+Guidelines on risk based supervision (EBA/GL/2021/16)
---+1. Compliance and reporting obligations
------+Status of these guidelines
---------+1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 …
---------+2. Guidelines set the EBA view of appropriate supervisory practices within the European System of …
------+Reporting requirements
---------+3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify …
---------+4. Notifications will be published on the EBA website, in line with Article 16(3).
---+2. Subject matter, scope and definitions
------+Subject matter
---------+5. These guidelines specify in accordance with Article 48(10) of Directive (EU) 2015/849 and …
------+Scope of application
---------+6. Competent authorities should apply these guidelines when designing, implementing, revising and …
------+Addressees
---------+7. These guidelines are addressed to competent authorities as defined in point (2)(iii) of Article …
------+Definitions
---------+8. Unless otherwise specified, terms used and defined in Directive (EU) 2015/849 and Regulation …
---+3. Implementation
------+Date of application
---------+9. These Guidelines will apply three months after publication in all EU official languages …
------+Repeal
---------+10. The following guidelines are repealed with effect from the date of application. Joint …
---+4. Guidelines
------+4.1 Implementing the RBS Model
---------+11. Competent authorities should apply the following four steps as part of an effective AML/CFT RBS …
---------+12. Competent authorities should take into account that the risk-based supervision is not a one-off …
---------+13. Competent authorities should implement the general considerations set out in paragraphs 11 and …
---------+14. Competent authorities should be proportionate in their supervision of subjects of assessment …
---------+15. Competent authorities should recognise that the size or systemic importance of a subject of …
---------+16. Competent authorities should identify those credit institutions or financial institutions …
---------+17. In order to identify those credit institutions or financial institutions that may belong to the …
---------+18. Competent authorities should consider whether they will treat credit institutions or financial …
---------+19. Where a competent authority knows, or has reasonable grounds to suspect, that the risk …
---------+20. Competent authorities should cooperate and exchange all relevant information with each other …
---------+21. In order to cooperate and exchange information effectively, competent authorities should apply …
---------+22. Competent authorities should consider the objective of their cooperation and information …
---------+23. When cooperating and exchanging information with other stakeholders, including law enforcement …
------+4.2 Step 1 – Identification of risk and mitigating factors
---------+24. Competent authorities should identify and understand the risk factors that will affect each …
---------+25. When identifying ML/TF risk factors, competent authorities should draw on the EBA ’s ML/TF risk …
---------+26. Where subjects of assessment are clusters, competent authorities should identify relevant …
---------+27. Where a subject of assessment is supervised by multiple competent authorities within one Member …
---------+28. The extent and type of information sought by competent authorities to identify risk factors and …
---------+29. Competent authorities should identify risk factors in respect of sectors, subsectors, if …
---------+30. The sources of information that competent authorities should always consider include:  C1 a) …
---------+31. Other sources of information competent authorities should also consider include: a) the EBA’s …
---------+32. Competent authorities should have adequate knowledge, awareness and understanding of the ML/TF …
---------+33. As part of this, and based on the sources described in paragraphs 30 and 31, competent …
---------+34. Where a subject of assessment or a sector as a whole maintains significant links with other …
---------+35. Competent authorities should take reasonable steps to acquire and keep up to date adequate …
---------+36. When identifying third countries which have strategic deficiencies in their national AML/CFT …
---------+37. Competent authorities should have a good understanding of the risk factors that are relevant …
---------+38. Depending on the size of a sector and the nature of subjects of assessment within it, competent …
---------+39. Competent authorities should understand how each sector and subsector is organised, and the …
---------+40. Competent authorities should gather sufficient, relevant and reliable information from the …
---------+41. In order to develop a good understanding of the inherent risk factors within the sectors and …
---------+42. The information described above can also contribute to the competent authorities' perception of …
---------+43. Based on the sectoral risk assessment, competent authorities should gather sufficient, relevant …
---------+44. In order to develop a good understanding of the inherent risk factors applicable to subjects of …
---------+45. In order to develop a good understanding of residual risk factors to which subjects of …
---------+46. Where competent authorities consider that the information gathered through sources described in …
---------+47. Where information for the individual risk assessment is gathered directly from subjects of …
---------+48. Competent authorities should consider adjusting the level and frequency of information …
------+4.3 Step 2 – Risk assessment
---------+49. Competent authorities should take a holistic view of the ML/TF risk factors they have …
---------+50. When drawing up their risk assessment methodology, competent authorities should consider how …
---------+51. Competent authorities should develop a good understanding of the ML/TF risks present in each …
---------+52. Competent authorities should ensure that the sectoral risk assessment is sufficiently …
---------+53. In order to perform the sectoral risk assessment, competent authorities should first define the …
---------+54. When carrying out the risk assessment of the sector as a whole or of the subsector, if …
---------+55. As part of this process, competent authorities should consider allocating different weights to …
---------+56. Competent authorities should develop a comprehensive understanding of the inherent risks and …
---------+57. In order to achieve a comprehensive understanding of risks associated with individual subjects …
---------+58. Where, on the basis of information set out in paragraph 45 b) in these guidelines, competent …
---------+59. When assessing the residual risk factors, competent authorities should take the steps necessary …
---------+60. Competent authorities should determine how to incorporate their professional judgment in their …
---------+61. Competent authorities, who are the lead supervisor in accordance with the ESAs Joint Guidelines …
---------+62. To inform the risk assessment of subjects of assessment which are part of a group, competent …
---------+63. When assessing whether subjects of assessment have implemented group-wide policies and …
---------+64. Competent authorities should weight the risk factors for sectors and subjects of assessment …
---------+65. Where competent authorities use automated IT systems to allocate overall risk scores to …
---------+66. The assessment of the inherent risk level and the effect on the inherent risk level by risk …
---------+67. Competent authorities should ensure that the assessment of mitigants within the subject of …
---------+68. Where competent authorities have only limited or unverified information available to them about …
---------+69. Competent authorities should use their professional judgement to validate the results of the …
---------+70. Competent authorities should decide on the most appropriate way to categorise the risk profiles …
---------+71. Competent authorities should ensure that their risk assessment processes enable them to …
---------+72. When categorising the residual risk associated with subjects of assessment, sectors or …
---------+73. Where competent authorities decide not to apply the risk classification set out in paragraphs …
---------+74. Competent authorities should note that the categorisation of subjects of assessment for ML/TF …
---------+75. Where a competent authority uses an automated IT system to determine the risk profile or score …
------+4.4 Step 3 – Supervision
---------+76. Competent authorities should ensure that subjects of assessment exposed to significant and very …
---------+77. Competent authorities should determine and implement a longer-term AML/CFT supervisory strategy …
---------+78. In the strategy, competent authorities should set clear objectives for their approach to …
---------+79. Competent authorities should determine and put in place a supervisory plan for all subjects of …
---------+80. Competent authorities should coordinate all supervisory plans that cover the entire time period …
---------+81. In the supervisory plan, competent authorities should clearly set out the supervisory tools …
---------+82. Competent authorities should set out in the plan how they will allocate supervisory resources …
---------+83. Competent authorities should recognise that subjects of assessment exposed to significant or …
---------+84. Competent authorities should ensure that the AML/CFT supervisory plan is independent from the …
---------+85. When developing the AML/CFT supervisory plan, competent authorities should ensure that they …
---------+86. Where competent authorities are required to make amendments to the initial AML/CFT supervisory …
---------+87. Competent authorities should recognise that each subject of assessment, sector and subsector is …
---------+88. Competent authorities should have a good understanding of all supervisory tools available to …
---------+89. Competent authorities should select the most effective supervisory tools for subjects of …
---------+90. Competent authorities should exercise flexibility to be able to adapt their use of supervisory …
---------+91. Either on their own or in combination with other supervisory tools, competent authorities …
---------+92. When deciding whether to carry out a full-scope on-site inspection at the subject of …
---------+93. Competent authorities should consider using off-site reviews in those instances where a less …
---------+94. In some instances, competent authorities should consider whether the combination of two or more …
---------+95. Where competent authorities undertake an inspection remotely through virtual means, they should …
---------+96. Competent authorities should consider the most effective supervisory tool to ensure that …
---------+97. Competent authorities should have a holistic view of all supervisory tools applied by them. …
---------+98. To meet their obligations under Directive (EU) 2015/849, competent authorities should ensure …
---------+99. Competent authorities should ensure that, where relevant, subjects of assessment appoint …
---------+100. Where, as a result of checks described in paragraph 99, the competent authority is concerned …
---------+101. In the supervisory manual, competent authorities should outline the steps supervisors are …
---------+102. Competent authorities ’ sampling policy should be flexible and allow for adjustments based on …
---------+103. The supervisory manual should be reviewed regularly and updated when necessary, in particular …
---------+104. Competent authorities should ensure that AML/CFT supervision is carried out consistently by …
---------+105. Competent authorities should ensure the accuracy and reliability of information gathered from …
---------+106. Where competent authorities have identified that the information provided by one or more …
---------+107. Competent authorities should consider the resources required when designing and carrying out …
---------+108. Where competent authorities use services of external consultants or auditors to carry out …
---------+109. Where competent authorities use experts consistently as part of their supervisory process …
---------+110. Competent authorities should ensure that they maintain sufficient in-house expertise to be …
---------+111. In situations where external auditors or consultants are engaged by subjects of assessment to …
---------+112. Competent authorities should consider the work of external parties, and should reflect on it …
---------+113. Competent authorities should ensure that there are gateways in place to ensure that experts …
---------+114. Competent authorities should be confident that all breaches or weaknesses in subjects of …
---------+115. When deciding on the most effective supervisory follow-up, competent authorities should choose …
---------+116. When determining the most effective supervisory follow-up in accordance with paragraphs 114 …
---------+117. Where competent authorities have suspicions that the failure to implement effective systems …
---------+118. Competent authorities should formalise their supervisory follow-up process and set it out in …
---------+119. Where competent authorities have identified that subjects of assessment have failed to …
---------+120. While the supervisory follow-up process is separate from the sanctioning process, the two …
---------+121. Without regard to the provisions in these guidelines, competent authorities should report any …
---------+122. Competent authorities should provide feedback to subjects of assessment on the outcomes of …
---------+123. Where competent authorities decide to provide subjects of assessment with a redacted version …
---------+124. Competent authorities should issue the necessary guidance to subjects of assessment explaining …
---------+125. Competent authorities should also assess the need for further guidance in the sector. …
---------+126. Competent authorities should assess whether guidance may be needed for the sector as a whole …
---------+127. Competent authorities should consider engaging with subjects of assessment and other relevant …
---------+128. Competent authorities should periodically assess the adequacy of their existing guidance …
---------+129. Competent authorities should put in place and apply a communication strategy to ensure that …
---------+130. Competent authorities should identify the most adequate and effective communication tools …
---------+131. When deciding on the most appropriate tools for communication, the competent authorities …
---------+132. Competent authorities should ensure that staff with direct or indirect AML/CFT …
---------+133. Competent authorities should develop a training programme, which should be adjusted to meet …
---------+134. Competent authorities should ensure that their supervisory staff are trained in the practical …
---------+135. Training should be tailored to the AML/CFT responsibilities of relevant staff, and senior …
---------+136. Competent authorities should ensure that relevant training is provided in a timely manner …
------+4.5 Step 4 – Monitoring and updating of the RBS Model
---------+137. The RBS is not a one ‐ off exercise, but an ongoing and cyclical process. Therefore, competent …
---------+138. As part of the cyclical process, competent authorities should review and update their sectoral …
---------+139. Supervisory strategy and plans should also be updated as necessary, whether by establishing …
---------+140. Competent authorities should carry out periodic reviews of their individual and sectoral risk …
---------+141. The schedule of each review should be aligned with the supervisory strategy and commensurate …
---------+142. Ad hoc reviews of the risk factors, the risk assessment and, where necessary, the supervisory …
---------+143. Competent authorities should also consider whether changes affecting one particular subject of …
---------+144. Where, as a result of the amended risk assessment the risk categories or scores have changed …
---------+145. Competent authorities should seek to satisfy themselves that their internal processes and …
---------+146. Where a review identifies issues with the AML/CFT RBS Model, competent authorities should take …
---------+147. Where competent authorities use automated scoring systems to carry out their risk assessment …
---------+148. Competent authorities should periodically review whether their AML/CFT RBS Model delivers the …
---------+149. Competent authorities should also seek to familiarise themselves with international best …
---------+150. Measuring the impact of AML/CFT supervision on the level of compliance and the effectiveness …
---------+151. In addition to regular reviews at fixed intervals, competent authorities should review, update …
---------+152. Competent authorities should put in place an objective review process of their RBS Model …
---------+153. In addition to the internal review process, competent authorities should consider whether it …
---------+154. Competent authorities should document the AML/CFT RBS Model, its implementation and subsequent …
---------+155. Senior management of the competent authorities should have an adequate understanding of the …
---------+156. Competent authorities’ senior management should ensure that there are a dequate governance …
---+Annex
------+Conversion of risk categories
 English - European Union - Financial Industry -

Guidelines on risk based supervision (EBA/GL/2021/16)

Guidelines on risk based supervision (EBA/GL/2021/16)

Consolidated version.

https://www.eba.europa.eu/legacy/regulation-and-policy/regulatory-activities/anti-money-laundering-and-countering-financing/guidelines-on-risk-based-supervision – PDF

1. Pregled

,
1. Compliance and reporting obligations

1. Compliance and reporting obligations
2. Subject matter, scope and definitions

2. Subject matter, scope and definitions
3. Implementation

3. Implementation
4. Guidelines

4. Guidelines
Annex

Annex

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani standardi

2. Utvrđeni zahtjevi

Zahtjevi

3. Povezani standardi

Standardi

Povezani zadaci

Poveznice
is related to Imported: Guidelines on risk based supervision (2024-12-30-2032380b5d-cdbf)
is related to Assignments added: Guidelines on risk based supervision (2024-12-30-2032380b5d-cdbf) – 5 links
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/