5.7 ML/TF risks and prudential concerns

When analysing the internal governance framework and investment firm-wide controls, competent authorities should also take into account the assessments received from AML/CFT supervisors, and evaluate whether these give rise to prudential concerns. This could be the case in particular where findings point to material weaknesses in an investment firm’s AML/CFT systems and controls. Conversely, where the competent authority’s assessment indicates the shortcomings in an investment firm’s internal controls and governance framework and investment firm-wide controls give rise to prudential concerns related to ML/TF risk, competent authorities should share the outcome of that assessment with AML/CFT supervisors.

Competent authorities should assess whether the investment firm’s overall governance framework includes also the management of the ML/TF risks.

In line with the EBA Guidelines on internal governance and Joint ESMA and EBA Guidelines on the assessment of the suitability of the members of the management body and key function holders, competent authorities should assess from a prudential perspective whether the responsibilities of the management body with regard to ML/TF risks are being complied with. Competent authorities should take into account any supplementary information received from the AML/CFT supervisors following their assessment.

Category 3 investment firms

For the purpose of proportionality, where lower ML/TF risk is justified by the types of clients and the nature, scale and complexity of activities of the investment firm allow, competent authorities should assess at least whether the investment firm’s overall governance framework includes also the management of ML/TF risks.