22. The member of the management body, or the senior manager where designated, responsible for …

The member of the management body, or the senior manager where designated, responsible for AML/CFT should ensure that the entire management body, or the senior management where no management body is in place, is aware of the impact of ML/TF risks on their business-wide risk profile. The responsibilities of the member of the management body, or the senior manager where designated, responsible for AML/CFT, in view of the performance of their task as referred to in Article 46(4) of Directive (EU) 2015/849, and in particular in relation to the implementation of policies, controls and procedures to mitigate and manage effectively the risks of ML/TF as referred to in Article 8 of that Directive, should include at least:

• a) ensuring that the AML/CFT policies, procedures and internal control measures are adequate and proportionate, taking into account the characteristics of the credit or financial institution and the ML/TF risks to which it is exposed;
• b) carrying out with the management body the assessment of whether it would be appropriate to appoint a separate AML/CFT compliance officer at management level, as referred in section 4.2.2.;
• c) supporting the management body in assessing the need for a dedicated AML/CFT unit to assist the AML/CFT compliance officer in carrying out his/her functions, taking into account the scale and complexity of the credit or financial institution’s operations and exposure to the ML/TF risks. Staff within this unit should possess the necessary expertise, skills and knowledge to assist the AML/CFT compliance officer, who should be involved in the recruitment process;
• d) ensuring that there is periodical reporting to the management body on the activities carried out by the AML/CFT compliance officer and that the management body is provided with sufficiently comprehensive and timely information and data on ML/TF risks and AML/CFT compliance, which is necessary to allow the management body to carry out the role and functions entrusted to it. Such information should also cover the credit or financial institution’s engagements with the national competent authority and communications with the FIU, without prejudice to the confidentiality of STRs, and any ML/TF-related findings of the competent authority against the credit or financial institution including measures or sanctions imposed;
• e) informing the management body of any serious or significant AML/CFT issues and breaches and recommending actions to remedy them;
• f) ensuring that the AML/CFT compliance officer (i) has direct access to all the information necessary to perform his/her tasks, (ii) has sufficient human and technical resources and tools to be able to adequately perform the tasks assigned to them, and (iii) is well informed of the AML/CFT-related incidents and shortcomings identified by the internal control systems and by the national and, in the case of groups, foreign supervisory authorities.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/