Communications - Communication of the Bank of Italy on anti-money laundering obligations for banking and financial intermediaries

1 Communication of the Bank of Italy on anti-money laundering obligations for banking and financial intermediaries

Preamble This communication provides, within the limits of the competencies assigned to the Bank of Italy, indications on the methods to comply with the anti-money laundering obligations provided for by Legislative Decree 21 November 2007, n. 231, as modified by Legislative Decree 25 May 2017, n. 90 (hereinafter also referred to as "the law"), which implements Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. The indications concern both the transitional period provided for by the law (which expires on 31 March 2018) and the subsequent period, until the entry into force of the new implementing regulations of the Bank of Italy; they are applicable from the day following the publication of this communication. The indications are addressed to: banks; Poste Italiane S.p.A.; electronic money institutions; payment institutions; securities intermediation companies (SIM); asset management companies (SGR); variable capital investment companies (SICAV); fixed capital investment companies (SICAF); financial intermediaries registered in the roll provided for by Article 106 of the TUB; micro-credit providers, pursuant to Article 111 of the TUB; Cassa Depositi e Prestiti S.p.A.; fiduciary companies registered in the roll provided for by Article 106 of the TUB; branches established in Italy of banking and financial intermediaries having their legal seat and central administration in another Member State of the European Union or in a third country; banking and financial intermediaries having their legal seat and central administration in another Member State and established without a branch on the territory of the Italian Republic (hereinafter "intermediaries") (1).

Applicable Rules Legislative Decree 25 May 2017, n. 90, in force from 4 July 2017, completely rewrote Legislative Decree 21 November 2007, n. 231 and introduced significant modifications to the previous legislation on anti-money laundering, particularly with reference to customer due diligence and data retention obligations. It confirmed the power of Supervisory Authorities to issue implementing provisions of the law.

According to Article 9, paragraph 1, of the law "provisions issued by the sector supervisory authorities, pursuant to repealed or replaced norms [...] continue to apply until 31 March 2018". However, the transitional discipline does not specify how to resolve any conflicts between the implementing provisions that continue to apply and the new laws that have entered into force; interpretative doubts may arise for intermediaries.

Since the law assigns to the Bank of Italy, in addition to the power to adopt new implementing regulations, also tasks of control over intermediaries to verify compliance with certain aspects

(1) Fixed capital investment companies (or SICAF) and banking and financial intermediaries having their legal seat and central administration in another Member State, established without a branch on the territory of the Italian Republic, were included in the list of recipients of anti-money laundering obligations only following the entry into force of Legislative Decree n. 90 of 2017; therefore, the implementing regulations issued by the Bank of Italy pursuant to the previous legal provisions do not apply to them. Moreover, pending the issuance of the new implementing discipline, they take into account the indications contained in this communication in identifying the concrete methods to comply with the obligations introduced by the aforementioned law.

2 of the anti-money laundering discipline, the following criteria are indicated to which the Institute will adhere in carrying out these tasks. A. With reference to the relationship between the implementing regulations issued based on the old legal provisions and the new norms introduced by Legislative Decree n. 90 of 2017, in case of conflict, the latter prevail over the former. Therefore, intermediaries must adhere, until 31 March 2018, to the provisions contained in the Bank of Italy's measures issued based on the old legal provisions only to the extent that they are compatible with the new legal discipline. B. Based on this criterion, the Bank of Italy's measures must be considered applicable within the limits and according to the methods illustrated below.

• Measure of the Bank of Italy of 10 March 2011 containing "implementing provisions on organization, internal procedures and controls aimed at preventing the use of intermediaries and other subjects carrying out financial activities for the purposes of money laundering and terrorist financing pursuant to [previous] Article 7, paragraph 2 of Legislative Decree 21 November 2007, n. 231". The measure is generally compatible with the new primary regulatory framework and is therefore applicable.

• Measure of the Bank of Italy of 3 April 2013 containing "implementing provisions for the keeping of the Unified IT Archive and for the simplified registration methods pursuant to [previous] Article 37, paragraphs 7 and 8, of Legislative Decree 21 November 2007, n. 231". The measure is no longer in force due to the repeal of the legal provisions that imposed the obligation to register data in the Unified IT Archive. However, the law provides for data retention obligations for the fulfillment of anti-money laundering duties (see Articles 31 and 32 of the new Legislative Decree n. 231 of 2007) and assigns to the Bank of Italy the power to issue implementing norms that may also allow the use of "computerized archives [...] already established at the subjects [...] supervised". Pending such intervention, therefore, the voluntary use of the Unified IT Archive constitutes a suitable method to fulfill these obligations.

• Measure of the Bank of Italy of 3 April 2013 containing "implementing provisions on customer due diligence, pursuant to [previous] Article 7, paragraph 2, of Legislative Decree 21 November 2007, n. 231". Articles 17 to 30 of the new Legislative Decree n. 231 of 2007 regulate significantly differently than before: i) the methods for fulfilling customer due diligence obligations (Article 19); ii) the criteria for determining the beneficial ownership of customers other than natural persons (Article 20); iii) the simplified and, for some aspects, enhanced customer due diligence measures (Articles 23, 24, and 25); iv) the rules on the execution of due diligence by third parties (Articles 26, 27, 28, 29, and 30). The new legal provisions are very detailed, having incorporated aspects previously left to the implementing regulations of the Supervisory Authorities. It follows that intermediaries must apply directly the customer due diligence obligations as provided for by the new legal norms. The provisions contained in the Measure of the Bank of Italy of 3 April 2013 apply to the extent that they clarify aspects that the new legal provisions regulate in continuity with

3 those repealed (for example, the rules on: customer profiling; scope of application; acquisition of information on the purpose and nature of the ongoing relationship; constant monitoring of the relationship; enhanced due diligence obligations, including provisions on remote operations, with the exception of the part on politically exposed persons referred to as "domestic", which is now incompatible with the new legal discipline) (2). In any case, the following parts of the Measure of 3 April 2013 are entirely inapplicable because incompatible with the new legal provisions:

• "Part Three: simplified due diligence measures" (3);
• "Annex 1: identification of beneficial owner sub 2" (4).

For the correct fulfillment of anti-money laundering obligations, intermediaries also take into account the Joint Guidelines of the European Supervisory Authorities on simplified and enhanced customer due diligence measures and risk factors, published on 4 January 2018; the Guidelines themselves clarify that some measures provided for therein are applicable only if compatible with national law. Until the entry into force of the new implementing measures under the competence of the Bank of Italy, the compliance by intermediaries with the indications contained in this communication ensures conformity with the new legislative framework even after the expiration of the transitional period.

(2) The law has in fact modified the definition of PEPs (now contained in Article 1, paragraph 2, letter dd of Legislative Decree n. 231 of 2007), subjecting also subjects resident in Italy, automatically, to the special enhanced due diligence measures (substantially unchanged since 2008) legislatively provided for. The Measure of 3 April 2013, on the other hand, required intermediaries to census PEPs resident in Italy (qualified as "domestic PEPs") and, only in case of actual high risk, apply to them the special enhanced measures provided for by the previous provisions of Legislative Decree n. 231 of 2007 for foreign PEPs. The law finally imposed on intermediaries to subject also occasional operations carried out by PEPs to enhanced obligations, previously applicable only in case of ongoing relationships.

(3) The law has: a) eliminated the cases qualified ex lege as low risk, leaving to intermediaries the assessment regarding the applicability of the simplified regime (with the sole exception of low-value electronic money products referred to in Article 23, paragraph 3, for which the law itself provides for the application of the simplified due diligence regime); b) provided that, even in the case of customers or products "at low risk", all phases of the due diligence process must be followed, albeit with less depth, extension, and frequency compared to ordinary due diligence. Against this primary regulatory framework, secondary regulation has no significant margins of autonomy. This also applies to the specific simplified due diligence measures that the Bank of Italy is called to identify regarding low-value electronic money products: these measures, in fact, cannot result in an exemption, even partial, from due diligence obligations.

(4) The law requires the identification of beneficial owner sub 2 in all cases where the customer is a subject other than a natural person (see Articles 1, paragraph 2, letter pp) and 19, paragraph 1, letter b). It simultaneously establishes that, in all these cases, the beneficial owner coincides with "the natural person to whom, in the last instance, the direct or indirect ownership of the entity or its control is attributable" (Article 20, paragraph 1). More specific criteria are however provided for the identification of the beneficial owner only for limited liability companies (Article 20, paragraphs 2, 3, and 4), for "private legal persons" (Article 20, paragraph 5) and for trusts (Article 22, paragraph 5). Intermediaries will use these criteria, consistently with the nature of the subject to be verified, also for the purpose of identifying the beneficial owner of partnerships and other types of customers other than natural persons, even those without legal personality (e.g., unrecognized associations).