Article 1 Indicators to classify the level of gravity of breaches

the duration of the breach;

the repetition of the breach;

the conduct of the natural person or legal person that committed, permitted or did not prevent the breach;

the impact of the breach on the obliged entity, by assessing:

the impact of the breach on the exposure of the obliged entity, or of the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; to which it belongs, to money launderingmeans the conduct set out in Article 3, paragraphs 1 and 5, of Directive (EU) 2018/1673 including aiding and abetting, inciting and attempting to commit that conduct, whether the activities which generated the property to be laundered were carried out on the territory of a Member State or on that of a third country; knowledge, intent or purpose required as an element of that conduct may be inferred from objective factual circumstances; and terrorist financingmeans the conduct set out in Article 11 of Directive (EU) 2017/541 including aiding and abetting, inciting and attempting to commit that conduct, whether carried out on the territory of a Member State or on that of a third country; knowledge, intent or purpose required as an element of that conduct may be inferred from objective factual circumstances; risks;

the nature of the breach, by assessing whether the breach is related to internal policies, procedures and controls of the obliged entity, customer due diligence, reporting obligations or records retention;

whether the breach could have facilitated or otherwise led to criminal activitiesmeans criminal activity as defined in Article 2, point (1), of Directive (EU) 2018/1673, as well as fraud affecting the Union’s financial interests as defined in Article 3(2) of Directive (EU) 2017/1371, passive and active corruption as defined in Article 4 (2) and misappropriation as defined in Article 4(3), second subparagraph, of that Directive; as defined in Article 2(1), point (3), of Regulation (EU) 2024/1624;

whether there is a structural failure within the obliged entity with regards to AML/CFT systems, controls or policies or a material failure of the entity to put in place adequate AML/CFT systems, controls or policies;

the actual or potential impact of the breach on the financial viability of the obliged entity or of the groupmeans a group of undertakings which consists of a parent undertaking, its subsidiaries, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU; of which the obliged entity is part;

the actual or potential impact of the breach:

the systematic nature of the breach;

any other indicator identified by the supervisorsmeans the body entrusted with responsibilities aimed at ensuring compliance by obliged entities with the requirements of this Regulation, including AMLA when performing the tasks entrusted to it in Article 5(2) of Regulation (EU) 2024/1620;.