4.2 The role and responsibilities of the AML/CFT compliance officer

When deciding whether to appoint the AML/CFT compliance officer in accordance with Article 8(4) of Directive (EU) 2015/849, the management body should take into account the scale and complexity of the credit or financial institution’s operations and its risk exposure to ML/TF pursuant to the criteria set out in section 4.2.2.

The AML/CFT compliance officer should be appointed at management level. He/she should have sufficient authority to propose, on his/her own initiative, all necessary or appropriate measures to ensure the compliance and effectiveness of the internal AML/CFT measures to the management body in its supervisory and management function.

Where the AML/CFT compliance officer is appointed in accordance with Article 8(4) of Directive (EU) 2015/849, the management body should determine whether that role will be carried out on a full-time basis or whether it may be carried out by an employee or an officer in addition to his/her existing functions within the credit or financial institution.

Where the functions of the AML/CFT compliance officer are to be entrusted to an officer or employee who already has other duties or functions within the credit or financial institution, the management body should identify and consider possible conflicts of interest and take the steps necessary to avoid or, where this is not possible, manage these. The management body should ensure that that person can allocate sufficient time to the functions of AML/CFT compliance officer.

The AML/CFT compliance officer should make themselves available to the competent authority and the FIU upon request, and should therefore normally be contracted and work in the country in which the credit or financial institution is established.

Where commensurate with the ML/TF risk to which the credit or financial institution is exposed and to the extent that this is permitted under the national law, the AML/CFT compliance officer may be contracted to work in another jurisdiction. In those cases the credit or financial institution should have the necessary systems and controls in place to ensure that the AML/CFT compliance officer has access to all the necessary information and systems required to perform his/her tasks and is available to meet the local FIU and the competent authority without delay. The credit or financial institution should also be able to demonstrate to its competent authority that the measures it has put in place in this regard are adequate and effective.

The AML/CFT compliance officer should be able to assign and delegate his/her tasks as set out in section 4.2.4. to other officers and employees acting under his/her direction and supervision, provided that ultimate responsibility for the effective fulfilment of those tasks remains with the AML/CFT compliance officer.

The AML/CFT compliance officer should be part of the second line of defence and, as such, part of an independent function, and the following conditions should be met:

• a) The AML/CFT compliance officer should be independent from the business lines or units he/she controls and he/she cannot be subordinate to a person who has responsibility for managing any of those business lines or units.
• b) The credit or financial institution has put in place internal procedures to ensure that the AML/CFT compliance officer has at all times unrestricted and direct access to all information that is necessary to the performance of his/her function. The decision on which information he/she needs to access in this regard should be the AML/CFT compliance officer’s alone .
• c) In the case of a significant incident, the AML/CFT compliance officer should be able to report and have direct access to the management body in its supervisory function or to the senior management where no management body is in place.

4.2.2 Proportionality criteria for the appointment of a separate AML/CFT compliance officer

A credit or financial institution should appoint a separate AML/CFT compliance officer unless it is a sole trader or has a very limited number of employees or the reasons set out in paragraph 33 justify the non-appointment.

When the management body decides not to appoint a separate AML/CFT compliance officer, the reasons should be justified and documented, and explicitly refer to at least the following criteria:

• a) the nature of the credit or financial institution ’s busine ss and the ML/TF risks associated therewith, taking into account its geographical exposure, customer base, distribution channels and products and services offering;
• b) the size of its operations in the jurisdiction, the number of its customers, the number and volume of its transactions and the number of its full-time equivalent employees;
• c) the legal form of the credit or financial institution, including whether the credit or financial institution is part of a group.

Where a separate AML/CFT compliance officer is not appointed, the credit or financial institution should organise the performance of the AML/CFT compliance officer tasks (see below section 4.2.4 on Tasks and role of the AML/CFT compliance officer ) by either the member of the management body as referred to in section 4.1.3 or the senior manager responsible for AML/CFT as referred to in section 4.1.4, or by outsourcing operational functions as mentioned in section 4.2.6, or by a combination of the previous options.

When the AML/CFT compliance officer acts for two or more entities within the group or is charged with other tasks, the credit or financial institution should ensure that these multiple appointments still allow the AML/CFT compliance officer to effectively perform his/her functions. The AML/CFT compliance officer should operate for different entities only if the entities are part of the same group. However, due to the specific nature of the collective investment undertakings sector¹⁷ , the AML/CFT compliance officer could service several funds.

4.2.3 Suitability, skills and expertise

¹⁷ A collective investment undertaking or CIU means a UCITS as defined in Article 1(2) of Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) or an AIF as defined in Article 4(1)(a) of Directive 2011/61/EU.

In relation to employee screening referred to in Article 8(4) (a) of Directive (EU) 2015/849, credit or financial institutions should, prior to the appointment, assess whether the AML/CFT compliance officer possesses:

• a) the reputation, honesty and integrity necessary to perform his/her function;
• b) the appropriate AML/CFT skills and expertise, including knowledge of the applicable legal and regulatory AML/CFT framework, and the implementation of AML/CFT policies, controls and procedures;
• c) sufficient knowledge and understanding of the ML/TF risks associated with the business model of the credit or financial institution to perform his/her function effectively;
• d) relevant experience regarding the identification, assessment and management of the ML/TF risks; and
• e) sufficient time and seniority to perform his/her functions effectively, independently and autonomously.

The credit or financial institutions should ensure that the AML/CFT compliance function operates on an ongoing basis as part of its overall business continuity management. It should cater for the possibility of having the AML/CFT compliance officer discontinue his/her functions and the availability of a delegate with appropriate skills and expertise to take over the functions of the AML/CFT compliance officer in the event that he/she is absent for a period of time or the integrity of the AML/CFT compliance officer is called into question.

4.2.4 Tasks and role of the AML/CFT compliance officer

The role and responsibilities of the AML/CFT compliance officer should be clearly defined and documented.

• a. Development of a risk assessment framework

In relation to the identification and assessment of risk referred to Article 8(1) of Directive (EU) 2015/849, the AML/CFT compliance officer should develop and maintain an ML/TF risk assessment framework for business-wide and individual ML/TF risk assessments in line with the EBA guidelines on ML/TF risk factors¹⁸ .

¹⁸ EBA revised guidelines on ML/TF risk factors: EBA/GL/2021/02

The AML/CFT compliance officer should report the results of the business-wide and individual ML/TF risk assessment to the management body, via the member of the management body, or to the senior manager responsible for AML/CFT, or directly, if he/she deems it necessary. The AML/CFT compliance officer should propose to the management body the measures to take to mitigate those risks. The launch of a new product or service or significant changes to existing ones, the development of a new market or the undertaking of new activities should not be initiated until adequate resources to understand and manage the associated risks are available and effectively implemented.

• b. Development of policies and procedures

The AML/CFT compliance officer should ensure that adequate policies and procedures are put in place, kept up to date and implemented effectively on an ongoing basis. The policies and procedures should be commensurate with the ML/TF risks that the credit or financial institution has identified. The AML/CFT compliance officer should at least:

• a) set out the AML/CFT policies and procedures to be adopted by the credit or financial institution, as well as the controls and systems to be implemented under Article 8(4) of Directive (EU) 2015/849;
• b) ensure that AML/CFT policies and procedures are implemented effectively by the credit or financial institution as explained under section d on Monitoring compliance;
• c) ensure that AML/CFT policies and procedures are reviewed regularly and amended or updated where necessary;
• d) propose how to address any changes in legal or regulatory requirements or in ML/TF risks as well as how to best address deficiencies or shortcomings identified through monitoring or supervisory activities.

The policies, controls and procedures referred to in Article 8(4) of Directive (EU) 2015/849 should at least include the following:

• a) the business-wide and individual ML/TF risk assessment methodology;
• b) customer due diligence including that provided by the EBA revised guidelines on ML/TF risk factors¹⁹ , and a customer acceptance process as explained below in section c on Customers, in particular for high-risk customers;
• c) internal reporting (analysis of unusual transactions) and the submission of STRs to the FIU;
• d) record keeping; and
• e) provisions for monitoring AML/CFT compliance as in section d on Monitoring compliance.
• c. Customers, including high-risk customers

¹⁹ Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions ( ‘Guidelines on ML/TF risk factors ’ ) under Articles 17 and 18(4) of Directive (EU) 2015/849: EBA/GL/2021/02

The AML/CFT compliance officer should be consulted before a final decision is taken by senior management on onboarding new high-risk customers or maintaining business relationships with high-risk customers in line with the risk-based internal AML/CFT policies of the credit or financial institution, and in particular in situations where the senior management’s approval is explicitly required under Directive (EU) 2015/849. If senior management decides not to follow the advice of the AML/CFT compliance officer, it should duly record its decision and address how it proposes to mitigate the risks raised by the AML/CFT compliance officer.

• d. Monitoring compliance

As a second line of defence, the AML/CFT compliance officer should be responsible for monitoring whether the measures, policies, controls and procedures implemented by the credit or financial institution comply with the credit or financial institution’s AML/CFT obligations. The AML/CFT compliance officer should also oversee the effective application of AML/CFT controls applied by business lines and internal units (first line of defence).

The AML/CFT compliance officer should ensure that the AML/CFT framework is updated where necessary, and in any case when deficiencies are detected, new risks emerge or the legal or regulatory framework has changed.

The AML/CFT compliance officer should recommend to the management body corrective measures to be taken to address identified weaknesses in the credit or financial institution’s AML/CTF framework, including weaknesses identified by competent authorities or by internal or external auditors.

• e. Reporting to the management body

The AML/CFT compliance officer should advise the management body on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards, and should provide his/her assessment of the possible impact of any changes in the legal or regulatory environment on the credit or financial institution’s activities and compliance framework.

The AML/CFT compliance officer should bring to the attention of the member of the management body or the senior manager responsible for AML/CFT:

• a) the areas where the operation of AML/CFT controls should be implemented or improved;
• b) the appropriate improvements suggested in relation to point (a) above;
• c) a progress report of any significant remedial programmes, at least once a year as part of the activity report referred to in paragraph 50 and on an ad hoc basis or periodically, depending on the improvements, to provide information about the level of exposure to the ML/TF risks, and the measures taken or recommended to reduce and effectively manage these risks;
• d) whether the human and technical resources allocated to the AML/CFT compliance function are insufficient and should be reinforced.

The credit or financial institution needs to stand ready to share a copy of the activity report referred to in paragraph 50 with the competent authority.

The AML/CFT compliance officer should produce an activity report on at least an annual basis. The activity report should be proportionate to the scale and nature of the activities of the credit or financial institution. The activity report may, where appropriate, be based on information already sent to the national competent authorities in the form of other reports. The activity report should contain at least the following information:

1) On the ML/TF risk assessment:

• a) a summary of the main findings of the business-wide ML/TF risk assessment as referred to in Article 8 of Directive (EU) 2015/849, where such an update has been performed in the past year, and a confirmation of whether it was required by the competent authority to be submitted for the reporting year;²⁰
• b) a description of any changes related to the method used by the credit or financial institution to assess the individual customer risk profile, highlighting how such change is aligned to the credit or financial instit ution’s business -wide ML/TF risk assessment;
• c) the classification of customers by risk category, including the number of customer files by risk category for whom CDD reviews and updates are outstanding;
• d) information and statistical data on:

2) On resources:

• e) a brief description of the AML/CFT organisation structure and, where appropriate, of any significant changes made in the past year and of the underlying reasoning;
• f) a brief description of the human and technical resources allocated to the AML/CFT compliance function by the credit or financial institution;
• g) where applicable, the list of AML/CFT processes outsourced with a description of the oversight performed by the credit or financial institution on those activities.

3) On policies and procedures:

• h) a summary of important measures taken and procedures adopted during the year, including a brief description of the recommendations, problems, shortcomings and irregularities identified in the year of the reporting;
• i) a description of the compliance monitoring actions undertaken to assess application of the credit or financial institution’s AML/CFT policies, controls and procedures by the credit or financial institution’s employees, agents, distributors and service providers, as well as the adequacy of any monitoring tools employed by the credit or financial institution for AML/CFT purposes;
• j) a description of the AML/CFT training activities completed, and of the training plan for next year;
• k) a plan of activities of the AML/CFT compliance officer function for the subsequent year;
• l) findings of internal and external audits relevant to AML/CFT and any progress made by the credit or financial institution to address these findings;
• m) supervisory activities, including communications with the credit or financial institution, carried out by the competent authority, reports submitted, breaches identified and sanctions imposed together with how the credit or financial institution is undertaking to remedy the breaches identified and the stage at which the remedial action is, without prejudice to any other periodical report that may be required in the case of supervisory activity or remedial action.
• f. Reporting of suspicious transactions

²⁰ Please refer to the EBA guidelines on ML/TF risk factors on conducting risk assessments (EBA/GL/2021/02)

In relation to the AML/CFT compliance officer’s obligation under Article 33(2) of Directive (EU) 2015/849 to transmit information referred to in paragraph (1) of that Article, he/she should make sure that other members of staff whose assistance is sought with the discharge of aspects of this function have the skills, knowledge and suitability to assist with that task. Due consideration should be given to the sensitivity and confidentiality of information that may be disclosed and the non-disclosure obligations the credit or financial institution has to adhere to.

When the AML/CFT compliance officer transmits information to the FIU in accordance with Article 33(2) of Directive (EU) 2015/849, he/she should ensure that the information is transmitted in a format and through means which comply with any guidelines issued by the national FIU, in an effective manner. As part of his/her role under that provision, the AML/CFT compliance officer should:

• a) understand the functioning and design of the transaction monitoring system, including scenarios covered according to the ML/TF risks posed to the credit or financial institution and internal procedures to handle alerts;
• b) receive reports from the credit or financial institution’s employees, agents or distributors, or reports generated otherwise by the credit or financial institution’s systems, of knowledge or suspicion of ML/TF, or that a person may have been, is or may be connected with ML/TF;
• c) ensure that these reports are considered promptly so as to determine whether there is knowledge or suspicion that funds are proceeds of criminal activity including ML/TF, or whether a person may have been, is or may be connected with ML/TF; the AML/CFT compliance officer should also determine, document and implement a prioritisation process for the internal reports received so that internal reports concerning especially high-risk situations are treated with the necessary urgency;
• d) while assessing the reports received, keep a record of all evaluations carried out as well as any feedback received from the FIU subsequently to improve the detection of future suspicious transactions;
• e) ensure that knowledge or suspicion of ML/TF or of a person’s connection with ML/TF are promptly reported to the FIU, submitting with the report such facts, events or information and documentation as necessary to substantiate the suspicion or instances of reasonable grounds to suspect ML/TF;
• f) ensure a prompt and exhaustive response to any request for information made by the FIU; and
• g) consider regularly the reasons why alerts of unusual activity or transactions were not escalated as internal reports so as to determine whether there are any issues that need to be addressed to ensure effective detection of suspicious activity or transactions.

The AML/CFT compliance officer should ensure that the credit or financial institution ’s internal controls will enable it to comply with any guidance provided by the FIU.

Credit or financial institutions should draw the attention of their managers and employees to the obligation to comply strictly with the prohibition on informing the customer or third parties that an ML/TF analysis is ongoing or may be started and to limit access to this information to the persons who need it for the performance of their functions. While there is a non-disclosure obligation applicable within the credit or financial institution, the AML/CFT compliance officer should still consider carefully to whom information on either any reports submitted to the FIU or any request for information received from the FIU is provided within the credit or financial institution. The reporting procedure should be confidential and the identity of the persons involved in the preparation and forwarding of the report should be protected by privacy policy.

• g. Training and awareness

In accordance with the obligation under Article 46(1) of Directive (EU) 2015/849 and as specified in the EBA revised guidelines on ML/TF risk factors²¹ , the AML/CFT compliance officer should duly inform staff about the ML/TF risks to which the credit or financial institution is exposed including ML/TF methods, trends and typologies, as well as of the risk-based approach implemented by the credit or financial institution to mitigate these risks. This information may take various forms, such as company letters, the intranet, meetings.

²¹ Guideline 6: Training of EBA revised guidelines on ML/TF risk factors: EBA/GL/2021/02

The AML/CFT compliance officer should oversee the preparation and implementation of an ongoing AML/CFT training programme. In cooperation with the human resources department of the credit or financial institution, an annual plan of training and education of staff should be documented and be referred to in the activity report to the management body as per paragraph 50.

The AML/CFT compliance officer should ensure that the internal reporting procedures adopted by the credit or financial institution are brought to the attention of all staff.

In addition to general education, for the purposes of Article 46(1) of Directive (EU) 2015/849 the AML/CFT compliance officer should assess the specific training needs within the credit or financial institution and ensure that adequate theoretical and practical training is provided to the persons exposed to different level of ML/FT risks, such as:

• a) persons working in the compliance function under the responsibility of the AML/CFT compliance officer;
• b) persons in contact with customers or tasked with carrying out their transactions (employees, agents and distributors);
• c) persons responsible for developing procedures or internal tools applicable to activities that may be sensitive to ML/TF risk.

The content of the specific training programmes delivered to persons with different levels of exposure to ML/TF risks should be adjusted on a risk-sensitive basis as described in the EBA revised guidelines on ML/TF risk factors²² .

²² Guideline 6: Training of EBA revised guidelines on ML/TF risk factors: EBA/GL/2021/02

The AML/CFT compliance officer should determine indicators of assessment to check the effectiveness of training provided.

Where the credit or financial institution adopts a training and awareness-raising programme developed abroad, e.g. by its registered office or parent company, the AML/CFT compliance officer should ensure that this programme is adapted to the legal and regulatory rules applicable at national level, as well as with respect to ML/TF typologies and specific activities of the credit or financial institution.

Where certain training activities are outsourced to a service provider, the AML/CFT compliance officer should ensure (i) that the service provider has the required AML/CFT knowledge to guarantee the quality of the training to be provided, (ii) that the management conditions of the outsourcing are set and respected, and (iii) that the content of this training is adapted to the specific features of the credit or financial institution concerned.

4.2.5 Relationship between the AML/CFT compliance function and other functions

Both the compliance function and the independent AML/CFT compliance function should be located in the second line of defence of the credit and financial institutions.

Where the AML/CFT compliance function is different from the general compliance function, in addition to the provisions of ESAs guidelines on internal governance²³ on a transparent and documented decision-making process and clear allocation of responsibilities and authority within its internal control framework, credit or financial institutions should meet the provisions set out in this section.

²³ EBA guidelines on internal governance under Directive 2013/36/EU: EBA/GL/2021/05; ESMA guidelines on certain aspects of the MiFID II compliance function requirements: ESMA35-36-1946; EIOPA guidelines on system of governance: EIOPA-BoS-14/253 EN

The independent audit function referred to in Article 8(4)(b) of Directive (EU) 2015/849 should not be combined with the AML/CFT compliance function.

The risk management function, to the extent that the credit or financial institution has a risk management function, and, where established, the risk committee, should have access to relevant information and data necessary to perform their role, including information and data from relevant corporate and internal control functions, such as AML/CFT compliance.

A good cooperation to exchange information should take place between the head of risk management and the AML/CFT compliance officer. The AML/CFT compliance officer should cooperate with the risk function for the purpose of setting AML/CFT methodologies coherent with the risk management strategy of the credit or financial institution.

4.2.6 Outsourcing of operational functions of the AML/CFT compliance officer

In addition to the ESAs guidelines on outsourcing²⁴ , as applicable, and where the outsourcing of operational functions of the AML/CFT compliance officer is permitted under national law, credit or financial institutions should have regard to the following key principles:

• a. The ultimate responsibility for compliance with legal and regulatory obligations, whether or not specific functions are outsourced, lies with the credit or financial institution.
• b. The rights and obligations of the credit or financial institution and the service provider should be clearly allocated and set out in a written agreement.
• c. The credit or financial institution relying on an outsourcing arrangement should remain accountable to monitor and oversee the quality of the service provided.
• d. Intra-group outsourcing should be subject to the same regulatory framework as outsourcing to service providers outside the group²⁵ .
• e. The outsourcing of functions cannot result in the del egation of the management body’s responsibilities. Strategic decisions in relation to AML/CFT should not be outsourced. These decisions include, in particular:
• i. the approval of the business-wide ML/TF risk assessment;
• ii. the decision on the internal organisation of the AML/CFT framework of the credit and financial institution;
• iii. the adoption of internal AML/CFT policies and procedures;
• iv. the approval of the methodology used to determine the ML/TF risk presented by a given business relationship and the assignment of the risk profile;
• v. the approval of the criteria to be used by the credit or financial institution to detect suspicious or unusual transactions for its ongoing monitoring and/or reporting purposes.

Credit and financial institutions remain ultimately responsible for the decision to report suspicious transactions to the FIU, including in situations where the identification and reporting of suspicious transactions is outsourced.

²⁴ EBA guidelines on outsourcing arrangements: EBA/GL/2019/02; EIOPA guidelines on outsourcing to cloud service providers: EIOPA-BoS-20-002; ESMA guidelines on outsourcing to cloud service providers: ESMA50-157-2403

²⁵ Point 27 of the Background sections of the EBA guidelines on outsourcing arrangements of 25 February 2019: EBA/GL/2019/02

Credit and financial institutions should follow the outsourcing process, as set out in the EBA’s guidelines on outsourcing arrangements, when outsourcing operational tasks of the AML/CFT compliance officer function to a service provider. This includes the identification and assessment of relevant risks of the outsourcing arrangement, the justification of the decision to outsource in light of the objectives pursued (whether it aims to ensure an optimal allocation of AML/CFT resources throughout the group or on the basis of the proportionality criteria), undertaking due diligence on the prospective service provider, and the contractualisation of the outsourcing agreement.

The credit or financial institution which outsources tasks of the AML/CFT compliance function should entrust its AML/CFT compliance officer with:

• i) monitoring the service provider ’ s performance to ensure that the outsourcing effectively enables the credit or financial institution to comply with all its legal and regulatory AML/CFT obligations;
• ii) carrying out a regular control of compliance by the service provider with the commitments arising from the agreement. In accordance with the documented analysis, the regular control should ensure that the AML/CFT compliance function is provided with means to test and monitor regularly and occasionally compliance with the obligations incumbent upon the service provider. As regards its customer’s data, the AML/CFT compliance function and the competent authority should have access rights to the systems/databases of the service provider;
• iii) reporting on the outsourcing to the management body as part of the AML/CFT compliance officer’s activity report or whenever circumstances require, in particular so that any necessary remediation measures are implemented as soon as possible.

Where the credit or financial institution does not have any officers or employees of its own other than a management body, it may outsource the AML/CFT compliance function to a service provider. In such instances the AML/CFT compliance officer should be the AML/CFT compliance officer of one of the service providers who has experience or knowledge on the type of activity or transactions carried out by the credit or financial institution.

In situations whereby the credit or financial institution is making use of intra-group outsourcing, it should in particular take the measures necessary to identify and manage any conflicts of interest that could arise from such an outsourcing agreement. The parent entity of the group should:

• a) ensure that an inventory of cases of intra-group AML/CFT outsourcing, in order to determine which function relates to which legal entity, is established in the concerned entities and regularly made available for its consultation; and
• b) ensure that intra-group outsourcing does not compromise the compliance of each subsidiary, branch or other form of establishment with its AML/CFT obligations.

The outsourcing of tasks related to AML/CFT to service providers established in third countries should be subject to additional safeguard measures in order to ensure that the outsourcing does not, as a result of the location of the service provider, increase the risk of non-compliance with the legal and regulatory requirements or of inefficient performance of the outsourced tasks, nor hinders the competent authority’s capacity to effectively exercise its supervisory power with regard to the service provider.