Legal and regulatory perspectives of the 6th Directive

Although the effectiveness and impact of the latest AML-CFT installments remain to be evaluated within the next couple of years, the fight against money laundering and terrorist financing is far from over and continues to be a major concern at the EU Commission, which is currently reinforcing its arsenal via a number of regulatory efforts.

To consolidate and reinforce the AML-CFT existing measures, as of July 20, 2021, the Commission has issued an AML-CFT legislative framework containing 4 proposals[2]:

• The creation of an EU centralized AML Authority (“AMLA”) which should:

o   Be operational in 2024;

o   Help optimize supervision on financial institutions presenting the highest risk;

o   Enhance coordination between national supervisory authorities responsible for overseeing financial and non-financial organizations;

o   Ensure better cooperation among Financial Intelligence Units in Member States, to monitor potentially illegal cross-border financial flows.

The provisions on the AMLA will be embedded in a new regulation – the “AMLA Regulation”

• A new regulation on AML-CFT (“on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing”) imposing clearer requirements directly applicable to “obliged entities”, which:

o   From now on include additional types of organizations subject to the EU AML-CFT rules, such as, all crypto-asset and some crowdfunding services providers, mortgage credit and consumer credit providers and intermediaries, which are not financial institutions, as well as operators working on behalf of nationals of third countries;

o   Must adopt a risk-based approach when establishing internal processes and controls, with a risk management procedure focusing on the risks of money laundering and terrorist financing;

o   Must appoint a Compliance/AML officer and adopt a series of policies at management level to ensure proper control;

o   Must understand and comply with the more granular measures provided in the regulation around customer due diligence, taking into account risk factors to help evaluate whether a simplified or enhanced customer due diligence is more appropriate. A customer due diligence should be conducted whenever a business relationship is established; when an occasional transaction of more than EUR 10 000 is carried out; when a suspicion of money laundering or terrorist financing arises; or when there are doubts about the veracity or adequacy of the provided data.

In addition to the customer due diligence measures, obliged entities must have in place appropriate risk management systems, including risk-based procedures, to determine whether the customer or the beneficial owner of the customer is a politically exposed person.

At the minimum, customer identification via a verification of the customer’s identity should be conducted, not to mention the verification of the identity of beneficial owners and understanding the customer’s control structure; albeit when the risk is higher, the enhanced diligence would require examining the origin and destination of funds involved in a transaction as well as obtaining further information on the business relationship, nature, and purpose of the transaction.

The Commission also introduces a Union-wide limit to large cash payments over EUR 10 000, although EU Members may adopt lower thresholds depending on the local specificities.

• A new directive (“on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing directive (EU) 2015/849”) which shall be transposed into national law, imposing rules to national supervisors and financial intelligence units in each Member State and thus recognizing the need for flexibility for in the application of certain measures; for instance, currency exchange or cheque cashing offices as well as trust or company service providers or gambling service providers must be regulated (licensed or registration).

Moreover, to confirm the provisions within current AML frameworks, the directive highlights the probity, the “fit and proper” requirements to apply to senior managers of obliged entities, and the applicability of some rules to beneficial owners.

Persons convicted of money laundering, or of any of its predicate offenses, are prohibited to operate.

National supervisory authorities are granted certain powers to rule over certain obliged entities’ senior management or beneficial owners, where a conviction takes place.

• A revision of the regulation 2015/847/EU on transfers of funds to include the traceability of transfers of crypto-assets made by crypto-assets service providers, whenever the transactions involve a standard wire transfer or a crypto-asset transfer between a crypto-asset service provider and another obliged entity.

For regulated entities who may need to take necessary steps to improve their AML-CFT program, time is of the essence as the new AML-CFT framework will be soon discussed by the European Parliament and the Council, the Commission aiming for an expedited legislative process to get the AMLA up and running.