7.4 On and off-site supervision and risk assessments

In the context of on and off-site supervision, the information that prudential supervisors and AML/CFT supervisors should share with each other may include but is not limited to:

• a. relevant information on the outcomes related to on-site inspections and off-site reviews and relevant documentation collected during the supervision;
• b. relevant sections from reports received from the institutions or third parties including consultants and external auditors;
• c. relevant information shared within the AML/CFT college or the prudential college, where relevant;
• d. relevant parts from minutes of meetings with the institutions and from meetings of colleges, where available.

Prudential supervisors

Prudential supervisors should request from AML/CFT supervisors information that is relevant for the Supervisory Review and Evaluation Process (SREP) as set out in the EBA Guidelines on common procedures and methodologies for the SREP²⁷ , including but not limited to:

• a. relevant outcomes of ML/TF risk assessments, including sectoral and individual risk assessments and risk ratings, in particular in cases of increased exposure to significant ML/TF risks;
• b. information related to emerging ML/TF risks that the institution may be exposed to;
• c. information related to material weaknesses²⁸ in the supervised instit ution’s AML/CFT governance, systems and controls framework;
• d. information related to potential or actual breaches, in particular serious breaches of the applicable AML/CFT laws by the supervised institution;
• e. information related to the measures put in place by the institution to mitigate breaches and material weaknesses;
• f. information related to supervisory measures or sanctions pending or imposed on the institution as set out in section 8.

²⁷ EBA Guidelines on the revised common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing (EBA/GL/2014/13).

²⁸ Material weaknesses as defined in the RTS under Article 9a of Regulation (EU) No 1093/2010.

Prudential supervisors should provide information that is relevant for the ML/TF risk assessment carried out by the AML/CFT supervisors including, but not limited to, the information listed in paragraph 81.

Prudential supervisors should share with the financial intelligence unit information that is relevant for the tasks of the financial intelligence unit according to paragraph 20, including relevant outcomes of supervisory assessments of institutions with potential implications for the suspicious transaction reporting framework.

In addition, in situations where the institution is exposed to increased ML/TF risks, prudential supervisors should, where appropriate, seek from the financial intelligence unit information that is relevant for their Supervisory Review and Evaluation Process (SREP) that may include but is not limited to information from typologies and risk analysis on transactions and business relationships that could be relevant for the business model analysis.

AML/CFT supervisors

AML/CFT supervisors should request from prudential supervisors information that is relevant when carrying out the ML/TF risk assessment of the supervised institutions, including but not limited to:

• a. i nformation relevant to assessing institutions’ inherent ML/TF risk or the sectorial ML/TF risk, particularly information on the institution´s products and services, customer base, geographical presence or distribution channels;²⁹
• b. relevant outcomes resulting from the Supervisory Review and Evaluation Process (SREP)³⁰ , where available, in particular in the areas of business model, the assessment of internal governance and institution-wide controls, risks to capital and risks to liquidity and funding;
• c. relevant breaches or material weaknesses identified in the supervised institution that may have an impact on the institution’s AML/CFT framework;
• d. information related to supervisory measures or sanctions pending or imposed on the institution as set out in section 8;
• e. information on branches and subsidiaries necessary to fulfil the mapping of firms according to the Joint Guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849³¹ .

²⁹ In line with the revised Joint Guidelines on risk-based supervision (EBA/GL/2021/16).

³⁰ In accordance with the EBA Guidelines on the revised common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing (EBA/GL/2014/13).

³¹ Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (JC 2019 81).

AML/CFT supervisors should provide information that is relevant for the prudential risk assessment including, but not limited to, the information set out in paragraph 77.

AML/CFT supervisors should, where appropriate, seek from the financial intelligence unit information that is relevant for the performance of ML/TF risk assessment and supervision that may include but is not limited to:

• a. typologies on ML/TF risks, including geographical risks and cross-border risks;
• b. relevant outcomes of the ML/TF risk assessment carried out by the financial intelligence unit;
• c. information on emerging risks identified by the financial intelligence unit;
• d. information on the quantity and quality of suspicious transaction reports received from institutions, in an aggregated manner, such as per sector, and in respect of individual institutions;
• e. information relating to any AML/CFT systems and controls weaknesses that the financial intelligence unit may have identified or suspected and especially information on the timeliness in responding to requests for information made by the financial intelligence unit and the quality of the information, data and documentation provided in reply to any such requests;
• f. confirmation on whether the institution has been a subject of a suspicious transaction report submitted by another institution or whether funds that are subject to suspicious transaction reports regularly come from that institution and any information in relation to the case that the financial intelligence unit may be able to share in accordance with the national law.

AML/CFT supervisors should share information with the financial intelligence unit that is relevant for its tasks according to paragraph 20, that may include but is not limited to:

• a. information with regard to relevant deficiencies and weaknesses identified in the supervised institution, including those that can affect the suspicious transaction reporting framework;
• b. information on suspected or committed breaches, in particular serious breaches of the applicable AML/CFT laws by the supervised institution, particularly where those breaches have an impact on the institution’s ability to report suspicious transactions, relevant outcomes of the ML/TF risk assessment of sectors or, where appropriate, individual institutions;
• c. any information relating to the emerging ML/TF risks within the sector;
• d. relevant information gathered from reports received following Article 61(1) of Directive (EU) 2015/849 on potential or actual breaches of the national provisions transposing Directive (EU) 2015/849.

Common assessment between AML/CFT and prudential supervisors under Article 97(6) of Directive 2013/36/EU

Where the prudential risk assessment gives the prudential supervisor reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted in connection with an institution or that an institution is exposed to an increased ML/TF risk, the prudential supervisor should immediately notify the AML/CFT supervisor of that institution and the EBA of their findings and concerns in accordance with Article 97(6) of Directive 2013/36/EU.

Where the AML/CFT supervisor assesses that an institution is potentially exposed to an increased ML/TF risk following the notification from the prudential supervisor as set out above, the AML/CFT supervisor should liaise with the prudential supervisor in order to reach a common assessment, which should be notified immediately to the EBA in accordance with Article 97(6) of Directive 2013/36/EU through a single submission by the prudential supervisor.

For the performance of the common assessment as required under Article 97(6) of Directive 2013/36/EU, the prudential supervisor and the AML/CFT supervisor should cooperate closely and establish all facts and reasons that may give rise to the potential increased ML/TF risk. Both supervisors should exchange all information that is relevant for the performance of the common assessment.

The common assessment should be set out in writing and contain the established facts and reasons. The document should contain at least the AML/CFT supervisory assessment of the potential increased ML/TF risk, including possible measures to mitigate the risk from an AML/CFT perspective, and the analysis of the potential prudential implications of such assessment and possible prudential measures to mitigate the risk.