Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units

EBA/GL/2021/15 16 December 2021

Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU Contents

1. Executive summary 3

2. Background and rationale 4

3. Guidelines 8

4. Accompanying documents 32 4.1 Draft cost-benefit analysis/impact assessment 32 4.2 Feedback on the public consultation 38

1. Executive summary

A strong regulatory and supervisory framework to detect and fight money laundering and terrorist financing (‘AML/CFT framework’) that is implemented effectively is essential in order to safeguard the safety and soundness of institutions operating in the financial sector and the integrity and stability of the financial system. ML/TF cannot be fought in isolation, and this is why effective and efficient cooperation between the different stakeholders at national level and where necessary, across borders is important.

In recent years, a series of high-profile ML/TF cases involving EU credit institutions indicated a need to further bring improvements to the EU’s AML/CFT framework and the way that is implemented by those it addresses. These cases highlighted among other factors that cooperation between prudential and AML/CFT supervisors was often hampered by real or perceived legal obstacles, the absence of a formal framework to structure cooperation and information exchange, and a lack of understanding of the way such cooperation could be conducive to more effective supervision. Consequently, the Council in its December 2018 Council AML Action Plan requested a number of steps to be taken. Inter alia it emphasised the need for improved cooperation, which was afterwards confirmed by the European Commission’s post-mortem review.

In this context, Directive 2013/36/EU, as amended by Directive (EU) 2019/878, introduced an explicit cooperation obligation between competent authorities (‘prudential supervisors’), authorities entrusted with the public duty of supervising the obliged entities listed in points (1) and (2) of Article 2(1) of Directive (EU) 2015/849 (‘AML/CFT supervisors’), and financial intelligence units and removed barriers to effective information exchange between those authorities that were linked to confidentiality rules. The European Banking Authority (‘EBA’) is mandated by Article 117(6) of Directive 2013/36/EU as amended by Directive (EU) 2019/878, to develop guidelines specifying the manner for cooperation and information exchange between prudential supervisors, AML/CFT supervisors, and financial intelligence units, particularly in relation to cross-border groups and in the context of identifying serious breaches of anti-money laundering rules (‘AML/CFT Cooperation Guidelines’).

The guidelines set out general provisions and practical modalities for the cooperation and information exchange between the AML/CFT supervisors, prudential supervisors and financial intelligence units, while respecting the autonomy of their respective roles. The guidelines set out requirements for the cooperation and information exchange between the relevant authorities domestically and on a cross-border basis, regardless of the institutional setting of these authorities.

The guidelines apply to the cooperation and information exchange relating to institutions as defined in point (3) of Article 3(1) of Directive 2013/36/EU or of financial sector operators as defined in point (1a) of Article 4 of Regulation (EU) No 1093/2010 where these operators are included in the institution’s prudential consolidation. The guidelines explain how AML/CFT supervisors, prudential supervisors and financial intelligence units should cooperate and exchange information throughout the supervisory life cycle covering authorisations, ongoing supervision including the risk assessment and the imposition of supervisory measures and sanctions, including the withdrawal of the authorisation.

2. Background and rationale

Background

1. Involvement of an institution or its management in money laundering and terrorist financing (ML/TF) affects the reputation, financial soundness and viability of that institution, and can have a negative impact on the stability and integrity of the financial system in which the institution operates. This is why a strong regulatory and supervisory framework to prevent and detect money laundering and terrorist financing is an essential part of a well-functioning banking and capital markets union.

2. The current framework involves different authorities across the EU, with different supervisory tasks, powers and responsibilities. This includes authorities responsible for the supervision of compliance by institutions with requirements set out in Directive (EU) 2015/849 (‘AML/CFT supervisors’), which are responsible for supervising whether institutions have put in place and maintain effective systems and controls to mitigate the risk that they may be used for ML/TF purposes. In addition, competent authorities responsible for supervising institutions’ compliance with prudential requirements under Directive 2013/36/EU as amended by Directive (EU) 2019/878 and Regulation (EU) No 575/2013 as amended by Regulation (EU) 2019/876 (‘prudential supervisors’) should also consider ML/TF risks and concerns in their relevant supervisory activities, including in the context of suitability assessments, and thus contribute to the wider Union framework to combat ML/TF. Besides the supervisory authorities, the framework includes the financial intelligence units that are solely responsible for the receipt and analysis of suspicious transaction reports received from the institutions in line with Article 33 of Directive (EU) 2015/849.

3. While each authority has its own role and responsibilities in the fight against ML/TF, there are areas where their tasks complement each other and therefore effective cooperation and information exchange among them is essential to identify, address and mitigate ML/TF risks, to ensure the prudential soundness and viability of institutions and the stability of the financial system as a whole. However, the evidence from the EBA’s implementation reviews shows that in the absence of specific legal requirements to cooperate and due to the lack of cooperation arrangements, this cooperation and information exchange is not always happening in practice highlighting a clear need for common guidelines in this area.

Legal basis

4. In 2018, the Council of the European Union adopted an Anti-Money Laundering Action Plan. This Action Plan sets out a number of objectives, with deliverables and timelines through which the Council intended to strengthen the effectiveness of the EU’s AML/CFT framework. As part of this, the Council requested the ESAs, AML/CFT supervisors and prudential supervisors to ensure effective cooperation throughout the various phases of the supervisory processes, establishing adequate channels for information exchange and ensuring ongoing information flows in both directions.

5. The amendments to Directive (EU) 2015/849 introduced by Directive (EU) 2018/843 removed any legal obstacles to the exchange of confidential information and collaboration between AML/CFT competent authorities and prudential supervisors. Directive (EU) 2015/849 also requires that AML/CFT competent authorities and financial intelligence units as well as other public authorities involved in the fight against ML/TF have in place effective mechanisms to cooperate .

6. In addition, Directive (EU) 2019/878 introduced an explicit cooperation obligation between prudential supervisors, AML/CFT supervisors, and financial intelligence units into Directive 2013/36/EU and removed barriers to effective information exchange between those authorities that were linked to confidentiality rules, provided that such cooperation and information exchange do not impinge on an ongoing inquiry, investigation or proceedings in accordance with the criminal or administrative law of the Member State where such authorities are located. The European Banking Authority (‘EBA’) is mandated by Article 117(6) of Directive 2013/36/EU to develop guidelines specifying the manner for cooperation and information exchange between prudential supervisors, AML/CFT supervisors, and financial intelligence units, particularly in relation to cross-border groups and in the context of identifying serious breaches of anti-money laundering rules (‘AML/CFT Cooperation Guidelines’).

7. The guidelines should be read in conjunction with and without prejudice to the EBA Guidelines on a common assessment methodology for granting authorisation as a credit institution under Article 8(5) of Directive 2013/36/EU , the (final reports on draft) RTS and ITS on the authorisation of credit institutions , the joint EBA and ESMA Guidelines on the assessment of the suitability of members of the management body and key function holders , the (final report on draft) ITS on the procedures and forms in respect of proposed acquisitions and increases of qualifying holdings in credit institutions , the Joint Guidelines on the prudential assessment of proposed acquisitions and increases of qualifying holdings in the financial sector , the Joint Committee Guidelines on cooperation and information exchange for the purposes of Directive (EU) 9 10 2015/849 , the EBA Guidelines on outsourcing arrangements , the Joint Guidelines on risk based supervision , and the EBA Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing .

Rationale and objective of the guidelines

8. The aim of these guidelines is to establish a formal framework to ensure effective cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units, thus enabling and facilitating the efficient and effective supervision and coordinated supervisory actions where necessary. The goal is to identify synergies between the work of the different authorities and build on these synergies to foster a more effective approach to both prudential and AML/CFT supervision, while avoiding unnecessary duplications and respecting the autonomy of the different authorities’ respective roles, tasks and competencies.

9. The guidelines are designed so that they can be applied in a neutral way regardless of the institutional setting of the prudential supervisors, AML/CFT supervisors or the financial intelligence unit in each Member State. The guidelines also do not prescribe a specific way of how authorities should engage with the financial intelligence unit and allow flexibility for the competent authorities to choose the most suitable cooperation mechanism. 10.The guidelines leverage on supervisory experiences, the EBA’s existing work in this area and international initiatives such as the BCBS Guidelines for interaction and cooperation between prudential and AML/CFT supervisors. When drafting these guidelines, the EBA launched a targeted questionnaire addressed to EU financial intelligence units to gain a better insight into the type of information and extent of cooperation the financial intelligence units would consider useful for their tasks and the type and extent of information that the financial intelligence units would be able to share with AML/CFT and prudential supervisors. The EBA also carried out a fact-finding exercise with prudential supervisors, which aimed to gather more information on the way and extent to which prudential supervisors cooperate with AML/CFT supervisors. The outcome of both surveys has informed these guidelines and is reflected in the impact assessment as outlined in section 4.1. In addition to that, a prior targeted consultation was organised with EU financial intelligence units in view of the fact that the financial intelligence units are relevant stakeholders of these guidelines, as they are in the scope of the mandate under Article 117(6) of Directive 2013/36/EU, but unlike the prudential supervisors and the AML/CFT supervisors, financial intelligence units as such are not represented in the EBA governance structure. The feedback received from the financial intelligence units in the prior targeted consultation was taken into account for the relevant sections concerning the cooperation and information exchange with financial intelligence units. 11.These guidelines specify the manner in which prudential supervisors, AML/CFT supervisors and the financial intelligence units should cooperate with each other and exchange information that is available to them, gathered or created as part of their respective tasks, in accordance with Article 117(5) of Directive 2013/36/EU. The guidelines require that the cooperation and information exchange should happen throughout the supervisory life cycle covering authorisation, qualifying holding assessments, assessments of suitability of members of management body and key function holders, ongoing supervision including assessment of internal controls and risk management systems and the imposition of supervisory measures and sanctions and the withdrawal of the authorisation. 12.These guidelines recognise that in certain circumstances, there are existing arrangements for cooperation and information exchange in place, including those developed as part of the multilateral agreement between the ECB and the AML/CFT supervisors . Where such arrangements exist, the relevant prudential supervisors or AML/CFT supervisors should decide on whether the existing arrangements for cooperation and information exchange can be used to comply with these guidelines, or would need to be updated or otherwise supplemented with alternative arrangements in view of the modalities for cooperation and information exchange as set out in these guidelines. 13.In a cross-border context, the cooperation can be carried out within prudential or AML/CFT colleges. Where such colleges exist, AML/CFT supervisors and prudential supervisors can use the college framework for the purposes of the cooperation and information exchange, as set out in these guidelines, where deemed appropriate in view of the nature of the cooperation and the type of information to be exchanged. 14.In accordance with Article 9a of Regulation (EU) No 1093/2010, the EBA is in the process of establishing a central AML/CFT database. The EBA developed the regulatory technical standards specifying the information that will be collected in this central database, and how this information will be analysed by the EBA and in particular made available to relevant authorities, including prudential supervisors, and AML/CFT supervisors, for their supervisory activities with regard to the prevention of ML/TF. Once the database has been established, the provisions set out in these guidelines will apply in conjunction with the legal requirements in the RTS.

3. Guidelines

EA/GL/2021/15 16 December 2021

Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU 1. Compliance and reporting obligations

Status of these guidelines

1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.

2. Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions.

Reporting requirements

3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by 11.04.2022. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2021/15’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA. 4. Notifications will be published on the EBA website, in line with Article 16(3).

2. Subject matter, scope and definitions

Subject matter

5. These guidelines specify the manner of cooperation and information exchange, particularly in relation to cross-border groups and in the context of identifying serious breaches of anti-money laundering rules, according to Article 117(6) of Directive 2013/36/EU.

Scope of application

6. Competent authorities as defined in point (36) of Article 3(1) of Directive 2013/36/EU and in point (5) of Article 3(1) of Directive (EU) 2019/2034 should apply these guidelines at the individual and consolidated level referred to in Article 110 of Directive 2013/36/EU.

7. Authorities entrusted with the public duty of supervising the obliged entities listed in points (1) and (2) of Article 2(1) of Directive (EU) 2015/849 for compliance with that Directive should apply these guidelines, both at individual level, and at the group-wide level set out in Article 48 (5) of Directive (EU) 2015/849 .

Addressees

8. These guidelines are addressed to competent authorities as defined in point (2)(i) and (2)(viii) of Article 4 of Regulation (EU) No 1093/2010 , and to competent authorities as defined in point (2)(iii) of Article 4 of Regulation (EU) No 1093/2010 to the extent these authorities are supervising the compliance with the requirements of Directive (EU) 2015/849 of institutions as defined in point (3) of Article 3(1) of Directive 2013/36/EU, or of financial sector operators as defined in point (1a) of Article 4 of Regulation (EU) No 1093/2010 where these operators are included in the institution’s prudential consolidation, including of branches established in the Union whether their head office is situated in a Member State or in a third country (‘institutions’).

Definitions

9. Unless otherwise specified, terms used and defined in Directive 2013/36/EU, Regulation (EU) No 575/2013, , and Directive (EU) 2015/849 have the same meaning in the guidelines. In addition, for the purposes of these guidelines, the following definitions apply: means a competent authority as defined in AML/CFT supervisor point (2)(iii) of Article 4 of Regulation (EU) No 1093/2010. means a competent authority as defined in Prudential supervisor point (2)(i) or (2)(viii) of Article 4 of Regulation (EU) No 1093/2010. means an AML/CFT college as defined in the Joint Guidelines on cooperation and information exchange for the purpose of AML/CFT college Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (JC 2019 81). means a college of supervisors as referred to in Prudential college Article 51 or 116 of Directive 2013/36/EU. means the risk as defined in the Guidelines ML/TF risk EBA/GL/2021/02.

3. Implementation

Date of application

10. These guidelines apply from 1 June 2022.

4. General provisions

11. The cooperation and information exchange under Article 117(5) of Directive 2013/36/EU should be organised in an efficient and effective manner in accordance with the provisions of these guidelines, both at the domestic level and in the cross-border context, regardless of the specific institutional arrangements in each Member State for the respective functions of AML/CFT supervisors, prudential supervisors and financial intelligence units (FIUs). In order to ensure efficiency, such cooperation and information exchange should avoid unnecessary duplication of efforts.

12. Prudential supervisors and AML/CFT supervisors should exchange with each other as well as with the financial intelligence units, information that they have gathered or created in the exercise of their tasks and that is relevant for the exercise of the other authority’s tasks. The exchange of information should take place on request and on own initiative.

13. Prudential supervisors and AML/CFT supervisors should cooperate with each other within their respective competences to the fullest extent possible and exchange information without undue delay, provided that such cooperation and information exchange do not impinge on an ongoing inquiry, investigation or proceedings as referred to in Article 117(5) of Directive 2013/36/EU.

5. Mechanisms for cooperation, information exchange and confidentiality treatment

5.1 Practical modalities for cooperation and information exchange

14. Effective and efficient means for cooperation and information exchange should be in place to support the cooperation and information exchange under these guidelines both in the domestic and cross-border context. Such means should ensure confidential information is exchanged through secure channels.

15. The information should be provided in writing, regardless of its format, be it paper, electronic communication or any other format. Information exchanges or requests for cooperation should include a clear identification of the institution or branch concerned including the Legal Entity Identifier code (LEI) where available (for a branch: the LEI of the parent).

16. Where deemed necessary, as in case of urgency or emergency, the information should be requested, or provided on own initiative, verbally, by telephone or during a meeting between the relevant supervisors. Such a verbal exchange should be supported in writing as soon as feasible thereafter.

17. Where the prudential and the AML/CFT supervisor is the same authority or where the AML/CFT supervisor and the financial intelligence unit is the same authority, other processes than those identified in this section may be put in place as appropriate, ensuring at least the same degree of cooperation and information exchange as per in this section.

Relevance criteria for information to be exchanged

18. Prudential supervisors should consider information to be relevant for the exercise of AML/CFT supervisory tasks at least in situations where the information: a) gives the prudential supervisor reasonable grounds to suspect that in connection with an institution, ML or TF has been or is being committed or attempted or there is an increased risk thereof; b) indicates that the business activity or business model of an institution, or changes to it suggest that the institution may be exposed to an increased ML/TF risk; c) relates to shortcomings in an institution’s compliance with prudential requirements that may have a negative impact on the AML/CFT governance arrangements and internal systems and controls framework; or d) relates to an institution’s compliance with requirements set out in Directive (EU) 2015/849.

19. AML/CFT supervisors should consider information to be relevant for the exercise of prudential supervisory tasks at least, where the information may have an impact on the institution’s business model, internal governance arrangements, risk management framework, operational risk, adequacy of liquidity, institution-wide systems and controls, concerns the institution’s compliance with the prudential requirements as set out in Directive 2013/36/EU and Regulation (EU) No 575/2013 or it may affect the financial soundness or viability of the institution.

20. Prudential supervisors and AML/CFT supervisors should consider information to be relevant for the exercise of a financial intelligence unit’s tasks when that information could indicate possible ML or TF, and when it might help to identify ML/TF risks, trends, patterns or typologies.

21. Prudential supervisors should provide the relevant information to: a) the AML/CFT supervisors responsible for the supervision of the institution in the Member State where the institution is established or it is intended to be established, and b) the AML/CFT supervisors in the Member State where the EU parent undertaking is established if the institution belongs to a cross-border group or, in the case of a single institution with branches in other Member States, where the institution’s head office is located, or where an AML/CFT college has been established, the lead supervisor.

22. Prudential supervisors should inform each of the receiving AML/CFT supervisors about the other AML/CFT supervisors to whom they are providing or have provided information, where relevant.

23. AML/CFT supervisors should provide the relevant information to: a) the prudential supervisors responsible for the supervision of the institution in the Member State where the institution is established or it is intended to be established, and b) the consolidating supervisor if the institution belongs to a cross-border group, or in the case of a single institution with branches in other Member States, the prudential supervisor of the head office.

24. AML/CFT supervisors should inform each of the receiving prudential supervisors about the other prudential supervisors to whom they are providing or have provided information, where relevant.

Requests for cooperation and information

25. Prudential and AML/CFT supervisors should make a request for information or cooperation in writing, specifying at least the following: a. the type of information or cooperation that is requested; b. the purpose for which the information or cooperation is requested, including the specification of the legal provisions defining the supervisory tasks for which the requested information is deemed to be relevant; and c. for time-sensitive requests, the date by which the reply is expected, including the context and urgency of the request, if any.

26. Where the requested authority is unable to provide the requested information or cooperation by the date set by the requesting authority, an alternative date should be agreed on. In the event that the requested authority can provide a partial reply within the date indicated by the requesting authority, the requested authority should provide any information that it can so provide and agree on another date for the provision of any outstanding information.

27. Where a request for cooperation or information cannot be fulfilled in part or in whole, the requested authority should provide a detailed explanation in writing of the reasons why it is not possible or feasible to comply with the request.

28. Prudential supervisors and AML/CFT supervisors should, where possible, request the necessary information from the authority that originally gathered or created the information, if known.

Own initiative provision of information

29. Information deemed relevant for another authority should be transmitted on own initiative and without undue delay, unless it is obvious to the owner of the information that the potential receiving authority already holds that information.

Cooperation between prudential supervisors and AML/CFT supervisors

30. Prudential supervisors and AML/CFT supervisors should agree to set up a regular exchange of information where considered appropriate for the supervision of an institution or of crossborder groups or institutions with branches established in other jurisdictions. Where agreed to set up a regular exchange of information, prudential supervisors and AML/CFT supervisors should share with each other at regular intervals information that is considered to be relevant for the performance of the other supervisor’s tasks.

31. Prudential supervisors and AML/CFT supervisors should notify each other of designated contact points to facilitate the transmission of relevant information and should consider putting in place a functional mailbox.

32. Where there are existing arrangements for cooperation and information exchange in place, the relevant prudential supervisors and AML/CFT supervisors should decide on whether the existing arrangements for exchanging information are sufficient to comply with the provisions set out in these guidelines or whether the authorities need to update these arrangements or otherwise supplement them with alternative arrangements in view of the modalities for cooperation and information exchange as set out in these guidelines.

33. Where the cooperation and information exchange is already taking place in prudential colleges and/or AML/CFT colleges, AML/CFT supervisors and prudential supervisors should use the colleges framework for the purposes of the cooperation and information exchange as set out in these guidelines, where deemed appropriate in view of the nature of the cooperation and the type of information to be exchanged.

Cooperation between prudential supervisors and the financial intelligence unit

34. Prudential supervisors should share with the financial intelligence unit information gathered or created in the performance of their supervisory activities that is relevant for the tasks of the financial intelligence unit in accordance with paragraph 20.

35. Where appropriate, prudential supervisors should seek from the financial intelligence unit information as set out in these guidelines that is relevant for the performance of their supervisory tasks.

Cooperation between AML/CFT supervisors and the financial intelligence unit

36. AML/CFT supervisors should share with the financial intelligence unit information gathered or created in the performance of their supervisory tasks that is relevant for the tasks of the financial intelligence unit in accordance with paragraph 20.

37. Where appropriate, AML/CFT supervisors should seek from the financial intelligence unit information as set out in these guidelines that is relevant for the performance of their supervisory tasks.

5.2 Confidentiality restrictions and permissible uses of information

38. Prudential supervisors and AML/CFT supervisors should ensure confidential information is exchanged with each other as well as with the financial intelligence unit through secure channels.

39. Any information received following the cooperation and information exchange set out in Article 117(5) of Directive 2013/36/EU should be kept confidential as required by applicable laws, and used or disclosed only as permitted by applicable laws. Prior consent should be observed where required in accordance with the applicable laws.

40. The cooperation and information exchange set out in these guidelines should be performed in compliance with the applicable laws governing data protection.

6. Cooperation and information exchange in the context of the processes for authorisation, proposed acquisitions of qualifying holdings, suitability assessments, and withdrawal of authorisation

6.1 Applications for authorisation of institutions

Prudential supervisors

41. When assessing an application for authorisation under Articles 10 to 14 of Directive 2013/36/EU , prudential supervisors should cooperate and exchange information with the relevant AML/CFT supervisor for the purpose of their assessment in accordance with the EBA Guidelines on a common assessment methodology for granting authorisations , in particular regarding the assessment of the ML/TF risks related to the proposed application for authorisation.

42. The prudential supervisor should share with the AML/CFT supervisor all information provided with or related to the application that is relevant for the AML/CFT supervisor to provide its views on the application for authorisation. Information exchange should also take place where any other data or information with relevance for the AML/CFT supervisor is revealed during the application review.

43. In addition, in situations where the risk of ML/TF associated with the shareholders, members of the management body or key function holders is increased, the prudential supervisor should also, where appropriate, seek information from the financial intelligence unit to inform their assessment as explained in sections 6.2 and 6.3.

44. In addition, where the risk of ML/TF associated with the funds used to fulfil the capital requirement at authorisation of a new institution is increased, prudential supervisors should also, where appropriate, seek information from the financial intelligence unit, to inform their assessment. This is particularly relevant in cases where information available raises suspicion about the legitimacy of the origin of the funds used to fulfil the capital requirement at authorisation and the extent to which the funds are potentially connected to or derived from criminal activity.

45. Where a prudential supervisor decides not to grant the authorisation to an institution on grounds of ML/TF risks, the prudential supervisor should share the relevant decision or parts of the decision with the AML/CFT supervisor in the Member State where the institution was proposed to be established and also with the financial intelligence unit in that Member State.

AML/CFT supervisors

46. AML/CFT supervisors should, upon request from prudential supervisors, share all relevant information available to them and provide their assessment of the application from an AML/CFT perspective. Where appropriate, AML/CFT supervisors should also seek information from other AML/CFT supervisors and from the financial intelligence unit as part of their assessment of the application, unless such information is already available to the prudential supervisor or has been requested from the financial intelligence unit by the prudential supervisor.

47. Information requested in the context of an application for authorisation of an institution should be provided without undue delay in view of the short legal timeframe for the assessment of such application by the prudential supervisor.

6.2 Assessment of proposed acquisitions or increases of qualifying holdings

Prudential supervisors

48. When assessing the proposed acquisition or increase of qualifying holdings under Articles 22 and 23 of Directive 2013/36/EU, prudential supervisors should, where deemed necessary, cooperate and exchange information with the relevant AML/CFT supervisors for the purpose of their assessment in particular with regards to the assessment of the reasonable grounds for suspicion of ML/TF in connection with the proposed acquirer or ML/TF risks further to the proposed acquisition or increase of qualifying holdings . Prudential supervisors should, where deemed necessary, request information from the relevant AML/CFT supervisor for the purpose of assessing the AML/CFT criterion established in Article 23(1)(e) of Directive 2013/36/EU in accordance with paragraph 14 of the Joint Guidelines on the prudential assessment of acquisitions and increases of qualifying holdings.

49. In addition, in situations where the risk of ML/TF associated with the institution or applicant is increased, the prudential supervisor should also, where appropriate, seek information from financial intelligence units to inform their assessment of an application for a proposed acquisition or increase of qualifying holdings. This is particularly relevant in cases where there are reasonable grounds to suspect that money laundering or terrorist financing has been or is being committed or attempted or there is an increased risk thereof in connection with the institution or applicant and in particular in situations where information available raises suspicion about the legitimacy of the origin of the funds.

50. When requesting information, the prudential supervisor making the request should provide all the relevant information provided with or related to the notification as per Article 22(1) of Directive 2013/36/EU. In the request, legal and natural persons should be identified in a clear manner to ensure that data for the correct person is provided.

51. Where a prudential supervisor decides to oppose the proposed acquisition based on the outcome of the assessment of the AML/CFT criterion established in Article 23(1)(e) of Directive 2013/36/EU, the prudential supervisor should share the relevant decision or parts of the decision with the relevant AML/CFT supervisor and with the financial intelligence unit.

AML/CFT supervisors

52. AML/CFT supervisors should, upon request from prudential supervisors, cooperate and provide their assessment of the applicant from an AML/CFT perspective in order to assess the proposed acquisition or increase of qualifying holdings. Where appropriate, the AML/CFT supervisor should also seek information from the financial intelligence unit as part of their assessment, unless such information is already available to the prudential supervisor or has been requested from the financial intelligence unit by the prudential supervisor.

53. AML/CFT supervisors should on their own initiative share with prudential supervisors information that is considered to be relevant for the assessment of proposed acquisitions or increases of qualifying holdings where they are aware of new facts related to ML/TF of institutions, their shareholders or their members of the management body and key function holders.

54. Information requested in the context of proposed acquisitions or increases of qualifying holdings should be provided without undue delay in view of the short legal timeframe for the assessment of such application by the prudential supervisor.

6.3 Suitability assessment of members of the management body and key function holders

Prudential supervisors

55. When assessing or re-assessing the suitability of members of the management body and key function holders, prudential supervisors should, where deemed necessary, cooperate and exchange information with the relevant AML/CFT supervisors for the purpose of their assessment, in particular, with regards to the assessment of whether there are reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted, or there is increased risk thereof in connection with that institution. Prudential supervisors should, where deemed necessary, request information from the relevant AML/CFT supervisors for the purpose of their assessment in accordance with the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU .

56. Where a prudential supervisor decides that a member of the management body or key function holder is not suitable based on relevant facts in the context of ML/TF risks or events, the prudential supervisor should share their findings and decisions with the relevant AML/CFT supervisor and with the financial intelligence unit.

AML/CFT supervisors

57. AML/CFT supervisors should, upon request from the prudential supervisor, share all relevant information available to them to inform the assessment and re-assessment of the suitability of members of the management body, and key function holders. Where appropriate, the AML/CFT supervisor should also seek information from the financial intelligence unit as part of this, unless such information is already available to the prudential supervisor or has been requested from the financial intelligence unit by the prudential supervisor.

58. AML/CFT supervisors should on their own initiative share with prudential supervisors information that is considered relevant for the assessment or re-assessment of the suitability of members of the management body and key function holders where new or previously unknown facts related to ML/TF arise.

59. Information requested in the context of suitability assessments should be provided without undue delay in view of the short legal timeframe for such assessments by the prudential supervisor.

6.4 Withdrawal of authorisation of institutions

60. In case the prudential supervisor decides to initiate the procedure to withdraw the authorisation granted to an institution, based exclusively or among other grounds on its liability for serious breaches of the applicable AML/CFT laws in line with its power under Article 18 of Directive 2013/36/EU, the prudential supervisor should inform the relevant AML/CFT supervisor.

61. Where AML/CFT supervisors identify serious breaches of the applicable AML/CFT laws in relation to the institution, they should inform the prudential supervisor without undue delay of these serious breaches and their decision and any relevant additional considerations, including whether they consider that the institution is unwilling or unable to remedy these breaches and to what extent the weaknesses or breach can be addressed by measures available to the AML/CFT supervisor.

62. When informing the prudential supervisor of a serious breach, the AML/CFT supervisor should provide to the prudential supervisor all relevant information and details on the identified serious breach(es) in order to allow the prudential supervisor to properly evaluate the information received and conduct its own assessment on whether withdrawal of the authorisation is appropriate.

63. The AML/CFT supervisor should, at least, include detailed information explaining why the breach is serious, including the type of breach, the length of time during which the breach occurred, whether the breach represents a systemic failure within the institution, the impact of the breach on the institution and the integrity of the market in which it operates, whether a remediation action, if any, has been planned or taken by the institution to remedy the breach and the supervisory measures and sanctions, if any, planned or imposed by the AML/CFT supervisor.

64. Following the notification of a serious breach as set out in paragraph 61 above, the AML/CFT supervisor should cooperate to the fullest extent with the prudential supervisor as necessary and provide additional explanations or information where needed.

65. In case the prudential supervisor decides to withdraw the authorisation granted to an institution based on serious breaches of the applicable AML/CFT laws in line with its power under Article 18 of Directive 2013/36/EU, the prudential supervisor should inform the relevant AML/CFT supervisor and the financial intelligence unit.

7. Cooperation and information exchange in ongoing supervision

7.1 Assessment of notifications to exercise the freedom of establishment and the exercise of freedom to provide services

Prudential supervisors

66. The host prudential supervisor receiving the notification on the exercise of the right of establishment within its territory from the institution’s home prudential supervisor should notify the relevant AML/CFT supervisor in their Member State of the receipt of such notification.

67. The prudential supervisor should, when requested by the AML/CFT supervisor, share information on the actual exercise of the freedom to provide services by the institution with the AML/CFT supervisor.

AML/CFT supervisors

68. On receipt of the information on the exercise of the right of establishment or of the freedom to provide services within its jurisdiction from the prudential supervisor, the AML/CFT supervisor should cooperate and exchange information with the relevant AML/CFT supervisor in the Member State where the head office of the institution is established, in particular when carrying out the ML/TF risk assessment.

69. In circumstances where the institution is exposed to significant or increased ML/TF risk, AML/CFT supervisors should consider seeking relevant information from the financial intelligence unit.

7.2 Assessment of mergers

Prudential supervisors

70. When a prudential supervisor is assessing merger applications for institutions, it should exchange relevant information related to the merger application with the relevant AML/CFT supervisors of the merging institutions and of the new institution created by the merger. The extent of this interaction is determined by the financial and legal structure of the resulting consolidation form as explained below.

71. In the case of a merger by acquisition, the prudential supervisor that is responsible for assessing the merger application should proceed as follows: a. In case the merger gives rise to a proposed acquisition or increase of qualifying holdings, the prudential supervisor should exchange relevant information for the assessment with the relevant AML/CFT supervisor, and where appropriate with the financial intelligence unit, as foreseen in section 6.2; and b. In case the integration of the acquired institution impacts the scope of the acquirer’s license, the prudential supervisor should exchange relevant information for the assessment of the application to extend the acquirer’s authorisation with the relevant AML/CFT supervisor as foreseen in section 6.1.

72. In the case of a merger by formation of a new institution, the prudential supervisor responsible for assessing the licensing application of the new institution should exchange information with the relevant AML/CFT supervisor as foreseen in section 6.1.

AML/CFT supervisors

73. Where the AML/CFT supervisors receive a notification of a merger from the prudential supervisors, they should provide all relevant information to the relevant prudential supervisor in respect of the institutions involved in the merger, particularly where the prudential supervisor changes as a result of the merger. In particular, upon receipt of such notification, the AML/CFT supervisor should notify the prudential supervisor of serious breaches of the applicable AML/CFT laws or material weaknesses in the merging institutions’ AML/CFT framework or of whether they have taken any supervisory measures or imposed any sanctions on the merging institutions.

7.3 Assessment of outsourcing arrangements

Prudential supervisors

74. The prudential supervisor responsible for monitoring the outsourcing arrangements of institutions as defined in the EBA Guidelines on outsourcing arrangements should exchange information related to relevant outsourcing arrangements with the relevant AML/CFT supervisor. Such exchange should take place in particular in cases where the prudential supervisor has reasonable grounds to suspect that the outsourcing arrangements could impact the ML/TF risk exposure of the institution or its continuing compliance with its obligations under Directive 2013/36/EU and Directive (EU) 2015/849, including when: a. there are potential concerns about the proper oversight and governance arrangements with regards to the function outsourced and the impact on the ML/TF risks that the institution faces, the access to customer data, the reliability of records, or the allocation of tasks between the institution and the service provider, particularly when the provider is not an obliged entity under Directive (EU) 2015/849; b. the institution is outsourcing critical or important functions as referred to in section 4 of the EBA Guidelines on outsourcing arrangements that can affect the institution’s internal systems and control framework with regard to ML/TF risks, or if in the case of a default in service distribution by the service provider (or its provider in case of suboutsourcing), this may lead to the institution’s failure to comply with its AML/CFT obligations.

AML/CFT supervisors

75. Where the AML/CFT supervisors receive information about an outsourcing arrangement from the prudential supervisor, they should share any concerns identified from an AML/CFT perspective with prudential supervisors.

7.4 On and off-site supervision and risk assessments

Prudential supervisors and AML/CFT supervisors

76. In the context of on and off-site supervision, the information that prudential supervisors and AML/CFT supervisors should share with each other may include but is not limited to: a. relevant information on the outcomes related to on-site inspections and off-site reviews and relevant documentation collected during the supervision; b. relevant sections from reports received from the institutions or third parties including consultants and external auditors; c. relevant information shared within the AML/CFT college or the prudential college, where relevant; d. relevant parts from minutes of meetings with the institutions and from meetings of colleges, where available.

Prudential supervisors

77. Prudential supervisors should request from AML/CFT supervisors information that is relevant for the Supervisory Review and Evaluation Process (SREP) as set out in the EBA Guidelines on common procedures and methodologies for the SREP , including but not limited to: a. relevant outcomes of ML/TF risk assessments, including sectoral and individual risk assessments and risk ratings, in particular in cases of increased exposure to significant ML/TF risks; b. information related to emerging ML/TF risks that the institution may be exposed to; c. information related to material weaknesses in the supervised institution’s AML/CFT governance, systems and controls framework; d. information related to potential or actual breaches, in particular serious breaches of the applicable AML/CFT laws by the supervised institution; e. information related to the measures put in place by the institution to mitigate breaches and material weaknesses; f. information related to supervisory measures or sanctions pending or imposed on the institution as set out in section 8.

78. Prudential supervisors should provide information that is relevant for the ML/TF risk assessment carried out by the AML/CFT supervisors including, but not limited to, the information listed in paragraph 81.

79. Prudential supervisors should share with the financial intelligence unit information that is relevant for the tasks of the financial intelligence unit according to paragraph 20, including relevant outcomes of supervisory assessments of institutions with potential implications for the suspicious transaction reporting framework.

80. In addition, in situations where the institution is exposed to increased ML/TF risks, prudential supervisors should, where appropriate, seek from the financial intelligence unit information that is relevant for their Supervisory Review and Evaluation Process (SREP) that may include but is not limited to information from typologies and risk analysis on transactions and business relationships that could be relevant for the business model analysis.

AML/CFT supervisors

81. AML/CFT supervisors should request from prudential supervisors information that is relevant when carrying out the ML/TF risk assessment of the supervised institutions, including but not limited to: a. information relevant to assessing institutions’ inherent ML/TF risk or the sectorial ML/TF risk, particularly information on the institution´s products and services, customer base, geographical presence or distribution channels; b. relevant outcomes resulting from the Supervisory Review and Evaluation Process (SREP) , where available, in particular in the areas of business model, the assessment of internal governance and institution-wide controls, risks to capital and risks to liquidity and funding; c. relevant breaches or material weaknesses identified in the supervised institution that may have an impact on the institution’s AML/CFT framework; d. information related to supervisory measures or sanctions pending or imposed on the institution as set out in section 8; e. information on branches and subsidiaries necessary to fulfil the mapping of firms according to the Joint Guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 .

82. AML/CFT supervisors should provide information that is relevant for the prudential risk assessment including, but not limited to, the information set out in paragraph 77.

83. AML/CFT supervisors should, where appropriate, seek from the financial intelligence unit information that is relevant for the performance of ML/TF risk assessment and supervision that may include but is not limited to: a. typologies on ML/TF risks, including geographical risks and cross-border risks; b. relevant outcomes of the ML/TF risk assessment carried out by the financial intelligence unit; c. information on emerging risks identified by the financial intelligence unit; d. information on the quantity and quality of suspicious transaction reports received from institutions, in an aggregated manner, such as per sector, and in respect of individual institutions; e. information relating to any AML/CFT systems and controls weaknesses that the financial intelligence unit may have identified or suspected and especially information on the timeliness in responding to requests for information made by the financial intelligence unit and the quality of the information, data and documentation provided in reply to any such requests; f. confirmation on whether the institution has been a subject of a suspicious transaction report submitted by another institution or whether funds that are subject to suspicious transaction reports regularly come from that institution and any information in relation to the case that the financial intelligence unit may be able to share in accordance with the national law.

84. AML/CFT supervisors should share information with the financial intelligence unit that is relevant for its tasks according to paragraph 20, that may include but is not limited to: a. information with regard to relevant deficiencies and weaknesses identified in the supervised institution, including those that can affect the suspicious transaction reporting framework; b. information on suspected or committed breaches, in particular serious breaches of the applicable AML/CFT laws by the supervised institution, particularly where those breaches have an impact on the institution’s ability to report suspicious transactions, relevant outcomes of the ML/TF risk assessment of sectors or, where appropriate, individual institutions; c. any information relating to the emerging ML/TF risks within the sector; d. relevant information gathered from reports received following Article 61(1) of Directive (EU) 2015/849 on potential or actual breaches of the national provisions transposing Directive (EU) 2015/849.

85. Where the prudential risk assessment gives the prudential supervisor reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted in connection with an institution or that an institution is exposed to an increased ML/TF risk, the prudential supervisor should immediately notify the AML/CFT supervisor of that institution and the EBA of their findings and concerns in accordance with Article 97(6) of Directive 2013/36/EU.

86. Where the AML/CFT supervisor assesses that an institution is potentially exposed to an increased ML/TF risk following the notification from the prudential supervisor as set out above, the AML/CFT supervisor should liaise with the prudential supervisor in order to reach a common assessment, which should be notified immediately to the EBA in accordance with Article 97(6) of Directive 2013/36/EU through a single submission by the prudential supervisor.

87. For the performance of the common assessment as required under Article 97(6) of Directive 2013/36/EU, the prudential supervisor and the AML/CFT supervisor should cooperate closely and establish all facts and reasons that may give rise to the potential increased ML/TF risk. Both supervisors should exchange all information that is relevant for the performance of the common assessment.

88. The common assessment should be set out in writing and contain the established facts and reasons. The document should contain at least the AML/CFT supervisory assessment of the potential increased ML/TF risk, including possible measures to mitigate the risk from an AML/CFT perspective, and the analysis of the potential prudential implications of such assessment and possible prudential measures to mitigate the risk.

7.5 Coordinated supervisory activities

Prudential supervisors and AML/CFT supervisors

89. Prudential supervisors and AML/CFT supervisors should consider identifying areas of mutual interest where appropriate when planning their respective on-site and off-site supervisory activities.

90. Where areas of mutual interest are identified, prudential supervisors and AML/CFT supervisors should consider the most appropriate form of cooperation for setting up coordinated supervisory activities, in accordance with their respective competences and supervisory responsibilities, including but not limited to: a. mutual attendance of meetings with institution representatives; b. mutual participation in thematic reviews; and c. mutual participation in off-site reviews or on-site inspections.

91. Where a coordinated supervisory activity is being set up, prudential supervisors and AML/CFT supervisors should agree on the modalities for the cooperation, including as a minimum: a. the nature and type of action to be taken by each respective supervisor; b. the timing of the work to be undertaken and the planned allocation of supervisory resources; c. the modalities for information exchange, including the sharing of information gathered during the coordinated activity, and the findings as a result of the activity; d. the process for handling findings from the coordinated activity and potential breaches; e. the options for coordinated follow-up, if any.

8. Cooperation and information exchange regarding supervisory measures and sanctions

Prudential supervisors and AML/CFT supervisors

92. Prudential supervisors and AML/CFT supervisors should exchange information regarding pending or imposed supervisory measures or sanctions that is relevant for their respective supervisory tasks as early as possible in the enforcement process.

93. Communications regarding supervisory measures or sanctions between prudential supervisors and AML/CFT supervisors should detail the nature and extent of the underlying deficiencies, material weaknesses and serious breaches. The information shared should allow prudential supervisors to consider the potential prudential implications of the material weaknesses and serious breaches identified by the AML/CFT supervisors, and AML/CFT supervisors to consider the potential implications on the institution’s AML/CFT systems and control framework of the deficiencies identified by the prudential supervisors.

4. Accompanying documents

4.1 Draft cost-benefit analysis/impact assessment

I. Introduction

According to the AML Council Action Plan published in December 2018, cooperation and information exchange should occur throughout all the supervisory phases and in both directions (from prudential supervisors to AML/CFT supervisors and vice versa). In order to ensure a common framework for supervisory cooperation, Directive (EU) 2019/878 (CRDV) added Article 117(6) to Directive 2013/36/EU, which entered into force on 27 June 2019 and covers the mandate to issue guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, specifying the manner for cooperation and information exchange between competent authorities, financial intelligence units and AML/CFT competent authorities, particularly in relation to cross-border groups and in the context of identifying serious breaches of anti-money laundering rules.

The guidelines are addressed to both prudential and AML/CFT supervisors and aim to set a framework that ensures information-sharing between both in order to understand ML/TF risks from a prudential perspective and AML/CFT aspects of prudential supervision. Flows of information will be beneficial for the activities of both supervisors, as prudential supervisors ensure the compliance of institutions with the prudential framework, while AML supervisors are in charge of the assessment of ML/TF risk profile of institutions, the compliance with rules for combating ML/TF risks and governance and internal control framework to identify and mitigate such risks.

Specific provisions regarding information exchange are covered in Level 1 legislation applicable to both prudential and AML supervisors. Regarding prudential supervisors, cooperation and information exchange should be in place between prudential and financial markets supervisors under CRDIV. Afterwards, CRDV introduced cooperation and information exchange with AML/CFT supervisors and financial intelligence units (Article 117(5) of Directive 2013/36/EU, added by Directive (EU) 2019/878, CRDV). Similarly, AML/CFT supervisors shall set an agreement on the practical modalities for the exchange of information with prudential supervisors on a European basis (Article 57a, paragraph 2, of AMLD5) and on a cross-border basis (Article 57a, paragraph 5, of AMLD5).

II. Objectives of the guidelines

Establishment of a level playing field across the EU for the cooperation and information exchange between prudential and AML supervisors. The cooperation should take place under every form of institutional structure of both prudential and AML/CFT supervision (e.g. a single authority performing both functions, an organisational subdivision within prudential supervisors in charge of

AML/CFT supervision or different supervisory authorities), under different channels (e.g. through AML/CFT or prudential colleges or bilaterally) and under every scope of supervision (e.g. national authorities or different authorities on a cross-border context).

III. Options considered

In the process of drafting the guidelines, the EBA considered whether to address the mandate under the approach of international standards on cooperation and information exchange, under detailed and prescriptive guidance to supervisors or through the provision of sufficient guidance while leaving room to apply the guidelines in concrete circumstances.

Option 1: High-level guidelines in accordance with international standards

Cooperation and information exchange under a high-level framework, without detailing the types of information to be exchanged, the mechanisms of information exchange, the timeliness of sharing information or the scope of the exchanges (i.e. regular exchanges or ad-hoc information exchanges).

High-level guidelines will ensure full alignment with other international issued standards. However, the lack of detail could further give room to supervisory arbitrage leading to limited informationsharing during key supervisory assessments or authorisations.

Therefore, this approach could be ineffective in order to accomplish a risk-based supervision that considers all risks to which the institution is exposed or could give rise to a misleading decisionmaking process by supervisors in the authorisation processes.

Option 2: Detailed and highly prescriptive guidelines

Under this option, detailed prescriptions on cooperation and information exchange would be put in place. Among others, provisions related to the manner (i.e. specific requirement to set an agreement), the channel (i.e. college or non-college context) and the type of information. This option could be disruptive with the current practices of cooperation and information exchange that are currently in place and could represent an excessive burden to competent authorities.

Option 3: Provision of sufficient guidance to ensure an effective framework for cooperation and information exchange

This option ensures the provision of sufficient guidance while allowing flexibility to apply the guidelines to concrete circumstances. The guidelines aim to ensure the effectiveness of the cooperation and information exchange between prudential and AML/CFT supervisors, without prescribing the manner or the channel for the information exchange. Thus, the first section of the guidelines leaves sufficient room for both supervisors to decide whether the existing arrangements in place should be amended in line of the provisions of the guidelines or whether they are sufficient. The lists of information included in sections 6, 7 and 8 of the guidelines aim to facilitate the role of prudential supervisor in knowing which information is available, representing non-exhaustive lists of information based on the applicable guidelines to each supervisory context (i.e. authorisation

process, acquisition of qualifying holdings, suitability assessments, etc.), but are not mandatory prescriptions in any case. Therefore, this option would fulfil the Level 1 mandate and accomplish an effective framework for exchanging information without being disruptive with current practices and without being an excessive burden for competent authorities.

Option 3 is the preferred option.

IV. Cost-benefit analysis

Overall, the implementation of the guidelines entails one-off costs for prudential and AML supervisors, mainly driven by strengthening the current modalities of cooperation and information exchange. Other future costs associated with compliance with the guidelines by supervisors are the execution of regular exchanges of information and adequacy of resources to assess the information received.

On the benefit side, increased cooperation and information exchange will achieve a more effective supervisory activity based on a broader set of information. Furthermore, the consideration of the assessment performed by other authorities will increase the knowledge of all risks faced by the institution.

For institutions, benefits could arise from the decline in the volume of information requests, more robust governance arrangements and enhanced risk management function.

The following sections tackle the cost-benefit analysis of the specific areas covered in the guidelines.

Mechanisms for cooperation, information exchange and confidentiality treatment

Cooperation and information exchange between prudential and AML/CFT supervisors can be performed within their jurisdiction and across different member states for institutions operating on a cross-border basis. Information can be shared upon formal requests or on their own initiative. Overall, adequate arrangements should be put in place by both AML and prudential supervisors to ensure that cooperation and information exchange is performed through secure channels.

The benefits of effective and efficient cooperation and information exchange are foreseen to be: (i) timely identification of ML/TF risks of a certain institution before they crystallise, through the exchange of AML/CFT information relevant from a prudential perspective and prudential information relevant from an AML/CFT perspective, (ii) knowledge by prudential supervisors of the AML/CFT supervisory plans (i.e. ratio between on-site and off-site supervision, the focus of supervision or the frequency of supervision, etc.), (iii) improved overview of ML/TF risks of institutions operating on a cross-border basis.

The costs of cooperation and information exchange are expected to arise from: (i) strengthening the actual modalities for cooperation and information exchange and implementing the requirements set out in Article 117(5) of Directive 2013/36/EU, (ii) setting up appropriate and

secure means for cooperation and information exchange, (iii) completing notification templates, (iv) translating information.

Cooperation and information exchange in the context of the processes for authorisation, proposed acquisitions of qualifying holdings, suitability assessments, and withdrawal of authorisation

The application for authorisation shall be completed with detailed information about the applicant credit institution under the RTS on information to be provided for the authorisation of credit institutions, the requirements applicable to shareholders and members with qualifying holdings.

According to the RTS, the applicant institution may provide to the prudential supervisor a summary of its own history (including criminal convictions or civil or administrative penalty in respect of money laundering), risk management framework and the strategy for identifying and managing ML/TF risks, business and regulatory risk factors, internal organisation of the compliance function and information related to the systems and policies for assessing and managing ML/TF risks. However, prudential supervisors may have a more complete knowledge about the applicant institution by receiving assessments from AML/CFT supervisor.

Thus, the benefits of cooperation and information exchange in the authorisation process are expected to be: (i) an improved understanding by the prudential supervisors of the AML/CFT aspects of the jurisdiction in which the entity is based (e.g. AML/CFT regulatory and supervisory regime, effectiveness of judiciary systems, ML/TF risks identified by the financial intelligence unit and the AML supervisor, etc.), (ii) assessment by AML/CFT supervisor of the business model of the institution (e.g. level of exposure to sectors identified as high risk for ML/TF purposes, targeted customers, cross-border transactions, etc.), (iii) assessment by AML/CFT supervisors of internal policies and procedures, risk management systems, governance of the structure to combat ML/TF risks.

The foreseen costs of the authorisation process with regards to the incorporation of AML/CFTrelated information arise from: (i) difficulties in identifying all subsidiaries and branches of the applicant institution, including those considered not significant, and their immediate parent, (ii) identification of AML/CFT competent authorities of the parent and the subsidiaries (e.g. through the register of competent authorities published by the European Commission in line with Article 48 (1a) of Directive 2015/849), (iii) information requests in the working language of the competent authorities, (iv) analysis of the information received and incorporation in the process of authorisation.

Cooperation and information exchange in ongoing supervision

The cooperation and information exchange is applicable throughout the ongoing supervision of both prudential and AML/CFT supervision or in coordinated supervisory actions, including common assessments in accordance with Article 97(6) of Directive 2013/36/EU.

With regard to the information exchange between prudential and AML/CFT supervisors in the performance of ongoing supervision, common assessments, and coordinated activities, the costs are expected to arise from: (i) setting up means for eventual regular information exchange, (ii) potential identification of areas of mutual interest, and if identified, (iii) coordinating with the other supervisor in order to plan on and off-site supervisory activities, (iv) assessing the best form of cooperation between supervisors (e.g. mutual attendance of meetings, mutual participation in deep-dives, mutual participation in off-site or on-site inspections, etc.), (v) agreeing on the modalities for cooperation (e.g. actions to be taken by each supervisor, timing, modalities, process, options for coordinated follow-up, etc.).

The benefits of cooperation and information exchange between supervisors are mainly related to the timely identification of ML/TF risks before they crystallise.

Cooperation and information exchange regarding supervisory measures and sanctions imposed by prudential supervisors and AML/CFT supervisors

Formal engagement between prudential and AML/CFT supervisors on the imposition of supervisory measures and sanctions should take place in view of the prudential impact that the imposed measures might have from the AML/CFT perspective and vice versa. Thus, the assessment of the severity needs to be performed from both perspectives (AML/CFT and prudential) for the selection of adequate measures.

The benefits of cooperation and information exchange between prudential and AML/CFT supervisors in the imposition of measures and sanctions are expected to be: (i) timely identification of impacts of serious AML/CFT breaches, and (ii) avoid jeopardising parallel actions.

The costs are expected to arise from the following: (i) providing sufficient detail to the other supervisor on the severity of the deficiencies identified, (ii) analysing confidentiality requirements of the investigation and (iii) considering other interested parties (e.g. the financial intelligence unit).

V. Overall impact assessment

The EBA organised a survey among EU prudential supervisors to provide an overview of the current practices in cooperation between prudential and AML supervisors when performing supervisory activities and other prudential assessment processes (i.e. authorisations, assessments of proposed qualifying holdings and fitness and propriety of key function holders). Thus, 22 responses of EEA competent authorities (including the SSM) were received.

Regarding the institutional framework of cooperation and information exchange between AML and prudential supervisors, 18 jurisdictions (of the 22 respondents) have both AML/CFT and prudential supervision as part of the same authority. Of these, only four indicated that they already account with an internal cooperation arrangement in place or a cooperation framework in internal regulation, another three jurisdictions are in the process of developing them. The rest account with implemented practices of cooperation and information exchange.

In relation to the four jurisdictions that have AML and prudential supervision divided between two or more authorities, they indicated that they have either cooperation arrangements in place, MoU or cooperation set out in law.

The impact of putting in place the modalities for information exchange and cooperation under the guidelines is considered to be medium considering the fact that almost all cooperate in practical terms, and cooperation arrangements are already in place for more than half of the respondents and would just need to be adjusted accordingly where the modalities provided for would not be in line with the guidelines.

In relation to cooperation in ongoing supervision, it is worth knowing the current practices of notifications to AML/CFT supervisors about prudential supervisory activities and onwards. From the side of AML/CFT supervisors, only five authorities responded that they are notified of all prudential inspections and other 11 responded that AML/CFT supervisors are involved by prudential supervisors only on ad-hoc basis (i.e. when there are AML/CFT concerns). From the side of prudential supervisors, 10 responded that they are notified of all AML/CFT on-site inspections and seven responded that they are notified when there are serious AML/CFT breaches. Therefore, as more than half of respondents account with practices in place to notify either all or on an ad-hoc basis, the expected cost of cooperation in ongoing supervision is expected to be low.

Regarding cooperation in authorisation processes, 16 competent authorities responded to have cooperation in place for licensing applications, 13 for qualifying holdings and 10 for the assessment of key function holders and management board members. The rest of the authorities responded that they usually consult the AML/CFT supervisor on an ad hoc basis. Only one authority indicated that ML/TF risks are not considered for refusal of the authorisation of key function holders or management board members. Therefore, as most authorities account with procedures in place, the expected impact of implementation in this issue is expected to be low.

With regard to the engagement when imposing supervisory measures, only seven authorities account with a systematic engagement throughout the imposition of prudential and AML/CFT supervisory measures for ML/TF related aspects. Another five account with ad-hoc practices, with engagement in place if needed. Thus, the cost of implementing joint engagement is expected to be high, as less than half of consulted authorities do not account with joint enforcement actions in place.

4.2 Feedback on the public consultation

The EBA publicly consulted on the draft proposal contained in this paper.

The consultation period lasted for three months from 27 May 2021 to 27 August 2021. Two responses were received, which were both published on the EBA website.

This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary.

In some cases, several industry bodies made similar comments or the same body repeated its comments in the response to different questions. In such cases, the comments and EBA analysis are included in the section of this paper where EBA considers them most appropriate.

Changes to the draft guidelines have been incorporated as a result of the responses received during the public consultation.

Summary of key issues and the EBA’s response

Respondents in general welcomed the draft guidelines and were supportive of the aim of establishing a formal framework to ensure effective cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units. According to respondents, such effective cooperation and information exchange between authorities should help to build on synergies and avoid unnecessary duplications of efforts while respecting the autonomy of the different authorities’ respective roles, tasks and competencies.

Furthermore, respondents made suggestions on the data to be included in the information exchange between prudential supervisors and AML/CFT supervisors. In particular, the addition of the LEI (Legal Entity Identifier) would, according to the respondents, facilitate an efficient and quick identification of the legal entities concerned in the information exchange.

Finally, respondents asked to include a maximum timeframe for AML/CFT supervisors to respond to requests by the prudential supervisor in the context of applications for authorisations of a new credit institution in view of the regulatory deadlines for this process.

The EBA carefully examined all the comments received (as indicated in the table below) and amended the text of the guidelines accordingly.

Summary of responses to the consultation and the EBA’s analysis

Amendments to Comments Summary of responses received EBA analysis the proposals

Specific questions in relation to the Consultation Paper EBA/CP/2021/21

Question 1.

Do you consider that the subject matter, scope of application, and definitions are appropriate and sufficiently clear?

Question 2.

Do you consider that the general provisions are appropriate and sufficiently clear?

Amendments to Comments Summary of responses received EBA analysis the proposals

Question 3.

Do you consider the mechanisms for cooperation, information exchange and confidentiality treatment are appropriate and sufficiently clear?

Amendments to Comments Summary of responses received EBA analysis the proposals

Amendments to Comments Summary of responses received EBA analysis the proposals

Question 5.

Do you consider that the provisions on cooperation and information exchange in ongoing supervision are appropriate and sufficiently clear?

Amendments to Comments Summary of responses received EBA analysis the proposals