Article 4 Information sharing within a group

For the purposes of the prevention of money laundering, terrorist financing and the risk of the non-implementation or evasion of targeted financial sanctions, the parent undertaking and the obliged entities within a group shall enable the sharing of the information listed in Annex I when relevant as referred to in Article 16(3) of Regulation (EU) 2024/1624.

The sharing of information listed in Annex I within the group shall be provided to any obliged entity that is part of the group, taking into account the availability and quality of the information.

The parent undertaking shall define and maintain policies and procedures for information sharing within the group. Group-wide requirements shall not impose a requirement of the approval of the parent undertaking or any other obliged entity to share the information listed in Annex I to any obliged entity within the group.

Obliged entities within the group shall set up appropriate technical and organisational means through which such sharing can take place, taking into account size, complexity and risks.

Information shall be up to date, readily accessible, provided in an adequate and comprehensible form, provided on a need-to-know basis and be shared in line with the requirements stipulated by the applicable data protection legislation and in line with fundamental rights, through secure channels and respecting the requirements of security, integrity and confidentiality.

Information-sharing policies, procedures and controls shall include appropriate records of information exchanges to ensure the traceability and accountability of such information and to ensure effective supervision.

Information sharing within the group shall not affect the individual responsibility of each obliged entity to comply with AML/CFT requirements and to prevent the risk of the non-implementation or evasion of targeted financial sanctions. Each obliged entity of the group shall remain fully responsible for complying with due diligence requirements and performing its own risk assessments and making its own risk-related decisions, even when such decisions are based on information shared at the group level and taking into account any outsourcing, reliance on other obliged entities or other third-party arrangement in place.