Article 3 Minimum requirements regarding group-wide policies, procedures and controls

setting up, implementing and maintaining an organisation and coordination framework at the group level with sufficient decision-making powers for the compliance manager at the level of the group and compliance officer appointed where justified by the activities carried out at the group level pursuant to Article 16(2) of Regulation (EU) 2024/1624. This framework shall ensure a proper allocation of functions, responsibilities and reporting lines and shall be clearly documented;

ensuring that the management body, internal controls and independent audit function have the necessary information at the group level to be able to carry out their functions under the applicable AML/CFT framework and to address and implement any administrative act issued by any supervisor for the oversight and management of entities and branches of the group in Member States and in third countries as applicable;

identifying and mitigating conflicts of interests between the prevention and management of risks related to money laundering, terrorist financing and the non-implementation or evasion of targeted financial sanctions and the tasks of the commercial functions of groups, including at the entity and branch level as applicable as part of the risk management framework;

ensuring that the group-wide risk assessment pursuant to Article 16(1) of Regulation (EU) 2024/1624 is commensurate to the complexity and the risk profile of the group;

putting in place a holistic assessment of risks to which branches and entities of the group as applicable are exposed, focussing on those that may have a significant impact on the group-wide risk exposure, including outsourcing, reliance on other obliged entities or other third-party arrangements. In this respect, particular attention shall be paid to the risks to which the entities and branches of the group established in third countries as applicable are exposed;

ensuring that the group compliance functions referred to in Article 16(2) of Regulation (EU) 2024/1624 have regular and documented information exchanges with the management body of the parent undertaking, commercial functions, other compliance functions established at entities and branches of the group as applicable, other internal controls and independent audit functions, and external auditors;

ensuring that information exchanges under point (i) cover, at a minimum, relevant information on identified risks, significant compliance issues, and measures adopted to address them;

ensure that they are adequate to the actual organisation, composition and operations of the group and are appropriately designed to take into account the individual situation of the entities and branches of the group as applicable by including all the elements listed in Articles 9 and 10 of Regulation (EU) 2024/1624;

ensure that they take into account group-specific risks in their design, execution and application and include group-wide measures to address non-compliance;

ensure that the compliance functions referred to in Article 16(2) of Regulation (EU) 2024/1624 and the internal controls:

ensure that the group-wide policies, procedures and controls and the group-wide risk assessments are implemented consistently in all entities and branches of the group and in their subsidiaries and branches in third countries as applicable;

establish, implement and maintain group-wide whistle-blowing policies, procedures and controls, including secure reporting, escalation channels and appropriate safeguards for whistleblowers as part of the risk management framework;

establish, implement and maintain group-wide policies, procedures and controls related to incident reporting and notification as part of the risk management framework. Such policies, procedures and controls shall clearly define the handling of material breaches and include adequate communication protocols and tools necessary to duly and adequately protect all the relevant information;

establish, implement and maintain group-wide training policies, procedures and controls with adequate minimum standards covering the frequency, categories and performance of the training, including for the management body and senior management as part of the risk management framework;

establish, implement and maintain group-wide policies, procedures and controls that are designed and implemented in such a way so that entities that are not obliged entities do not prevent the parent undertakings and obliged entities of the group from complying with the requirements set out in Regulation (EU) 2024/1624;

ensure that group-wide policies, procedures and controls are communicated to relevant staff, including staff employed in subsidiaries and branches established in Member States or third countries as applicable.