+4. Guidelines
---+4.1 Implementing the RBS Model
------+11. Competent authorities should apply the following four steps as part of an effective AML/CFT RBS …
------+12. Competent authorities should take into account that the risk-based supervision is not a one-off …
------+13. Competent authorities should implement the general considerations set out in paragraphs 11 and …
------+14. Competent authorities should be proportionate in their supervision of subjects of assessment …
------+15. Competent authorities should recognise that the size or systemic importance of a subject of …
------+16. Competent authorities should identify those credit institutions or financial institutions …
------+17. In order to identify those credit institutions or financial institutions that may belong to the …
------+18. Competent authorities should consider whether they will treat credit institutions or financial …
------+19. Where a competent authority knows, or has reasonable grounds to suspect, that the risk …
------+20. Competent authorities should cooperate and exchange all relevant information with each other …
------+21. In order to cooperate and exchange information effectively, competent authorities should apply …
------+22. Competent authorities should consider the objective of their cooperation and information …
------+23. When cooperating and exchanging information with other stakeholders, including law enforcement …
---+4.2 Step 1 – Identification of risk and mitigating factors
------+24. Competent authorities should identify and understand the risk factors that will affect each …
------+25. When identifying ML/TF risk factors, competent authorities should draw on the EBA ’s ML/TF risk …
------+26. Where subjects of assessment are clusters, competent authorities should identify relevant …
------+27. Where a subject of assessment is supervised by multiple competent authorities within one Member …
------+28. The extent and type of information sought by competent authorities to identify risk factors and …
------+29. Competent authorities should identify risk factors in respect of sectors, subsectors, if …
------+30. The sources of information that competent authorities should always consider include: C1 a) …
------+31. Other sources of information competent authorities should also consider include: a) the EBA’s …
------+32. Competent authorities should have adequate knowledge, awareness and understanding of the ML/TF …
------+33. As part of this, and based on the sources described in paragraphs 30 and 31, competent …
------+34. Where a subject of assessment or a sector as a whole maintains significant links with other …
------+35. Competent authorities should take reasonable steps to acquire and keep up to date adequate …
------+36. When identifying third countries which have strategic deficiencies in their national AML/CFT …
------+37. Competent authorities should have a good understanding of the risk factors that are relevant …
------+38. Depending on the size of a sector and the nature of subjects of assessment within it, competent …
------+39. Competent authorities should understand how each sector and subsector is organised, and the …
------+40. Competent authorities should gather sufficient, relevant and reliable information from the …
------+41. In order to develop a good understanding of the inherent risk factors within the sectors and …
------+42. The information described above can also contribute to the competent authorities' perception of …
------+43. Based on the sectoral risk assessment, competent authorities should gather sufficient, relevant …
------+44. In order to develop a good understanding of the inherent risk factors applicable to subjects of …
------+45. In order to develop a good understanding of residual risk factors to which subjects of …
------+46. Where competent authorities consider that the information gathered through sources described in …
------+47. Where information for the individual risk assessment is gathered directly from subjects of …
------+48. Competent authorities should consider adjusting the level and frequency of information …
---+4.3 Step 2 – Risk assessment
------+49. Competent authorities should take a holistic view of the ML/TF risk factors they have …
------+50. When drawing up their risk assessment methodology, competent authorities should consider how …
------+51. Competent authorities should develop a good understanding of the ML/TF risks present in each …
------+52. Competent authorities should ensure that the sectoral risk assessment is sufficiently …
------+53. In order to perform the sectoral risk assessment, competent authorities should first define the …
------+54. When carrying out the risk assessment of the sector as a whole or of the subsector, if …
------+55. As part of this process, competent authorities should consider allocating different weights to …
------+56. Competent authorities should develop a comprehensive understanding of the inherent risks and …
------+57. In order to achieve a comprehensive understanding of risks associated with individual subjects …
------+58. Where, on the basis of information set out in paragraph 45 b) in these guidelines, competent …
------+59. When assessing the residual risk factors, competent authorities should take the steps necessary …
------+60. Competent authorities should determine how to incorporate their professional judgment in their …
------+61. Competent authorities, who are the lead supervisor in accordance with the ESAs Joint Guidelines …
------+62. To inform the risk assessment of subjects of assessment which are part of a group, competent …
------+63. When assessing whether subjects of assessment have implemented group-wide policies and …
------+64. Competent authorities should weight the risk factors for sectors and subjects of assessment …
------+65. Where competent authorities use automated IT systems to allocate overall risk scores to …
------+66. The assessment of the inherent risk level and the effect on the inherent risk level by risk …
------+67. Competent authorities should ensure that the assessment of mitigants within the subject of …
------+68. Where competent authorities have only limited or unverified information available to them about …
------+69. Competent authorities should use their professional judgement to validate the results of the …
------+70. Competent authorities should decide on the most appropriate way to categorise the risk profiles …
------+71. Competent authorities should ensure that their risk assessment processes enable them to …
------+72. When categorising the residual risk associated with subjects of assessment, sectors or …
------+73. Where competent authorities decide not to apply the risk classification set out in paragraphs …
------+74. Competent authorities should note that the categorisation of subjects of assessment for ML/TF …
------+75. Where a competent authority uses an automated IT system to determine the risk profile or score …
---+4.4 Step 3 – Supervision
------+76. Competent authorities should ensure that subjects of assessment exposed to significant and very …
------+77. Competent authorities should determine and implement a longer-term AML/CFT supervisory strategy …
------+78. In the strategy, competent authorities should set clear objectives for their approach to …
------+79. Competent authorities should determine and put in place a supervisory plan for all subjects of …
------+80. Competent authorities should coordinate all supervisory plans that cover the entire time period …
------+81. In the supervisory plan, competent authorities should clearly set out the supervisory tools …
------+82. Competent authorities should set out in the plan how they will allocate supervisory resources …
------+83. Competent authorities should recognise that subjects of assessment exposed to significant or …
------+84. Competent authorities should ensure that the AML/CFT supervisory plan is independent from the …
------+85. When developing the AML/CFT supervisory plan, competent authorities should ensure that they …
------+86. Where competent authorities are required to make amendments to the initial AML/CFT supervisory …
------+87. Competent authorities should recognise that each subject of assessment, sector and subsector is …
------+88. Competent authorities should have a good understanding of all supervisory tools available to …
------+89. Competent authorities should select the most effective supervisory tools for subjects of …
------+90. Competent authorities should exercise flexibility to be able to adapt their use of supervisory …
------+91. Either on their own or in combination with other supervisory tools, competent authorities …
------+92. When deciding whether to carry out a full-scope on-site inspection at the subject of …
------+93. Competent authorities should consider using off-site reviews in those instances where a less …
------+94. In some instances, competent authorities should consider whether the combination of two or more …
------+95. Where competent authorities undertake an inspection remotely through virtual means, they should …
------+96. Competent authorities should consider the most effective supervisory tool to ensure that …
------+97. Competent authorities should have a holistic view of all supervisory tools applied by them. …
------+98. To meet their obligations under Directive (EU) 2015/849, competent authorities should ensure …
------+99. Competent authorities should ensure that, where relevant, subjects of assessment appoint …
------+100. Where, as a result of checks described in paragraph 99, the competent authority is concerned …
------+101. In the supervisory manual, competent authorities should outline the steps supervisors are …
------+102. Competent authorities ’ sampling policy should be flexible and allow for adjustments based on …
------+103. The supervisory manual should be reviewed regularly and updated when necessary, in particular …
------+104. Competent authorities should ensure that AML/CFT supervision is carried out consistently by …
------+105. Competent authorities should ensure the accuracy and reliability of information gathered from …
------+106. Where competent authorities have identified that the information provided by one or more …
------+107. Competent authorities should consider the resources required when designing and carrying out …
------+108. Where competent authorities use services of external consultants or auditors to carry out …
------+109. Where competent authorities use experts consistently as part of their supervisory process …
------+110. Competent authorities should ensure that they maintain sufficient in-house expertise to be …
------+111. In situations where external auditors or consultants are engaged by subjects of assessment to …
------+112. Competent authorities should consider the work of external parties, and should reflect on it …
------+113. Competent authorities should ensure that there are gateways in place to ensure that experts …
------+114. Competent authorities should be confident that all breaches or weaknesses in subjects of …
------+115. When deciding on the most effective supervisory follow-up, competent authorities should choose …
------+116. When determining the most effective supervisory follow-up in accordance with paragraphs 114 …
------+117. Where competent authorities have suspicions that the failure to implement effective systems …
------+118. Competent authorities should formalise their supervisory follow-up process and set it out in …
------+119. Where competent authorities have identified that subjects of assessment have failed to …
------+120. While the supervisory follow-up process is separate from the sanctioning process, the two …
------+121. Without regard to the provisions in these guidelines, competent authorities should report any …
------+122. Competent authorities should provide feedback to subjects of assessment on the outcomes of …
------+123. Where competent authorities decide to provide subjects of assessment with a redacted version …
------+124. Competent authorities should issue the necessary guidance to subjects of assessment explaining …
------+125. Competent authorities should also assess the need for further guidance in the sector. …
------+126. Competent authorities should assess whether guidance may be needed for the sector as a whole …
------+127. Competent authorities should consider engaging with subjects of assessment and other relevant …
------+128. Competent authorities should periodically assess the adequacy of their existing guidance …
------+129. Competent authorities should put in place and apply a communication strategy to ensure that …
------+130. Competent authorities should identify the most adequate and effective communication tools …
------+131. When deciding on the most appropriate tools for communication, the competent authorities …
------+132. Competent authorities should ensure that staff with direct or indirect AML/CFT …
------+133. Competent authorities should develop a training programme, which should be adjusted to meet …
------+134. Competent authorities should ensure that their supervisory staff are trained in the practical …
------+135. Training should be tailored to the AML/CFT responsibilities of relevant staff, and senior …
------+136. Competent authorities should ensure that relevant training is provided in a timely manner …
---+4.5 Step 4 – Monitoring and updating of the RBS Model
------+137. The RBS is not a one ‐ off exercise, but an ongoing and cyclical process. Therefore, competent …
------+138. As part of the cyclical process, competent authorities should review and update their sectoral …
------+139. Supervisory strategy and plans should also be updated as necessary, whether by establishing …
------+140. Competent authorities should carry out periodic reviews of their individual and sectoral risk …
------+141. The schedule of each review should be aligned with the supervisory strategy and commensurate …
------+142. Ad hoc reviews of the risk factors, the risk assessment and, where necessary, the supervisory …
------+143. Competent authorities should also consider whether changes affecting one particular subject of …
------+144. Where, as a result of the amended risk assessment the risk categories or scores have changed …
------+145. Competent authorities should seek to satisfy themselves that their internal processes and …
------+146. Where a review identifies issues with the AML/CFT RBS Model, competent authorities should take …
------+147. Where competent authorities use automated scoring systems to carry out their risk assessment …
------+148. Competent authorities should periodically review whether their AML/CFT RBS Model delivers the …
------+149. Competent authorities should also seek to familiarise themselves with international best …
------+150. Measuring the impact of AML/CFT supervision on the level of compliance and the effectiveness …
------+151. In addition to regular reviews at fixed intervals, competent authorities should review, update …
------+152. Competent authorities should put in place an objective review process of their RBS Model …
------+153. In addition to the internal review process, competent authorities should consider whether it …
------+154. Competent authorities should document the AML/CFT RBS Model, its implementation and subsequent …
------+155. Senior management of the competent authorities should have an adequate understanding of the …
------+156. Competent authorities’ senior management should ensure that there are a dequate governance …
|
4. Guidelines
4. Guidelines
1. Przegląd
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane normy
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane normy
- EBA - Published by the European Banking Authority at https://www.eba.europa.eu/
|