Source: OJ L, 2024/1620, 19.6.2024

Current language: EN

Article 21 Administrative measures


Summary What does Article 21 of the Anti-money laundering authority regulation (AMLAR) say?

This article sets out the Authority's power to apply administrative measures against selected obliged entities — those under its direct supervision as established in Article 13.

It defines both the circumstances that trigger intervention and the full range of tools available, running from softer measures like issuing recommendations through to severe interventions such as restricting business operations, requiring governance changes, or temporarily banning individuals from managerial roles.

The article also establishes a notification obligation on national financial supervisors to alert the Authority when they detect signs of a breach by a selected obliged entity.

Important points:

  • The Authority can act not only when a breach has occurred, but also where one is likely or where internal controls are deemed inadequate relative to ML/TF risks.
  • The range of administrative measures available is broad, including public statements, orders to cease conduct, business restrictions, and temporary bans on individuals exercising managerial responsibilities.
  • Financial supervisors are required to notify the Authority without undue delay upon becoming aware of indications that a selected obliged entity has breached the applicable regulations.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. For the purpose of carrying out its tasks referred to in Article 5(2), the Authority shall have the power to apply the administrative measures set out in paragraphs 2 and 3 of this Article to require any selected obliged entity to take the necessary measures where:

      1. the selected obliged entity is found to be in breach of the Union acts and national legislation referred to in Article 1(2);

      2. the Authority has sufficient and demonstrable indications that the selected obliged entity is likely to breach the Union acts and national legislation referred to in Article 1(2) and the application of an administrative measure can prevent the occurrence of the breach or reduce the risk thereof;

      3. based on a duly justified determination by the Authority, the internal policies, procedures and controls in place in the selected obliged entity are not commensurate to the risks of money laundering, its predicate offences or terrorist financing to which the selected obliged entity is exposed.

    1. For the purposes of Article 6(1), the Authority shall have, in particular, the power to apply the following administrative measures:

      1. issue recommendations;

      2. order obliged entities to comply, including to implement specific corrective measures;

      3. issue a public statement which identifies the natural or legal person and the nature of the breach;

      4. issue an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;

      5. restrict or limit the business, operations or network of institutions comprising the selected obliged entity, or require the divestment of activities;

      6. require changes in the governance structure;

      7. where a selected obliged entity is subject to authorisation, propose the withdrawal or suspension of that authorisation to the authority that has granted it; where the authority which has granted that authorisation does not follow the Authority’s proposal to suspend or withdraw, the Authority shall request it to provide the reasons thereof in writing.

    1. By means of the administrative measures referred to in paragraph 2, the Authority may in particular:

      1. require the provision of any data or information necessary for the fulfilment of tasks listed in Article 5(2) without undue delay, require the submission of any document, or impose additional or more frequent reporting requirements;

      2. require the reinforcement of the internal policies, procedures and controls;

      3. require the application of a specific policy or requirements relating to categories of, or individual, clients, transactions, activities or delivery channels that pose high ML/TF risks;

      4. require the implementation of measures to decrease the ML/TF risks in the activities and products of selected obliged entities;

      5. temporarily ban any person exercising managerial responsibilities in the selected obliged entity, or any other natural person held responsible for the breach, from exercising managerial functions in obliged entities.

    1. The administrative measures referred to in paragraph 2 shall be accompanied, where relevant, by binding deadlines for their implementation. The Authority shall follow up and assess the implementation by the selected obliged entity of the actions requested.

    1. Financial supervisors shall notify the Authority without undue delay where they become aware of one or more indications that a selected obliged entity has breached Regulation (EU) 2023/1113 or Regulation (EU) 2024/1624.

    1. The administrative measures applied shall be effective, proportionate and dissuasive.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod