16. In relation to internal policies, controls and procedures referred to in Articles 8(3) and 8(4) …

In relation to internal policies, controls and procedures referred to in Articles 8(3) and 8(4) of Directive (EU) 2015/849, a credit or financial institution’s management body in its management function should:

• a) implement the appropriate and effective organisational and operational structure necessary to comply with the AML/CFT strategy adopted by the management body, paying particular attention to the sufficient authority and the appropriateness of the human and technical resources allocated to the AML/CFT compliance officer function, including the need for a dedicated AML/CFT unit to assist the AML/CFT compliance officer;
• b) ensure implementation of internal AML/CFT policies and procedures;
• c) review the AML/CFT compliance officer’s activity report, at least annually;
• d) ensure adequate, timely and sufficiently detailed AML/CFT reporting to the competent authority;
• e) where operational functions of the AML/CFT compliance officer are outsourced, ensure compliance with the ESAs guidelines on outsourcing arrangements¹⁵ and ESAs guidelines on internal governance¹⁶ , where applicable, and receive regular reporting from the service provider to inform the management body.

4.1.3. Identification of the member of the management body responsible for AML/CFT

¹⁵ EBA guidelines on outsourcing arrangements: EBA/GL/2019/02; EIOPA guidelines on outsourcing to cloud service providers: EIOPA-BoS-20-002; ESMA guidelines on outsourcing to cloud service providers: ESMA50-157-2403

¹⁶ EBA guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2021/05 of 2 July 2021

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/