Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (Text with EEA relevance)

CHAPTER I GENERAL PROVISIONS

SECTION 1 Subject-matter, scope and definitions

Article 1

• (a) the conversion or transfer of property, knowing that such property is derived from criminal activity or from an act of participation in such activity, for the purpose of concealing or disguising the illicit origin of the property or of assisting any person who is involved in the commission of such an activity to evade the legal consequences of that person's action;

• (b) the concealment or disguise of the true nature, source, location, disposition, movement, rights with respect to, or ownership of, property, knowing that such property is derived from criminal activity or from an act of participation in such an activity;

• (c) the acquisition, possession or use of property, knowing, at the time of receipt, that such property was derived from criminal activity or from an act of participation in such an activity;

• (d) participation in, association to commit, attempts to commit and aiding, abetting, facilitating and counselling the commission of any of the actions referred to in points (a), (b) and (c).

Article 2

• (1) credit institutions;

• (2) financial institutions;

• (3) the following natural or legal persons acting in the exercise of their professional activities:
• (a) auditors, external accountants and tax advisors, and any other person that undertakes to provide, directly or by means of other persons to which that other person is related, material aid, assistance or advice on tax matters as principal business or professional activity;
• (b) notaries and other independent legal professionals, where they participate, whether by acting on behalf of and for their client in any financial or real estate transaction, or by assisting in the planning or carrying out of transactions for their client concerning the:
• (i) buying and selling of real property or business entities;
• (ii) managing of client money, securities or other assets;
• (iii) opening or management of bank, savings or securities accounts;
• (iv) organisation of contributions necessary for the creation, operation or management of companies;
• (v) creation, operation or management of trusts, companies, foundations, or similar structures;
• (c) trust or company service providers not already covered under point (a) or (b);
• (d) estate agents including when acting as intermediaries in the letting of immovable property, but only in relation to transactions for which the monthly rent amounts to EUR 10 000 or more;
• (e) other persons trading in goods to the extent that payments are made or received in cash in an amount of EUR 10 000 or more, whether the transaction is carried out in a single operation or in several operations which appear to be linked;
• (f) providers of gambling services; —————
• (i) persons trading or acting as intermediaries in the trade of works of art, including when this is carried out by art galleries and auction houses, where the value of the transaction or a series of linked transactions amounts to EUR 10 000 or more;
• (j) persons storing, trading or acting as intermediaries in the trade of works of art when this is carried out by free ports, where the value of the transaction or a series of linked transactions amounts to EUR 10 000 or more.

Among the factors considered in their risk assessments, Member States shall assess the degree of vulnerability of the applicable transactions, including with respect to the payment methods used.

In their risk assessments, Member States shall indicate how they have taken into account any relevant findings in the reports issued by the Commission pursuant to Article 6.

Any decision taken by a Member State pursuant to the first subparagraph shall be notified to the Commission, together with a justification based on the specific risk assessment. The Commission shall communicate that decision to the other Member States.

• (a) the financial activity is limited in absolute terms;

• (b) the financial activity is limited on a transaction basis;

• (c) the financial activity is not the main activity of such persons;

• (d) the financial activity is ancillary and directly related to the main activity of such persons;

• (e) the main activity of such persons is not an activity referred to in points (a) to (d) or point (f) of paragraph 1(3);

• (f) the financial activity is provided only to the customers of the main activity of such persons and is not generally offered to the public.

The first subparagraph shall not apply to persons engaged in the activity of money remittance as defined in point (13) of Article 4 of Directive 2007/64/EC of the European Parliament and of the Council ([^E0002]).

Article 3

For the purposes of this Directive, the following definitions apply:

• (1) ‘credit institution’ means a credit institution as defined in point (1) of Article 4(1) of Regulation (EU) No 575/2013 of the European Parliament and of the Council ([^E0003]), including branches thereof, as defined in point (17) of Article 4(1) of that Regulation, located in the Union, whether its head office is situated within the Union or in a third country;

• (2) ‘financial institution’ means:
• (a) an undertaking other than a credit institution, which carries out one or more of the activities listed in points (2) to (12), (14) and (15) of Annex I to Directive 2013/36/EU of the European Parliament and of the Council ([^E0004]), including the activities of currency exchange offices (bureaux de change);
• (b) an insurance undertaking as defined in point (1) of Article 13 of Directive 2009/138/EC of the European Parliament and of the Council ([^E0005]), insofar as it carries out life assurance activities covered by that Directive;
• (c) an investment firm as defined in point (1) of Article 4(1) of Directive 2004/39/EC of the European Parliament and of the Council ([^E0006]);
• (d) a collective investment undertaking marketing its units or shares;
• (e) an insurance intermediary as defined in point (5) of Article 2 of Directive 2002/92/EC of the European Parliament and of the Council ([^E0007]) where it acts with respect to life insurance and other investment-related services, with the exception of a tied insurance intermediary as defined in point (7) of that Article;
• (f) branches, when located in the Union, of financial institutions as referred to in points (a) to (e), whether their head office is situated in a Member State or in a third country;
• (g) crypto-asset service providers;

• (3) ‘property’ means assets of any kind, whether corporeal or incorporeal, movable or immovable, tangible or intangible, and legal documents or instruments in any form including electronic or digital, evidencing title to or an interest in such assets;

• (4) ‘criminal activity’ means any kind of criminal involvement in the commission of the following serious crimes:
• (a) terrorist offences, offences related to a terrorist group and offences related to terrorist activities as set out in Titles II and III of Directive (EU) 2017/541 ([^E0008]);
• (b) any of the offences referred in Article 3(1)(a) of the 1988 United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances;
• (c) the activities of criminal organisations as defined in Article 1(1) of Council Framework Decision 2008/841/JHA ([^E0009]);
• (d) fraud affecting the Union's financial interests, where it is at least serious, as defined in Article 1(1) and Article 2(1) of the Convention on the protection of the European Communities' financial interests ([^E0010]);
• (e) corruption;
• (f) all offences, including tax crimes relating to direct taxes and indirect taxes and as defined in the national law of the Member States, which are punishable by deprivation of liberty or a detention order for a maximum of more than one year or, as regards Member States that have a minimum threshold for offences in their legal system, all offences punishable by deprivation of liberty or a detention order for a minimum of more than six months;

• (5) ‘self-regulatory body’ means a body that represents members of a profession and has a role in regulating them, in performing certain supervisory or monitoring type functions and in ensuring the enforcement of the rules relating to them;

• (6) ‘beneficial owner’ means any natural person(s) who ultimately owns or controls the customer and/or the natural person(s) on whose behalf a transaction or activity is being conducted and includes at least:
• (a) in the case of corporate entities:
• (i) the natural person(s) who ultimately owns or controls a legal entity through direct or indirect ownership of a sufficient percentage of the shares or voting rights or ownership interest in that entity, including through bearer shareholdings, or through control via other means, other than a company listed on a regulated market that is subject to disclosure requirements consistent with Union law or subject to equivalent international standards which ensure adequate transparency of ownership information. A shareholding of 25 % plus one share or an ownership interest of more than 25 % in the customer held by a natural person shall be an indication of direct ownership. A shareholding of 25 % plus one share or an ownership interest of more than 25 % in the customer held by a corporate entity, which is under the control of a natural person(s), or by multiple corporate entities, which are under the control of the same natural person(s), shall be an indication of indirect ownership. This applies without prejudice to the right of Member States to decide that a lower percentage may be an indication of ownership or control. Control through other means may be determined, inter alia, in accordance with the criteria in Article 22(1) to (5) of Directive 2013/34/EU of the European Parliament and of the Council ([^E0011]);
• (ii) if, after having exhausted all possible means and provided there are no grounds for suspicion, no person under point (i) is identified, or if there is any doubt that the person(s) identified are the beneficial owner(s), the natural person(s) who hold the position of senior managing official(s), the obliged entities shall keep records of the actions taken in order to identify the beneficial ownership under point (i) and this point;
• (b) in the case of trusts, all following persons:
• (i) the settlor(s);
• (ii) the trustee(s);
• (iii) the protector(s), if any;
• (iv) the beneficiaries or where the individuals benefiting from the legal arrangement or entity have yet to be determined, the class of persons in whose main interest the legal arrangement or entity is set up or operates;
• (v) any other natural person exercising ultimate control over the trust by means of direct or indirect ownership or by other means;
• (c) in the case of legal entities such as foundations, and legal arrangements similar to trusts, the natural person(s) holding equivalent or similar positions to those referred to in point (b);

• (7) ‘trust or company service provider’ means any person that, by way of its business, provides any of the following services to third parties:
• (a) the formation of companies or other legal persons;
• (b) acting as, or arranging for another person to act as, a director or secretary of a company, a partner of a partnership, or a similar position in relation to other legal persons;
• (c) providing a registered office, business address, correspondence or administrative address and other related services for a company, a partnership or any other legal person or arrangement;
• (d) acting as, or arranging for another person to act as, a trustee of an express trust or a similar legal arrangement;
• (e) acting as, or arranging for another person to act as, a nominee shareholder for another person other than a company listed on a regulated market that is subject to disclosure requirements in accordance with Union law or subject to equivalent international standards;

• (8) ‘correspondent relationship’ means:
• (a) the provision of banking services by one bank as the correspondent to another bank as the respondent, including providing a current or other liability account and related services, such as cash management, international funds transfers, cheque clearing, payable-through accounts and foreign exchange services;
• (b) the relationships between and among credit institutions and financial institutions, including where similar services are provided by a correspondent institution to a respondent institution, and including relationships established for securities transactions or funds transfers or relationships established for transactions in crypto-assets or transfers of crypto-assets;

• (9) ‘politically exposed person’ means a natural person who is or who has been entrusted with prominent public functions and includes the following:
• (a) heads of State, heads of government, ministers and deputy or assistant ministers;
• (b) members of parliament or of similar legislative bodies;
• (c) members of the governing bodies of political parties;
• (d) members of supreme courts, of constitutional courts or of other high-level judicial bodies, the decisions of which are not subject to further appeal, except in exceptional circumstances;
• (e) members of courts of auditors or of the boards of central banks;
• (f) ambassadors, chargés d'affaires and high-ranking officers in the armed forces;
• (g) members of the administrative, management or supervisory bodies of State-owned enterprises;
• (h) directors, deputy directors and members of the board or equivalent function of an international organisation. No public function referred to in points (a) to (h) shall be understood as covering middle-ranking or more junior officials;

• (10) ‘family members’ includes the following:
• (a) the spouse, or a person considered to be equivalent to a spouse, of a politically exposed person;
• (b) the children and their spouses, or persons considered to be equivalent to a spouse, of a politically exposed person;
• (c) the parents of a politically exposed person;

• (11) ‘persons known to be close associates’ means:
• (a) natural persons who are known to have joint beneficial ownership of legal entities or legal arrangements, or any other close business relations, with a politically exposed person;
• (b) natural persons who have sole beneficial ownership of a legal entity or legal arrangement which is known to have been set up for the de facto benefit of a politically exposed person.

• (12) ‘senior management’ means an officer or employee with sufficient knowledge of the institution's money laundering and terrorist financing risk exposure and sufficient seniority to take decisions affecting its risk exposure, and need not, in all cases, be a member of the board of directors;

• (13) ‘business relationship’ means a business, professional or commercial relationship which is connected with the professional activities of an obliged entity and which is expected, at the time when the contact is established, to have an element of duration;

• (14) ‘gambling services’ means a service which involves wagering a stake with monetary value in games of chance, including those with an element of skill such as lotteries, casino games, poker games and betting transactions that are provided at a physical location, or by any means at a distance, by electronic means or any other technology for facilitating communication, and at the individual request of a recipient of services;

• (15) ‘group’ means a group of undertakings which consists of a parent undertaking, its subsidiaries, and the entities in which the parent undertaking or its subsidiaries hold a participation, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU;

• (16) ‘electronic money’ means electronic money as defined in point (2) of Article 2 of Directive 2009/110/EC, but excluding monetary value as referred to in Article 1(4) and (5) of that Directive;

• (17) ‘shell bank’ means a credit institution or financial institution, or an institution that carries out activities equivalent to those carried out by credit institutions and financial institutions, incorporated in a jurisdiction in which it has no physical presence, involving meaningful mind and management, and which is unaffiliated with a regulated financial group;

• (18) ‘crypto-asset’ means a crypto-asset as defined in Article 3(1), point (5), of Regulation (EU) 2023/1114 of the European Parliament and of the Council ([^E0012]), except where falling within the categories listed in Article 2(2), (3) and (4) of that Regulation or otherwise qualifying as funds;

• (19) ‘crypto-asset service provider’ means a crypto-asset service provider as defined in Article 3(1), point (15), of Regulation (EU) 2023/1114, where performing one or more crypto-asset services as defined in Article 3(1), point (16), of that Regulation, with the exception of providing advice on crypto-assets as referred to in Article 3(1), point (16)(h), of that Regulation;

• (20) ‘self-hosted address’ means a self-hosted address as defined in Article 3, point (20), of Regulation (EU) 2023/1113 of the European Parliament and of the Council ([^E0013]).

Article 4

Article 5

Member States may adopt or retain in force stricter provisions in the field covered by this Directive to prevent money laundering and terrorist financing, within the limits of Union law.

SECTION 2 Risk assessment

Article 6

To that end, the Commission shall, by 26 June 2017, draw up a report identifying, analysing and evaluating those risks at Union level. Thereafter, the Commission shall update its report every two years, or more frequently if appropriate.

• (a) the areas of the internal market that are at greatest risk;

• (b) the risks associated with each relevant sector including, where available, estimates of the monetary volumes of money laundering provided by Eurostat for each of those sectors;

• (c) the most widespread means used by criminals to launder illicit proceeds, including, where available, those particularly used in transactions between Member States and third countries, independently of the identification of a third country as high-risk pursuant to Article 9(2).

Article 7

• (a) use it to improve its AML/CFT regime, in particular by identifying any areas where obliged entities are to apply enhanced measures and, where appropriate, specifying the measures to be taken;

• (b) identify, where appropriate, sectors or areas of lower or greater risk of money laundering and terrorist financing;

• (c) use it to assist it in the allocation and prioritisation of resources to combat money laundering and terrorist financing;

• (d) use it to ensure that appropriate rules are drawn up for each sector or area, in accordance with the risks of money laundering and terrorist financing;

• (e) make appropriate information available promptly to obliged entities to facilitate the carrying out of their own money laundering and terrorist financing risk assessments;

• (f) report the institutional structure and broad procedures of their AML/CFT regime, including, inter alia, the FIU, tax authorities and prosecutors, as well as the allocated human and financial resources to the extent that this information is available;

• (g) report on national efforts and resources (labour forces and budget) allocated to combat money laundering and terrorist financing.

Article 8

• (a) the development of internal policies, controls and procedures, including model risk management practices, customer due diligence, reporting, record-keeping, internal control, compliance management including, where appropriate with regard to the size and nature of the business, the appointment of a compliance officer at management level, and employee screening;

• (b) where appropriate with regard to the size and nature of the business, an independent audit function to test the internal policies, controls and procedures referred to in point (a).

SECTION 3 Third-country policy

Article 9

• (a) the legal and institutional AML/CFT framework of the third country, in particular:
• (i) the criminalisation of money laundering and terrorist financing;
• (ii) measures relating to customer due diligence;
• (iii) requirements relating to record-keeping;
• (iv) requirements to report suspicious transactions;
• (v) the availability of accurate and timely information of the beneficial ownership of legal persons and arrangements to competent authorities;

• (b) the powers and procedures of the third country’s competent authorities for the purposes of combating money laundering and terrorist financing including appropriately effective, proportionate and dissuasive sanctions, as well as the third country’s practice in cooperation and exchange of information with Member States’ competent authorities;

• (c) the effectiveness of the third country’s AML/CFT system in addressing money laundering or terrorist financing risks.

CHAPTER II CUSTOMER DUE DILIGENCE

SECTION 1 General provisions

Article 10

Article 11

Member States shall ensure that obliged entities apply customer due diligence measures in the following circumstances:

• (a) when establishing a business relationship;

• (b) when carrying out an occasional transaction that:
• (i) amounts to EUR 15 000 or more, whether that transaction is carried out in a single operation or in several operations which appear to be linked; or
• (ii) constitutes a transfer of funds, as defined in point (9) of Article 3 of Regulation (EU) 2015/847 of the European Parliament and of the Council ([^E0015]), exceeding EUR 1 000 ;

• (c) in the case of persons trading in goods, when carrying out occasional transactions in cash amounting to EUR 10 000 or more, whether the transaction is carried out in a single operation or in several operations which appear to be linked;

• (d) for providers of gambling services, upon the collection of winnings, the wagering of a stake, or both, when carrying out transactions amounting to EUR 2 000 or more, whether the transaction is carried out in a single operation or in several operations which appear to be linked;

• (e) when there is a suspicion of money laundering or terrorist financing, regardless of any derogation, exemption or threshold;

• (f) when there are doubts about the veracity or adequacy of previously obtained customer identification data.

Article 12

• (a) the payment instrument is not reloadable, or has a maximum monthly payment transactions limit of EUR 150 which can be used only in that Member State;

• (b) the maximum amount stored electronically does not exceed EUR 150;

• (c) the payment instrument is used exclusively to purchase goods or services;

• (d) the payment instrument cannot be funded with anonymous electronic money;

• (e) the issuer carries out sufficient monitoring of the transactions or business relationship to enable the detection of unusual or suspicious transactions.

Member States may decide not to accept on their territory payments carried out by using anonymous prepaid cards.

Article 13

• (a) identifying the customer and verifying the customer’s identity on the basis of documents, data or information obtained from a reliable and independent source, including, where available, electronic identification means, relevant trust services as set out in Regulation (EU) No 910/2014 of the European Parliament and of the Council ([^E0017]) or any other secure, remote or electronic identification process regulated, recognised, approved or accepted by the relevant national authorities;

• (b) identifying the beneficial owner and taking reasonable measures to verify that person's identity so that the obliged entity is satisfied that it knows who the beneficial owner is, including, as regards legal persons, trusts, companies, foundations and similar legal arrangements, taking reasonable measures to understand the ownership and control structure of the customer. Where the beneficial owner identified is the senior managing official as referred to in Article 3(6)(a) (ii), obliged entities shall take the necessary reasonable measures to verify the identity of the natural person who holds the position of senior managing official and shall keep records of the actions taken as well as any difficulties encountered during the verification process;

• (c) assessing and, as appropriate, obtaining information on the purpose and intended nature of the business relationship;

• (d) conducting ongoing monitoring of the business relationship including scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the obliged entity's knowledge of the customer, the business and risk profile, including where necessary the source of funds and ensuring that the documents, data or information held are kept up-to-date.

When performing the measures referred to in points (a) and (b) of the first subparagraph, obliged entities shall also verify that any person purporting to act on behalf of the customer is so authorised and identify and verify the identity of that person.

• (a) in the case of beneficiaries that are identified as specifically named persons or legal arrangements, taking the name of the person;

• (b) in the case of beneficiaries that are designated by characteristics or by class or by other means, obtaining sufficient information concerning those beneficiaries to satisfy the credit institutions or financial institution that it will be able to establish the identity of the beneficiary at the time of the payout.

With regard to points (a) and (b) of the first subparagraph, the verification of the identity of the beneficiaries shall take place at the time of the payout. In the case of assignment, in whole or in part, of the life or other investment-related insurance to a third party, credit institutions and financial institutions aware of the assignment shall identify the beneficial owner at the time of the assignment to the natural or legal person or legal arrangement receiving for its own benefit the value of the policy assigned.

Article 14

Member States shall not apply the first subparagraph to notaries, other independent legal professionals, auditors, external accountants and tax advisors only to the strict extent that those persons ascertain the legal position of their client, or perform the task of defending or representing that client in, or concerning, judicial proceedings, including providing advice on instituting or avoiding such proceedings.

SECTION 2 Simplified customer due diligence

Article 15

Article 16

When assessing the risks of money laundering and terrorist financing relating to types of customers, geographic areas, and particular products, services, transactions or delivery channels, Member States and obliged entities shall take into account at least the factors of potentially lower risk situations set out in Annex II.

Article 17

By 26 June 2017, the ESAs shall issue guidelines, addressed to competent authorities and to the credit institutions and financial institutions, in accordance with Article 16 of Regulation (EU) No 1093/2010 on the risk factors to be taken into consideration and the measures to be taken in situations where simplified customer due diligence measures are appropriate. From 1 January 2020, EBA shall, where appropriate, issue such guidelines. Specific account shall be taken of the nature and size of the business, and, where appropriate and proportionate, specific measures shall be laid down.

SECTION 3 Enhanced customer due diligence

Article 18

Enhanced customer due diligence measures need not be invoked automatically with respect to branches or majority-owned subsidiaries of obliged entities established in the Union which are located in high-risk third countries, where those branches or majority-owned subsidiaries fully comply with the group-wide policies and procedures in accordance with Article 45. Member States shall ensure that those cases are handled by obliged entities by using a risk-based approach.

• (i) they are complex transactions;

• (ii) they are unusually large transactions;

• (iii) they are conducted in an unusual pattern;

• (iv) they do not have an apparent economic or lawful purpose.

In particular, obliged entities shall increase the degree and nature of monitoring of the business relationship, in order to determine whether those transactions or activities appear suspicious.

Where situations of higher risk are identified, the guidelines referred to in paragraph 5 shall include enhanced due diligence measures that obliged entities shall consider applying to mitigate such risks, including the adoption of appropriate procedures to detect the origin or destination of crypto-assets.

Article 18a

• (a) obtaining additional information on the customer and on the beneficial owner(s);

• (b) obtaining additional information on the intended nature of the business relationship;

• (c) obtaining information on the source of funds and source of wealth of the customer and of the beneficial owner(s);

• (d) obtaining information on the reasons for the intended or performed transactions;

• (e) obtaining the approval of senior management for establishing or continuing the business relationship;

• (f) conducting enhanced monitoring of the business relationship by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination.

Member States may require obliged entities to ensure, where applicable, that the first payment be carried out through an account in the customer’s name with a credit institution subject to customer due diligence standards that are not less robust than those laid down in this Directive.

• (a) the application of additional elements of enhanced due diligence;

• (b) the introduction of enhanced relevant reporting mechanisms or systematic reporting of financial transactions;

• (c) the limitation of business relationships or transactions with natural persons or legal entities from the third countries identified as high risk countries pursuant to Article 9(2).

• (a) refusing the establishment of subsidiaries or branches or representative offices of obliged entities from the country concerned, or otherwise taking into account the fact that the relevant obliged entity is from a country that does not have adequate AML/CFT regimes;

• (b) prohibiting obliged entities from establishing branches or representative offices in the country concerned, or otherwise taking into account the fact that the relevant branch or representative office would be in a country that does not have adequate AML/CFT regimes;

• (c) requiring increased supervisory examination or increased external audit requirements for branches and subsidiaries of obliged entities located in the country concerned;

• (d) requiring increased external audit requirements for financial groups with respect to any of their branches and subsidiaries located in the country concerned;

• (e) requiring credit and financial institutions to review and amend, or if necessary terminate, correspondent relationships with respondent institutions in the country concerned.

Article 19

With respect to cross-border correspondent relationships involving the execution of payments with a third-country respondent institution, Member States shall, in addition to the customer due diligence measures laid down in Article 13, require their credit institutions and financial institutions when entering into a business relationship to:

• (a) gather sufficient information about the respondent institution to understand fully the nature of the respondent's business and to determine from publicly available information the reputation of the institution and the quality of supervision;

• (b) assess the respondent institution's AML/CFT controls;

• (c) obtain approval from senior management before establishing new correspondent relationships;

• (d) document the respective responsibilities of each institution;

• (e) with respect to payable-through accounts, be satisfied that the respondent institution has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent institution, and that it is able to provide relevant customer due diligence data to the correspondent institution, upon request.

Article 19a

• (a) taking risk-based measures to identify, and verify the identity of, the originator or beneficiary of a transfer made to or from a self-hosted address or the beneficial owner of such originator or beneficiary, including through reliance on third parties;

• (b) requiring additional information on the origin and destination of the transferred crypto-assets;

• (c) conducting enhanced ongoing monitoring of those transactions;

• (d) any other measure to mitigate and manage the risks of money laundering and terrorist financing as well as the risk of non-implementation and evasion of targeted financial sanctions and proliferation financing-related targeted financial sanctions.

Article 19b

• (a) determine if the respondent entity is licensed or registered;

• (b) gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;

• (c) assess the respondent entity’s AML/CFT controls;

• (d) obtain approval from senior management before establishing new correspondent relationships;

• (e) document the respective responsibilities of each party to the correspondent relationship;

• (f) with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

Where crypto-asset service providers decide to terminate correspondent relationships for reasons relating to anti-money laundering and counter-terrorist financing policy, they shall document and record their decision.

Crypto-asset service providers shall update the due diligence information for the correspondent relationship on a regular basis or when new risks emerge in relation to the respondent entity.

Article 20

With respect to transactions or business relationships with politically exposed persons, Member States shall, in addition to the customer due diligence measures laid down in Article 13, require obliged entities to:

• (a) have in place appropriate risk management systems, including risk-based procedures, to determine whether the customer or the beneficial owner of the customer is a politically exposed person;

• (b) apply the following measures in cases of business relationships with politically exposed persons:
• (i) obtain senior management approval for establishing or continuing business relationships with such persons;
• (ii) take adequate measures to establish the source of wealth and source of funds that are involved in business relationships or transactions with such persons;
• (iii) conduct enhanced, ongoing monitoring of those business relationships.

Article 20a

Article 21

Member States shall require obliged entities to take reasonable measures to determine whether the beneficiaries of a life or other investment-related insurance policy and/or, where required, the beneficial owner of the beneficiary are politically exposed persons. Those measures shall be taken no later than at the time of the payout or at the time of the assignment, in whole or in part, of the policy. Where there are higher risks identified, in addition to applying the customer due diligence measures laid down in Article 13, Member States shall require obliged entities to:

• (a) inform senior management before payout of policy proceeds;

• (b) conduct enhanced scrutiny of the entire business relationship with the policyholder.

Article 22

Where a politically exposed person is no longer entrusted with a prominent public function by a Member State or a third country, or with a prominent public function by an international organisation, obliged entities shall, for at least 12 months, be required to take into account the continuing risk posed by that person and to apply appropriate and risk-sensitive measures until such time as that person is deemed to pose no further risk specific to politically exposed persons.

Article 23

The measures referred to in Articles 20 and 21 shall also apply to family members or persons known to be close associates of politically exposed persons.

Article 24

Member States shall prohibit credit institutions and financial institutions from entering into, or continuing, a correspondent relationship with a shell bank. They shall require that those institutions take appropriate measures to ensure that they do not engage in or continue correspondent relationships with a credit institution or financial institution that is known to allow its accounts to be used by a shell bank.

Article 24a

By 1 January 2024, EBA shall issue guidelines specifying how the enhanced customer due diligence measures in this Section apply when obliged entities perform crypto-asset services as defined in Article 3(1), point (16), of Regulation (EU) 2023/1114, with the exception of point (h) of that point, as well as transfers of crypto-assets as defined in Article 3, point (10), of Regulation (EU) 2023/1113. In particular, EBA shall specify how and when those obliged entities shall obtain additional information on the originator and beneficiary.

SECTION 4 Performance by third parties

Article 25

Member States may permit obliged entities to rely on third parties to meet the customer due diligence requirements laid down in points (a), (b) and (c) of the first subparagraph of Article 13(1). However, the ultimate responsibility for meeting those requirements shall remain with the obliged entity which relies on the third party.

Article 26

• (a) apply customer due diligence requirements and record-keeping requirements that are consistent with those laid down in this Directive; and

• (b) have their compliance with the requirements of this Directive supervised in a manner consistent with Section 2 of Chapter VI.

Article 27

Article 28

Member States shall ensure that the competent authority of the home Member State (for group-wide policies and procedures) and the competent authority of the host Member State (for branches and subsidiaries) may consider an obliged entity to comply with the provisions adopted pursuant to Articles 26 and 27 through its group programme, where all of the following conditions are met:

• (a) the obliged entity relies on information provided by a third party that is part of the same group;

• (b) that group applies customer due diligence measures, rules on record-keeping and programmes against money laundering and terrorist financing in accordance with this Directive or equivalent rules;

• (c) the effective implementation of the requirements referred to in point (b) is supervised at group level by a competent authority of the home Member State or of the third country.

Article 29

This Section shall not apply to outsourcing or agency relationships where, on the basis of a contractual arrangement, the outsourcing service provider or agent is to be regarded as part of the obliged entity.

CHAPTER III BENEFICIAL OWNERSHIP INFORMATION

Article 30

Member States shall ensure that those entities are required to provide, in addition to information about their legal owner, information on the beneficial owner to obliged entities when the obliged entities are taking customer due diligence measures in accordance with Chapter II.

Member States shall require that the beneficial owners of corporate or other legal entities, including through shares, voting rights, ownership interest, bearer shareholdings or control via other means, provide those entities with all the information necessary for the corporate or other legal entity to comply with the requirements in the first subparagraph.

• (a) competent authorities and FIUs, without any restriction;

• (b) obliged entities, within the framework of customer due diligence in accordance with Chapter II;

• (c) any person or organisation that can demonstrate a legitimate interest.

The persons or organisations referred to in point (c) of the first subparagraph shall be permitted to access at least the name, the month and year of birth and the country of residence and nationality of the beneficial owner as well as the nature and extent of the beneficial interest held.

Member States may, under conditions to be determined in national law, provide for access to additional information enabling the identification of the beneficial owner. That additional information shall include at least the date of birth or contact details in accordance with data protection rules.

5a. Member States may choose to make the information held in their national registers referred to in paragraph 3 available on the condition of online registration and the payment of a fee, which shall not exceed the administrative costs of making the information available, including costs of maintenance and developments of the register.

Competent authorities granted access to the central register referred to in paragraph 3 shall be those public authorities with designated responsibilities for combating money laundering or terrorist financing, as well as tax authorities, supervisors of obliged entities and authorities that have the function of investigating or prosecuting money laundering, associated predicate offences and terrorist financing, tracing and seizing or freezing and confiscating criminal assets.