4.2 Step 1 – Identification of risk and mitigating factors

Competent authorities should identify and understand the risk factors that will affect each sector’s and subject of assessment’s exposure to the ML/TF risks. For this purpose, competent authorities should use different sources of information provided in Guideline 4.2.2 and also actively engage with the sector and with other competent authorities where relevant, as set out in Guidelines 4.1.4. and 4.4.9.

When identifying ML/TF risk factors, competent authorities should draw on the EBA ’s ML/TF risk factors guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions under Articles 17 and 18(4) of Directive (EU) 2015/849.¹¹

¹¹ EBA Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849 , EBA/GL/2021/02.

Where subjects of assessment are clusters, competent authorities should identify relevant factors based on those listed in paragraphs 44 and 45 to characterise the cluster as a whole. This should enable competent authorities to justify their decisions on the risk profile they assign to the cluster. Competent authorities should also consider the results of previous supervisory actions in respect of subjects of assessment included within that cluster.

Where a subject of assessment is supervised by multiple competent authorities within one Member State, those competent authorities should cooperate and exchange information on that subject of assessment in order to develop a common understanding of its risk exposure.

The extent and type of information sought by competent authorities to identify risk factors and mitigating factors should be proportionate to the nature and size, where known, of the subjects of assessment’s business activities. It should also take into account the subjects of assessment risk profile as determined on the basis of previous risk assessments, if any, and the context in which the subject of assessment operates, such as the nature of the sector to which the subject of assessment belongs. Competent authorities should consider setting out:

• a) what information they will always require in respect of subjects of assessment and require similar information for comparable subjects of assessment;
• b) where and how they will obtain this information; and
• c) the type of information which will trigger a more extensive and in-depth information request. 4.2.2 Sources of information

Competent authorities should identify risk factors in respect of sectors, subsectors, if relevant, and subjects of assessment based on information from a variety of sources. Competent authorities should determine the type and number of these sources on a risk ‐ sensitive basis. Competent authorities should ensure that they have access to appropriate sources of information and take steps, where necessary, to improve these. Competent authorities should also ensure that they have implemented processes and procedures for collecting the necessary data.

The sources of information that competent authorities should always consider include:

•  C1
• a) the European Commission’s supranational risk assessment published in accordance with Article 6(1) of Directive (EU) 2015/849;
• b) the EBA ’ s Opinion on the ML/TF risk affecting the Union’s financial sector published in accordance with Article 6(5) of Directive (EU) 2015/849;
• c) the national risk assessment (NRA) of the Member State and other Member States as referred to in Article 7(1) of Directive (EU) 2015/849;
• d) Delegated Acts adopted by the European Commission as referred to in Article 9(2) of Directive (EU) 2015/849;
• e) national and foreign governments;
• f) outcomes of the EBA’s risk assessments as referred to in Article 9a of Regulation (EU) No 1093/2010;
• g) other competent authorities;
• h) AML/CFT supervisory authorities in third countries;
• i) supervisory authorities responsible for the supervision of subjects of assessment’ s compliance with prudential requirements, including competent authorities as defined in points (2)(i) and (viii) of Article 4 of Regulation (EU) No 1093/2010, points (2)(i) of Article 4 of Regulation (EU) No 1094/2010, and points (3)(i) of Article 4 of Regulation (EU) No 1095/2010;
• j) the financial intelligence units (FIUs);
• k) law enforcement agencies, where not excluded by the applicable law;
• l) tax authorities, where not excluded by the applicable law; and
• m) AML/CFT colleges, established in accordance with the ESAs ’ Joint Guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (the AML/CFT Colleges Guidelines’)¹² , where established.
•  O

¹² ESAs Joint Guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (JC 2019 81)

Other sources of information competent authorities should also consider include:

• a) the EBA’s AML/CFT central database as referred to in Article 9a ( 1) and (3) of Regulation (EU) No 1093/2010, when the information is made available to the competent authority;
• b) colleges of prudential supervisors, set up in line with Article 51 or 116 of Directive (EU) 2019/878 and with the Commission Implementing Regulation (EU) 2016/99 of 16 October 2015 on the operational functioning of colleges of supervisors, and the Commission Delegated Regulation (EU) 2016/98 of 16 October 2015 on the general conditions for the functioning of colleges of supervisors, where established;
• c) industry bodies, including information gathered as part of public-private partnerships, if available, such as typologies and information on emerging risks;
• d) civil society such as corruption perception indices;
• e) international or supranational standard- setting bodies such as mutual evaluations of countries’ AML/CFT, anti-corruption and tax regimes;
• f) information from credible and reliable open sources, such as reports in reputable newspapers;
• g) reputable commercial organisations such as risk and intelligence reports;
• h) whistleblowing reports;
• i) information from academic institutions;
• j) external auditors’ report s in respect of the subject of assessment, where they are available;
•  A1
• k) outcomes of analysis of one or more advanced analytics tools; or
• l) notifications of repeatedly failing payment service providers or crypto-asset service providers submitted to the responsible competent authorities in accordance with Articles 8(2), 12(2), 17(2) and 21(2) of Regulation (EU) 2023/1113, to the extent that these providers fall within the competent autho rity’s supervisory scope .
•  O 4.2.3 Domestic risk factors

Competent authorities should have adequate knowledge, awareness and understanding of the ML/TF risks identified at the national level in order to identify the ML/TF risk factors associated with the domestic activities of subjects of assessment and within sectors.

As part of this, and based on the sources described in paragraphs 30 and 31, competent authorities should understand, among other things:

• a) the type, typologies and scale of money laundering linked to predicate offences, including but not limited to tax offences, committed domestically;
• b) the scale of laundering of proceeds from predicate offences, including but not limited to tax offences, committed abroad;
• c) the type, typologies and scale of terrorism financing and the scale and the level of support for terrorist activities and groups in the country;
• d) relevant ML/TF typologies identified by the FIU and other public authorities or relevant credible private bodies.

4.2.4 Foreign risk factors

Where a subject of assessment or a sector as a whole maintains significant links with other Member States or third countries so that the subject of assessment or sector is exposed to ML/TF risks associated with these other countries, competent authorities should identify these risks. Significant links include those where:

• a) a subject of assessment maintains a significant level of business relationships with customers from other Member States or third countries;
• b) a beneficial owner of a customer of the subject of assessment is from other Member States or third countries;
• c) a subject of assessment is carrying out significant levels of occasional transactions with other Member States or third countries;
• d) a subject of assessment maintains significant business relationships with counterparties established in other Member States or third countries;
• e) a subject of assessment forms part of a financial group established in another Member State or third country;
• f) a subject of assessment's beneficial owners are based in another Member State or third country;
• g) a subject of assessment’s managing body is comprised of individuals from another Member State or third country; and
• h) a subject of assessment has any other relevant links to another Member State or third country, which means that it is exposed to the ML/TF risk associated with that country.

Competent authorities should take reasonable steps to acquire and keep up to date adequate knowledge, awareness and understanding of the ML/TF risks associated with these Member States or third countries that may affect the activities carried out by the subjects of assessment. To this end, competent authorities should identify risk factors in line with the EBA ’ s AML/CFT Risk Factors Guidelines¹³ and those described in paragraphs 33 and 34 above for each of these Member States or third countries.

¹³ EBA Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849, EBA/GL/2021/02.

When identifying third countries which have strategic deficiencies in their national AML/CFT regimes that pose significant threats to the financial system of the European Union, competent authorities should have regard to the delegated acts adopted by the European Commission in accordance with Article 9(2) of Directive (EU) 2015/849 as well as public statements issued by relevant international standard ‐ setters, including the Financial Action Task Force (FATF), the European Council’s Committee of Experts on the Evaluation of Anti -Money Laundering Measures and the Financing of Terrorism (MONEYVAL) or other FATF ‐ style regional bodies (FSRBs).

4.2.5 Sector ‐ wide ML/TF risk factors

•  A1

Competent authorities should have a good understanding of the risk factors that are relevant for all sectors under their supervision. In order to identify relevant risk factors in the relevant sectors, competent authorities should first define the sectors under their supervision. To inform their view of the sectors, competent authorities should categorise obliged entities in line with the list of institutions provided in the definition of credit and financial institutions under Article 3(1) and (2) of Directive (EU) 2015/849.

Depending on the size of a sector and the nature of subjects of assessment within it, competent authorities should consider dividing sectors further into subsectors. This may be necessary when a sector is made up of subjects of assessment that are very diverse because a substantial proportion of subjects of assessment share similar features and business models that set them apart from the rest of the sector. Similar features include, but are not limited to, the type of products and services offered, the delivery channels used and the type of customers they service. Examples of subsectors include money-remitters, private banks, brokerage firms, and crypto-asset exchanges, which represent subsectors of payment institutions, credit institutions, investment firms, and crypto-asset service providers respectively. To inform their view on sectors and subsectors and their specific features, competent authorities should refer to Title II of the EBA’s AML/CFT Risk Factors Guidelines .

•  O

Competent authorities should understand how each sector and subsector is organised, and the risks associated with shared features such as the type of products and services offered, the delivery channels used and the type of customers they service. Competent authorities should base their understanding of the sectoral and subsectoral risk factors on:

• a) a high-level view of all relevant information related to subject of assessment in a particular sector or subsector as set out in paragraphs 44 and 45 in these guidelines in order to identify commonalities within each sector and subsector as a whole; and
• b) relevant information related to the sectors and subsectors as set out in paragraphs 41 in these guidelines.

4.2.6 Type of information necessary to identify risk factors

• a. Information on sectors

Competent authorities should gather sufficient, relevant and reliable information from the sources described in paragraphs 30 and 31 to develop an overall understanding of the inherent risk factors and factors that mitigate these risks within the sector and subsector, where relevant.

•  C1

In order to develop a good understanding of the inherent risk factors within the sectors and subsectors, competent authorities should obtain information which should include, but not be limited to:

• a) information on the size, scope of activities, and complexity of the sector in an aggregated format;
• b) the nature of the business models within the sector;
• c) general information on the type of products, services, customers and delivery channels used within the sector or subsector and their risk profiles, if known;
• d) information on the current and emerging risks associated with the sector or subsector domestically and internationally, including the information that may indicate that the sector or subsector may be exposed to increased ML/TF risk as a result of de-risking practices applied to these sectors or subsectors by other sectors;
• e) information on the main ML/TF risks affecting the internal market;
• f) the impact of cross-border activities within the sector or sub-sector;
• g) the sector’s or subsector’s exposure to vulnerabilities that arise in a global context;
• h) threat reports, alerts and typologies from the financial intelligence unit and other relevant state bodies, if applicable; and
• i) guidance published by other competent authorities or international standard-setters;
•  A1
• j) where the use of technology, such as distributed ledger technology (DLT) or anonymity enhancing features, is essential to the sector ’s or subsector ’ s business model and operation, the effect this technology has on the sector ’s or subsector ’ s ML/TF risk exposure.
•  O

The information described above can also contribute to the competent authorities' perception of risk factors on the level of individual subjects of assessment and vice versa.

• b. Information on subjects of assessment

Based on the sectoral risk assessment, competent authorities should gather sufficient, relevant and reliable information from the sources described in paragraphs 30 and 31 to develop an overall understanding of the subjects of assessment’s inherent risk factors, and, to the extent possible, residual risk factors.

In order to develop a good understanding of the inherent risk factors applicable to subjects of assessment, competent authorities should gather information from various sources that includes, but is not limited to, the information relating to:

• a) the ownership and corporate structure of the subjects of assessment, taking into account whether the subject of assessment is a foreign or domestic credit institution or financial institution, parent company, subsidiary, branch or other kind of establishment, and the level of complexity and transparency of its organisation and structure;
• b) the reputation and integrity of senior managers, members of the management body and qualifying shareholders;
•  A1
• c) the nature and complexity of the products and services provided and the type of transactions carried out;
•  O
• d) the delivery channels used, including the provision of services through non-face-to-face channels and the use of agents or intermediaries;
• e) the types of customers serviced by the subject of assessment and the level of risk associated with those customers, including customers that are politically-exposed persons (PEPs) and those assessed as presenting heightened ML/TF risk according to the subject of assessment ’s risk assessment methodology;
•  A1
• f) the geographical area of the business activities, in particular where they involve high-risk third countries¹⁴ , including, where applicable, the countries of origin or establishment of a significant part of the subject of assessment’s customers and the geographical links of its qualifying shareholders or beneficial owners;
•  O
• g) the authorisations, licensing or passporting by the subject of assessment.

¹⁴ EBA Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849, EBA/GL/2021/02.

In order to develop a good understanding of residual risk factors to which subjects of assessment are exposed, competent authorities should gather information from different sources that includes, but is not limited to, the information in respect of:

• a) the adequacy of mitigating measures put in place by a subject of assessment and in particular information
• i) relating to the adequacy of the risk-management framework, including the ML/TF risk management;
• ii) from the internal controls function reports, including internal audit, where relevant;
• iii) related to the prudential and general aspects of the subject of assessment’s business, such as years in operation, liquidity or capital adequacy;
• iv) findings from off-site reviews carried out by the competent authority, other relevant competent authority, prudential supervisors or other relevant supervisory authority, including AML/CFT authorities in third countries;
•  A1
• v) from advanced analytics tools and platforms where services of the subject of assessment are provided using DLT or blockchain technology.
•  O
• b) the effectiveness of mitigating measures put in place by a subject of assessment, in particular information in respect of:
• i) the quality of internal governance arrangements and structures, including the adequacy and effectiveness of internal audit and compliance functions, reporting lines, the level of compliance with AML/CFT legal and regulatory requirements and the effectiveness of the AML/CFT policies and procedures to the extent that these are already known;
• ii) the prevailing ‘corporate culture’, particularly the ‘compliance culture’ and the culture of transparency and trust in relations with the competent authorities;
• iii) findings from previous supervisory inspections carried out by the competent authority, other relevant competent authority, prudential supervisors or other relevant supervisory authority, including AML/CFT authorities in third countries that involve certain on-site elements and testing;
• iv) pending or imposed supervisory measures and sanctions related to the subject of assessment taken by the competent authority, prudential supervisors or other relevant supervisory authority, including in third countries;
• v) Information received from financial intelligence units, such as the information related to suspicious transactions reports.

Where competent authorities consider that the information gathered through sources described in paragraphs 30 and 31 is not available or is insufficient to develop a good understanding of risks associated with the subject of assessment, competent authorities should consider collecting such information directly from the subjects of assessment.

Where information for the individual risk assessment is gathered directly from subjects of assessment, competent authorities should ensure that the type of information requested is determined by the relevant domestic, foreign and sector-wide risk factors as set out in these guidelines, including emerging risks.

Competent authorities should consider adjusting the level and frequency of information requested from subjects of assessment based on the risk level associated with the sector or subsector to which the subject of assessment belongs. This means that information related to the sectors that are exposed to more significant levels of ML/TF risks may be collected more frequently than sectors with less significant levels of risk. When determining the level and frequency of the information requests, competent authorities should consider:

• a) whether some of the information requested is available to the competent authority from other sources, including prudential supervisors, to reduce the duplication of information requests;
• b) the purpose for which the information will be used. If the information is requested to inform the competent authority’s assessment of risks associated with a subject of assessment or the sector, then the competent authority should consider aligning the frequency of information requests with the frequency of updates to the risk assessment;
• c) whether there have been any significant changes to the level of ML/TF risk associated with the subject of assessment or the sector, which would indicate the need for more frequent information requests.