The EACB supports AMLA's effort to establish minimum requirements for OEs to identify and assess ML/TF risks arising from their business model, customers, products, services and transactions, delivery channels and geographical exposure, while ensuring that the assessment remains proportionate to the specificities, risks and complexity of each OE. However, the draft Guidelines raise a number of concerns, which the EACB has set out in its response to the consultation. The following are some of the key issues identified in our analysis of the draft Guidelines:
- The risk-based and proportionate approach should be preserved across all types of OEs. Proportionality should also apply to large, complex and internationally active groups, allowing them to use more granular methodologies where necessary, while retaining sufficient flexibility to reflect the specific risks of different entities, sectors and jurisdictions.
- The Guidelines should provide greater flexibility on the application of a common group methodology. A common framework should allow individual entities to calibrate the scope, depth and level of detail of their BWRA according to their specific risk profile. Further clarity is also needed on the treatment of branches and on the consolidation of entity-level assessments into a meaningful group-wide view.
- Methodological flexibility should be maintained and overly prescriptive documentation requirements avoided. OEs should be able to use appropriate quantitative and qualitative approaches, including documented expert judgement, while avoiding requirements to document sources, methodologies or risk factors at a level of granularity that is not proportionate.
- The minimum BWRA requirements should clearly distinguish inherent risk, control effectiveness and residual risk. These components should not necessarily be subject to the same methodological and documentary requirements, particularly where they are already addressed through separate internal processes and governance arrangements. Further clarity is also needed on the assessment and aggregation of residual risk.
- The use of additional sources of information should remain risk-based and proportionate. The type and number of sources should depend on their relevance and materiality to the OE, rather than being understood as an exhaustive requirement. The Guidelines should also recognise the value of relevant internal risk data, including fraud, transaction monitoring, screening and CDD data.
- Finally, implementation should be supported by regulatory coherence and clear transition arrangements. Greater clarity is needed on the interaction between the BWRA Guidelines, other AMLA instruments still under development and the existing EBA Guidelines. A coordinated implementation timeline would help OEs plan the necessary methodological, operational and governance changes.