Article 75 Exchange of information in the framework of partnerships for information sharing
1. Members of partnerships for information sharing may share information among each other where strictly necessary for the purposes of complying with the obligations under Chapter III and Article 69 and in accordance with fundamental rights and judicial procedural safeguards. 2. Obliged entities intending to participate in a partnership for information sharing shall notify their respective supervisory authorities which shall, where relevant in consultation with each other and with the authorities in charge of verifying compliance with Regulation (EU) 2016/679, verify that the partnership for information sharing has mechanisms in place to ensure compliance with this Article and that the data protection impact assessment referred to in paragraph 4, point (h), has been carried out. The verification shall take place prior to the beginning of the activities of the partnership for information sharing. Where relevant, the supervisory authorities shall also consult the FIUs. Responsibility for compliance with requirements under Union or national law shall remain with the participants in the partnership for information sharing. 3. Information exchanged in the framework of a partnership for information sharing shall be limited to: (a) information on the customer, including any information obtained in the course of identifying and verifying the identity of the customer and, where relevant, the beneficial owner of the customer; (b) information on the purpose and intended nature of the business relationship or occasional transaction between the customer and the obliged entity, as well as, where applicable, the source of wealth and source of funds of the customer; (c) information on customer transactions; (d) information on higher and lower risk factors associated with the customer; (e) the obliged entity’s analysis of the risks associated with the customer pursuant to Article 20(2); (f) information held by the obliged entity pursuant to Article 77(1); (g) information on suspicions pursuant to Article 69. The information referred to in the first subparagraph shall only be exchanged to the extent that it is necessary for the purposes of carrying out the activities of the partnership for information sharing. 4. The following conditions shall apply to the sharing of information within the context of a partnership for information sharing: (a) obliged entities shall record all instances of information sharing within the partnership; (b) obliged entities shall not rely solely on the information received in the context of the partnership to comply with the requirements of this Regulation; (c) obliged entities shall not draw conclusions or take decisions that have an impact on the business relationship with the customer or on the performance of occasional transactions for the customer on the basis of information received from other participants in the partnership for information sharing without having assessed that information; any information received in the context of the partnership that is used in an assessment resulting in a decision to refuse or terminate a business relationship or to carry out an occasional transaction shall be included in the records kept pursuant to Article 21(3), and that record shall contain reference to the fact that the information originated from a partnership for information sharing; (d) obliged entities shall carry out their own assessment of transactions involving customers in order to assess which ones may be related to money laundering or terrorist financing or involve proceeds of criminal activity; (e) obliged entities shall implement appropriate technical and organisational measures, including measures to allows pseudonymisation, to ensure a level of security and confidentiality proportionate to the nature and extent of the information exchanged; (f) the sharing of information shall be carried out only in relation to customers: (i) whose behaviour or transaction activities are associated with a higher risk of money laundering, its predicate offences or terrorist financing, as identified pursuant to the risk assessment at Union level and the national risk assessment carried out in accordance with Articles 7 and 8 of Directive (EU) 2024/1640; (ii) who fall under any of the situations referred to in Articles 29, 30, 31 and 36 to 46 of this Regulation; or (iii) for whom the obliged entities need to collect additional information in order to determine whether they are associated with a higher level of risk of money laundering, its predicate offences or terrorist financing; (g) information generated through the use of artificial intelligence, machine learning technologies or algorithms may only be shared where those processes were subject to adequate human oversight; (h) a data protection impact assessment referred to in Article 35 of Regulation (EU) 2016/679 shall be carried out prior to the processing of any personal data; (i) the competent authorities that are members of a partnership for information sharing shall only obtain, provide and exchange information to the extent that this is necessary for the performance of their tasks under relevant Union or national law; (j) where competent authorities referred to in Article 2(1), point (44)(c), of this Regulation participate in a partnership for information sharing, they shall only obtain, provide or exchange personal data and operational information in accordance with national law transposing Directive (EU) 2016/680 of the European Parliament and of the Council ( 44 ) and with the applicable provisions of national criminal procedural law, including prior judicial authorisation or any other national procedural safeguard as required; (k) the exchange of information on suspicious transactions pursuant to paragraph 3, point (g), of this Article shall only take place where the FIU to which the suspicious transaction report was submitted pursuant to Articles 69 or 70 has agreed with such disclosure. 5. Information received in the context of a partnership for information sharing shall not be further transmitted, except where: (a) the information is provided to another obliged entity pursuant to Article 49(1); (b) the information is to be included in a report submitted to the FIU or provided in response to a FIU request pursuant to Article 69(1); (c) the information is provided to AMLA pursuant to Article 93 of Regulation (EU) 2024/1620; (d) the information is requested by law enforcement or judicial authorities, subject to any prior authorisations or other procedural guarantees as required under the national law. 6. Obliged entities that participate in partnerships for information sharing shall define policies and procedures for the sharing of information in their internal policies and procedures established pursuant to Article 9. Such policies and procedures shall: (a) specify the assessment to be carried out to determine the extent of information to be shared, and where relevant for the nature of the information or the applicable judicial safeguards, provide for differentiated or limited access to information for members of the partnership; (b) describe the roles and responsibilities of the parties to the partnership for information-sharing; (c) identify the risk assessments that the obliged entity will take into account to determine situations of higher risk in which information can be shared. The internal policies and procedures referred to in the first subparagraph shall be drawn up prior to the participation in a partnership for information sharing. 7. Where supervisory authorities deem it necessary, obliged entities participating in a partnership for information sharing shall commission an independent audit of the functioning of that partnership and shall share the results with the supervisory authorities.
Article 76 Processing of personal data
1. To the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, obliged entities may process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679 and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation subject to the safeguards provided for in paragraphs 2 and 3 of this Article. 2. Obliged entities shall be able to process personal data covered by Article 9 of Regulation (EU) 2016/679 provided that: (a) they inform their customers or prospective customers that such categories of data may be processed for the purpose of complying with the requirements of this Regulation; (b) the data originate from reliable sources, are accurate and up-to-date; (c) they do not take decisions that would lead to biased and discriminatory outcomes on the basis of those data; (d) they adopt measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality. 3. Obliged entities shall be able to process personal data covered by Article 10 of Regulation (EU) 2016/679 provided that they comply with the conditions laid down in paragraph 2 of this Article and that: (a) such personal data relate to money laundering, its predicate offences or terrorist financing; (b) the obliged entities have procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence. 4. Personal data shall be processed by obliged entities on the basis of this Regulation only for the purposes of the prevention of money laundering and terrorist financing and shall not be further processed in a way that is incompatible with those purposes. The processing of personal data on the basis of this Regulation for commercial purposes shall be prohibited. 5. Obliged entities may adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of Regulation (EU) 2024/xxx of the European Parliament and of the Council ( 45 ) , provided that: (a) the data processed by such systems is limited to data obtained pursuant to Chapter III of this Regulation; (b) any decision to enter or refuse to enter into or maintain a business relationship with a customer or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20 of this Regulation, is subject to meaningful human intervention to ensure the accuracy and appropriateness of such a decision; and (c) the customer may obtain an explanation of the decision reached by the obliged entity, and may challenge that decision, except in relation to a report as referred to in Article 69 of this Regulation.
Article 77 Record retention
1. Obliged entities shall retain the following documents and information: (a) a copy of the documents and information obtained in the performance of customer due diligence pursuant to Chapter III, including information obtained through electronic identification means; (b) a record of the assessment undertaken pursuant to Article 69(2), including the information and circumstances considered and the results of such assessment, whether or not such assessment results in a suspicious transaction report being made to the FIU, and a copy of the suspicion transaction report, if any; (c) the supporting evidence and records of transactions, consisting of the original documents or copies admissible in judicial proceedings under the applicable national law, which are necessary to identify transactions; (d) when they participate in partnerships for information sharing pursuant to Chapter VI, copies of the documents and information obtained in the framework of those partnerships, and records of all instances of information sharing. Obliged entities shall ensure that documents, information and records kept pursuant to this Article are not redacted. 2. By way of derogation from paragraph 1, obliged entities may decide to replace the retention of copies of the information by a retention of the references to such information, provided that the nature and method of retention of such information ensure that the obliged entities can provide immediately to competent authorities the information and that the information cannot be modified or altered. Obliged entities making use of the derogation referred to in the first subparagraph shall define in their internal procedures drawn up pursuant to Article 9, the categories of information for which they will retain a reference instead of a copy or original, as well as the procedures for retrieving the information so that it can be provided to competent authorities upon request. 3. The information referred to in paragraphs 1 and 2 shall be retained for a period of 5 years commencing on the date of the termination of the business relationship or on the date of the carrying out of the occasional transaction, or on the date of refusal to enter into a business relationship or carry out an occasional transaction. Without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679, obliged entities shall delete personal data upon expiry of the five-year period. Competent authorities may require further retention of the information referred to in the first subparagraph on a case-by-case basis, provided that such retention is necessary for the prevention, detection, investigation or prosecution of money laundering or terrorist financing. That further retention period shall not exceed 5 years. 4. Where, on 10 July 2027, legal proceedings concerned with the prevention, detection, investigation or prosecution of suspected money laundering or terrorist financing are pending in a Member State, and an obliged entity holds information or documents relating to those pending proceedings, the obliged entity may retain that information or those documents for a period of 5 years from 10 July 2027. Member States may, without prejudice to national criminal law on evidence applicable to ongoing criminal investigations and legal proceedings, allow or require the retention of such information or documents for a further period of 5 years where the necessity and proportionality of such further retention have been established for the prevention, detection, investigation or prosecution of suspected money laundering or terrorist financing.
Article 78 Provision of records to competent authorities
Obliged entities shall have systems in place that enable them to respond fully and speedily to enquiries from their FIU or from other competent authorities, in accordance with national law, as to whether they are maintaining or have maintained, during a five-year period prior to that enquiry a business relationship with specified persons, and on the nature of that relationship, through secure channels and in a manner that ensures full confidentiality of the enquiries.
Article 79 Anonymous accounts and bearer shares and bearer share warrants
1. Credit institutions, financial institutions and crypto-asset service providers shall be prohibited from keeping anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes or anonymous crypto-asset accounts as well as any account otherwise allowing for the anonymisation of the customer account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins. Owners and beneficiaries of existing anonymous bank or payment accounts, anonymous passbooks, anonymous safe-deposit boxes held by credit institutions or financial institutions, or crypto-asset accounts shall be subject to customer due diligence measures before those accounts, passbooks, or deposit boxes are used in any way. 2. Credit institutions and financial institutions acting as acquirers within the meaning of Article 2, point (1), of Regulation (EU) 2015/751 of the European Parliament and of the Council ( 46 ) shall not accept payments carried out with anonymous prepaid cards issued in third countries, unless otherwise provided for in the regulatory technical standards adopted by the Commission in accordance with Article 28 of this Regulation on the basis of a proven low risk. 3. Companies shall be prohibited from issuing bearer shares, and shall convert all existing bearer shares into registered shares, shall immobilise them within the meaning of Article 2(1), point (3), of Regulation (EU) No 909/2014, or deposit them with a financial institution by 10 July 2029. However, companies with securities listed on a regulated market or whose shares are issued as intermediated securities either through immobilisation within the meaning of Article 2(1), point (3), of that Regulation or through a direct issuance in dematerialised form within the meaning of Article 2(1), point (4), of that Regulation shall be permitted to issue new and maintain existing bearer shares. For existing bearer shares that are not converted, immobilised or deposited by 10 July 2029, all voting rights and rights to distribution attached to those shares shall be automatically suspended until their conversion, immobilisation or deposit. All such shares not converted, immobilised or deposited by 10 July 2030 shall be cancelled, leading to a share capital decrease of the corresponding amount. Companies shall be prohibited from issuing bearer share warrants that are not in intermediated form.
Article 80 Limits to large cash payments in exchange for goods or services
1. Persons trading in goods or providing services may accept or make a payment in cash only up to an amount of EUR 10 000 or the equivalent in national or foreign currency, whether the transaction is carried out in a single operation or in several operations which appear to be linked. 2. Member States may adopt lower limits following consultation of the European Central Bank in accordance with Article 2(1) of Council Decision 98/415/EC ( 47 ) . Those lower limits shall be notified to the Commission within 3 months of the measure being introduced at national level. 3. When limits already exist at national level which are below the limit set out in paragraph 1, they shall continue to apply. Member States shall notify those limits to the Commission by 10 October 2024. 4. The limit referred to in paragraph 1 shall not apply to: (a) payments between natural persons who are not acting in a professional capacity; (b) payments or deposits made at the premises of credit institutions, electronic money issuers as defined in Article 2, point (3), of Directive 2009/110/EC and payment service providers as defined in Article 4, point (11), of Directive (EU) 2015/2366. Payments or deposits referred to in the first subparagraph, point (b) above the limit shall be reported to the FIU within the deadlines imposed by the FIU. 5. Member States shall ensure that appropriate measures, including the imposition of penalties, are taken against natural or legal persons acting in their professional capacity which are suspected of a breach of the limit set out in paragraph 1, or of a lower limit adopted by the Member States. 6. The overall level of the penalties shall be calculated, in accordance with the relevant provisions of national law, in such way as to produce results proportionate to the seriousness of the infringement, thereby effectively discouraging further offences of the same kind. 7. Where, by reason of force majeure, means of payment by funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 other than banknotes and coins become unavailable at national level, Member States may temporarily suspend the application of paragraph 1 or, where applicable, of paragraph 2 of this Article and shall inform the Commission thereof without delay. Member States shall also inform the Commission of the expected duration of the unavailability of means of payment by funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 other than banknotes and coins and of the measures taken by Member States to reinstate their availability. Where, on the basis of the information communicated by the Member State, the Commission considers that the suspension of the application of paragraph 1 or, where applicable, of paragraph 2 is not justified by a case of force majeure, it shall adopt a decision addressed to that Member State requesting the immediate lifting of such suspension.
Article 81 Cooperation between FIUs and the EPPO
1. Pursuant to Article 24 of Regulation (EU) 2017/1939, each FIU shall without undue delay report to the EPPO the results of its analyses and any additional relevant information where there are reasonable grounds to suspect that money laundering and other criminal activity are being or have been committed in respect of which the EPPO could exercise its competence in accordance with Article 22 and Article 25(2) and (3) of that Regulation. By 10 July 2026, AMLA shall, in consultation with the EPPO, develop draft implementing technical standards and submit them to the Commission for adoption. Those draft implementing technical standards shall specify the format to be used by FIUs for reporting information to the EPPO. Power is conferred on the Commission to adopt the implementing technical standards referred to in the second subparagraph of this paragraph in accordance with Article 53 of Regulation (EU) 2024/1620. 2. FIUs shall respond in a timely manner to requests for information by the EPPO in relation to money laundering and other criminal activity as referred to in paragraph 1. 3. FIUs and the EPPO may exchange the results of strategic analyses, including typologies and risk indicators, where such analyses relate to money laundering and other criminal activity as referred to in paragraph 1.
Article 82 Requests for information to the EPPO
1. The EPPO shall respond without undue delay to reasoned requests for information by an FIU where that information is necessary for the performance of the FIU’s functions under Chapter III of Directive (EU) 2024/1640. 2. The EPPO may postpone or refuse the provision of the information referred to in paragraph 1 where providing it would be likely to prejudice the proper conduct and confidentiality of an ongoing investigation. The EPPO shall communicate in a timely manner the postponement of or refusal to provide the requested information, including the reasons therefor, to the requesting FIU.
Article 83 Cooperation between FIUs and OLAF
1. Pursuant to Article 8(3) of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council ( 48 ) , each FIU shall transmit without delay the results of its analyses and any additional relevant information to OLAF where there are reasonable grounds to suspect that fraud, corruption or any other illegal activity affecting the Union’s financial interests are being or have been committed in respect of which OLAF could exercise its competence in accordance with Article 8 of that Regulation. 2. FIUs shall respond in a timely manner to requests for information by OLAF in relation to fraud, corruption or any other illegal activity as referred to in paragraph 1. 3. FIUs and OLAF may exchange the results of strategic analyses, including typologies and risk indicators, where such analyses relate to fraud, corruption or any other illegal activity as referred to in paragraph 1.
Article 84 Requests for information to OLAF
1. OLAF shall respond in a timely manner to reasoned requests for information by an FIU where that information is necessary for the performance of the FIU’s functions under Chapter III of Directive (EU) 2024/1640. 2. OLAF may postpone or refuse the provision of the information referred to in paragraph 1 where providing it would be likely to have a negative impact on an ongoing investigation. OLAF shall communicate such postponement or refusal to the requesting FIU in a timely manner, including the reasons therefor.
Article 85 Exercise of the delegation
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Articles 29, 30, 31, 34, 43, 52 and 68 shall be conferred on the Commission for an indeterminate period of time from 9 July 2024. 3. The delegation of power referred to in Articles 29, 30, 31, 34, 43, 52 and 68 may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Article 29, 30, 31 or 34 shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of 1 month of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by 1 month at the initiative of the European Parliament or of the Council. 7. A delegated act adopted pursuant to Article 43, 52 or 68 shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of 3 months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by 3 months at the initiative of the European Parliament or of the Council.
Article 86 Committee procedure
1. The Commission shall be assisted by the Committee on the Prevention of Money Laundering and Terrorist Financing established by Article 34 of Regulation (EU) 2023/1113. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Article 87 Review
By 10 July 2032, and every 3 years thereafter, the Commission shall review the application of this Regulation and submit a report to the European Parliament and to the Council. The first review shall include an assessment of: (a) the national systems for reporting of suspicions pursuant to Article 69 and obstacles and opportunities to establish a single reporting system at Union level; (b) the adequacy of the beneficial ownership transparency framework to mitigate risks associated with legal entities and legal arrangements.
Article 88 Reports
By 10 July 2030, the Commission shall submit reports to the European Parliament and to the Council assessing the necessity and proportionality of: (a) lowering the 25 % threshold for the identification of beneficial ownership of legal entities through ownership interest; (b) extending the scope of high-value goods to include high-value garments and accessories; (c) extending the scope of the threshold-based disclosures under Article 74 to cover the sale of other goods, of introducing harmonised formats for the reporting of those transactions based on the usefulness of those reports for FIUs, and of extending the scope of information collected from persons trading in free-trade zones; (d) adjusting the limit for large cash payments.
Article 89 Relation to Directive (EU) 2015/849
References to Directive (EU) 2015/849 shall be construed as references to this Regulation and to Directive (EU) 2024/1640 and read in accordance with the correlation table set out in Annex VI to this Regulation.
Article 90 Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 10 July 2027, except in relation to obliged entities referred to in Article 3, points (3)(n) and (o), to which it shall apply from 10 July 2029.