5. Assessment of AML/CFT requirements applicable to the TCB

When assessing whether there are reasonable grounds to suspect if the TCB would be used to commit or facilitate the commission of ML/TF, competent authorities should at least:

• a) take into account the statement(s) of third-country competent authority(ies) (as per point
• (g) of Section 1, paragraph (2), of Part I of these Guidelines) in relation of the good repute of the applicant head undertaking, the intermediate and parent head undertaking its controlling shareholders, ultimate beneficial owners and members of the management body in management function, in particular: (i) their geographical location in countries that are considered high-risk and non-cooperative by the FATF or that have not

28 The Consultation paper is available here: https://www.eba.europa.eu/publications-and-media/press-releases/eba-consults-revised-guidelines-internal-governance 29 The Consultation papers are available at https://www.eba.europa.eu/publications-and-media/press-releases/eba-and-esma-launch-consultation-revised-suitability-assessment-framework-banks-and-investment-firms 30 The Consultation paper is available at https://www.eba.europa.eu/sites/default/files/2025-07/33a0ee15-9601-4c2b-828e-1b09201a6e9f/CP%20on%20Draft%20Guidelines%20on%20sound%20management%20of%20third%20pa rty%20risk.pdf implemented the FATF's recommendations in this area; and (ii) their involvement in money laundering, terrorist financing or any other financial crime, regardless of whether they have been convicted;

• b) assess the adequacy of the TCB’s proposed internal systems and controls and resources dedicated to the TCB’s AML/CFT compliance function and the knowledge and skills of the persons who will be in charge of the TCB’s AML/CFT compliance.

Competent authorities should consult the AML/CFT competent authority in accordance with Article 48(c)5 of CRD, and subsequently assess the level of expected prudential impact of the following:

• a) the knowledge and skills of the person responsible for the TCB’s compliance with AML/CFT requirements in the Member State where the application for authorisation has been submitted. This assessment should cover the person‘s adequate knowledge of the local laws and regulations governing AML/CFT of the Member States where the TCB will be established;
• b) whether the envisaged TCB’s ML/TF risk assessment is plausible in light of the TCB’s size, business model and target customers, whether it adequately captures the inherent risk factors relating to the target customers, product and services offered and distribution channels used;
• c) whether the arrangements and resources dedicated to the TCB’s AML/CFT compliance function are sufficient in light of the level of ML/TF risks identified in the TCB’s ML/TF risk assessment;
• d) the adequacy of the AML/CF-related policies and procedures of the TCB’s internal systems and controls. The assessment should also focus on how the proposed key policies and procedures would allow the TCB to mitigate the ML/TF risks identified in the ML/TF risk assessment of the TCB the day of its access to the market.

When assessing the above AML/CFT related policies and procedures, competent authorities should take a holistic approach to the assessment and use all information submitted as part of the authorisation. Accordingly, information submitted for the AML/CFT assessment should be complemented by other information, including, but not limited to the business plan, the information submitted on the internal governance and risk management.