Article 16 Group-wide requirements

A parent undertakingmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; shall ensure that the requirements on internal procedures, risk assessment and staff referred to in Section 1 of this Chapter apply in all branches and subsidiaries of the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; in the Member States and, for groupsmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; whose head office is located in the Union, in third countriesmeans any jurisdiction, independent state or autonomous territory that is not part of the Union and that has its own AML/CFT legislation or enforcement regime;. To this end, a parent undertakingmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; shall perform a group-wide risk assessment, taking into account the business-wide risk assessment performed by all branches and subsidiaries of the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU;, and establish and implement group-wide policies, procedures and controls, including on data protection and on information sharing within the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; for AML/CFT purposes and to ensure that employees within the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; are aware of the requirements arising from this Regulation. Obliged entities within the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; shall implement those group-wide policies, procedures and controls, taking into account their specificities and the risks to which they are exposed.

The group-wide policies, procedures and controls and the group-wide risk assessments referred to in the first subparagraph shall include all the elements listed in Articles 9 and 10, respectively.

For the purposes of the first subparagraph, where a groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; has establishmentsmeans the actual pursuit by an obliged entity of an economic activity covered by Article 3 in a Member State or third country other than the country where its head office is located for an indefinite period and through a stable infrastructure, including:a branch or subsidiary;in the case of credit institutions and financial institutions, an infrastructure qualifying as an establishment under prudential regulation; in more than one Member State and, for groupsmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; whose head office is located in the Union, in third countriesmeans any jurisdiction, independent state or autonomous territory that is not part of the Union and that has its own AML/CFT legislation or enforcement regime;, parent undertakingsmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; shall take into account the information published by the authorities of all the Member States or third countriesmeans any jurisdiction, independent state or autonomous territory that is not part of the Union and that has its own AML/CFT legislation or enforcement regime; where the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU;’s establishmentsmeans the actual pursuit by an obliged entity of an economic activity covered by Article 3 in a Member State or third country other than the country where its head office is located for an indefinite period and through a stable infrastructure, including:a branch or subsidiary;in the case of credit institutions and financial institutions, an infrastructure qualifying as an establishment under prudential regulation; are located.

Compliance functions shall be established at the level of the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU;. Those functions shall include a compliance manager at the level of the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; and, where justified by the activities carried out at groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; level, a compliance officer. The decision on the extent of the compliance functions shall be documented.

The compliance manager referred to in the first subparagraph shall regularly report to the management body in its management functionmeans the management body responsible for the day-to-day management of the obliged entity; of the parent undertakingmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; on the implementation of the group-wide policies, procedures and controls. At a minimum, the compliance manager shall submit once a year a report on the implementation of the obliged entity’s internal policies, procedures and controls and shall take the necessary actions to remedy in a timely manner any deficiencies identified. Where the management body in its management functionmeans the management body responsible for the day-to-day management of the obliged entity; is a body collectively responsible for its decisions, the compliance manager shall assist and advise it, and shall prepare the decisions necessary for the implementation of this Article.

The policies, procedures and controls pertaining to the sharing of information referred to in paragraph 1 shall require obliged entities within the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; to exchange information when such sharing is relevant for the purposes of customer due diligence and money launderingmeans the conduct set out in Article 3, paragraphs 1 and 5, of Directive (EU) 2018/1673 including aiding and abetting, inciting and attempting to commit that conduct, whether the activities which generated the property to be laundered were carried out on the territory of a Member State or on that of a third country; knowledge, intent or purpose required as an element of that conduct may be inferred from objective factual circumstances; and terrorist financingmeans the conduct set out in Article 11 of Directive (EU) 2017/541 including aiding and abetting, inciting and attempting to commit that conduct, whether carried out on the territory of a Member State or on that of a third country; knowledge, intent or purpose required as an element of that conduct may be inferred from objective factual circumstances; risk management. The sharing of information within the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; shall cover in particular the identity and characteristics of the customer, its beneficial ownersmeans any natural person who ultimately owns or controls a legal entity or an express trust or similar legal arrangement; or the person on behalf of whom the customer acts, the nature and purpose of the business relationshipmeans a business, professional or commercial relationship connected with the professional activities of an obliged entity, which is set up between an obliged entity and a customer, including in the absence of a written contract and which is expected to have, at the time when the contact is established, or which subsequently acquires, an element of repetition or duration; and of the occasional transactions and the suspicions, accompanied by the underlying analyses, that fundsor ‘property’ means property as defined in Article 2, point (2), of Directive (EU) 2018/1673; are the proceeds of criminal activitymeans criminal activity as defined in Article 2, point (1), of Directive (EU) 2018/1673, as well as fraud affecting the Union’s financial interests as defined in Article 3(2) of Directive (EU) 2017/1371, passive and active corruption as defined in Article 4 (2) and misappropriation as defined in Article 4(3), second subparagraph, of that Directive; or are related to terrorist financingmeans the conduct set out in Article 11 of Directive (EU) 2017/541 including aiding and abetting, inciting and attempting to commit that conduct, whether carried out on the territory of a Member State or on that of a third country; knowledge, intent or purpose required as an element of that conduct may be inferred from objective factual circumstances; reported to FIU pursuant to Article 69, unless otherwise instructed by the FIU.

The group-wide policies, procedures and controls shall not prevent entities within a groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; which are not obliged entities to provide information to obliged entities within the same groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; where such sharing is relevant for those obliged entities to comply with requirements set out in this Regulation.

Parent undertakingsmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; shall put in place group-wide policies, procedures and controls to ensure that the information exchanged pursuant to the first and second subparagraphs is subject to sufficient guarantees in terms of confidentiality, data protection and use of the information, including to prevent its disclosure.

By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall specify the minimum requirements of group-wide policies, procedures and controls, including minimum standards for information sharing within the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU;, the criteria for identifying the parent undertakingmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; in the cases covered by Article 2(1), point (42)(b), and the conditions under which the provisions of this Article apply to entities that are part of structures which share common ownership, management or compliance control, including networks or partnerships, as well as the criteria for identifying the parent undertakingmeans:for groups whose head office is located in the Union, an obliged entity that is a parent undertaking as defined in Article 2, point (9), of Directive 2013/34/EU that is not itself a subsidiary of another undertaking in the Union, provided that at least one subsidiary undertaking is an obliged entity;for groups whose head office is located outside of the Union, where at least two subsidiary undertakings are obliged entities established in the Union, an undertaking within that group established in the Union that:is an obliged entity;is an undertaking that is not a subsidiary of another undertaking that is an obliged entity established in the Union;has a sufficient prominence within the group and a sufficient understanding of the operations of the group that are subject to the requirements of this Regulation; andis given the responsibility of implementing group-wide requirements under Chapter II, Section 2 of this Regulation; in the Union in those cases.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 4 of this Article in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.