Preamble Recitals

Supervisors should have a common understanding of the breaches that warrant the imposition of pecuniary sanctions or administrative measures to ensure a consistent approach to enforcement across Member States. To achieve this, this Regulation sets out a list of indicators that supervisors should take into account when assessing the level of gravity of breaches. It also classifies the level of gravity of breaches into four categories of increased severity.

When determining the level of gravity of breaches by classifying them into the four categories, and when setting the level of pecuniary sanctions and applying administrative measures, supervisors should take into account in their overall assessment all applicable indicators and criteria. Supervisors should use their supervisory judgement to analyse whether and to what extent these indicators and criteria are met.

The list of indicators and criteria specified by this Regulation is non-exhaustive. This is to enable supervisors to take into account the specific context in which the breach has occurred. Where supervisors consider additional specific indicators or criteria, they should justify their use. Supervisors should ensure that supervisory judgement is applied in a coherent and consistent way, with comparable outcomes. They should also ensure their approach supports the convergence of practices and the consistency and comparability of enforcement outcomes across Member States.

To ensure a consistent approach to assessing the level of gravity of breaches across Member States, this Regulation sets specific combinations of indicators that, if identified by the supervisor as an outcome of the assessment of a breach, should lead to its classification into a certain category of gravity. Those combinations of indicators are not exhaustive. Supervisors may classify other combinations of indicators into the same categories.

An important indicator for classifying the level of gravity of breaches is the conduct of the natural person or of the legal person, including its senior management and its management body in its supervisory function. Supervisors should consider whether a breach was committed intentionally or negligently. Supervisors should pay particular attention to situations where the natural person or legal person appears to have had knowledge of the breach and took no action, or where their action directly contributed to the breach.

Some administrative measures are more severe than others. To ensure a consistent approach across Member States, it is necessary to set out common criteria that supervisors should take into account when considering whether to apply the administrative measures listed under Article 56(2), points (e), (f), and (g), of Directive (EU) 2024/1640, including the withdrawal or suspension of the authorisation, since these could have the highest impact on the obliged entities and the market.

Periodic penalty payments are a tool that supervisors can use to compel compliance with administrative measures. Where supervisors decide to impose periodic penalty payments they should take into account all relevant factors when determining the appropriate and proportionate amount of periodic penalty payments on obliged entities and natural persons to compel them to comply with the imposed administrative measures.

The decision on the imposition of periodic penalty payments should be taken on the basis of findings that allow the supervisor to conclude that an obliged entity or natural person has failed to comply with an administrative measure within a specified period.

Decisions to impose periodic penalty payments should be based exclusively on grounds on which the obliged entity or natural person has been able to exercise its right to be heard.

The periodic penalty payments imposed should be effective and proportionate, having regard to the circumstances of the specific case.

To ensure legal certainty, if not otherwise stipulated by this Regulation, provisions of law applicable in the Member State where the periodic penalty payment is imposed and collected, should apply.

This Regulation is based on the draft regulatory technical standards submitted to the Commission by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism.