(v) Amendments to Guideline 4: CDD measures to be applied by all firms

In Guideline 4.29, the introductory phrase is replaced by the following:

‘4.29 To perform their obligations under Article 13(1) of Directive (EU) 2015/849, where the business relationship is initiated, established, or conducted in non-face-to-face situations or an occasional transaction is carried out in non-face-to-face situations in accordance with the EBA’s Guidelines (EBA/GL/2022/15) on the use of Remote Customer Onboarding Solutions un-der Article 13(1) of Directive (EU) 2015/849, firms should:’

Guideline 4.35 is replaced by the following:

‘4.35 Where the external provider is a firm established in a non-EU country, the firm should ensure that it understands the legal risks and operational risks and data protection require-ments associated therewith and mitigates those risks effectively. The firm should also ensure that it can promptly access the relevant customer data and information when necessary, in-cluding in case of termination of an outsourcing agreement .’

In Guideline 4.60, point a) is replaced by the following:

‘a) they differ from the transactions the firm would normally expect based on its knowledge of the customer the business relationship or the category to which the customer belongs, ei-ther in the amount or frequency or complexity or similar, including when transactions are larger or more frequent than usual or for transactions involving small amounts that are unu-sually frequent, or where there are successive transactions without an obvious economic ra-tionale, such as transactions that are split up to circumvent reporting limits or align unusual transactions with the normally expected behaviour and patterns as supported by information gathered during the on-boarding procedure and the ongoing monitoring of the business rela-tionship.’

In Guideline 4.61, point a) is replaced by the following:

‘a) taking reasonable and appropriate measures to understand the background and purpose of these transactions, for example by determining the source and destination of the funds or crypto- assets or finding out more about the customer’s business to ascertain the likelihood of the customer making such transactions; and’

In Guideline 4.74, point b) is replaced by the following:

‘ b) Whether they will monitor transactions manually or by using an automated transaction monitoring system. Firms that process a high volume of transactions or transactions at high frequencies should consider putting in place an automated transaction monitoring system; ’

15

In Guideline 4.74, the following point is added:

‘d) whether the use of advanced analytics tools, like distributed ledger or blockchain analytics tools, is necessary in light of the ML/TF risk associated with the firm’s business, and with the firm’s customers’ individual transactions.’