4.3 Organisation of the AML/CFT compliance function at group level

The credit or financial institution should adapt its internal control framework to the specificity of its business, its complexity and the associated risks, taking into account the group context.

The credit or financial institution should ensure that the parent undertaking, where it is a credit or financial institution, has sufficient data and information and is able to assess the group-wide ML/TF risk profile, in line with the EBA guidelines on ML/TF risk factors²⁶ .

²⁶ EBA revised guidelines on ML/TF risk factors: EBA/GL/2021/02

Where the credit or financial institution is the parent of a group, it should ensure that each management body, business line and internal unit, including each internal control function, has the information necessary to be able to carry out its duties. In particular it should ensure exchange of adequate information between the business lines and the AML/CFT compliance function, and the compliance function where those are different functions, at the group level and between the heads of the internal control functions at the group level and the management body of the credit or financial institution.

4.3.2 Role of the management body in respect of AML/CFT at group level

Where the parent is a credit or financial institution and thus an obliged entity under Directive (EU) 2015/849, its management body should carry out at a minimum the following tasks:

• a) in order to have a cartography of the ML/TF risks to which each group entity is exposed, ensure that the group entities perform their own business-wide ML/TF risk assessments in a coordinated way and based on a common methodology, yet reflecting their own specificities, taking into account Article 8(1) of Directive (EU) 2015/849 and the EBA revised guidelines on ML/TF risk factors²⁷ ;
• b) when being informed, by members of the group management body or senior manager responsible for AML/CFT or directly by the group AML/CFT compliance officer, of supervisory activities carried out in entities of the group by a competent authority, or deficiencies identified therein, ensure that remediation measures are completed by the subsidiary or branch in a timely and effective manner.

4.3.3 Organisational requirements at group level

²⁷ EBA revised guidelines on ML/TF risk factors: EBA/GL/2021/02

When implementing group-wide policies and procedures as referred to in Article 45 of Directive (EU) 2015/849, conflicting interests, meaning ML/TF risk-generating tasks such as the commercial function, between a parent credit or financial institution, which is an obliged entity under Directive (EU) 2015/849, and a subsidiary or branch, should not jeopardise the compliance with AML/CFT requirements, and should be mitigated.

The parent credit or financial institution should:

• a) designate a member of its management body or senior manager responsible for AML/CFT among the senior managers at the level of the parent undertaking, as well as a group AML/CFT compliance officer;
• b) set up an organisational and operational coordination structure at group level with sufficient decision-making power for the group AML/CFT management to make this position effective at managing and preventing ML/TF risks, in line with the proportionality principle and applicable domestic legislation;
• c) approve the group's internal AML/CFT policies and procedures and ensure that these are consistent with the group's structure and with the size and characteristics of the credit or financial institutions belonging to it;
• d) set up internal AML/CFT control mechanisms at group level;
• e) regularly evaluate the effectiveness of the AML/CFT policies and procedures at group level; and
• f) for a credit or financial institution that operates branches or subsidiaries domestically, or in another Member State or a third country, appoint a group AML/CFT compliance officer as a coordinator, for ensuring the implementation by all the entities of the group, which are engaged in financial activities, of the group policy and the adequate and appropriate systems and procedures for the effective prevention of ML/TF.

The group AML/CFT compliance officer should cooperate fully with the AML/CFT compliance officer of each entity .

The group AML/CFT compliance officer should have at least the following tasks:

• a) coordinate the business-wide assessment of the ML/TF risks carried out at local level by entities of the group and organise the aggregation of their results in order to have a good understanding of the nature, intensity and location of the ML/TF risks to which the group as a whole is exposed;
• b) draft a group-wide ML/TF risk assessment. In this respect, the parent entity of the group should take into account, in its ML/TF risk management system at group level, both the individual risks of the various entities of the group and their possible interrelations that could have a significant impact on the group-wide risk exposure. In this respect, particular attention should be paid to the risks to which the group ’ s branches or subsidiaries established in third countries are exposed, especially if they are of high ML/TF risk;
• c) define group-level AML/CFT standards and ensure that local, entity-level policies and procedures comply with the AML/CFT legislation and regulations applicable to each entity of the group individually, and are also aligned to the group standards defined;
• d) coordinate the activities of the various local AML/CFT compliance officers in the group's operational entities in order to ensure that they work consistently;
• e) monitor compliance of the branches and the subsidiaries located in third countries with EU AML/CFT provisions, in particular where requirements for the prevention of ML/TF are less strict than those set out in Directive (EU) 2015/849²⁸ ;
• f) set group-wide policies, procedures and measures concerning, in particular, data protection and sharing of information within the group for the purposes of AML/CFT, in accordance with the national legal provisions;
• g) ensure that the entities of the group have adequate STRs procedures and share information properly, including the information that a suspicious transaction report has been filed (with no prejudice to national confidentiality rules where existing).

²⁸ Please also refer to the Joint ESA Regulatory Technical Standards on the implementation of group-wide AML/CFT policies in third countries of 6 December 2017: JC 2017 25

The group AML/CFT compliance officer should produce an activity report on at least an annual basis and present it to the group management body. In addition to the points mentioned in paragraph 50, the group AML /CFT compliance officer’s report should contain, at least, the following points from the AML/CFT compliance officers in branches and subsidiaries:

• a) statistics consolidated at group level, especially on risk exposure and suspicious activities;
• b) monitoring of inherent risks that have occurred in one subsidiary or branch and across other subsidiaries and branches, and analysing the impact of residual risks;
• c) supervisory reviews, internal or external audits of subsidiaries or branches of the credit or financial institution including the serious weaknesses identified in the AML/CFT policies and procedures of the credit or financial institution, and the actions or recommendations for corrective measures; and
• d) information on steering and oversight of subsidiaries and branches with a special focus on the ones located in high-risk countries if applicable.

The AML/CFT compliance officer of a subsidiary or branch should have a direct reporting line with the group AML/CFT compliance officer.

The group should ensure that the policies and procedures entities put in place are aligned with the group’s procedures and policies to the extent permitted under applicable national law. Based on the proportionality criteria, credit or financial institutions should, where appropriate, establish committees (including a compliance committee) of the management body in its supervisory function as set out in Section 5 of the EBA revised guidelines on internal governance²⁹ .

²⁹ EBA revised guidelines on internal governance under Directive 2013/36/EU: EBA/GL/2021/05