Circular NBB_2025_04 / Periodic questionnaires on the prevention of money laundering and terrorist financing

NBB_2025_04 – 18 March 2025 Circular – Page 1/6 Boulevard de Berlaimont 14 – BE-1000 Brussels tel. +32 2 221 29 30 company number : 0203.201.340 RPM Bruxelles www.nbb.be Circular Brussels, 18 March 2025 B r u x e l l e s , l e X 2 0 2 4 Reference : NBB_2025_04 Contact person :
Nathan Dessy
Supervision.ta.aml@nbb.be
Periodic questionnaires on the prevention of money laundering and terrorist financing Scope of application

• Credit institutions, including EU and non-EU branches
• Stockbroking firms, including EU and non-EU branches
• Insurance companies authorised to conduct life insurance business, including EU and non-EU
  branches
• Payment institutions and electronic money institutions, including EU and non-EU branches
• Payment institutions and electronic money institutions authorised in other member states of the
  European Economic Area and established in Belgium (through one or more agents and/or distributors)
• Settlement institutions, including EU and non-EU branches
  Summary/Objectives
  By means of this circular, the National Bank of Belgium seeks to obtain standardised information from financial institutions in order to strengthen its risk-based approach to the exercise of its statutory supervisory powers in the fight against money laundering and terrorist financing. Structure

1. Introduction
2. Development of the periodic questionnaire
3. Submission of answers to the periodic questionnaires
4. Reporting deadline
5. Practical aspects
6. Methodology for answering the questionnaires
   riï BanqueNationaleBank
   DE BELGIQUE VAN BELGIË
   Eurosystem

NBB_2025_04 – 18 March 2025 Circular – Page 2/6 Dear Sir or Madam, Please find appended hereto questionnaires by means of which the National Bank of Belgium (hereinafter “the Bank”) seeks to obtain standardised information about, on the one hand, the inherent risks associated with money laundering and terrorist financing (hereinafter “ML/FT”) to which your institution is exposed and, on the other hand, the quality of the risk management measures taken by your institution. The Bank expects your financial institution to return the completed questionnaires as set out below.

1. Introduction
   The International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation (also known as the “FATF Recommendations”), adopted in February 2012, strongly emphasise the importance of a risk-based approach to combating money laundering and terrorist financing. Not only should financial institutions establish a risk-based AML/CFT organisational framework, but the competent supervisory authorities should also have an AML/CFT supervisory model allowing them to exercise their supervisory powers based on the risks to which the financial institutions under their supervision are exposed. The requirement for supervisory authorities to organise their supervision using a risk-based approach is explicitly set out in the European AML/CFT legislation1 and laid down in Article 87 of the Act of 18 September on the prevention of money laundering and terrorist financing and on restriction of the use of cash. In addition, the European Supervisory Authorities2 (hereinafter “the ESAs”) have published joint guidelines on risk-based AML/CFT supervision of financial institutions. These guidelines contain concrete recommendations for the development of a risk-based supervisory model by the national AML/CFT supervisory authorities of financial institutions. These recommendations focus in particular on the following steps:

• Step 1: Identification of ML/FT risk factors
• Step 2: Implementation of a risk assessment for each supervised financial institution
• Step 3: Effective exercise of supervision
• Step 4: Review, adjustment and monitoring of the risk-based supervisory model
  In order to allow the Bank to perform a risk assessment for each financial institution it supervises (step 2 of the ESA Guidelines) and to enable it to determine supervisory priorities based on this assessment, it must possess, on the one hand, information on the inherent ML/FT risks to which these institutions are exposed and, on the other hand, information on the quality of the risk management measures taken by financial institutions. Based on this information, the residual ML/FT risks and supervisory priorities can be determined for each institution. The periodic questionnaire appended to this circular therefore aims to collect the abovementioned information from each institution supervised by the Bank 3 . Additionally, the Bank notes that the information it receives from financial institutions through the periodic questionnaires on ML/FT risks is, in practice, supplemented by and assessed in the light of other sources of information which the Bank can either access or gain access to. These sources include the findings of on-site inspections, contacts with financial institutions, reports of and contacts with certified auditors, the 1 Directive (EU) 2015/849 and Regulation (EU) 2023/1113 of 31 May 2023. 2 These authorities are the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA). 3 The information provided only relates to the activities for which the aforementioned institutions are subject to the supervision of the Bank. Therefore, for example, activities of a credit institution acting as an agent of an insurance company (for the sale of insurance products), which are subject to the supervision of the FSMA, are not covered.

NBB_2025_04 – 18 March 2025 Circular – Page 3/6 CTIF-CFI, prudential supervisors and ML/FT supervisors from other EU member states and third countries, the judicial authorities, etc.
2. Development of the periodic questionnaire
In 2013, the Bank sent supervised financial institutions an AML/CFT questionnaire for the first time. The main aim of this questionnaire was to verify the compliance of their internal AML/CFT procedures with the Belgian AML/CFT legislation. Therefore, the questionnaire focused mainly on the quality of the risk management measures taken by financial institutions. In subsequent years, new questions and/or sections were added to the periodic questionnaire. In 2017, the Bank requested for the first time information about the inherent ML/FT risks to which the institutions under its supervision were exposed. Until 2023, the questions on inherent ML/FT risks and those on compliance were grouped together in a single questionnaire per sector (credit institutions, life insurance companies, payment and electronic money institutions, stockbroking firms). In order to strengthen cross-sector comparability and improve the effectiveness of its analytical approach, the Bank carried out a structural review of the periodic questionnaire since 2024. This review resulted in the creation of several separate questionnaires, each focusing on a specific type of activity, as well as a questionnaire common to all sectors. The purpose of this segmentation is to refine analysis of the collected data and facilitate a more accurate risk assessment, while ensuring the stability and comparability of the information gathered across all sectors concerned. Regarding the 2025 edition of the questionnaire, only minor non-substantial adjustments have been made. Additionally, several new questions have been integrated to assess more precisely the prevalence and importance of services related to virtual IBANs and crypto-assets within the financial sector. The reporting period has remained unchanged; the information to be submitted by institutions should, as before, relate to the preceding calendar year and the state of internal procedures on 31 December of that year.
3. Submission of answers to the periodic questionnaires
Financial institutions should submit the completed periodic questionnaires through OneGate, where the questionnaires are made available in electronic form. In addition to the questionnaire common to all sectors, institutions should, where appropriate, complete specific questionnaires relating to the areas of activity in which they operate. The Bank automatically receives the information provided by an institution upon completion and submission of the electronic forms. In order to guarantee the security of the information provided, institutions must use a digital certificate to access OneGate. Such a certificate can be obtained from a recognised certificate authority (Globalsign, Isabel and Quo Vadis). Institutions that do not have a Belgian CBE number can request an exemption from the digital certificate requirement by sending an e-mail to supervision.ta.aml@nbb.be. If the requested exemption is granted, the institution in question will receive login credentials and a password allowing it to access OneGate in order to complete the periodic questionnaires. More information on OneGate and how to access the application can be found at https://www.nbb.be/doc/dq/onegate/en/login_en.html.
4. Reporting deadline
Responses to the periodic questionnaire must be submitted via OneGate by 15 May 2025 at the latest. The electronic forms used to provide the requested information will be made available in OneGate as from 1 April 2025, in order to ensure that financial institutions have sufficient time to complete them.

NBB_2025_04 – 18 March 2025 Circular – Page 4/6
5. Practical aspects
The Bank chose to draw up a questionnaire common to all sectors as well as separate specific questionnaires for the main types of activity performed by the institutions subject to its supervision. In total, a questionnaire common to all sectors and four specific questionnaires relating to the following areas of activity have been prepared: (i) banking and financing services, (ii) payment and electronic money services, (iii) investment and asset management services and activities, and (iv) life insurance activities. As stated above, financial institutions need only complete the common questionnaire and the specific questionnaire(s) relating to the activities they actually perform. In addition to the common questionnaire, settlement institutions must complete the questionnaire for banking and financing services. Financial institutions falling within the scope of this circular should note that all questionnaires, both common and specific, may now be accessed via OneGate by all financial institutions, regardless of the nature of their authorisation or licence. Specific questionnaires (or parts thereof) that are not applicable to your institution should be marked as not applicable (N/A) using the function dedicated to this purpose in OneGate. All questionnaires are available in English, French and Dutch. You will not receive the questionnaires in hard copy. To view the questionnaires, please visit the Bank’s website and download the appropriate forms. The questionnaires can be found by following these instructions:

1. Go to www.nbb.be.
2. Go to Financial oversight → Prevention of money laundering and terrorist financing (AML/CFT
   page) → Useful links and documents → Main reference documents → Click on this circular
   For any questions about the questionnaires, please contact the Bank’s ML/FT supervisory team at supervision.ta.aml@nbb.be.
3. Methodology for answering the questionnaires
   a) Answering the questions
   In the electronic forms available in OneGate, your institution should provide the necessary information by selecting from the drop-down menu, for each question, the answer that best corresponds to its organisation (e.g. “yes”, “no” or “not applicable”). Where numerical information is requested, your institution can usually choose between the options “not available” or “number”. If your institution does not have the figures required to provide a reliable answer to a question, it should choose the option “not available”. If your institution has the required data, it should select the option “number” and enter the correct
   figure. Finally, if a question is not relevant to your institution, select the option “number” and
   enter “0”.
   Note
   Numbers should always be entered without decimal points or commas between the thousands. A decimal point may only be used before decimal fractions. If a number is not entered in the correct format, you will receive an error message and will not be able to close the form.

NBB_2025_04 – 18 March 2025 Circular – Page 5/6

• Sample error message:
• Correct entry:
• b) Reference date for answering the questions
  As regards the reference date to be used to answer the questions, two types of questions should be distinguished. Questions aimed at obtaining numerical data always mention, in principle, the date or period to which the requested information should relate. In in most cases, the requested information should pertain (i) to the situation on 31 December of the previous calendar year (e.g. the number of customers as at 31 December 2023) or (ii) to the situation over the previous calendar year (e.g. number of payments made to high-risk countries in 2023). For qualitative questions which relate, for example, to the compliance of internal procedures with the legislation in force or to the checks performed, or not performed, by the institution, the information provided must always relate to the situation as at 31 December of the previous calendar year. c) Indicative list of countries presenting a heightened risk of money laundering or terrorist financing The questionnaires include questions relating to transactions carried out from or to countries that may be considered as presenting a heightened risk of money laundering or terrorist financing. A list of such countries is appended to the questionnaire. It should be noted that this list is not exhaustive and has no official value. d) Responsibility for the accuracy of responses Senior management of the financial institution bears ultimate responsibility for the responses to the questionnaires submitted to the Bank. It is further noted that the responsible person designated by each financial institution, in accordance with
  Article 9 §2 of the Act of 18 September 2017, is, pursuant to this same provision, tasked not only with
  analysing atypical transactions in order to determine whether these transactions should be considered suspicious and notified to the Financial Intelligence Processing Unit (CTIF-CFI), but also with implementing the policies and procedures referred to in Article 8 of the Act, particularly the internal controls and procedures necessary to ensure compliance with the Act and which are covered by the questionnaire. Article 9 of the Act also states that this person should, in general, ensure that the institution fulfils all of its obligations with regard to the prevention of money laundering and terrorist financing and, in particular, that it has in place an adequate administrative organisation and internal controls as required by
  Article 8 of the Act. This person should also be authorised to propose, at their own initiative, all necessary
  or useful measures to senior management of the institution, including release of the required resources. .2 (•) Number
• The given inputvalue contains illegal characters (•) Not Available
  4.2 '¥•' Number
  422.45

NBB_2025_04 – 18 March 2025 Circular – Page 6/6 The Bank therefore expects senior management of financial institutions to decide on the answers to the questionnaires based on a proposal by the person responsible for the prevention of money laundering and terrorist financing within the institution. The Bank can, in the context of specific supervisory actions or on-site inspections, verify the accuracy and quality of the answers provided by institutions. A copy of this circular is being sent to the auditor(s) of your company or institution. Yours faithfully, Pierre Wunsch Governor Annexes: 6, available at www.nbb.be

1. Common questionnaire for use by all financial institutions falling within the scope of this circular
2. Specific questionnaire for institutions providing banking and/or financing services
3. Specific questionnaire for institutions providing payment and/or electronic money services;
4. Specific questionnaire for institutions providing investment and asset management services and
   activities;
5. Specific questionnaire for institutions carrying out life insurance activities
6. Indicative list of countries presenting a heightened risk of money laundering or terrorist financing