14. Credit and financial institutions should set out the scope, steps and record keeping …

Credit and financial institutions should set out the scope, steps and record keeping requirements of the pre-implementation assessment in their policies and procedures, which should include at least:

• a) an assessment of the adequacy of the solution regarding the completeness and accuracy of the data and documents to be collected, as well as of the reliability and independence of the sources of information it uses;
• b) an assessment of the impact of the use of the remote customer onboarding solution on its business-wide risks, including ML/TF, operational, reputational and legal risks;
• c) the identification of possible mitigating measures and remedial actions for each risk identified in the assessment under letter b);
• d) tests to assess fraud risks including impersonation fraud risks and other information and communications technology (“ICT”) and security risks, in accordance with the provision 43 of the EBA Guidelines on ICT and security risk management¹³ ;
• e) an end-to-end testing of the functioning of the solution targeting customer(s), product(s) and service(s) identified in the remote customer onboarding policies and procedures.

¹³ EBA/GL/2019/04

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/