50. The AML/CFT compliance officer should produce an activity report on at least an annual basis. …

The AML/CFT compliance officer should produce an activity report on at least an annual basis. The activity report should be proportionate to the scale and nature of the activities of the credit or financial institution. The activity report may, where appropriate, be based on information already sent to the national competent authorities in the form of other reports. The activity report should contain at least the following information:

1) On the ML/TF risk assessment:

• a) a summary of the main findings of the business-wide ML/TF risk assessment as referred to in Article 8 of Directive (EU) 2015/849, where such an update has been performed in the past year, and a confirmation of whether it was required by the competent authority to be submitted for the reporting year;²⁰
• b) a description of any changes related to the method used by the credit or financial institution to assess the individual customer risk profile, highlighting how such change is aligned to the credit or financial instit ution’s business -wide ML/TF risk assessment;
• c) the classification of customers by risk category, including the number of customer files by risk category for whom CDD reviews and updates are outstanding;
• d) information and statistical data on:

2) On resources:

• e) a brief description of the AML/CFT organisation structure and, where appropriate, of any significant changes made in the past year and of the underlying reasoning;
• f) a brief description of the human and technical resources allocated to the AML/CFT compliance function by the credit or financial institution;
• g) where applicable, the list of AML/CFT processes outsourced with a description of the oversight performed by the credit or financial institution on those activities.

3) On policies and procedures:

• h) a summary of important measures taken and procedures adopted during the year, including a brief description of the recommendations, problems, shortcomings and irregularities identified in the year of the reporting;
• i) a description of the compliance monitoring actions undertaken to assess application of the credit or financial institution’s AML/CFT policies, controls and procedures by the credit or financial institution’s employees, agents, distributors and service providers, as well as the adequacy of any monitoring tools employed by the credit or financial institution for AML/CFT purposes;
• j) a description of the AML/CFT training activities completed, and of the training plan for next year;
• k) a plan of activities of the AML/CFT compliance officer function for the subsequent year;
• l) findings of internal and external audits relevant to AML/CFT and any progress made by the credit or financial institution to address these findings;
• m) supervisory activities, including communications with the credit or financial institution, carried out by the competent authority, reports submitted, breaches identified and sanctions imposed together with how the credit or financial institution is undertaking to remedy the breaches identified and the stage at which the remedial action is, without prejudice to any other periodical report that may be required in the case of supervisory activity or remedial action.
• f. Reporting of suspicious transactions

²⁰ Please refer to the EBA guidelines on ML/TF risk factors on conducting risk assessments (EBA/GL/2021/02)

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/