Title 2: Adjusting the intensity of monitoring measures

Credit and financial institutions should set out in their policies and procedures how they adjust the level and intensity of monitoring in a way that is commensurate with the ML/TF risk asso-ciated with the customer and in line with the customer’s r isk profile, as set out in the EBA ’s risk factors guidelines and in particular guidelines 4.69 to 4.75. To effectively manage ML/TF risk associated with a customer, monitoring should at least include the following steps:

• a. setting expectations of the customer’s behavio ur, such as the likely nature, amount, source and destination of transactions, so as to enable the institution to spot unusual transactions.
• b. ensuring that the customer’s account is reviewed regularly to understand whether changes to the c ustomer’s risk profile are justified.
• c. ensuring that any changes to the previously obtained CDD information that might af-fect the institution’s assessment of the ML/TF risk associated with the individual busi-ness relationship are taken into account.

Credi t and financial institutions’ policies and procedures should contain guidance on handling applications from individuals that may have credible and legitimate reasons to be unable to provide traditional forms of identity documentation. These should set out at least:

• a. The steps to take where the customer is a person seeking asylum under the Geneva Convention of 28 July 1951 relating to the Status of Refugees, the Protocol thereto of 31 January 1967 and other relevant international treaties, and cannot provide the credit and financial institution with a traditional form of identification, such as a passports or ID card. Institutions’ policies and procedures should specify which alternative, independent documentation it can rely upon to meet its CDD obliga-tions, where permitted by national law. These documents should be sufficiently reliable, i.e., up to date, issued by an official national or local authority and con-taining, as a minimum, the applicant’s full name and date of birth.
• b. The steps to take where the customer is vulnerable and cannot provide traditional forms of identification or an address, for example because the customer is a refu-gee under the 1951 Geneva Convention or other relevant international treaties, or does not have a fixed address. Institutions’ policies and procedures should specify which alternative, independent documentation it can rely upon. This documenta-tion may include, where permitted under national law, expired identity documents and documentation provided by an official authority, such as social services or a well-established not-for-profit organisation working on behalf of official authorities (Red Cross or similar), which also provides assistance to this customer.
• c. Similar steps may also be applied to individuals who are not granted a residence permit but whose expulsion is impossible for legal or factual reasons. In such situ-ations, credit and financial institutions’ policies and procedures should have regard to certificates or documentation produced by an official authority or by an organi-sation providing support or legal assistance to those individuals on behalf of an official authority, where permitted by national law. Such authorities may include social work departments, home affairs ministries and migration services. These documents may be used as proof that the individual cannot be expulsed expelled in accordance with EU law.
• d. In cases where support for the persons referred to in points a., b. and c. is disbursed in the form of prepaid cards and where the conditions related to simplified due diligence are met as set out in guidelines 4.41, 9.15, 10.18 of the EBA’s ML/TF Risk Factors Guidelines, policies and procedures should indicate that credit and financial institutions may postpone the application of initial customer due diligence measures to a later date.
• e. In cases where the persons referred to in points a., b. and c. apply for access to a payment account and are considered as presenting low ML/TF risks, policies and procedures should indicate which alternative forms of ID the institution may ac-cept and the options for postponing the application of full CDD until after the establishment of the business relationship.