16. In relation to internal policies, controls and procedures referred to in Articles 8(3) and 8(4) …

In relation to internal policies, controls and procedures referred to in Articles 8(3) and 8(4) of Directive (EU) 2015/849, a credit or financial institution’s management body in its management function should:

• a) implement the appropriate and effective organisational and operational structure necessary to comply with the AML/CFT strategy adopted by the management body, paying particular attention to the sufficient authority and the appropriateness of the human and technical resources allocated to the AML/CFT compliance officer function, including the need for a dedicated AML/CFT unit to assist the AML/CFT compliance officer;
• b) ensure implementation of internal AML/CFT policies and procedures;
• c) review the AML/CFT compliance officer’s activity report, at least annually;
• d) ensure adequate, timely and sufficiently detailed AML/CFT reporting to the competent authority;
• e) where operational functions of the AML/CFT compliance officer are outsourced, ensure compliance with the ESAs guidelines on outsourcing arrangements¹⁵ and ESAs guidelines on internal governance¹⁶ , where applicable, and receive regular reporting from the service provider to inform the management body.

4.1.3. Identification of the member of the management body responsible for AML/CFT

¹⁵ EBA guidelines on outsourcing arrangements: EBA/GL/2019/02; EIOPA guidelines on outsourcing to cloud service providers: EIOPA-BoS-20-002; ESMA guidelines on outsourcing to cloud service providers: ESMA50-157-2403

¹⁶ EBA guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2021/05 of 2 July 2021

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA -

  EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

  DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.