The draft RTS on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries aim to specify the requirements for group-wide policies, procedures and controls, including information-sharing arrangements, as well as the additional measures applicable where third-country law restricts the implementation of group-wide AML/CFT requirements and the conditions for applying similar requirements to certain structures outside traditional group relationships.
In its response to AMLA’s consultation, the EACB welcomed the opportunity to provide the banking sector’s perspective on the proposed framework, while highlighting a number of areas where further clarification and flexibility would be needed to ensure effective and proportionate implementation.
In our view, the main points to be considered include the following:
- The scope of group-wide requirements should remain clearly anchored in the AMLR and proportionate to the nature of the relationship between entities. Greater clarity is needed on the interaction between the concepts of “group”, “structure”, “network” and “partnership”, particularly where entities are not linked through a traditional parent–subsidiary relationship. Group-like requirements should not extend to arrangements where the relevant entities are not subject to AML/CFT obligations or where the risks and degree of control do not justify their application.
- Group-wide frameworks should be capable of accommodating existing global and organisational structures. For groups headquartered outside the EU, global AML/CFT policies and controls that meet or exceed EU requirements should be capable of being relied upon, with adaptations focused on identified EU-specific requirements. Similarly, governance arrangements should allow for appropriate flexibility in complex groups, including where direct reporting lines between group and local compliance functions are not practicable.
- Information sharing should remain risk-based, targeted and subject to applicable legal constraints. The RTS should not be interpreted as requiring obliged entities to collect, generate or centrally maintain information solely for the purpose of intra-group sharing. Clear safeguards are needed to ensure consistency with GDPR, confidentiality, FIU-related secrecy obligations, data protection requirements and third-country restrictions, while avoiding reliance on customer or UBO consent where this is not legally or operationally realistic.
- The framework should provide workable solutions where third-country law restricts information sharing or the implementation of group-wide controls. Where entities have taken all measures legally and operationally available to them, including the required notifications and mitigating measures, they should not be exposed to further obligations where compliance remains impossible due to binding local legal restrictions. A coordinated EU-level approach to identifying recurring third-country legal restrictions would also help avoid unnecessary duplication across institutions.
- The application of equivalent requirements to structures outside traditional groups should be subject to clear limits and effective proportionality safeguards. In particular, the concept of “common compliance control” should be more precisely defined, while obligations should remain limited to areas within the relevant entity’s legal and operational control and to AML/CFT-related risks. Greater clarity is also needed on the treatment of non-obliged entities and on the extent to which group-like requirements may be simplified depending on the size, complexity and risk profile of the structure.
- The RTS should support legal certainty and consistency across the regulatory framework. Definitions and requirements should be aligned, where relevant, with existing AMLR, prudential and other EU regulatory frameworks, while clear guidance and practical examples would help ensure consistent supervisory expectations, particularly for cross-border groups and structures subject to different legal and organisational arrangements.