(viii) Amendments to Guideline 9: Sectoral Guideline for retail banks

Guideline 9.3 is replaced by the following:

'9.3. Banks should consider the following risk factors and measures alongside those set out in Title I of these Guidelines. Banks that provide wealth management services should also refer to sectoral Guideline 12, payment initiation services or account information services should also refer to sectoral Guideline 18 and those that provide crypto-asset services should refer to

4 Article 3, point (8) of Regulation (EU) 2023/1114 defines official currency as an official currency of a country that is issued by a central bank or other monetary authority. 17 sectoral Guideline 21.’

Guideline 9.16 is replaced by the following:

‘9.16 Where a bank’s customer opens a ‘pooled/omnibus account’ in order to administer funds or crypto-assets that belong to the customer’s own clients, the bank should apply full CDD measures, including treating the customer’s clients as the beneficial owners of funds held in the pooled account and verifying their identities.’

Guideline 9.17 is replaced by the following:

‘9.17 Where a bank has determined , based on its ML/TF risk assessment carried out in keeping with these Guidelines, that the level of the ML/TF risk associated with the business relation-ship is high, it should apply the EDD measures set out in Article 18 of Directive (EU) 2015/849 as appropriate.’

In Guideline 9.18, the introductory phrase is replaced by the following:

‘9.18. However, to the extent permitted by national legislation, where, according to the indi-vidual ML/TF risk assessment of the customer, the risk associated with the business relation-ship is low, a bank may apply simplified due diligence (SDD) measures, provided that:’

The heading of Guidelines 9.20 to 9.24 is replaced by the following:

‘Customers that offer services related to crypto - assets’

Guidelines 9.20 to 9.23 are deleted.

The following Guidelines 9.20 and 9.21 are inserted:

‘9.20 When entering into a business relationship with a customer who is a provider of crypto-assets services, other than a CASP regulated under Regulation (EU) 2023/1114⁵ , banks may be exposed to increased risk of ML/TF. The risk may be reduced in circumstances where such a provider is regulated and supervised under a regulatory framework similar to that set out in Regulation (EU) 2023/1114 or Directive (EU) 2015/849. Banks should carry out the ML/TF risk assessment of these customers prior to establishing a business relationship with them. As part of this, banks should also consider the ML/TF risk associated with the specific type of crypto-assets that are provided or serviced by these providers. ’

‘ 9.21 To ensure that the level of ML/TF risk associated with customers described in Guideline 9.20 is mitigated, banks, as part of their CDD measures, should at least:

5 Regulation (EU) 2023/1114 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937. 18

• a) enter into a dialogue with the customer to understand the nature of the business and the ML/TF risks to which it is exposed;
• b) in addition to verifying the identity of the customer’s beneficial owners, carry out due diligence on senior management to the extent that they are different, includ-ing consideration of any adverse information;
• c) understand the extent to which these customers apply their own CDD measures to their clients either under a legal obligation or on a voluntary basis;
• d) determine whether the customer is registered or licensed in an EU/EEA Member State or a non-EU country, and, in the case of a non-EU country, take a view on the adequacy of that non-EU country’s AML/CFT regulatory and supervisory re-gime in accordance with Guideline 2.11;
• e) determine whether the services provided by the customer fall within the scope of the registration or licence of the customer;
• f) determine whether the customer is providing services other than for which it is registered or licensed as a credit or financial institution;
• g) where the customer’s business involves issuing crypto -assets to raise funds, such as Initial Coin Offerings, banks should determine whether such business is per-formed in compliance with existing legal requirements and, where applicable, whether it is regulated for AML/CFT purposes according to internationally agreed standards, such as standards published by the Financial Action Task Force.’