SECTION 1 — General provisions
Powers and resources of national supervisors
1. Each Member State shall ensure that all obliged entities established in its territory, except for the circumstances covered in Article 38, are subject to adequate and effective supervision. To that end, each Member State shall appoint one or more supervisors to monitor effectively, and to take the measures necessary to ensure compliance by the obliged entities with Regulations (EU) 2024/1624 and (EU) 2023/1113.
Where, for reasons of overriding general interest, Member States have introduced specific authorisations requirements for obliged entities to operate in their territory under the freedom to provide services, they shall ensure that the activities carried out by the obliged entities under those specific authorisations are subject to supervision by their national supervisors, regardless of whether the authorised activities are carried out through an infrastructure in their territory or remotely. Member States shall also ensure that supervision under this subparagraph is notified to the supervisors of the Member State where the head office of the obliged entity is located.
This paragraph shall not apply when AMLA acts as a supervisor.
2. Member States shall ensure that supervisors have adequate financial, human and technical resources to perform their tasks as listed in paragraph 5. Member States shall ensure that staff of those authorities are of high integrity and appropriately skilled, and maintain high professional standards, including standards of confidentiality, data protection and standards addressing conflicts of interest.
3. In the case of the obliged entities referred to in Article 3, points (3)(a) and (b), of Regulation (EU) 2024/1624, Member States may allow the function referred to in paragraph 1 of this Article to be performed by self-regulatory bodies, provided that those self-regulatory bodies have the powers referred to in paragraph 6 of this Article and have adequate financial, human and technical resources to perform their functions. Member States shall ensure that staff of those bodies are of high integrity and appropriately skilled, and that they maintain high professional standards, including standards of confidentiality, data protection and standards addressing conflicts of interest.
4. Where a Member State has entrusted the supervision of a category of obliged entities to more than one supervisor, it shall ensure that those supervisors supervise obliged entities in a consistent and efficient manner across the sector. To that end, the Member State shall appoint a leading supervisor or establish a coordination mechanism among those supervisors.
Where a Member State has entrusted the supervision of all obliged entities to more than one supervisor, it shall establish a coordination mechanism among those supervisors to ensure that obliged entities are effectively supervised to the highest standards. Such a coordination mechanism shall include all supervisors, except where:
(a)
supervision is entrusted to a self-regulatory body, in which case the public authority referred to in Article 52 shall participate in the coordination mechanism;
(b)
supervision of a category of obliged entities is entrusted to several supervisors, in which case the lead supervisor shall participate in the coordination mechanism; where no lead supervisor has been appointed, supervisors shall designate a representative among them.
5. For the purposes of paragraph 1, Member States shall ensure that the national supervisors perform the following tasks:
(a)
to disseminate relevant information to obliged entities pursuant to Article 39;
(b)
to decide on those cases where the specific risks inherent in a sector are clear and understood and individual documented risk assessments pursuant to Article 10 of Regulation (EU) 2024/1624 are not required;
(c)
to verify the adequacy and implementation of the internal policies, procedures and controls of obliged entities pursuant to Chapter II of Regulation (EU) 2024/1624 and of the human resources allocated to the performance of the tasks required under that Regulation, as well as, for supervisors of collective investment undertakings, to decide on those cases where the collective investment undertaking may outsource the reporting of suspicious activities pursuant to Article 18(7) of Regulation (EU) 2024/1624 to a service provider;
(d)
to regularly assess and monitor the money laundering and terrorist financing risks as well as the risks of non-implementation and evasion of targeted financial sanctions the obliged entities are exposed to;
(e)
to monitor compliance by obliged entities with regard to their obligations in relation to targeted financial sanctions;
(f)
to conduct all the necessary off-site investigations, on-site inspections and thematic checks and any other inquiries, assessments and analyses necessary to verify that obliged entities comply with Regulation (EU) 2024/1624, and with any administrative measures taken pursuant to Article 56 of this Directive;
(g)
to take appropriate supervisory measures to address any breaches of applicable requirements by the obliged entities identified in the process of supervisory assessments and follow up on the implementation of such measures.
6. Member States shall ensure that supervisors have adequate powers to perform their tasks as provided for in paragraph 5, including the power to:
(a)
compel the production of any information from obliged entities which is relevant for monitoring and verifying compliance with Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 and to perform checks, including from service providers to whom the obliged entity has outsourced part of its tasks to meet the requirements of those Regulations;
(b)
apply appropriate and proportionate administrative measures to remedy the situation in the case of breaches, including through the imposition of pecuniary sanctions in accordance with Section 4 of this Chapter.
7. Member States shall ensure that financial supervisors and supervisors in charge of gambling service providers have powers additional to those referred to in paragraph 6, including the power to inspect the business premises of the obliged entity without prior announcement where the proper conduct and efficiency of an inspection so require, and that they have all the necessary means to carry out such inspection.
For the purposes of the first subparagraph, the supervisors shall at least be able to:
(a)
examine the books and records of the obliged entity and take copies or extracts from such books and records;
(b)
obtain access to any software, databases, IT tools or other electronic means of recording information used by the obliged entity;
(c)
obtain written or oral information from any person responsible for AML/CFT internal policies, procedures and controls or their representatives or staff, as well as any representative or staff of entities to which the obliged entity has outsourced tasks pursuant to Article 18 of Regulation (EU) 2024/1624, and interview any other person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation.
Supervision of forms of infrastructure of certain intermediaries operating under the freedom to provide services
1. Where the activities of the following obliged entities are carried out in their territory under the freedom to provide services through agents or distributors, or through other types of infrastructure, including when those activities are carried out under an authorisation obtained under Directive 2013/36/EU, Member States shall ensure that such activities are subject to supervision by their national supervisors:
(a)
electronic money issuers as defined in Article 2, point (3), of Directive 2009/110/EC of the European Parliament and of the Council ( 42 ) ;
(b)
payment service providers as defined in Article 4, point (11), of Directive (EU) 2015/2366; and
(c)
crypto-asset service providers.
For the purposes of the first subparagraph, the supervisors of the Member State where the activities are carried out shall monitor effectively and ensure compliance with the Regulations (EU) 2024/1624 and (EU) 2023/1113.
2. By way of derogation from paragraph 1, supervision of agents, distributors, or other types of infrastructure, referred to in that paragraph shall be carried out by the supervisor of the Member State where the head office of the obliged entity is located where:
(a)
the criteria set out in the regulatory technical standard referred to in Article 41(2) are not met; and
(b)
the supervisor of the Member State where those agents, distributors, or other types of infrastructure, are located notifies the supervisor of the Member State where the head office of the obliged entity is located that, considering the limited infrastructure of the entity in its territory, supervision of the activities referred to in paragraph 1 is to be carried out by the supervisor of the Member State where the head office of the obliged entity is located.
3. For the purposes of this Article, the supervisor of the Member State where the head office of the obliged entity is located and the supervisor of the Member State where the obliged entity operates under the freedom to provide services through agents or distributors, or through other types of infrastructure, shall provide each other any information necessary to assess whether the criteria referred to in paragraph 2, point (a), are met, including on any change in the circumstances of the obliged entity that may have an impact on the satisfaction of those criteria.
4. Member States shall ensure that the supervisor of the Member State where the head office of the obliged entity is located informs the obliged entity within 2 weeks of receiving the notification under paragraph 2, point (b), that it will supervise the activities of the agents, distributors, or other types of infrastructure, through which the obliged entities operates under the freedom to provide services in another Member State, and of any subsequent change to their supervision.
5. This Article shall not apply when AMLA acts as a supervisor.
Provision of information to obliged entities
1. Member States shall ensure that supervisors make information on money laundering and terrorist financing available to the obliged entities under their supervision.
2. The information referred to in paragraph 1 shall include the following:
(a)
the risk assessment at Union level conducted by the Commission pursuant to Article 7 and any relevant recommendation by the Commission on the basis of that Article;
(b)
national or sectoral risk assessments carried out pursuant to Article 8;
(c)
relevant guidelines, recommendations and opinions issued by AMLA in accordance with Articles 54 and 55 of Regulation (EU) 2024/1620;
(d)
information on third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624;
(e)
any guidance and report produced by AMLA, other supervisors and, where relevant, the public authority overseeing self-regulatory bodies, the FIU or any other competent authority or international organisations and standard setters regarding money laundering and terrorist financing methods which might apply to a sector and indications which may facilitate the identification of transactions or activities at risk of being linked to money laundering and terrorist financing in that sector, as well as guidance on obliged entities’ obligations in relation to targeted financial sanctions.
3. Member States shall ensure that supervisors carry out outreach activities, as appropriate, to inform the obliged entities under their supervision of their obligations.
4. Member States shall ensure that supervisors make information on persons or entities designated in relation to targeted financial sanctions and UN financial sanctions available to the obliged entities under their supervision immediately.
Risk-based supervision
1. Member States shall ensure that supervisors apply a risk-based approach to supervision. To that end, Member States shall ensure that they:
(a)
have a clear understanding of the risks of money laundering and terrorist financing present in their Member State;
(b)
assess all relevant information on the specific domestic and international risks associated with customers, products and services of the obliged entities;
(c)
base the frequency and intensity of on-site, off-site and thematic supervision on the risk profile of obliged entities, and on the risks of money laundering and terrorist financing in that Member State.
For the purposes of point (c) of the first subparagraph of this paragraph, supervisors shall draw up annual supervisory programmes, which shall take into account the timing and resources needed to react promptly in the event of objective and significant indications of breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113.
2. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall set out the benchmarks and a methodology for assessing and classifying the inherent and residual risk profile of obliged entities, as well as the frequency at which such risk profile shall be reviewed. Such frequency shall take into account any major events or developments in the management and operations of the obliged entity, as well as the nature and size of the business.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
3. By 10 July 2028, AMLA shall issue guidelines addressed to supervisors on:
(a)
the characteristics of a risk-based approach to supervision;
(b)
the measures to be put in place within supervisors to ensure adequate and effective supervision, including to train their staff;
(c)
the steps to be taken when conducting supervision on a risk-sensitive basis.
Where relevant, the guidelines referred to in the first subparagraph shall take into account the outcomes of the assessments carried out pursuant to Articles 30 and 35 of Regulation (EU) 2024/1620.
4. Member States shall ensure that supervisors take into account the degree of discretion allowed to the obliged entity, and appropriately review the risk assessments underlying this discretion, and the adequacy of its internal policies, procedures and controls.
5. Member States shall ensure that supervisors prepare a detailed annual activity report and that a summary of that report is made public. That summary shall not contain confidential information and shall include:
(a)
the categories of obliged entities under the supervision and the number of obliged entities per category;
(b)
a description of the powers with which the supervisors are entrusted and the tasks assigned to them and, where relevant, of mechanisms referred to in Article 37(4) in which they participate and, for the lead supervisor, a summary of the coordination activities carried out;
(c)
an overview of the supervisory activities carried out.
Central contact points
1. For the purposes of Article 37(1) and Article 38(1), Member States may require electronic money issuers, payment service providers and crypto-asset service providers operating establishments in their territory other than a subsidiary or a branch, or operating in their territory through agents or distributors, or through other types of infrastructure, under the freedom to provide services, to appoint a central contact point in their territory. That central contact point shall ensure, on behalf of the obliged entity, compliance with AML/CFT rules and shall facilitate supervision by supervisors, including by providing supervisors with documents and information on request.
2. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall set out the criteria for determining the circumstances in which the appointment of a central contact point pursuant to paragraph 1 is appropriate, and the functions of the central contact points.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
Disclosure to FIUs
1. Member States shall ensure that if, in the course of the checks carried out on the obliged entities, or in any other way, supervisors discover facts that could be related to money laundering, its predicate offences or terrorist financing, they shall promptly inform the FIU.
2. Member States shall ensure that supervisors empowered to oversee the stock, foreign exchange and financial derivatives markets, inform the FIU if they discover information that could be related to money laundering or terrorist financing.
3. Member States shall ensure that compliance with the requirements of this Article does not replace any obligation for supervisory authorities to report to the relevant competent authorities any criminal activity they uncover or become aware of in the context of their supervisory activities.
Provision of information to FIUs
Member States shall ensure that supervisors communicate to the FIU at least the following information:
(a)
the list of establishments operating in the respective Member State and the list of infrastructure under their supervision pursuant to Article 38(1), and of any changes to those lists;
(b)
any relevant findings indicating serious weaknesses of the reporting systems of obliged entities;
(c)
the results of the risk assessments performed pursuant to Article 40, in aggregated form.
General principles regarding supervisory cooperation
Member States shall ensure that supervisors cooperate with each other to the greatest extent possible, regardless of their respective nature or status. Such cooperation may include conducting, within the powers of the requested supervisor, inquiries on behalf of a requesting supervisor, and the subsequent exchange of the information obtained through such inquiries, or facilitating the conduct of such inquiries by the requesting supervisor.
Provision of information on cross-border activities
1. Member States shall ensure that the supervisors of the home Member State inform the supervisors of the host Member State as soon as possible, and in any case within 3 months of receiving a notification pursuant to Article 8(1) of Regulation (EU) 2024/1624 of the activities that the obliged entity intends to carry out in the host Member State.
Any subsequent change notified to the supervisors of the home Member State pursuant to Article 8(2) of Regulation (EU) 2024/1624 shall be notified to the supervisors of the host Member State as soon as possible and in any case within 1 month of receiving it.
2. Member States shall ensure that the supervisors of the home Member State share with the supervisors of the host Member State information on the activities effectively carried out by the obliged entity in the territory of the host Member State that they receive in the context of their supervisory activities, including information submitted by the obliged entities in response to supervisory questionnaires, and any relevant information connected to the activities carried out in the host Member State.
The information referred to in the first subparagraph shall be exchanged at least annually. Where that information is provided in an aggregated form, Member States shall ensure that the supervisors of the home Member State respond promptly to any request for additional information by the supervisors of the host Member State.
By way of derogation from the second subparagraph of this paragraph, Member States shall ensure that supervisors of the home Member State inform the supervisors of the host Member State immediately upon receiving notification by obliged entities pursuant to Article 8(1) of Regulation (EU) 2024/1624 that activities in the host Member State have commenced.
Provisions related to cooperation in the context of group supervision
1. In the case of credit institutions and financial institutions that are part of a group, Member States shall ensure that, for the purposes laid down in Article 37(1), financial supervisors of the home Member State and those of the host Member State cooperate with each other to the greatest extent possible, regardless of their respective nature or status. They shall also cooperate with AMLA when acting as a supervisor.
2. Except when AMLA acts as a supervisor, Member States shall ensure that the financial supervisors of the home Member State supervise the effective implementation of the group-wide policies, procedures and controls referred to in Chapter II, Section 2, of Regulation (EU) 2024/1624. Member States shall also ensure that financial supervisors of the host Member State supervise the compliance of the establishments located in the territory of their Member State with Regulations (EU) 2024/1624 and (EU) 2023/1113.
3. For the purposes of this Article, and except in cases where AML/CFT supervisory colleges are set up in accordance with Article 49, Member States shall ensure that financial supervisors provide one another with any information they require for the exercise of their supervisory tasks, whether on request or on their own initiative. In particular, financial supervisors shall exchange any information that could significantly influence the assessment of the inherent or residual risk exposure of a credit institution or financial institution in another Member State, including:
(a)
identification of the group’s legal, governance and organisational structure, covering all subsidiaries and branches;
(b)
relevant information on the beneficial owners and senior management, including outcomes of fit and proper checks, whether carried out under this Directive or under other Union legal acts;
(c)
policies, procedures and controls in place within the group;
(d)
customer due diligence information, including customer files and records of transactions;
(e)
adverse developments in relation to the parent undertaking, subsidiaries or branches, which could seriously affect other parts of the group;
(f)
pecuniary sanctions that financial supervisors intend to impose and administrative measures that financial supervisors intend to apply in accordance with Section 4 of this Chapter.
Member States shall also ensure that financial supervisors are able to conduct, within their powers, inquiries on behalf of a requesting supervisor, and to share the information obtained through such inquiries, or to facilitate the conduct of such inquiries by the requesting supervisor.
4. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall detail the respective duties of the home and host supervisors, and the modalities of cooperation between them.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
5. Financial supervisors may refer to AMLA any of the following situations:
(a)
where a financial supervisor has not communicated the information referred to in paragraph 3;
(b)
where a request for cooperation has been rejected or has not been acted upon within a reasonable time;
(c)
where there is a disagreement on the basis of objective reasons on breaches identified and on the pecuniary sanctions to be imposed or administrative measures to be applied on the entity or group to remedy those breaches.
AMLA may act in accordance with the powers conferred on it under Article 33 of Regulation (EU) 2024/1620. When doing so, AMLA shall provide its opinion on the subject-matter of the request within 1 month.
6. Member States shall ensure that this Article also applies to the supervision of:
(a)
groups of obliged entities in the non-financial sector;
(b)
obliged entities operating under the freedom to provide services without any infrastructure in another Member States than the Member State where they are established, where the supervision of activities in that other Member State is carried out by the supervisors of that other Member State pursuant to Article 37(1), second subparagraph.
Where the situations referred to in paragraph 5 arise in relation to non-financial supervisors, AMLA may act in accordance with the powers conferred on it under Article 38 of Regulation (EU) 2024/1620.
Member States shall also ensure that in cases where obliged entities in the non-financial sector are part of structures which share common ownership, management or compliance control, including networks or partnerships, non-financial supervisors cooperate and exchange information.
Supervisory cooperation regarding obliged entities carrying out cross-border activities
1. Where obliged entities that are not part of a group carry out cross-border activities as referred to in Article 54(1) and supervision is shared between the supervisors of the home and host Member States pursuant to Articles 37(1) and 38(1), Member States shall ensure that those supervisors cooperate with each other to the greatest extent possible and assist each other in the performance of supervision pursuant to Articles 37(1) and 38(1).
For the purposes of the first subparagraph, and except in cases where AML/CFT supervisory colleges are set up in accordance with Article 49, Member States shall ensure that supervisors:
(a)
provide one another with any information they require for the exercise of their supervisory tasks, whether on request or on their own initiative, including the information referred to in Article 46(3), first subparagraph, points (a), (b) and (d), where that information is necessary for the performance of supervisory tasks;
(b)
inform one another of any adverse development in relation to the obliged entity, its establishments or types of infrastructure, which could seriously affect the entity’s compliance with applicable requirements, and pecuniary sanctions they intend to impose, or administrative measures they intend to apply in accordance with Section 4 of this Chapter;
(c)
are able to conduct, within their powers, inquiries on behalf of a requesting supervisor, and to share the information obtained through such inquiries, or to facilitate the conduct of such inquiries by the requesting supervisor.
This paragraph shall also apply in the case of obliged entities that are established in a single Member State and operate under the freedom to provide services in another Member State without any infrastructure, where the supervision of activities in that other Member State is carried out by the supervisors of that Member State pursuant to Article 37(1), second subparagraph.
2. Where supervision of the obliged entity and any of its types of infrastructure in other Member States is entrusted to the supervisors of the home Member State pursuant to Article 38(2), Member States shall ensure that the supervisors of the home Member State inform regularly the supervisors of the host Member State of the measures in place within the obliged entity, and compliance of that entity with applicable requirements, including those in place in the host Member State. Where serious, repeated or systematic breaches are identified, the supervisors of the home Member State shall promptly inform the supervisors of the host Member State of those breaches and of any pecuniary sanctions they intend to impose and administrative measures they intend to apply to remedy them.
Member States shall ensure that supervisors of the host Member State provide assistance to the supervisors of the home Member State to ensure the verification of compliance by the obliged entity with legal requirements. In particular, Member States shall ensure that supervisors of the host Member State inform the supervisors of the home Member State of any serious doubts that they have regarding compliance of the obliged entity with applicable requirements, and that they share any information they hold in this regard with the supervisors of the home Member State.
This paragraph shall also apply in the case of obliged entities that are established in a single Member State and operate under the freedom to provide services in another Member State without any infrastructure, except for cases where the supervision of activities in that other Member State is carried out by the supervisors of that other Member State pursuant to Article 37(1), second subparagraph.
3. Supervisors shall be able to refer to AMLA any of the following situations:
(a)
where a supervisor has not communicated the information referred to in paragraph 1, second subparagraph, points (a) and (b) or paragraph 2, first and second subparagraph;
(b)
where a request for cooperation has been rejected or has not been acted upon within a reasonable time;
(c)
where there is a disagreement on the basis of objective reasons on breaches identified and on the pecuniary sanctions to be imposed on or administrative measures to be applied to the entity to remedy those breaches.
AMLA shall act in accordance with the powers conferred on it under Articles 33 and 38 of Regulation (EU) 2024/1620. AMLA shall provide its opinion on the subject-matter of the request within 1 month.
Exchange of information in relation to implementation of group-wide policies in third countries
Supervisors, including AMLA, shall inform each other of instances in which the law of a third country does not permit the implementation of the policies, procedures and controls required under Article 16 of Regulation (EU) 2024/1624. In such cases, coordinated actions may be taken by supervisors to pursue a solution. In assessing which third countries do not permit the implementation of the policies, procedures and controls required under Article 16 of Regulation (EU) 2024/1624, supervisors shall take into account any legal constraints that may hinder proper implementation of those policies, procedures and controls, including professional secrecy, an insufficient level of data protection and other constraints limiting the exchange of information that may be relevant for that purpose.
SECTION 2 — Cooperation within AML/CFT supervisory colleges and with counterparts in third countries
AML/CFT supervisory colleges in the financial sector
1. Member States shall ensure that dedicated AML/CFT supervisory colleges are set up by the financial supervisor in charge of the parent undertaking of a group of credit institutions or financial institutions or of the head office of a credit institution or financial institution in any of the following situations:
(a)
where a credit institution or a financial institution, including groups thereof, has set up establishments in at least two different Member States other than the Member State where its head office is located;
(b)
where a third-country credit institution or financial institution has set up establishments in at least three Member States.
2. The permanent members of the college shall be the financial supervisor in charge of the parent undertaking or of the head office, the financial supervisors in charge of establishments in host Member States and the financial supervisors in charge of infrastructure in host Member States pursuant to Article 38.
3. This Article shall not apply when AMLA acts as a supervisor.
4. The activities of the AML/CFT supervisory colleges shall be proportionate to the level of the money laundering and terrorist financing risks to which the credit institution or financial institution or the group is exposed, and to the scale of its cross-border activities.
5. For the purposes of paragraph 1, Member States shall ensure that financial supervisors identify:
(a)
all credit institutions or financial institutions that have been authorised in their Member State and that have establishments in other Member States or third countries;
(b)
all establishments set up by credit institutions or financial institutions in other Member States or third countries;
(c)
establishments set up in their territory by credit institutions or financial institutions from other Member States or third countries.
6. In situations other than those covered by Article 38, where credit institutions or financial institutions carry out activities in other Member States under the freedom to provide services, the financial supervisor of the home Member State may invite the financial supervisors of those Member States to participate in the college as observers.
7. Where a group of credit institutions or financial institutions includes any obliged entity in the non-financial sector, the financial supervisor setting up the college shall invite the supervisors of those obliged entities to participate in the college.
8. Member States may allow the setting-up of AML/CFT supervisory colleges when a credit institution or financial institution established in the Union has set up establishments in at least two third countries. Financial supervisors may invite their counterparts in those third countries to set up such college. The financial supervisors participating in the college shall establish a written agreement detailing the conditions and procedures of the cooperation and exchange of information.
9. Member States shall ensure that colleges are used, among others, for exchanging information, providing mutual assistance or coordinating the supervisory approach to the group or institution, including, where relevant, the taking of appropriate and proportionate measures to address serious breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113 that are detected at the level of the group or of the credit institution or financial institution or across the establishments set up by the group or institution in the jurisdiction of a supervisor participating in the college.
10. AMLA may attend the meetings of the AML/CFT supervisory colleges and shall facilitate their work in accordance with Article 31 of Regulation (EU) 2024/1620. Where AMLA decides to participate in the meetings of an AML/CFT supervisory college, it shall have the status of an observer.
11. Financial supervisors may allow their counterparts in third countries to participate as observers in AML/CFT supervisory colleges in the case referred to in paragraph 1, point (b) or where Union groups or credit institutions or financial institutions operate branches and subsidiaries in those third countries, provided that:
(a)
the third-country counterparts submit a request for participation and the members of the college agree with their participation, or the members of the college agree to invite those third-country counterparts;
(b)
Union data protection rules concerning data transfers are complied with;
(c)
the third-country counterparts sign the written agreement referred to in paragraph 8, third sentence, and share within the college the relevant information they possess for the supervision of the credit institutions or financial institutions or of the group;
(d)
the information disclosed is subject to a guarantee of professional secrecy requirements at least equivalent to that referred to in Article 67(1) and is used solely for the purposes of performing the supervisory tasks of the participating financial supervisors or of the counterparts in third countries.
Member States shall ensure that financial supervisors setting up the colleges carry out an assessment of whether the conditions of the first subparagraph are met and submit it to the permanent members of the college. That assessment shall be carried out prior to the third-country counterpart being allowed to join the college and may be repeated as necessary thereafter. The financial supervisors of the home Member State may seek the support of AMLA for the performance of that assessment.
12. Where deemed necessary by the permanent members of the college, additional observers may be invited, provided that confidentiality requirements are complied with. Observers may include prudential supervisors, including the ECB acting in accordance with Council Regulation (EU) No 1024/2013 ( 43 ) , as well as the European Supervisory Authorities and FIUs.
13. Where the members of a college disagree on the measures to be taken in relation to an obliged entity, they may refer the matter to AMLA and request its assistance in accordance with Article 33 of Regulation (EU) 2024/1620.
14. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall specify:
(a)
the general conditions for the functioning, on a risk-sensitive basis, of the AML/CFT supervisory colleges in the financial sector, including the terms of cooperation between permanent members and with observers, and the operational functioning of such colleges;
(b)
the template for the written agreement to be signed by financial supervisors pursuant to paragraph 8;
(c)
any additional measure to be implemented by the colleges when groups include obliged entities in the non-financial sector;
(d)
conditions for the participation of financial supervisors in third countries.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
AML/CFT supervisory colleges in the non-financial sector
1. Member States shall ensure that the non-financial supervisors in charge of the parent undertaking of a group of obliged entities in the non-financial sector or of the head office of an obliged entity in the non-financial sector are able to set up dedicated AML/CFT supervisory colleges in any of the following situations:
(a)
where an obliged entity in the non-financial sector, or a group thereof, has set up establishments in at least two different Member States other than the Member State where its head office is located;
(b)
where a third-country entity subject to AML/CFT requirements other than a credit institution or a financial institution has set up establishments in at least three Member States.
This paragraph shall also apply to structures which share common ownership, management or compliance control, including networks or partnerships to which group-wide requirements apply pursuant to Article 16 of Regulation (EU) 2024/1624.
The permanent members of the college shall be the non-financial supervisor in charge of the parent undertaking or of the head office and the non-financial supervisors in charge of establishments in host Member States or of supervision of that obliged entity in other Member States in the cases covered by Article 37(1), second subparagraph.
2. Member States shall ensure that where the non-financial supervisor in charge of the parent undertaking of a group or of the head office of an obliged entity does not set up a college, non-financial supervisors referred to in paragraph 1, second subparagraph, point (b), can submit an opinion that, having regard to the money laundering and terrorist financing risks to which the obliged entity or group is exposed and the scale of its cross-border activities, a college shall be set up. That opinion shall be submitted by at least two non-financial supervisors and addressed to:
(a)
the non-financial supervisor in charge of the parent undertaking of a group or of the head office of an obliged entity;
(b)
AMLA;
(c)
all other non-financial supervisors.
Where the non-financial supervisor referred to in point (a) of the first subparagraph of this paragraph is a self-regulatory body, that opinion shall also be submitted to the public authority in charge of overseeing that self-regulatory body pursuant to Article 52.
3. Where, after an opinion is submitted pursuant to paragraph 2, the non-financial supervisor in charge of the parent undertaking of a group or of the head office of an obliged entity still considers that it is not necessary to set up a college, Member States shall ensure that the other non-financial supervisors are able to set up the college, provided that it is composed of at least two members. In those cases, those non-financial supervisors shall decide among them who is the supervisor in charge of the college. The non-financial supervisor in charge of the parent undertaking of a group or of the head office of an obliged entity shall be informed of the activities of the college and be able to join the college at any time.
4. For the purposes of paragraph 1, Member States shall ensure that non-financial supervisors identify:
(a)
all obliged entities in the non-financial sector that have their head office in their Member State and that have establishments in other Member States or third countries;
(b)
all establishments set up by those obliged entities in other Member States or third countries;
(c)
establishments set up in their territory by obliged entities in the non-financial sector from other Member States or third countries.
5. Where obliged entities in the non-financial sector carry out activities in other Member States under the freedom to provide services, the non-financial supervisor of the home Member State may invite the non-financial supervisors of those Member States to participate in the college as observers.
6. Where a group in the non-financial sector includes any credit institution or financial institution, but their presence in the group does not meet the threshold for setting up a college pursuant to Article 49, the supervisor setting up the college shall invite the financial supervisors of those credit institutions or financial institutions to participate in the college.
7. Member States may allow the setting up of AML/CFT supervisory colleges when an obliged entity in the non-financial sector established in the Union has set up establishments in at least two third countries. Non-financial supervisors may invite their counterparts in those third countries to set up such college. The non-financial supervisors participating in the college shall establish a written agreement detailing the conditions and procedures for the cooperation and exchange of information.
Where the college is set up in relation to obliged entities referred to in Article 3, points (3)(a) and (b), of Regulation (EU) 2024/1624 or groups thereof, the written agreement referred to in the first subparagraph of this paragraph shall also include procedures to ensure that no information collected pursuant to Article 21(2) of Regulation (EU) 2024/1624 is shared, unless the second subparagraph of Article 21(2) applies.
8. Member States shall ensure that colleges are used, among others, for exchanging information, providing mutual assistance or coordinating the supervisory approach to the group or obliged entity, including, where relevant, the taking of appropriate and proportionate measures to address serious breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113 that are detected at the level of the group or of the obliged entity, or across the establishments set up by the group or obliged entity in the jurisdiction of a supervisor participating in the college.
9. AMLA may attend the meetings of the AML/CFT supervisory colleges and shall facilitate their work in accordance with Article 36 of Regulation (EU) 2024/1620. Where AMLA decides to participate in the meetings of an AML/CFT supervisory college, it shall have the status of an observer.
10. Non-financial supervisors may allow their counterparts in third countries to participate in AML/CFT supervisory colleges as observers in the case referred to in paragraph 1, point (b), or where Union obliged entities in the non-financial sector or groups thereof operate branches and subsidiaries in those third countries, provided that:
(a)
the third-country counterparts submit a request for participation and the members of the college agree with their participation, or the members of the college agree to invite those third-country counterparts;
(b)
Union data protection rules concerning data transfers are complied with;
(c)
the third-country counterparts sign the written agreement referred to in paragraph 7 and share within the college the relevant information they possess for the supervision of the obliged entity or of the group;
(d)
the information disclosed is subject to a guarantee of professional secrecy requirements at least equivalent to that referred to in Article 67(1) and is used solely for the purposes of performing the supervisory tasks of the participating non-financial supervisors or of the counterparts in third countries.
Member States shall ensure that non-financial supervisors in charge of the parent undertaking of a group or of the head office of an obliged entity or, in the cases covered by paragraph 3, of the college carry out an assessment of whether the conditions of the first subparagraph of this paragraph are met and submit it to the permanent members of the college. That assessment shall be carried out prior to the third-country counterpart being allowed to join the college and may be repeated as necessary thereafter. The non-financial supervisors in charge of the assessment may seek the support of AMLA for the performance of that assessment.
11. Where deemed necessary by the permanent members of the college, additional observers may be invited, provided that confidentiality requirements are complied with. Observers may include FIUs.
12. Where the members of a college disagree on the measures to be taken in relation to an obliged entity, they may refer the matter to AMLA and request its assistance in accordance with Article 38 of Regulation (EU) 2024/1620. AMLA shall provide its opinion on the matter of disagreement within 2 months.
13. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall specify:
(a)
the general conditions for the functioning of the AML/CFT supervisory colleges in the non-financial sector, including the terms of cooperation between permanent members and with observers, and the operational functioning of such colleges;
(b)
the template for the written agreement to be signed by non-financial supervisors pursuant to paragraph 7;
(c)
conditions for the participation of non-financial supervisors in third countries;
(d)
any additional measure to be implemented by the colleges when groups include credit institutions or financial institutions.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
14. By 10 July 2029 and every 2 years thereafter, AMLA shall issue an opinion on the functioning of AML/CFT supervisory colleges in the non-financial sector. That opinion shall include:
(a)
an overview of the colleges set up by non-financial supervisors;
(b)
an assessment of the actions taken by those colleges and the level of cooperation attained, including difficulties faced in the functioning of the colleges.
Cooperation with supervisors in third countries
1. Member States shall ensure that supervisors are able to conclude cooperation agreements providing for cooperation and exchanges of confidential information with their counterparts in third countries. Such cooperation agreements shall comply with applicable data protection rules and be concluded on the basis of reciprocity and subject to a guarantee of professional secrecy requirements at least equivalent to that referred to in Article 67(1). Confidential information exchanged in accordance with those cooperation agreements shall be used for the purpose of performing the supervisory tasks of those authorities only.
Where the information exchanged originates in another Member State, it shall only be disclosed with the explicit consent of the supervisor which shared it and, where appropriate, solely for the purposes for which that supervisor gave its consent.
2. For the purposes of paragraph 1, AMLA shall provide such assistance as necessary to assess the equivalence of professional secrecy requirements applicable to the third-country counterpart.
3. Member States shall ensure that supervisors notify any agreement signed pursuant to this Article to AMLA within 1 month of its signature.
4. By 10 July 2029, AMLA shall develop draft implementing technical standards and submit them to the Commission for adoption. Those draft implementing technical standards shall specify the template to be used for the conclusion of cooperation agreements referred to in paragraph 1.
Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 53 of Regulation (EU) 2024/1620.
SECTION 3 — Specific provisions relating to self-regulatory bodies
Oversight of self-regulatory bodies
1. Where Member States decide, pursuant to Article 37(3) of this Directive, to allow self-regulatory bodies to perform supervision of the obliged entities referred to in Article 3, points (3)(a) and (b), of Regulation (EU) 2024/1624, they shall ensure that the activities of such self-regulatory bodies in the performance of such functions are subject to oversight by a public authority.
2. The public authority overseeing self-regulatory bodies shall be responsible for ensuring an adequate and effective supervisory system for the obliged entities referred to in Article 3, points (3)(a) and (b), of Regulation (EU) 2024/1624, including by:
(a)
verifying that any self-regulatory body performing the functions or aspiring to perform the functions referred to in Article 37(1) satisfies the requirements of paragraph 3 of that Article;
(b)
issuing guidance as regards the performance of the functions referred to in Article 37(1);
(c)
ensuring that self-regulatory bodies perform their functions under Section 1 of this Chapter adequately and effectively;
(d)
reviewing the exemptions granted by self-regulatory bodies from the obligation to draw up an individual documented risk assessment pursuant to Article 37(5), point (b);
(e)
regularly informing self-regulatory bodies of any activity planned or task carried out by AMLA that is relevant for the performance of their supervisory function, and in particular the planning of peer reviews in accordance with Article 35 of Regulation (EU) 2024/1620.
3. Member States shall ensure that the public authority overseeing self-regulatory bodies is granted adequate powers to discharge its responsibilities under paragraph 2. As a minimum, Member States shall ensure that the public authority has the power to:
(a)
compel the production of any information that is relevant to monitoring compliance and performing checks, except for any information collected by obliged entities referred to in Article 3, points (3)(a) and (b), of Regulation (EU) 2024/1624 in the course of ascertaining the legal position of their client, subject to the conditions of Article 21(2) of that Regulation, or for performing the task of defending or representing that client in, or concerning, judicial proceedings, including providing advice on instituting or avoiding such proceedings; whether such information was collected before, during or after such proceedings;
(b)
issue instructions to a self-regulatory body for the purpose of remedying a failure to perform its functions under Article 37(1) or to comply with the requirements of paragraph 6 of that Article, or to prevent any such failures.
When issuing instructions to a self-regulatory body in accordance with point (b) of the first subparagraph, the public authority shall consider any relevant guidance it provided or that has been provided by AMLA.
4. Member States shall ensure that the public authority overseeing self-regulatory bodies performs its functions free of undue influence.
Member States shall also ensure that the staff of the public authority overseeing self-regulatory bodies are bound by professional secrecy requirements equivalent to those laid down in Article 67, and that they maintain high professional standards, including high professional standards of confidentiality and data protection, and are of high integrity. Member States shall ensure that the public authority overseeing self-regulatory bodies has in place procedures to prevent and manage conflicts of interest.
5. Member States may provide for effective, proportionate and dissuasive measures or sanctions for failures by self-regulatory bodies to comply with any request or instruction or other measure taken by the authority pursuant to paragraph 2 or 3.
6. Member States shall ensure that the public authority overseeing self-regulatory bodies informs the authorities competent for investigating and prosecuting criminal activities timely, directly or through the FIU, of any breaches which are subject to criminal sanctions that it detects in the performance of its tasks.
7. The public authority overseeing self-regulatory bodies shall publish an annual report containing information about:
(a)
the number and nature of breaches detected by each self-regulatory body and the pecuniary sanctions imposed on or administrative measures applied to obliged entities;
(b)
the number of suspicious transactions reported by the obliged entities subject to supervision by each self-regulatory body to the FIU, whether submitted directly pursuant to Article 69(1) of Regulation (EU) 2024/1624, or forwarded by each self-regulatory body to the FIU pursuant to Article 70(1) of that Regulation;
(c)
the number and description of pecuniary sanctions and periodic penalty payments imposed or administrative measures applied under Section 4 of this Chapter by each self-regulatory body to ensure compliance by obliged entities with Regulation (EU) 2024/1624 referred to in Article 55(1) of this Directive;
(d)
the number and description of measures taken by the public authority overseeing self-regulatory bodies under this Article and the number of instructions issued to self-regulatory bodies.
The report referred to in the first subparagraph shall be made available on the website of the public authority overseeing self-regulatory bodies and submitted to the Commission and AMLA.
SECTION 4 — Pecuniary sanctions and administrative measures
General provisions
1. Member States shall ensure that obliged entities can be held liable for breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113 in accordance with this Section.
2. Without prejudice to the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on pecuniary sanctions and administrative measures and ensure that supervisors may impose such pecuniary sanctions and apply administrative measures with respect to breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 and shall ensure that they are enforced. Any sanction imposed or measure applied pursuant to this Section shall be effective, proportionate and dissuasive.
3. By way of derogation from paragraph 2, where the legal system of a Member State does not provide for administrative sanctions, this Article may be applied in such a manner that the pecuniary sanction is initiated by the supervisor and imposed by a judicial authority, while ensuring that those legal remedies are effective and have an equivalent effect to the pecuniary sanctions imposed by supervisors. In any event, the pecuniary sanctions imposed shall be effective, proportionate and dissuasive.
The Member States referred to in the first subparagraph shall communicate to the Commission the measures of national law which they adopt pursuant to this paragraph by 10 July 2027 and, without delay, any subsequent amendments thereto.
4. In the event of a breach of Regulations (EU) 2024/1624 and (EU) 2023/1113, Member States shall ensure that where obligations apply to legal persons, pecuniary sanctions can be imposed and administrative measures can be applied not only to the legal person, but also to the senior management and to other natural persons who under national law are responsible for the breach.
Member States shall ensure that where supervisors identify breaches which are subject to criminal sanctions, they inform the authorities competent for investigating and prosecuting criminal activities in a timely manner.
5. In accordance with this Directive and with national law, pecuniary sanctions shall be imposed and administrative measures shall be applied in any of the following ways:
(a)
directly by the supervisors;
(b)
in cooperation between the supervisors and other authorities;
(c)
under the responsibility of the supervisors by delegation to other authorities;
(d)
by application by the supervisors to the competent judicial authorities.
By 10 October 2027, Member States shall notify to the Commission and AMLA the information as regards the arrangements relating to the imposition of pecuniary sanctions or application of administrative measures pursuant to this paragraph, including, where relevant, information whether certain sanctions or measures require the recourse to a specific procedure.
6. Member States shall ensure that, when determining the type and level of pecuniary sanctions or administrative measures, supervisors take into account all relevant circumstances, including where applicable:
(a)
the gravity and the duration of the breach;
(b)
the number of instances the breach was repeated;
(c)
the degree of responsibility of the natural or legal person held responsible;
(d)
the financial strength of the natural or legal person held responsible, including in light of its total turnover or annual income;
(e)
the benefit derived from the breach by the natural or legal person held responsible, insofar as it can be determined;
(f)
the losses to third parties caused by the breach, insofar as they can be determined;
(g)
the level of cooperation of the natural or legal person held responsible with the competent authority;
(h)
previous breaches by the natural or legal person held responsible.
7. Member States shall ensure that legal persons can be held liable for the breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 committed on their behalf or for their benefit by any person, acting individually or as part of a body of that legal person and having a leading position within that legal person, based on any of the following:
(a)
a power to represent the legal person;
(b)
an authority to take decisions on behalf of the legal person;
(c)
an authority to exercise control within the legal person.
8. Member States shall ensure that legal persons can be held liable where the lack of supervision or control by a person as referred to in paragraph 7 of this Article has made possible the breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 by a person under their authority on behalf of or for the benefit of the legal person.
9. In the exercise of their powers to impose pecuniary sanctions and apply administrative measures, supervisors shall cooperate closely and, where relevant, coordinate their actions with other authorities as appropriate, in order to ensure that those pecuniary sanctions or administrative measures produce the desired results and coordinate their action when dealing with cross-border cases.
10. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall set out:
(a)
indicators to classify the level of gravity of breaches;
(b)
criteria to be taken into account when setting the level of pecuniary sanctions or applying administrative measures pursuant to this Section;
(c)
a methodology for the imposition of periodic penalty payments pursuant to Article 57, including their frequency.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
11. By 10 July 2026, AMLA shall issue guidelines on the base amounts for the imposing of pecuniary sanctions relative to turnover, broken down per type of breach and category of obliged entities.
Supervisory measures towards establishments of obliged entities and certain activities carried out under the freedom to provide services
1. In the case of establishments of obliged entities that do not as such qualify as credit institutions or financial institutions or of types of infrastructure of obliged entities over which the supervisor of the host Member State exercises supervision pursuant to Article 38(1), paragraphs 2 to 5 of this Article shall apply.
2. Where the supervisors of the host Member State identify breaches of applicable requirements, they shall request the obliged entities operating through the establishments or types of infrastructure as referred to in paragraph 1 to comply with the applicable requirements and inform the supervisors of the home Member State of the breaches identified within those obliged entities and of the request to comply.
3. Where the obliged entities fail to take the necessary action, the supervisors of the host Member State shall inform the supervisors of the home Member State accordingly.
The supervisors of the home Member State shall act promptly and take all appropriate measures to ensure that the obliged entity concerned remedies the breaches detected in its establishments or types of infrastructure in the host Member State. The supervisors of the home Member State shall inform the supervisors of the host Member State of any actions taken pursuant to this paragraph.
4. By way of derogation from paragraph 3, in situations of serious, repeated or systematic breaches by obliged entities operating through establishments or other types of infrastructure in their territory as referred to in paragraph 1 that require immediate remedies, supervisors of the host Member State shall be allowed at their own initiative to take appropriate and proportionate measures to address those breaches. Those measures shall be temporary and be terminated when the breaches identified are addressed, including with the assistance of or in cooperation with the supervisors of the home Member State of the obliged entity.
Member States shall ensure that the supervisors of the host Member State inform the supervisor of the home Member State of the obliged entity immediately upon identification of the serious, repeated or systematic breaches and upon taking any measure pursuant to the first subparagraph, unless measures are taken in cooperation with the supervisors of the home Member State.
5. Where the supervisors of the home and host Member States disagree on the measures to be taken in relation to an obliged entity, they may refer the matter to AMLA and request its assistance in accordance with Articles 33 and 38 of Regulation (EU) 2024/1620. AMLA shall provide its opinion on the matter of disagreement within 1 month.
Pecuniary sanctions
1. Member States shall ensure that pecuniary sanctions are imposed on obliged entities for serious, repeated or systematic breaches, whether committed intentionally or negligently, of the requirements laid down in the following provisions of Regulation (EU) 2024/1624:
(a)
Chapter II (Internal policies, procedures and controls of obliged entities);
(b)
Chapter III (Customer due diligence);
(c)
Chapter V (Reporting obligations);
(d)
Article 77 (Record retention).
Member States shall also ensure that pecuniary sanctions can be imposed where obliged entities have not complied with administrative measures applied to them pursuant to Article 56 of this Directive or for breaches that are not serious, repeated or systematic.
2. Member States shall ensure that in the cases referred to in paragraph 1, first subparagraph, the maximum pecuniary sanctions that can be imposed amount at least to twice the amount of the benefit derived from the breach where that benefit can be determined, or at least EUR 1 000 000, whichever is higher.
For Member States whose currency is not the euro, the value referred to in the first subparagraph shall be the corresponding value in the national currency on 9 July 2024.
3. Member States shall ensure that, by way of derogation from paragraph 2, where the obliged entity concerned is a credit institution or a financial institution, the following pecuniary sanctions can also be imposed:
(a)
in the case of a legal person, maximum pecuniary sanctions of at least EUR 10 000 000 or, in the Member States whose currency is not the euro, the corresponding value in the national currency on 9 July 2024, or 10 % of the total annual turnover according to the latest available accounts approved by the management body, whichever is higher; where the obliged entity is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial accounts in accordance with Article 22 of Directive 2013/34/EU of the European Parliament and of the Council ( 44 ) , the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with the relevant accounting regime according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking;
(b)
in the case of a natural person, maximum pecuniary sanctions of at least EUR 5 000 000 or, in the Member States whose currency is not the euro, the corresponding value in the national currency on 9 July 2024.
4. Member States may empower competent authorities to impose pecuniary sanctions exceeding the amounts referred to in paragraphs 2 and 3.
5. Member States shall ensure that, when determining the amount of the pecuniary sanction, the ability of the obliged entity to pay the sanction is taken into account and that, where the pecuniary sanction may affect compliance with prudential regulation, supervisors consult the authorities competent to supervise compliance by the obliged entities with relevant Union legal acts.
Administrative measures
1. Member States shall ensure that supervisors are able to apply administrative measures to an obliged entity where they identify:
(a)
breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113, either in combination with pecuniary sanctions for serious, repeated and systematic breaches, or on their own;
(b)
weaknesses in the internal policies, procedures and controls of the obliged entity that are likely to result in breaches of the requirements referred to in point (a) and administrative measures can prevent the occurrence of those breaches or reduce the risk thereof;
(c)
that the obliged entity has internal policies, procedures and controls that are not commensurate with the risks of money laundering, its predicate offences or terrorist financing to which the entity is exposed.
2. Member States shall ensure that the supervisors are able at least to:
(a)
issue recommendations;
(b)
order obliged entities to comply, including to implement specific corrective measures;
(c)
issue a public statement which identifies the natural or legal person and the nature of the breach;
(d)
issue an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;
(e)
restrict or limit the business, operations or network of institutions comprising the obliged entity, or to require the divestment of activities;
(f)
where an obliged entity is subject to an authorisation, withdraw or suspend the authorisation;
(g)
require changes in the governance structure.
3. Member States shall ensure that the supervisors are able, by means of the administrative measures referred to in paragraph 2, in particular to:
(a)
require the provision of any data or information necessary for the fulfilment of their tasks pursuant to this Chapter without undue delay, to require the submission of any document, or impose additional or more frequent reporting requirements;
(b)
require the reinforcement of the internal policies, procedures and controls;
(c)
require the obliged entity to apply a specific policy or requirements relating to categories of or individual clients, transactions, activities or delivery channels that pose high risks;
(d)
require the implementation of measures to bring about the reduction of the money laundering or terrorist financing risks inherent in the activities and products of the obliged entity;
(e)
impose a temporary ban against any person discharging managerial responsibilities in an obliged entity, or any other natural person who has been held responsible for the breach from exercising managerial functions in obliged entities.
4. The administrative measures referred to in paragraph 2 shall be accompanied, where relevant, by binding deadlines for their implementation. Member States shall ensure that supervisors follow up and assess the implementation by the obliged entity of the actions requested.
5. Member States may empower supervisors to apply additional types of administrative measures to those referred to in paragraph 2.
Periodic penalty payments
1. Member States shall ensure that, where obliged entities fail to comply with administrative measures applied by the supervisor pursuant to Article 56(2), points (b), (d), (e) and (g), within the applicable deadlines, supervisors are able to impose periodic penalty payments in order to compel compliance with those administrative measures.
2. The periodic penalty payments shall be effective and proportionate. The periodic penalty payments shall be imposed until the obliged entity or person concerned complies with the relevant administrative measures.
3. Notwithstanding paragraph 2, in the case of legal persons, the amount of the periodic penalty payment shall not exceed 3 % of their average daily turnover in the preceding business year or, in the case of natural persons, that amount shall not exceed 2 % of their average daily income in the preceding calendar year.
4. Periodic penalty payments shall only be imposed for a period of no more than 6 months following the supervisor’s decision. Where, upon expiry of that period, the obliged entity has not yet complied with the administrative measure, Member States shall ensure that supervisors can impose periodic penalty payments for an additional period of no more than 6 months.
5. Member States shall ensure that a decision imposing a periodic penalty payment can be taken as of the date of the application of the administrative measure.
The periodic penalty payment shall apply as of the date when that decision is taken.
Publication of pecuniary sanctions, administrative measures and periodic penalty payments
1. Member States shall ensure that supervisors publish on their website, in an accessible format, decisions imposing pecuniary sanctions, applying administrative measures referred to in Article 56(2), points (c) to (g), pursuant to Article 56(1), point (a), or imposing periodic penalty payments.
2. Member States shall ensure that the decisions referred to in paragraph 1 are published by the supervisor immediately after the persons responsible for the breach are informed of those decisions.
By way of derogation from the first subparagraph, where the publication concerns administrative measures against which there is an appeal and that do not aim to remedy serious, repeated and systematic breaches, Member States may allow for the publication of those administrative measures to be deferred until expiry of the deadline for lodging an appeal.
Where the publication refers to decisions against which there is an appeal, supervisors shall also publish, immediately, on their website such information and any subsequent information on an appeal, and the outcome of such appeal. Any decision annulling a previous decision to impose a pecuniary sanction, apply an administrative measure, or impose a periodic penalty payment, shall also be published.
3. The publication shall include at least information on the type and nature of the breach and the identity of the persons responsible, as well as, for pecuniary sanctions and periodic penalty payments, their amounts. Member States shall not be obliged to apply this subparagraph to decisions applying administrative measures that are of an investigatory nature, or which are taken pursuant to Article 56(2), points (a) and (c).
Where the publication of the identity of the persons responsible as referred to in the first subparagraph or the personal data of such persons is considered by the supervisors to be disproportionate following a case-by-case assessment, or where publication jeopardises the stability of financial markets or an on-going investigation, supervisors shall:
(a)
delay the publication of the decision until the moment at which the reasons for not publishing it cease to exist;
(b)
publish the decision on an anonymous basis in a manner in accordance with national law, if such anonymous publication ensures the effective protection of the personal data concerned; in that case, the publication of the relevant data may be postponed for a reasonable period if it is foreseen that within that period the reasons for anonymous publication shall cease to exist;
(c)
not publish the decision at all in the event that the options set out in points (a) and (b) are considered insufficient to ensure one of the following:
(i)
that the stability of financial markets would not be put in jeopardy;
(ii)
the proportionality of the publication of the decision with regard to pecuniary sanctions and administrative measures for breaches which are deemed to be of a minor nature.
4. Member States shall ensure that any publication in accordance with this Article remains on the website of the supervisors for a period of 5 years after its publication. However, personal data contained in the publication shall only be kept on the website of the supervisors for the period which is necessary in accordance with the applicable data protection rules and in any case for no more than 5 years.
Exchange of information on pecuniary sanctions and administrative measures
1. Member States shall ensure that their supervisors and, where relevant, the public authority overseeing self-regulatory bodies in their performance of supervisory functions, inform AMLA of all pecuniary sanctions imposed and administrative measures applied in accordance with this Section, including of any appeal in relation thereto and the outcome thereof. Such information shall also be shared with other supervisors when the pecuniary sanction or administrative measure concerns an entity operating in two or more Member States.
2. AMLA shall maintain on its website links to each supervisor’s publication of pecuniary sanctions imposed and administrative measures applied in accordance with Article 58, and shall show the period for which each Member State publishes pecuniary sanctions and administrative measures.
SECTION 5 — Reporting of breaches
Reporting of breaches and protection of reporting persons
1. Directive (EU) 2019/1937 shall apply to the reporting of breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113 and of this Directive, and to the protection of persons reporting such breaches and of the persons concerned by those reports.
2. Supervisory authorities shall be the authorities competent to establish external reporting channels and to follow-up on reports insofar as requirements applicable to obliged entities are concerned, in accordance with Directive (EU) 2019/1937.
3. The public authorities overseeing self-regulatory bodies referred to in Article 52 shall be the authorities competent to establish external reporting channels and to follow up on reports by self-regulatory bodies and their staff insofar as requirements applicable to self-regulatory bodies in the exercise of supervisory functions are concerned.
4. Member States shall ensure that supervisory authorities in the non-financial sector report the following, on an annual basis, to AMLA:
(a)
the number of reports received pursuant to paragraph 1 and information on the share of reports that have been or are in the process of being followed-up, including whether they have been closed or are still open, and of the reports that have been dismissed;
(b)
the types of irregularities reported;
(c)
where reports have been followed-up, a description of the actions taken by the supervisor and, for reports that are still open, the actions which the supervisor intends to take;
(d)
where reports have been dismissed, the reasons for dismissing them.
Annual reports as referred to in the first subparagraph shall not contain any information on the identity or occupation of the reporting persons, or any other information that could lead to their identification.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
