General provisions
1. Member States shall ensure that obliged entities can be held liable for breaches of Regulations (EU) 2024/1624 and (EU) 2023/1113 in accordance with this Section.
2. Without prejudice to the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on pecuniary sanctions and administrative measures and ensure that supervisors may impose such pecuniary sanctions and apply administrative measures with respect to breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 and shall ensure that they are enforced. Any sanction imposed or measure applied pursuant to this Section shall be effective, proportionate and dissuasive.
3. By way of derogation from paragraph 2, where the legal system of a Member State does not provide for administrative sanctions, this Article may be applied in such a manner that the pecuniary sanction is initiated by the supervisor and imposed by a judicial authority, while ensuring that those legal remedies are effective and have an equivalent effect to the pecuniary sanctions imposed by supervisors. In any event, the pecuniary sanctions imposed shall be effective, proportionate and dissuasive.
The Member States referred to in the first subparagraph shall communicate to the Commission the measures of national law which they adopt pursuant to this paragraph by 10 July 2027 and, without delay, any subsequent amendments thereto.
4. In the event of a breach of Regulations (EU) 2024/1624 and (EU) 2023/1113, Member States shall ensure that where obligations apply to legal persons, pecuniary sanctions can be imposed and administrative measures can be applied not only to the legal person, but also to the senior management and to other natural persons who under national law are responsible for the breach.
Member States shall ensure that where supervisors identify breaches which are subject to criminal sanctions, they inform the authorities competent for investigating and prosecuting criminal activities in a timely manner.
5. In accordance with this Directive and with national law, pecuniary sanctions shall be imposed and administrative measures shall be applied in any of the following ways:
(a)
directly by the supervisors;
(b)
in cooperation between the supervisors and other authorities;
(c)
under the responsibility of the supervisors by delegation to other authorities;
(d)
by application by the supervisors to the competent judicial authorities.
By 10 October 2027, Member States shall notify to the Commission and AMLA the information as regards the arrangements relating to the imposition of pecuniary sanctions or application of administrative measures pursuant to this paragraph, including, where relevant, information whether certain sanctions or measures require the recourse to a specific procedure.
6. Member States shall ensure that, when determining the type and level of pecuniary sanctions or administrative measures, supervisors take into account all relevant circumstances, including where applicable:
(a)
the gravity and the duration of the breach;
(b)
the number of instances the breach was repeated;
(c)
the degree of responsibility of the natural or legal person held responsible;
(d)
the financial strength of the natural or legal person held responsible, including in light of its total turnover or annual income;
(e)
the benefit derived from the breach by the natural or legal person held responsible, insofar as it can be determined;
(f)
the losses to third parties caused by the breach, insofar as they can be determined;
(g)
the level of cooperation of the natural or legal person held responsible with the competent authority;
(h)
previous breaches by the natural or legal person held responsible.
7. Member States shall ensure that legal persons can be held liable for the breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 committed on their behalf or for their benefit by any person, acting individually or as part of a body of that legal person and having a leading position within that legal person, based on any of the following:
(a)
a power to represent the legal person;
(b)
an authority to take decisions on behalf of the legal person;
(c)
an authority to exercise control within the legal person.
8. Member States shall ensure that legal persons can be held liable where the lack of supervision or control by a person as referred to in paragraph 7 of this Article has made possible the breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113 by a person under their authority on behalf of or for the benefit of the legal person.
9. In the exercise of their powers to impose pecuniary sanctions and apply administrative measures, supervisors shall cooperate closely and, where relevant, coordinate their actions with other authorities as appropriate, in order to ensure that those pecuniary sanctions or administrative measures produce the desired results and coordinate their action when dealing with cross-border cases.
10. By 10 July 2026, AMLA shall develop draft regulatory technical standards and submit them to the Commission for adoption. Those draft regulatory technical standards shall set out:
(a)
indicators to classify the level of gravity of breaches;
(b)
criteria to be taken into account when setting the level of pecuniary sanctions or applying administrative measures pursuant to this Section;
(c)
a methodology for the imposition of periodic penalty payments pursuant to Article 57, including their frequency.
Power is delegated to the Commission to supplement this Directive by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 49 to 52 of Regulation (EU) 2024/1620.
11. By 10 July 2026, AMLA shall issue guidelines on the base amounts for the imposing of pecuniary sanctions relative to turnover, broken down per type of breach and category of obliged entities.
Supervisory measures towards establishments of obliged entities and certain activities carried out under the freedom to provide services
1. In the case of establishments of obliged entities that do not as such qualify as credit institutions or financial institutions or of types of infrastructure of obliged entities over which the supervisor of the host Member State exercises supervision pursuant to Article 38(1), paragraphs 2 to 5 of this Article shall apply.
2. Where the supervisors of the host Member State identify breaches of applicable requirements, they shall request the obliged entities operating through the establishments or types of infrastructure as referred to in paragraph 1 to comply with the applicable requirements and inform the supervisors of the home Member State of the breaches identified within those obliged entities and of the request to comply.
3. Where the obliged entities fail to take the necessary action, the supervisors of the host Member State shall inform the supervisors of the home Member State accordingly.
The supervisors of the home Member State shall act promptly and take all appropriate measures to ensure that the obliged entity concerned remedies the breaches detected in its establishments or types of infrastructure in the host Member State. The supervisors of the home Member State shall inform the supervisors of the host Member State of any actions taken pursuant to this paragraph.
4. By way of derogation from paragraph 3, in situations of serious, repeated or systematic breaches by obliged entities operating through establishments or other types of infrastructure in their territory as referred to in paragraph 1 that require immediate remedies, supervisors of the host Member State shall be allowed at their own initiative to take appropriate and proportionate measures to address those breaches. Those measures shall be temporary and be terminated when the breaches identified are addressed, including with the assistance of or in cooperation with the supervisors of the home Member State of the obliged entity.
Member States shall ensure that the supervisors of the host Member State inform the supervisor of the home Member State of the obliged entity immediately upon identification of the serious, repeated or systematic breaches and upon taking any measure pursuant to the first subparagraph, unless measures are taken in cooperation with the supervisors of the home Member State.
5. Where the supervisors of the home and host Member States disagree on the measures to be taken in relation to an obliged entity, they may refer the matter to AMLA and request its assistance in accordance with Articles 33 and 38 of Regulation (EU) 2024/1620. AMLA shall provide its opinion on the matter of disagreement within 1 month.
Pecuniary sanctions
1. Member States shall ensure that pecuniary sanctions are imposed on obliged entities for serious, repeated or systematic breaches, whether committed intentionally or negligently, of the requirements laid down in the following provisions of Regulation (EU) 2024/1624:
(a)
Chapter II (Internal policies, procedures and controls of obliged entities);
(b)
Chapter III (Customer due diligence);
(c)
Chapter V (Reporting obligations);
(d)
Article 77 (Record retention).
Member States shall also ensure that pecuniary sanctions can be imposed where obliged entities have not complied with administrative measures applied to them pursuant to Article 56 of this Directive or for breaches that are not serious, repeated or systematic.
2. Member States shall ensure that in the cases referred to in paragraph 1, first subparagraph, the maximum pecuniary sanctions that can be imposed amount at least to twice the amount of the benefit derived from the breach where that benefit can be determined, or at least EUR 1 000 000, whichever is higher.
For Member States whose currency is not the euro, the value referred to in the first subparagraph shall be the corresponding value in the national currency on 9 July 2024.
3. Member States shall ensure that, by way of derogation from paragraph 2, where the obliged entity concerned is a credit institution or a financial institution, the following pecuniary sanctions can also be imposed:
(a)
in the case of a legal person, maximum pecuniary sanctions of at least EUR 10 000 000 or, in the Member States whose currency is not the euro, the corresponding value in the national currency on 9 July 2024, or 10 % of the total annual turnover according to the latest available accounts approved by the management body, whichever is higher; where the obliged entity is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial accounts in accordance with Article 22 of Directive 2013/34/EU of the European Parliament and of the Council ( 44 ) , the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with the relevant accounting regime according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking;
(b)
in the case of a natural person, maximum pecuniary sanctions of at least EUR 5 000 000 or, in the Member States whose currency is not the euro, the corresponding value in the national currency on 9 July 2024.
4. Member States may empower competent authorities to impose pecuniary sanctions exceeding the amounts referred to in paragraphs 2 and 3.
5. Member States shall ensure that, when determining the amount of the pecuniary sanction, the ability of the obliged entity to pay the sanction is taken into account and that, where the pecuniary sanction may affect compliance with prudential regulation, supervisors consult the authorities competent to supervise compliance by the obliged entities with relevant Union legal acts.
Administrative measures
1. Member States shall ensure that supervisors are able to apply administrative measures to an obliged entity where they identify:
(a)
breaches of Regulation (EU) 2024/1624 or Regulation (EU) 2023/1113, either in combination with pecuniary sanctions for serious, repeated and systematic breaches, or on their own;
(b)
weaknesses in the internal policies, procedures and controls of the obliged entity that are likely to result in breaches of the requirements referred to in point (a) and administrative measures can prevent the occurrence of those breaches or reduce the risk thereof;
(c)
that the obliged entity has internal policies, procedures and controls that are not commensurate with the risks of money laundering, its predicate offences or terrorist financing to which the entity is exposed.
2. Member States shall ensure that the supervisors are able at least to:
(a)
issue recommendations;
(b)
order obliged entities to comply, including to implement specific corrective measures;
(c)
issue a public statement which identifies the natural or legal person and the nature of the breach;
(d)
issue an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;
(e)
restrict or limit the business, operations or network of institutions comprising the obliged entity, or to require the divestment of activities;
(f)
where an obliged entity is subject to an authorisation, withdraw or suspend the authorisation;
(g)
require changes in the governance structure.
3. Member States shall ensure that the supervisors are able, by means of the administrative measures referred to in paragraph 2, in particular to:
(a)
require the provision of any data or information necessary for the fulfilment of their tasks pursuant to this Chapter without undue delay, to require the submission of any document, or impose additional or more frequent reporting requirements;
(b)
require the reinforcement of the internal policies, procedures and controls;
(c)
require the obliged entity to apply a specific policy or requirements relating to categories of or individual clients, transactions, activities or delivery channels that pose high risks;
(d)
require the implementation of measures to bring about the reduction of the money laundering or terrorist financing risks inherent in the activities and products of the obliged entity;
(e)
impose a temporary ban against any person discharging managerial responsibilities in an obliged entity, or any other natural person who has been held responsible for the breach from exercising managerial functions in obliged entities.
4. The administrative measures referred to in paragraph 2 shall be accompanied, where relevant, by binding deadlines for their implementation. Member States shall ensure that supervisors follow up and assess the implementation by the obliged entity of the actions requested.
5. Member States may empower supervisors to apply additional types of administrative measures to those referred to in paragraph 2.
Periodic penalty payments
1. Member States shall ensure that, where obliged entities fail to comply with administrative measures applied by the supervisor pursuant to Article 56(2), points (b), (d), (e) and (g), within the applicable deadlines, supervisors are able to impose periodic penalty payments in order to compel compliance with those administrative measures.
2. The periodic penalty payments shall be effective and proportionate. The periodic penalty payments shall be imposed until the obliged entity or person concerned complies with the relevant administrative measures.
3. Notwithstanding paragraph 2, in the case of legal persons, the amount of the periodic penalty payment shall not exceed 3 % of their average daily turnover in the preceding business year or, in the case of natural persons, that amount shall not exceed 2 % of their average daily income in the preceding calendar year.
4. Periodic penalty payments shall only be imposed for a period of no more than 6 months following the supervisor’s decision. Where, upon expiry of that period, the obliged entity has not yet complied with the administrative measure, Member States shall ensure that supervisors can impose periodic penalty payments for an additional period of no more than 6 months.
5. Member States shall ensure that a decision imposing a periodic penalty payment can be taken as of the date of the application of the administrative measure.
The periodic penalty payment shall apply as of the date when that decision is taken.
Publication of pecuniary sanctions, administrative measures and periodic penalty payments
1. Member States shall ensure that supervisors publish on their website, in an accessible format, decisions imposing pecuniary sanctions, applying administrative measures referred to in Article 56(2), points (c) to (g), pursuant to Article 56(1), point (a), or imposing periodic penalty payments.
2. Member States shall ensure that the decisions referred to in paragraph 1 are published by the supervisor immediately after the persons responsible for the breach are informed of those decisions.
By way of derogation from the first subparagraph, where the publication concerns administrative measures against which there is an appeal and that do not aim to remedy serious, repeated and systematic breaches, Member States may allow for the publication of those administrative measures to be deferred until expiry of the deadline for lodging an appeal.
Where the publication refers to decisions against which there is an appeal, supervisors shall also publish, immediately, on their website such information and any subsequent information on an appeal, and the outcome of such appeal. Any decision annulling a previous decision to impose a pecuniary sanction, apply an administrative measure, or impose a periodic penalty payment, shall also be published.
3. The publication shall include at least information on the type and nature of the breach and the identity of the persons responsible, as well as, for pecuniary sanctions and periodic penalty payments, their amounts. Member States shall not be obliged to apply this subparagraph to decisions applying administrative measures that are of an investigatory nature, or which are taken pursuant to Article 56(2), points (a) and (c).
Where the publication of the identity of the persons responsible as referred to in the first subparagraph or the personal data of such persons is considered by the supervisors to be disproportionate following a case-by-case assessment, or where publication jeopardises the stability of financial markets or an on-going investigation, supervisors shall:
(a)
delay the publication of the decision until the moment at which the reasons for not publishing it cease to exist;
(b)
publish the decision on an anonymous basis in a manner in accordance with national law, if such anonymous publication ensures the effective protection of the personal data concerned; in that case, the publication of the relevant data may be postponed for a reasonable period if it is foreseen that within that period the reasons for anonymous publication shall cease to exist;
(c)
not publish the decision at all in the event that the options set out in points (a) and (b) are considered insufficient to ensure one of the following:
(i)
that the stability of financial markets would not be put in jeopardy;
(ii)
the proportionality of the publication of the decision with regard to pecuniary sanctions and administrative measures for breaches which are deemed to be of a minor nature.
4. Member States shall ensure that any publication in accordance with this Article remains on the website of the supervisors for a period of 5 years after its publication. However, personal data contained in the publication shall only be kept on the website of the supervisors for the period which is necessary in accordance with the applicable data protection rules and in any case for no more than 5 years.
Exchange of information on pecuniary sanctions and administrative measures
1. Member States shall ensure that their supervisors and, where relevant, the public authority overseeing self-regulatory bodies in their performance of supervisory functions, inform AMLA of all pecuniary sanctions imposed and administrative measures applied in accordance with this Section, including of any appeal in relation thereto and the outcome thereof. Such information shall also be shared with other supervisors when the pecuniary sanction or administrative measure concerns an entity operating in two or more Member States.
2. AMLA shall maintain on its website links to each supervisor’s publication of pecuniary sanctions imposed and administrative measures applied in accordance with Article 58, and shall show the period for which each Member State publishes pecuniary sanctions and administrative measures.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
