4.7. Repeatedly failing PSPs, CASPs, IPSPs or ICASPs in accordance with Articles 8 (2), 12 (2), 17 (2) and 21(2) of Regulation (EU) 2023/1113

PSPs and CASPs should set out in their policies and procedures the quantitative and qualitative criteria they will use to determine whether a PSP, IPSP, CASP or ICASP is ‘repeatedly failing’ and document all transfers with missing or incomplete information.

Quantitative criteria should include at least:

• a) the percentage of transfers with missing or incomplete information sent by a specific PSP, IPSP, CASP or ICASP within a specific timeframe; and
• b) the percentage of follow-up requests that were left unanswered or were not ade-quately answered by a certain deadline.

Qualitative criteria should include at least:

• a) the level of cooperation of the requested PSP, IPSP, CASP or ICASP relating to previous requests for missing information;
• b) the existence of an agreement with the PSP, IPSP, CASP or ICASP requiring more time to provide the information;
• c) the type of information missing or incomplete and the reason given by the PSP, IPSP, CASP or ICASP for not providing the information.

The warning in accordance with Articles 8(2), point (a), 12(2), point (a), 17(2), point (a), and 21(2), point (a), of Regulation (EU) 2023/1113 should inform the prior PSP, IPSP, CASP or ICASP in the transfer chain of the steps that will be applied, should it continue to fail to provide the required information, including deadlines.

PSPs and CASPs should consider issuing a further warning to the prior PSP, IPSP, CASP or ICASP in the transfer chain that any future transfers will be rejected.

In relation to the treatment under Articles 8(2), point (b), 12(2), point (b), 17(2), point (b), and 21(2), point (b), of Regulation (EU) 2023/1113, PSPs and CASPs should consider how the re-peated failure by the prior PSP, IPSP, CASP or ICASP in the transfer chain to provide information and that PSP ’s and CASP ’s attitude to responding to such requests affect the ML/TF risk asso-ciated with that PSP or CASP, and, where appropriate, carrying out real-time monitoring of all transactions received from them.

Before taking the decision to terminate a business relationship, in particular where the prior PSP, IPSP, CASP or ICASP in the transfer chain is a respondent counterparty from a third coun-try, PSPs, IPSPs, CASPs and ICASPs should consider whether or not the risk can be managed in other ways, including ex ante through the application of enhanced due diligence measures in line with Article 19 of Directive (EU) 2015/849.

4.7.2. Reporting repeatedly failing PSPs, CASPs, IPSPs or ICASPs to the competent au-thority in accordance with Articles 8(2), 12(2), 17(2) and 21(2) of Regulation (EU) 2023/1113

Transfer of funds and crypto-assets

The report to the competent authority referred to in Articles 8(2), 12(2), 17(2) and 21 of Reg-ulation (EU) 2023/1113 should be submitted by the PSPs, IPSPs, CASPs and ICASPs without undue delay, and no later than three months after identifying the repeatedly failing PSP, IPSP, CASP or ICASP. Reporting should take place regardless of the reasons given by the ‘repeatedly failing’ PSP, IPSP, CASP or ICASP, if any, to justify that breach, or their location in the Union or outside.

The report should include:

• a) the name of the PSP, IPSP, CASP or ICASP identified as repeatedly failing to provide the required information;
• b) the country in which the PSP, IPSP, CASP or ICASP is authorised;
• c) the nature of the breach, including:
• i. the frequency of transfers with missing information;
• ii. the period of time during which the breaches were identified; and
• iii. any reasons the PSP, IPSP, CASP or ICASP may have given to justify their re-peated failure to provide the required information;
• d) details of the steps the reporting PSP, IPSP, CASP or ICASP took.