4.1 Implementing the RBS Model

Competent authorities should apply the following four steps as part of an effective AML/CFT RBS Model:

• a) Step 1 – Identification of ML/TF risk factors;
• b) Step 2 – Risk assessment;
• c) Step 3 – AML/CFT Supervision; and
• d) Step 4 – Monitoring and review of the RBS Model.

Competent authorities should take into account that the risk-based supervision is not a one-off exercise, but an ongoing and cyclical process.

Competent authorities should implement the general considerations set out in paragraphs 11 and 12 of these guidelines throughout their RBS model.

4.1.2 Proportionality

Competent authorities should be proportionate in their supervision of subjects of assessment for AML/CFT purposes. The extent of information sought, and the frequency and intensity of supervisory engagement and dialogue with a subject of assessment should be commensurate with the ML/TF risk identified.

Competent authorities should recognise that the size or systemic importance of a subject of assessment may not, by itself, be indicative of the extent to which it is exposed to ML/TF risk; small credit institutions or financial institutions that are not systemically important can nevertheless pose a high ML/TF risk.

4.1.3 Subjects of assessment

Competent authorities should identify those credit institutions or financial institutions within each sector that share a sufficient amount of similar characteristics to justify being grouped in one cluster. The shared characteristics should include the same level of risk that they are exposed to, inter alia, their size, the nature of their business, the type of customers serviced, the geographic area they operate in or activity and their delivery channels. For clustered credit institutions or financial institutions, the RBS process may be carried out at the collective level of the cluster itself, rather than at the level of each individual credit institution or financial institution within that cluster.

In order to identify those credit institutions or financial institutions that may belong to the same cluster, competent authorities should refer to their business model, the sectoral risk assessment, the risk assessments of individual credit institutions or financial institutions as well as other relevant sources of information as set out in paragraphs 30 and 31 of these guidelines, including the information gathered as a result of their supervisory activities.

Competent authorities should consider whether they will treat credit institutions or financial institutions in the same sector that form part of the same domestic financial group as one ‘subject of assessment’ .

•  A1

Where a competent authority knows, or has reasonable grounds to suspect, that the risk associated with an individual credit institution or financial institution in a cluster varies significantly from that associated with other credit institutions or financial institutions in that cluster, the competent authority should remove that credit institution or financial institution from the cluster and assess it either individually, or as part of a different cluster of credit institutions or financial institutions, which are exposed to a similar level of ML/TF risk. The removal from a cluster should include, inter alia, circumstances where:

• - the credit institution or financial institution is beneficially owned by individuals whose integrity is in doubt due to ML/TF concerns; or
• - the credit institution’s or financial institution’s internal control framework is deficient which has an impact on the credit institution’s or financial institution’s residual risk rating; or
• - the credit institution or financial institution has introduced significant changes to its products or services, or may have combined those changes with changes in delivery channels, its customer base or different geographic areas where the services or products are delivered. When assessing these points, competent authorities should take into account suitability assessments made under the prudential frameworks, in particular, where applicable, assessments in relation to the suitability of members of the management body and of the heads of internal control functions, including those assessments made under the joint ESMA and EBA ‘ fit and p roper’ guidelines⁴ and the EBA Guidelines on internal governance⁵ . In the case of crypto-asset service providers, competent authorities should consider applying Sections 1, 2, 3 and 5 of Title II, Section 6 of Title III, Sections 8 and 9 of Title IV and Title V of the EBA Guidelines on internal governance for investment firms⁶ for AML/CFT purposes⁷ .
•  O 4.1.4 Cooperation

⁴ Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU, EBA/GL/2021/06.

⁵ The E BA’s Guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2021/05.

⁶ The E BA’s Guidelines on internal governance under Directive (EU) 2019/2034, EBA/GL/2021/14.

⁷ This is without prejudice to Article 68 of Regulation (EU) 2023/1114 (MiCA) regarding governance arrangements for crypto-asset service providers.

Competent authorities should cooperate and exchange all relevant information with each other and with other stakeholders, including prudential supervisors, financial intelligence units, tax authorities, law enforcement agencies, judicial authorities and AML/CFT supervisors of third countries to ensure the effective AML/CFT supervision of subjects of assessment. All relevant information should be exchanged without delay. Where subjects of assessment operate on a cross ‐ border basis, such cooperation should extend to competent authorities of other Member States and where relevant, competent authorities of third countries.

•  C1

In order to cooperate and exchange information effectively, competent authorities should apply all cooperation and coordination measures and tools at their disposal, including those competent authorities have been required to put in place in accordance with Directive (EU) 2015/849. Competent authorities should ensure the reliability and continuity of these measures and tools to minimise the risk of a potential information void. In particular, competent authorities should refer to the ESAs Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions,⁸ the EBA Guidelines on cooperation and information between prudential and AML/CFT supervisors and financial intelligence units under Directive (EU) 2013/36⁹ and the Multilateral Agreement between the European Central Bank and national competent authorities pursuant to Article 57a(2)(b) of Directive (EU) 2015/849.¹⁰

•  A1

⁸ Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions, ‘The AML/CFT Colleges Guidelines’, JC 2019 81.

⁹ EBA Guidelines on Cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Article 117(6) of Directive 2013/36/EU, December 2021

¹⁰ Multilateral Agreement between the European Central Bank and national competent authorities pursuant to Article 57a(2)(b) of Directive (EU) 2015/849.

Competent authorities should consider the objective of their cooperation and information exchange with other stakeholders, and on this basis determine the most effective way for this cooperation, as the same approach may not be suitable in all circumstances. Competent authorities should in particular ensure that they cooperate effectively with those authorities that are responsible for the conduct and prudential supervision of the same subject of assessment.

•  O

When cooperating and exchanging information with other stakeholders, including law enforcement agencies, tax authorities, and other bodies or agencies, competent authorities should do so to the extent possible under national law. Competent authorities should seek to exchange information with local tax authorities on various tax offences and mechanisms, which would help the competent authority to assess the resulting ML risks to which the subjects of assessment or sectors may be exposed. It may also exchange information on possible preventative actions in this area.