4.1 Internal policies and procedures

Credit and financial institutions should put in place and maintain policies and procedures to comply with their obligations under Article 13(1) (a) and (c) of Directive (EU) 2015/849 in situations where the customer is onboarded remotely. These policies and procedures should be risk-sensitive and set out at least:

• a) a general description of the solution credit and financial institutions have put in place to collect, verify, and record information throughout the remote customer onboarding process. This should include an explanation of the features and functioning of the solution;
• b) the situations where the remote customer onboarding solution can be used, taking into account the risk factors identified and assessed in accordance with Article 8 (1) of the Directive (EU) 2015/849 and in the business-wide risk assessment, including a description of the category of customers, products and services that are eligible for remote onboarding;
• c) which steps are fully autonomized and which steps require human intervention;
• d) the controls in place to ensure that the first transaction with a newly onboarded customer is executed only once all initial customer due diligence (CDD) measures, have been applied;
• e) a description of the induction and regular training programs to ensure staff awareness and up-to-date knowledge of the functioning of the remote customer onboarding solution, the associated risks, and of the remote customer onboarding policies and procedures aimed at mitigating such risks.

The policies and procedures, when implemented, should enable credit and financial institutions to ensure compliance with the provisions in Section 4.2 to 4.7 of these Guidelines.

4.1.2 Governance

In addition to the provisions set out in the Section 4.2.4 of the EBA Compliance Officer Guidelines¹¹ , the AML/CFT Compliance Officer¹² should, as part of their general duty to prepare policies and procedures to comply with the CDD requirements, make sure that remote customer onboarding policies and procedures are implemented effectively, reviewed regularly and amended where necessary.

¹¹ Draft Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer under Article 8 and Chapter VI of Directive

¹² In accordance with the Proportionality criteria set out in Section 4.2.2 of the Compliance Officer Guidelines

The management body of the credit and financial institution should approve remote customer onboarding policies and procedures and oversee their correct implementation.

4.1.3 The pre-implementation assessment of the remote customer onboarding solution

When considering whether to adopt a new remote customer onboarding solution, credit and financial institutions should carry out a pre-implementation assessment of the remote customer onboarding solution.

Credit and financial institutions should set out the scope, steps and record keeping requirements of the pre-implementation assessment in their policies and procedures, which should include at least:

• a) an assessment of the adequacy of the solution regarding the completeness and accuracy of the data and documents to be collected, as well as of the reliability and independence of the sources of information it uses;
• b) an assessment of the impact of the use of the remote customer onboarding solution on its business-wide risks, including ML/TF, operational, reputational and legal risks;
• c) the identification of possible mitigating measures and remedial actions for each risk identified in the assessment under letter b);
• d) tests to assess fraud risks including impersonation fraud risks and other information and communications technology (“ICT”) and security risks, in accordance with the provision 43 of the EBA Guidelines on ICT and security risk management¹³ ;
• e) an end-to-end testing of the functioning of the solution targeting customer(s), product(s) and service(s) identified in the remote customer onboarding policies and procedures.

¹³ EBA/GL/2019/04

Credit and financial institutions should consider the criteria in paragraph 14 (a) (d) and (e) to be met where the solution uses one of the following:

• a) electronic identification schemes notified in accordance with Article 9 of Regulation (EU) No 910/2014 and meeting the requirements of assurance levels ‘substantial’ or ‘high’ in accordance with Article 8 of that Regulation;
• b) relevant qualified trust services that meet the requirements of Regulation (EU) No 910/2014, in particular Chapter III, Section 3 and Article 24 (1), subparagraph 2, point
• (b) of that Regulation.

Credit and financial institutions should be able to demonstrate to their competent authority which assessments they carried out before implementation of the remote customer onboarding solution, the outcome of their assessment and how its use is appropriate in light of the ML/TF risks identified for the types of customer(s), service(s), geographies and product(s) in its scope.

Credit and financial institutions should start using a remote customer onboarding solution only once they are satisfied that it can be integrated into the institution’s wider internal control system, thereby allowing the institution to adequately manage the ML/TF risks that may arise from the use of the remote customer onboarding solution.

4.1.4 Ongoing monitoring of the remote customer onboarding solution

Credit and financial institutions should monitor the remote customer onboarding solution on an ongoing basis to ensure that it operates in line with the credit and financial institutions expectations. They should complement their policies and procedures described in paragraph 9 with a description of at least:

• a) the steps they will take to be satisfied of the ongoing quality, completeness, accuracy and adequacy of data collected during the remote customer onboarding process, which should be commensurate to the ML/TF risks to which the credit and financial institution is exposed to;
• b) the scope and frequency of such regular reviews; and
• c) the circumstances that will trigger ad hoc reviews, which should include at least:
• a. changes to the ML/TF risk exposure of the credit and financial institution;
• b. deficiencies on the functioning of the solution detected in the course of monitoring, audit or supervisory activities;
• c. A perceived increase in fraud attempts;
• d. changes to the legal or regulatory framework.

Credit and financial institutions should set out in their procedures and processes remedial measures where a risk has materialised, or where errors have been identified that have an impact on the efficiency and effectiveness of the general remote customer onboarding solution. These measures should include at least:

• a) a review of all affected business relationships, to assess whether sufficient initial CDD has been applied by the credit and financial institutions in order to comply with article 13 (1), (a), (b) and (c) of the AMLD. Credit and financial institutions should prioritise those business relationships that carry the highest ML/TF risk;
• b) taking into account the information obtained in the above-mentioned review, an assessment of whether an affected business relationships should be:
• a. subject to additional due diligence measures;
• b. subject to limitations, such as limits on the volume of transaction, where permitted under national law, until such time as a review has taken place;
• c. terminated;
• d. reported to the FIU;
• e. reclassified into a different risk category.

Credit and financial institutions should consider the most effective way to monitor the ongoing adequacy and reliability of the remote customer onboarding solutions. They should consider one or more of, but not limited to, the following means:

• i. quality assurance testing;
• ii. automated critical alerts and notifications;
• iii. regular automated quality reports;
• iv. sample testing;
• v. manual reviews.

This section also applies where fully automated remote customer onboarding solutions are used which are highly dependent on automated algorithms, without or with little human intervention.

Credit and financial institutions should be able to demonstrate to their competent authority which reviews they carried out and the remedial steps they have taken to rectify any shortcomings identified throughout the lifetime of the remote customer onboarding solution.