45. In order to develop a good understanding of residual risk factors to which subjects of …

In order to develop a good understanding of residual risk factors to which subjects of assessment are exposed, competent authorities should gather information from different sources that includes, but is not limited to, the information in respect of:

• a) the adequacy of mitigating measures put in place by a subject of assessment and in particular information
• i) relating to the adequacy of the risk-management framework, including the ML/TF risk management;
• ii) from the internal controls function reports, including internal audit, where relevant;
• iii) related to the prudential and general aspects of the subject of assessment’s business, such as years in operation, liquidity or capital adequacy;
• iv) findings from off-site reviews carried out by the competent authority, other relevant competent authority, prudential supervisors or other relevant supervisory authority, including AML/CFT authorities in third countries;
•  A1
• v) from advanced analytics tools and platforms where services of the subject of assessment are provided using DLT or blockchain technology.
•  O
• b) the effectiveness of mitigating measures put in place by a subject of assessment, in particular information in respect of:
• i) the quality of internal governance arrangements and structures, including the adequacy and effectiveness of internal audit and compliance functions, reporting lines, the level of compliance with AML/CFT legal and regulatory requirements and the effectiveness of the AML/CFT policies and procedures to the extent that these are already known;
• ii) the prevailing ‘corporate culture’, particularly the ‘compliance culture’ and the culture of transparency and trust in relations with the competent authorities;
• iii) findings from previous supervisory inspections carried out by the competent authority, other relevant competent authority, prudential supervisors or other relevant supervisory authority, including AML/CFT authorities in third countries that involve certain on-site elements and testing;
• iv) pending or imposed supervisory measures and sanctions related to the subject of assessment taken by the competent authority, prudential supervisors or other relevant supervisory authority, including in third countries;
• v) Information received from financial intelligence units, such as the information related to suspicious transactions reports.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související standardy

2. Identifikované požadavky

3. Související standardy

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/