"EBA AML/CFT Newsletter" Newsletter Issues

EBA issues guidance to crypto-asset service providers to effectively manage their exposure to ML/TF risks (30/04/2024)

In January, we extended our Guidelines on money laundering and terrorist financing (ML/TF) risk factors to crypto-asset service providers (CASPs). CASPs can be abused for financial crime purposes, including ML/TF. The risk of this happening can be increased as a result of, for example, the speed of crypto-asset transfers or because some products contain features that allow the user’s identity to be hidden.

The EBA Risk‐Based Supervision Guidelines have been translated into all EU languages (30/04/2024)

In December 2023, we published new Guidelines for AML/CFT supervisors of CASPs. These Guidelines extend the Risk‐Based Supervision Guidelines to set clear expectations of the steps supervisors should take to identify and manage ML/TF risks in this sector and are an important step forward in the EU’s fight against financial crime. The Guidelines have now been translated into all official EU languages. You can find them at this link.

The Guidelines on restrictive measures and the ‘Travel Rule’ are now being finalised (30/04/2024)

In November 2023, we launched a consultation on new EBA ‘Travel Rule’ Guidelines. The main objective of these Guidelines is to prevent the abuse of funds and crypto-assets transfers for terrorist financing and other financial crime purposes. We held a virtual public hearing on 17 January with over 120 participants from both, payment service and crypto asset service providers. The consultation closed in February 2024. We received more than 30 responses, which are now being analysed.

The EBA publishes follow-up on the Peer Review on the Joint ESAs Guidelines on the prudential assessment of the acquisition of qualifying holdings (30/04/2024)

In February, we published a follow up to the EBA 2021 peer review report on the application of the Joint ESAs Guidelines on the prudential assessment of the acquisition of qualifying holdings. The review assesses the adequacy and effectiveness of the actions undertaken by the competent authorities subject to the previous review and finds good progress in remedying the deficiencies identified in 2021. All competent authorities have taken the need to respond to the assessment of the initial peer review seriously and most have adopted measures to remedy the deficiencies identified. We noted particular improvements in relation to the steps competent authorities have taken to identify and act upon suspicion of ML/TF.

The Commission asks the EBA for advice on aspects of the new AML regime (30/04/2024)

In March, we received a 'Call for Advice' (CfA) from the European Commission on important aspects of the future EU AML/CFT framework. Our response will form the basis of legal instruments that the new AML/CFT Authority (AMLA) will prepare and ensure that AMLA can begin to operate quickly once established.

The EBA’s work on de-risking (30/04/2024)

In March, we published a factsheet on de-risking. De-risking is the refusal to enter into, or a decision to terminate, business relationships with individual customers or categories of customers associated with higher ML/TF risk, or to refuse to carry out higher ML/TF risk transaction.

EuReCA database update (02/05/2024)

Our AML/CFT database (EuReCA) is collecting information about the AML/CFT material weaknesses identified by supervisor and measures taken in response to such material weaknesses. Following the publication of the RTS in the Official Journal of the European Union on 16 February 2024, the database is ready to start collecting information on natural persons associated with the infringements.

The EBA’s work on virtual IBANs (30/04/2024)

Over the last few years, we have observed that some credit, payment and e-money institutions issue "virtual IBANs” (vIBANs). A vIBAN is a number/ identifier that is used by PSPs to re-route payments to a payment account (the ‘master account’). Contrary to standard IBANs, vIBANs may not contain the country code of the jurisdiction in which the master account is held.

The EBA consults on the MICAR Guidelines on redemption plans (02/05/2024)

In March 2024, we launched the public consultation on the Guidelines for the plans to orderly redeem asset-referenced tokens (ARTs) or e-money tokens (EMTs) based on Articles 47 and 55 of MiCAR in the event that the issuer fails to fulfil its obligations under MiCAR. 

The EBA assesses competent authorities’ approaches to the AML/CFT supervision of banks (08/01/2024)

In July 2023, we published the 2022 review of competent authorities’ approaches to tackling money laundering and terrorist financing (ML/TF) risks in the banking sector. We assessed 12 competent authorities from 9 Member States and we concluded that supervisors are making progress in the fight against ML/TF.

Some competent authorities in the sample have extensively changed their approach to anti-money laundering and countering the financing of terrorism (AML/CFT) supervision of banks, which is now broadly effective. Cooperation between supervisors has also improved. Nevertheless, most supervisors in this sample were asked to do more to tackle ML/TF risk in the banking sector. We provided advice to competent authorities on the steps they should take to strengthen their approach.

Happy New Year! (08/01/2024)

We wish you a happy and prosperous new year.

The EBA publishes its Opinion on ML/TF Risks in the EU’s financial sector (08/01/2024)

In July 2023, we published an Opinion on the risks of ML/TF in the EU's financial sector. The Opinion also sets out what competent authorities can do to mitigate those risks.

We published this Opinion against the background of a changing risk landscape, which impacts financial institutions’ AML/CFT compliance and alters competent authorities’ approaches to supervision. While financial institutions' awareness of ML/TF risks is increasing and AML/CFT supervision is improving, AML/CFT systems and controls are not always effective. In particular, significant challenges remain in institutions’ approaches to transaction monitoring and reporting of suspicious transactions.

The EBA contributes to safeguard Not-for-Profit Organisations’ access to financial services that are essential for the delivery of humanitarian aid across the world (08/01/2024)

In March 2023, we updated the Guidelines on ML/TF risks factors and included guidance that sets out what financial institutions should do to identify and assess ML/TF risk associated with Not-for-Profit organisations (NPOs). This is to support financial institutions in managing ML/TF risks associated with NPOs effectively, instead of denying them access to financial services. The Guidelines are applicable across the EU since October 2023.

In July 2023, to complement these Guidelines and to engage further with NPOs, we published a joint factsheet together with the European Commission to clarify the information NPOs might have to provide to financial institutions to open an account or to carry out a specific transaction. The factsheet also explains the reasons why financial institutions may require this information.

Cooperation between AML/CFT supervisors is improving (08/01/2024)

In August 2023, we published our third Report on the functioning of AML/CFT colleges. We found that competent authorities have taken important steps to improve the functioning of AML/CFT colleges. This resulted in the exchange of more substantive and useful information. Nevertheless, not all AML/CFT colleges have reached full maturity, and at the time of our review, approximately 50 colleges had not yet held their first meeting.

The Report highlights good practices to further strengthen the effectiveness of AML/CFT colleges going forward.

The EBA met representatives of the payment institution sector to discuss AML/CFT compliance (08/01/2024)

In November 2023, we organised an Industry Roundtable with Members of the European Payment Institutions Federation (EPIF) as a follow up to the EBA Report on ML/TF risks associated with payment institutions, published in June 2023. The Roundtable’s objective was to constructively exchange on what the sector can do to improve their AML/CFT systems and controls. Discussions focused on ensuring adequate oversight of agent networks and the hallmarks of an effective approach to ongoing transaction monitoring in the sector.

Simultaneously, we continue our work with competent authorities to foster the exchange of information and good practices in relation to the supervision of the payment institution sector.

The EBA consults on ‘Travel Rule’ Guidelines (08/01/2024)

In November 2023, we launched a public consultation on new Guidelines to prevent the abuse of funds and crypto-assets transfers for terrorist financing and other financial crime purposes.

These 'Travel Rule' Guidelines specify the steps that Payment Service Providers (PSPs), Intermediary PSPs (IPSPs), crypto-asset service providers (CASPs) and Intermediary CASPs (ICASPs) should take to detect missing or incomplete information that accompanies a transfer of funds or crypto-assets. The consultation runs until 26 February 2024. We will also hold a virtual public hearing on 17 January 2024 from 14:00 to 16:00 CET.

The EBA extends AML/CFT Guidelines to CASP supervisors (second revision) (08/01/2024)

In November 2023, we published the second revision of the Risk-Based Supervision Guidelines. The revision extends the scope of the Guidelines to AML/CFT supervisors of CASPs. The amendments include guidance that competent authorities should consider when assessing ML/TF risks associated with CASPs.

CASPs can present high ML/TF risks. They also operate across borders. For this reason, a common supervisory approach to tackling ML/TF risks in that sector is crucial. The amended Guidelines highlight the importance of a consistent approach in setting supervisory expectations, where multiple competent authorities are responsible for the supervision of the same institutions. The Guidelines also emphasise the importance of training so that staff from competent authorities have the technical skills and expertise necessary to carry out their tasks.

The EBA publishes its annual Risk Assessment of the European banking system (08/01/2024)

In December 2023, we published the 2023 risk assessment of the European banking system, with a chapter focusing on financial crime risks.

Banks appear to have improved their awareness of ML/TF risk compared to 2022 but seem to continue to attribute less significance to ML/TF risk than to other operational risk aspects.

By contrast, AML/CFT supervisors express ongoing concerns about banks’ AML/CFT controls which are often in place but not always effective. In particular, according to supervisors, many banks fail to consider TF risks properly. According to AML/CFT supervisors, 70% of banks rely too heavily on the screening of targeted financial sanctions lists instead of monitoring risks associated with terrorist financing.

The EBA consults on Guidelines on internal policies, procedures and controls to support the implementation of Union and national restrictive measures (08/01/2024)

In December 2023, we launched a public consultation on two sets of Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures. Restrictive measures are binding on any person or entity under the jurisdiction of Member States. They comprise individual measures, i.e., targeted financial sanctions, and sectoral measures, i.e., financial and economic measures or embargoes.

Through these Guidelines, the EBA creates, for the first time in the EU, a common understanding, among PSPs, CASPs and their supervisors, of the steps they need to take to be able to comply with restrictive measures. The consultation runs until 25 March 2024. We will also hold a virtual public hearing on 8 February 2024 from 10:00 to 12:00 CET.

The EBA supports EU AML/CFT supervisors to prepare for the new EU AML/CFT framework (08/01/2024)

The establishment of a new EU Anti-Money Laundering Authority (AMLA) will bring significant changes to the way competent authorities approach AML/CFT supervision. Therefore, we have set up a Forum to support competent authorities in preparing their transition plans. The objective of the Forum is to contribute to the smooth transition to the new institutional framework.

The EBA and ESMA consult on regulatory instruments under Regulation (EU) 2023/1114 (MiCAR) that are relevant from a financial crime perspective (08/01/2024)

As a part of the MiCAR, the EBA and ESMA were given several mandates that are key to ensuring that ML/TF risks are identified and tackled. These include mandates in relation to:

• authorisations and notifications;
• assessments for the acquisition of qualifying holdings;
• suitability assessments of members of management bodies and of shareholders and members with qualifying holdings;
• governance arrangements;
• colleges;
• redemption plan; and
• transfer services.

CASPs and issuers of E-Money Tokens (EMTs) will be obliged entities under the Anti-Money Laundering Directive (AMLD). Issuers of asset-referenced tokens (ARTs) are not necessarily financial institutions or ‘obliged entities’ for AML/CFT purposes. ARTs have nevertheless to ensure that they are not used for financial crime purposes. The draft instruments set out what institutions and their supervisors should do to maintain the integrity of the sector once MiCAR applies. The consultation papers and final reports once published can be found on ESMA and EBA’s respective websites.

The EBA is finalising AML/CFT Guidelines for CASPs (08/01/2024)

We are finalising amendments to the Risk Factors Guidelines, which now contain specific guidance for CASPs on factors that they need to consider when entering a business relationship with their customers. The guidance for credit and financial institutions was also extended to highlight risk factors they need to consider when dealing with customers that are CASPs.

EBA publishes EuReCA Factsheet (29/06/2023)

In January 2022, the EBA launched EuReCA, its central anti-money laundering and countering the financing of terrorism (AML/CFT) database.

The EBA has now published a factsheet that summarises what EuReCA is, who reports into it and how the EBA uses information from EuReCA to foster an effective approach by EU supervisors to tackling financial crime risks in their sector. It also provides some statistics and examples from EuReCA’s first year.

EBA Guidelines on the use of Remote Customer Onboarding Solutions enter into force (29/06/2023)

In March, the EBA published the Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 in all EU official languages, triggering the compliance notification period and their subsequent entry into force.

The Guidelines set out a common understanding by competent authorities of the steps financial sector operators should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework.

The deadline for competent authorities to provide their compliance notification with these Guidelines was 30 May 2023. The EBA published the compliance table on its website.

EBA consults on guidelines for AML/CFT supervisors of CASPs (29/06/2023)

In March, the EBA launched a consultation on its proposal to amend its Guidelines on risk-based supervision to extend them to AML/CFT supervisors of Crypto-Asset Services Providers (CASPs).

The proposed amendments include guidance on the sources of information competent authorities should consider when assessing money laundering and terrorism financing (ML/TF) risks associated with CASPs. They also highlight the importance of a consistent approach to setting supervisory expectations where multiple competent authorities are responsible for the supervision of the same institutions. Additionally, the amendments emphasise the significance of training to ensure that staff from competent authorities have the technical skills and expertise necessary for the execution of their functions.

The consultation closed on 29 June 2023.

EBA issues Guidelines to tackle de-risking and safeguard access to financial services to vulnerable customers (29/06/2023)

In March, the EBA issued guidelines amending the ML/TF risk factors guidelines on the effective management of ML/TF risks and access to financial services', following a three -month consultation and a public hearing.

The purpose of the new guidelines is to ensure that customers have access to the financial services they need to fully participate in society and that they are not denied such access on unsubstantiated AML/CFT grounds or without a valid reason. The guidelines set common expectations of effective money ML/TF risk management practices in those situations.

EBA publishes three AML/CFT Q&As (29/06/2023)

Earlier this year, the EBA published answers to three questions that were submitted through its Q&A process.

Q&A 5100, published in February, clarifies the relationship between the EBA’s guidelines on outsourcing and section 4 of the AMLD on reliance on a third party provider.

Q&A 6048,  published in March clarifies the conditions under which Payment Initiation Service Provider (PISPs) should conduct customer due diligence.

Q&A 5818, also published in March, clarifies the conditions under which electronic money institutions and payment services providers having set up establishments in another Member State may be required to appoint a central contact point in that Member State.

EBA publishes report on convergence of supervisory practices (29/06/2023)

In May, the EBA published and submitted the European Parliament and the Council its annual report to on the degree of convergence between supervisory practices.

The latest Report on supervisory convergence for 2022  highlights the efforts made by prudential supervisors to take ML/TF risks into account when conducting the Supervisory Review and Evaluation Process (SREP) assessment and the synergies developed between AML/CFT and prudential supervisory colleges. The EBA found that prudential supervisors had incorporated AML/CFT into their supervisory priorities in 2022 and followed up on AML/CFT-related concerns.

EBA consults on draft RTS and ITS on supervisory colleges (29/06/2023)

In May the EBA launched a consultation on the draft regulatory technical standards (RTS) and implementing technical standards (ITS)  on the functioning of supervisory colleges amending the RTS and ITS on colleges of supervisors published by the European Commission in January 2016.

Some of the proposed revisions aim to enhance cooperation and information exchange between AML/CFT colleges and prudential supervisory colleges. Notably, under the EBA’s proposals, lead supervisors of AML/CFT colleges would be requested to participate as observers in prudential colleges.

The consultation closes 30 August, and a public hearing took place on 28 June 2023.

EBA proposes to extend the ML/TF Risk Factors Guidelines to CASPs (29/06/2023)

In May, the EBA initiated a public consultation on amendments to the Guidelines on MLK/TF risk factors. The proposed amendments extend the scope of the Guidelines to include crypto-asset service providers (CASPs) and highlight the ML/TF risks these providers should considered when carrying out risk assessments of their business or customers. The proposed amendments also include the risks that other credit and financial institutions should  consider when engaging in a business relationship with a CASP or when they are otherwise exposed to crypto assets.

The proposed amendments were necessary to fulfil  the mandates given to the EBA under the recast Transfer of Funds Regulation. The deadline for submission of comments in response to the consultation is 31 August 2023.

EBA assesses ML/TF risk in payment institutions (29/06/2023)

In June the EBA published the findings from its assessment of the scale and nature of ML/TF risks associated with payment institutions. It considered how payment institutions identify and manage ML/TF risks and what supervisors do to mitigate those risks when considering an application for the authorisation of a payment institution and during the life of a payment institution.

The sector consists of a heterogenous set of institutions of different sizes and business models, each carrying different levels of ML/TF risk. Nevertheless, the EBA’s findings suggest that overall, the sector does not manage ML/TF risk adequately. AML/CFT internal controls in payment institutions are often insufficient to prevent or detect ML/TF.

The EBA’s findings also suggest that not all competent authorities are currently doing enough to supervise the sector effectively. As a result, payment institutions with weak AML/CFT controls can operate in the EU, for example by establishing themselves in Member States where authorisation and AML/CFT supervision processes are less stringent to passport their activities cross-border afterwards.

EBA Annual Report (29/06/2023)

In June the EBA published its latest Annual Report. The report highlights the EBA’s continued leading work to reduce the risk of financial crime within the EU.   

In 2022, this included consolidating the regulatory framework and preparing to deliver ten new mandates under the recast Regulation on the transfer of funds and crypto-assets; launching the central database, EuReCA; continuing in-depth reviews of competent authorities’ approaches to tackling ML/TF risk; building supervisory capacity and fostering cooperation and information exchange in AML/CFT colleges.

EBA reports on competent authorities’ approaches to the AML/CFT supervision of banks (29/06/2023)

The EBA will publish its third report competent authorities’ approaches to the AML/CFT supervision of banks. The report provides a summary of the main findings and recommendations from this third round of reviews.

During this third round of reviews, the EBA assessed twelve competent authorities from nine EU and EEA Member States that are responsible for the AML/CFT supervision of banks in the EU and in the EEA.

EBA Data Protection Impact Assessment (29/06/2023)

The EBA has been working on a revised version of the Data Protection Impact Assessment (DPIA) on EuReCA.

An update of the summary of the DPIA will be published once the RTS on the AML/CFT central database is approved by the European Commission.

Opinion on ML/TF risks affecting the EU financial sector (29/06/2023)

The EBA is working on the next Opinion on the ML/TF risks affecting the EU financial sector, which is issued every two years.

As was the case in previous years, the EBA identifies ML/TF risks that cut across all sectors and risks that are specific to each of the 11 sectors within the EBA’s AML/CFT remit. For the first time, this report will include a sectoral risk assessment of crypto asset service providers.

EuReCA approaching 1-year anniversary! (16/12/2022)

In January the EBA launched EuReCA, the European Reporting system for AML/CFT material weaknesses. EuReCA is the only EU central database that brings together in one space information on serious deficiencies in individual financial institutions’ systems and controls that expose these institutions to money laundering and terrorist financing (ML/TF) risk.  EuReCA also contains information on the measures competent authorities imposed on financial institutions to correct those deficiencies.

The EBA receives new mandates under the revised Regulation on information accompanying transfers of funds (TFR) (16/12/2022)

On 29 June 2022 the co-legislators reached a provisional agreement on the revised TFR. According to this agreement, the EBA will be assigned 10 legislative mandates on different aspects of the TFR. The new mandates include:

• guidance on the steps crypto assets service providers (CASPs) need to take to comply with the TFR,
• the AML/CFT supervision of CASPs,
• the systems and controls payment service providers and CASPs have to put in place to comply with restrictive measures (financial sanctions) regimes.

The EBA sets up two Technical Expert Groups to inform the EBA’s work on new TFR mandates (16/12/2022)

In October, the EBA issued a public call for interest for two expert groups (TEG) to advise on its work under the revised TFR.

Both groups have now been set up. One group brings together experts on crypto assets service providers and anti-money laundering and countering the financing of terrorism (TEG-CASPs/AML), and the other one brings together experts on restrictive measures regimes (TEG-RMRs). TEG members participate in their personal capacity and provide independent expertise. They do not represent national interests or the interests of their organisation or employer. For transparency purposes, the EBA published the name of members of each TEG on its website.

The EBA published final Remote Customer Onboarding Guidelines (16/12/2022)

In November, the EBA published the final Guidelines on remote customer onboarding. The Guidelines  establish common EU standards on the development and implementation of sound, risk-sensitive initial customer due diligence policies and processes in the remote customer onboarding context. They set out the steps credit and financial institutions should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework.

The Guidelines apply to all credit and financial institutions that are within the scope of the Anti-money Laundering Directive (AMLD).

AML/CFT in the EU Supervisory Digital Finance Academy (16/12/2022)

In October, the European Commission together with the European Supervisory Authorities (ESAs) and the Florence School of Banking and Finance (Robert Schuman Centre, EUI) launched the EU Supervisory Digital Finance Academy (EU-SDFA).

The EU-SDFA provides participants with the knowledge necessary to carry out effective supervision of the application of digital technologies in finance by credit and financial institutions and supervisors’ use of technology. It also includes an AML/CFT module, which is provided by the EBA.

Financial crime risk remains a priority for prudential supervisors (16/12/2022)

In October, the EBA published the European Supervisory Examination Programme (ESEP) for 2023. The ESEP sets priorities for prudential supervisors across the EU. One of ESEP’s four priorities relates to financial crime. Accordingly, supervisors are expected to consider ML/TF risks from a prudential perspective and to verify that institutions’ internal control and governance frameworks are sufficient to enable them to comply with financial sanctions.

The EBA trains AML/CFT supervisors (16/12/2022)

In December, the EBA hosted a 3-day training event on effective, risk-based AML/CFT supervision to follow up on its findings from its ongoing programme of intrusive reviews of competent authorities’ approaches to AML/CFT supervision. The training was provided by EBA staff with input from 16 competent authorities across the EU who shared best practices and discussed real life cases through presentations, Q&As and panel discussions. Approx. 300 supervisors from AML/CFT, prudential and resolution authorities participated in the training. Competent authorities can access the training materials on the EBA’s learning hub.

The EBA consults on Guidelines to tackle de-risking (16/12/2022)

In December, following up on its Opinion on de-risking, the EBA launched a public consultation on new Guidelines to tackle de-risking. The consultation covers two set of Guidelines.

The first set consists of a new section to the EBA’s ML/TF risk factors Guidelines dedicated to not-for-profit organisations and set out what financial institutions should do to identify and tackle ML/TF risk associated with these customers.

The EBA publishes 2022 Risk Assessment Report (16/12/2022)

In December, the EBA published its Risk Assessment Report for 2022. This report provides an in-depth assessment of the state of health of the EU banking sector. In relation to financial crime, the report highlights that banks are attributing less importance to ML/TF risks, following a shift in focus towards risks related to the implementation of restrictive measures following the Russian war of aggression against Ukraine and risks relating to the circumvention of sanctions.

The EBA reviews implementation of authorisation guidelines for payment services providers (16/12/2022)

The EBA is carrying out a peer review on the authorisation of payment institutions (PIs) and electronic money institutions (EMIs) under the Payment Services Directive.

The peer review assesses supervisory practices across the EU in the authorisation of PIs and EMIs including the implementation of the EBA Guidelines on the information to be provided for the authorisation of PIs and EMIs and for the registration of account information service providers under PSD2. It will also identify shortcomings, good practices and provide targeted recommendations to competent authorities with the overall aim to further strengthen consistency and convergence of the assessment of applications for authorisations of PIs and EMIs across Europe.

The report will be published in early 2023.

Best wishes for a joyous year-end season (16/12/2022)

We’d like to thank you for your interest in our work and wish you and your dear ones a joyous end of the year and a great beginning of 2023.

Click on the image below for animation and sound. 

Guidelines on the role and responsibilities of the AML/CFT compliance officer (02/09/2022)

In June 2022, we published our new Guidelines on the role of AML/CFT compliance officers.

These Guidelines create, for the first time, a common understanding across EU Member States, of credit or financial institutions’ AML/CFT governance arrangements. They complement but do not replace relevant guidelines by the EBA on wider governance arrangements and suitability checks. 

Update on EuReCA [corrigendum] (02/09/2022)

Since the launch of the EBA’s new AML/CFT database ‘EuReCA’ (the European Reporting system for material AML/CFT weaknesses) on 31 January 2022, competent authorities have reported 98 ‘material weaknesses’, which relate to serious deficiencies that they have identified in individual financial institutions and 52 measures they have taken to rectify those deficiencies.

Training for AML/CFT supervisors of the life insurance sector (02/09/2022)

In April 2022, we provided AML/CFT training to more than 100 supervisors responsible for the supervision of the life insurance sector in the EU. Mr. Patrick Hoedjes, Head of the Oversight Department at EIOPA and a member of the EBA’s AML/CFT Standing Committee, opened the session and provided an introductory speech.

EBA’s response to the Call for Advice on the review of the PSD2 (02/09/2022)

In June 2022, we published a response to the Call for Advice on the review of the Payment Services Directive (PSD2), which proposed to the European Commission several amendments to the Directive to address various issues identified by the EBA. The proposal aims, among others, to address issues related to the move from open banking to open finance, to clarify the application of strong customer authentication and other security requirements, to define the scope of the Directive and key terms, as well as to identify the interplay between PSD2 and other EU legal acts.

Joint ESAs Report on the withdrawal of authorisation for serious breaches of AML/CFT rules (02/09/2022)

In June 2022, we published a joint Report, together withESMA and EIOPA, on the withdrawal of authorisation for serious breaches of AML/CFT rules. The report provides a comprehensive analysis on the completeness, adequacy and uniformity of the applicable laws and practices on the withdrawal of license for serious breaches of the AML/CFT rules.

Annual Report (02/09/2022)

In June 2022, the EBA published its 2021 Annual Report. The report summarises the EBA’s main achievements and key publications in 2021. On the AML/CFT side, it focusses on the building of the infrastructure in the EU to lead, coordinate and monitor AML/CFT supervision.

Political agreement reached on the recast of the 2015 Funds Transfer Regulation and new EBA mandates (02/09/2022)

One year ago, the European Commission published an AML/CFT packageconsisting of 4 legislative proposals that once implemented will transform the Union’s legal and institutional AML/CFT framework.

One of these proposals is the recast of the 2015 Funds Transfer Regulation. This recast serves to bring the EU’s legal framework in line with the Financial Action Task Force (FATF) standards which extended the application of its Recommendation 16 to virtual asset service providers. It means that to ensure traceability, these entities, which will now be included in the regulatory perimeter by the Market in Crypto Assets Regulation, will have to include information about the originator and beneficiary of the crypto-assets transfers, just as PSPs/IPSPs currently do for wire transfers. This is known as the “travel rule”.

Report on the functioning of AML/CFT colleges (02/09/2022)

On 1 September 2022, we published a second report on the Functioning of AML/CFT colleges in 2021. The report is based on data and information collected by the EBA from competent authorities or through EBA staff participation in AML/CFT college meetings.

Guidelines on effective ML/TF risk management and access to financial services (‘Anti-derisking Guidelines’) (02/09/2022)

As a follow-up from the EBA Opinion on de-risking (published in January 2022), the EBA is working on a new set of guidelines to tackle further the negative impact of de-risking and to strike the right balance between financial inclusion and compliance with the current EU AML/CFT framework.

New Director of the Innovation, Conduct and Consumers Department (29/04/2022)

The newly appointed Director of the Innovation, Conduct and Consumers Department, Marilin Pikaro, joined the EBA on 1 March.

Prior to joining the EBA Ms Pikaro was a special advisor to the European Commission, and her experience includes work for the Estonian Criminal Police and as a Chief Compliance Officer and member of the Executive team and Management Board at Luminor.

De-risking Opinion and Report (29/04/2022)

In January we published an Opinion and a report on the scale and impact of de-risking in the EU. We worked with competent authorities across the EU, and with external stakeholders, to better understand why credit and financial institutions decide to de-risk particular categories of customers instead of managing the risks associated therewith.

Call for Advice on Digital Finance (29/04/2022)

In January 2022 the EBA, along with the other ESAs, submitted the joint response to the European Commission’s February 2021 Call for Advice on Digital Finance. The ESAs identified that the use of innovative technologies in the EU financial sector is facilitating changes to value chains, that dependencies on digital platforms are increasing rapidly, and that new mixed-activity groups are emerging. These trends open up a range of opportunities for both EU consumers and financial institutions, but also pose new or elevated risks.

EuReCA update (29/04/2022)

In January we launched our central EU AML/CFT database, EuReCA, the European Reporting system for material AML/CFT weaknesses. EuReCA is based on the draft Regulatory Technical Standards (RTS) published in December 2021 that define key terms and type of information to report to EuReCA. EuReCA brings together in one place information from competent authorities (CAs) across the EU that relates to serious AML/CFT shortcomings in individual financial institutions, and the measures CAs have taken to rectify those shortcomings.

EuReCA will be key to strengthening AML/CFT supervision and coordinating supervisory efforts across the EU.

Luanda Leaks (29/04/2022)

In February we published the findings of our assessment of competent authorities’ responses to the 2020 Luanda Leaks. We found that competent authorities across the EU adopted significantly different approaches for identifying and tackling the risks highlighted by the information contained in the leaks, and that these approaches varied beyond what the EBA would have expected under a risk-based approach.

However, we also identified good practices, including steps by competent authorities to put in place dedicated processes to identify and swiftly react to instances of crystallised ML/TF risk. The  EBA Risk-Based AML/CFT Supervision Guidelines can also support competent authorities to better identify, assess and manage emerging ML/TF risks holistically and across all areas of supervision.

EBA updates SREP Guidelines with explicit AML/CFT references (29/04/2022)

In March, the EBA published its revised Guidelines on common procedures and methodologies for the supervisory review and evaluation process (EBA SREP Guidelines).

The revised Guidelines reflect changes to the EU’s legal framework. They also set out how prudential supervisors should take ML/TF risks into account in SREP, in line with the EBA's Opinion on ML/TF risks in SREP.

Remote customer onboarding (29/04/2022)

At the end of the last year, the EBA launched a public consultation on its draft Guidelines on the use of remote customer onboarding solutions. These Guidelines set out a common understanding by competent authorities of the steps financial sector operators should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework.

EBA calls for the financial inclusion of refugees (29/04/2022)

In March, we published a first  statement on the situation in Ukraine, calling all competent authorities to ensure all financial institutions properly implement restrictive measures adopted by the Council of the EU.  We highlighted the importance of sanctions compliance and of institutions taking advantage of the flexibility enshrined in EU AML/CFT law to provide refugees with access to at least basic financial products.

EBA asked financial institutions to follow a risk-based approach when providing financial products to refugees from Ukraine, using the EBA’s 2021 ML/TF Risk Factors Guidelines and the EBA’s 2016 Opinion on the Application of Customer Due Diligence Measures for Asylum Seekers.

In April we published a statement on financial inclustion in the context of the invastion in Ukraine.  The statement sets out what financial institutions and their AML/CFT supervisors can do to facilitate access by refugees from Ukraine to the EU’s financial system and what financial institutions and AML/CFT supervisors can do to protect vulnerable customers from abuse by criminals and to tackle emerging financial crime risks.

EBA assesses effectiveness of AML/CFT supervision (29/04/2022)

In March, we published our second report on competent authorities’ approaches to the AML/CFT supervision of banks. We found that several competent authorities in last year’s sample had engaged in meaningful reforms but that the effectiveness of their approaches was often hampered by insufficient ML/TF risk assessments and failure to translate those risk assessments into their supervisory practices and plans.

EBA chairperson writes to co-legislators about the AML/CFT package (29/04/2022)

In March, the EBA's chairperson, Jose Manuel Campa, wrote to the European Parliament, the Council and the Commission co-legislators about the importance of cooperation in the future EU AML/CFT framework, a holistic approach to tackling ML/TF and the criteria for selecting institutions that will be directly supervised by the future AMLA.

The Chairperson emphasised that ML/TF cannot be fought effectively in isolation, and that building on the synergies that exist between the AML/CFT, prudential and conduct frameworks will remain important to protect the European Union from financial crime.

Revised Guidelines on Risk-Based AML/CFT Supervision (29/04/2022)

In April, the EBA published the translations of the Guidelines on Risk-Based Supervision (revised).

The revised Guidelines enter into effect on 4 July 2022.

New guidelines on the authorisation of credit institutions (20/12/2021)

In November we published the final guidelines on a common assessment methodology for granting authorisation of credit institutions. The guidelines introduce guidance on ML/TF risk as part of the risks competent authorities should consider in the assessment of applications for authorisation, and highlight the importance of cooperation with the AML supervisors and other public bodies.

EuReCA! Draft Regulatory Technical Standards on the AML/CFT database (20/12/2021)

In December, we published our draft Regulatory Technical Standards (RTS) on a central database on AML/CFT in the EU, also known as the European reporting system for material CFT/AML weaknesses (EuReCA). This database will act as an early warning tool, helping competent authorities to take action before ML/TF risk materialise, and to coordinate their efforts to prevent and counter ML/TF in the Union.

Revised guidelines on risk-based AML/CFT supervision (20/12/2021)

In December, we published our revised guidelines on the risk-based supervision of credit and financial institutions’ compliance with AML/CFT obligations. Building on the EBA’s existing 4-step approach to risk-based AML/CFT supervision, the revised guidelines set out the steps supervisors should take to ensure adequate AML/CFT oversight of their sector and support the adoption, by credit and financial institutions, of effective ML/TF risk management policies and procedures.  They also provide additional guidance on ML/TF risk assessments, including sectoral ML/TF risk assessment. Finally, they help supervisors choose the most effective tools to meet their supervisory objectives, including in situations when they have identified breaches and weaknesses in institutions’ systems and controls framework and emphasise the importance of cooperation between AML/CFT supervisors and other stakeholders, including prudential supervisors, FIUs and tax authorities.

EBA publishes AML/CFT cooperation guidelines (20/12/2021)

In December, we published our new guidelines on cooperation and information exchange between prudential and AML/CFT supervisors and FIUs. The guidelines set out how and in what situations information exchange is warranted, starting at the authorisation phase through the ongoing supervision and, where relevant the imposition of supervisory measures and sanctions including the withdrawal of authorisation.

The guidelines will apply from 1 June 2022.

EBA annual risk assessment (20/12/2021)

In December, we published our annual risk assessment (RAR) of the European banking system.

The report focuses on risks across the whole banking sector, including risks related to the current COVID-19 pandemic. From an AML/CFT perspective, we found that some banks may be underestimating the level of ML/TF risk to which they are exposed. We also found that the pandemic increased reliance on remote onboarding solutions and gave rise to new financial crime risks, which some banks may not have been equipped to manage. Finally, a reduction in some banks’ revenues as a result of the pandemic may have led them to take on greater ML/TF risks.

AML/CFT colleges factsheets (20/12/2021)

In December, we published two factsheets on AML/CFT colleges.

One factsheet explains the overall AML/CFT colleges framework, which is set out in the ESA’s guidelines. The other factsheet explains how we monitor AML/CFT colleges, and how we select AML/CFT colleges that we will then monitor closely, i.e. those institutions that pose the highest ML/TF risks. When identifying the colleges to closely monitor, we also take into account the need to ensure a broad geographical spread, coverage by sector and the strategic importance of specific institutions in some regions and Member States.

In addition to active monitoring, from January 2022, we will also carry out thematic monitoring of colleges in certain sectors, and general monitoring of all colleges.

Update on EBA consultation on new guidelines on the role of AML/CFT compliance officers (20/12/2021)

The public consultation on the new draft guidelines on the role, tasks and responsibilities of AML/CFT compliance officers was launched in early August and ended on 2 November 2021. We received 36 submissions mainly from banking, insurance or other finance associations across Member States, which are currently under our review.

The publication of the final guidelines is scheduled for summer 2022.

EBA updates SREP guidelines with explicit AML/CFT references (20/12/2021)

We are currently finalising our revised guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP).

The revised guidelines will reflect changes to the EU’s legal framework. They will also set out how prudential supervisors should take ML/TF risks into account in SREP, in line with the EBA's Opinion on ML/TF risks in SREP.

The final revised SREP guidelines are aimed to be published by end of March 2022.

EBA consults on draft guidelines on the use of remote customer onboarding solutions (20/12/2021)

We launched a consultation on draft guidelines on the use of remote customer onboarding solutions. These guidelines set out a common understanding of the steps financial sector operators should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework while observing the principle of technological neutrality.

De-risking Opinion and Report (20/12/2021)

We will publish an Opinion on the scale and impact of de-risking in the EU in early 2022.

In 2020-21 we conducted a series of information gathering exercises, reaching out to all relevant competent authorities across the EU, as well as to external stakeholders to assess the scale and impact of de-risking across the EU and to better understand why institutions decide to de-risk particular categories of customers instead of managing the risks associated therewith. We consolidated the findings and identified a number of steps for competent authorities and the European Commission and co-legislators to tackle unwarranted de-risking going forward.

Report on non-bank lending (20/12/2021)

In February 2021, as part of a broader call for advice on digital finance, the European Commission requested the EBA to provide technical advice on non-bank lending.

We will provide our view on the need to adjust the EU regulatory perimeter, including in relation to AML/CFT. The final report will be published in Q1 2022.

Findings from the EBA’s review of competent authorities’ approaches to AML/CFT supervision (20/12/2021)

We will soon be publishing our findings of this year’s implementation reviews. Implementation reviews are staff-led assessments of competent authorities’ approaches to AML/CFT supervision. Our first report is available on our website.

AML/CFT Colleges report (20/12/2021)

In Q1, 2022, we plan to publish our second report on the functioning of AML/CFT Colleges, where we will summarise our observations of good and poor practices from AML/CFT colleges, which we have attended in 2021. In the report, we will also identify themes and priority areas for 2022 that should be considered and discussed in all colleges.

AML/CFT database will soon be operational (20/12/2021)

The European Reporting system for material AML/CFT weaknesses (EuReCA) will be central to coordinating efforts to prevent and counter money laundering and terrorist financing (ML/TF) in the Union.

EuReCA will start collecting data in Q1 2022.

Call for advice on digital finance (20/12/2021)

In February 2021, the European Commission requested the ESAs to provide technical advice on digital finance and related issues. The Commission specifically asked the ESAs to review the regulation and supervision of (a) more fragmented or non-integrated value chains, (b) platforms and bundling of services, and (c) risks of groups combining different activities, including in relation to AML/CFT.

The final report will be published Q1, 2022.

EBA publishes revised ML/TF risk factors Guidelines (07/04/2021)

In March, following an extensive public consultation, we published our final Risk Factors Guidelines. These Guidelines were first issued in 2017 and have since become central to financial institutions’ risk-based approaches to AML/CFT. We updated them to reflect changes in the EU legal framework, to address new ML/TF risks that have emerged since the previous version, and to clarify regulatory expectations where our findings from, for example, the Opinion on ML/TF risks and our implementation reviews suggested that this was necessary to achieve more robust and consistent outcomes across the EU.

EBA publishes its 2021 Opinion on ML/TF risks (07/04/2021)

In March, we also published our biennial Opinion on ML/TF risks. This Opinion draws on information from the EU’s 57 national AML/CFT supervisors of the financial sector and other work of the EBA. The Opinion provides an insight into the state of the fight against ML/TF in different financial services sub-sectors, as well as an overview of cross-cutting risks such as the Covid-19 pandemic, financial innovation and ‘de-risking’. We will use our findings to inform our policy-making this year and next.

We also published an interactive tool that illustrates all the risks we identified.

Crypto-assets: ESAs remind consumers about risks (07/04/2021)

In March, the European Supervisory Authorities (ESAs) issued a joint warning reminding consumers that the majority of crypto-assets remain unregulated. Even though some virtual asset service providers now fall within the scope of national AML/CFT regimes and the legislative proposal for an EU Regulation in Markets for Crypto Assets (MiCA) has now been published, the negotiations between EU legislators are ongoing and the Regulation does not yet apply. This is why consumers buying or holding crypto assets do not yet benefit from the guarantees and safeguards associated with regulated financial services.

EBA provides introductory AML/CFT training to more than 550 EU supervisors (07/04/2021)

In February, we organised a virtual one-day introductory AML/CFT training course for staff of national supervisory authorities. More than 550 participants from AML/CFT competent authorities, prudential supervisors, Financial Intelligence Units (FIUs) and EU agencies joined to learn about global and European AML/CFT standards, the role of supervisors, FIUs and law enforcement, and the importance of a joined-up approach to fighting financial crime.

We would like to thank our expert speakers from the Financial Action Task Force (FATF), the European Commission, the European Central Bank, the Egmont Group, Europol, the Autorité de Contrôle Prudentiel et de Résolution, the Financial Intelligence and Analysis Unit, the Autoriteit Financiële Markten and the EBA for sharing their insights.

EBA conducts a peer review of competent authorities’ approaches to assessing applications for qualifying holdings (07/04/2021)

We are currently carrying out a Peer Review under Article 30 of our Founding Regulation of the ESAs’ Joint Guidelines on the prudential assessment of the acquisitions and increases of qualifying holdings in the financial sector. We are assessing how competent authorities comply with specific aspects of the joint guidelines, and the extent to which their current practices are effective. Our review includes the fifth assessment criterion, which relates to ML/TF risks that may arise from the proposed acquisition of the qualifying holdings. We are paying particular attention to the way competent authorities assess the origin and legitimacy of the funds the applicant proposes to use to acquire the holdings. 

We will conclude our review in July 2021 and publish our findings later this year.

EBA consults on changes to its risk-based AML/CFT supervision Guidelines (07/04/2021)

In March, we launched a public consultation on changes to our Risk-based Supervision Guidelines. The Guidelines set out what supervisors should do to ensure institutions’ compliance with their AML/CFT obligations. The changes address key obstacles to effective AML/CFT supervision that we identified since the Guidelines were first issued, including for example through our implementation reviews and Breach of Union Law work. Specifically, the revised version contains greater detail on risk assessments, the translation of risk assessments into a supervisory strategy and inspection plan, and the use of different tools to meet supervisory objectives.

The consultation is open until 17 June 2021.

EBA consults on new Guidelines on the authorisation of credit institutions (07/04/2021)

In March, we launched a public consultation on a common assessment methodology for granting authorisation as a credit institution under the Capital Requirements Directive (CRD). The draft Guidelines set out how supervisors should consider ML/TF risk when assessing applications for authorisation and emphasise the importance of cooperation between prudential and AML/CFT supervisors, and between supervisors and other public bodies in this context.

The consultation is open until 10 June 2021.

The EBA takes steps to address unwarranted ‘de-risking’ (07/04/2021)

In March, following evidence we gathered in our call for input last year, we published three regulatory instruments in which we address de-risking practices. In these instruments, we clarify that compliance with anti-money and countering terrorist financing (AML/CTF) obligations in EU law does not require financial institutions to refuse, or terminate, business relationships with entire categories of customers that they consider to present a higher ML/TF risk. We also set out steps that financial institutions and competent authorities should take to manage risks associated with individual business relationships in an effective manner.

EBA to consult on three new AML/CFT instruments in Q2 2021 (07/04/2021)

We are preparing to launch public consultations on three new AML/CFT instruments in Q2, 2021:

• Draft regulatory technical standards on our new AML/CFT central database, which will specify the type of information this database will contain and how we will use and disseminate this information in line with our legal mandate to lead, coordinate and monitor the EU financial sector’s fight against ML/TF;

• Draft Guidelines on the cooperation between prudential supervisors, AML/CFT supervisors and FIUs; and

• Draft Guidelines on the role of AML/CFT compliance officers.

Advising the Commission on digital finance (07/04/2021)

In September 2020, the European Commission published its Digital Finance Strategy (DFS) accompanied by legislative proposals for markets in crypto-assets (MiCA) and digital operational resilience (DORA). The DFS sets out significant new roles for EBA including in relation to digital identities, RegTech and SupTech and ensuring the ongoing suitability of the EU’s regulatory and supervisory framework.