Art. 4 Criteria to be taken into account when setting the level of pecuniary sanctions | RTS on pecuniary sanctions and administrative measures | AML

This article directly follows the breach classification framework established in Articles 1 and 2, and translates that gravity assessment into concrete guidance on how supervisors should calibrate the level of pecuniary sanctions.

It sets out a structured, multi-directional approach: certain behaviours and circumstances will push sanctions downward (such as cooperation with the supervisor and timely remedial action), while others will push them upward (such as intentional conduct, concealment of the breach, prior sanctions history, and financial benefit derived from the breach).

The article also separately addresses how sanctions are calibrated for natural persons who are not themselves obliged entities, and requires supervisors to factor in the financial strength of both legal and natural persons when arriving at a final figure.

Important points:

Supervisors are required to apply both mitigating and aggravating criteria when determining the level of a pecuniary sanction, building directly on the breach severity classification from Articles 1 and 2.
Supervisors are required to assess the financial strength of legal persons using financial statements and prudential authority data, and for natural persons using their annual income from the obliged entity and any other relevant income.
When sanctioning natural persons who are not themselves obliged entities, supervisors must additionally consider their specific role, responsibilities, and degree of involvement in the breach.

1. To set the level of pecuniary sanctions, supervisors shall, after performing the assessment of the indicators specified in Articles 1 and 2, take into account:
  1. the circumstances referred to in Article 53(6) of Directive (EU) 2024/1640, and
  2. the criteria specified in paragraphs 2 to 6.
1. The level of pecuniary sanctions shall decrease taking into account each of the following criteria, to the extent that they apply:
  1. the level of cooperation of the natural person or the legal person held responsible with the supervisor. Supervisors shall consider, in particular, whether the natural person or the legal person has quickly and effectively brought the complete breach to the supervisor’s attention and whether it has actively and effectively contributed to the investigation of the breach conducted by the supervisor;
  2. the conduct of the natural person or the legal person held responsible since the breach has been identified either by the natural person or legal person itself or by the supervisor. Supervisors shall consider, in particular, whether the natural person or legal person held responsible has taken effective and timely remedial actions to end the breach or has taken voluntary adequate measures to effectively prevent similar breaches in the future;
  3. any other criteria identified by the supervisor.
1. The level of pecuniary sanctions shall increase taking into account each of the following criteria, to the extent that they apply:
  1. the level of cooperation of the natural person or the legal person held responsible with the supervisor. Supervisors shall consider, in particular, whether the natural or legal person has failed to cooperate with the supervisor, did not disclose to the supervisor anything the supervisor would have reasonably expected, or took actions aimed at partially or fully concealing the breach to the supervisor or at misleading the supervisor;
  2. the conduct of the natural person or the legal person held responsible since the breach was identified either by the entity itself or by the supervisor and the absence of remedial actions or measures taken to prevent breaches in the future;
  3. the degree of responsibility of the natural person or legal persons held responsible and whether the breach was committed intentionally;
  4. the benefit derived from the breach insofar as it can be determined and whether the natural person or legal person held responsible has benefited or could benefit either financially or competitively from the breach or avoid any loss;
  5. the losses to third parties caused by the breach, insofar as they can be determined, and the loss or risk of loss caused to customers or other market users;
  6. previous breaches by the natural person or the legal person held responsible and whether the supervisor has imposed any previous sanction concerning an AML/CFT breach or has previously requested remedial action be taken concerning an AML/CFT breach, and whether such action has not been taken in the time requested;
  7. any other criteria identified by the supervisor.
1. In addition to the criteria set out in paragraphs 1 to 3, when setting the level of pecuniary sanctions for natural persons who are not themselves obliged entities, supervisors shall take into account, where applicable, their role and effective responsibilities in the obliged entity, the scope of their functions and the extent of involvement in the breach.
1. When setting the level of pecuniary sanctions, supervisors shall take into account the financial strength of the legal person held responsible, including, where applicable, and in the light of its total annual turnover, any available relevant information from the financial statements in order to assess financial capacity and information from prudential authorities on the level of regulatory capital and liquidity requirements.
1. When setting the level of pecuniary sanctions, supervisors shall take into account the financial strength of the natural persons held responsible by assessing all the information made available. Such assessment shall cover the annual income, whether consisting of fixed or variable remuneration, received from the obliged entity or group of which the obliged entity is part and where relevant, other income of the natural person held responsible.