Guideline 11: Confidentiality restrictions and permissible uses of information

Non-public information

11.1 All permanent members in an AML/CFT college should keep any non-public information obtained in that college confidential. Non-public information includes requests for mutual assistance.

11.2 Where a permanent member receives a request for mutual assistance from a competent authority that is not a permanent member or observer in that AML/CFT college, and responding to that request would necessitate the disclosure of non-public information obtained in the AML/CFT college context, the permanent member who received the request should:

• (a) consult with those permanent members or observers from which the information that is subject to the disclosure request originated and with the lead supervisor;
• (b) refrain from disclosing non-public information unless it has obtained the written agreement from the permanent members and/or observers from which the non-public information originated;
• (c) refrain from disclosing, to the extent permitted, non-public information if the permanent members and/or observers from which the information originated consider that disclosure is not warranted. In those cases, the requested permanent member should ask the requesting competent authority to consider withdrawing its request for mutual assistance or amend it in such a way as to eliminate the need for the disclosure of non-public information.

11.3 Where the transmission of confidential information obtained in the AML/CFT college to an invited participant is permissible under the applicable law and such transmission is proposed, the lead supervisor should obtain explicit prior consent from the permanent members or observers that provided such information to the AML/CFT college. Where the applicable law requires that such transmission can only be made if the invited participant is subject to a specific professional secrecy requirement, the lead supervisor should assess whether the requirement is met and attach the assessment to the request for prior consent referred to in the first sentence of this paragraph. The invited participants should sign a confidentiality agreement that ensures that any confidential information discussed at the college meeting may not be disclosed to any person or entity outside the AML/CFT college unless required and permitted by law.

11.4 The lead supervisor should ensure that confidential information is always exchanged within the AML/CFT college through secure channels, unless such information is exchanged during the college meeting.

11.5 The exchange of information between the lead supervisor, permanent members and observers has to be in compliance with the applicable laws governing data protection.¹²

Permissible uses of information

11.6 Permanent members should use the information obtained in the AML/CFT college, without prior consent, for the purposes set out in Article 57a of Directive (EU) 2015/849 and particularly in order to:

• (a) ensure that the firm operating on a cross-border basis or EU establishments comply with the provisions of Directive (EU) 2015/849; or
• (b) inform their ML/FT risk assessment of the sector.

11.7 If a permanent member decides to disclose the information obtained in the AML/CFT college for any purpose other than those set out in Directive (EU) 2015/849 or specified in these guidelines, it should obtain prior written consent from the permanent members or observers from which the information originated or that may be affected by the information disclosure.

¹² For national authorities Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC and national implementing laws of this Regulation, and for the Union institutions bodies, offices and agencies Regulation (EU) 2018/1725. of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the institutions, bodies, offices and agencies of the Union and to the freedom circulation of this data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002 / EC.

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät standardit

2. Tunnistetut vaatimukset

3. Liittyvät standardit

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/