6.3 Complex structures and non-standard or non-transparent activities

Institutions should avoid setting up complex and potentially non-transparent structures. Institutions should take into account in their decision-making the results of a risk assessment performed to identify whether such structures could be used for a purpose connected with money laundering, terrorist financing or other financial crimes and the respective controls and legal framework in place²⁹ . To this end, institutions should take into account at least:

• a. the extent to which the jurisdiction in which the structure will be set up complies effectively with EU and international standards on tax transparency, anti-money laundering and countering the financing of terrorism³⁰ ;
• b. the extent to which the structure serves an obvious economic and lawful purpose;
• c. the extent to which the structure could be used to hide the identity of the ultimate beneficial owner;
• d. the extent to which the customer’s request that leads to the possible setting up of a structure gives rise to concern;
• e. whether the structure might impede appropriate oversight by the institution ’s management body or the institution ’ s ability to manage the related risk; and
• f. whether the structure poses obstacles to effective supervision by competent authorities.

²⁹ For further details on the assessment of country risk and the risk associated with individual products and customers, institutions should refer also to the joint guidelines on ML/TF risk factors (EBA GL JC/2017/37) currently under review.

³⁰ See also:https://eba.europa.eu/regulation-and-policy/anti-money-laundering-and-e-money/rts-on-the-implementation-of-group-wide-aml/cft-policies-in-third-countries

In any case, institutions should not set up opaque or unnecessarily complex structures which have no clear economic rationale or legal purpose or structures that could raise concerns that these might be created for a purpose connected with financial crime.

When setting up such structures, the management body should understand them and their purpose and the particular risks associated with them and ensure that the internal control functions are appropriately involved. Such structures should be approved and maintained only when their purpose has been clearly defined and understood, and when the management body is satisfied that all material risks, including reputational risks, have been identified, that all risks can be managed effectively and appropriately reported, and that effective oversight has been ensured. The more complex and opaque the organisational and operational structure, and the greater the risks, the more intensive the oversight of the structure should be.

Institutions should document their decisions and be able to justify their decisions to competent authorities.

The management body should ensure that appropriate actions are taken to avoid or mitigate the risks of activities within such structures. This includes ensuring that:

• a. the institution has in place adequate policies and procedures and documented processes (e.g. applicable limits, information flows) for the consideration, compliance, approval and risk management of such activities, taking into account the consequences for the group ’ s organisational and operational structure, its risk profile and its reputational risk;
• b. information concerning these activities and the risks thereof is accessible to the consolidating institution and internal and external auditors and is reported to the management body in its supervisory function and to the competent authority that granted authorisation; and
• c. the institution periodically assesses the continuing need to maintain such structures.

These structures and activities, including their compliance with legislation and professional standards, should be subject to regular review by the internal audit function following a risk-based approach.

Institutions should take the same risk management measures as for the institution ’s own business activities when they perform non-standard or non-transparent activities for clients (e.g. helping clients to set up vehicles in offshore jurisdictions, developing complex structures, financing transactions for them or providing trustee services) that pose similar internal governance challenges and create significant operational and reputational risks. In particular, institutions should analyse the reason why a client wants to set up a particular structure.