Art. 10 Individual risk assessments | RTS on group-wide minimum requirements and additional measures for third-country subsidiaries and branches | AML

This article addresses a specific problem that arises when a third country's law blocks or restricts a branch or subsidiary from applying the internal policies, procedures and controls needed to properly identify and assess money laundering and terrorist financing risk — particularly where access to customer or beneficial ownership information is limited.

It sets out a clear escalation pathway for the parent undertaking or obliged entity to follow, moving from notification and consent-seeking, through additional compensatory measures drawn from Article 15, and ultimately to the most drastic option of terminating relationships or closing down operations if the risk cannot otherwise be managed.

Important points:

Notify the home Member State supervisor within 28 calendar days of identifying a third country legal restriction that blocks adequate AML/CFT controls, specifying the country and nature of the restriction.
Where customer consent cannot be obtained to overcome the restriction, apply the additional measures referenced in Article 15, determined on a risk-sensitive basis.
If the ML/TF risk still cannot be effectively managed after exhausting those measures, terminate the business relationship, refuse the occasional transaction, or close down some or all operations of the affected branch or subsidiary.

1. Where the parent undertaking in the Union or an obliged entity identifies that the law of a third country does not permit or restricts the application of Regulation (EU) 2024/1624 by a subsidiary or branch when it comes to internal policies, procedures and controls that are necessary to identify and assess adequately the money laundering and terrorist financing risk associated with a business relationship or occasional transaction due to restrictions on access to relevant customer and beneficial ownership information or restrictions on the use of such information for customer due diligence purposes, it shall at least:
  1. inform the supervisor of the home Member State without undue delay and in any case no later than 28 calendar days of the following:
    the name of the country concerned;
    how the application of the law of the third country concerned does not permit or restricts the application of internal policies, procedures and controls referred to in paragraph 1;
  2. ensure that their branches or subsidiaries established in the third country determine whether consent from their customers and, where applicable, their customers’ beneficial owners, can be used to legally overcome the restrictions or prohibitions referred to in point (a)(ii);
  3. ensure that their branches or subsidiaries established in the third country require their customers and, where applicable, their customers’ beneficial owners, to give consent to overcome restrictions or prohibitions referred to in point (a)(ii) to the extent that this is compatible with the law of the third country.
1. In cases where the consent referred to in point (c) of paragraph 1 is not feasible, the parent undertaking in the Union or the obliged entity shall apply additional measures as set out in point (c) of Article 15 of this Regulation and one or more of the measures set out in points (a), (b), (d), (e) and (f) of that Article.
1. Where the parent undertaking in the Union or an obliged entity cannot effectively manage the money laundering and terrorist financing risk by applying the measures referred to in paragraphs 1 and 2, it shall:
  1. ensure that the branch or subsidiary terminates the business relationship;
  2. ensure that the branch or subsidiary does not carry out the occasional transaction;
  3. close down some or all operations provided by their branch or subsidiary established in the third country.
1. The parent undertaking in the Union or the obliged entity shall determine the extent of the additional measures listed in paragraph 2 and 3 of this Article on a risk-sensitive basis and shall inform without undue delay the supervisor of the home Member State that the extent of the additional measures is appropriate in view of the money laundering and terrorist financing risks.