101. In the supervisory manual, competent authorities should outline the steps supervisors are …

In the supervisory manual, competent authorities should outline the steps supervisors are required to take when applying different supervisory tools. The manual should set out at least:

•  C1
• a) the process and methodology followed by competent authorities when assessing ML/TF risks associated with subjects of assessment and sectors/subsectors. Competent authorities should also explain the process followed by supervisors when they wish to amend the risk score of the subject of assessment based on their professional judgment;
•  C1
• b) possible instances where supervisors are required to cooperate with other stakeholders as described in Section 4.1.4. of these Guidelines and explain the process of how this cooperation should happen in practice;
•  O
• c) the process that should be followed by supervisors when carrying out each supervisory tool and explaining the elements that should be tested. Competent authorities should clearly set out the key differences between different supervisory tools available to them. This means that competent authorities should at least clarify the extent to which supervisors are expected to test in subjects of assessment:
•  A1
• i) the adequacy of relevant policies and procedures and whether they are linked to the business-wide risk assessment and whether these policies and procedures are reviewed and, if necessary, updated whenever the business-wide risk assessment changes;
•  O
• ii) that relevant processes have been put in place and that they operate as expected;
• iii) the adequacy and completeness of the business-wide risk assessments and to what extent it determines the overall AML/CFT approach;
• iv) the adequacy of customer risk assessments and the extent to which they determine the applicable level of customer due diligence requirements;
• v) the adequacy of internal governance arrangements and internal reporting lines, in respect of AML/CFT compliance, including the quality and quantity of management information;
• vi) the adequacy of the person performing the role of the AML/CFT compliance officer within the subject of assessment as defined in Article 8(4) of Directive (EU) 2015/849 and steps that supervisors should take to carry out this assessment;
• d) what type of engagements and communications should the supervisor have with the subject of assessment prior to, during and after the application of a particular supervisory tool;
• e) when communicating findings from inspections or reviews, indicative timeframes that should be observed by competent authorities and subjects of assessment;
• f) how to assess that AML/CFT systems and controls put in place by subjects of assessment are effective enough and commensurate with the ML/TF risks to which the subject of assessment is exposed. Competent authorities should at least set out the main areas on which the supervisor should focus, which may suggest the lack of effectiveness within the subject of assessment. Some indicators that may suggest that the AML/CFT framework is implemented effectively include, but are not limited to:
• vii) staff within the subject of assessment demonstrate good understanding of the parameters used for different systems and are able to explain the rationale for the outcomes from these systems;
• viii) systems and processes used to screen customers and transactions deliver the expected outcomes, which are in line with other similar subjects of assessment in a sector;
• ix) policies and processes to identify and analyse suspicious or unusual transactions and report to the FIU or other relevant authorities;
• x) staff at the subject of assessment demonstrate good understanding of AML/CFT policies and processes and how they are applied in practice;
• xi) various internal and external reports, such as internal and external audit or consultants, do not raise any concerns about the subject of assessment ’s AML/CFT compliance;
• xii) sufficient and relevant training is provided to all relevant staff and senior management within the subject of assessment;
• xiii) fair incentives practices, including remuneration and other rewards, have been implemented by the subject of assessment that do not directly or indirectly foster unsound work practices or culture;
• xiv) sufficient and adequate management reporting throughout all levels of management;
• xv) adequate governance arrangements have been put in place with a clear role of the senior management within the AML/CFT framework.
• g) the extent to which the supervisor is expected to challenge the robustness of AML/CFT systems and controls, the implementation of AML/CFT policies and procedures and the effectiveness of the business-wide risk assessment;
• h) examples of the type of situations where the supervisors are expected to apply their supervisory judgment;
• i) where a supervisory tool includes sampling of customer files or transactions, the manual should explain the sampling methodology, including the minimum sample size and criteria for selecting a sample;
• j) the steps that supervisors are required to take following the inspection to ensure that supervisory findings are adequately addressed by subjects of assessment and examples of instances in which a follow-up inspection may be necessary as set out in Section 4.4.8 of these Guidelines; and
• k) the governance arrangements within the competent authority for approval of the outcomes from inspections or reviews, including the decision-making process relating to sanctions and administrative measures.

101. A) When developing their sampling policy, competent authorities should be mindful that subjects of assessment differ in many ways, such as the number and type of products and services and the number and type of customers and transactions. This means that competent authorities may need to tailor their approach to sampling in relation to a particular subject of assessment. As part of this, competent authorities should consider at least the following criteria for selecting a meaningful sample:

• a) Sampling should help competent authorities to meet the objectives of a particular supervisory tool which is being used for the assessment. This means that a sample should be made up of a meaningful number of customer files or transactions that represent the diversity of customers, products and services in different risk categories, however the size and composition of that sample is determined by:
• i) the goal of the supervisory tool used for the assessment;
• ii) different risk categories of customers within the subject of assessment and the proportion of customers that represent significant or very significant ML/TF risk;
• iii) the nature, size and complexity of the subject of assessment ’s business.
• b) Checks performed as part of sampling should be sufficiently comprehensive and intrusive to enable the competent authority to achieve the desired supervisory goal.
• c) Sampling should be balanced against other supervisory activities that form part of the supervisory tool, such as reviewing systems, governance arrangements and policies and procedures.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související standardy

2. Identifikované požadavky

3. Související standardy

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/