4.5. Detecting missing information in accordance with Articles 7, 11, 16 and 20 of Regulation (EU) 2023/1113

Procedures as referred to in Articles 7 11, 16 and 20 of Regulation (EU) 2023/1113 should at least contain the following:

• a) the steps for the detection of missing, incomplete and meaningless information or in-admissible characters or inputs;
• b) a combination of monitoring practices during and after the transfer commensurate with the level of ML/TF risk to which the transfers are exposed, determined in accord-ance with t he EBA’s ML/TF Risk Factors Guidelines; and
• c) the criteria that help PSPs, IPSPs, CASPs and ICASPs identify risk-increasing factors, as described in paragraph 52.

4.5.2. Admissible characters or inputs checks on transfers of funds in accordance with Articles 7(1) and 11(1) of Regulation (EU) 2023/1113

Transfer of funds

Payees ’ PSPs and IPSPs should ensure that in relation to their messaging or payment and set-tlement systems:

• a) they understand the system’s validation rules;
• b) the system contains all the fields necessary to obtain the information required in Reg-ulation (EU) 2023/1113, as specified in Section 4.4.;
• c) the system prevents the sending or receipt of transfers where inadmissible characters or inputs are detected; and
• d) the system flags rejected transfers for manual review and processing.

Where a PSP’s or IPSP’s messaging or payment and settlement system does not meet all the criteria set out in paragraph 43, the PSP or IPSP should put in place controls to mitigate the shortcomings.

Payees ’ PSPs and IPSPs should set out in their policies and procedures:

• a) how they will detect whether the fields relating to the information in the messaging or payment and settlement system have been filled with characters or inputs that comply with the conventions of that system; and
• b) the steps they will take where the characters or inputs are not in line with the conven-tions of that system.

4.5.3. Monitoring of transfers in accordance with Articles 7(2), 11(2), 16(1) and 20 of Regulation (EU) 2023/1113

Transfer of funds and crypto-assets

Payees’ PSPs, IPSPs, beneficiary’s CASPs or ICASPs should set out in their policies and proce-dures how they will determine which transfers will be monitored during or after the transfer in accordance with Articles 7(2), 11(2), 16 (1) and 20 of Regulation (EU) 2023/1113. PSPs, IPSPs, CASPs and ICASPs should at least set out:

• a) which risk factors they will take into account in this assessment; and
• b) which risk-increasing factors, or combination of risk-increasing factors, will always trig-ger monitoring during the transfer, and which will trigger a targeted review after the transfer has taken place.

PSPs, IPSPs, CASPs and ICASPs should determine the risk factors based on those set out in the EBA’s ML/TF Risk Factors Guidelines, as well as relevant risk factors from their business -wide risk assessment, and the sectoral or national risk assessment to the extent that this is available. The risk factors should at least include:

• a) transfers that exceed a predefined value threshold taking into account the average value of transfers they routinely process and what constitutes an unusually large trans-fer, based on their particular business model;
• b) transfers where the payer, originator, payee, beneficiary, payer’s PSP, originator’s CASP, payee’s PSP or beneficiary’s CASP are located in countries or territories that are subject to restrictive measures including targeted financial sanctions, or countries or territories that present a high risk of circumvention of restrictive measures or targeted financial sanctions;
• c) transfers where the payer, originator, payee, beneficiary, payer’s PSP, originator’s CASP, payee’s PSP or beneficiary’s CASP are based in a country associated with high ML/TF risk, including, but not limited to:
• i) countries identified as high risk by the European Commission in accordance with Article 9 of Directive (EU) 2015/849; and
• ii) countries which, on the basis of credible sources such as evaluations, mutual evalu-ations, assessment reports or published follow-up reports, have AML/CFT require-ments that are not consistent with Directive (EU) 2015/849 or the FATF Recommen-dations and countries that have not effectively implemented those requirements;
• d) transfers where the payer’s PSP, originator’s CASP, IPSP, ICASP, payee’s PSP or benefi-ciary’s CASP are located in a country that, based on publicly available information, has not yet implemented the obligation to obtain, hold and transmit information on the originator and beneficiary when conducting wire and virtual asset transfers;
• e) transfers with entities based in a third country that does not have licensing regimes or does not regulate PSP activity in the case of funds transfers and CASP activities in the case of crypto-asset transfers;
• f) transfers with self-hosted addresses;
• g) transfers from or to accounts, addresses or wallets known to be linked with suspicious activity;
• h) a negative AML/CFT compliance record of the prior PSP, IPSP, CASP or ICASP in the transfer chain, based on public information;
• i) transfers from a PSP, IPSP, CASP or ICASP identified as repeatedly failing to provide required information without a justified reason, or from a PSP, IPSP, CASP or ICASP that has previously been known to fail to provide required information on a number of oc-casions without good reason, even if it did not repeatedly fail to do so;
• j) use of other techniques to perform layering of transactions that hinders the tracing of crypto-assets by concealing the trail leading back to the originator, including, but not limited to:
• i) funds and crypto-assets received and rapidly transferred further, thus artificially ex-tending the transfer chain;
• ii) anonymity-enhancing techniques, products or services, including, but not limited to, mixers or tumblers, Internet Protocol (IP) anonymisers and stealth addresses.

When considering whether or not a transfer raises suspicion, the PSPs, IPSPs, CASPs or ICASPs should take a holistic view of all ML/TF risk factors associated with the transfer and consider that missing or inadmissible information per se does not give rise to suspicion of ML/TF.

4.5.4. Missing information checks in accordance with Articles 7 (2), 11 (2), 16 (1) and 20 of Regulation (EU) 2023/1113

Transfer of funds and crypto-assets

The payee’s PSP, beneficiary’s CASP, IPSP and ICASP should treat information as missing if fields are left empty, or if the information provided is meaningless or incomplete.

The payee’s PSP, beneficiary’s CASP, IPSP and ICASP should treat at least the following infor-mation as meaningless:

• a) strings of random or illogical characters (such as ‘xxxxx’, or ‘ABCDEFG’);
• b) use of titles (such as Dr or Mrs) without the person’s name;
• c) other designations that are incoherent or unintelligible (such as ‘An Other’, or ‘My Cus-tomer’).

Where PSPs, CASPs, IPSPs and ICASPs use a list of terms commonly found to be meaningless, they should periodically review this list to ensure it remains relevant.