4.1 The role and responsibilities of the management body in the AML/CFT framework and of the senior manager responsible for AML/CFT

The management body should be responsible for approving the credit or financial institution’s overall AML/CFT strategy and for overseeing its implementation. To this end, it should collectively possess adequate knowledge, skills and experience to be able to understand the ML/TF risks related to the credit or financial institution ’ s activities and business model, including the knowledge of the national legal and regulatory framework relating to the prevention of ML/TF.

4.1.1 The role of the management body in its supervisory function in the AML/CFT framework

The management body in its supervisory function should be responsible for overseeing and monitoring the implementation of the internal governance and internal control framework to ensure compliance with applicable requirements in the context of the prevention of money laundering and terrorism financing (ML/TF).

In addition to the provisions set out in the ESAs ’ guidelines on internal governance¹⁴ , as applicable, a credit or fi nancial institution’s management body in its supervisory function should:

• a) be informed of the results of the business-wide ML/TF risk assessment;
• b) oversee and monitor the extent to which the AML/CFT policies and procedures are adequate and effective in light of the ML/TF risks to which the credit or financial institution is exposed and take appropriate steps to ensure remedial measures are taken where necessary;
• c) at least once a year, review the activity report of the AML/CFT compliance officer and obtain interim updates more frequently for activities that expose the credit or financial institution to higher ML/TF risks;
• d) at least once a year, assess the effective functioning of the AML/CFT compliance function, including by taking into account the conclusions of any AML/CFT-related internal and/or external audits that may have been carried out, including with regard to the appropriateness of the human and technical resources allocated to the AML/CFT compliance officer.

¹⁴ EBA guidelines on internal governance under Directive 2013/36/EU: EBA/GL/2021/05; ESMA guidelines on certain aspects of the MiFID II compliance function requirements: ESMA35-36-1946; EIOPA guidelines on system of governance: EIOPA-BoS-14/253 EN

The management body in its supervisory function should ensure that the member of the management body referred to in section 4.1.3. or where applicable the senior manager referred to in section 4.1.4., who is responsible for the implementation of the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2015/849:

• a) has the knowledge, skills and experience necessary to identify, assess and manage the ML/TF risks to which the credit or financial institution is exposed, and the implementation of AML/CFT policies, controls and procedures;
• b) has a good understanding of the credit or financial institution’s business model and the sector in which it operates and the extent to which this business model exposes the credit or financial institution to ML/TF risks;
• c) is informed in a timely manner of decisions that may affect the risks to which the credit or financial institution is exposed.

The management body in its supervisory function should have access to and take into account data and information of sufficient detail and quality to enable it to discharge its AML/CFT functions effectively. At a minimum, the management body in its supervisory function should have timely and direct access to the activity report of the AML/CFT compliance officer, the report of the internal audit function, the findings and observations of external auditors, where applicable, as well as the findings of the competent authority, relevant communications with the FIU and supervisory measures or sanctions imposed.

4.1.2. The role of the management body in its management function in the AML/CFT framework

In relation to internal policies, controls and procedures referred to in Articles 8(3) and 8(4) of Directive (EU) 2015/849, a credit or financial institution’s management body in its management function should:

• a) implement the appropriate and effective organisational and operational structure necessary to comply with the AML/CFT strategy adopted by the management body, paying particular attention to the sufficient authority and the appropriateness of the human and technical resources allocated to the AML/CFT compliance officer function, including the need for a dedicated AML/CFT unit to assist the AML/CFT compliance officer;
• b) ensure implementation of internal AML/CFT policies and procedures;
• c) review the AML/CFT compliance officer’s activity report, at least annually;
• d) ensure adequate, timely and sufficiently detailed AML/CFT reporting to the competent authority;
• e) where operational functions of the AML/CFT compliance officer are outsourced, ensure compliance with the ESAs guidelines on outsourcing arrangements¹⁵ and ESAs guidelines on internal governance¹⁶ , where applicable, and receive regular reporting from the service provider to inform the management body.

4.1.3. Identification of the member of the management body responsible for AML/CFT

¹⁵ EBA guidelines on outsourcing arrangements: EBA/GL/2019/02; EIOPA guidelines on outsourcing to cloud service providers: EIOPA-BoS-20-002; ESMA guidelines on outsourcing to cloud service providers: ESMA50-157-2403

¹⁶ EBA guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2021/05 of 2 July 2021

The member of the management body to be identified in accordance with Article 46(4) of Directive (EU) 2015/849 should, in particular, have sufficient knowledge, skills and experience regarding ML/TF risks, and the implementation of AML/CFT policies, controls and procedures, with a good understanding of the credit or financial institution’s b usiness model and the sector in which the credit or financial institution operates.

The member of the management body referred to in Article 46(4) of Directive (EU) 2015/849 should commit sufficient time and have sufficient resources to perform his/her AML/CFT duties effectively. He/she should report comprehensively about his/her tasks as mentioned in section 4.1.5. and regularly inform, where necessary and without undue delay, the management body in its supervisory function.

4.1.4. Identification of a senior manager responsible for AML/CFT where no management body is in place

Where no management body is in place, the credit or financial institution should appoint a senior manager who is ultimately responsible for the implementation of the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2015/849, with sufficient time, resources and authority to perform his/her duties effectively.

The senior manager referred to in paragraph 19 should have sufficient knowledge, skills and experience regarding ML/TF risks, and the implementation of AML/CFT policies, controls and procedures, with a good understanding of the credit or financial institution’s business model and the sector in which the credit or financial institution operates. In addition, he/she should be given sufficient time, resources and authority to perform his/her duties effectively.

4.1.5. Tasks and role of the member of the management body or senior manager responsible for AML/CFT

Without prejudice to the overall and collective responsibility of the management body, when appointing the member of the management body, or the senior manager referred to in paragraphs 17 and 19, credit or financial institutions should identify and take into account potential conflicts of interest and take steps to avoid or mitigate them.

The member of the management body, or the senior manager where designated, responsible for AML/CFT should ensure that the entire management body, or the senior management where no management body is in place, is aware of the impact of ML/TF risks on their business-wide risk profile. The responsibilities of the member of the management body, or the senior manager where designated, responsible for AML/CFT, in view of the performance of their task as referred to in Article 46(4) of Directive (EU) 2015/849, and in particular in relation to the implementation of policies, controls and procedures to mitigate and manage effectively the risks of ML/TF as referred to in Article 8 of that Directive, should include at least:

• a) ensuring that the AML/CFT policies, procedures and internal control measures are adequate and proportionate, taking into account the characteristics of the credit or financial institution and the ML/TF risks to which it is exposed;
• b) carrying out with the management body the assessment of whether it would be appropriate to appoint a separate AML/CFT compliance officer at management level, as referred in section 4.2.2.;
• c) supporting the management body in assessing the need for a dedicated AML/CFT unit to assist the AML/CFT compliance officer in carrying out his/her functions, taking into account the scale and complexity of the credit or financial institution’s operations and exposure to the ML/TF risks. Staff within this unit should possess the necessary expertise, skills and knowledge to assist the AML/CFT compliance officer, who should be involved in the recruitment process;
• d) ensuring that there is periodical reporting to the management body on the activities carried out by the AML/CFT compliance officer and that the management body is provided with sufficiently comprehensive and timely information and data on ML/TF risks and AML/CFT compliance, which is necessary to allow the management body to carry out the role and functions entrusted to it. Such information should also cover the credit or financial institution’s engagements with the national competent authority and communications with the FIU, without prejudice to the confidentiality of STRs, and any ML/TF-related findings of the competent authority against the credit or financial institution including measures or sanctions imposed;
• e) informing the management body of any serious or significant AML/CFT issues and breaches and recommending actions to remedy them;
• f) ensuring that the AML/CFT compliance officer (i) has direct access to all the information necessary to perform his/her tasks, (ii) has sufficient human and technical resources and tools to be able to adequately perform the tasks assigned to them, and (iii) is well informed of the AML/CFT-related incidents and shortcomings identified by the internal control systems and by the national and, in the case of groups, foreign supervisory authorities.

The member of the management body, or the senior manager where designated, responsible for AML/CFT should be the main contact point for the AML/CFT compliance officer within the management. In addition, the member of the management body, or the senior manager where designated, responsible for AML/CFT should ensure that any AML/CFT concerns that the AML/CFT compliance officer has are duly addressed and, where this is not possible, are duly considered by the management body in its management function or by the senior management where applicable. If the management body in its management function or senior management where applicable decide not to follow the recommendation of the AML/CFT compliance officer, they should duly justify and record their decision in light of the risks and concerns raised by the AML/CFT compliance officer. In the case of a significant incident, the AML/CFT compliance officer should have direct access to the management body in its supervisory function.