Changes from plenary report to adopted text

Removed5. The Authority shall make every effort to provide the requested assistance if it deems the request appropriate, including by mobilising its own human resources as well as by ensuring mobilisation of resources at supervisory authorities on a voluntary basis.

Removed6. By the end of each year, the Chair of the Authority shall inform the General Board in supervisory composition of the resources that the Authority will allocate to providing such assistance.

Removed7. Any interaction between the staff of the Authority and the obliged entity shall remain under the exclusive responsibility of the supervisory authority responsible for the supervision of that entity, and shall not be construed as a transfer of tasks and powers related to individual obliged entities within the AML/CFT supervisory system.Article 11

RemovedCentral AML/CFT database

Removed1. The Authority shall establish and keep up to date a central database of information collected pursuant to this Article. The Authority shall analyse the information received and ensure that it is made available to supervisory authorities and non-AML/CFT authorities as well as other national authorities and bodies competent for ensuring compliance with Directive 2014/17/EU [consumer credit directive], Directive (EU) 2015/2366 [PSD], Directive 2009/110/EC [e-money Directive], Directive 2009/138/EC [Solvency II], Directive 2014/65/EU [Mifid II], and Regulation [MiCA] and to the European Supervisory Authorities, on a need-to-know and confidential basis. The Authority may share the results of its analysis and inspections on its own initiative with supervisory authorities, including non-AML/CFT authorities, for the purposes of facilitating their supervisory activities.

Removed2. The supervisors and supervisory authorities shall transmit to the Authority at least the following information, including the data related to individual obliged entities:

Removed(a) a list of all supervisory authorities and self-regulatory bodies entrusted with supervision of obliged entities, including information about their mandate, tasks and powers;

Removed(b) statistical information about the type and number of supervised obliged entities in each Member State and basic information about the risk profile;

Removed(ba) the information included in the common regulatory templates submitted by selected and non-selected obliged entities;

Removed(c) binding measures and sanctions taken in the course of supervision of individual obliged entities;

Removed(ca) consolidated information from selected and non-selected obliged entities that might be relevant for benchmarking purposes in the risk assessment process referred to in Articles 12 and 13, or for other supervisory purposes;

Removed(d) any advice provided to other▌ authorities in relation to authorisation procedures, withdrawal of authorisation procedures, and fit and proper assessments of shareholders or members of the management body of individual obliged entities;

Removed(e) reports on outcomes of supervisory activities;

Removed(f) results from supervisory inspections of files concerning politically exposed persons, their family members and their associates;

Removed(g) statistical information regarding performed supervisory activities over the past calendar year, including the number of off-site and on-site inspections;

Removed(h) statistical information about staffing and other resources of public authorities;

Removed(ha) information from competent authorities relating to weaknesses identified during supervision and authorisation procedures in the processes and procedures, governance arrangements, fitness and propriety, acquisition of qualifying holdings, business models and activities of financial sector operators in relation to preventing and countering money laundering and terrorist financing;

Removed(hb) measures taken by competent authorities in response to the following weaknesses affecting one or more requirements of the legislative acts referred to in Article 1(2) of this Regulation, Article 1(2) of Regulation (EU) No 1094/2010 and Article 1(2) of Regulation (EU) No 1095/2010 and of any national laws transposing them with regard to preventing or countering the use of the financial system for the purpose of money laundering or terrorist financing:

Removed(a) a breach or a potential breach by a financial sector operator of such requirements,

Removed(b) the inappropriate or ineffective application by a financial sector operator of such requirements, or

Removed(c) the inappropriate or ineffective application by a financial sector operator of its internal policies and procedures to comply with such requirements;

Removed(hc) weaknesses and failures of obliged entities to comply with [AMLR] and with any measures taken by supervisory authorities in response to weaknesses affecting one or more requirements of [AMLR].

Removed2a. The Authority shall publish the information collected pursuant to paragraph 2, points (a), (b), (g) and (h). A summary of non-confidential findings regarding the information collected pursuant to paragraph 2, points (c), (d), (e), (f), (ha), (hb) and (hc), shall be made available to obliged entities.

Removed3. The Authority may request supervisory authorities and non-AML/CFT authorities to provide other information in addition to that referred to in paragraph 2. In response to the Authority´s request, the supervisory authorities or the non-AML/CFT authorities shall update any ▌ information previously provided by them.

RemovedNon-AML/CFT authorities, as well as other national authorities and bodies competent for ensuring compliance with the requirements of Directive 2014/17/EU [consumer credit directive], Directive (EU) 2015/2366 [PSD], Directive 2009/110/EC [e-money Directive], Directive 2009/138/EC [Solvency II], Directive 2014/65/EU [Mifid II], and Regulation [MiCA] and the European Supervisory Authorities, shall transmit to the Authority information relating to weaknesses identified during ongoing supervision and authorisation procedures in the processes and procedures, governance arrangements, fitness and propriety, acquisition of qualifying holdings, business models and activities of credit and financial institutions as defined in Article 2 of [AMLR] in relation to preventing and countering money laundering and terrorist financing as well as measures taken by those authorities, in response to material weaknesses affecting one or more requirements of the legislative acts referred to in Article 1(2) of Regulation EU (No) 1093/2010, Article 1(2) of Regulation (EU) No 1094/2010 and Article 1(2) of Regulation (EU) No 1095/2010 and of any national laws transposing them, respectively, with regard to the institution’s ability to tackle ML/TF risks effectively, and as such, the integrity and transparency of the financial system of the Union.

RemovedNon-AML/CFT authorities may share with the Authority any additional information, within the boundaries of their mandates and tasks, deemed relevant to the prevention and countering of money laundering or terrorist financing.

Removed3a. For the purposes of paragraph 1 of this Article, the Authority shall take over the central AML/CFT database established in accordance with Article 9a of Regulation EU (No) 1093/2010 (EuReCA) and shall become the owner of its content and the technical system operating EuReCA.

RemovedWith a view to ensuring a smooth transition until such time as the Authority is operationally in a position to fully take over and keep the EuReCA database up to date, the European Banking Authority shall continue receiving information, analysing it and making it available in accordance with Article 9a of Regulation EU (No) 1093/2010 until [insert date dd.mm.yyyy corresponding to 18 months after date of entry into force].

Removed4. Any supervisory authority, any non-AML authority, as well as other national authorities and bodies competent for ensuring compliance with the requirements of Directive 2014/17/EU [consumer credit directive], Directive (EU) 2015/2366 [PSD], Directive 2009/110/EC [e-money Directive], Directive 2009/138/EC [Solvency II], Directive 2014/65/EU [Mifid II], and Regulation [MiCA], or the European Supervisory Authorities may address to the Authority a reasoned request for information collected pursuant to this Article that is relevant for its supervisory activities. The Authority shall assess those requests and provide the information requested ▌on a need-to-know basis and confidential basis and in a timely manner. The Authority shall inform the authority that has initially provided the requested information, of the identity of the requesting supervisory or other authority, the identity of an obliged entity concerned, the reason for the information request as well as whether the information has been provided to the requesting authority. Where the Authority decides not to provide the requested information, it shall provide a reasoned justification for that decision.

Removed4a. The Authority shall make available to all supervisors consolidated information of obliged entities that might be relevant for supervisory purposes or that might inform benchmarks and the methodolody for classification in the risk assessment process.

Removed4b. The Authority shall develop draft regulatory technical standards further specifying the weaknesses referred to in paragraph 2, points (ha), (hb) and (hc), including the corresponding situations where weaknesses may occur, the materiality of weaknesses and the practical implementation of the information collection by the Authority as well as the type of information that should be provided pursuant to those provisions. The Authority shall also specify the format, the transmission procedure and information included in the common regulatory templates referred to in paragraph 2, point (ba).

RemovedTo that end, the Authority shall consider the volume of the information to be provided and the need to avoid duplication. It shall also set out arrangements to ensure effectiveness, confidentiality and the protection of personal data, specifying the data types and purposes for which personal data is processed and collected.

RemovedThe Authority shall submit the draft regulatory technical standards to the Commission by [18 months after the date of entry into force of this Regulation].

RemovedThe Commission is empowered to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Article 38 of this Regulation.

Removed4c. Personal data collected in accordance with this Article may be kept in an identifiable form for a period of up to 10 years after the date of collection of the data by the Authority, at the end of which the personal data shall be deleted. Based on a regular assessment of their necessity, personal data may be deleted before the expiry of that period on a case-by-case basis.

RemovedInformation requests directly to obliged entities

Removed1. The supervisory authorities and the Authority shall provide each other with all necessary information regarding selected and non-selected obliged entities in order to carry out their respective duties, powers and legal mandate, provided that the supervisory authorities and the Authority have legal access to the relevant information.

Removed2. Where information is not available or is not made available under paragraph 1 in a timely manner, the Authority may address a request directly to the relevant obliged entities or associations of obliged entities. The request shall be duly justified, include the legal basis of the request, specify the information required and fix a reasonable time limit within which the information is to be provided. The supervisory authority shall receive a copy of the request.

RemovedThe addressees of such a request shall provide the Authority, within the time limit specified in the request, with clear, accurate and complete information, provided that they have legal access to the relevant information. Upon a duly justified request to the Authority, the addressees may ask for a single extension of the deadline.

RemovedThe request shall be sent in accordance with the language arrangements established, mutatis mutandis, in Article 27.

Removed3. The Authority shall use confidential information received pursuant to this Article only for the purposes of carrying out the duties assigned to it under this Regulation and other applicable Union law.

Removed4. The Authority shall develop draft regulatory technical standards setting out the modalities with regard to information requests addressed to obliged entities as provided in paragraph 1.

RemovedThe Authority shall submit the draft regulatory technical standards to the Commission by [1 January 2025]. The Commission is empowered to adopt the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Article 38.

RemovedInformation sharing with FIUs and Europol

RemovedWhere the Authority, in the course of its supervisory activities in relation to obliged entities under Sections 3, 4 and 5 of this Chapter, suspects that facts that it has examined in the framework of those supervisory activities could be related to money laundering, to a predicate offence or to terrorist financing, it shall promptly transmit such information to the competent FIUs.

RemovedWhere the facts referred to in the first paragraph have a cross-border relevance, the Authority shall promptly transmit the information to Europol.

RemovedWithout prejudice to [GDPR, LED and Regulation (EU) 2018/1725], to the extent that information referred to in the first and second paragraphs contains personal data within the meaning of any of those legislative acts, the Authority shall only transmit those personal data to the relevant FIUs and Europol where such transmission is strictly necessary for the relevant FIUs to perform their respective mandates in accordance with applicable Union and national law, or for Europol to perform its mandate in accordance with [the Europol regulation].

RemovedFor the purposes of the second paragraph, the Authority may rely on cooperation agreements concluded with Europol in accordance with Article 80 of this Regulation.

RemovedDirect supervision of selected obliged entities

RemovedAssessment of financial sector obliged entities for the purposes of selection for direct supervision

Removed1. For the purposes of carrying out the tasks listed in Article 5(2), the Authority, with the collaboration of financial supervisors in accordance with paragraph 1b of this Article, shall carry out a periodic assessment of the obliged entities listed in paragraph 3 of this Article based on criteria and following the process specified in paragraphs 2 to 6 of this Article and in Article 13 where they operate establishments as defined in Article 2(8) of [proposal for 6th Anti-Money Laundering Directive - COM/2021/423 final], or under the freedom to provide services, in at least four Member States, including the Member State of establishment.

Removed▌

Removed▌

Removed(1a) In cases where all of the obliged entities established in a particular Member State operate in fewer than four Member States, whether through establishments or through the freedom to provide services, the periodic assessment referred to in paragraph 1 shall be carried out on the obliged entities listed in paragraph 3 which are established in that Member State.

Removed(1b) The Authority shall receive all necessary information from supervisory authorities, and, in exceptional cases, from the obliged entities, in order to carry out the periodic assessment of individual obliged entities. That information shall be included in the common reporting templates referred to in Article 5(3), point (e).

Removed(1c) The Authority shall keep the relevant non-AML/CFT authorities informed of the assessments provided for in paragraphs 1, (1a) and (1b) in cases where the obliged entities fall within their supervisory remits.

Removed2. After having assessed the residual risk profile of the assessed obliged entities referred to in paragraph 1, the Authority ▌shall classify them as low, medium, substantial or high in each jurisdiction they operate in, based on the benchmarks and following the methodology set out in the regulatory technical standard referred to in paragraph 5.

Removed3. The methodology for classifying the residual risk profile shall be established separately for at least the following categories of obliged entities, taking into account the specificities of each sector:

Removed(a) credit institutions;

Removed(b) bureaux de change;