, and thus they do not trigger any suspicion when the bank account is opened. It appears that terrorist groups do not experience specific challenges in hiding the real beneficiary of the funds or the exact purpose of the transaction (destination of funds) given that they may still include family members or relatives in the ownership chain. This requires at least basic planning and basic knowledge of how banking systems work. At the same time, once executed, cash withdrawals allow cross-border movements, which makes this risk scenario rather attractive. Conclusions: terrorists groups rather frequently use deposits on account and related money value transfer services to easily enter cash in bank accounts and withdraw money for terrorist activities, although it requires some basic knowledge and planning capabilities to ensure that funds deposited appear legitimate. As a result, this method is rather attractive for terrorist groups. That being the case, the level of terrorist financing threat related to deposits on accounts is considered as significant/very significant (level 3/4). Money laundering The assessment of the money laundering threat related to deposits on account shows that this risk scenario concerns both the placing and withdrawal of funds (i.e. deposits in an account and subsequent use of this account, withdrawing money from that deposit account or transferring money to disguise the origin of funds). Deposits on account are frequently used by organised crime organisations, but also by relatives/close associates, which extends the scope of the intent and capability analysis. Law enforcement authorities report frequent use of this method as one of the easiest ways to integrate illicit funds into the financial system. Although in the case of small amounts of money, deep planning and knowledge of how banking systems work may not be necessary, in the case of a complex money laundering case involving funds deposited on accounts transiting via a chain of complex operations, more in-depth knowledge is necessary and perpetrators may use available expertise from intermediaries. Conclusions: In the light of the above threats, specially the use by criminal organizations, the level of the money laundering threat related to deposits on account is considered as very significant (level 4). Vulnerability

Terrorist financing The assessment of terrorist financing vulnerability related to deposits on accounts looked at the placement and withdrawing of funds a) risk exposure Banks continue to be exposed to terrorist financing risks: deposits on accounts represent the most straightforward and least sophisticated way to introduce money into the financial system. In the case of the risk from terrorist financing, the risk exposure is even higher when the origin of funds is legitimate. The use of funds in deposit accounts for terrorist purposes is difficult to detect as low amounts of money are usually used by terrorist groups. When it comes to sending money to conflict zones, the terrorist financing risk is lower in deposits on accounts as perpetrators prefer the use of other products such as money value transfer services or E-money products. b) risk awareness The risk awareness of credit and financial institutions is generally good, and the banking sector has put in place guidance to detect the relevant red flags on terrorist financing. However, systems and checks that firms put in place to mitigate the terrorist financing risk are similar to, and often the same as, the checks put in place for anti-money laundering purposes. Supervisors and law enforcement agencies are aware of vulnerabilities to terrorist financing and are proactively engaged with the sector. c) legal framework and checks Deposits on accounts have been included in the scope of the framework on anti-money laundering (AML) and countering the financing of terrorism (CFT) since the first AML/CFT legislation at EU level in 1991. Checks in place are generally considered as efficient, although some banks limit them to sanctions screening, which is an element of, but not a substitute for, effective CFT checks. Financial sanctions target individuals or groups that are already known to pose a threat, whereas the risk from terrorist financing often emanates from individuals who are not caught by the sanctions regime. This is why risk‐based AML/CFT checks, and transaction monitoring in particular, are key to an effective fight against terrorist financing. Usually, banks do not have access to relevant information that would help them identify terrorist financing risks before they materialise, as such information is often held by law enforcement agencies. Likewise, law enforcement agencies’ efforts to disrupt terrorist activities and networks can be hampered in cases where they are unable to obtain information about finance flows that only firms can provide. There are now initiatives at national and supranational levels to test how law enforcement agencies can provide firms with more specific and meaningful information on specific persons of interest, allowing firms to focus their transaction monitoring on these persons. Conclusions: risk exposure may be consider