4.4 Step 3 – Supervision

Competent authorities should ensure that subjects of assessment exposed to significant and very significant ML/TF risks are subject to more frequent and intrusive supervision than those exposed to moderately or less significant risks. Competent authorities should adjust their supervisory approach by adjusting one or more of the following elements:

• a) the nature of supervision, by adjusting the ratio between off-site and on-site supervisory tools;
• b) the focus of supervision, by focusing on the overall AML/CFT framework in place at subjects of assessment or by focusing on the management of specific ML/TF risks, including risks associated with particular products or services, or on specific aspects of the AML/CFT processes such as customer identification, risk assessment, ongoing monitoring and reporting activities;
• c) the frequency of supervision, by ensuring that subjects of assessment that are exposed to more significant ML/TF risks are supervised more frequently than those subjects of assessment that are exposed to less significant risks; and
• d) the intensity and intrusiveness of supervision, by determining, according to risk, the extent of customer file reviews, sample testing of transactions and suspicious transactions reports conducted on-site. Competent authorities should note that a review ba sed only on an assessment of policies and procedures, rather than on their implementation, is unlikely to be sufficient in situations where the exposure to ML/TF risk is more significant. 4.4.2 Supervisory strategy

Competent authorities should determine and implement a longer-term AML/CFT supervisory strategy where they set out how they will mitigate the ML/TF risks they have identified in all sectors and subsectors, where relevant, under their supervision. The strategy should be based on the sector-wide risk assessment carried out by competent authorities in accordance with Guideline 4.3.

In the strategy, competent authorities should set clear objectives for their approach to AML/CFT supervision and set out how these objectives will be achieved within a defined timeframe and with available resources. As part of this, a supervisory strategy should:

• a) explain how they will work to mitigate the existing ML/TF risks identified in the sectors and subsectors under their supervision;
• b) explain how they will ensure that adequate supervisory coverage and monitoring commensurate with the ML/TF risk is applied to all sectors and subsectors, including those associated with lower ML/TF risks. In particular, how they will ensure that sectors associated with more significant ML/TF risks will receive higher supervisory coverage;
• c) set out the type of supervisory tools that competent authorities will use to tackle which types of risks as described in Section 4.4.4. of these Guidelines;
• d) define cycles of supervisory inspections and reviews, if any, according to which subjects of assessment in each risk category will be supervised and determine the type of supervisory tools applicable in each cycle;
•  A1
• e) determine the supervisory resources necessary to implement the supervisory strategy and ensure that sufficient resources are available to them. When determining the necessary resources, competent authorities should also consider the technological resources they need to perform their functions effectively, in particular where technology is essential to how the specific sectors operate;
•  O
• f) explain how competent authorities will tackle and address emerging risks effectively when they arise in a way that does not have an adverse effect on the entire strategy.

4.4.3 AML/CFT supervisory plan

Competent authorities should determine and put in place a supervisory plan for all subjects of assessment, which explains how their supervisory strategy will be implemented in practice. Competent authorities should decide on the period of time covered by their supervisory plan, such as an annual or two-yearly supervisory plan, taking into account wider organisational constraints as appropriate.

Competent authorities should coordinate all supervisory plans that cover the entire time period covered by the supervisory strategy to ensure balance between them and that together they serve to implement the supervisory strategy. This means that where the supervisory strategy is set for a 5-year period but the supervisory plans are developed annually, competent authorities should ensure that all annual plans together over the 5-year period fulfil the strategy.

In the supervisory plan, competent authorities should clearly set out the supervisory tools that they will apply to subjects of assessment to achieve their objectives in line with their strategy. Competent authorities should use risk assessments of individual subjects of assessment to fine-tune their choice of supervisory tools for a specific subject of assessment targeting risks specific to that subject of assessment.

Competent authorities should set out in the plan how they will allocate supervisory resources to subjects of assessment in a way that is commensurate with the subjects of assessment ’s risk profile developed in line with Guideline 4.3.

Competent authorities should recognise that subjects of assessment exposed to significant or very significant levels of ML/TF risk may not be systemically important. Therefore, when deciding on the most appropriate AML/CFT supervisory tools, competent authorities should refer to their ML/TF risk assessment and should not rely on their prudential or conduct risk assessments, where available, nor should they consider only systemically important subjects of assessment. Competent authorities should note that it may not be appropriate to draw conclusions for AML/CFT supervisory purposes from the level of prudential or conduct risk.

Competent authorities should ensure that the AML/CFT supervisory plan is independent from the prudential supervisory plan; although, at times, there might be overlaps in the subjects of assessment inspected by competent authorities and prudential supervisors, and joint or supplementary supervisory tools may be applied. However, competent authorities are responsible for ensuring that the AML/CFT supervisory objectives are fully met as a result of these actions.

When developing the AML/CFT supervisory plan, competent authorities should ensure that they provide for contingencies in cases where new risks are identified in the course of on ‐ site or off ‐ site supervision or through other reliable sources, which require competent authorities to respond in an appropriate and timely fashion.

Where competent authorities are required to make amendments to the initial AML/CFT supervisory plan, such as changing from off-site to on-site supervision or from thematic reviews to full scope inspections, to adapt to the new circumstance or to tackle the emerging ML/TF risks, they should have appropriate internal governance arrangements in place when processing such changes to the supervisory plan. All such changes should be adequately documented by competent authorities, explaining how and when the supervision of those subjects of assessment affected by changes to the plan will be carried out. 4.4.4 Supervisory tools

Competent authorities should recognise that each subject of assessment, sector and subsector is exposed to different levels of ML/TF risk and, therefore, the type and frequency of supervisory tools used may differ between them. To ensure efficient use of supervisory resources, competent authorities should choose such supervisory tools likely to have a greater impact on the subjects of assessment ’s compliance, or allow them to cover a larger part of a sector. Where competent authorities are looking to develop a better understanding of the way specific ML/TF risks are managed by a sector, or particular types of subjects of assessment, they should consider using thematic reviews to achieve this.

Competent authorities should have a good understanding of all supervisory tools available to them to implement their supervisory strategy and plan. They should develop an understanding of the advantages and disadvantages associated with each supervisory tool, including the level of intrusiveness and intensity they could achieve with each of the supervisory tools, and consider how they can use the widest range of supervisory tools at their disposal effectively, including, but not limited to, full scope or partial on-site inspections, ad hoc inspections, thematic inspections, AML/CFT returns, follow-up inspections, off-site reviews, as well as the feedback and guidance to the sector.

Competent authorities should select the most effective supervisory tools for subjects of assessment to address a specific supervisory need or objective. When selecting supervisory tools, competent authorities should refer to their sectoral and individual ML/TF risk assessments and should also consider:

• a) the number of subjects of assessment and sectors under the competent authority’s supervision;
• b) specific features of different supervisory tools when applied on their own or in combination with each other;
• c) the resources needed to apply different supervisory tools;
• d) the time needed for the supervisory tool to achieve its purpose and to have an impact on the subjects of assessment ’s AML/CFT compliance.

Competent authorities should exercise flexibility to be able to adapt their use of supervisory tools also in response to emerging ML/TF risks within the subject of assessment, sector or subsector as they arise. This means that where competent authorities have identified an emerging ML/TF risk, either through AML/CFT returns, other supervisory tools or other means, they should consider whether a further and more intrusive assessment through an off-site review or an on-site inspection may be necessary to ensure that the subjects of assessment ’s systems and controls are sufficiently robust to mitigate the emerging risk. Therefore, on-site inspections allow competent authorities to:

• a) develop a deeper understanding of the subject of assessment ’ s overall approach towards AML/CFT, including practices, governance, staff behaviours and culture;
• b) discuss potential risks, the results of supervisory activities, as well as problems which the subject of assessment might be facing and ways to solve them;
• c) communicate their supervisory expectations directly to subjects of assessment.

Either on their own or in combination with other supervisory tools, competent authorities should consider using on-site inspections, in particular, when supervising subjects of assessment that present a significant and very significant level of ML/TF risk. These inspections include, at least, a review of subjects of assessment ’s AML/CFT policies and procedures and an assessment of how they are implemented in practice through, inter alia, interviews with key personnel, testing of systems used in the AML/ CFT compliance and a review of the risk assessment and customer files. Based on the scope and complexity of the subjects of assessment ’s business, competent authorities should consider whether the full scope on-site inspection will cover the entire business of the subject of assessment or whether it is more feasible to focus on a specific business line within the subject of assessment. Although, where the scope is limited to a specific business line, competent authorities should develop an understanding of the touch points between the systems and controls applied within that business line and those applied in the wider institution and, where weaknesses in the business line’s systems and controls are identified, competent authorities should seek to assess whether and how this may have an impact on the entire subject of assessment.

When deciding whether to carry out a full-scope on-site inspection at the subject of assessment, competent authorities should consider the following factors:

• a) whether there is a need to obtain additional or more comprehensive information on the subject of assessment that may be obtained only through on-site elements;
• b) what type of information is needed and how to obtain it effectively and in a comprehensive manner;
• c) whether the outcomes of previous on-site inspections or off-site reviews carried out either by the competent authority or relevant prudential supervisors or, where the subject of assessment is part of a group, by competent authorities responsible for the supervision of other entities within the group, if available, show poor levels of AML/CFT compliance or suggest poor compliance culture within the subject of assessment or within the group, which may have an impact on the subject of assessment;
• d) whether subjects of assessment have previously breached their AML/CFT obligations and whether they have done so repeatedly;
• e) what type of supervisory follow-up, if any, was previously applied by the competent authority to the subject of assessment; and
• f) whether subjects of assessment have previously demonstrated their commitment to fix the shortcomings and whether they have taken robust action to do so.

Competent authorities should consider using off-site reviews in those instances where a less intrusive supervisory approach might be sufficient, or in cases where subjects of assessment are exposed to low levels of ML/TF risk. Off-site reviews primarily involve a desk-based review of the subjects of assessment’s written AML/CFT policies and procedures and the risk assessment, but does not involve an in-depth assessment of how effectively these policies and procedures have been implemented in practice by the subject of assessment. Off-site reviews may also be considered as a preliminary step to more thorough reviews through on-site inspections that would complement off-site work, or may be used in combination with other supervisory tools.

•  A1

In some instances, competent authorities should consider whether the combination of two or more tools may be more effective. This includes situations where the competent authority is concerned about the accuracy of information received during off-site reviews or as part of AML/CFT returns. In such circumstances, it may be necessary for competent authorities to verify this information through an on-site inspection, which generally contains such elements as sampling of transactions and customer files, and interviews with key personnel and members of the management body. Competent authorities should be able to carry out ad hoc inspections when necessary, which do not form part of their supervisory strategy and plan. The need for such inspections may be triggered by a specific event, which may expose the sector/subsector or subjects of assessment to an increased ML/TF risk, or by significant changes in the ML/TF risk exposure of the sector/subsector or subjects of assessment, or may happen as a result of discovery of certain information by the competent authority, including through whistleblowing reports, widespread public allegations of wrongdoing, information from other public domestic or foreign authorities, a new ML/TF typology or supervisory findings relating to AML/CFT systems and controls or a wider internal controls framework. Where the competent authority has decided that an ad hoc inspection is warranted, it should determine the scope of the inspection, the focus of the inspection and whether it will involve any on-site elements, and if there is a need to involve and cooperate with other supervisors.

•  O

Where competent authorities undertake an inspection remotely through virtual means, they should consider the effectiveness of this supervisory tool and whether the engagement with the subject of assessment meets the conditions for an on-site inspection and is commensurate with the ML/TF risk presented by the subject of assessment. Competent authorities should consider whether an on-site inspection is more appropriate when supervising subjects of assessment that present a significant or very significant level of ML/TF risk and in circumstances where competent authorities are looking to develop a deep understanding of the overall AML/CFT systems and controls framework within the subject of assessment.

Competent authorities should consider the most effective supervisory tool to ensure that group-wide policies and procedures are implemented effectively by subjects of assessment, which are part of the group by applying similar considerations to those applicable to individual subjects of assessment as explained above. If a group is operating on a cross-border basis, the lead supervisor¹⁷ should cooperate with other competent authorities involved in the supervision of subjects of assessment within the group through AML/CFT colleges, where they exist, or through other channels and cooperation mechanisms, including those set out in the EBA’s Cooperation Guidelines.¹⁸ This cooperation may consist of, but is not limited to:

• a) the extent of mutual assistance described in Guideline 9 of the AML/CFT Colleges Guidelines;
• b) agreeing to apply a particular supervisory tool or supervisory action with other competent authorities, which are responsible for the supervision of other subjects of assessment within the group. This may involve carrying out an inspection or a review jointly with other competent authorities or by jointly adjusting the focus of a supervisory tool to mitigate risks that are cross-cutting across the group more effectively;
• c) exchanging information relating to the ML/TF risk assessment of the subject of assessment or the sector, if relevant;
• d) exchanging information related to planned supervisory inspections or reviews and on relevant findings thereafter;
• e) exchanging information related to weaknesses or breaches identified by other competent authorities.

¹⁷ The lead supervisor is determined in accordance with the ESAs joint guidelines (JC 2019 81) on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (‘the AML/CFT Colleges Guidelines’). In general, the lead supe rvisor is a competent authority that is responsible for the AML/CFT supervision in a Member State where the head office of the group is located.

¹⁸ EBA Guidelines on Cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Article 117(6) of Directive 2013/36/EU, December 2021

Competent authorities should have a holistic view of all supervisory tools applied by them. They should monitor their implementation and effectiveness and make adjustments where necessary.

4.4.5 Supervisory practices and the supervisory manual

To meet their obligations under Directive (EU) 2015/849, competent authorities should ensure that subjects of assessment have put in place robust AML/CFT systems and controls and that these systems and controls are sufficiently effective to prevent and detect ML/TF. The steps competent authorities take to assess subject of assessment s’ AML/CFT systems and controls should be set out in a dedicated AML/CFT supervisory manual. This allows competent authorities to ensure the application of the supervisory tools and professional judgment in a consistent way. When drafting the manual, competent authorities should ensure that it provides sufficient details of all the activities relevant supervisors are required to undertake to carry out supervision effectively, however it should also provide supervisors with sufficient flexibility to apply their expert judgement and make adjustments to the supervisory approach as necessary.

Competent authorities should ensure that, where relevant, subjects of assessment appoint AML/CFT compliance officers in accordance with Article 8(4) of Directive (EU) 2015/849. Competent authorities should also take risk-sensitive steps to check whether the AML/CFT compliance officer appointed by a subject of assessment has or continues to have the necessary levels of integrity, expertise and knowledge to fulfil its functions effectively.¹⁹ This may include a meeting with the AML/CFT compliance officer or requesting the subject of assessment to provide a summary of the AML/CFT compliance officer’s professional expertise and any other information deemed relevant by the competent authority. Competent authorities should consider whether to carry out such an assessment as part of their supervisory activities, including during on-site inspections or off-site reviews, or as a stand-alone assessment.

¹⁹ Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer under Article 8 and Chapter VI of Directive (EU) 2015/849.

Where, as a result of checks described in paragraph 99, the competent authority is concerned that the AML/CFT compliance officer may not be suitable, the competent authority should notify the relevant prudential supervisor²⁰ of their concerns and should proactively share with prudential supervisors any information that has given rise to these concerns. Furthermore,

• a) where the assessment of the suitability of the AML/CFT compliance officer is not within the competence of a prudential supervisor, competent authorities should apply the necessary measures to remedy the issue without undue delay, such as a request for the AML/CFT compliance officer to undergo additional training or an enhancement of professional qualifications; a request for an enhanced management or the reorganisation of the AML/CFT compliance officer’s role ; or a request for the replacement or an additional AML/CFT compliance officer to be appointed;
• b) where prudential supervisors are competent for assessing the suitability of the AML/CFT compliance officer,²¹ competent authorities should cooperate with prudential supervisors during the initial assessment and also during any reassessments of suitability by prudential supervisors as necessary.²² Competent authorities should share all relevant information, which may have an impact on the suitability assessment or reassessment of the AML/CFT compliance officer, with relevant prudential supervisors, including their proposed recommendations of measures, as described in point a) above, that could be taken from an AML/CFT supervisory perspective to mitigate the issues.

²⁰ In accordance, in particular, with paragraph 19 of the EBA Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU.  O

²¹ Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU, EBA/GL/2021/06.

²² Including as envisaged in Sections 6.1 and 6.3 of the forthcoming EBA Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU

In the supervisory manual, competent authorities should outline the steps supervisors are required to take when applying different supervisory tools. The manual should set out at least:

•  C1
• a) the process and methodology followed by competent authorities when assessing ML/TF risks associated with subjects of assessment and sectors/subsectors. Competent authorities should also explain the process followed by supervisors when they wish to amend the risk score of the subject of assessment based on their professional judgment;
•  C1
• b) possible instances where supervisors are required to cooperate with other stakeholders as described in Section 4.1.4. of these Guidelines and explain the process of how this cooperation should happen in practice;
•  O
• c) the process that should be followed by supervisors when carrying out each supervisory tool and explaining the elements that should be tested. Competent authorities should clearly set out the key differences between different supervisory tools available to them. This means that competent authorities should at least clarify the extent to which supervisors are expected to test in subjects of assessment:
•  A1
• i) the adequacy of relevant policies and procedures and whether they are linked to the business-wide risk assessment and whether these policies and procedures are reviewed and, if necessary, updated whenever the business-wide risk assessment changes;
•  O
• ii) that relevant processes have been put in place and that they operate as expected;
• iii) the adequacy and completeness of the business-wide risk assessments and to what extent it determines the overall AML/CFT approach;
• iv) the adequacy of customer risk assessments and the extent to which they determine the applicable level of customer due diligence requirements;
• v) the adequacy of internal governance arrangements and internal reporting lines, in respect of AML/CFT compliance, including the quality and quantity of management information;
• vi) the adequacy of the person performing the role of the AML/CFT compliance officer within the subject of assessment as defined in Article 8(4) of Directive (EU) 2015/849 and steps that supervisors should take to carry out this assessment;
• d) what type of engagements and communications should the supervisor have with the subject of assessment prior to, during and after the application of a particular supervisory tool;
• e) when communicating findings from inspections or reviews, indicative timeframes that should be observed by competent authorities and subjects of assessment;
• f) how to assess that AML/CFT systems and controls put in place by subjects of assessment are effective enough and commensurate with the ML/TF risks to which the subject of assessment is exposed. Competent authorities should at least set out the main areas on which the supervisor should focus, which may suggest the lack of effectiveness within the subject of assessment. Some indicators that may suggest that the AML/CFT framework is implemented effectively include, but are not limited to:
• vii) staff within the subject of assessment demonstrate good understanding of the parameters used for different systems and are able to explain the rationale for the outcomes from these systems;
• viii) systems and processes used to screen customers and transactions deliver the expected outcomes, which are in line with other similar subjects of assessment in a sector;
• ix) policies and processes to identify and analyse suspicious or unusual transactions and report to the FIU or other relevant authorities;
• x) staff at the subject of assessment demonstrate good understanding of AML/CFT policies and processes and how they are applied in practice;
• xi) various internal and external reports, such as internal and external audit or consultants, do not raise any concerns about the subject of assessment ’s AML/CFT compliance;
• xii) sufficient and relevant training is provided to all relevant staff and senior management within the subject of assessment;
• xiii) fair incentives practices, including remuneration and other rewards, have been implemented by the subject of assessment that do not directly or indirectly foster unsound work practices or culture;
• xiv) sufficient and adequate management reporting throughout all levels of management;
• xv) adequate governance arrangements have been put in place with a clear role of the senior management within the AML/CFT framework.
• g) the extent to which the supervisor is expected to challenge the robustness of AML/CFT systems and controls, the implementation of AML/CFT policies and procedures and the effectiveness of the business-wide risk assessment;
• h) examples of the type of situations where the supervisors are expected to apply their supervisory judgment;
• i) where a supervisory tool includes sampling of customer files or transactions, the manual should explain the sampling methodology, including the minimum sample size and criteria for selecting a sample;
• j) the steps that supervisors are required to take following the inspection to ensure that supervisory findings are adequately addressed by subjects of assessment and examples of instances in which a follow-up inspection may be necessary as set out in Section 4.4.8 of these Guidelines; and
• k) the governance arrangements within the competent authority for approval of the outcomes from inspections or reviews, including the decision-making process relating to sanctions and administrative measures.

101. A) When developing their sampling policy, competent authorities should be mindful that subjects of assessment differ in many ways, such as the number and type of products and services and the number and type of customers and transactions. This means that competent authorities may need to tailor their approach to sampling in relation to a particular subject of assessment. As part of this, competent authorities should consider at least the following criteria for selecting a meaningful sample:

• a) Sampling should help competent authorities to meet the objectives of a particular supervisory tool which is being used for the assessment. This means that a sample should be made up of a meaningful number of customer files or transactions that represent the diversity of customers, products and services in different risk categories, however the size and composition of that sample is determined by:
• i) the goal of the supervisory tool used for the assessment;
• ii) different risk categories of customers within the subject of assessment and the proportion of customers that represent significant or very significant ML/TF risk;
• iii) the nature, size and complexity of the subject of assessment ’s business.
• b) Checks performed as part of sampling should be sufficiently comprehensive and intrusive to enable the competent authority to achieve the desired supervisory goal.
• c) Sampling should be balanced against other supervisory activities that form part of the supervisory tool, such as reviewing systems, governance arrangements and policies and procedures.

Competent authorities ’ sampling policy should be flexible and allow for adjustments based on the level of risk or new information, including information obtained as part of their supervisory activities. This means that competent authorities may change the size of the sample, the categories of customers, products, services or transactions included in the sample or the specific checks performed prior to or during the inspection or review. Where sampling suggests a systemic failure to comply with the applicable AML/CFT obligations on behalf of the subject of assessment, competent authorities should investigate the root cause of this failure, which may involve further checks or supervisory activities, including additional sampling or interviews with key personnel.

The supervisory manual should be reviewed regularly and updated when necessary, in particular, if there have been significant changes that may have an impact on the supervisory approach, including changes introduced by the legal framework or international guidance, or changes required as a result of the feedback received by competent authorities on the adequacy of its supervisory approach, including from an internal audit function or external bodies like the Financial Action Task Force, the Council of Europe or the European Supervisory Authorities. As a result of this review, competent authorities should take stock of lessons learnt and address any shortcomings identified, if any. Relevant supervisors should be made aware of any changes to the manual without delay.

4.4.6 Quality assurance

Competent authorities should ensure that AML/CFT supervision is carried out consistently by all supervisors. Therefore, they should put in place quality assurance checks to ensure the consistent application of supervisory tools and practices by all supervisors in line with the supervisory manual. Such checks should include, at least, a review by the internal audit function and an application of a four-eye principle. Competent authorities should also make use of staff training, mentoring and work shadowing between supervisors as other means of achieving supervisory consistency.

Competent authorities should ensure the accuracy and reliability of information gathered from subjects of assessment for the purposes of the risk assessment or other supervisory tools. To ensure this, competent authorities should at least cross-check this information against the information already available to them in respect of the specific subject of assessment or similar subjects of assessment or against the information received from other reliable sources, including prudential supervisors, other competent authorities or financial intelligence units.

Where competent authorities have identified that the information provided by one or more subjects of assessment appears to be inaccurate or incomplete, they should take steps to clarify these inconsistencies and seek to obtain accurate information. In such circumstances, competent authorities should consider the most adequate supervisory action to address the issue based on the extent and type of inaccuracies identified. The actions may include requesting clarifications directly from the subject of assessment, carrying out an ad hoc inspection on the subject of assessment or imposing certain supervisory measures.

Competent authorities should consider the resources required when designing and carrying out the necessary quality assurance checks. In some instances, it may be necessary to involve certain specialised resources from IT or other fields.

4.4.7 Use of services of external parties

Where competent authorities use services of external consultants or auditors to carry out their supervisory plan, some parts of the plan or a specific supervisory task, they should always ensure that these external parties:

• a) have sufficient knowledge and skills to carry out the specific supervisory tasks for which they are engaged by competent authorities;
• b) have a clear understanding of regulatory expectations and the scope of work they are required to carry out;
• c) have access to specific guidance that clearly sets out the terms of their involvement, as well as any processes that they are required to follow as part of their engagement;
• d) keep sufficient records detailing the steps they have taken to carry the required tasks and explaining the rationale for their conclusions and findings;
• e) carry out the required tasks to a high-quality standard. This may involve competent authorities reviewing other work carried out by the external party or participating in some of the activities carried out by them on behalf of the competent authority;
• f) declare any potential conflicts of interest and, if it transpires that conflicts of interest exist, competent authorities should ensure that they are adequately managed and resolved. Where it is not possible to resolve the conflicts of interest, competent authorities should refuse or terminate the engagement with the specific external party.

Where competent authorities use experts consistently as part of their supervisory process, they should reflect this in the supervisory plan and manual.

Competent authorities should ensure that they maintain sufficient in-house expertise to be able to review and sufficiently challenge, if necessary, the work carried out by external parties on their behalf.

In situations where external auditors or consultants are engaged by subjects of assessment to carry out an assessment of their compliance with AML/CFT obligations, either on their own initiative or upon request by competent authorities, competent authorities should ensure that they are:

• a) notified of the scope of the review carried out by the external parties;
• b) notified of the skills, knowledge and experience of experts employed by the external parties who will carry out the assessment; and
• c) updated regularly on the outcomes and findings of the experts’ work, including where the experts consistently report the absence of weaknesses or findings.

Competent authorities should consider the work of external parties, and should reflect on it in their supervisory follow-up or as part of their ongoing supervision as necessary. Competent authorities should analyse the reasons for any discrepancies identified between the work of experts from external parties and their own findings from supervisory inspections or reviews and reflect this analysis in their risk assessment of the subject of assessment. If competent authorities have doubts about the overall quality of work carried out by experts from external parties as described in paragraphs 108 and 111, competent authorities should consider including a review of this work as part of their future inspections or reviews within the subject of assessment.

Competent authorities should ensure that there are gateways in place to ensure that experts from external parties are able to report any irregularities, weaknesses or breaches within the subject of assessment directly to competent authorities, if necessary, regardless of whether their services are engaged by competent authorities or by subjects of assessment.

4.4.8 Supervisory follow-up

Competent authorities should be confident that all breaches or weaknesses in subjects of assessment’s AML/CFT systems and controls framework are adequately addressed and effectively remediated by subjects of assessment. Competent authorities should take all necessary steps to ensure that subjects of assessment ’ s behaviours or activities change or discontinue.

When deciding on the most effective supervisory follow-up, competent authorities should choose supervisory tools or measures that are proportionate to the materiality of weaknesses and seriousness of breaches identified and take into consideration the level of risk to which the subject of assessment is exposed. This means that serious breaches and material weaknesses²³ identified in a subject of assessment, which is exposed to significant or very significant ML/TF risk, will require more intense follow-up and more supervisory resources than less serious breaches or non-material weaknesses in less significant risk subjects of assessment. For example, in the most serious cases, competent authorities may carry out a follow-up inspection to ensure that all weaknesses are mitigated effectively and potentially consider a sanction, whereas in less serious cases, it may be sufficient to receive the confirmation from the subject of assessment that issues have been addressed in accordance with the remediation plan proposed by them.

²³ For more details on how to determine the materiality of weaknesses, refer to the Regulatory Technical Standards developed by the EBA under Article 9a of the EBA Regulation.

When determining the most effective supervisory follow-up in accordance with paragraphs 114 and 115 above, competent authorities should consider at least:

• a) whether, after the implementation of the remediation plan proposed by a subject of assessment to the competent authority, all breaches and weaknesses will be addressed and remediated effectively. Competent authorities should be satisfied with the timeline proposed by the subject of assessment for when the remediation will be complete, and they should challenge the subject of assessment where the timeline is unrealistic or where the proposed actions are not sufficiently robust to remediate specific weaknesses;
• b) whether to use one or a combination of supervisory tools, supervisory measures or sanctions to ensure that breaches and shortcomings within the subject of assessment are addressed and remediated in a most effective and timely manner;
• c) the urgency of remediation as some breaches or weaknesses may require more urgent action by subjects of assessment, which means that competent authorities should ensure that sufficient priority is given by the subject of assessment to remediate these shortcomings;
• d) the length of time required to remediate specific breaches or shortcomings and where the remediation may take a long time, the subject of assessment should put in place adequate temporary measures to mitigate the risk;
• e) the probability of a repeat or systemic breach or weakness, which may be assessed by looking at the previous failures within the subject of assessment and the length of time for which the subject of assessment failed to implement effective systems and controls, the competent authority’s follow-up should focus not just on fixing one specific issue but on ensuring the discontinuation of the systemic failure by the subject of assessment;
• f) potential impact of the breach or weakness on the wider internal controls framework within subjects of assessment, which may require an engagement with prudential supervisors in accordance with the EBA’s Cooperation Guidelines²⁴ and a possible follow-up action also from a prudential perspective;
• g) the subject of assessment’s ability and willingness to remediate failures identified by competent authorities, including the extent to which the key function-holders and senior management within the subject of assessment are involved in the remediation process.
•  A1

²⁴ EBA Guidelines on Cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Article 117(6) of Directive 2013/36/EU, December 2021

Where competent authorities have suspicions that the failure to implement effective systems and controls may be deliberate, they should consider a more robust follow-up action, which would ensure an immediate cessation of such behaviour by the subject of assessment. In such circumstances, competent authorities should cooperate with and exchange information on and, where necessary, coordinate actions with respect to the subject of assessment’s failures with prudential supervisors.

•  O

Competent authorities should formalise their supervisory follow-up process and set it out in their supervisory manual, while allowing sufficient flexibility for the supervisory judgement. Competent authorities should establish a timeline and a description of the concrete supervisory follow-up actions and measures to be taken by the subject of assessment to address each breach or weakness.

Where competent authorities have identified that subjects of assessment have failed to implement their group-wide policies and procedures effectively in all parts of the group in accordance with Article 45(1) of Directive 2015/849 and that their systems and controls are not sufficiently robust to mitigate the risk to which the group is exposed in different jurisdictions, the competent authority should take the necessary steps to ensure that:

• a) subjects of assessment have put in place a remediation plan at a group level setting out how they will remediate the identified weaknesses in different jurisdictions;
• b) they cooperate with other competent authorities involved in the supervision of the group entities without delay, either through AML/CFT colleges or through other cooperation mechanisms, to ensure that they are aware of these weakness; and
• c) they cooperate with other competent authorities and, potentially, prudential supervisors to decide on the most appropriate follow-up action, either at a group or individual entity level, as necessary. Such follow-up may involve, among other supervisory tools, a joint on-site inspection or a common approach between different competent authorities.

While the supervisory follow-up process is separate from the sanctioning process, the two processes are not mutually exclusive and should supplement each other. Therefore, irrespective of the sanctions to be imposed on a subject of assessment, competent authorities should closely follow-up to ensure that breaches and shortcomings are sufficiently remediated.

Without regard to the provisions in these guidelines, competent authorities should report any material weaknesses to the European Banking Authority in accordance with the draft regulatory technical standards under Article 9a of Regulation (EU) No 1093/2010.

4.4.9 Feedback to the sector

• a. Feedback on risk assessments

Competent authorities should provide feedback to subjects of assessment on the outcomes of their sectoral risk assessment. Competent authorities should disclose at least:

• a) the key risks they have identified in each sector and sub-sector;
• b) their assessment of these risks; and
• c) any other information that may enhance subjects of assessment’s understanding of risks and enhance their business-wide and individual risk assessments.

Where competent authorities decide to provide subjects of assessment with a redacted version of their sectoral or subsectoral risk assessment, they should ensure this contains sufficient and meaningful information to enable subjects of assessment to use this information when developing their own risk assessments.

• b. Guidance to the sector

Competent authorities should issue the necessary guidance to subjects of assessment explaining how they expect subjects of assessment to implement the risk-based approach in practice and what they are expected to do to comply with their AML/CFT obligation. Competent authorities should use relevant guidelines published by the European Supervisory Authorities as a basis for their guidance, supplementing them with specific features at a national level.

Competent authorities should also assess the need for further guidance in the sector. Competent authorities should assess the level of AML/CFT knowledge and expertise in their sector based on reoccurring issues, emerging risks or other concerns arising from their analysis of information gathered for the risk assessment, findings from inspections, including thematic reviews, and from other engagements with the sector, including trade associations. Some of the indicators that may suggest that further guidance may be needed, include but are not limited to:

• a) repeated failures by subjects of assessment to comply with certain AML/CFT obligations;
• b) recent changes in the legislative framework at the national or EU level that may have an impact on subjects of assessment’s ability to comply with their AML/CFT obligations;
• c) evidence of de-risking in some sectors or subjects of assessment, or evidence that subjects of assessment avoid risks rather than manage them effectively;
• d) repeated questions addressed to competent authorities or requests for guidance on certain aspect of the AML/CFT framework;
• e) emergence of new ML/TF risks and typologies;
•  A1
• f) concerns about the quality and usefulness of suspicious transaction reports.
•  O

Competent authorities should assess whether guidance may be needed for the sector as a whole or specifically for a particular subsector or cover a specific topic. Competent authorities should ensure that guidance provided by them is clear and unambiguous as well as:

•  A1
• a) facilitates and supports the implementation, by subjects of assessment, of an effective risk-based approach, including through the publication of best practices identified in the sector;
• b) does not directly or indirectly foster or condone unwarranted de-risking of entire categories of customers in accordance with the Guidelines on policies and controls for the effective management of money laundering and terrorist financing (ML/TF) risks whe n providing access to financial services under Directive (EU) 2015/849 and the EBA’s ML/TF Risk Factor Guidelines and in particular guidelines 4.9., 4.10. and 4.11²⁵ ;
• c) where multiple competent authorities are responsible for the AML/CFT supervision of subjects of assessment in the same sector in the Member State, these competent authorities should coordinate their actions and consider issuing joint guidance to set consistent expectations. Competent authorities should consider whether other authorities may be responsible for issuing guidance on related matters and, if so, coordinate with those authorities as appropriate.

²⁵ EBA Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849, EBA/GL/2021/02.

Competent authorities should consider engaging with subjects of assessment and other relevant stakeholders when developing supervisory guidance and should determine the most effective way for this outreach. The engagement may include, among other things, a public consultation process, engagement with the sector, in particular where a sector is new to regulation or supervision, engagement with trade associations, financial intelligence units, law enforcement, other competent authorities or government agencies, or participation in consultative forums. Competent authorities should ensure that the outreach includes a sufficient proportion of stakeholders who will be impacted by the guidance and that sufficient time is allocated for stakeholders to communicate their views.

Competent authorities should periodically assess the adequacy of their existing guidance provided to the sector, in particular where a sector is new to regulation or supervision. Such an assessment should be done regularly or on an ad hoc basis, and may be triggered by certain events, including changes in the national or European legislation or amendments to the national or supranational risk assessment, or may be based on the feedback from the sector. Where competent authorities determine that the existing guidance is no longer up to date or relevant, they should communicate the necessary amendments to the sector without undue delay.

•  O
• c. Communication with the sector

Competent authorities should put in place and apply a communication strategy to ensure that their communications with subjects of assessment remain focused on improving AML/CFT compliance in the sector or certain subsectors and to ensure the most effective use of competent authorities’ resources. As part of their communication strategy, competent authorities should set out how they will communicate with different stakeholders, including when communicating the outcomes of their risk assessment and relevant guidance to the sector.

Competent authorities should identify the most adequate and effective communication tools available to them, which allow them to communicate their regulatory expectations to the relevant stakeholders in a clear and constructive manner. These tools may include, but are not limited to:

• a) simultaneous communication with all subjects of assessment, which may include a publication on the competent authority’s website or through other online channels;
• b) communication to a limited group of stakeholders, which may include the competent authority’s participation at various conferences or training events or through an outreach to trade and professional associations;
• c) communication through letters or circulars, which may be addressed to the sector as a whole or relevant groups of stakeholders; or
• d) direct communication with subjects of assessment either on a bilateral or multilateral basis, including public consultations. Where the competent authority communicates bilaterally, it should consider the relevance of this communication for a wider group of stakeholders, which may indicate that a potentially different communication tool may be more adequate.

When deciding on the most appropriate tools for communication, the competent authorities should consider at least the following elements:

• a) the target audience of the communication, which may determine the granularity of the communication;
• b) the relevance of a specific topic for a particular group of stakeholders, the sector or the market as a whole;
• c) the timing and urgency of the communication, ensuring that the required information is made available to subjects of assessment in a timely manner; and
• d) the type of information that is being communicated.

4.4.10 Training of competent authority’s staff

Competent authorities should ensure that staff with direct or indirect AML/CFT responsibilities have appropriate knowledge and understanding of the applicable legal and regulatory AML/CFT framework and are suitably qualified and trained to exercise sound supervisory judgement.

•  A1

Competent authorities should develop a training programme, which should be adjusted to meet the needs of specific functions within the competent authority, taking into account the characteristics of the sectors under their supervision, their job responsibilities, seniority and experience of staff. Competent authorities should keep this training programme up to date and review it regularly to ensure that it remains relevant.

Competent authorities should ensure that the training provided is sufficiently comprehensive so that relevant staff have adequate technical expertise for the supervision of the subjects of assessment. If necessary, competent authorities should engage an external training provider.

Competent authorities should monitor the level of training completed by individual staff members or entire teams as appropriate.

133. A) Where competent authorities use services of external parties to carry out (some parts of) their supervisory plan or a specific supervisory task as referred to in Section 4.4.7, or otherwise delegate supervisory tasks to other supervisory authorities, competent authorities should also consider including any such external party within their training programme.

•  O

Competent authorities should ensure that their supervisory staff are trained in the practical application of the competent authorities’ AML/CFT RBS Model so that supervisors are able to carry out risk ‐ based AML/CFT supervision in an effective and consistent manner. Competent authorities should ensure that the outcomes of the sector-wide and individual ML/TF risk assessments are communicated to all relevant staff within the competent authority, including staff who are not directly involved in the risk-based AML/CFT supervision. Among other things, competent authorities should ensure that supervisors are able to:

• a) understand the need for flexibility when subjects of assessment’s views of risks and controls are different from competent authorit ies’ views on those risks and take into consideration the argumentation provided by subjects of assessment;
• b) assess the quality of the risk assessment carried out by subjects of assessment;
•  A1
• c) assess the adequacy, proportionality and effectiveness of subjects of assessment’s AML/CFT policies and procedures, including any software or other technological tools, and wider governance arrangements and internal controls in light of subjects of assessment’s own risk assessment and business models;
• d) understand different products, services and financial instruments, and the risks to which they are exposed, including those associated with the underlying technologies used in the provision of those products, services and instruments;
•  O
• e) understand competent authorit ies’ supervisory framework, including the AML/CFT supervisory strategy and plan; and
• f) understand various supervisory tools used and practices put in place by competent authorities, and how they are relevant to the tasks carried out by the staff member, such as the use of different supervisory tools in practice, and the importance of cooperation with other stakeholders;
•  A1
• g) understand the technology underpinning thebusiness models, operations and controls of subjects of assessment to be able to assess the risks and controls and to enable the appropriate deployment of (technology-enabled) supervisory tools.

Training should be tailored to the AML/CFT responsibilities of relevant staff, and senior management, and may include internal and external training courses and conferences, e-learning courses, newsletters, case study discussions, recruitment, feedback on completed tasks, and other forms of ‘learning by doing’. Where necessary and appropriate, competent authorities should also consider filling existing knowledge gaps through strategic hires or draw on the support of in-house specialists such as IT specialists.

135. A) Where multiple competent authorities are responsible for the AML/CFT supervision of the same sector in the Member State, competent authorities should consider providing joint training, to achieve a common understanding of the applicable framework and how it should be applied, and a consistent supervisory approach. Competent authorities may also benefit from knowledge sharing among competent authorities and with other relevant domestic and foreign authorities, such as prudential supervisors, the FIU, relevant EU bodies, and other countries’ AML/CFT supervisors .

•  O

Competent authorities should ensure that relevant training is provided in a timely manner especially for new staff and in case of significant changes within the AML/CFT supervisory framework. Competent authorities should ensure that the AML/CFT expertise of their staff remains up to date and relevant, and includes awareness of emerging risks, as appropriate.