EBA Guidelines for AML/CFT Compliance Officers Set Tone for Risk Culture and Governance

The guidelines highlight the crucial role that the management body plays in setting the AML/CTF strategy, ensuring adequate resources, and fostering a culture of compliance throughout the organisation, by outlining the following provisions:

• In its supervisory function, the management body should be responsible for overseeing and monitoring the implementation of the internal governance and internal control framework to ensure compliance with the AML/CFT strategy and applicable requirements in the context of ML/FT.⁶

   

• In its management function, it should be responsible for implementing the AML/CFT policies and procedures, and the appropriate and effective organisational and operational structure necessary to comply with the AML/CFT strategy.⁷ Furthermore, it should take appropriate steps to ensure remedial measures where necessary.

   

• It should have access to sufficient, accurate, timely, comprehensive, and up-to-date AML/CFT data that enable informed decision-making to discharge its AML/CFT functions effectively, such as:

   

– the report of the AML/

- the report of the internal audit function;

– the findings and observations of external auditors, where applicable;

– the findings of the competent authority, relevant communications with the FIU and supervisory measures and sanctions imposed.

– moreover, it should be informed of the results of the business-wide ML/FT risk assessments and review the activity report of the AML/CFT Compliance Officer at least once a year.⁸

• On an annual basis, at a minimum, it should assess the effective functioning of the AML/CFT compliance function, considering the conclusions of any AML/CFT audit that may have been carried out, and the appropriateness of the human and technical resources allocated to the AML/CFT compliance function.⁹

   

• It should designate a member of the management body¹⁰ in charge of the AML/CFT compliance function, and ensure that this person has:

   

– the necessary knowledge, skills, and experience with regard to ML/FT risks to which the organisation is exposed, and the implementation of AML/CFT policies, controls, and procedures;

– a good understanding of the credit or financial institution’s business model and the sector in which it operates;

– and a good understanding of the extent to which this business model exposes the credit or financial institution to ML/FT risks.¹¹

• It should designate an AML/CFT Compliance Officer considering the scale and complexity of the credit or financial institutions operations, and its exposure to the risks indicated above.¹²

To promote and ensure that compliance is integrated into the strategy and operations of the organisation, the EBA guidelines also establish clear and defined roles and responsibilities for the CO, as follows:

• The CO should have sufficient authority to propose all necessary or appropriate measures to ensure the compliance and effectiveness of the internal AML/CFT measures to the management body in its supervisory and management function.¹³ Furthermore, the credit or financial institution should have the necessary systems and controls in place to ensure that the AML/CFT CO has access to all the necessary information and systems required to perform the compliance officer tasks.¹⁴

• As part of the second line, the CO should be independent from the business lines and perform its function autonomously, having unrestricted and direct access to all information that is necessary to the performance the CO function.

   

  In the case of a significant incident, the CO should be able to report and have direct access to the management body in its supervisory function or to the senior management where no management body is in place.¹⁵

• The CO should have the necessary AML/CFT knowledge, skills, expertise and seniority, as well as a good understanding of the ML/FT risks associated with the credit or financial institution’s business model to perform the CO function effectively. They should also have relevant experience regarding the identification, assessment and management of these risks, and the implementation of AML/CFT policies, controls and procedures.¹⁶

• The CO should be responsible for, among others, the following main tasks which should be clearly defined and documented:¹⁷

   

- to develop and maintain a risk assessment framework, as well as to report the results and propose mitigated measures of the identified risks to the management body;¹⁸

– to set up, keep up to date, and ensure the proper implementation and review of AML/CFT policies, procedures, systems and controls;¹⁹

– to provide advice before a final decision is taken by senior management on onboarding new high-risk customers or maintaining a business relationship with them, in line with the risk-based internal AML/CFT policies of the credit or financial institutions, and in particular in situations where the senior management’s approval is required;²⁰

– to monitor whether measures, policies, controls and procedures implemented by the aforementioned institutions comply with their AML/CFT regulatory framework. The CO should also oversee the effective application of these controls applied by the first line of defense;²¹

- to advise and bring to the attention of the management body on measures to be taken to ensure compliance with applicable laws, rules, regulations, and standards, and provide assessment of the possible impact of any changes in the legal or regulatory environment on the institution’s activities and compliance framework. Furthermore, the AML/CFT CO should provide an activity report on, at least, an annual basis.;²²

– to ensure that knowledge or suspicion of ML/FT or of a person’s connection with ML/FT are promptly reported to the Financial Intelligence Unit (‘FIU’), and prompt and exhaustive response to any request for information made by the FIU;²³

– to inform staff about the ML/FT risks to which the credit or financial institutions are exposed, including methods, trends and typologies, as well as of the risk-based approach implemented by the institutions to mitigate these risks. The CO should also oversee the preparation and implementation of the ongoing AML/CFT training programme. The trainings should be adjusted on a risk-sensitive basis.²⁴

The credit or financial institution should designate a member of its management body, or senior manager responsible for AML/CFT among the senior managers at the level of the parent undertaking, as well as a group AML/CFT compliance officer.²⁵

This institution should set up an organisational and operational coordination structure at group level with sufficient decision-making power for the group AML/CFT management to make this position effective at managing and preventing ML/TF risks, in line with the proportionality principle and applicable legislation.²⁶

The group AML/CFT compliance officer should cooperate with and coordinate the activities of the various local AML/CFT compliance officers in the group’s operational entities in order to ensure that they work consistently.²⁷