RTS on group-wide minimum requirements and additional measures for third-country subsidiaries and branches

Information sharing within groups is a key element of ensuring an appropriate understanding of money laundering risks, terrorist financing risks and risks of the non- implementation and evasion of targeted financial sanctions. Information sharing should mitigate these risks, especially when they are associated with customers and transactions.

A list of information that, when considered relevant for the purposes of the prevention of money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions, can be shared is provided in Annex I to this Regulation. The type of information to be shared within the group should include, among other types, information on customers, transactions, services and activities, risk assessments, internal controls, independent audit functions, external audits, suspicious transactions or activity reporting, group-wide policies, procedures and controls, and interactions with supervisors and competent authorities. In any case, information sharing should take into account the requirements set out in Regulation (EU) 2024/1624, Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849(²) and any administrative act of the supervisors.

Obliged entities should use the information shared by other entities in the group to make, among other things, informed decisions on customers, transactions and risk assessments, and to potentially restrict or refuse to enter into a new relationship, terminate existing business relationships or restrict or refuse to carry out the execution of occasional transactions in accordance with Regulation (EU) 2024/1624. Furthermore, the information shared within the group should be used to prevent and mitigate money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions and to inform the parent undertaking in the Union of the group-wide-level risk assessment.

Information sharing should also include ad hoc sharing of newly identified relevant information related to the risk of the non-implementation or evasion of targeted financial sanctions.

The Union anti-money-laundering / countering the financing of terrorism (AML/CFT) framework applies to a wide variety of obliged entities. Some obliged entities perform transactions; other obliged entities, such as real estate agents, lawyers and notaries, provide services or activities connected to transactions. For these obliged entities, information- sharing requirements should include sharing of information related to the provision of services or activities under the AML/CFT framework.

Certain aspects of the implementation of the AML/CFT framework involve the collection, analysis, storage and sharing of data, including personal data. The processing of personal data should be permitted only for the purposes of the prevention and management of money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions. In addition, information sharing should be subject to sufficient guarantees in terms of confidentiality, secure channels and data protection in line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)(³) regarding the use of information and should fully respect fundamental rights.

Sharing of information should be implemented in a manner proportionate to the relevancy of the request and be based on a need-to-know assessment. In any case, obliged entities should not be prevented from sharing any relevant information related to risks of money laundering, terrorist financing or the non-implementation or evasion of targeted financial sanctions as deemed appropriate.

Obliged entities in the Union may share information with other entities of the group outside the Union. In such cases, the Regulation clarifies that in cases where there are restrictions or prohibitions on the sharing of information to third countries, the parent undertaking in the Union and the other obliged entities of the group in the Union need to assess the restrictions and prohibitions and communicate them to the supervisors in the Union. Similarly, in cases where restrictions or prohibitions on the sharing of information exist from third countries to the Union, including to supervisors in the Union, obliged entities in the Union need to assess restrictions or prohibitions and communicate them to the supervisors in the Union. In any case, obliged entities should take appropriate measures to address such restrictions or prohibitions on sharing information.

There are circumstances where a group or an obliged entity operates branches or subsidiaries in a third country whose law does not permit the implementation of group- wide policies, procedures and controls on AML/CFT. This can be the case, for example, where the third country's data protection, banking secrecy or professional secrecy law limits the group's ability to access, process or exchange information related to customers of branches or subsidiaries in the third country. In such cases, the parent undertaking in the Union or the obliged entity should communicate these legal impediments to its supervisor and may notify the supervisor of multiple impediments within a single notification.

In those circumstances, and in situations where the ability of supervisors to effectively supervise the group's compliance with the requirements of Regulation (EU) 2024/1624 is impeded because supervisors do not have access to relevant information held at branches or subsidiaries in third countries, additional policies, procedures and controls are required to manage money laundering and terrorist financing risks effectively. These additional policies, procedures and controls may include obtaining consent from customers, which can serve to overcome certain legal obstacles to the implementation of group-wide AML/CFT policies, procedures and controls in third countries where other options are limited.

The need to ensure a consistent Union level response to legal obstacles to the implementation of group-wide policies, procedures and controls justifies the imposition of specific minimum actions that obliged entities are required to take in those situations. However, the extent of such additional policies, procedures and controls should be proportionate and risk based.

Parent undertakings and obliged entities should inform their supervisors that the extent of the additional measures they have taken is appropriate in view of the money laundering and terrorist financing risk. However, should the supervisor consider that the additional measures an obliged entity has taken are insufficient to manage that risk, the supervisor should be able to direct the obliged entity to take specific additional measures to ensure the obliged entity's compliance with its obligations regarding AML/CFT requirements. In order to ensure effective oversight and coordination, where a supervisor is a self-regulatory body, the public authority overseeing that body should be informed of legal impediments reported by obliged entities, the steps taken to address those impediments, any supervisory actions requested and any relevant developments arising thereafter.

The additional supervisory actions described in this Regulation are specific to situations where, in the context of operations or activities carried out in a third country, including through branches or subsidiaries forming part of the group, the parent undertaking in the Union or the obliged entity do not put in place adequate systems and controls to manage the money laundering and terrorist financing risks where the law of that third country does not permit the application of group-wide AML/CFT systems and controls that comply with Union law. The assessment of whether such third-country legal or regulatory impediments prevent effective compliance should not depend on the internal allocation of functions within the group. Where operations or activities are carried out in a third country through a branch or subsidiary, such assessment should be made irrespective of whether specific AML/CFT functions are performed locally or at the group level.

Following a supervisory assessment, where the policies, procedures, systems and controls put in place do not ensure that the associated money laundering and terrorist financing risks are effectively managed, supervisors should apply the additional supervisory actions provided for in this Regulation. Those additional supervisory actions complement other supervisory actions and measures that supervisors may apply under Union or national law, including enforcement measures available under those legal frameworks. The actions supervisors take should be proportionate and risk based, taking into account the specific circumstances of the case.

The provisions of this Regulation should also be without prejudice to the enhanced due diligence measures obliged entities are required to take when dealing with natural persons or legal entities established in countries identified by the Commission as having significant strategic deficiencies in their national AML/CFT regimes, weaknesses in their national AML/CFT regimes or posing a specific and serious threat to the Union’s financial system pursuant to Articles 29, 30 and 31 of Regulation (EU) 2024/1624.

For groups whose head office is located outside of the Union, where at least two subsidiaries are obliged entities established in the Union and they are not in a relationship of control with each other pursuant to Article 2(1), point (42)(b), of Regulation (EU) 2024/1624, one parent undertaking in the Union, responsible for the implementation of the AML/CFT framework and the prevention to the risk of the non-implementation or evasion of targeted financial sanctions, should be identified.

In the situation covered by Article 2(1), point (42)(b) of Regulation (EU) 2024/1624, before notifying the supervisor, obliged entities in the Union should assess their role, taking into account certain criteria such as the prominence of activities, the understanding of operations and the responsibility of implementing group-wide requirements. Sufficient prominence of the obliged entities should be based on elements such as the type of obliged entity, cross-border establishments of any kind, the customer base, the amount of transactions when these are performed. In case such criteria are not enough to determine sufficient prominence of the obliged entities, other criteria should be the total annual turnover or the balance sheet or the average number of staff of the identified obliged entity in the group. Sufficient understanding of operations of the obliged entities should be based on qualitative criteria showing the types of powers and influence of the identified obliged entities in the group in the Union. In case such criteria are not enough to determine sufficient understanding of operations, an additional criterion should be the number of staff in the compliance functions referred to in Article 11 of Regulation (EU) 2024/1624.

To ensure that supervisors are aware of the identified obliged entity as parent undertaking in the Union for groups whose head office is located outside of the Union and that have two or more obliged entities in the Union which are not a subsidiary of another undertaking that is an obliged entity established in the Union, a notification and approval mechanism to supervisors should be established.

The identified obliged entity in the Union pursuant to Article 2(1), point (42)(b) of Regulation (EU) 2024/1624 should submit a notification to the supervisor. The supervisor should be able to request, where necessary, specific clarifications or additional information regarding the parent undertaking assessment performed by the identified obliged entity. The assessment should be based on whether the identified obliged entity fulfils the criteria set out in Article 2(1), point (42)(b) of Regulation (EU) 2024/1624.

All the supervisors and the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (´the Authority´) should be fully informed in any case on the notification procedure to identify the parent undertaking in the Union pursuant to Article 2(1), point (42)(b) of Regulation (EU) 2024/1624. This is to ensure that appropriate information sharing and good cooperation between supervisors take place and that the supervisor adopts effectively and timely the decision on the identification of the parent undertaking in the Union. In cases of disagreement between supervisors on the assessment of the parent undertaking performed by the supervisor, one or more supervisors may ask the Authority to settle the disagreement between supervisors in cross-border situations.

In addition to groups, structures exist, such as networks or partnerships or franchises, in which obliged entities might share common ownership, management, compliance control or a combination of them, which should be subject to group-wide requirements. To ensure a level playing field across the sectors whilst avoiding overburdening the affected sectors, this Regulation identifies situations where group-wide policies, procedures and controls, including information sharing requirements, should apply to those structures, taking into account the principle of proportionality.

Given the different types of structures that could exist in different sectors and jurisdictions, especially in the non-financial sector, the conditions for the qualification of structures that share common ownership, management, compliance control or a combination of them should be designed in a general and comprehensible manner to ensure harmonisation at Union level. Furthermore, such conditions should be designed broadly to allow a wide application of the group-wide requirements. For instance, common compliance control should not be limited to compliance under the AML/CFT framework, but include other types of compliance such as any prudential, product and service compliance in place.

Structures other than groups under the scope of this Regulation could be identified in specific forms such as networks, partnerships or franchises comprising two or more obliged entities. Networks are common arrangements for auditors, external accountants, lawyers and other professionals. These arrangements are established for specific purposes and can have common ownership, common management, common compliance control or a combination of them. Partnerships are also common arrangements for auditors, external accountants, lawyers and notaries. They can include obliged entities belonging to different categories and share common ownership, common management, common compliance control or a combination of them. Further, franchises are common arrangements for instance for professionals in sectors such as real estate (e.g. real estate agents) and gambling. Arrangements put in place under a common franchise may share certain elements of common management, common compliance control or a combination of them for the purposes of marketing specific types of goods and/or services. Under the conditions set out in this Regulation these structures should be subject to group-wide requirements.

In addition, given the close operational and organisational links between legal entities and their branches, the application of group-wide requirements to such forms of structures is necessary to ensure a consistent and comprehensive approach to AML/CFT risk management throughout the Union. For instance, an obliged entity authorised in one Member State that operates in other Member States through one or more branches, even when it has no subsidiaries, should be subject to this Regulation. Similarly, when an entity in a third country operates only through branches as obliged entities established or located in the Union or through a combination of legal entities and independent branches as obliged entities, all these obliged entities should be subject to this Regulation. In these cases, such structures have in place common ownership, common management or common compliance control.

Differently, there can be structures other than groups that do not share any elements of common ownership, common management or common compliance control, such as structures aiming exclusively to establish customer referral arrangements, to share common technical tools, facilities or knowledge or to exchange best practices or similar without any power of management or control by any entity sharing them, including marketing or distribution strategies; structures sharing the same name, franchise or branding without any power of management or control on the name, branding or franchise by any entity; or structures set up for a specific customer relationship or transaction without any power of management or control between obliged entities. To ensure proportionality in the application of the requirements, these structures should not be considered as falling in the scope of this Regulation.

Furthermore, the relationship between an agent and its principal and between a distributor and its principal does not fall within the scope of this Regulation when it is subject to specific provisions stated in Articles 8(5) and 12 of Regulation (EU) 2024/1624.

For arrangements other than groups that share common ownership, common management or common compliance control or a combination of them, obliged entities in the structure should identify the head of the structure in the Union. The criteria to determine the head of the structure in the Union in these cases should be the position, powers, control and services provided by such entity on the obliged entities in the structure. In case these criteria do not allow the proper identification of the head of the structure in the Union, obliged entities should identify the entity acting as head of the structure based on its balance sheet or annual turnover or the average number of staff.

In case the identified entity is an obliged entity, such obliged entity should notify the supervisor its role to ensure clarity and effectiveness in the identification of the head of the structure in the Union. The supervisor should be able to request, where necessary, specific clarifications or additional information regarding the head of the structure assessment performed by the obliged entity in the Union. The assessment should be based on the criteria set out in this Regulation to determine the head of the structure.

Obliged entities of the structure should identify one obliged entity that has sufficient powers and controls to ensure that group-wide requirements apply to the obliged entities of the structure. In duly justified circumstances and to ensure a proportionate application of the requirements set out in this Regulation, obliged entities of the structure should be able to ask for a permission to the supervisors not to identify a head of the structure. Obliged entities should appoint a coordinating obliged entity in charge of the notification to the supervisor. In case the permission is granted, the application of group-wide requirements should be limited to certain minimum group-wide requirements provided in this Regulation that do not necessitate an obliged entity acting as head of the structure. Obliged entities in the structure should adopt common policies, procedures, and controls for managing the money laundering, terrorist financing, and targeted financial sanctions risks, including risks arising from the non-implementation, circumvention, or evasion of targeted financial sanctions and mutually ensure compliance with these minimum group- wide requirements. Certain conditions should be attached to such request to ensure that obliged entities do not abuse of such permission and that supervisors can still conduct risk- based monitoring activities or take other adequate measures.

To allow obliged entities sufficient time to adapt, where necessary their systems, policies, controls and procedures, including training of staff, to the requirements laid down in this Regulation, and thereby facilitate their effective implementation, this Regulation should apply six months after its entry into force.

This Regulation is based on the draft regulatory technical standards submitted to the Commission by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (the ‘Authority’).

The Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based and analysed the potential related costs and benefits,