Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849

AML/CFT COLLEGES GUIDELINES 1 JC 2019 81 16 December 2019 Final report on Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions The AML/CFT Colleges Guidelines

AML/CFT COLLEGES GUIDELINES 2 Contents

1. Executive summary 3
2. Background and rationale 5
3. Guidelines on the cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions 202
4. Accompanying documents 43

AML/CFT COLLEGES GUIDELINES 3 1.Executive summary Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing aims, inter alia, to bring European Union legislation in line with the International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, which the Financial Action Task Force (FATF), a setter of international standards on anti-money laundering/combating the financing of terrorism (AML/CFT), adopted in 2012. The FATF’s standards make it clear that the cooperation of those authorities responsible for overseeing AML/CFT compliance is an essential part of an effective AML/CFT regime. 1 Consequently, Directive (EU) 2015/849 includes a high-level requirement for competent authorities of home and host Member States to cooperate. In 2018, Directive (EU) 2015/849 was amended. The new text requiresthat Member States do not prohibit or unreasonably restrict the exchange of information or cooperation between competent authorities for AML/CFT supervision purposes. It also clarifies the legal basis for supervisory cooperation and information exchange in different EU Member States. However, the revised directive does not establish a framework to support supervisory cooperation or information exchange. Recent events have shown that, in the absence of a common framework for supervisory cooperation, cooperation and information exchange between competent authorities can be difficult. The three European supervisory authorities (ESAs) are issuing these guidelines to clarify the practical modalities of supervisory cooperation and information exchange, and to create a common framework that supervisors should use to support effective oversight of cross-border groups from an AML/CFT perspective and also from a more general prudential perspective. AML/CFT colleges will be central to achieving this. Specifically, AML/CFT colleges will provide a permanent structure for cooperation and information exchange between supervisors from different Member States and third countries that are responsible for the AML/CFT supervision of the same firm. These guidelines set out the rules that govern the establishment and operation of these colleges, and structure the exchange of information between AML/CFT and prudential supervisors, who will be invited to participate in AML/CFT colleges as observers. The ESAs believe that the establishment of AML/CFT colleges will support competent authorities’ understanding of the money laundering and terrorist financing (ML/TF) risks associated with firms under their supervision and, ultimately, foster the development of consistent and effective supervisory approaches to AML/CFT supervision across the EU. In situations where the conditions for setting up an AML/CFT college are not met, the guidelines define the process for bilateral exchangesof information between competent authorities.

1 See in particular Recommendation 40 and the associated ‘Methodology for assessing technical compliance with the FATF Recommendations and the effectiveness of AML/CFT systems’: http://www.fatf￾gafi.org/media/fatf/documents/methodology/FATF%20Methodology%2022%20Feb%202013.pdf

AML/CFT COLLEGES GUIDELINES 4 The ESAs publicly consulted on a version of these guidelines between 7 November 2018 and 8 February 2019. Respondents broadly welcomed these guidelines. The ESAs have considered the feedback received and updated these guidelines as appropriate. In December 2018, 1 month after the publication of the Consultation Paper, the Council of the European Union published an AML action plan.2 This action plan sets out a number of objectives, with deliverables and timelines, that the Council hopes will strengthen the effectiveness of the current EU AML/CFT framework. In the Council’s view, better cooperation and information exchange between AML/CFT and prudential supervisors are central to this. With the publication of these guidelines, the ESAs meet Objective 6b of this action plan.

2 https://www.consilium.europa.eu/media/37283/st15164-en18.pdf

AML/CFT COLLEGES GUIDELINES 5 2.Background and rationale Background

1. On 26 June 2015, Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing entered into force. This directive aims, inter alia, to bring European Union legislation in line with the International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, which the FATF, an international AML/CFT standard setter, adopted in 2012.
2. The FATF’s standards make it clear that the cooperation of authorities responsible for overseeing AML/CFT compliance is an essential part of an effective AML/CFT regime. 3 Consequently, Directive (EU) 2015/849 includes a high-level requirement for competent authorities of home and host Member States to cooperate to ensure the effective AML/CFT supervision of obliged entities that operate on a cross-border basis.
3. However, in contrast to other EU legal texts that govern relationships between supervisory authorities from different Member States, Directive (EU) 2015/849 does not set out in detail how authorities responsible for the AML/CFT supervision of credit and financial institutions in the EU (hereafter ‘competent authorities’) should cooperate. The absence of specific provisions in Directive (EU) 2015/849, together with the lack of specific references to cooperation and information exchange for AML/CFT supervision purposes in most other EU legal texts, appears to have hampered effective cooperation between national competent authoritiesin some cases. Directive (EU) 2015/849 was therefore amended so that it requires EU Member States not to prohibit or unreasonably restrict the exchange of information or cooperation between competent authorities for AML/CFT supervision purposes, and to clarify the legal basis for cooperation and information exchange between competent authorities in different EU Member States. It does not establish a framework to support cooperation and information exchange.
4. Recent events have shown that, in the absence of a common framework for supervisory cooperation, cooperation and information exchange between competent authorities can be difficult. The three ESAs are therefore issuing guidelines to clarify the modalities of supervisory cooperation and information exchange, and to create a common framework to support the effective AML/CFT supervision of firms that operate on a cross-border basis.
5. Specifically, the guidelines set out: (a) the rules for the establishment of AML/CFT colleges for firms operating on a cross￾border basis; AML/CFT colleges provide a forum for AML/CFT competent

3 See in Particular Recommendation 40 and the associated ‘Methodology for assessing technical compliance with the FATF Recommendations and the effectiveness of AML/CFT systems’: http://www.fatf￾gafi.org/media/fatf/documents/methodology/FATF%20Methodology%2022%20Feb%202013.pdf

AML/CFT COLLEGES GUIDELINES 6 authorities and other relevant authorities, including prudential supervisors that are responsible for supervising these firms in different Member States to work together to improve their understanding of the ML/TF risk associated with the firm, exchange information to inform their approach to the supervision of that firm and to coordinate supervisory action where appropriate; and (b) the process for bilateral exchanges of information between competent authorities. 6. The ESAs publicly consulted on a version of these guidelines between 7 November 2018 and 8 February 2019. Respondents broadly welcomed these guidelines. The ESAs considered the feedback received and updated these guidelines as appropriate. 7. In December 2018, 1month after the publication of the Consultation Paper, the Council of the European Union published an AML action plan. 4 This action plan sets out a number of objectives, with deliverables and timelines, that the Council hopes will strengthen the effectiveness of the current EU AML/CFT framework. In the Council’s view, better cooperation and information exchange between AML/CFT and prudential supervisors are central to this. With the publication of these guidelines, the ESAs meet Objective 6b of this action plan. 8. The ESAs will keep these guidelines under review and update them as appropriate. Rationale 9. These guidelines cover: (a) the mapping of firms; (b) the conditions for establishing and maintaining an AML/CFT college; (c) cooperation between AML/CFT colleges and prudential supervisors; (d) the composition of AML/CFT colleges; and (e) procedural issues related to college meetings, such as written cooperation and information-sharing agreements, procedures for requesting and providing mutual assistance, a common approach and other related aspects. Mapping of firms 10. These guidelines are designed to foster cooperation and information exchange between competent authorities that are responsible for supervising firms that operate on a cross￾border basis as well as EU and cross-border establishments. To this end, these guidelines set out the conditions for the establishment of AML/CFT colleges that provide a permanent

4 https://www.consilium.europa.eu/media/37283/st15164-en18.pdf

AML/CFT COLLEGES GUIDELINES 7 structure for cooperation and information sharing between supervisors from different Member States and third countries. 11. As a first step, Guideline 1 requires that competent authorities identify all firms operating on a cross-border basis that have been authorised in their Member State and all branches or subsidiaries set up by these firms in other jurisdictions to establish whether the criteria for setting up an AML/CFT college are met. The mapping should also include all branches and subsidiaries operating in the competent authority’s Member State from other Member States or third countries as well as those third countries where the third-country undertaking linked5 to the EU establishments is situated. 12. The mapping of firms is not a new concept, and many competent authorities will be able to draw on their existing maps of firms, including those created to apply a risk-based approach to supervision in line with Article 48(6) of the fourth Anti-Money Laundering Directive (AMLD4) and the ESAs’ Risk-Based Supervision Guidelines6 and those used by prudential supervisors for prudential college purposes. Conditions for establishing an AML/CFT college 13. Guideline 2 provides that an AML/CFT college should be set up if competent authorities from three or more Member States are involved in the AML/CFT supervision of the same firm where that firm is operating on a cross-border basis. A firm that operates establishments in three or more jurisdictions is exposed to different ML/TF risks than a firm that operates in one jurisdiction only. It’s business model is also likely to be more complex. In those situations, the setting up of a permanent structure to support cooperation and information exchange between competent authorities is proportionate and appropriate. 14. Guideline 2 does not prevent the establishment of anAML/CFT college in situations where the conditions set out in Guideline 2 are not met. Establishing and maintaining an AML/CFT college 15. Guideline 3 provides that the lead supervisor should set up an AML/CFT college if the conditions in Guideline 2 are met. It also sets out what steps competent authorities should follow if the lead supervisor does not set up a college as expected.

5 Pursuant to Article 3(15) of Directive (EU) 2015/849, ‘group’ means a group of undertakings that consists of a parent undertaking, its subsidiaries, and the entities in which the parent undertaking or its subsidiaries hold a participation, as well as undertakings linked to each other by a relationship within the meaning of Article 22 of Directive 2013/34/EU. 6 Joint Guidelines on the characteristics of a risk‐based approach to anti‐money laundering and terrorist financing supervision, and the steps to be taken when conducting supervision on a risk‐sensitive basis were published by the ESAs on 16 November 2016 and are available here: https://esas-joint￾committee.europa.eu/Publications/Guidelines/Final_RBSGL_for_publication_20161115.pdf. All competent authorities are required to comply with these.

AML/CFT COLLEGES GUIDELINES 8 16. In line with the risk-based approach, these guidelines envisage that the lead supervisor should in the first instance prioritise AML/CFT colleges for the firms and EU establishments that are most exposed to ML/TF risk. This point is also reflected in Guideline 16. Cooperation between AML/CFT colleges and prudential supervisors 17.These guidelines aim to foster cooperation between AML/CFT and prudential supervisors and ensure that they exchange relevant information in a timely manner. The ESAs have reflected this in Guideline 4. Guideline 4 will sit alongside similar regulatory products and instruments, including future guidelines under Article 117(5) and (6) of the Capital Requirements Directive (CRD). Composition of an AML/CFT college 18.Similar to colleges of prudential supervisors, AML/CFT colleges are made up of permanent members and observers. Guideline 5 specifies that all competent authorities involved in the AML/CFT supervision of a firm operating on a cross-border basis or the supervision of EU establishments and all ESAs should be permanent members of the AML/CFT college. The lead supervisor is responsible for identifying and inviting all permanent members to participate in the college. 19.Guideline 5 envisages that observers be invited to participate in AML/CFT colleges where relevant to foster cooperation and information exchange. Observers include the financial intelligence unit (FIU) of the lead supervisor’s Member State. 20.Observers can be invited to participate in the college only if they comply with certain confidentiality standards. When considering whether a particular observer may be invited, the lead supervisor or the permanent members should carry out an assessment of the professional secrecy and confidentiality requirements applicable to the potential observer. When carrying out an assessment of confidentiality provisions of third-country authorities, the recommendation on equivalence of non-EU authorities for participation in supervisory colleges published on the European Banking Authority’s (EBA’s) website can be an important input for the overall equivalence assessment carried out by the lead supervisor or the permanent member. 21.In addition to the permanent members and observers, the lead supervisor may also invite other attendees to participate in specific AML/CFT college sessions as invited participants on an ad hoc basis where it considers that these attendees may add value to the college discussions. There are no limitations as to who can be an invited participant; however, in practice these are likely to be the firm, consultants who have engaged with the firm or FIUs from jurisdictions other than the lead supervisor’s Member State. However, their attendance at the AML/CFT college meeting should be justified by the lead supervisor and approved by the permanent members.

AML/CFT COLLEGES GUIDELINES 9 Contact lists 22.The lead supervisor is responsible for putting together a contact list of all permanent members and observers, using the template in Annex II of these guidelines. The lead supervisor should review this list regularly and share it with the permanent members and observers. 23.It is the responsibility of permanent members and observers to notify the lead supervisor of any changes in their status or contact details without undue delay. AML/CFT college meetings 24.Guideline 7 provides a list of factors, including the level of ML/TF risk associated with the firm, that the lead supervisor should consider when determining the frequency and form of the college meetings. The only exception is the first meeting of a new AML/CFT college for a firm that is associated with high ML/TF risk, in which case Guideline 7 recommendsthat a physical meeting would be appropriate. This is proportionate and in line with the risk-based approach. 25.Guideline 7 also allows the lead supervisor, either on its own initiative or upon request from permanent members, to convene an ad hoc AML/CFT college meeting in circumstances where the ML/TF risk has materialised or a serious ML/TF risk has emerged. Written cooperation and information-sharing agreement 26.Guideline 8 provides that the lead supervisor and the permanent members of each college should put in place a written cooperation and information-sharing agreement. To ease the burden on the lead supervisor, and to foster a consistent approach, the guideline envisages that a template for such an agreement, provided in Annex II, is used for all AML/CFT colleges, unless permanent members or the lead supervisor agree to amend it. The scope of mutual assistance 27.Guideline 9 clarifies the scope of mutual assistance and provides a non-exhaustive list of situations in which mutual assistance may be sought and provided by permanent members and, to a certain extent, by observers. Procedure for requesting mutual assistance 28.Guideline 10 sets out the process for requesting and providing mutual assistance between permanent members and between permanent members and observers, where provided in the terms of participation of observers, which are prepared individually for each observer by the lead supervisor of the AML/CFT college. Confidentiality restrictions and permissible uses of information 29.In a colleges setting, it is important that permanent members can be confident to discuss and share non-public information with each other and with observers where applicable. To this

AML/CFT COLLEGES GUIDELINES 10 end, Guideline 11 requiresthat safeguards be put in place to ensure that the disclosure of non￾public information within AML/CFT colleges complies with relevant provisions in the AMLD and other applicable EU law, for example the Capital Requirements Directive. Common approach 30.Guideline 12 envisagesthat permanent members adopt a common approach to the AML/CFT supervision of the firm and sets out the process that permanent members should follow to ensure the effective and consistent oversight of the group. 31.The ESAs expect that permanent members that have agreed to follow the common approach will do so and, where a permanent member has failed to do so in practice, Guideline 12 clarifies that other permanent members may ask for the EBA’sassistance. Coordinated supervisory action 32.Guideline 13 sets out a process for coordinated supervisory actions. These can be part of the common approach adopted under Guideline 12, for example in situations where a coordinated approach to the AML/CFT supervision of a firm may be more effective. This could be the case when assessing a firm’s compliance with Article 45 of Directive (EU) 2015/849, which requires that group-wide policies and procedures are implemented by a firm in its branches and subsidiaries. Bilateral relationships 33.Not all firms operating on a cross-border basis will require an AML/CFT college to be set up, and competent authorities supervising these firms will continue to engage with each other on a bilateral basis. However, evidence shows that, without a formal framework in place, such bilateral communication and engagement are not always effective. To this purpose, Guideline 14 provides a basic framework for such cooperation. Conflict resolution Considering that there are different parties involved in AML/CFT colleges, Guideline 15 provides that any conflicts that may arise between these parties and that cannot be resolved can be referred to the EBA for mediation. Transitional period 34.The guidelines anticipate that AML/CFT colleges be established for all firms operating on a cross-border basis and EU establishments that meet the conditions set out in Guideline 2. However, the ESAs acknowledge that the establishment of an AML/CFT college may take time and could be resource intensive. In order to minimise the burden on lead supervisors, and in line with the principles of proportionality and the risk-based approach, Guideline 16 envisages a transitional period. During this transitional period, all AML/CFT colleges should be

AML/CFT COLLEGES GUIDELINES 11 established, but the first meeting does not have to have taken place during this period unless the firm has been deemed to pose a high ML/TF risk.

AML/CFT COLLEGES GUIDELINES 12 JC 2019 81 16 December 2019 Final Guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions The AML/CFT Colleges Guidelines

AML/CFT COLLEGES GUIDELINES 13

1. Compliance and reporting obligations Status of these joint guidelines This document contains joint guidelines issued pursuant to Articles 16 and 56, subparagraph 1, of Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European supervisory authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC; Regulation (EU) No 1094/2010 establishing a European supervisory authority (European Insurance and Occupational Pensions Authority); and Regulation (EU) No 1095/2010 establishing a European supervisory authority (European Securities and Markets Authority)) – ‘the ESA regulations’. In accordance with Article 16(3) of the ESA regulations, competent authorities and financial institutions must make every effort to comply with the guidelines. Joint guidelines set out the European supervisory authorities’ (ESAs’) views of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities to which the joint guidelines apply should comply by incorporating them into their supervisory practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where the joint guidelines are directed primarily at institutions. Reporting requirements In accordance with Article 16(3) of the ESA regulations, competent authorities must notify the respective European supervisory authority (ESA) of whether they comply or intend to comply with these joint guidelines, or otherwise, with reasons for non-compliance, by dd.mm.yyyy (2 months after issuance). In the absence of any notification by this deadline, competent authorities will be considered non-compliant by the respective ESA. Notifications should be sent to compliance@eba.europa.eu, compliance@eiopa.europa.eu and compliance@esma.europa.eu with the reference ‘JC 2019 81’. A template for notifications is available on the ESAs’ websites. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Notifications will be published on the ESAs’ websites, in line with Article 16(3).

AML/CFT COLLEGES GUIDELINES 14 2. Subject matter, definitions and addressees Subject matter These guidelines: a) establish a framework for cooperation and information exchange between competent authorities through either bilateral engagements or anti-money laundering/combatting the financing of terrorism (AML/CFT) colleges; b) govern the establishment and functioning of AML/CFT colleges. Definitions Unless otherwise specified, terms used and defined in Directive (EU) 2015/849 and Regulation (EU) No 575/2013 have the same meaning in these guidelines. In addition, for the purposes of these guidelines, the following definitions apply: Competent authority A competent authority defined in point (2)(ii) of Article 4 of Regulation (EU) No 1093/2010; point (2)(ii) of Article 4 of Regulation (EU) No 1094/2010; and point (3)(ii) of Article 4 of Regulation (EU) No 1095/2010 that is competent for ensuring firms’ compliance with the requirements of Directive (EU) 2015/849. In line with point (b) of Article 1 of Decisions of the EEA Joint Committee No 199/2016, No 200/2016 and No 201/2016 of 30 September 2016, the terms ‘Member State(s)’ and ‘competent authorities’ shall be understood to include, in addition to their meaning in the abovementioned Regulation, the European Free Trade Association (EFTA) states and their competent authorities, respectively. Third-country undertaking An undertaking established in a third country, which, were it established in a Member State, would qualify as a credit institution or financial institution referred to in points (1) and (2) of Article 3 of Directive (EU) 2015/849. Firm A credit institution or financial institution referred to in points (1) and (2) of Article 3 of Directive (EU) 2015/849. Firm operating on a cross￾border basis A firm with branches established in another Member State or in a third country or a group of credit and financial institutions

AML/CFT COLLEGES GUIDELINES 15 referred to in point (15s) of Article 3 of Directive (EU) 2015/849 with subsidiaries and branches established in a Member State or in a third country. Cross-border establishment A branch or any other form of establishment as referred to in Article 45(2) and Article 48(4) of Directive (EU) 2015/849 of a firm that operates in a Member State other than the Member State where the head office of the firm is established or in a third country; or the subsidiary of a parent undertaking established in a Member State other thanthe Member State where that parent undertaking has been established or in a third country. EU establishment The direct or indirect subsidiary of a third-country undertaking that has been established in a Member State (‘EU subsidiary of a third-country undertaking’) or an EU branch, or any other form of establishment as referred to in Article 45(2) and Article 48(4) of Directive (EU) 2015/849 of that third-country undertaking or any of its EU subsidiaries. Lead supervisor For cross-border establishments set up in at least three Member States, the lead supervisor means: (a) the competent authority of the Member State where the consolidating supervisor referred to in Article 111 of Directive 2013/36/EU7 or the group supervisor referred to in Article 212(1)(d) of Directive 2009/138/EC 8 is situated; or, where the consolidating supervisor is the European Central Bank (ECB), the competent authority of the Member State where the consolidating supervisor would have been situated prior to the application of Regulation (EU) No 1024/2013; 9 or (b) for a firm, other than a credit institution or an insurance undertaking, with cross-border establishments, which are:

7 Directive 2013/36/EU of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC. 8 Directive 2009/138/EC of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II). 9 Council Regulation (EU) 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions.

AML/CFT COLLEGES GUIDELINES 16 i. subsidiaries, the competent authority of the home Member State of the parent undertaking; ii. not subsidiaries, the competent authority of the home Member State of that firm; or (c) for a firm operating on a cross-border basis, which is a subsidiary of an undertaking other than a credit institution or a financial institution referred to in points (1) and (2) of Article 3 of Directive (EU) 2015/849, the competent authority of a Member State as defined in points b(i) and b(ii) above. For EU establishments set up in at least three Member States, the lead supervisor means: (a) between branches and subsidiaries, the competent authority of the Member State where the subsidiary is established; (b) among subsidiaries or among branches, the competent authority of the Member State where the subsidiary or the branch that presents the highest level of ML/TF risk in accordance with the relevant competent authority’s risk assessment is established; or (c) among subsidiaries or among branches, with the same ML/TF risk levels, the competent authority of the Member State where the subsidiary or the branch with the highest total value of its assets is established. Where the lead supervisor cannot be identified, the relevant European supervisory authority may on its own initiative or upon request from the competent authorities involved provide assistance, including by means of mediation. AML/CFT college A college, consisting of the lead supervisor, permanent members and observers, that is set up to provide a permanent structure for cooperation and information sharing between these parties for the purposes of supervising a firm operating on a cross￾border basis. Prudential supervisor The competent authority defined in point (2)(i) of Article 4 of Regulation (EU) No 1093/2010, in point (2)(i) of Article 4 of

AML/CFT COLLEGES GUIDELINES 17 Regulation (EU) No 1094/2010 and in point (3)(i) of Article 4 of Regulation (EU) No 1095/2010.

AML/CFT COLLEGES GUIDELINES 18 Addressees 8. These guidelines are addressed to competent authorities.

AML/CFT COLLEGES GUIDELINES 19 5. Implementation Date of application These guidelines apply from 10 January 2020. Transitional provisions References to the ESAs in these guidelines should be construed as references to the European supervisory authority to which Union law confers the tasks related to preventing and countering money laundering and financing of terrorism in the financial system across the EU.

AML/CFT COLLEGES GUIDELINES 20

1. Guidelines on the cooperation and information exchange for the purposes of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions Guideline 1: Mapping 1.1 Competent authorities should perform mapping of all the following: (a) firms operating on a cross-border basisthat are established in their Member State and those firms’ cross-border establishments in other Member States or third countries; (b) cross-border and EU establishments operating in their Member State; and (c) third-country undertakings linked to the EU establishments set out in (b) above. 1.2 To perform the mapping for the purposes of these guidelines, competent authorities should use mapping: (a) already available to them in their capacity as prudential supervisors; (b) communicated to them by prudential supervisors; or (c) carried out by them as part of their risk-based supervision framework, which is set out in the ESAs’ Joint Guidelines on the characteristics of a risk‐based approach to anti‐ money laundering and terrorist financing supervision, and the steps to be taken when conducting supervision on a risk‐sensitive basis (JC 2016 72), published on 16 November 2016 (‘the Risk-Based Supervision Guidelines’). 1.3 Competent authorities should ensure that the mapping referred to in Guideline 1.2 above: (a) contains sufficient information for competent authorities to ensure their compliance with these guidelines; and (b) is supported by a ML/TF risk assessment of firms and sectors within their supervisory remit. 1.4 When performing the mapping for the purposes of these guidelines, competent authorities should gather the necessary information from all available sources including, but not limited to:

AML/CFT COLLEGES GUIDELINES 21 (a) their own supervisory activities, including annual reporting; (b) other competent authorities or AML/CFT supervisory authorities in third countries, to the extent possible; (c) public registers of authorised/licensed firms, including the registers of the European Banking Authority (EBA); and (d) prudential supervisors, namely information that they have about the firm or group structures of firms that are subject to their prudential supervision, including information that is obtained as part of authorisations, passporting notifications and the establishment of colleges of supervisors, where relevant. 1.5 When performing the mapping, competent authorities should use the template provided in Annex I. 1.6 When completing the mapping, competent authorities should include at least: (a) names of all Member States, EEA EFTA states or third countries where the firm operating on a cross-border basis has its cross-border establishments; (b) names of all Member States and EEA EFTA states where the third-country undertaking has its EU establishments, to the extent that this is known to the competent authority; (c) the name of the third country where the third-country undertaking linked to the EU establishments has its head office; and (d) the level of ML/TF risk associated with the firm operating on a cross-border basis, the cross-border establishments and the EU establishments, to the extent that this is known to the competent authority, in line with Steps 1 and 2 of the Risk-Based Supervision Guidelines. 1.7 Competent authorities should ensure that the mapping remains up to date. Competent authorities should review and update the mapping regularly, and on an ad hoc basis when made aware of any relevant changesin the ownership structure of the firm operating on a cross-border basis or of the third-country undertaking. 1.8 Competent authorities should submit the mapping and its updates thereafter to the relevant European supervisory authority. Guideline 2: Conditions for establishing an AML/CFT college 2.1 After performing the mapping in accordance with Guideline 1, the lead supervisor should identify the firms operating on a cross-border basis that meet the conditions referred to in Guideline 2.2 for the establishment of an AML/CFT college.

AML/CFT COLLEGES GUIDELINES 22 2.2 The conditions for establishing an AML/CFT college aremet when: (a) a firm operating on a cross-border basis has set up cross-border establishments in at least two different Member States other than the Member State where its head office is situated; or (b) a third-country undertaking has set up EU establishments in at least three Member States; branches of an EU subsidiary of a third-country undertaking set up in a Member State different from the Member State where the EU subsidiary has been established count as separate establishments. 2.3 Where the conditions for setting up an AML/CFT college are not met, competent authorities should, at least, ensure cooperation and information exchange on a bilateral basis in accordance with Guideline 14. Guideline 3: Establishing and maintaining an AML/CFT college 3.1 Where the conditions set out in Guideline 2 are met, the lead supervisor, in cooperation with the competent authorities of the cross-border and EU establishments, should establish and maintain an AML/CFT college. 3.2 The lead supervisor should prioritise the establishment of AML/CFT colleges for those firms operating on a cross-border basis and EU establishments that are classified as high risk for ML/TF purposes, following the risk assessment carried out in line with the Risk-Based Supervision Guidelines, and take into consideration relevant information published by the European Commission, including the European Commission’s Supranational Risk Assessment published in line with Article 6 of Directive (EU) 2015/849. 3.3 Where a college has not been established by the lead supervisor despite the relevant conditions set out in these guidelines having been met, competent authorities of cross￾border and EU establishments of the cross-border firm for which the college has not been established should write to the lead supervisor stating why a college should be established. As part of this communication, competent authorities should set out: (a) why they consider the conditions for setting up a college to have been met; (b) the ML/TF risk associated with the relevant cross-border or EU establishment, including in particular any indications of breaches or potential breaches of the Anti￾Money Laundering Directive (AMLD)framework at the individual level or at group level; and (c) the impact that the non-establishment of a college would have on theirsupervisory functions and in particular their ability to effectively monitor the cross-border or EU establishment’s compliance with its AML/CFT obligations.

AML/CFT COLLEGES GUIDELINES 23 The lead supervisor should provide a reasoned response to the competent authorities within a month of receiving the written request. If the lead supervisor does not set up a college and the competent authorities disagree with the reasons provided, they should contact the EBA with a request for non-binding mediation with regard to whether the college should be established. 3.4 Where the EBA is of the view that a college should be established and the lead supervisor does not establish the college: (a) where requested by competent authorities of cross-border and EU establishments, the lead supervisor should send without undue delay all information necessary to enable them to effectively supervise the cross-border and EU establishments within their remit; (b) consideration may be given to whether Article 9b of Regulation 1093/2010 should apply; and (c) the non-establishment of the college should be deemed as the lead supervisor being non-compliant with these guidelines. 3.5 Where a competent authority has not received the information requested from the lead supervisor in accordance with point (a) of paragraph 3.4, it should send to the EBA a request for binding mediation. Guideline 4:Cooperation between AML/CFT colleges and prudential supervisors 4.1 Where a college of supervisors referred to in Directive 2013/36/EU or in Directive 2009/138/EC has been established, the following should be ensured: (a) the lead supervisor should endeavour to obtain from the consolidating supervisor the mapping of the group performed in accordance with Article 2 of Commission Delegated Regulation (EU) 2016/98 and Article 2 of Commission Implementing Regulation (EU) 2016/99; (b) the lead supervisor should provide the consolidating supervisor or the group supervisor with the mapping that it has performed in accordance with Guideline 1. 4.2 The lead supervisor should engage with a consolidating supervisor or the chair of the college of prudential supervisors and, if different, with the chair of the AML/CFT substructure of the college of prudential supervisors where such substructure exists, in order to ensure cooperation and information exchange between AML/CFT and prudential supervisors as relevant for their tasks and as foreseen by applicable legislation. Such cooperation should:

AML/CFT COLLEGES GUIDELINES 24 (a) include the exchange of relevant information between the AML/CFT college and the college of prudential supervisors of the firm operating on a cross-border basis or the group for which the AML/CFT college has been established; and (b) ensure participation in the meetings of their respective colleges, when a topic of relevance for the other college members is included in the agenda of their meetings. Guideline 5: Composition of an AML/CFT college Permanent members 5.1 The lead supervisor should always invite the following authorities to participate in the AML/CFT college as permanent members: (a) all competent authorities responsible for the AML/CFT supervision of all cross-border establishments of the firm operating on a cross-border basis; (b) the competent authorities responsible for the AML/CFT supervision of all EU establishments; (c) the appropriate ESA (the EBA, ESMA or EIOPA). 5.2 The lead supervisor should be responsible for identifying permanent membersreferred to in Guideline 5.1 and recording their namesand contact details in the contact list for the relevant AML/CFT college in line with Guideline 6. To identify competent authorities, the lead supervisor may refer to the register of competent authorities published by the European Commission in line with Article 48 (1a) of Directive (EU) 2015/849. 5.3 Upon receipt of the invitation to participate in the AML/CFT college, permanent members should confirm their participation in writing to the lead supervisor within 10 working days. Observers 5.4 The lead supervisor should invite to participate in the AML/CFT college as observers the prudential supervisors of firms operating on a cross-border basis, the cross-border and EU establishments and the AML/CFT authorities of third countries where cross-border establishments operate. It may also invite the prudential supervisors of third countries where cross-border establishments operate and the financial intelligence unit (FIU) of the Member State where the lead supervisor is located to participate. 5.5 The lead supervisor should be responsible for identifying observers referred to in Guideline 5.4 and recording their namesand contact details in the contact list for the relevant AML/CFT college in line with Guideline 6. To identify the relevant authorities, the lead supervisor may consult the European supervisory authorities.

AML/CFT COLLEGES GUIDELINES 25 5.6 When deciding whether to invite a particular observer, the lead supervisor should draw up a list of potential observers in line with Guideline 5.5. In doing so, the lead supervisor should consider all proposals receivedfrom permanent members in writing within a reasonable time and their justification for inviting a particular observer to the AML/CFT college. In order to propose an observer, the lead supervisor or the permanent member proposing the invitation of the observer should carry out the following: (a) An assessment of the equivalence of the confidentiality regime applicable to a third￾country AML/CFT or prudential supervisory authority. As part of this assessment, the lead supervisor or a permanent member may refer to the recommendation on equivalence of non-EU authorities for participation in supervisory colleges published on the EBA’s website, which can be an important input in the overall equivalence assessment of the third-country authority. In addition, the European Commission’s equivalence decisions in the area of the Solvency II Directive 10 and the adequacy decisions in the area of data protection may also be consulted, 11 as appropriate. (b) An assessment of the impact that the attendance of the observer might have on the functioning of the AML/CFT college. (c) An assessment of the third-country AML/CFT or prudential supervisor’s ability and preparedness to sign bilateral cooperation agreements with all permanent members pursuant to Article 57(a)(5) of AMLD. 5.7 The lead supervisor should share a list of potential observers together with the outcome of the assessment carried out in line with Guideline 5.6 with all permanent members of the AML/CFT college and the existing observers. 5.8 Permanent members should raise any observations about and objections to the proposed observers being invited to participate in the AML/CFT college within the deadline set by the lead supervisor. These observations and objections should be accompanied by a written rationale setting out the basis for these observations and objections, and how, in the permanent member’s view, the proposed observer’s participation in the AML/CFT college could affect college proceedings. 5.9 The lead supervisor may invite an observer to participate in the AML/CFT college only where none of the permanent members objects and where the potential observer agrees to abide by the terms of participation of observers, which should be individually drafted by the lead supervisor, and agreed with the relevant authorities, in respect of each observer. 5.10 The EBA may be consulted or act on its own initiate to conciliate or mediate any issue arising with regard to the invitation and participation of observers.

10 Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance. 11 See Article 45(3) of Regulation (EU) 2016/679 or Article 36(3) of Directive (EU) 2016/680.

AML/CFT COLLEGES GUIDELINES 26 Invited participants 5.11 The lead supervisor, either on its own initiative or upon request from a permanent member, may consider inviting other relevant participants to attend a particular session of the AML/CFT college meeting where: (a) the attendance of these participants would benefit the AML/CFT college; such participants may include, but are not limited to, the firm, the FIUs other than the FIU set out in Guideline 5.4, auditors or consultants; or (b) particular matters discussed at the AML/CFT college may have an impact on the work carried out by the invited participant; such participants may indicatively include resolution authorities, the Single Resolution Board or deposit guarantee schemes. 5.12 The leadsupervisor should consider all proposals in writing from permanent members about potential participants and their justification for inviting them. The lead supervisor should consult with and receive approval from all permanent members before inviting these participants to attend a particular session of the AML/CFT college meeting, and inform observers of such a decision. 5.13 Permanent members should raise any concerns about or objections to the proposed participants within the deadline set by the lead supervisor and should support them with a written rationale setting out the basis for these concerns or objections. Guideline 6: Contact lists 6.1 The lead supervisor should maintain a contact list of all permanent members and observers by completing a template attached to the cooperation and information-sharing agreement in Annex II and review it regularly. 6.2 The lead supervisor should share the list compiled in line with Guideline 6.1 with all permanent members and observers. 6.3 Permanent members and observers should provide their contact details to the lead supervisor and inform it of any changes without undue delay. Guideline 7: AML/CFT college meetings Scheduled meetings 7.1 The lead supervisor, in consultation with permanent members, should determine the form and frequency of AML/CFT college meetings, taking into account at least the following factors: (a) the lead supervisor’s assessment of the ML/TF risk associated with the firm and its cross-border establishments or EU establishments for which the AML/CFT college is

AML/CFT COLLEGES GUIDELINES 27 established, which the lead supervisor has determined in line with the ESAs’ Risk-Based Supervision Guidelines and the Risk Factors Guidelines; (b) the views of permanent members; (c) the urgency and timeliness of the matter; (d) the availability of permanent members; (e) the impact on the effectiveness and functioning of the AML/CFT college; and (f) any significant changes to the level of ML/TF risk associated with the firms or their cross-border or EU establishments for which the AML/CFT college is established. 7.2 The first meeting of any newly established AML/CFT college should be a physical meeting, unless the permanent members and the lead supervisor agree that a different form for the meeting is appropriate, taking into account the factors set out in Guideline 7.1 points (a) to (e) above. 7.3 Where the lead supervisor determines, having regard to the views expressed by the permanent members, that the firm operating on a cross-border basis or EU establishments present a high risk of ML/TF, the lead supervisor should convene at least one physical AML/CFT college meeting per year, unless permanent members agree on a different frequency or form of the meeting, taking into account the factors set out in Guideline 7.1. 7.4 To the extent that this is relevant and possible, the lead supervisor, in consultation with permanent members, should organise a physical meeting of the AML/CFT college immediately before, after or at the same time as the meeting of the college of prudential supervisors to facilitate the exchange of information between the competent authorities and prudential supervisors. 7.5 In all cases not addressed in Guideline 7.3, the lead supervisor should, in consultation with permanent members, agree on the frequency or form of the meeting, taking into account the factors set out in Guideline 7.1. 7.6 The lead supervisor should ensure that scheduled AML/CFT college meetings include at least: (a) exchange of information on the firm operating on a cross-border basis and its cross￾border establishments or the EU establishmentsincluding: (i) permanent members’ assessment of the ML/TF risk profile of the firm operating on a cross-border basis or the EU establishments; (ii) early warnings of emerging ML/TF risks;

AML/CFT COLLEGES GUIDELINES 28 (iii) crystallised ML/TF risks and wider supervisory findings (or provisional findings where serious breaches have been identified) relating to the AML/CFT policies and procedures, including the application of group-wide policies and procedures, by the firm operating on a cross-border basis or EU establishments, including a number and analysis of suspicious transactions reports filed, where such information is available; (iv) planned or recently completed AML/CFT supervisory actionsincluding on-site and off-site inspections; (v) sanctions or other corrective actions or measures that have been considered or imposed for breaches of AML/CFT obligations; (vi) other supervisory or enforcement measures, including measures applied by prudential supervisors, where relevant, such as capital add-on based on ML/TF risk, or measures and decisions taken on the grounds of ML/TF risk with regard to the authorisation, qualifying holdings, governance, internal controls, and fitness and propriety; (b) a consideration of the need for a common approach and coordinated actions in accordance with Guidelines 12 and 13. Ad hoc meetings 7.7 The lead supervisor, either on its own initiative or upon request from one or more permanent members, should organise an ad hoc meeting of the AML/CFT college where an ML/TF risk has crystallised or a serious ML/TF risk has emerged,such as: (a) an alleged involvement of either the firm operating on a cross-border basis, or the cross-border establishment or the EU establishment in an international ML/TF scheme; or (b) a high level of non-compliance of either the firm operating on a cross-border basis, or the cross-border establishment or the EU establishment with AML/CFT standards that could have an impact in other jurisdictions. 7.8 The lead supervisor should organise a meeting as described in Guideline 7.7 without delay and determine, in consultation with permanent members, the most appropriate form for the meeting. 7.9 Where the lead supervisor fails to organise an ad hoc meeting of the AML/CFT college as described in Guideline 7.8, one or more permanent members should organise the meeting and ensure that other permanent members are made aware of the meeting and the issues that will be discussed.

AML/CFT COLLEGES GUIDELINES 29 7.10 Where an ML/TF risk has crystallised and urgent action is required, one or more permanent members may organise an ad hoc meeting without delay and ensure that other permanent members are made aware of the meeting. 7.11 Guideline 7.6 of these guidelines does not apply in respect of ad hoc meetings. Guideline 8: Written cooperation and information-sharing agreement 8.1 For each AML/CFT college, the lead supervisor and the permanent members should have a written cooperation and information-sharing arrangement (the ‘AML/CFT cooperation agreement’) in place, and should address, with regard to the permanent members, at least: (a) the scope of mutual assistance, cooperation and information exchange; (b) the process to be followed for the provision of mutual assistance, including requests for cooperation and information exchange; (c) coordination of supervisory actions (including joint inspections); (d) confidentiality restrictions and permissible uses of information; (e) the rules governing the settlement of disputes; and (f) the language that should be used for communications within the AML/CFT college. 8.2 The lead supervisor should complete a template of the AML/CFT cooperation agreement provided in Annex II for all AML/CFT colleges. When the template AML/CFT cooperation agreement is used, prior approval from permanent members is not required. The lead supervisor should communicate the finalised AML/CFT cooperation agreement to all permanent members and observers and to the consolidating supervisor, where relevant. 8.3 The lead supervisor should amend the AML/CFT cooperation agreement referred to in Guideline 8.2 if it considers it necessary or upon request from one or more permanent members. The lead supervisor should transmit the amended AML/CFT cooperation agreement to all permanent members and observers. The lead supervisor should finalise the written agreement, having regard to any views expressed by the permanent members at least to the extent that they were received within a set deadline. The lead supervisor should communicate the final AML/CFT cooperation agreement to all permanent members and observers. 8.4 The lead supervisor should keep the AML/CFT cooperation agreement referred to in Guideline 8.2 or 8.3 under review and update it where necessary, subject to prior consultation with permanent members.

AML/CFT COLLEGES GUIDELINES 30 Guideline 9: Scope of mutual assistance 9.1 Permanent members and, where this is foreseen in the terms of participation annexed to the AML/CFT cooperation agreement, observers should provide each other with the fullest mutual assistance in any matters relevant to the AML/CFT supervision or AML/CFT-related aspects of the prudential supervision of the firm operating on a cross-border basis or EU establishments for which the AML/CFT college has been established. Mutual assistance includes cooperation and information exchange in relation to the firm operating on a cross￾border basis, the cross-border establishment or the EU establishment, to the extent that such information exchange is permitted by the applicable legislation while having reference to Article 50a and Article 57a(4) of the AMLD, in relation to, but not limited to: (a) the supervision of that firm, the cross-border establishment or the EU establishment in line with the Risk-Based Supervision Guidelines, in particular: (i) when testing the application of AML/CFT policies and procedures, including the application of group-wide AML/CFT policies and procedures, where applicable; (ii) when issuing findings related to failures to comply with the group-wide AML/CFT policies and procedures, where applicable; (iii) when carrying out on-site inspections; (iv) the ML/TF risk profile; (b) the conduction of (joint) on-site inspections in another Member State; (c) the examination of suspected, attempted or committed breaches of AML/CFT obligations or shortcomings in the internal governance arrangements; (d) sanctions or measures imposed, for example when considering the impact of sanctions for breaches of AML/CFT obligations; and (e) emerging or crystallised ML/TF risks. Guideline 10: Procedures for requesting and providing mutual assistance 10.1 Permanent members and observers to the extent foreseen in their terms of participation annexed to the AML/CFT cooperation agreement may request mutual assistance, including supervisory cooperation and the exchange of information, from other permanent members and, to the extent foreseen in the terms of participation annexed to the AML/CFT cooperation agreement, observers.

AML/CFT COLLEGES GUIDELINES 31 10.2 The requesting permanent member should submit its request in writing to the other permanent members (or observers) and send a copy of that request to the lead supervisor within 3 working days of the day that the requesting permanent member (or observer) sent the request. 10.3 The request should set out which information or type of mutual assistance is requested and the reason for the request. In exceptional circumstances where an oral request is made, it should be followed up with a written confirmation as soon as practicable. 10.4 When receiving a request for mutual assistance from a permanent member or an observer, the requested permanent member should provide the assistance required, including information about its ML/TF risk assessment, without undue delay and in a comprehensive fashion. Should the requested permanent member refuse to act on a request for assistance, it should explain its reasons for so doing and, wherever possible, highlight alternative ways to obtain the assistance requested. 10.5 Where information is not available in the language specified in the written cooperation and information-sharing agreement, the requested member should consider providing a summary in the language of the college. Guideline 11: Confidentiality restrictions and permissible uses of information Non-public information 11.1 All permanent members in an AML/CFT college should keep any non-public information obtained in that college confidential. Non-public information includes requests for mutual assistance. 11.2 Where a permanent member receives a request for mutual assistance from a competent authority that is not a permanent member or observer in that AML/CFT college, and responding to that request would necessitate the disclosure of non-public information obtained in the AML/CFT college context, the permanent member who received the request should: (a) consult with those permanent members or observers from which the information that is subject to the disclosure request originated and with the lead supervisor; (b) refrain from disclosing non-public information unless it has obtained the written agreement fromthe permanent members and/or observersfrom which the non-public information originated;

AML/CFT COLLEGES GUIDELINES 32 (c) refrain from disclosing, to the extent permitted, non-public information if the permanent members and/or observersfrom which the information originated consider that disclosure is not warranted. In those cases, the requested permanent member should ask the requesting competent authority to consider withdrawing its request for mutual assistance or amend it in such a way as to eliminate the need for the disclosure of non-public information. 11.3 Where the transmission of confidential information obtained in the AML/CFT college to an invited participant is permissible under the applicable law and such transmission is proposed, the lead supervisor should obtain explicit prior consent from the permanent members or observers that provided such information to the AML/CFT college. Where the applicable law requires that such transmission can only be made if the invited participant is subject to a specific professional secrecy requirement, the lead supervisor should assess whether the requirement is met and attach the assessment to the request for prior consent referred to in the first sentence of this paragraph. The invited participants should sign a confidentiality agreement that ensures that any confidential information discussed at the college meeting may not be disclosed to any person or entity outside the AML/CFT college unless required and permitted by law. 11.4 The lead supervisor should ensure that confidential information is always exchanged within the AML/CFT college through secure channels, unless such information is exchanged during the college meeting. 11.5 The exchange of information between the lead supervisor, permanent members and observers has to be in compliance with the applicable laws governing data protection. 12 Permissible uses of information 11.6 Permanent members should use the information obtained in the AML/CFT college, without prior consent, for the purposes set out in Article 57a of Directive (EU) 2015/849 and particularly in order to: (a) ensure that the firm operating on a cross-border basis or EU establishments comply with the provisions of Directive (EU) 2015/849; or (b) inform their ML/FT risk assessment of the sector. 11.7 If a permanent member decides to disclose the information obtained in the AML/CFT college for any purpose other than those set out in Directive (EU) 2015/849 or specified in these

12 For national authorities Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC and national implementing laws of this Regulation, and for the Union institutions bodies, offices and agencies Regulation (EU) 2018/1725. of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the institutions, bodies, offices and agencies of the Union and to the freedom circulation of this data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002 / EC.

AML/CFT COLLEGES GUIDELINES 33 guidelines, it should obtain prior written consent from the permanent members or observers from which the information originated or that may be affected by the information disclosure. Guideline 12: Common approach 12.1 Permanent members should agree on a common approach to ensure that the firm operating on a cross-border basis and its cross-border establishments or EU establishments comply with the provisions of Directive (EU) 2015/849 and are supervised consistently in all jurisdictions. 12.2 In certain circumstances, two or more permanent members may agree on a common approach. For example: (a) where an issue relates only to a cross-border or EU establishment in one Member State, it may be sufficient for the permanent member responsible for the supervision of that establishment and the lead supervisor toagree on the common approach; or (b) where an issue relatesto the firm’s or cross-border or EU establishment’s application of group-wide policies and procedures, an agreement on the common approach between all permanent members may be more appropriate. 12.3 Where permanent members agree that a common approach is needed to resolve the issue but an agreement cannot be reached on how it should be applied, the lead supervisor’s decision prevails. 12.4 Permanent members should commit to applying the approach described in Guidelines 12.1 and 12.2 in practice where this approach does not prejudice the powers and obligations conferred to them by virtue of their respective national laws. 12.5 Where a permanent member has agreed to follow the common approach and fails to act in accordance with the approach, other permanent members should contact the responsible European supervisory authority. Guideline 13: Coordinated supervisory action(s) 13.1 The common approach described in Guideline 12 can lead to a coordinated supervisory action, which may include coordinated or joint inspections by some or all permanent members. When deciding whether to carry out a coordinated supervisory action, permanent members should have regard to: (a) the nature and level of the ML/TF risk that the joint action is designed to assess or mitigate;

AML/CFT COLLEGES GUIDELINES 34 (b) the specific risks or legal or regulatory provisions that form the subject matter of coordinated action, and any differences in the applicable legal and regulatory framework; (c) the supervisory resources available and the planned allocation of supervisory resources. 13.2 If a coordinated action is agreed on, participating permanent members should set out in writing at a minimum: (a) the permanent member that is responsible for coordinating anaction, if necessary; (b) an action plan, including the nature and type of coordinated action to be taken by each permanent member, the timing of the work to be undertaken by each permanent member and the modalities of information exchange, including the sharing of information gathered during, and as a result of, the coordinated action; (c) the options for coordinated follow-up, if any, including, where applicable, coordinated enforcement action. Guideline 14: Bilateral relationships 14.1 In order to structure their relationships where an AML/CFT college has not been established, competent authorities should apply processes that facilitate effective and efficient cooperation and information exchange with other competent authorities, supervisory authorities from third countries where feasible and prudential supervisors through bilateral relationships. To that effect, competent authorities should apply where appropriate the provisions set out in: (a) Guideline 9 in relation to the scope of mutual assistance; (b) Guideline 10 in relation to the process of mutual assistance; (c) Guideline 11 in relation to the permissible uses of information; and (d) Guidelines 12 and 13 in relation to a common approach and coordinated supervisory actions. 14.2 Where, in accordance with Article 57a(2) of Directive (EU) 2015/849, the competent authoritieshave signed anagreement with the European Central Bank, they should also refer to that agreement for practical modalities of cooperation and exchange of information between them.

AML/CFT COLLEGES GUIDELINES 35 Guideline 15:Conflict resolution 15.1 Any conflict, arising from the application of these guidelines, between permanent members and observers, including where an AML/CFT college is not established or a request for mutual assistance has been declined or not fully satisfied, should be referred to the European supervisory authorities by all competent authorities involved. Guideline 16: Transitional period 16.1 The lead supervisor should make every effort to establish as soon as possible an AML/CFT college for all firms, cross-border and EU establishments that meet the conditions set out in Guideline 2. It should first establish colleges for those firms assessed as high risk for ML/TF purposes in line with the Risk-Based Supervision Guidelines and ensure that colleges for all other eligible firms be established within 2 years of the date of application of these guidelines. 16.2 During this transitional period, competent authorities should inform the EBA of any issues encountered in the application of these guidelines.

AML/CFT COLLEGES GUIDELINES 36 Annex I – Mapping templates [this template should be used when mapping firms with cross-border establishments, which are authorised in your Member State and which have cross-border establishments in other Member States] Name of the firm Type of firm ML/TF risk rating Legal identifier, if relevant Member State or a third country where a firm is operating a cross￾border establishment Type of cross-border establishment Does the firm require an AML/CFT college? [this template should be used when mapping cross-border establishments, which operate in the Member State, of a firm established in another Member State] Name of the cross-border establishment operating in the Member State Type of firm ML/TF risk rating of the cross-border establishment Legal identifier, if relevant Member State where the head office is located How the firm is operating in your Member State (a branch, a subsidiary, etc.) Does the EU cross￾border establishment require an AML/CFT college? Where the AML/CFT college is required, record the name and location of the lead supervisor

AML/CFT COLLEGES GUIDELINES 37 [This template should be used when mapping EU establishments of third-country undertakings, which operate in the Member State.] Name of the EU establishment Type of firm ML/TF risk rating of the EU establishment Legal identifier, if relevant Name of the third￾country undertaking Country where the third-country undertaking’s head office is located How the EU establishment is operating in your Member State (a branch, subsidiary, etc.) Other EU establishments related to the same third￾country undertaking Total value of assets of the EU establishment operating in your Member State The level of ML/TF risk associated with the EU establishment in your Member State Does the EU establishment operating in your Member State require an AML/CFT college?

AML/CFT COLLEGES GUIDELINES 38 Annex II – AML/CFT cooperation agreement template AML/CFT cooperationand information-sharing agreement (the ‘agreement’) of the supervisory AML/CFT college (the ‘AML/CFT college’) established for [Record the name of the firm operating on a cross-border basis or the EU establishment] (the ‘firm’) i. Introduction [Record the name of the competent authority] as the lead supervisor (the ‘lead supervisor’) has established this AML/CFT college in accordance with Articles 48(4), 48(5), 49, 50(a) and 57(a) of Directive (EU) 2015/849. The lead supervisor in its ML/TF risk assessment has classified the firm as [record the ML/TF risk rating] for ML/TF risk purposes. The purpose of this AML college is to ensure the cooperation of, and information exchange between, the permanent members and observers identified in section II of this agreement. This AML college will operate in line with this agreement, which will be reviewed and updated regularly according to the rules set out in the ESAs’ guidelines on the cooperation and information exchange for the purposes of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (the ‘AML/CFT Colleges Guidelines’). ii. Identification of permanent members and observers a. Description and structure of the firm [Please insert a structure chart and/or a short description of the firm. A detailed description of the firm should be enclosed in Appendix I to this agreement.] b. Identification of permanent members As a result of themapping exercise carried out by the lead supervisor and in line with Guideline 5 of the AML Colleges Guidelines, the lead supervisor has identified the following permanent members who are required to participate in the AML college: [Insert a list of all permanent members] Contact details of all permanent members are enclosed in Appendix II attached to this agreement.

AML/CFT COLLEGES GUIDELINES 39 c. Identification of observers The lead supervisor has carried out a mapping exercise and, in line with Guideline 5 of the AML Colleges Guidelines, has identified observers for the AML college. After receiving a confirmation from the observers that they will abide by the Terms of the Participation of observers enclosed in the Appendix III to this agreement, the lead supervisor has invited the following observers to participate in the AML college: [Insert a list of all observers] The lead supervisor considers that these observers have a particular interest in the matters related to the firm, which will be discussed at the AML/CFT collegemeetings, including: [Include a list of topics] [Record the name of the supervisory authority] is a third-country supervisory authority that has been invited to participate in the AML college as an observer because [In relation to sections a) or b) below, please delete the section that is not relevant] a) the lead supervisor considers the confidentiality regime of the supervisory authority in the third country to be equivalent to that of the competent authorities; or b) the lead supervisor considers the confidentiality regime of the supervisory authority in the third country not to be equivalent to that of the competent authorities and therefore limits the observer’s participation to the following sessions where no confidential information is disclosed: [Include a list of sessions] [Include the following condition only where the permanent members have agreed that observers should attend only particular sessions of the college meeting] iii. Participation in the AML college meetings The lead supervisor and permanent members of the AML college will ensure that the most appropriate representatives participate in the college meetings and activities, based on the topics to be discussed and objectives to be pursued. Those representativeswill have the power to commit their authorities as permanent members, to the maximum extent possible for the decisions planned to be taken during the AML college meetings or activities.

AML/CFT COLLEGES GUIDELINES 40 The lead supervisor, in consultation with permanent members, will invite other participants to attend a particular session of the AML college meeting in accordance with Guideline 5 of the AML Colleges Guidelines, where necessary. iv. Scope and framework for requesting mutual assistance Permanent members will follow the process for requesting and providing mutual assistance set out in the AML Colleges Guidelines. Permanent members will provide the fullest mutual assistance to other permanent members and observers, where feasible, in any matters relevant to the AML/CFT supervision of the firm and at least in matters described in the AML Colleges Guidelines. vii. Treatment of confidential information In accordance with Article 48(2) of Directive (EU) 2015/849, all permanent members will treat the information received under this agreement and in the context of the AML college as confidential and in compliance with applicable data protection rules. Permanent members will use the confidential information received in the context of the AML college only in the course of their duties and only for the purposes specified in the AML Colleges Guidelines. The permanent members will disclose the information obtained as part of the AML college to parties other than permanent members and observers, where appropriate, only in a manner described in the AML Colleges Guidelines. viii.Common approach and coordinated action Permanent members will refer to the AML Colleges Guidelines when agreeing on a common approach or coordinated actions. The lead supervisor will take all necessary steps to ensure the application of a common approach when agreed between two or more permanent members, where it does not prejudice the powers and obligations conferred to these members by virtue of their respective national laws. ix. Conflict resolution Any conflicts between permanent members and observers, where relevant, will be resolved in accordance with the AML Colleges Guidelines.

AML/CFT COLLEGES GUIDELINES 41 x. Final provisions for the written coordination and cooperation arrangements Permanent members will honour the arrangements laid down in this agreement. In case of discontinuation of membership by a permanent member or an observer, the lead supervisor, in consultation with permanent members, will revise this agreement accordingly. The language of communication within the AML college is [name the language]. This document should not be published. Date: On behalf of the [lead supervisor] Name: Position: Signature:……………………………………………… Date: On behalf of [Competent authority] Name:…………………………………… Position:………………………………… Signature:.……………………………………………… Appendix I – The firm’s structure [include here a detailed description of the firm’s structure or the organisational chart] Appendix II – Contact list Last updated: Status Authority Contact details Phone number Email address [record whether permanent member or observer] [record the name of the competent/supervisory authority or ESAs] [record the name and job title of the contact person at the authority] [record the contact person’s phone number] [record the contact person’s email address] Appendix III – Individual Terms of the Participation of observers [The Terms of Participation, which will be concluded by permanent members with the individual observers, should become annexes of the cooperation and information-sharing agreement, i.e. AppendicesIII.1, III.2, etc., depending on the number of observers in the college. For each observer there should be individual Terms of Participation defining its involvement in the AML college activities and its interactions with permanent

AML/CFT COLLEGES GUIDELINES 42 members and other observers in the context of the AML college (unless agreed otherwise by the college members and the observers).]

FINAL REPORT ON AML COOPERATION GUIDELINES 43 4. Accompanying documents 4.1. Draft cost–benefit analysis/impact assessment Directive (EU) 2015/849 aims, inter alia, to bring European Union legislation in line with the International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, which the FATF, an international AML/CFT standard setter, adopted in 2012. In contrast to other EU legal texts, Directive (EU) 2015/849 does not set out in detail how the competent authorities from different Member States should cooperate and exchange information. In the absence of detailed provisions in Directive (EU) 2015/849 and specific references to cooperation and information exchange for supervision purposes in most other EU legal texts, the Commission, the Council and the European Parliament have amended Directive (EU) 2015/849 by introducing new Articles50a and 57a, which now explicitly require competent authorities to exchange information and cooperate. A. Problem identification Despite being helpful in setting the tone for cooperation among competent authorities, the amended Directive (EU) 2015/849 does not go far enough towards achieving the intended levels of cooperation and information exchange, as the directive does not set out in detail how this should be achieved. The three ESAs have therefore arrived at the conclusion that, in order to improve supervisory cooperation within the EU, it would be beneficial to issue a set of guidelines that establish a formal framework for such cooperation and information exchange. With these guidelines, the ESAs consider that such a framework should evolve around AML/CFT colleges, similar to the model adopted by prudential supervisors. These guidelines require the setting up of AML/CFT colleges for firms operating on a cross-border basis in at least three jurisdictions. The purpose of AML/CFT colleges is to provide a forum for competent authorities responsible for the supervision of the same firm in different jurisdictions to collaborate and exchange information with the view to building a common understanding of the ML/TF risks associated with this firm. This would inform their approach to the AML/CFT supervision of this firm, coordinate supervisory action, where appropriate, and formalise the process for bilateral exchanges of information between competent authorities. B. Policy objectives The strategic objective of the guidelines is to move towards the improved harmonisation of the supervisory framework, i.e. creating a framework comprising equivalent supervisory practices across the EU. The operational objective when creating this framework is to promote a common understanding among competent authorities across the EU. A common understanding is essential

FINAL REPORT ON AML COOPERATION GUIDELINES 44 to ensure the consistent interpretation and application of Union law and is conducive to a stronger European AML/CFT regime. At the same time, the ESAs are clear that guidelines need to leave sufficient room for the competent authorities to define their approach in a way that is commensurate with the ML/TF risk they are exposed to. C. Baseline scenario Article 57a of Directive (EU) 2015/849 requires competent authorities to exchange information and cooperate with each other to the greatest extent possible; however, there is no explanation given in the directive of how this could be achieved in practice. This impact assessment assesses the advantages and disadvantages of different options considered by the ESAs on how to address the absence of detailed provisions in Directive (EU) 2015/849. The impact assessment also evaluates the magnitude of potential costs associated with each option. Given the low impact anticipated in monetary terms, the cost–benefit analysis section assesses only the high-level impact on the operational cost of fully implementing the guidelines. D. Options considered The ESAs considered various options of how to foster the cooperation and information exchange between competent authorities as described below. Option 1: in the absence of guidelines, rely on the relevant provisions of AMLD5 (the ‘do nothing’ option) There is no explicit mandate given to the ESAs in the AMLD for drafting guidelines on cooperation and information exchange between competent authorities. In line with Article 57a of AMLD5, competent authorities are required to cooperate with each other to the greatest extent possible, regardless of their respective nature and status. In the absence of guidelines, competent authorities will engage bilaterally with each other on an ad hoc basis.  The advantage of this option is that it does not require any material changes to the competent authorities’ current practices and competent authorities can continue to engage bilaterally on an ad hoc basis.  The disadvantages of this option are that, in the absence of a framework that structures cooperation and information exchange, it is evident that in practice the majority of competent authorities are not cooperating and, even where the cooperation is taking place, it has rarely achieved the desired results, as competent authorities cooperate with each other and exchange information only after the ML/TF risk has already crystallised. There are various reasons why competent authorities are failing to cooperate, including: o a lack of interest or prioritisation;

FINAL REPORT ON AML COOPERATION GUIDELINES 45 o competent authorities being unable to identify their counterpart due to differences in the way AML/CFT supervision is organised in different Member States; o actual or perceived legal obstacles. Option 2: AML/CFT is discussed as part of the existing colleges of prudential supervisors (‘prudential colleges’) framework Prudential supervisors of banking groups that operate on a cross-border basis are required to set up colleges of prudential supervisors (prudential colleges) in line with the implementing technical standards (ITS) on the operational functioning of the colleges of supervisors according to Directive 2013/36/EU. This framework provides that AML/CFT matters can be discussed as part of prudential college meetings or that an AML/CFT substructure can be set up as part of the college.  The advantage of this option is that it allows the ESAs to establish a clear link between prudential and AML/CFT supervisors and that the mapping has already been carried out.  The disadvantagesof this option are as follows: o Prudential colleges are required only for banking groups, which would mean that a different, parallel process would need to be established for the information exchange between competent authorities in other sectors, for example for payment institutions. o Where the bank is under direct supervision of the Single Supervisory Mechanism, prudential colleges are only required where the bank has operations outside the eurozone. This means that those banks that have branches and subsidiaries in other Member States within the eurozone do not require a prudential college and there would need to be a parallel process established for the information exchange between competent authorities responsible for the supervision of those significant banking groups. o AML/CFT substructures that already exist in some prudential colleges have yielded mixed results. o It is evident that often AML/CFT discussions as part of the prudential colleges happen retrospectively, after the ML/TF risk has already crystallised, and considering that participants ofthe prudential colleges are not AML/CFT specialists, they are unable to challenge the issues presented to them in any meaningful way. Option 3: the ESAs draft guidelines on their own-initiative The ESAs draft guidelines that establish a formal framework for cooperation and information exchange among competent authorities through either bilateral engagements or AML/CFT colleges and set out the process for the establishment and functioning of these colleges.  The advantages of this option are as follows: o the guidelines require that specialist AML/CFT supervisors participate in college meetings to ensure that ML/TF issues and risks associated with a particular firm or group are sufficiently discussed and challenged if needed; o the guidelines provide that AML/CFT college meetings are held regularly; however, the frequency and form of these meetings is determined by the ML/TF risk

FINAL REPORT ON AML COOPERATION GUIDELINES 46 associated with the firm, so that the ML/TF risks can be identified and mitigated before they have crystallised; o the guidelines provide that in certain circumstances where competent authorities cannot come to an agreement they can refer the matter for mediation by the ESAs; and o the mapping of firms to establish whether the AML/CFT college is required will allow the competent authorities to develop a holistic view of firms operating in their jurisdiction and to develop a better understanding of ML/TF risks associated with each sector.  The disadvantage of this option is that it may potentially create more work for competent authorities in the short term, particularly for those competent authorities that do not yet have a good understanding of the firms operating in their jurisdictions and the ML/TF risks associated with these firms. However, the risk‐based approach incorporated in these guidelines will ensure that, in the medium term, any additional workload remains proportionate to the ML/TF risk. E. Cost–benefit analysis Each of the options listed above would result in both benefits and costs for competent authorities. The benefits identified will be realised on an ongoing basis assuming that all Member States adopt the guidelines. These benefits mostly relate to a reduction in unstructured communications among competent authorities, which will save competent authorities’ resources in the long term. The operational cost arises from the implementation of the guidelines, which is mostly a one-off cost that will materialise when competent authorities implement the guidelines. The cost includes the training of the competent authorities’ staff and of dedicating resources to digesting the processes set out in these guidelines. Overall, the net impact of the implementation of the three options is the summarised below. Option considered Benefit Cost Net impact Option 1 (‘do nothing’) zero Option 2 (‘do nothing – prudential colleges’) low zero zero Option 3 high medium low (positive)

FINAL REPORT ON AML COOPERATION GUIDELINES 47 Option considered Benefit Cost Net impact 1st-year cost: medium to high Consecutive years: low The costs and benefits of Options 1 and 2 cancel each other out, producing a zero net impact. The implementation of Option 3 produces a high level of benefits because it will save resources due to the standardisation of processes and potentially more targeted supervisory actions, which will lead to the improvement of the quality and efficiency of the tasks performed by the competent authorities. F. Preferred option After taking into account the qualitative assessment (advantages/disadvantages) provided in Section D and the cost–benefit analysis of Section E, the ESAs’ preferred option is Option 3. The preferred option yields a positive net impact and provides a clear framework for cooperation and exchange of information among competent authorities, enabling them to mitigate any ML/TF risks before they have crystallised. Thus, it serves the operational objective set by the present guidelines. In the long term, this option could potentially reduce ML/TF vulnerabilities within the internal market and increase the effectiveness of AML/CFT supervision within the EU. When implementing Option 3, competent authorities can build on the mapping already carried out by adding additional relevant information to it. In order to obtain this additional information, the competent authorities can use various sources of information, including the information from public registers of authorised firms. These guidelines encourage cooperation and information exchange between AML/CFT and prudential supervisors, particularly consolidating supervisors that are responsible for setting up prudential colleges for banks and that therefore have already carried out the mapping exercise. G. Pilot test of the mapping exercise The results of the cost–benefit analysis for Option 3 are also supported by the results from a pilot test of the mapping exercise that was carried out by two competent authorities (competent authority I and competent authority II). Both pilot tests focused only on the mapping of credit institutions, including branches and subsidiaries established in their Member State from third countries. Nonetheless, they provide a useful insight into what will be required of competent authorities to ensure the implementation of these guidelines. This is summarised below. Population of banks

FINAL REPORT ON AML COOPERATION GUIDELINES 48 Competent authority I (CAI) Competent authority II (CAII) Population of banks 48 banks – authorised by CAI; 45 branches – with a head office in an EEA country; 3 branches – with a head office in a third country. 59 banks – authorised by CAII; 2 banks – saving banks; 63 banks – credit cooperative banks; 79 branches – with a head office in an EEA country; 4 branches – with a head office in a third country. Population of banks that will require a college 15 banks where the CAI will be required to establish an AML/CFT college; and 45 branches of banks with a head office in an EEA country – the CAI will potentially be required to attend an AML/CFT college as a permanent member. 6 banks where the CAII will be required to establish an AML/CFT college; and 15 branches of banks with a head office in an EEA country – the CAI will potentially be required to attend an AML/CFT college as a permanent member. Resources and time commitment In relation to resources, both competent authorities confirmed that it took them approximately 2 weeks to complete the mapping exercise and it involved a number of different people working on it simultaneously. Overall, the mapping process involved discussions among staff, data selection, combining data with risk profiles and assessing those data. CAI estimated that it would take approximately 3 days to complete the mapping for each sector with three or four people working on it at the same time. Availability of information Both competent authorities confirmed that most information (approximately60%) related to banks that were authorised by them was freely available either from their own activities or from public registers. CAI highlighted that the most challenging part of the mapping exercise was deciding on the exact data that were required to perform the mapping. Once this was clear, it was easy to extract these data from the public register. Yet, both competent authorities found it challenging to gather information about branches of banks operating in their jurisdiction with a head office in another EEA state or in a third country. 4.2 Feedback on the public consultation

1. The ESAs publicly consulted on the draft AML/CFT colleges guidelines over a 3-month period, from November 2018 to February 2019. A public hearing was held on 20 December 2018. Altogether, nine responses were received.
2. In December 2018, the Council of the European Union published an AML/CFT action plan. In the Council’s view, better cooperation and information exchange between prudential and

FINAL REPORT ON AML COOPERATION GUIDELINES 49 AML/CFT supervisors are central to strengthening the EU’s AML/CFT defences. Consequently, the Council explicitly supported the publication of these guidelines. 3. The ESAs thank all respondents for taking the time to reply and for the constructive and positive feedback they received. The ESAs have carefully considered all responses and revised the guidelines where appropriate. Summary of key issues and the ESAs’ response are summarised below. 4. Most respondents welcomed these guidelines. Respondents agreed that these guidelines would improve cooperation and information exchange between competent authorities and welcomed the clarification of practical modalities for such cooperation and information exchange. They also agreed with the conditions for establishing an AML/CFT college. Some respondents welcomed the fact that, in their view, these guidelines would contribute to increasing supervisory convergence across the EU. 5. Where respondents raised concerns, these were related to a perceived duplication of processes, the resources that competent authorities might need to implement these guidelines and confidentiality provisions applicable to invited participants in the AML/CFT college. Duplication of processes 6. Some respondents questioned whether existing prudential college structures should be used instead of establishing AML/CFT colleges. They were concerned that the establishment of stand-alone AML/CFT colleges would lead to a duplication of processes. 7. The ESAs’ decision to issue guidelines on supervisory cooperation and information exchange in the AML/CFT context is based on a careful analysis of supervisory cooperation practices and an assessment of the extent to which existing cooperation channels can be used by competent authorities responsible for the AML/CFT supervision of the same firm to cooperate and exchange information on that firm. As part of this, the ESAs assessed the extent to which prudential colleges are being used, and could be used, for this purpose. This assessment was included in the consultation version of these guidelines. 8. The ESAs found that existing cooperation channels are not enough to foster effective and efficient cooperation practices and information exchange. Prudential colleges do not exist for all firms that operate on a cross-border basis and are subject to Directive (EU) 2015/849, and, where they exist, evidence suggests that they have failed to prevent major AML/CFT scandals or failed to enable AML/CFT or prudential competent authorities to intervene in good time before ML/TF risks have crystallised. This is at least in part because AML/CFT supervisors that are not also prudential supervisors are not members of prudential colleges, and because the focus of prudential colleges is on ensuring the firm’s safety and soundness, which means that, in most cases, AML/CFT issues have been addressed only once ML/TF risks have crystallised. The impact assessment accompanying the public consultation document has further details on this point.

FINAL REPORT ON AML COOPERATION GUIDELINES 50 9. The ESAs are mindful of the need to avoid duplication and to streamline processes where possible to ensure a proportionate and effective approach. Consequently, these guidelines build on existing processes, structures and information where these exist to create a permanent framework to foster cooperation and information exchange between competent authorities that are responsible for the supervision of the same firm or group of firms. The ESAs have also reviewed the guidelines to adjust the terminology used in line with that of relevant provisions in EU law, most importantly the AMLD and the CRD/Capital Requirements Regulation (CRR). Resources 10. Some respondents were concerned about the resources required to implement these guidelines, particularly when establishing colleges and, in some cases, throughout the life of these colleges. For Member States with a large number of firms operating on a cross-border basis, the extent of additional resources needed to set up and maintain AML/CFT colleges could be significant and some respondents considered that more flexibility should be given to the lead supervisor to determine the frequency and form of the college meetings. 11. These guidelines create a new framework for cooperation and information exchange between the competent authorities across the EU, and some resources will be required to implement this framework. To ease the burden on competent authorities, these guidelines highlight where supervisors can draw on information that is already available to support their implementation of these guidelines. 12. In line with the risk-based approach set out in Directive (EU) 2015/849 and the ESAs’ own Risk￾Based Supervision Guidelines, these guidelines require that the form and frequency of college meetings be determined by the ML/TF risk presented by a firm. For example, the guidelines require that AML/CFT colleges are set up for all firms that meet the conditions set out in Guideline 2, but the guidelines leave it to the lead supervisor, together with permanent college members, to determine the frequency with which college meetings will take place. 13. Furthermore, as set out in the impact assessment accompanying the consultation version of these guidelines, the introduction of standardised processes for cooperation and information exchange in the AML/CFT context will increase the type and quality of information that competent authorities have at their disposal. As a result, the resources needed to establish and maintain AML/CFT colleges are likely to be offset in the medium term by efficiency gains and by targeted more effective AML/CFT supervision. Confidentiality of non-public information 14. Respondents expressed divergent views on the confidentiality requirements applicable to invited participants where non-public information is exchanged within the AML/CFT college. Some respondents considered the draft provisions to be sufficiently robust while others found them to be too weak and called for amendments to the draft guidelines. One respondent considered the confidentiality requirements to be too strict; this respondent suggested that

FINAL REPORT ON AML COOPERATION GUIDELINES 51 the disclosure of non-public information should be allowed to certain types of invited participants, such as FIUs and law enforcement agencies, as they may benefit from it. 15. The ESAs have aligned the confidentiality requirements applicable to all participants in AML/CFT colleges with the requirements set out in Directive (EU) 2015/849 and other EU laws, including the Capital Requirements Directive.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 52 Summary of responses to the consultation and the ESAs’ analysis Comments Summary of responses received ESAs’ analysis Amendments to the proposals General comments Resources Most respondents expressed their support for the guidelines. While the respondents consider the AML/CFT colleges to be an important tool that would enhance the cooperation between the competent authorities (CAs) going forward, they are also concerned about the need for increased resources at CAs to implement these guidelines. It was also suggested by one respondent that the implementation of these guidelines may potentially delay the CAs’ inspection plans. With these guidelines, the ESAs put in place a formal framework to ensure that CAs responsible for the supervision of a firm’s compliance with AML/CFT obligations can cooperate with each other and with prudential competent authorities. These guidelines also aim to enhance CAs’ cooperation with FIUs and authorities in third countries where relevant. The need for such guidelines was recognised by the ESAs in light of recent events, which confirmed that cooperation between CAs was not effective and that AML/CFT issues have not been sufficiently and appropriately addressed by CAs within the current framework. The ESAs acknowledge that creating a new framework means thatsome tasks may be time￾consuming and labour-intensive at the start, such as the mapping of firms and establishing colleges. However, the workload will decrease at later stages of the implementation. To recognise this, the guidelines envisage a 2-year transition period for their full implementation. Furthermore, in line with the risk-based approach, the ESAs provide that competent authorities can also use existing information No change.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 53 Comments Summary of responses received ESAs’ analysis Amendments to the proposals where it exists for AML/CFT colleges purposes, including the mapping of firms. As regardsthe suggestion that other supervisory activities may be neglected due to the implementation of these guidelines, Article48 of Directive (EU) 2015/849 is clear that to supervise effectively, CAsmust ensure that they have adequate human resources to perform their functions. Duplication of processes Some respondents raised concerns about potential duplication of processes. The aim of these guidelines is not to duplicate existing processes but to instead encourage competent authorities to use information and existing structures where possible. For this reason, these guidelines require a close cooperation between the lead supervisor in the AML/CFT colleges and the chair of colleges of prudential supervisors. No change. Definitions (previously ‘Scope of application’) A clarification was sought by one respondent on the interpretation of the term ‘other forms of establishment’ used in the draft guidelines. In particular:  whether ‘other forms of establishment’might include intermediaries involved in the distribution of funds (e.g. tied agents, introducing brokers and any other forms of externally registered representatives of the firms,such as a representative office);  whether servicing clients on a cross-border basis, falls under the ‘other form of In light of the questions raised by the respondent, the ESAs have included additional definitions in the guidelines that explain better the types of establishments that will require an AML/CFT college. The new definitions are for the ‘cross-border establishment’, ‘EU establishment’, ‘third-country undertaking’ and a ‘firm operating on a cross-border basis’. The term ‘other forms of establishment’ used in these draft guidelines has a meaning set out in Articles 45(2) and 48(4) of Directive (EU) 2015/849. This is now reflected in the Amendments to ‘Definitions’section.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 54 Comments Summary of responses received ESAs’ analysis Amendments to the proposals establishment’ definition (as funds do not operate branches or subsidiaries);  whether a collective investments undertaking having a fund manager, custodian, fund administrator, investment advisor in other Member States should be considered as ‘other form of establishment’;  whether selling shares/units of a fund or sub￾fund to another Member State client through the undertaking would be considered as ‘other forms of establishment’. definition of the ‘cross-border establishment’ and the ‘EU establishments’. Scope of the guidelines One respondent suggested that less prescriptive provisions should be included in the guidelines for the credit union sector. These guidelines are addressed to competent authorities that supervise credit and financial institutions as defined by Article3 of Directive (EU) 2015/849. As credit unions fall within the definition of financial institutions, the competent authorities responsible for the supervision of their compliance with AM/CFT requirements are required to comply with these guidelines. However, these guidelines require of an AML/CFT college that it is set up only when a financial institution is operating in three different Member States. Considering the nature of the credit unions’ business and that their aim is to serve the local community, it is very unlikely that a credit union would require the establishment of an AML/CFT college. No change.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 55 Comments Summary of responses received ESAs’ analysis Amendments to the proposals Proportionality One respondent suggested applying the proportionality principle when implementing these guidelines, particularly in relation to the investment firms sector (confidential response). The main objective of these guidelines is to enhance cooperation between supervisors responsible for the supervision of a firm operating across borders in different jurisdictions, regardless of the sector to which this firms belongs. However, proportionality is achieved through the application of a risk-based approach, as these guidelines envisage that the competent authorities’ focus when establishing and maintaining colleges will be on firms categorised as high risk for ML/TF purposes. Thereafter, the frequency and form of the college meetings is also largely determined by the ML/TF risk presented by a particular firm. No change. Timing One respondent suggested that the guidelines do not give sufficient time for permanent members to respond when expressing their agreement and disagreement within the AML/CFT college. There are a number of instances where these guidelines require the expression of views from the permanent members. When drafting these guidelines, the ESAs consulted with competent authorities to ascertain what constitutes a sufficient time frame in different circumstances and in most cases the competent authorities felt that the college members should be given flexibility when determining time frames and therefore the guidelines often referred to a ‘reasonable’ or ‘sufficient’ time. However, the ESAs have considered the suggestion made by the respondent and in an effort to streamline the process, have introduced a number of explicit timelinesin Guidelines 3 and 5. New deadlines introduced in Guidelines 3 and 5.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 56 Comments Summary of responses received ESAs’ analysis Amendments to the proposals Comments and responses in respect of each guideline Mapping of firms (Guideline1) Most respondents agree with the proposed approach to the mapping and consider it to be a vital part of the process for implementing the AML/CFT colleges framework. A mapping exercise is designed to help the competent authorities to establish which firms and cross-border and EU establishments under their supervision will require an AML/CFT college. The guidelines also provide that those CAs thathave already carried out mapping when designing their risk-based approach to supervision can use this mapping as a basis for the mapping required under these guidelines. No change. Conditions for establishing AML/CFT college (Guideline2) One respondent suggested that guidelines should allow some flexibility for CAs in cases where the criteria for establishing an AML/CFT college is de minimis, for example where a firm has only one branch in a third￾country jurisdiction. In accordance with these guidelines, CAs are required to establish an AML/CFT college if a firm is operating on a cross-border basis in at least three Member States. These guidelines do not require an AML/CFT college to be set up where a firm has operations only in third countries. Where a firm has cross-border establishments in both the EU and third countries, the number of EU countries in which the cross-border establishments are situated will determine whether an AML/CFT college is warranted. No change. One respondent was concerned about the firm’s geographical presence being the only condition that determines the need for an AML/CFT college and suggested the introduction of an element of proportionality, which would be particularly beneficial for non-banking supervisors. The respondent suggested that additional conditions are introduced The proportionality in these guidelines is achieved through provisions relating to the form and frequency of AML/CFT college meetings. The ESAs have considered the additional conditions suggested by the respondent and believe that the information required to fulfil these additional conditions is often not readily No change.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 57 Comments Summary of responses received ESAs’ analysis Amendments to the proposals that would determine the establishment of a college, such as the number of customers, total assets and a proportion of income attributed to the particular jurisdiction. available to AML/CFT competent authorities. As a result, such additional conditions may result in an unnecessary burden for them. One respondent suggested that guidelines should provide an option for an AML/CFT college to be set up, if warranted by the size and risk profile of the firm, even in circumstances where the conditions for establishing a college are not met, for example where a firm is operating on a cross-border basis in only two Member States. The ESAs are of the view that there are no provisions in these guidelines that would prevent competent authorities from establishing an AML/CFT college in circumstances where the conditions set out in Guideline2 are not met. However, in order for a CA to set up such a college, it would need to obtain an agreement from other prospective permanent members. No change. Establishing and maintaining AML/CFT college (Guideline3) Some respondents have raised their concerns about a disproportionate burden imposed by these guidelines on the lead supervisors, as they are responsible for establishing and maintaining the AML/CFT colleges as well as organising the college meetings. This may be quite time-consuming, particularly for those competent authorities that will be lead supervisors for a large number of AML/CFT colleges. The ESAs have based the AML/CFT colleges model on a framework for colleges of prudential supervisors of banks, which has been operational for many years and appearsto work well. They recognise the lead supervisor’s role in ensuring the implementation of a firm’s group￾wide policies and procedures in line with Article45 of the AMLD, which is why they are best placed to establish and maintain an AML/CFT college. In order to ease the burden on the lead supervisor, the guidelines allow the template of the written cooperation and information￾sharing agreement enclosed in Annex II to be used in all cases, unless permanent members

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 58 Comments Summary of responses received ESAs’ analysis Amendments to the proposals specifically request the lead supervisor not to do so. One respondent noted that there is a lack of coherence in the way competent authorities carry out their ML/TF risk assessments of firms, which may have an impact on the AML/CFT colleges framework. In line with the risk-based approach, these guidelines require that the establishment of AML/CFT colleges for high-risk firms and EU establishments should be prioritised. Also, the level of engagement between the college members is largely determined by the level of ML/TF risks, among other factors. The ESAs’ Risk-Based Supervision Guidelines 13 set out how this should be done. No change.

13 Joint Guidelines by the European supervisory authorities (JC 2016 72) on the characteristics of a risk‐based approach to anti‐money laundering and terrorist financing supervision, and the steps to be taken when conducting supervision on a risk‐sensitive basis (‘the Risk-Based Supervision Guidelines’), published 16 November 2016; available at: https://eba.europa.eu/documents/10180/1663861/Joint+Guidelines+on+Risk-Based+Supervision+%28ESAS+2016+72%29.pdf/7159758d-8337-499e-8b12-e34911f9b4b6

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 59 Cooperation between AML/CFT colleges and prudential supervisors (Guideline4) (the previous Guideline 4 on converting existing college structures into AML/CFT colleges was merged with Guideline 14 on cooperation between AML/CFT colleges and prudential supervisors) Some respondents raised concerns that AML/CFT colleges could add another layer and duplicate procedures and suggested that the existing prudential structures should be used instead. The ESAs have assessed alternative ways to facilitate cooperation and information exchange and have considered the possibility of using existing structures, including those developed for colleges of prudential supervisors. However, AML/CFT issues are not always a priority for colleges of prudential supervisors. The ESAs concluded that the objective of these guidelines cannot be achieved with prudential colleges alone. However, where the relevant structures already exist, such as AML/CFT substructures of prudential colleges, they can continue operating.With that in mind, the ESAs have merged Guideline 4 with Guideline 14. Guideline4 merged with Guideline 14.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 60 Comments Summary of responses received ESAs’ analysis Amendments to the proposals Composition of AML/CFT college (Guideline5) Most respondents agreed with the proposed composition of AML/CFT colleges; however, one respondent asked thatthe EBA clarifies the role of the ECB and competencies of prudential supervisory authorities within the AML/CFT colleges. The guidelines envisage that prudential supervisors, including the ECB, will be invited by the lead supervisor to attend the relevant AML/CFT colleges as observers. Their exact role and responsibilities will be set out in the Terms of Participation of observers prepared by the lead supervisor. However, the ESAs expect that prudential supervisory authorities will participate in the AML/CFT colleges and will exchange relevant information within the colleges, including the mapping carried out for the purposes of colleges of prudential supervisors and minutes from their college meetings where relevant topics are discussed. No change. One respondent suggested that it is a disproportionate burden on the lead supervisor to seek approval from all permanent members for every attendee at the AML/CFT college. These GLs consider the permanent members to be the main building block of the AML/CFT college framework. Therefore, in the ESAs’ view, the lead supervisor should be informed and make decisions related to all aspects of the AML/CFT college and its attendees, as it may have an impact on the confidentiality restrictions applicable to the permanent member. In order to ease the burden on the lead supervisor, the ESAs have amended Guideline5, which now requires the permanent member who proposes an observer to carry out an assessment of the confidentiality regime applicable to that observer. Guideline5 has been amended and requires that the permanent member who is proposing an observer to carry out the assessment of that observer’s confidentiality requirements.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 61 Comments Summary of responses received ESAs’ analysis Amendments to the proposals One respondent called for more clarity in relation to participants in the AML/CFT colleges. The respondent proposed that these guidelinesshould explicitly set out who can be invited and when. It was also suggested that relevant stakeholders should also be invited, subject to strict confidentiality requirements. The ESAs are mindful that these guidelines will need to be implemented across the EU by CAs operating under different legal frameworks. With this in mind, the ESAs have left the provisions on participants invited to the meetings of AML/CFT colleges sufficiently broad to ensure that the lead supervisor has flexibility when deciding who to invite. Therefore, these guidelines provide only examples, and not an exhaustive list, of who could be invited to attend certain meetings of the AML/CFT college and the ESAs have now extended this list of examples. In contrast, the guidelines explicitly set out the authorities that should be invited to participate as permanent members and observers for all AML/CFT colleges. The guidelines now go even further and provide that in certain circumstances the lead supervisor may invite additional authorities as observers. Minor amendments to Guideline 5. One respondent suggested that the lead supervisor may also consult the adequacy decisions published by the European Commission when considering to invite an observer to attend the AML/CFT college. The ESAs note that the European Commission has the power to determine, on the basis of Article45 of Regulation (EU) 2016/679, whether a country outside the EU offers an adequate level of data protection. The effect of such a decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary. The aim of these guidelines is to enhance the information exchange between permanent Guideline5 has been amended and requires that the lead supervisor or the permanent member carrying out an assessment of a potential observer should also refer to the European

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 62 Comments Summary of responses received ESAs’ analysis Amendments to the proposals members and observers. The ESAs intend that the widest scope of information is shared within the AML/CFT colleges, including certain personal information obtained as part of the suitability assessments of members of the management body. Therefore, the ESAs consider that a reference to the adequacy decisions published by the European Commission would be relevant in this context. Commission’s adequacy decisions. Contact lists (Guideline6) One respondent suggested that the onus should be on permanent members and observers to update the lead supervisor of any changes in their status. In line with the guidelines, the lead supervisor is responsible for compiling the contact list when establishing an AML/CFT college and sharing the list with all permanent members and observers. Thereafter, each permanent member and observer is responsible for notifying the lead supervisor of any changes to their contact details. As regards observers, their responsibilities should be set out in their Terms of Participation by the lead supervisor of a particular college. No change. AML/CFT college meetings (Guideline7) One respondent was concerned about the requirement to hold at least one annual meeting, as it may become a box ticking exercise and suggested that the lead supervisor should have flexibility to decide on the need for a meeting. Another respondent noted that annual physical meetings are not always appropriate or practical and suggested that the lead supervisor should be able to make a decision on whether a physical meeting is required. The ESAs consider permanent members to be the building blocks of the AML/CFT college, with a lead supervisor being one of those permanent members. Therefore, it crucial that all permanent members together decide on the frequency and form of the AML/CFT college meetings. Minor changes to the Guideline7 to clarify factors that should be considered by the lead supervisor and permanent members when deciding on the form and frequency

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 63 Comments Summary of responses received ESAs’ analysis Amendments to the proposals Considering the different sectors involved and varying size and complexity of firms and EU establishments that will require a college, the ESAs consider thatthe lead supervisor together with the permanent members are best placed to decide on the frequency of college meetings on a case-by-case basis, commensurate to the ML/TF risk presented by a firm operating on a cross-border basis or EU establishment. However, in line with the risk-based approach, the ESAs expectthat AML/CFT colleges for high￾risk firms meet more frequently than colleges for low-risk firms. of the AML/CFT college meetings. Written cooperation and information-sharing agreement (Guideline8) The establishment of a cooperation and information￾sharing framework was supported by a number of respondents. It was suggested that the template agreement could serve as a basis for this framework and that drafting of the agreement for a specific college should not become a time-consuming exercise for the lead supervisor. The ESAs are of the view that a template agreement attached in an annex to the guidelines is the least burdensome and most efficient tool. The guidelines envisage that the template agreement will be used as a default in all AML/CFT colleges unless permanent members request otherwise. No change. Mutual assistance (Guidelines 9 and 10) Respondents supported provisions around the common approach and coordinated actions between CAs set out in these guidelines and noted that it could potentially make the supervision more efficient. One respondent suggested that prior consultation with a firm, where practical, could also assist the cooperation. While the ESAs agree that CAs should engage with the firm, it should be done continuously as part of their supervisory activities. The aim of these guidelines is to improve cooperation between competent authorities that are involved in the supervision of firms operating on a cross-border basis and EU establishments. These guidelines do not prescribe how No change.

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 64 Comments Summary of responses received ESAs’ analysis Amendments to the proposals competent authorities should carry out their supervision of these firms, as this is already addressed in the ESAs’ Risk-Based Supervision Guidelines. 14 As regards the AML/CFT colleges, these guidelines envisage that the firm can be invited to participate in a particular college meeting as determined by the lead supervisor and permanent members (refer to GL5). Confidentiality restrictions (Guideline11) Respondents had differing views when it comes to the confidentiality provisions set out in these guidelines. Some considered these provisions to be reasonable but some requested more clarity in relation to the confidentiality requirements, particularly those applicable to invited participants. Confidentiality restrictions applicable to permanent members, observers and invited participants in the AML/CFT colleges are set out in Article57a and 57b of Directive (EU) 2015/849 and other relevant EU law. Guideline11 has been amended to include all relevant confidentiality provisions from across the guidelines. One respondent enquired whether there were any potential data protection requirements applicable to the information exchanged in AML/CFT colleges. These guidelines envisage that certain personal data may be exchanged within the AML/CFT colleges. Where personal data or information are exchanged, competent authorities within the EU are obliged to comply with Regulation (EU) 2016/679 and EU institutions, bodies, offices and agencies are obliged to comply with Regulation (EU) 2018/1725 when processing personal data. Guideline11 has been amended to include clarification on the applicable data protection obligations.

14 Joint guidelines by the European supervisory authorities (ESAs 2016 72) on the characteristics of a risk‐based approach to anti‐money laundering and terrorist financing supervision, and the steps to be taken when conducting supervision on a risk‐sensitive basis, published on 16 November 2016; available at https://eba.europa.eu/regulation-and-policy/anti￾money-laundering-and-e-money/guidelines-on-risk-based-supervision

RUNNING TITLE COMES HERE IN RUNNING TITLE STYLE 65 Comments Summary of responses received ESAs’ analysis Amendments to the proposals Furthermore, where personal data are processed for the purposes of the prevention of money laundering and terrorist financing, Article43 of Directive (EU) 2015/849 states that such processing is considered a matter of public interest when done on the basis of the Directive. Common approach (Guideline12) One respondent suggested deleting ‘and has not provided any valid explanation’ in GL 12.5 because the current wording could lead to a false belief that permanent members of AML/CFT colleges could have valid grounds for inactivity. In the ESAs’ view, there should be no reason for the permanent member not to act in accordance with the common approach they haveagreed to where such approach is in line with the permanent member’s national laws. Minor amendments to the Guideline 12.5. Conflict resolution (Guideline15; previously Guideline16) One respondent asked for stronger dispute resolution provisions. The respondent felt that the resolution of certain issues is mostly based on trust and a presumption that other members would step in when the competent authority fails to act. The respondent suggested that a formal process was needed for timely resolution of issues. The ESAs envisage that where disputes within the AML/CFT college arise, they are resolved between the lead supervisor, permanent members and observers. However, in circumstances where the dispute cannot be resolved within the college, they can be referred to the EBA. The EBA has a number of tools available, including mediation, that could be used to resolve the matter. An introduction of a specific timeframe has been added in relevant guidelines. Transitional period Guideline16; previously Guideline17) Most respondents agreed with the length of the transitional period and considered it reasonable, except two respondents who proposed an alternative transitional periods of 3–4 years (confidential response) and 2–3 years, respectively. Another respondent suggested that more time was potentially needed to carry out the mapping exercise. In the ESAs’ view, the proposed 2-year transitional period is sufficient given that competent authorities have been aware of these guidelines for a number of years. Furthermore, the 2-year transitional period is longer than is usual when implementing new guidelines published by the ESAs. No change.