Risk assessment at Union level
1. The Commission shall conduct an assessment of the risks of money laundering and terrorist financing and of non-implementation and evasion of targeted financial sanctions affecting the internal market and relating to cross-border activities.
2. By 10 July 2028, the Commission shall draw up a report identifying, analysing and evaluating those risks at Union level. The Commission shall update that report every 4 years thereafter. The Commission may update parts of the report more frequently, if appropriate.
Where, while updating its report, the Commission identifies new risks, it may recommend to Member States to consider updating their national risk assessments, or to carry out sectoral risk assessments, pursuant to Article 8 in order to assess those risks.
The report referred to in the first subparagraph shall be made public, except for those parts which contain classified information.
3. The report referred to in paragraph 1 shall cover at least the following:
(a)
the areas and sectors of the internal market that are exposed to money laundering and terrorist financing risks;
(b)
the nature and level of the risks associated with each area and sector;
(c)
the most widespread means used to launder illicit proceeds, including, where available, those particularly used in transactions between Member States and third countries, independently of the identification of a third country pursuant to Section 2 of Chapter III of Regulation (EU) 2024/1624;
(d)
an assessment of the risks of money laundering and terrorist financing associated with legal persons and legal arrangements, including the exposure to risks deriving from foreign legal persons and foreign legal arrangements;
(e)
the risks of non-implementation and evasion of targeted financial sanctions.
4. The Commission shall make recommendations to Member States on the measures suitable for addressing the identified risks. In the event that Member States decide not to apply any of the recommendations in their national AML/CFT regimes, they shall notify the Commission thereof and provide a detailed justification stating their reasons for such a decision.
5. By 10 July 2030 and every 2 years thereafter, AMLA, in accordance with Article 55 of Regulation (EU) 2024/1620, shall issue an opinion addressed to the Commission on the risks of money laundering and terrorist financing affecting the Union. AMLA may issue opinions or updates of its previous opinions more frequently, where it deems it appropriate to do so. The opinions issued by AMLA shall be made public, except for those parts which contain classified information.
6. In conducting the assessment referred to in paragraph 1, the Commission shall organise the work at Union level, shall take into account the opinions referred to in paragraph 5 and shall involve Member States’ experts in the area of AML/CFT, representatives from national supervisory authorities and FIUs, AMLA and other Union level bodies, and, where appropriate, other relevant stakeholders.
7. Within 2 years of the adoption of the report referred to in paragraph 2, and every 4 years thereafter, the Commission shall submit a report to the European Parliament and to the Council on the actions taken based on the findings of that report.
National risk assessment
1. Each Member State shall carry out a national risk assessment to identify, assess, understand and mitigate the risks of money laundering and terrorist financing, and the risks of non-implementation and evasion of targeted financial sanctions affecting it. It shall keep that risk assessment up to date and review it at least every 4 years.
Where Member States consider that the risk situation so requires, they may review the national risk assessment more frequently or conduct ad hoc sectoral risk assessments.
2. Each Member State shall designate an authority or establish a mechanism to coordinate the national response to the risks referred to in paragraph 1. The identity of that authority or the description of the mechanism shall be notified to the Commission. The Commission shall publish the list of the designated authorities or established mechanisms in the Official Journal of the European Union.
3. In carrying out the national risk assessments referred to in paragraph 1 of this Article, Member States shall take into account the report referred to in Article 7(2), including sectors and products covered and the findings of that report.
4. Member States shall use the national risk assessment to:
(a)
improve their AML/CFT regimes, in particular by identifying any areas where obliged entities are to apply enhanced measures in line with a risk-based approach and, where appropriate, specifying the measures to be taken;
(b)
identify, where appropriate, sectors or areas of lower or greater risk of money laundering and terrorist financing;
(c)
assess the risks of money laundering and terrorist financing associated with each type of legal person established in their territory and each type of legal arrangement which is governed under national law, or which is administered in their territory or whose trustees or persons holding equivalent positions in similar legal arrangements reside in their territory; and have an understanding of the exposure to risks deriving from foreign legal persons and foreign legal arrangements;
(d)
decide on the allocation and prioritisation of resources to combat money laundering and terrorist financing as well as non-implementation and evasion of targeted financial sanctions;
(e)
ensure that appropriate rules are drawn up for each sector or area, in accordance with the risks of money laundering and terrorist financing;
(f)
make appropriate information available promptly to competent authorities and to obliged entities to facilitate the carrying out of their own money laundering and terrorist financing risk assessments as well as the assessment of risks of non-implementation and evasion of targeted financial sanctions referred to in Article 10 of Regulation (EU) 2024/1624.
In the national risk assessment, Member States shall describe the institutional structure and broad procedures of their AML/CFT regime, including the FIU, tax authorities and prosecutors, the mechanisms for cooperation with counterparts within the Union or in third countries, as well as the allocated human and financial resources to the extent that this information is available.
5. Member States shall ensure appropriate participation of competent authorities and relevant stakeholders when carrying out their national risk assessment.
6. Member States shall make the results of their national risk assessments, including updates and reviews, available to the Commission, to AMLA and to the other Member States. A Member State may provide relevant additional information, where appropriate, to the Member State carrying out the national risk assessment. A summary of the findings of the assessment shall be made public. That summary shall not contain classified information. Any document disseminated or made public pursuant to this paragraph shall not contain any information permitting the identification of any natural person or name any legal person.
Statistics
1. Member States shall maintain comprehensive statistics on matters relevant to the effectiveness of their AML/CFT frameworks in order to review the effectiveness of those frameworks.
2. The statistics referred to in paragraph 1 of this Article shall include:
(a)
data measuring the size and importance of the different sectors which fall within the scope of this Directive, including the number of natural and legal persons and the economic importance of each sector;
(b)
data measuring the reporting, investigation and judicial phases of the national AML/CFT regime, including the number of suspicious transaction reports made to the FIU, the follow-up given to those reports, the information on cross-border physical transfers of cash transmitted to the FIU in accordance with Article 9 of Regulation (EU) 2018/1672 together with the follow-up given to the information submitted and, on an annual basis, the number of cases investigated, the number of persons prosecuted, the number of persons convicted for money laundering or terrorist financing offences, the types of predicate offences identified in accordance with Article 2 of Directive (EU) 2018/1673 of the European Parliament and of the Council ( 38 ) where such information is available, and the value in euro of property that has been frozen, seized or confiscated;
(c)
the number and percentage of suspicious transaction reports resulting in dissemination to other competent authorities and, if available, the number and percentage of reports resulting in further investigation, together with the annual report drawn up by FIUs pursuant to Article 27;
(d)
data regarding the number of cross-border requests for information that were made, received, refused and partially or fully answered by the FIU, broken down by counterpart country;
(e)
the number of mutual legal assistance or other international requests for information relating to beneficial ownership and bank account information as referred to in Chapter IV of Regulation (EU) 2024/1624 and Sections 1 and 2 of Chapter II of this Directive received from or made to counterparts outside the Union, broken down by competent authority and counterpart country;
(f)
human resources allocated to supervisors as well as human resources allocated to the FIU to fulfil the tasks specified in Article 19;
(g)
the number of on-site and off-site supervisory actions, the number of breaches identified on the basis of supervisory actions and pecuniary sanctions and periodic penalty payments imposed or administrative measures applied by supervisory authorities and self-regulatory bodies pursuant to Section 4 of Chapter IV;
(h)
the number and type of breaches identified in relation to the obligations of Chapter IV of Regulation (EU) 2024/1624 and pecuniary sanctions imposed or administrative measures applied in relation to those breaches, the number of discrepancies reported to the central register referred to in Article 10 of this Directive, as well as the number of checks carried out by the entity in charge of the central register or on its behalf pursuant to Article 10(11) of this Directive;
(i)
the following information regarding the implementation of Article 12:
(i)
the number of requests to access beneficial ownership information in central registers on the basis of the categories laid down in Article 12(2);
(ii)
the percentage of requests for access to information which is refused under each category laid down in Article 12(2);
(iii)
a summary of the categories of persons granted access to beneficial ownership information under Article 12(2), second subparagraph;
(j)
the number of searches of bank account registers or data retrieval mechanisms made by competent authorities, broken down by category of competent authority, and the number of searches of the interconnection of bank account registers made by FIUs and supervisory authorities;
(k)
the following data regarding implementation of targeted financial sanctions:
(i)
the value of funds or other assets frozen, broken down by type;
(ii)
human resources allocated to authorities competent for implementation and enforcement of targeted financial sanctions.
3. Member States shall ensure that the statistics referred to in paragraph 2 are collected and transmitted to the Commission on an annual basis. The statistics referred to in paragraph 2, points (a), (c), (d) and (f), shall also be transmitted to AMLA.
AMLA shall store those statistics in its database in accordance with Article 11 of Regulation (EU) 2024/1620.
4. By 10 July 2029, AMLA shall adopt an opinion addressed to the Commission on the methodology for the collection of the statistics referred to in paragraph 2, points (a), (c), (d), (f) and (g).
5. The Commission may lay down, by means of implementing acts, the methodology for the collection of the statistics referred to in paragraph 2 of this Article and the arrangements for their transmission to the Commission and to AMLA. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 72(2).
6. By 10 July 2030 and every 2 years thereafter, the Commission shall publish a report summarising and explaining the statistics referred to in paragraph 2, and make it available on its website.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
