4.2 Conducting a restrictive measures exposure assessment

Internal procedures of financial institutions should cover the assessment of restrictive measures exposure to understand the extent to which each area of their business is exposed to restrictive measures and vulnerable to circumvention of restrictive measures.

The restrictive measures exposure assessment should enable the financial institutions to iden-tify and assess:

• a. which restrictive measures regimes apply to them;
• b. the likelihood of non-implementation of restrictive measures;
• c. the likelihood of circumvention of restrictive measures;
• d. the impact of any breaches of restrictive measures; and
• e. the following risk factors:
• a) geographic risk, including:
• i. where the financial institution conducts its business, i.e. the jurisdictions and territories in which the financial institution is established or operates;
• ii. the extent to which those jurisdictions and territories are exposed to restric-tive measures or are known to be used to circumvent restrictive measures;
• iii. origin and destination of transactions.
• b) customer risk, including:
• i. links of customers and, if applicable, their beneficial owners and controlling shareholders, to countries for which restrictive measures are in place due to a situation affecting this country, or known to be used to circumvent restrictive measures;
• ii. the number of customers, type of customers and the complexity of those customers, such as the issues with identification of the beneficial owner;
• iii. activity of its customer base, and complexity of the activity, including any links to industries or sectors that may be subject to economic or any other restric-tive measures, as well as frequency and types of transactions.
• c) products and services risk, including:
• i. the nature of the financial institution’s products and services;
• ii. the extent to which providing these products and services exposes the financial institution to the risk of breaches of restrictive measures and circumvention of restrictive measures.
• d) delivery channels risk, including whether the use of intermediaries, agents, third par-ties, correspondent banking relationships or other delivery channels creates vulnera-bilities, including by:
• i. limiting the visibility the financial institution has on the parties involved;
• ii. making the financial institution dependent on the screening processes of third parties;
• iii. increasing the financial institution’s exposure to geographic risks because they are operating, or based in, countries for which restrictive measures are in place due to a situation affecting this country or countries known to be used to circum-vent restrictive measures.

The assessment referred to in paragraph 22 should be based on a sufficiently diverse range of information sources, including at least the following:

• a. information obtained as part of the application of the financial institution’s customer due diligence measures, in compliance with the provisions of Article 13 of Directive (EU) 2015/849;
• b. information from international bodies, government, national competent authorities includ-ing AML/CFT supervisors, financial intelligence units (FIUs) and law enforcement authori-ties (LEAs), such as up-to-date typologies on the circumvention of restrictive measures;
• c. information from credible and reliable open sources, such as reports in reputable newspa-pers and other reputable media outlets;
• d. information from credible and reliable commercial organisations, such as risk reports;
• e. where this is available, an analysis of previous restrictive measures alerts concerning true positive and false positive matches in order to identify situations where true positive matches are most likely to occur.

When performing a restrictive measures exposure assessment, financial institutions should con-sider whether retroactive screening of their customer database and past transaction records could be useful and proportionate. This may be the case where the financial institution has iden-tified or has reasonable grounds to suspect that its previous screening system was inadequate or ineffective.

Financial institutions should ensure that their restrictive measures exposure assessment re-mains up to date and relevant. To achieve this, financial institutions should review it at least once a year and where necessary, update it. In addition, as necessary, financial institutions should review their restrictive measures exposure assessment in the following situations:

• a. adoption of new restrictive measures and significant changes to existing restrictive measures;
• b. before providing new products, offering new product delivery channels, servicing new cli-ent groups, entering new geographical areas;
• c. significant changes to the institution’s activity profile, customer base, organisational structure or business model;
• d. identification of non-implementation of restrictive measures and circumvention of re-strictive measures, which reveals the inappropriateness of the restrictive measures expo-sure assessment;
• e. deficiencies in existing restrictive measures exposure assessment as identified by the fi-nancial institution or the competent authority responsible for the supervision of internal policies, procedures and controls to ensure the implementation of Union and national re-strictive measures.

Financial institutions should document their methodology for conducting and reviewing their restrictive measures exposure assessment and the outcome of that assessment and make them available to their competent authority upon request.

Where the financial institution is the parent undertaking of a group, the group management body should ensure that the subsidiaries of the group perform its own restrictive measures ex-posure assessment in a coordinated way and based on a common methodology while reflecting its own specificities.