25. Cooperation between competent authorities

Competent authorities should provide each other, while respecting the applicable data protection legislation, with any information they hold about a member of the management body or key function holder for the performance of a suitability assessment. The information should also include a justification for the decision taken regarding that person ’ s suitability. For this purpose, unless national law permits it without requiring consent, the requesting competent authority should seek from members of the management body or key function holders consent:

• a. to request from any competent authority information relating to them which is needed for the suitability assessment;
• b. to process and use the provided information for the suitability assessment, if such consent is required by applicable data protection legislation.

Competent authorities may take into consideration the results of the assessment of suitability conducted by other competent authorities or other relevant information for the purpose of the assessment of suitability about members of the management body or key function holders and request the necessary information from other competent authorities in order to do so. Where appropriate, competent authorities should contact the AML/CFT supervisor in the relevant Member State to obtain additional information necessary to assess the integrity, honesty, good repute and suitability of an institution’s management body or key function holders. In addition, in situations where the risk of ML/TF associated with the institution or member is increased, competent authorities should also, where appropriate, seek information from other relevant stakeholders, including the Financial Intelligence Units and law enforcement agencies, to inform their suitability assessment.³⁶

³⁶ See also: Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions available under https://eba.europa.eu/regulation-and-policy/anti-money-laundering-and-countering-financing-terrorism

Competent authorities receiving such requests should, where possible, provide relevant available information on the suitability of individuals as soon as possible to enable the requesting competent authority to comply with the time for assessment laid down in paragraph 179. The information provided should comprise the result of the assessment of suitability, any identified shortcomings, measures taken to ensure the suitability, the responsibilities of the position for which the person was assessed and basic information on the size, nature, scale and complexity of the relevant institution, or other relevant information for the assessment of suitability.

Competent authorities should take into account the information provided in the EBA and ESMA databases on administrative penalties in line with Article 69 of Directive 2013/36/EU and Article 71 of Directive 2014/65/EU as a part of their assessment of suitability, by identifying any penalties in the last ten years against institutions where the assessed person was a member of their management body or a key function holder and considering the severity of the underlying cause and the responsibility of the assessed person.

Where relevant, competent authorities may also request information from other competent authorities about the assessed individual in cases where the person has not been assessed by another competent authority, but where the other competent authority may be in a position to provide additional information, e.g. on refused registrations or criminal records. Competent authorities receiving such requests should provide relevant available information on the suitability of persons. Where the information originates in another Member State, it shall be disclosed only with the express agreement of the authorities which have provided the information and solely for the purposes for which those authorities gave their agreement.

Where a competent authority reaches a decision about the suitability of a person that differs from any previous assessment conducted by another competent authority, the competent authority performing the more recent assessment should inform the other competent authorities of the result of its assessment.

Where a competent authority decides that a member of the management body or a head of the internal control function and the CFO, where they are not part of the management body, as referred to in paragraph 172, is not suitable based on relevant facts in the context of ML/TF risks or events, the competent authority should, without prejudice to national law, share their findings and decisions with the competent AML/CFT supervisor.

When requesting information, the competent authority making the request should provide the name of the individual being assessed together with his or her date of birth or the name of the institution and position for which the individual has already been assessed, to ensure that data for the correct person is provided.