4.5 Step 4 – Monitoring and updating of the RBS Model

The RBS is not a one ‐ off exercise, but an ongoing and cyclical process. Therefore, competent authorities should carry out periodic or ad hoc reviews of the information on which their risk assessment is based, and update this information as necessary.

As part of the cyclical process, competent authorities should review and update their sectoral and individual risk assessments of subjects of assessment regularly through periodic reviews or on an ad hoc basis.

Supervisory strategy and plans should also be updated as necessary, whether by establishing periodic reviews or as a response to external events. Supervisory strategy and plans should also reflect relevant changes to the risk assessments, in particular where emerging risks have been identified. Competent authorities should reflect the results of these reviews and updates as changes to the RBS.

• a. Periodic reviews

Competent authorities should carry out periodic reviews of their individual and sectoral risk assessments to ensure that they remain up to date and relevant. As part of this, it is important that competent authorities verify that the underlying assumptions supporting the risk assessment are still up to date, including assumptions related to the different level of risks posed by the relevant sectors and subjects of assessment or the understanding of the effectiveness associated with a certain supervisory tool.

The schedule of each review should be aligned with the supervisory strategy and commensurate with the ML/TF risk associated with the sector and the subject of assessment. For sectors and subjects of assessment that are exposed to significant or very significant ML/TF risks or those facing frequent changes in their activities and operating in a fast changing environment, reviews should take place more frequently.

• b. Ad hoc reviews

Ad hoc reviews of the risk factors, the risk assessment and, where necessary, the supervisory strategy and plans should take place following significant changes affecting the subject of assessment’s risk profile , including:

• a) emerging ML/TF risks;
• b) findings from off-site and on-site supervision and any follow-up of corrective or remedial actions taken by the subject of assessment;
• c) changes to, or new information emerging in relation to, owners of qualifying holdings, members of the management board or key function holders ’ operations or the organisation of the subject of assessment;
• d) amendments to the European Commission’s supranational risk assessment published in accordance with Article 6(1) of Directive (EU) 2015/849, national risk assessment or the supervisory risk assessment developed in line with these guidelines;
• e) new types of firms entering the sector or subsector;
• f) sudden changes within the sector or subsector, including changes to the customer base, services and products offered, delivery channels or exposure to certain geographic areas;
• g) new information that has emerged suggesting that the ML/TF risk exposure in respect of a specific subject of assessment or sector has increased;
• h) other situations where the competent authority has reasonable grounds to believe that information on which it had based its risk assessment is no longer relevant or has significant shortcomings.

Competent authorities should also consider whether changes affecting one particular subject of assessment might affect other subjects of assessment, and they should also review the risk assessment of those subjects of assessment, which are significantly affected by the change.

Where, as a result of the amended risk assessment the risk categories or scores have changed, competent authorities should ensure that their internal systems and supervisory manual are updated accordingly.

4.5.2 Review of the AML/CFT RBS Model

Competent authorities should seek to satisfy themselves that their internal processes and procedures, including their ML/TF risk assessment methodology, are up to date and are applied consistently and effectively. Competent authorities should review and update the methodology immediately, where necessary.

Where a review identifies issues with the AML/CFT RBS Model, competent authorities should take steps to address these. However, competent authorities should refrain from making repeated changes to their RBS Model within short time intervals, to facilitate comparisons over time.

Where competent authorities use automated scoring systems to carry out their risk assessment, they should review the cases in which the automated score was amended based on a professional judgement, which suggested that the allocated score did not accurately reflect the subject of assessment ’s risk profile. In such cases, competent authorities should examine whether the extent and frequency of such amendments may not be an indication of an error in the risk assessment methodology. If an error is identified, competent authorities should take the necessary steps to rectify it.

• a. Periodic reviews

Competent authorities should periodically review whether their AML/CFT RBS Model delivers the intended outcome and, in particular, whether the level of supervisory resources remains commensurate with the ML/TF risks identified. Competent authorities should use a variety of tools available to them when reviewing and assessing the adequacy and effectiveness of their AML/CFT RBS Model. These tools include, but are not limited to:

•  A1
• a) professional and technical expertise;
•  O
• b) self-assessment questionnaires ;
• c) sample testing of supervisory measures and actions;
• d) new information such as reports and feedback from other competent authorities or relevant AML/CFT authorities,
• e) feedback from financial intelligence units, law enforcement and other national agencies; or
• f) publications by relevant European or international organisations.

Competent authorities should also seek to familiarise themselves with international best practices and consider participating in relevant international and European forums when possible.

Measuring the impact of AML/CFT supervision on the level of compliance and the effectiveness of subjects of assessments’ AML/CFT controls may also help competent authorities assess the effectiveness of their AML/CFT RBS Model.

• b. Ad hoc reviews

In addition to regular reviews at fixed intervals, competent authorities should review, update or amend their AML/CFT RBS Model if its adequacy or effectiveness is called into question by events such as:

• a) External evaluations of the model, including by the FATF, Moneyval or external audits;
• b) Internal evaluations of the model, including an internal gap analysis, internal audit reports, quality assurance testing and ‘ lessons learned ’ exercises;
• c) Significant changes of the legislative or regulatory AML/CFT environment;
• d) Publication of relevant international guidance; and
• e) Emergence or identification of new risk factors.

4.5.3 Organisational and procedural aspects of the review process

Competent authorities should put in place an objective review process of their RBS Model, which is based on clear and transparent internal procedures. Such procedures should at least set out:

• a) when the revision is due or what events would trigger the review;
• b) what is the scope of the revision or how to determine the scope; and
• c) who in the competent authority is in charge of the revision process. Competent authorities should consider whether the team or person within the competent authority who was responsible for setting up the RBS Model should also be responsible for the review of the model or whether a different person or team, such as the competent authority’s internal quality assurance, internal audit or risk-management team should be responsible for the review.

In addition to the internal review process, competent authorities should consider whether it is necessary to engage an external expert to obtain an objective evaluation of its RBS Model or to ensure harmonisation on a national level with the models used by other competent authorities.

4.5.4 Record-keeping

Competent authorities should document the AML/CFT RBS Model, its implementation and subsequent reviews appropriately for its institutional (supervisory) memory and also to provide a record of outcomes and decisions and their underlying rationale to ensure that actions taken by competent authorities with regard to the different subjects of assessment are coherent and consistent.

4.5.5 Accountability

Senior management of the competent authorities should have an adequate understanding of the ML/TF risks present in the supervised sector and subsectors and be regularly informed on AML/CFT supervisory actions and their outcome. This is so they can judge the overall effectiveness of the measures implemented by the subjects of assessment to reduce these risks as well as the need to review, where appropriate, the intensity and frequency of the supervision and the allocation of supervisory resources.

Competent authorities’ senior management should ensure that there are a dequate governance arrangements put in place for approval of the supervisory strategy at a senior management level and any amendments thereafter and for monitoring the progress with the implementation of the AML/CFT supervisory strategy within the competent authority. In particular, they should ensure that the competent authority has sufficient resources to implement the strategy, including AML/CFT specialist, legal, policy and risk-specialist resources, and that its supervisory objectives set out in the strategy are fully fulfilled.