4.6. Transfers with missing or incomplete information in accord-ance with Articles 8, 12, 17 and 21 of Regulation (EU)

PSPs and CASPs should set out in their policies and procedures how they will determine whether to reject, suspend or execute a transfer in accordance with Articles 8(1), 12, 17(1) and 21 of Regulation (EU) 2023/1113. As part of this, PSPs and CASPs should list the risk factors that they will consider for each transfer.

PSPs, IPSPs, CASPs, and ICASPs should consider in their assessment before deciding on the appropriate course of action whether or not:

• a) the information allows for determination of the subjects of the transfer; and
• b) one or more risk-increasing factors have been identified that may suggest that the transfer presents a high ML/TF risk or gives rise to suspicion of ML/TF.

4.6.2. Rejecting or returning a transfer in accordance with Articles 8(1), point (a), 12, point (a), 17(1), point (a), and 21(1), point (a), of Regulation (EU) 2023/1113

Transfer of funds and crypto-assets

Where an IPSP, payee’s PSP, ICASP or beneficiary’s CASP decides to reject a transfer or an ICASP or beneficiary’s CASP decides to return a transfer instead of requesting the missing in-formation, they should inform the prior PSP, IPSP, CASP or ICASP in the transfer chain that the transfer has been rejected or returned because of missing information.

Transfer of crypto-assets

Where the rejection is technically not possible, the transfer should be returned to the origina-tor. Where returning the transfer to the original address is not possible, CASPs should apply alternative methods. The alternative methods should be set out in their policies, and should include holding the returned assets in a secure, segregated account while communicating with the originator to arrange a suitable return method to the originator. 4.6.3. Requesting required information in accordance with Articles 8(1), point (b), 12(1), point (b), 17(1), point (b), and 21 (1), point (b), of Regulation (EU) 2023/1113

Transfer of funds and crypto-assets

Where the PSP, IPSP, CASP or ICASP requests required information that is missing, it should set a reasonable deadline by which the information should be provided. This deadline should not exceed three working days for transfers taking place within the Union, and five working days for transfers received from outside of the Union, starting from the day the PSP, CASP, IPSP or ICASP identifies the missing information. Longer deadlines up to seven days may be set where transfer chains involve:

• a) more than two parties in the transfer flow, including intermediaries and non-banks;
• b) at least one PSP, IPSP, CASP or ICASP that is based outside of the EU.

Where a PSP, IPSP, CASP or ICASP decides to request the required information from the prior PSP, IPSP, CASP or ICASP in the transfer chain it should notify the prior PSP, IPSP, CASP or ICASP in the transfer chain of the technical actions taken on that transfer due to missing or incom-plete information, as applicable.

Any request for information or clarification should be sent through the same messaging system that was used for transmitting the required information or, where technical limitations exist as referred to in paragraph 24, secure methods of contact in line with the provisions and obli-gations of Regulation (EU) 2016/679.

Transfer of funds

Should the requested information not be forthcoming, the PSP or IPSP should send a reminder to the prior PSP or IPSP in the transfer chain and advise the prior PSP or IPSP in the transfer chain of the actions it may take should the PSP or IPSP fail to provide the requested information by the set deadline.

Where the requested information is not provided by the set deadline, the PSP or IPSP should make the decision on whether to reject, suspend or execute the transfer in line with its risk-based policies and procedures as specified in paragraphs 41 and 42. In addition to that decision it should, irrespective of whether the failure was repeated or not, consider the future treat-ment of the prior PSP or IPSP in the transfer chain for AML/CFT compliance purposes, including rejecting any future transfers from or to the prior PSP or IPSP in the transfer chain, or restrict-ing or terminating its business relationship with that PSP or IPSP.

Transfer of crypto-assets

Should the requested information not be forthcoming, as part of actions to be taken in accord-ance with Articles 17 and 21 of Regulation (EU) 2023/1113, CASPs or ICASPs should consider sending a reminder to the prior CASP or ICASP in the transfer chain and advise the prior CASP or ICASP in the transfer chain of the actions they may take should the CASP or ICASP fail to provide the required information before the set deadline.

Where the requested information is not provided by the set deadline, the CASP or ICASP should make the decision on whether to reject, return, suspend or execute the transfer in line with its risk-based policies and procedures as specified in paragraphs 52 and 53. In addition to that decision it should, irrespective of whether the failure was repeated or not, consider the future treatment of the prior CASP or ICASP in the transfer chain for AML/CFT compliance pur-poses, including rejecting any future transfers from or to the prior CASP or ICASP or self-hosted address in the transfer chain, or restricting or terminating its business relationship with it.

Requests for missing information or clarification with respect to transfers from or to self-hosted addresses should be sent directly to the CASP’s customer.

4.6.4. Executing a transfer in accordance with Articles 8(1), 12(1), 17(1) and 21(1) of Reg-ulation (EU) 2023/1113

Transfer of funds and crypto-assets

Where a PSP, IPSP, CASP or ICASP becomes aware that required information is missing, incom-plete or provided using inadmissible characters during the transfer and executes the transfer, it should document the reason for executing that transfer and, in line with its risk-based poli-cies and procedures, consider the future treatment of the prior PSP, IPSP, CASP, ICASP or self-hosted address in the transfer chain for AML/ CFT compliance purposes. However, where the payer, payee, originator or beneficiary cannot be unambiguously identified due to missing or incomplete information, or information provided using inadmissible characters, the PSP, IPSP, CASP or ICASP should not execute the transfer.

4.6.5. Detecting missing or incomplete information after executing a transfer in accord-ance with Articles 8(1), 12(1), 17(1) and 21(1) of Regulation (EU) 2023/1113

Transfer of funds

Where a PSP or IPSP detects ex post that the required information was missing, incomplete or provided using inadmissible characters, it should ask the prior PSP or IPSP in the transfer chain to provide the missing information, or to provide that information using admissible characters or inputs, applying Section 4.6.3.

Transfer of crypto-assets

Where a CASP or ICASP executes the transfer and detects ex post that the required information is missing or incomplete, it should ask the prior CASP or ICASP in the transfer chain to provide the missing information, in line with Section 4.6.3.