Final Report on Draft RTS Setting Up an AML/CFT Central Database

EBA/RTS/2021/16
20 December 2021
Final report on draft regulatory technical standards under Article 9a (1) and (3) of Regulation (EU) No 1093/2010 setting up an AML/CFT central database and specifying the materiality of weaknesses, the type of information collected, the practical implementation of the information collection and the analysis and dissemination of the information contained therein

FINAL REPORT ON DRAFT RTS UNDER ARTICLE 9A (1) AND (3) SETTING UP AN AML/CFT CENTRAL DATABASE Contents

Executive Summary 3
Background and rationale 4
Draft regulatry technical standards 10
Accompanying documents
4.1 Cost-benefit analysis/impact assessment 37
4.2 Overview of questions for consultation 45
4.3 Feedback on the public consultation 46
Annexe 65

FINAL REPORT ON DRAFT RTS UNDER ARTICLE 9A (1) AND (3) SETTING UP AN AML/CFT CENTRAL DATABASE

Executive summary
The EBA has a legal duty to contribute to preventing the use of the EU’s financial system for money laundering and terrorist financing (ML/TF) purposes and to lead, coordinate and monitor the EU financial sector’s fight against ML/TF. As part of this, Article 9 a(1) and (3) of the EBA Regulation confer on the EBA a mandate to establish and keep up to date a central anti-money laundering and countering the financing of terrorism (AML/CFT) database. In line with the legal mandate, the central AML/CFT database will contain information on material AML/CFT weaknesses in financial sector operators that competent authorities have identified. It will also contain information on the measures competent authorities have taken in response to those material weaknesses.The draft regulatory technical standards (RTS) in this report specify when weaknesses are material, the type of information competent authorities have to report, how information will be collected and how the EBA will analyse and disseminate the information contained in the database. They also set out the rules necessary to ensure confidentiality, the protection of personal data and the effectiveness of the database. The EBA will use this database to inform its view of ML/TF risks affecting the EU’s financial sector. It will also share information from this database with competent authorities as appropriate, support them at all stages of the supervisory process and, in particular, if specific risks or trends emerge. This means that the database will act as an early warning tool that will help competent authorities to act before the ML/TF risk crystallise. As such, the AML/CFT central database will be key to strengthening AML/CFT supervision and in the coordination of efforts to prevent and counter ML/TF in the EU. The EBA publicly consulted on these draft RTS between May and June 2021. Respondents welcomed the draft RTS. They said that the resulting database will contribute to a better system to fight ML/TF at the EU level and that it will facilitate the exchange of information between competent authorities, while achieving operational and cost efficiency. As part of the responses, some respondents requested that the EBA clarify further the definition of material weaknesses. Others highlighted the sensitive nature of the information the database will contain and asked that the draft RTS specify an applicable retention period for personal data. The EBA has carefully considered all the responses and revised the RTS and the technical specifications where appropriate. Next steps The EBA will submit these draft RTS to the European Commission for approval. Once approved, the RTS will be directly applicable in all Member States.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
2. Background and rationale

The EBA has a legal duty to contribute to preventing the use of the EU’s financial system for ML/TF
purposes and to lead, coordinate and monitor the EU financial sector’s fight against ML/TF. As part of this, Article 9 a(1) and (3) of the EBA Regulation confer on the EBA a mandate to establish and keep up to date a central anti-money laundering and countering the financing of terrorism (AML/CFT) database.
In line with the legal mandate, the central AML/CFT database will contain information on material
AML/CFT weaknesses in financial sector operators that competent authorities have identified. It will also contain information on the measures competent authorities have taken in response to those material weaknesses. The purpose is to bring together in one place the material weaknesses in financial sector operators identified by the competent authorities and the measures they have taken in response to inform the EBA’s view of the ML/TF risks affecting the EU’s financial sector. The EBA will use this database to inform its view of ML/TF risks affecting the EU’s financial sector. It will also share information from this database with competent authorities as appropriate, support them at all stages of the supervisory process and, in particular, ifspecific risks or trends emerge. This means that the database will act as an early warning tool that will help competent authorities to act before the ML/TF risk crystallise. As such, the AML/CFT central database will be key to strengthening AML/CFT supervision and in the coordination of efforts to prevent and counter ML/TF in the EU.
Specifically, the EBA will use the central AML/CFT database to:
a. share relevant information proactively on its own initiative with competent authorities in support of their supervisory activities on a risk-based approach; b. answer ‘reasoned requests’ for information from competent authorities about financial sector operators to the extent that this information is relevant for competent authorities’ supervisory activities with regard to preventing the use of the financial system for the purpose of ML/TF;
c. analyse information in the database on an aggregate basis to inform the Opinion
on ML/TF risk and to perform risk assessments under Article 9 a(5) of the EBA Regulation; d. support the EBA’s work to lead, coordinate and monitor the EU financial sector’s AML/CFT efforts.
The draft regulatory technical standards (RTS) in this report specify when weaknesses are material,
the type of information competent authorities have to report, how information will be collected and how the EBA will analyse and disseminate the information contained in the database. They also set out the rules necessary to ensure confidentiality, the protection of personal data and the effectiveness of the database.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
5. To avoid duplication of reporting, the draft RTS clarify how reporting obligations under these RTS
interact with other notifications such as that under Article 62 of Directive EU (2015/849). They also specify the timelines for reporting and the reporting of associated updates, as well asthe practical aspects of the information collection by the EBA. Rationale
6. When drafting these RTS, the EBA wanted to ensure that the database will be able to work as an
early warning tool and will inform the EBA’s view of ML/TF risks affecting the EU’s financial sector. The EBA wanted to obtain a comprehensive understanding of the material weaknesses and measures taken in response while at the same time respecting the principle of proportionality.
7. This is reflected in the EBA’s approach to the defining weaknesses and the materiality of a
weakness, the corresponding situations where a weakness may occur, the type of information that will have to be reported to the EBA, the analysis of the information by the EBA and how the EBA will make the information available, the provisions to ensure the efficiency of the database and how the information will be reported to the EBA, as well asthe articulation with other notifications and the provisions to ensure confidentiality and data protection. Definitions, including definition of a ‘weakness’
8. The draft RTS define weaknesses as required by the mandate. The definition of a weakness is based
on provisions in Article 9a of the EBA Regulation and covers three notions: a ‘breach’, a ‘potential breach’ and ‘ineffective or inappropriate application’. Those three notions have been further specified in Article 3. In line with the legal mandate and to support early intervention before risks materialise, weaknesses are defined as encompassing not only breaches or suspected breaches, but also situations where the application by a financial sector operator of the AML/CFT-related requirements or policies fallsshort of supervisory expectations. Similarly, the draft RTS define the meaning of ‘measures’. The definition aims to cover the various type of measures taken by a competent authority on a financial sector operator in response to the material weakness and to cover the measures taken in response not only to a material ‘breach’ but also a ‘potential breach’ or ‘ineffective or inappropriate application’. Corresponding situations where a weakness may occur
9. The mandate requires the EBA to specify ‘the corresponding situations where a weakness may
occur’. The corresponding situations are defined in Article 4 of these draft RTS with regard to the supervisory activities performed by the different competent authorities within the scope of these draft RTS. They are further specified in Annex 1 of the draft RTS. For this purpose, the EBA has taken into account the previous experiences of those competent authorities in identifying AML/CFT material weaknesses, as well as the situations that are potentially most relevant toAML/CFT in the various legislations. Materiality of a weakness

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
10. As required by the mandate, the draft RTS specify how to determine the materiality of weaknesses
that, if confirmed, will trigger the obligation to report the information to the EBA. The EBA recognises that materiality depends on the context. For this reason, materiality will be determined based on a definition and a non-exhaustive list of criteria to specify that definition further.
11. These draft RTS, as required by the mandate, set out the ‘type of information’ that will have to be
provided by competent authorities to the EBA when complying with their reporting obligations. They distinguish three types of information: general information, the nature of the material weakness and the information relating to any measures taken by competent authorities in response to a material weakness. The detailed data pointsthatthe competent authorities will have to report for all three types of information are included in technical specifications in accordance with Article 13(7) of these draft RTS as they are not part of the mandate given to the EBA. The technical specificationsincluding the detailed data points are set out in an annex tothis final report. Type of information a. Type of information – general
12. The general information serves to identify the competent authority that reports the information
and the financial sector operator that is the subject of the report. It includes information on the financial sector operator’s structure, including whether it is part of a group, its size and its risk profile as thisinformation supportsthe analysis of the weakness’s impactif associated ML/TF risks materialise. AML/CFT authorities should report information using the common ML/TF risk categories that are set out in Annex 3. b. Type of information to be submitted for the material weakness
13. The type of information to be submitted in respect of a material weakness should facilitate the
comprehensive assessment of the weakness and its impact or potential impact, and the factors leading up to it. To enable the EBA to use the information contained in the database also for the purpose of the Opinion on ML/TF risk pursuant to Article 6(5) of Directive (EU) 2015/849 or for risk assessment under Article 9a (5) of the EBA Regulation, as required by the mandate, any contextual or background information with regard to the weakness is also requested. Examples of background information to be supplied in such cases include whether the weakness pointsto an emerging risk or is linked to a specific area relevant for AML/CFT already identified by the EBA.
c. Type of information transmitted in relation to measurestaken in response to
material weaknesses
14. The type of information transmitted in relation to measuresthat competent authorities have taken
in response to a material weakness reflects existing reporting requirements, in particular the type of information that AML/CFT competent authorities already have to report, as part of the notification received by the EBA under Article 62 of Directive (EU) 2015/849 and of information requested by the EBA from competent authorities for the purpose of the Opinion on ML/TF risk pursuant to Article 6(5) of Directive (EU) 2015/849. Moreover, particular emphasis has been placed on the remediation measures imposed by the competent authority, including the action planned

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database or taken by the competent authority. This information will enable the EBA to fully understand how the competent authority has reacted to a material weaknessthatit has identified. Analysis of the information by the EBA and making information available
15. The draft RTS define how the EBA will analyse and disseminate information it has received. They
set out how the database will ensure cooperation with the ESMA and EIOPA, and specify that the EBA can combine, where appropriate, the information from the database with information otherwise available to the EBA.
16. The information will be made available by the EBA in two different ways: reactively, following a
request by a competent authority, and proactively, on the EBA’s own initiative, where appropriate as part of a risk-based approach.
17. With regard to the sharing of information on the EBA’s own initiative, and to avoid duplication,
the draft RTS envisage that information be shared through colleges to the extent that the information relates to a financial sector operator’s cross-border activities. Sharing information through colleges, where relevant, also enables those colleges to act before associated ML/TF risks crystallise. Timelines and obligations to provide updates/language
18. To ensure that the central AML/CFT database becomes an efficient tool, the quality, timeliness
and completeness of the information contained therein is essential. To that end, these draft RTS specify that information on material weaknesses and measures taken shall be submitted without undue delay and that competent authorities shall respond without undue delay to any request from the EBA for additional or subsequent information, where the EBA determines that the information submitted does not appear to be accurate, complete, adequate or up to date. To be effective and to support early intervention with a view to mitigating risks before they crystallise, information on material weaknesses has to be submitted to the database without delay following its identification by competent authorities. For the same reason, these draft RTS specify that submissions and requests made in accordance with themshall be in English. Articulation with other notifications
19. The mandates require the EBA to avoid duplication. For this purpose, these draft RTS clarify the
articulation with the notification referred to in Article 62 of Directive (EU) 2015/849 and with the notification under Article 97 (6) of Directive (EU) 2013/36. Practical implementation of the information collection including the sequential approach
20. These draft RTS specify that the competent authorities submitting and requesting information
shall declare to the EBA a person of appropriate seniority who will represent the authority vis-à-vis the EBA for the purpose of submitting information in accordance with these draft RTS. Competent

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database authorities must also designate a person or persons as contact points for the submission, request and receipt of information under these draft RTS. The draft RTS further specify that the competent authority will have to ensure that sufficient resources are dedicated to reporting. Due to the sensitive nature of the data that competent authorities will be submitting in line with these draft RTS, it is essential to ensure the efficiency of reporting and the quality of the data submitted.
21. Furthermore, these draft RTS set out how the information will have to be communicated to the
EBA. Given the large number of competent authorities concerned by these RTS, recognising that due to their supervisory activities some competent authorities are likely to report AML/CFT weaknesses and measures less frequently than others, and taking into account the need to achieve operational and cost efficiency both for the competent authorities and for the EBA, a sequential approach is being proposed on the basis of which some authorities should have direct and others indirect access to the database through the AML/CFT authority in charge of the AML/CFT supervision of the financial sector operator concerned by the material weakness. The technical specifications further set out the authorities submitting to the AML/CFT database indirectly in an
annex to this final report.
Confidentiality and data protection
22. Articles 14 and 15 of these draft RTS are designed to ensure confidentiality and data protection.
The information requested on natural persons isset out in Annex 2.
23. With regard to data protection, the draft RTS specify, in particular, that the EBA, ESMA, EIOPA and
the competent authorities shall determine their respective responsibilities as joint controllers of personal data by means of an arrangement between them, to the extent that those responsibilities are not determined by the Union or Member State law to which they are subject. Theyalso specify the retention period of the data.
24. Moreover, EBA staff have also conducted a data protection impact assessment (DPIA), and a
summary of the draft DPIA was published on the EBA website at the same time asthe consultation paper. The final DPIA will be published on the EBA website before the EBA startsto collect personal data in the AML/CFT central database. Moreover, the view of the European Data Protection Supervisor (EDPS) has been sought on these draft RTS, and its informal response has been taken into account when this final report has been developed. The formal view of the EDPS will be provided to the European Commission when it reviewsthe RTS. Technical specifications
25. The detailed data points that the competent authorities will have to report are included in
technical specifications in accordance with Article 13(7) of these draft RTS as they are not part of the mandate given to the EBA. The technical specifications also further clarify the authorities submitting to the AML/CFT database indirectly.
26. The EBA has consulted on the technical specifications on the detailed data points and on the
authorities submitting to the AML/CFT database indirectly, even if they are not part of the draft

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database RTS and the EBA was not required to consult on them. These technical specifications are specified in an annex to the final report on the RTS for the purpose of completeness and information. Next steps The EBA will be submitting these draft RTS to the Commission for endorsement before being published in the Official Journal of the European Union.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
3. Draft regulatory technical
standards
EUROPEAN
COMMISSION
Brussels, XXX
… XXX draft
COMMISSION DELEGATED REGULATION (EU) …/... of XXX supplementing Regulation (EU) No 1093/2010 of the European Parliament and of the Council with regard to regulatory technical standards setting up an AML/CFT central database and specifying the materiality of weaknesses, the type of information collected, the practical implementation of the information collection and the analysis and dissemination of the information contained therein

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EXPLANATORY MEMORANDUM

CONTEXT OF THE DELEGATED ACT
Article 9a(1) subparagraph 3 and 9a(3) subparagraph 3 of Regulation (EU) No 1093/2010 of
the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC empowers the Commission to adopt, following submission of draft standards by the European Banking Authority (EBA), and in accordance with Articles 10 to 14 of Regulation No (EU) 1093/2010, delegated acts on a central AML/CFT database that will be maintained by the EBA. These delegated acts also specify the type of information competent authorities shall report, how they shall report it and how the EBA will analyse and make available information from this database to competent authorities on a need-to-know and confidential basis. In accordance with Article 10(1) of Regulation No (EU) 1093/2010 establishing the EBA, the Commission shall decide within three months of receipt of the draft standards whether to endorse the drafts submitted. The Commission may also endorse the draft standards in part only, or with amendments, where the Union's interests so require, having regard to the specific procedure laid down in those Articles.
CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT
In accordance with the third subparagraph of Article 10(1) of Regulation No (EU) 1093/2010, the EBA has carried out a public consultation on the draft technical standards submitted to the Commission in accordance with Article 9a (1) and (3) of No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC. A consultation paper was published on the EBA internet site on 6 May 2021, and the consultation closed on 17 June 2021. Moreover, the EBA worked in close cooperation with the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority, and requested the Banking Stakeholder Group set up in accordance with Article 37 of Regulation No (EU) 1093/2010 to provide advice on them. Together with the draft technical standards, the EBA has submitted an explanation on how the outcome of these consultations has been taken into account in the development of the final draft technical standards submitted to the Commission. Together with the draft technical standards, and in accordance with the third subparagraph of
Article 10(1) of Regulation No (EU) 1093/2010, the EBA has submitted its impact assessment,
including its analysis of the costs and benefits, related to the draft technical standards submitted to the Commission. This analysis is available at https://www.eba.europa.eu/regulation-andpolicy/anti-money-laundering-and-countering-financing-terrorism/regulatory-technicalstandards-central-databas, pages 31-38 of the Final Report on the draft technical standards.
LEGAL ELEMENTS OF THE DELEGATED ACT
The EBA is required to set up and maintain a central AML/CFT database. This database will contain information on material weaknesses in individual financial sector operators that make them vulnerable to money laundering or terrorist financing. Competent authorities have to report material weaknesses that they have identified, as well as the measures they have taken to address those material weaknesses. These draft technical standards specify when weaknesses are material. They also set out which information competent authorities have to report, how they have to report it, and how the EBA will analyse this information and make it available to competent authorities.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database They also set out the rules that will apply to ensure confidentiality and the protection of personal data contained in the database.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database COMMISSION DELEGATED REGULATION (EU) …/... of XXX supplementing Regulation (EU) No 1093/2010 of the European Parliament and of the Council with regard to regulatory technical standards setting up an AML/CFT central database and specifying the materiality of weaknesses, the type of information collected, the practical implementation of the information collection and the analysis and dissemination of the information contained therein THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC1, and in particular Article 9a (1) and (3) thereof, Whereas:
(1) In accordance with Regulation (EU) 2019/2175 2 amending Regulation (EU) No 1093/2010, the EBA is entrusted with the power to act within the scope of Regulations (EU) No 1094/2010 and (EU) No 1095/2010 insofar as such power relates to the prevention and countering of money laundering or of terrorist financing, and to the extent that it concerns financial sector operators and the competent authorities supervising them, which are covered by those Regulations. Within this context, the EBA is tasked with the collection of information on material weaknesses regarding financial sector operators identified by the relevant Union and national authorities in relation to the prevention of money laundering and terrorist financing and on measures taken in response to those material weaknesses and to store such information in a centralised database, at the same time fostering cooperation among authorities by ensuring the appropriate analysis and dissemination of relevant information. This Regulation specifies the materiality of a weakness, what type of information will be collected by the EBA and how the EBA will collect and share that information. (2) Given the complementary character of the mandate set out in paragraph 1 of Article 9a of Regulation (EU) No 1093/2010 pertaining to the definition of weakness and its materiality, the specification of corresponding situations where a weakness may occur and the type and practical implementation of the information collection and of the mandate set out in paragraph 3 of that Article as to how information collected should be 1 OJ L 331, 15.12.2010, p. 12. 2 Regulation (EU) 2019/2175 of the European Parliament and of the Council amending Regulation (EU) No 1093/2010 establishing a European Supervisory Authority (European Banking Authority), Regulation (EU) No 1094/2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), Regulation (EU) No 1095/2010 establishing a European Supervisory Authority (European Securities and Markets Authority), Regulation (EU) No 600/2014 on markets in financial instruments, Regulation (EU) 2016/1011 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds, and Regulation (EU) 2015/847 on information accompanying transfers of funds, OJ L 334 of 27.12.2019, p. 1

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database analysed and made available on a need to-know and confidential basis, the relevant specifications should be set out in a single Regulation. (3) Given that, in accordance with Article 9a of Regulation (EU) No 1093/2010, the EBA shall collect information about the measures taken by the competent authorities in response to material weaknesses identified, such measures should be understood as any supervisory and administrative measures, sanctions and penalties including precautionary or temporary measures, taken by competent authorities in the context of a supervisory activity as set out in the second subparagraph of Article 2 (5) of Regulation 1093/2010, in the second subparagraph of Article 2 (5) of Regulation 1094/2010 and in the second subparagraph of Article 2 (5) of Regulation 1095/2010. (4) This Regulation should specify the corresponding situations where weaknesses may occur. To that end, the Regulation should take into account that supervision, perceived as including all relevant activities, without prejudice to national competences, of all competent authorities to be carried out pursuant to the sectoral legislative acts, is, indeed, diverse. Therefore, this Regulation should specify the corresponding situations having regard to the supervisory activities performed by the different competent authorities. (5) For the materiality of a weakness to be determined, there is a need to set out a general definition and a non-exhaustive list of criteria to specify that definition further. This is in order to achieve a harmonised approach in the application of this general definition, while also ensuring that all material weaknesses, in the sense of the general definition, are captured taking into account the specific context. (6) To ensure that weaknesses are reported to the database at an early stage, a material weakness should be defined in such a way that it encompasses not only weaknesses that reveal, but also those that could lead to a significant failure in compliance with applicable AML/CFT-related requirements even if that failure has not occurred yet. This is also justified by the fact that information should be reported to the database on a best effort basis by those competent authorities that do not possess the same level of AML/CFT information and expertise as the supervisory authorities designated as competent under Directive (EU) 2015/8495. (7) To set out the type of information to be submitted, this Regulation should distinguish between general information, information on material weaknesses and information on the measures taken. (8) When setting out the components of the general information to be submitted, particular attention should be given to financial sector operators that operate on a cross-border basis, including financial sector operators that are part of a group for which a college operates. Furthermore, it should be specified that
AML/CFT competent authorities should also submit to the EBA as part of this general information the financial sector operator’s AML/CFT risk profile using common categories, for comparability of information to be ensured. (9) Prudential authorities should, as part of the general information that they have to report, provide information on the result of the relevant risk assessment of any supervisory review process and of any other similar process impacted by the ML/TF risk of the financial sector operator along with information on any negative final assessment or decision on applications for authorisation or approval, where such assessment or decision is also based on the grounds of ML/TF risks.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (10) There is a need to have regard to the distinct competences of the home and host AML/CFT authorities as set out in Directive (EU) 2015/849. To that end, it should be clarified that both the home and the host AML/CFT authorities are required to report to the EBA material weaknesses they have each identified in the performance of their respective competences. It should also be clarified that the measures taken by the host AML/CFT competent authority should be submitted to the database independently from any notification to the home authority. (11) To ensure that the EBA is able effectively to exercise its role to lead, coordinate and monitor with a view to preventing the use of the financial system for ML/TF purposes, by making full use of all its powers and tools under Regulation (EU) No 1093/2010 while respecting the principle of proportionality, there is a need to ensure that the EBA can combine, for the purposes of analysing the information submitted to the database, information that it has from other sources. The EBA should endeavour to make use of this information for the achievement of all its tasks as set out in Regulation 1093/2010. (12) While analysing information submitted and made available in accordance with this Regulation, cooperation with the EIOPA and ESMA should be ensured, in accordance with Article 4(3) of the TEU as further specified in Article 2 (4) of Regulation 1093/2010, Article 2 (4) of Regulation 1094/2010 and Article 2 (4) of Regulation 1095/2010. (13) In particular, it should be specified that information requested by the EBA to these authorities or otherwise received from these authorities in accordance with Article 4 (3) of the TEU as further specified in Article 2 (4) of Regulation 1093/2010, Article 2 (4) of Regulation 1094/2010 and Article 2 (4) of Regulation 1095/2010 could be used, where appropriate, for the purposes of the analysis and that the EBA should provide the EIOPA and ESMA with information, either on its own initiative or following a request received by them. (14) This Regulation should specify how information is made available to competent authorities. Article 9a (2) of Regulation (EU) No 1093/2010, which refers generically to the fact that the EBA shall ensure that information is made available to competent authorities on a need-to-know and confidential basis, and 9a(3), which refers specifically to reasoned requests, are both part of the process regarding how information is made available to competent authorities. To that end, the particular elements of the reasoned request to be received by the EBA from competent authorities should also be set out. (15) To ensure proportionality and avoid the duplication of information, there is a need to set out that an AML/CFT competent authority submitting information on a measure will be deemed as also submitting the notification referred to in Article 62 of
Directive (EU) 2015/849 with regard to that measure; also that an AML/CFT or prudential authority submitting information under this Regulation shall specify with its submission whether it has already submitted a notification under Article 97 (6) of Directive (EU) 2013/36. (16) To ensure that the AML/CFT central database becomes an effective tool in the fight against ML/TF, there is a need to ensure that information is submitted to the database in a timely manner, and to ensure the quality of that information. To that end, information on material weaknesses and measures taken should be submitted without undue delay and competent authorities should respond without undue delay to any call from the EBA made after any quality check analysis is performed. For the same reason, the ongoing accuracy, completeness, adequacy and updates of such information should

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database be ensured, and information on a material weakness should be submitted independently from any measure in response to it. (17) To ensure time efficiency , thereby promoting consistent, systematic and effective monitoring and assessment of risks in relation to money laundering and terrorist financing in the Union’s financial systems, this Regulation should specify that submissions and requests made in accordance therewith, shall be in English; at the same time, to ensure proportionality and avoid excessive costs for the competent authorities, where the supporting documents are not available in English, they should be submitted in the original language of the document accompanied by a summary in English. (18) Where the operation of a deposit guarantee scheme is administered by a private entity, there is a need to specify that the designated authority supervising that scheme should ensure that such scheme reports material weaknesses identified in the course of its activities to the designated authority. (19) Given the large number of competent authorities within the scope of these RTS and to anticipate the considerable differences in the reporting frequency as some of them are, due to their supervisory responsibilities, likely to report AML/CFT material weaknesses and measures less frequently than others, and in order to achieve operational and cost efficiency both for the competent authorities and for the EBA, there is a need for a sequential approach to be built into the architecture of the database on the basis of which some authorities should have direct and others indirect access to the database. (20) There is a need to specify that information provided in accordance with this Regulation will be bound by professional secrecy and confidentiality requirements for all parties involved in the exchange of that information. Hence, specific provisions should be set out in this Regulation as to how this information can be further disclosed, thereby preserving confidentiality. (21) When information submitted, requested, shared or made available in accordance with this Regulation concerns natural persons, there is a need to ensure that proportionality considerations are applied to the processing of information on these natural persons. To that end, this Regulation should specify the information processed concerning natural persons. (22) To further ensure data protection, there is a need to specify that Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 are applicable to the processing of personal data under this Regulation, that competent authorities submitting and requesting information under this Regulation shall comply with the requirements set out in these Regulations and with the national requirements on the protection of natural persons with regard to the processing of personal data, and that the EBA, ESMA and EIOPA shall process personal data in
compliance with the requirements of Regulation (EU) 2018/1725.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database HAS ADOPTED THIS REGULATION:
Article 1
Subject matter
This Regulation specifies:
(a) the definition of weaknesses identified by competent authorities during ongoing supervision and authorisation procedures in the processes and procedures, governance arrangements, fitness and propriety, acquisition of qualifying holdings, business models and activities of financial sector operators in relation to preventing and countering money laundering and terrorist financing; (b) the corresponding situations where the weaknesses may occur and the materiality of such weaknesses; (c) the type of information that competent authorities shall provide to the European Banking Authority (‘EBA’) pursuant to point (a) of paragraph 1 of Article 9a of Regulation 1093/2010 in relation to these weaknesses and the practical implementation of the information collection by EBA; (d) how information included in the central database referred to in point (a) of paragraph 1 of Article 9a of Regulation 1093/2010 will be analysed in order for that information to be shared by the EBA on its own initiative with competent authorities for their supervisory activities with regard to the prevention of the use of the financial system for the purposes of money laundering or terrorist financing; (e) how the information referred to in point (d) will be made available by the EBA to the competent authorities on a need-to-know basis; (f) the arrangements necessary to ensure confidentiality when information is being provided or made available as referred to in points (c) and (e).
Article 2
Scope

This Regulation applies to the following competent authorities:
(a) authorities that identify weaknesses during their ongoing supervision and authorisation procedures, in the processes and procedures, governance arrangements, fitness and propriety, acquisition of qualifying holdings, business models and activities of financial sector operators as defined in Article 4 (1a) of Regulation (EU) No 1093/2010 in relation to preventing and countering money laundering and terrorist financing; and (b) authorities that take measures in response to the material weaknesses affecting one or more requirements of the legislative acts referred to in Article 1(2) of

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Regulation (EU) 1093/2020, Article 1(2) of Regulation (EU) No 1094/20103 and
Article 1(2) of Regulation (EU) No 1095/2010 4 and of any national laws
transposing them with regard to preventing and countering the use of the financial system for the purpose of money laundering or terrorist financing.
2. 2. This Regulation applies with regard to financial sector operators defined in Article
4 (1a) of Regulation (EU) No 1093/2010.
3. 3. References in this Regulation to supervision shall be read in accordance with the
second subparagraph of Article 2 (5) of Regulation (EU) No 1093/2010.
Article 3
Definitions
For the purpose of this Regulation the following definitions shall apply:
(1) ‘competent authority’ means an authority referred to in Article 2 (1); (2) 'AML/CFT authority’ means a competent authority entrusted with the duty to ensure compliance of a financial sector operator with Directive (EU) 2015/849; (3) ‘prudential authority’ means a competent authority entrusted with the duty to ensure compliance of a financial sector operator with the prudential framework set out in any of the legislative acts referred to in Article 1(2) of Regulation 1093/2010, Article 1(2) of Regulation (EU) No 1094/2010 and Article 1(2) of Regulation (EU) No 1095/2010 and in any national laws transposing them, including the European Central Bank with regard to matters relating to the tasks conferred on it by Regulation (EU) No 1024/20135. (4) ‘payment institutions authority’ means an authority referred to in Article 22 of Directive (EU) 2015/23666. (5) ‘conduct of business’ means a competent authority entrusted with the duty to ensure compliance of a financial sector operator with the conduct of business or the consumer protection framework set out in any of the legislative acts referred to in Article 1(2) of Regulation (EU) 1093/2010, Article 1(2) of Regulation (EU) No 1094/2010 and
Article 1(2) of Regulation (EU) No 1095/2010 and in any national laws transposing
them.
3 Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48) 4 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84) 5 Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63) 6 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337 of 23.12.2015, p. 35)

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (6) ‘resolution authority’ means a national authority designated by a Member State in accordance with Article 3 of Directive (EU) 2014/59 7 and the Single Resolution Board established by Regulation (EU) No 806/20148; (7) ‘designated authority’ means a competent authority as referred to in Article 2 (18) of Directive (EU) 2014/49 9; (8) ‘AML/CFT-related requirement’ means any requirement imposed on a financial sector operator in accordance with the legislative acts referred to in Article 1(2) of Regulation (EU) No 1093/2010, Article 1(2) of Regulation (EU) No 1094/2010 and Article 1(2) of Regulation (EU) No 1095/2010 and with any national laws transposing them, with regard to the prevention, and countering the use of the financial system for the purpose of money laundering or terrorist financing; (9) ‘policy’ means any internal policies and procedures that financial sector operators put in place to comply with AML/CFT-related requirements. (10) ‘measure’ means any supervisory and administrative measures, sanctions and penalties, including precautionary or temporary measures, taken by a competent authority in response to a weakness which is deemed as material in accordance with
Article 5;
(11) ‘breach’ means any violation of an AML/CFT-related requirement committed by a financial sector operator and which has been identified by a competent authority; (12) ‘potential breach’ means a situation in which either the competent authority has reasonable grounds to suspect that a violation of an AML/CFT-related requirement has been committed by a financial sector operator or that such a violation has been attempted; (13) ‘ineffective or inappropriate application’ means an application by a financial sector operator of an AML/CFT-related requirement or policies in a way that is considered by a competent authority to be inadequate or insuficient to achieve the intended effects of those requirements or policies and is likely, by its nature, to lead to a breach if the situation is not rectified, but which is not a breach or a potential breach; (14) ‘branch’ means a place of business which forms a legally dependent part of a financial sector operator and which carries out directly all or some of the transactions inherent in the business of the financial sector operator, whether its head office is situated in a Member State or in a third country;. (15) ‘parent financial sector operator’means a financial sector operator in a Member State which has another financial sector operator as a subsidiary or which holds a 7 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190) 8 Regulation (EU) No 806/2014 ofthe European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ L 225, 30.7.2014, p. 1) 9 Directive 2014/49/EU of the European Parliament and of the Council of 16 April 2014 on deposit guarantee schemes (OJ L 173, 12.6.2014, p. 149)

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database participation in such a financial sector operator and which is not itself a subsidiary of another financial sector operator authorised in the same Member State; (16) ‘union parent financial sector operator’ means a parent financial sector operator in a Member State that is not a subsidiary of another financial sector operator established in any Member State. (17) ‘college’ means a college of supervisors as set out in Article 116 of Directive (EU) 2013/36, a resolution college or a European resolution college as set out in Articles 88 and 89 of Directive (EU) 2014/59, or an AML/CFT college.
Article 4
Weaknesses and corresponding situations where weaknesses may occur

For the purpose of point (a) of the first subparagraph of Article 9a of Regulation (EU)
No 1093/2010, breaches, potential breaches and ineffective or inappropriate applications shall be weaknesses.
The corresponding situations where weaknesses may occur are set out in Annex 1.
Article 5
Materiality of a weakness
A weakness shall be considered material where it reveals or could lead to significant
failures in the compliance of the financial sector operator, or of the group to which the financial sector operator belongs, with its AML/CFT-related requirements.
For the purpose of paragraph 1, at least all of the following criteria shall be assessed:
(a) It occurs repeatedly;
(b) It has persisted over a significant period of time (duration); (c) It is serious or egregious (gravity); (d) The management body or the senior management of the financial sector operator either appear to have a knowledge of the weakness and decided not to remediate it or they adopted decisions or deliberations directed at generating the weakness (negligence and wilful misconduct); (e) The weakness increases the ML/TF risk exposure of the financial sector operator or the ML/TF risk associated with the financial sector operator, or of the group to which it belongs; (f) The weakness has or could have a significant impact on the integrity, transparency and security of the financial system of a Member State or of the Union as a whole; (g) The weakness has or could have a significant impact on the viability of the financial sector operator or of the group to which the financial sector operator belongs, or on the financial stability of a Member State or of the Union as a whole;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (h) The weakness has or could have a significant impact on the orderly functioning of financial markets.
Article 6
Type of information – general
The type of general information to be provided pursuant to point (a) of paragraph 1 of Article 9a of Regulation (EU) No 1093/2010 shall comprise the following:
(a) identification of the competent authority, including specification of the home and host AML/CFT authority and, where Article 13(4) applies, identification of the authority indirectly submitting the information; (b) identification of the financial sector operator and of its branches, agents and distributors under Directive (EU) 2015/2366 and Directive (EU) 2009/110 concerned by the material weakness or the measures taken, including the type of financial sector operator and, where applicable, the type of establishment; (c) where the firm is part of a group, identification of the Union parent financial sector operator, the parent financial sector operatorsin a Member State; (d) in the case of the European Central bank, the Single Resolution Bord or the national comptent authorities of the Member State where the registered office of the financial sector operator is situated, or, if the financial sector operator has no registered office, of the Member State in which its head office is situated, identification of the countries in which the financial sector operator operate branches and subsidiairies or through a network of agents and distibutors; (e) where the financial sector operator is part of a group, information as to any college established where the competent authority participates, including information on the members, observers, lead supervisor/group supervisor/consolidating supervisor/group level resolution authority of that college; (f) whether there is a central contact point as referred to in in Article 45(9) of Directive (EU) 2015/849, where applicable, and its identification; (g) any other relevant information, including whether the financial sector operator is currently applying for authorisation, establishment or other supervisory approvals, whether the financial sector operatoris in the process of application to exercise its right of establishment or its freedom to provide services, and whether the financial sector operator, is subject to any proceedings set out in Directive (EU) 2014/59 or other insolvency proceedings; (h) information on the size of the financial sector operator’s and branch’s activities, including, where applicable:
(a) information on financial statements;
(b) number of clients;
(c) volume of assets under management;
(d) for an insurance undertaking, its annual gross written premium (GWP) and the size of its technical provisions; (e) for an insurance intermediary, the volume of premiums intermediated;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (f) for payment institutions and electronic money institutions: the size of the distribution network including information on the number of agents and distributors; (i) Prudential authorities shall, in addition to points (a) to (h), specify the following:
(a) The result of the relevant risk assessment of any supervisory review process, including the processes referred to in Article 97 of Directive (EU) 2013/36 and in Directive (EU) 2009/138 and of any other similar process impacted by the ML/TF risk of the financial sector operator or of the branch, including in the areas of internal governance, business model, operational risk, liquidity and credit risk; (b) Any negative final assessment or decision on an application for authorisation or approval, including where a member of the management body does not meet the requirements on fitness and propriety, where such decision is also based on grounds of ML/TF risks. Any reporting on natural persons shall be made in accordance with Annex 2. (j) AML/CFT authorities shall, in addition to points (a) to (h), provide the ML/TF risk profile of the financial sector operator and branch as well as available information about agents’ and distributors’ ML/TF risk profile using the categories specified in
Annex 3.
Article 7
Type of information to be submitted for the material weakness The type of information to be provided pursuant to point (a) of paragraph 1 of Article 9a of Regulation (EU) No 1093/2010 in relation to the material weakness itself shall comprise:
(a) the type of weakness as set out in article 4 paragraph 1; (b) the reason for materiality as set out in Article 5; (c) the description of the material weakness; (d) the corresponding situation where the weakness has occurred in accordance with
Annex 1;
(e) the timeline of the material weakness;
(f) the identification of the origin of the information on the material weakness, including whether the information derives from the reporting competent authority or from other sources; (g) the AML/CFT-related requirements to which the material weakness relates; (h) the type of products, services or activities for which the financial sector operator has been authorised that are impacted by the material weakness; (i) whether the material weakness concerns the financial sector operator, branch, agent or distributor alone, as well as any cross-border impact of the material weakness; (j) whether information on the material weakness has been communicated to a college that has been established for the group where the financial sector operator belongs; if not communicated yet: the reason why;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (k) for the host AML/CFT competent authorities: whether the information on the material weakness has been communicated to the home AML/CFT competent authority or to the central contact point as referred to in Article 45(9) of Directive (EU) 2015/849 where applicable; if not communicated yet: the reason why; (l) whether the material weakness appears to be inherent in the design of that particular product, service or activity; (m) whether the material weakness appears to be linked with specific natural persons, whether a client, a beneficial owner, a member of the management body or key function holder, including reasoning thereof; any reporting on natural persons shall be made in accordance with Annex 2; (n) any contextual or background information with regard to the material weakness where known by the competent authority, including; (a) whether the material weakness is linked with a specific area relevant for AML/CFT already identified by the EBA; (b) for the AML/CFT authorities, whether the material weakness points to a ML/TF emerging risk (emerging risks include new risks that have not been identified before and existing risks that have significantly increased or taken on new significance); (c) whether the material weakness is linked to the use of new technology, and a short description of the technology employed.
Article 8
Type of information transmitted in relation to measures taken in response to material weaknesses The type of information to be provided pursuant to point (a) of paragraph 1 of Article 9a of regulation (EU) No 1093/2010 in relation to a measure taken in response to a material weakness shall comprise the following:
(a) a reference to the material weakness in relation to which the measure has been taken, and any necessary update of the information provided in accordance with Article 7; (b) the date of the imposition of the measure(s); (c) the type of measure, its internal reference number and link to it, if published; (d) full information as to the legal and natural persons which the measure concerns; any reporting on natural persons shall be made in accordance with Annex 2; (e) a description of the measure taken, including its legal basis; (f) the status of the measure, including whether any appeal has been brought against the measure; (g) whether and how the measure has been published, including the reasoning for any anonymous publication, delay in publication or non-publication; (h) all information relevant to the remediation of the material weakness that the measure concerns, including any action planned or taken for such remediation, any additional information necessary and the relevant timeline;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (i) whether the information on the measure has been communicated to a college that has been established for the group where the financial sector operator belongs; if not communicated yet: the reason why; (j) for the host AML/CFT competent authorities: whether information on the measure has been communicated to the home AML/CFT competent authority; if not communicated yet: the reason why.
Article 9
Timelines and obligation to provide updates

Information on material weaknesses and measures taken shall be submitted by
competent authorities in accordance with this Regulation without undue delay.
The reporting of a material weakness referred to in paragraph 1 shall be made by any
competent authority independently from any measure in response thereto and by the host AML/CFT authority independently from the notification to the home AML/CFT authority.
Competent authorities shall ensure that the information submitted in accordance with
this Regulation remains accurate, complete, appropriate and up to date.
Competent authorities shall provide, without undue delay, any additional or
subsequent information required by the EBA when the EBA determines that the information submitted is not accurate, complete, adequate or up to date.
Competent authorities shall provide, in due time, all the information necessary to keep
the EBA informed about any subsequent developments relating to the information provided, including information related to the material weakness identified or to the measure taken and its remediation.
Article 10
Analysis of the information received by the EBA under this Regulation
EBA shall analyse the information received in accordance with this Regulation on a
risk-based approach.
EBA may seek, where appropriate, to combine information submitted in accordance
with this Regulation with information available to the EBA or with information that the EBA has gathered from other sources during the performance of its tasks, including information disclosed to the EBA by any natural or legal person, including competent authorities, the Commission, the EIOPA or the ESMA.
The EBA may seek, where appropriate, to obtain additional information from the
ESMA and EIOPA. The competent authorities – the ESMA and the EIOPA – shall, in such cases, provide the information requested.
The EBA shall endeavour to make use of the information received in accordance with
this Regulation for the achievement of all its tasks as set out in Regulation (EU) 1093/2010, including but without limitation, the following tasks:
(a) to conduct analysis on an aggregate basis in order to:

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (a) inform the opinion it is requested to deliver pursuant to Article 6(5) of Directive (EU) 2015/849; (b) perform risk assessments under Article 9a(5) of Regulation (EU) No 1093/2010; (b) to provide responses to requests received from competent authorities for information about financial sector operators relevant for the supervisory activites of these authorities with regard to the prevention of the use of the financial system for the purpose of money laundering or of terrorist financing, as specifed in Article 9 a(3) of Regulation (EU) No 1093/2010; (c) to inform requests under Article 9b of Regulation (EU) No 1093/2010; (d) to disclose, on its own initiative, information to competent authorities relevant for their supervisory activities as specified in Article 11 (1) (b); (e) to provide the EIOPA and ESMA with information analysed in accordance with this article, including information on individual financial sector operators, and on natural persons in accordance with Annex 2, either on its own initiative, or following a request received by these authorities providing reasons as to why that information is necessary for the achievement of their tasks as set out in Regulation (EU) No 1094/2010 and Regulation (EU) No 1095/2010, respectively.
Article 11
Making information available

Information received in accordance with this Regulation and analysed in accordance
with Article 10 shall be made available by the EBA to the competent authorities:
(a) following a request received by the competent authority for information about financial sector operators relevant for the supervisory activites of these authorities with regard to the prevention of the use of the financial system for the purpose of money laundering or terrorist financing, as specifed in Article 9 a(3) of Regulation (EU) No 1093/2010; (b) on the EBA’s own initiative, including but not limited to the following cases on a risk-based approach:
(a) to the lead supervisor/group supervisor/consolidating supervisor/group level resolution authority, where a college has been established but the information has not been disseminated therein as per in point (k) of Article 7 and point (i) of Article 8 and the EBA deems the information relevant; (b) where no college has been established but the financial sector operator is
part of a cross-border group or has branches or operates through agents or
distributors in other countries and the EBA deems the information relevant for the authorities supervising such group entities, branches, agents or distributors;
The request referred to in point (a) of paragraph 1 shall identify the requesting
competent authority and the authority enabling the indirect submission where appropriate, as well as the financial sector operator concerned by the request, and shall

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database specify whether the request concerns the financial sector operator or a natural person; why the information is relevant for the requesting authority and its supervisory activities with regard to the prevention of the use of the financial system for the purpose of money laundering or terrorist financing; what the intended use of the requested information is; the date by which the information should be received, if any; whether there is a degree of urgency and relevant justifications for both, as well as any additional information that may assist or is requested by the EBA while processing the request.
3. Requests and making information available shall be made in accordance with Annex
2 where natural persons are concerned.
Article 12
Articulation with other notifications

An AML/CFT competent authority submitting information on a measure in accordance
with this Regulation shall be deemed as also submitting the notification referred to in
Article 62 of Directive (EU) 2015/849 with regard to that measure.
An AML/CFT or a prudential competent authority submitting information under this
Regulation shall specify with its submission whether it has already submitted a notification under Article 97 (6) of Directive (EU) 2013/36.
Article 13
Practical implementation of the information collection
The submissions and requests to the EBA under this Regulation by competent
authorities and the requests to the EBA by the ESMA and EIOPA shall be made by electronic means and in English.
Where the supporting documents are not available in English, their submission shall
be made in the original language of the document accompanied by a summary in English.
Where the operation of a deposit guarantee scheme is administered by a private entity,
the designated authority supervising that scheme should ensure that such scheme reports material weaknesses identified in the course of its activities to the designated authority.
Where a competent authority (‘authority indirectly submitting’) other than an
AML/CFT authority submits information and requests to the EBA and receives information from the EBA through the AML/CFT authority in charge of the supervision of the financial sector operator concerned by the material weakness of the Member State where the authority indirectly submitting is established (‘authority enabling indirect submission’), the following shall apply:
(a) the authority indirectly submitting shall submit information and requests to and receive information from the EBA as set out in this Regulation only through the authority enabling indirect submission;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database (b) the liability of the authority enabling indirect submission shall be limited solely to submitting to the EBA all the information and requests received by the authority indirectly submitting and to transferring to that authority all the information received by the EBA; (c) the authority indirectly submitting shall remain exclusively liable to comply with its obligations to report material weaknesses and measures in accordance with this Regulation; (d) the notifications under Article 9 a(3) are done by the EBA for the authority indirectly submitting through the authority enabling indirect submission.
5. Competent authorites shall declare to the EBA a person of appropriate seniority that
will represent the authority vis-à-vis the EBA for the purpose of submitting information in accordance with this Regulation; they shall report to the EBA any change of that person and they shall ensure that sufficient resources are dedicated for their reporting obligations under this Regulation to be discharged. Competent authorities shall notify to the EBA a person or persons designated as the contact points for the submission, the requests and the reception of information under this Regulation. Those notifications and any changes thereof shall be made in accordance with Annex
2. Authorities indirectly submitting shall make the declarations referred to in this
paragraph to the authorities enabling their indirect submission.
6. Additional information set out in the penultimate subparagraph of point (a) of Article
9a (1) of Regulation 1093/2010 includes – for the AML/CFT competent authority – the current ML/TF risk profile of the group if any, the ML/TF risk assessments of the financial sector operator, branch, agent or distributor or of the group; any information or document not referred to in this Regulation relevant for any material weakness or measure shall be provided by the competent authority with an explanation of such relevance;
7. The EBA shall, without prejudice to Annex 2, set out and communicate to competent
authorities technical specifications, including data exchange formats, representations, relevant data points and instructions rights of access to the relevant database, to which authorities shall conform, where submitting or receiving information in accordance with this Regulation. The EBA shall, having regard to the different supervisory activities of the competent authorities, the expected frequency of submissions and the need to achieve operational and cost efficiency, identify the competent authorities that shall be authorities indirectly submitting in accordance with paragraph 4.
Article 14
Confidentiality
8. Without prejudice to provisions of this Regulation as to how information is analysed
and made available to authorities, information submitted to the EBA in accordance with this Regulation shall be subject to Articles 70, 71 and 72 of Regulation (EU) No 1093/2010. Information received by the EIOPA and ESMA in accordance with this Regulation shall be subject to Articles 70, 71 and 72 of Regulation (EU) No 1094/2010 and to Articles 70, 71 and 72 of Regulation (EU) No 1095/2010, respectively.
9. Members of the competent authorities’ management bodies and persons working or
who have worked for these authorities, even after their duties are ceased, shall be

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database subject to professional secrecy requirements and shall not disclose information received in accordance with this Regulation except only in summary or aggregate form, such that individual financial sector operators, branches, agents, distributors or natural persons cannot be identified, without prejudice to cases covered by criminal law.
10. Competent authorities receiving information in accordance with this Regulation shall
treat this information as confidential and shall use it only in the course of their supervisory activities with regard to the prevention of the use of the financial system for the purpose of money laundering or of terrorist financing, carried out pursuant to the legal acts referred to in Article 1(2) of Regulation (EU) 1093/2010, Article 1 (2) of Regulation (EU) 1094/2010 and Article 1 (2) of Regulation (EU) 1095/2010, including in appeals against measures taken by these authorities and in any court proceedings concerning supervisory activities.
11. Paragraph 2 shall not preclude a competent authority from disclosing information
received in accordance with this Regulation to another competent authority or to an authority or body pursuant to the legal acts referred to in Article 1 (2) of Regulation (EU) 1093/2010, Article 1 (2) of Regulation (EU) 1094/2010 and Article 1 (2) of Regulation (EU) 1095/2010.
Article 15
Data protection

Regulation (EU) 2016/67910 and Regulation (EU) 2018/172511 are applicable to the
processing of personal data under this Regulation. The competent authorities submitting and requesting information under this Regulation shall comply with the requirements set out in these Regulations and with the national requirements on the protection of natural persons with regard to the processing of personal data. This paragraph applies also in cases of indirect submissions or requests in accordance with paragraph 4 of Article 13.
The EBA, ESMA and EIOPA shall process personal data included in information
submitted, requested, shared or made available in accordance with this Regulation in compliance with the requirements of Regulation (EU) 2018/1725.
The EBA, ESMA, EIOPA and the competent authorities shall determine their
respective responsibilities as joint controllers of personal data by means of an arrangement between them in accordance with Article 26 of Regulation (EU) 2016/679 and Article 86 of Regulation (EU) 2018/1725, to the extent that those responsibilities are not determined by Union or Member State law to which they are subject.
Data may be kept on an identifiable form for a period of up to ten years, at the end of
which personal information shall be deleted. Based on a regular assessment of their 10 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1) 11 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39)

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database necessity, personal data may be deleted before the end of that maximum period on a case-by-case basis. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, For the Commission The President On behalf of the President [Position]

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EUROPEAN COMMISSION Brussels, XXX … XXX draft ANNEXES 1 to 3 ANNEXES to the COMMISSION DELEGATED REGULATION (EU) No …/... supplementing Regulation (EU) No 1093/2010 of the European Parliament and of the Council with regard to regulatory technical standards setting up an AML/CFT central database and specifying the materiality of weaknesses, the type of information collected, the practical implementation of the information collection and the analysis and dissemination of the information contained therein

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EN 31 EN
ANNEX I
CORRESPONDING SITUATIONS
Competent authorities may come across weaknesses in the following situations:
PART 1: AML/CFT authorities
When carrying out their on-site and off-site supervisory activities in relation to:

Customer due diligence measures, including customer ML/TF risk assessments,
reliance on third parties and transaction monitoring;
Suspicious transaction reporting;
Record-keeping;
Internal AML/CFT systems and controls;
Risk management system, including business-wide ML/TF risk assessments;
Group-wide policies and procedures including policies for sharing information within
the group.
PART 2: Prudential authorities
During the authorisation process and the process for the assessement of acquisition of
qualifying holdings:
(a) Business strategy, business model analysis and reflection on other risk areas, including liquidity where applicable; (b) Fitness and propriety assessment of the members of the management body and key function holders, where performed; (c) Notification to establish a branch or to provide services under the freedom of establishment or the freedom to provide services; (d) Shareholders or members holding qualifying holdings or exclusively at authoritisation, where applicable identity of 20 largest shareholders or members if there are no qualifying holdings; (e) Internal governance arrangements including remuneration policies and practices; (f) Internal control framework including risk management, compliance and internal audit; (g) Information communication technology risk and risk management; (h) Assessment of the sources of funds to pay up capital at authorisation or the source of funds to purchase the qualifying holding;
During ongoing supervision, including on-site inspections and off-site supervisory
activites, regarding :
(a) Internal governance arrangements including remuneration policies and practices; (b) Internal control framework including risk management, compliance and internal audit;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EN 32 EN (c) Fitness and propriety assessment of the members of the management body and key function holders, where performed; (d) The assessment of the notifications of proposed acquisitions of qualifying holdings; (e) Operational risks including legal and reputational risks; (f) Information communication technology risk and risk management; (g) Business models; (h) Liquidity management; (i) Outsourcing arrangements and third party risk management; (j) Carrying out the procedures related to market access/banking licensing/authorisations; (k) Carrying out the Supervisory Review and Evaluation Proccess (SREP); carrying out the supervisory review process (SRP) or similar supervisory review processes (l) Assessment of ad hoc requests, notifications and applications; (m) Assessment of the eligibility of and monitoring institutional protection schemes; (n) Information received during ongoing work to ensure compliance with EU prudential rules such as the collection of supervisory reporting;
PART 3: Designated authorities
When preparing for DGS interventions, including stress testing and on-site or off-site inspections, or when executing a DGS intervention, including payouts.
PART 4: Resolution authorities
In the course of their functions, from resolution planning to execution.
PART 5: Conduct of business authorities
When carrying out their on-site and off-site supervisory activities and, in particular, in situations where they are aware of:

A denial of access to financial products/services for AML/CFT reasons;
A termination of a contract or the end of a service for AML/CFT reasons;
An exclusion of categories of customers, in particular in the situations mentioned in 1.
and 2. for AML/CFT reasons.
PART 6: Payment institutions authorities
In particular :
During the authorisation process and passporting;
When carrying out their on-site and off-site supervisory activities and, in particular:
(a) with regard to payment institutions and electronic money institutions, including when they provide their activites through agents and distributors;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EN 33 EN (b) with regard to the payment service provider’s obligations under Directive (EU) 2015/2366 on payment services in the internal market, including the obligation of the payee’s payment service providers to make funds available to the payee immediately after the amount is credited to the payment service provider’s account.
PART 7: Any other situations where the weakness is material.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EN 34 EN
ANNEX 2
INFORMATION ON NATURAL PERSONS

The information to be provided in application of Article 6 (i) (b)
(a) Name, surname, date of birth, country of residence, nationality, function in the financial sector operator or branch; (b) The grounds of ML/TF.
The information to be provided in application of Article 7 (m) is as follows:
Customer or beneficial owner :
(a) name, surname, date of birth, country of residence, nationality; (b) whether this natural person is also a member, or was also a member, of the management body or a key function holder in the financial sector operator or branch; (c) whether this natural person holds or held, directly or indirectly, shares in the financial sector operator or branch; (d) for a customer,whether the natural person is considered as ‘high risk’by thefinancial sector operator, branch, agent or distributor. Member(s) of the management body or key function holder(s) Name, surname, date of birth, country of residence, nationality, function in the financial sector operator or branch; Any natural person:
The reason why the competent authority considers that the natural person appears to be linked with the material weakness.
The information to be provided in application of Article 8 (d) is as follows:
Name, surname, date of birth, country of residence, nationality, function in the financial sector operator, branch, agent or distributor or role (with regard to customer or beneficial owner);
The information to be provided in application of Article 11 (3) is as follows:
(a) The information to be submitted by a competent authority when making a request about a natural persons:
(a) Name, surname, date of birth, nationality, country of residence; (b) The function, or role (with regard to the customer or beneficial owner), where known; (c) The rationale(s) for the request: the reason why the information about that specific person is necessary for the requesting competent authority for its supervisory activity with regard to the prevention of the use of the financial system for the purpose of money laundering or terrorist financing and the intended use (s) of the information requested. (b) The dissemination of personal data by the EBA

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database EN 35 EN Personal data will be shared by the EBA upon request under the conditions mentioned under Point 4 (a) (c.) and by the EBA on its own initiative as described in Article 11 (1) (c) if the information about that specific person is necessary for the competent authority for its supervisory activity with regard to the prevention of the use of the financial system for the purpose of money laundering or terrorist financing. In both cases, the information will be shared between authenticated users and using secured communication channels.
5. The information to be provided in application of Article 13 (5) is as follows:
Name, surname, function, business contact.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
ANNEX 3
ML/TF RISK PROFILE
i. Less significant risk profile
The financial sector operator/branch/agent or distributor has a less significant risk profile where its inherent risk is less significant and its risk profile remains unaffected by mitigation, or where inherent risk is moderately significant or significant but is effectively mitigated through AML/CFT systems and controls.
ii. Moderately significant risk profile
The financial sector operator/branch/agent or distributor has a moderately significant risk profile where its inherent risk is moderately significant and its risk profile remains unaffected by mitigation, or where its inherent risk is significant or very significant but is effectively mitigated through AML/CFT systems and controls.
iii. Significant risk profile
The financial sector operator/branch/agent or distributor has a significant risk profile where its inherent risk exposure is significant and the risk profile remains unaffected by mitigation, or where its inherent risk is very significant but is effectively mitigated through AML/CFT systems and controls.
iv. Very significant risk profile
The financial sector operator/branch/agent or distributor has a very significant risk profile where its inherent risk is very significant and, regardless of the mitigation, the risk profile remains unaffected by mitigation, or where the inherent risk is very significant but is not effectively mitigated due to systemic AML/CFT system and control weaknesses in the financial sector operator.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
4. Accompanying documents
4.1 Cost-benefit analysis/impact assessment
I. Introduction

The EBA leads, coordinates and monitors the EU financial sector’s fight against money
laundering and terrorist financing (ML/TF) and in that context has been mandated to establish and keep up to date an AML/CFT central database12. The database will help the EBA fulfil this mandate by supporting information exchange and thus, the cooperation between competent authorities; by serving as an early warning tool that prompts competent authorities to take action and address ML/TF risks in a timely manner before they crystallise; and by helping the EBA identify ML/TF risks and develop a common approach to mitigating these risks. Information from this database will also inform the EBA’s policy and strategy.
The AML/CFT central database will be designed on the basis of two legal mandates under
Article 9a (1) and (3) of Regulation (EU) 1093/2010 to collect information related to
weaknesses and measures taken in response to material weaknesses.
The database will collect information from a large scope of competent authorities (such
as the AML/CFT authorities, prudential authorities including the European Central Bank, resolution authorities including the Single Resolution Board (SRB), payment institutions authorities, conduct of business and designated authorities) that supervise any ‘financial sector operator’ (such as credit institutions, credit providers, life insurance undertakings, life insurance intermediaries, payment institutions, bureaux de change and investment firms).
II. Policy objectives
Recent AML/CFT scandals across Europe have shown that cross-border cooperation is
essential to an effective approach to fighting ML/TF. The AML/CFT central database that will be designed on the basis of these RTS will aim, in particular, to facilitate the flow of information and to serve as an early warning tool enabling the competent authorities to act before the ML/TF risks crystallise. Currently there is no such a tool at the EU level. Moreover, with regard to an aggregated analysis, in drafting these regulatory technical standards the EBA will be able to perform all the tasks/missions allocated to this AML/CFT central database and, more broadly, to support the EBA’s mission to lead, coordinate and 12 Regulation (EU) 2019/2175 of the European Parliament and of the Council of 18 December 2019 amending Regulation (EU) No 1093/2010 establishing a European Supervisory Authority (European Banking Authority)

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database monitor AML/CFT in Europe, and to do so in a way that is efficient, proportionate and avoids duplication.
5. Objectives of the information to be collected: the EBA will use the information collected
under these RTS mainly to share it with the competent authorities upon request or on its own initiative, and to perform aggregated analysis of this information, for example for its biennial opinion on ML/TF risks. Other uses of the database could, for instance, be related to the possibility of performing risk assessments as described in Article 9a (5) or to inform requests under Article 9b of the EBA Regulation and, more broadly, for the performance of all the EBA’s tasks as set out in the EBA Regulation.
III. Baseline scenario
6. The RTS under Article 9 a(1) aim to collect information on weaknesses and measures
imposed in response to material weaknesses. For this reason, the definition of what constitutes a weakness and the materiality of the weaknesses will define the scope of the reporting requirements and the amount of information to be provided by the competent authorities.
7. The RTS mandate requires the EBA to collect information on all weaknesses identified,
without considering the level of materiality. It also requires the EBA to take into account the principle of proportionality and the necessity to consider the ‘volume of the information’. Moreover, as for the measures, Article 9a(1) is clear that the information is to be collected only relating to ‘material weaknesses’. Therefore the baseline scenario is that in practice the focus of all reporting and information collection will be on ‘material weaknesses’.
8. In this sense, a weakness is considered material if it is serious or very serious. This is
consistent with other work already done or currently done by the EBA. Indeed, with regard to breaches (which are one component of a weakness), the survey that forms the basis of the Opinion on ML/TF risk already distinguishes four level of seriousness for AML/CFT breaches: (i) minor breaches, (ii) moderate breaches, (iii) serious breaches, (iv) egregious breaches. Moreover, this is also consistent with Article 117(6) of the Capital Requirement Directive (CRD) and the mandates to issue guidelines for cooperation and information exchange between competent authorities, FIUs and AML/CFT supervisors with a focus on the serious breaches of AML/CFT rules, as well as with Objective 5 of the Council Action Plan, which requires European supervisory authorities (ESAs) to interpret uniformly the concept of ‘serious breaches’ of AML/CFT rules for the purposes of the CRD.
9. In addition, there is a need to ensure that competent authorities are consistent in their
designation of materiality, while at the same time acknowledging that materiality could depend on different factors. For this purpose, a definition of materiality and some criteria to be assessed will be specified in the RTS.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
10. Moreover, some information requested in the RTS may already be available to the EBA.
In that case, information would not be transmitted twice to the EBA in order to avoid duplications, and there will be a specific article in the RTS to specify the articulation with other notifications. Similarly, with regard to the sharing of information on its own initiative, the EBA intends to use the colleges and to share the information though a college only when it has not already been disseminated therein in order to avoid duplication.
IV. Options considered
11. The mandates in Article 9a (1) and (3) of the EBA Regulation focus, in particular, on the
definition of weaknesses, the situations where weaknesses may occur and the materiality of weaknesses, as well as the type of information to be collected. The EBA has considered different options for the following topics:
Article 4 and Annex 1: the situations where a weakness may occur
12.The mandate requires the EBA to specify ‘the corresponding situations where a weakness may occur’. Option 1: minimum list aligned with the situations mentioned in Article 9a
13. Article 9a (1) already lists some situations where weaknesses maybe identified, such as
ongoing supervision, authorisation procedures, governance arrangements, fitness and propriety, acquisition of qualifying holdings, business models and activities of the financial sector operator. One option could be to align the list of corresponding situations with this list. However, this list mainly relatesto the supervisory activities of prudential authorities. Therefore, the main disadvantage is that it does not provide sufficient information for all the various types of competent authorities within the scope of the RTS, including the AML/CFT competent authorities, which are likely to be one of the types of authorities reporting the most frequently to the AML/CFT central database. Option 2: list of situations defined with regard to the supervisory activities performed by all the different types of competent authorities within the scope of the RTS
14. This approach complements Option 1 by specifying the situations where a weakness may
occur with regard to the supervisory activities performed by all the various types of competent authorities within the scope of the RTS (such as the AML/CFT supervisors, the resolution authorities including the Single Resolution Board (SRB), payment institution authorities or conduct of business/designated authorities). As all these competent authorities will have to report to the database and their supervisory activities are very diverse, it makes sense to define the corresponding situations with reference to each of these types of competent authorities. It will strengthen awareness of all the competent

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database authorities about the situations where AML/CFT weaknesses may occur and therefore ensure a better quality of reporting and, in the end, enhance the effectiveness of the AML/CFT central database.
15. Option 2 is the EBA’s preferred option.
Article 5: materiality of a weakness
16. Defining the materiality of a weakness affects what competent authorities have to report.
Therefore, when defining materiality, this has to be in line with the legal mandate without imposing a disproportionate reporting burden on competent authorities. During the drafting process, the EBA therefore considered the extent of the principle of proportionality the definition and criteria for materiality. Option 1: materiality only based on the impact on a system-wide basis
17. This option entails the inclusion in the database of only those weaknesses considered
material with regard to their impact on a system-wide basis. This option does not entail the impact on the financial sector operator itself. This approach will significantly reduce the burden for competent authorities. However, this option would not enable the EBA to obtain sufficient information to fulfil the part of the mandate that consists of sharing information with competent authorities about financial sector operatorsrelevantfor their supervisory activities with regard to the prevention of the use of the financial system for the purpose of ML/TF. Option 2: materiality based both on the impact on the financial sector operator itself and on a system-wide basis
18. This option will take into account criteria to assess the impact on a system-wide basis,
but also the impact of the weakness on the financial sector operator itself. Other criteria such as the frequency, the duration of the weakness, the ML/TF risk exposure of the financial sector operator or the ML/TF risk associated with the financial sector operator, or of the group to which it belongs, are also considered, as are negligence and wilful misconduct. This approach is consistent with the approach taken for other existing regulatory products with regard to ‘serious breaches’ and the criteria listed for sanctions in Article 59 of Directive (EU) 2015/849 with regard to breaches which are ‘serious, repeated and systematic, or a combination thereof’. This would therefore reduce implementation costs and uncertainty for competent authorities.
19. Option 2 is the EBA’s preferred option.
Articles 6, 7 and 8: the type of information transmitted

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
20. With regard to the type of information transmitted, the following policy options were
assessed.
Option 1: discretionary collection of the qualitative and quantitative information under Article 9a
21. Under this option, the authorities addressed would report material weaknesses,
measures taken by competent authorities and subsequent developments relating to the information provided on a discretionary basis. This option would not entail additional costs for the competent authorities and would provide flexibility in order to report all the related information to the weakness concerned. However, the purpose of the database as an early warning tool would be undermined, as the cost of aggregating different information obtained from each authority would be high for the EBA. Furthermore, the process would take time and would not result in accurate information being assessed on aggregate. Option 2: standardisation of the qualitative and quantitative information provided
22. Under this option, the degree of standardisation of the information collected is higher,
while leaving sufficient room for adding free text by competent authorities.
23. This option entails the standardisation of the information related to material weaknesses
via pre-defined lists (e.g. type, reason for the materiality, timeline, sources of information and the requirement concerned) but with the inclusion of free text by competent authorities (i.e. description and impact of the material weaknesses). Moreover, qualitative additional background information would also be included (e.g. material weakness appears to be linked with a specific natural person, whetherit relates to the use of new technologies or emerging risks, etc.).
24. In relation to the measures taken, standardisation relates to the type, date and
information linked tothe remediation, while the information collected via free text relates to information requestedto understand the measurestaken (i.e. description).
25. This option ensures the efficency of the database and facilitates the analysis of the
information contained in it, while retaining sufficient flexibility so as to adjust the reporting to the specificities of the competent authorities. Another advantage is that a higher degree of standardisation will provide more convergence of practices at the EU level.
26. Option 2 is the EBA’s preferred option.
Article 13: practical implementation of the data collection and in particular access to
the database

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
27. Article 13 specifies, in particular, the manner of the transmission of information from
competent authorities to the EBA. To this end, the following policy options have been discussed in the drafting process. Option 1: direct access to the database by all competent authorities
28. This option entails the direct submission of information and requests to the EBA from all
the competent authorities concerned as well as the direct receipt of information from the EBA by all the competent authorities. A large number of competent authorities are covered by the RTS, and some competent authorities are likely to report AML/CFT weaknesses and measures less frequently than others due to their supervisory activities. Therefore this option does not achieve operational and cost efficiency either for the competent authorities or for the EBA. Option 2: direct access to the database by some competent authorities and indirect access by others via a ‘sequential approach’
29. This option represents a combination of direct and indirect access to the database
(‘authority indirectly submitting’) via the AML/CFT authority in charge of supervising the financial sector operator concerned by the material weakness of the Member State where the authority indirectly submitting is established (‘authority enabling indirect submission’). The EBA, having regard to the different supervisory activities of the competent authorities and the expected frequency of submissions, will identify the competent authorities that shall be authorities submitting indirectly. This option would better reflect the organisation at national level and would entail more limited costs.
30. Option 2 is the EBA’s preferred option.
V. Cost-benefit analysis
31. The implementation of the RTSunder Article 9a (1) and (3) of the EBA Regulation on the
AML/CFT ‘central database’ entail costs for both the EBA and competent authorities. However, the creation of a repository encompassing weaknesses and measures taken in response to material weaknesses for the single market benefits both the EBA and the competent authorities. In this section, we analyse first the costs and then the benefits for both the EBA and the competent authorities that are addressed in the RTS.
32. Regarding the EBA, costs relate to the collection of information on weaknesses and
measures as well as the process of disseminating the information to competent authorities. Those costs mainly relate to the build-up and maintenance of the IT infrastructure. Moreover, the EBA shall analyse all the information received in order to fulfil all the tasks described in the RTS. The analysis and dissemination of the information contained in the database will require the work of AML/CFT data specialists. The EBA will have to comply with the process and the timeline.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
33. Regarding competent authorities, the associated costs mainly arise from classifying
information related to weaknesses (i.e. breaches, potential breaches and inappropriate or ineffective application) and the designation of materiality. The competent authorities will have to submit the information within the expected timeline and may also have to adjust their internal processes to identify weaknesses. Lastly, once weaknesses are identified, they should comply with the reporting process designed by the EBA to submit the information correctly. 34.The expected benefits for both the EBA and the competent authorities relate to the use of the database as an early warning tool that will facilitate the flow of information and the coordination of efforts to combat ML/TF at the EU level. For the EBA it will be a useful source of information to inform its AML/CFT policy work and support its mandates to lead, coordinate and monitor AML/CFT in Europe. For competent authorities, the benefits also relate to the use of the database for the purposes of their supervisory activities such as, for instance, planning their on-site and off-site inspections.
VI. Overall impact assessment
35. For the purpose of assessing the impact of implementing the RTS under Article 9 a(1) of
the EBA Regulation, the EBA carried out a survey to assess the level of implementation of the definition of ‘weakness’ and ‘materiality’ from an AML/TF perspective. The survey was sent to the AML/CFT competent authorities. Responses to the survey were received with a deadline for submissions of mid-September 2020. As the RTS refer to all financial sector operators (i.e. credit institutions, credit providers, life insurance undertakings, life insurance intermediaries, e-money institutions, payment institutions, investment firms, etc.), the AML/CFT competent authorities consulted were those that supervise all these entities. Therefore, the EBA received 32 responses from 26 member states (one for each member state, plus an additional authority for three member states and two additional authorities for another one).
36. As the RTS will require competent authorities to report ‘weaknesses’ and measures
imposed in response to material weaknesses, implementation of the RTS relies on implemented definitions of both concepts at the level of each competent authority. Regarding ‘weaknesses’, only four AML/CFT competent authorities account with a definition in either the national law, regulation, case law or guidance. Regarding the ‘materiality’ of a weakness, only six competent authorities account with an implemented criteria. Therefore a small proportion of AML/CFT competent authorities have already developed legal provisions in their national jurisdictions that would define the scope of the reporting requirements. However, it should be noted that the definition of a ‘weakness’ contains the notion of a ‘breach’, which is already known by the competent authorities, and the definition of materiality is consistent with other work done with regard to ‘serious breaches’.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
37. Therefore, implementation of the definitions of the RTS for the purposes of reporting to
the AML/CFT central database is expected to be medium.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
4.2 Overview of questions for consultation
Question 1: Do you have any comments on the definitions proposed in Articles 3 and 4? If so, please explain your reasoning. Question 2: Do you have any comments on the corresponding situations identified and proposed in Article 4 and Annex 1 for each type of competent authority in the scope of the draft RTS? If so, please explain your reasoning. Question 3: Do you have any comments on the definition of the materiality of a weakness proposed in Article 5? If so, please provide your comments. Question 4: Do you have any comments on the type of information as specified in Articles 6, 7 and 8 and Annex 3? If so, please provide your reasoning. Question 5: Do you have any comments on the proposed approach with regard to the EBA’s analysis and dissemination of the information contained in the database, as proposed in Articles 10 and 11 of the draft RTS? If you do, please provide your reasoning. Question 6: Do you have any comments on the provisions proposed in Article 9 ‘timelines and obligations to provide updates’ and in Article 13 (1) and (2) in relation to the language used? If so, please provide your reasoning. Question 7: Do you have any comments on the provisions proposed in Article 12 on the ‘articulation with other notifications’? If so, please provide your reasoning. Question 8: Do you have any comments on the approach proposed in Article 13 and in particular on the sequential approach described in paragraph 4 of that Article? If so, please provide your reasoning. Question 9: Do you have any comments on the approach proposed in Articles 14 and 15 with regard to confidentiality and data protection, and on Annex 2, which sets out information in relation to natural persons for the purpose of these draft RTS or more generally on data protection? If so, please provide your reasoning. Question 10: Do you have any comments on the technical specifications specified in the Annexes to this draft consultation paper? If so, please provide your reasoning.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
4.3 Feedback on the public consultation
The EBA publicly consulted on the draft proposal.
The consultation period lasted for six weeks and ended on 17 June 2021. Eight responses were received from private sector representatives or associations, of which seven were published on the EBA’s website. This section summarises the comments received during the public consultation. It also sets out the EBA’s response and how the EBA addressed these comments. Where several respondents made similar comments or the same respondent repeated their comments in response to different questions, these comments, and the EBA’s analysis, are included in the section of this paper where the EBA considered them most appropriate. The EBA thanks all respondents for taking the time to reply and for the constructive and positive feedback received. The EBA has carefully considered all the responses and revised the draft RTS and the technical specifications where appropriate.
4.3.1 Summary of key issues and the EBA’s response
All respondents welcomed the EBA’s draft RTS. They said that theywill contribute to a better system to ML/TF atthe EU level. Moreover, they underlined that it will facilitate the exchange of information between the competent authorities. The sequential approach has also been received positively as achieving operational and cost efficiency for both the competent authorities and the EBA. Where respondents raised concerns, these related to :

The materiality of a weakness
The EBA is mandated to define the ‘materiality’ of a weakness that will trigger a reporting obligation. The definition of materiality in the draft RTS comprises a general definition as well as criteria which clarify that definition further in order to ensure its harmonised application. Respondents’ concerns related to:

The list of criteria and, in particular, whether all the criteria had to be met for a
weakness to be considered ‘material’;
Whether the use of ‘could lead to’ in the general definition could broaden the scope
of reporting to the EBA too much. One respondent felt that it would include almost any weakness and even potential breaches, which would lead to submissions of large volumes of data that would potentially be of little use in an AML/CFT context;
Whether all criteria were sufficiently clear, in particular those criteria relating to the
duration of the weakness and to its frequency. Furthermore, one respondent

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database considered that the criteria linked to the seriousness of the weakness or the fact that it is egregious should only apply when a competent authority had pursued or been successful in enforcement action at the national level, while another respondent felt considered that the criteria related to the significant impact on the ‘integrity, transparency and security of the financial system’ or that the ‘financial stability of the member state would be difficult to establish without establishing that the financial sector operator was aware of this impact at the time when the weakness materialised’. We have amended Articles 5 and 6 to clarify those points. The legal mandate is clear in that not only breaches or obvious failures need to be reported to the database, but also potential breaches as defined in the RTS. The EBA also needs to ensure that the database will work as an early warning system. Moreover, the legal mandate is also clear that competent authorities need to report weaknesses and measures they have taken in response to those weaknessesseparately. Therefore, the seriousness of a weakness cannot be dependent on the fact that an enforcement proceeding has been successful at the national level. The EBA’s approach reflectsthis. Nevertheless, to ensure the consistent application of provisions in these RTS, and taking into account the feedback received, the EBA has amended the draft to make clear that when a competent authority assesses the materiality of a weakness applying its supervisory judgment, it should consider at least all the non-exhaustive criteria listed in Article 5 and take into account the context of the weakness. Materiality is therefore not triggered by a fixed, predetermined number of criteria. The EBA has also reviewed the wording of some of the criteria so as to reinforce consistent application by the competent authorities and has added one criterion regarding the impact on the orderly functioning of the financial market.
2. The quality of the information in the database and its sensitivity
Data contained in this database will relate to material weaknesses identified by competent authorities in financial sector operators and measures taken in response by the competent authorities. Respondents’ concerns related to:

the fact that the competent authorities should always provide documentary
evidence of the weakness while the upload of supportive documents is only an ability in the Consultation Paper (Article 13 (6) of the RTS);
the requirement that competent authorities should update the EBA if the weakness
is no longer material or no longer exists;
how the EBA will assess that the weakness has been properly identified. Some
respondents felt that financial sector operators should be notified when information

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database is reported to the database in relation to them, with the ability to provide some comments to the EBA before the information is included in the AML/CFT central database so as to allow financial sector operators to exercise their process rights under Union law. One respondent feared that competent authorities will use this database in lieu of national enforcement procedures in order to circumvent firms’ process rights;

the fear that financial sector operators for which material weaknesses have been
reported would be stigmatised and that this may affect their reputation. We have not amended the draft on this point. In line with the legal mandate, the material weaknesses have to be reported, as do the measures taken in response. Timely reporting is necessary to ensure that the database will work as an early warning tool. Ensuring the quality and accuracy of the information received in the AML/CFT is crucial. This is the reason why Recital 18 and Article 9 already set out specific provisions in that regard. In particular, Article 9 (4) sets out ‘that competent authorities shall provide without undue delay any information required by the EBA when the EBA determines that the information submitted is not accurate, complete, adequate or up to date’. Therefore, the competent authorities will need, for instance, to update the EBA if the weakness is no longer material or not a weakness in the end. Similarly, the competent authorities will also report the measures taken in response to the material weaknesses to ensure that the EBA has a comprehensive overview. The EBA also has to take into account the principle of proportionality. The various competent authorities that will report into the AML/CFT central database are already subject to a specific legal framework with supervisory rules. With regard to the sharing of the information, this will take place, as set out in the EBA Regulation, on a need-to-know and confidential basis with competent authorities for their supervisory activities with regard to the prevention of the use of the financial system for the purpose of money laundering or terrorist financing. A dedicated article in the RTS specifies the confidentiality rules that will apply. While the EBA Regulation has not provided for a notification to financial sector operators of the data that relates to them, the AML/CFT database does not replace the ongoing relationship or communication between the competent authority and the financial sector operators.

Make further use of the legal entity identifier (LEI)
One respondent welcomed the inclusion of the LEI in the RTS but regretted that it still allows financial sector operators to be identified with their national business registry numbers if the LEI is not available. It suggested that the EBA should make the LEI the foundational step in the AML/CFT central database for all legal entities so as to facilitate the flow of information and information sharing across and between the EBA and the competent authorities. It also suggested the consistent use of the LEI in all customer due diligence processes. The respondent referred to the European Systemic Risk Board's recent LEI Recommendation (ESRB/2020/12).

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database We have not amended the draft RTS on this point. The use of a legal entity identification number (LEI or national entity identifier) can be helpful but is not the only way to identify financial institutions. This is why provisions in the RTS have been drafted so as to guarantee fulfilment of the reporting obligation by the competent authorities. With regard to the respondent’s request about the use of the LEI for the CDD obligations under Directive (EU) 2015/849, defining the CDD obligations was not part of the RTS mandate under Article 9 a of the EBA Regulation. The view of the EBA on the use of the LEI in that context has been explained in the recently revised ‘ML/TF Risk Factors Guidelines’ under Articles 17 and 18(4) of Directive (EU) 2015/849 and its feedback table.
4. The technical specifications
All respondents expressed support forthe standardisation of the qualitative and quantitative information requested in the technical specifications. Some respondents underlined that the detailed points specified in the technical specifications will enable the efficient and effective functioning of the AML/CFT central database and that they agree with the list. Where respondents raised concerns, these related to the potential workload that its implementation may produce. The EBA subsequently simplified as much as possible the data collection with the use of pre-defined lists where appropriate. Moreover, some information regarding the financial sector operators is already available to the EBA. Recognising that the competent authorities may not always have the same level of detail of information, invarious places the competent authorities will have the ability to specify that the information requested may be ‘unknown’. It has also been clarified in various places where the information requested will be ‘not applicable’. The technical specifications have also been amended so as to reflect the changes made to the RTS.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Summary of the responses to the consultation and the EBA’s analysis Recitals The EBA has made consequential amendments to some Recitals to reflect changes made in RTS provisions in response to comments received during the public consultation. Recitals 5, 6, 8, 10, 15,16. 1 Article 3 Definitions One respondent suggested that the definition of a firm should not be limited to financial sector operators and that non-financial institutions should also fall within the scope of the RTS. Another respondent suggested including nonsupervised entities which intend to acquire a qualifying holding in a financial institution/investment firm when the qualifying holding acquirer is refused in a member state because of ML/TF risk. The legal mandate specified in Article 9a of the EBA Regulation refers to ‘financial sector operators’. Therefore,the scope of the RTS cannot be widenedso as to include ‘non-financial institutions’ or other entities. Similarly, if an entity applies for a licence but does not obtain it, it would not be qualified as a ‘financial sector operator’ and therefore it would not be in the scope of the RTS.
Annex 1, which defines the ‘corresponding situation’,
refers in part 2 ‘Prudential Authorities’ to the authorisation process and the process for the assessment of the acquisition of qualifying holdings. Therefore, if a competent authority come across a material weakness in those situations, the competent authority will have to report it to the AML/CFT central database. For clarity,the EBA has deleted the definition of ‘firms’ in the RTS as it was referring only to financial sector operators as requested by the EBA Regulation. The RTS and technical specifications now refer directly to ‘financial sector operators’. Minor amendmentsto Article 3.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
Article 3
Definitions
Two respondents requested further clarification of the definition of ‘ineffective application’, fearing that it may be applied in an inconsistent manner by the competent authorities. One of them also suggested applyingmateriality considerationsto this definition. The RTS defines separately a ‘weakness’, which includes ineffective application, and the ‘materiality of a weakness’. Only material weaknesses will have to be reported to the AML/CFT central database. The materiality of a weakness is specified in Article 5. There is therefore no need to add some materiality consideration in the definition of ‘ineffective application’. Nevertheless, so as to take into account the comment received and ensure the consistent application of this definition, the EBA has amended it. Amendment to article 3.
Article 3
Definitions
One respondent suggested that where a financial sector operator rectifies the ‘ineffective application’ of an AML/CTF requirement, the report submitted by the competent authority should be removed so as to ensure the database remains accurate and up to date. To ensure that the information in the database remains accurate and up to date, the RTS specify in Article 9 ‘Timelines and obligation to provide updates’ paragraph 3 that ‘Competent authorities shall ensure that the information submitted in accordance with this Regulation remains accurate, complete, appropriate and up to date.’ Similarly, Article 9 (5) sets out that ‘Competent authorities shall provide in due time all information necessary to keep the EBA informed about any subsequent developments relating to the information provided, including information related to the material weakness identified or to the measure taken and its remediation.’ None.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
Article 3
Definitions
One respondent underlined that the definition of ‘breach’ or ‘potential breach’ does not appear to delineate the severity of breaches and called for the adoption of a risk-based approach to focus on serious and very serious breaches, similar to the obligation imposed on firms to follow a riskbased approach. As requested in the mandate received, the RTS specify the definition of a ‘weakness’ (Article 3 and 4) and the ‘materiality of a weakness’ (Article 5). In order to take into account the principle of proportionality, only material weaknesses will be reported to the EBA. For this purpose,the RTS specify how to determine the materiality of a weakness and have set out a general definition and a list of criteria which specify that definition further. One of the criteria focuses, in particular, on the fact that the weakness is ‘(…) serious or egregious (gravity); None.
Article 3
Definitions
One respondent underlined that only proven breaches should be reported to the AML/CFT central database as these are the only ones for which there is sufficient grounds, information and proof. The definition of a ‘weakness’ has to include the notions described in Article 9 a of the EBA Regulation, which are a ‘breach’, a ‘potential breach’ and ‘ineffective or inappropriate application’ and therefore cannot be limited to a ‘breach’. None.
Article 3
Definitions
One respondent requested further clarification of the definition of a ‘potential breach’with regard to the meaning of ‘attempted breach’ which implies an active behaviour, whilst breaches are very often caused by a lack of action or compliance. The EBA takes is of the view that the definition of a potential breach covers both active and passive behaviour. Potential breaches dues to a lack of action will have to be reported to the AML/CFT database. None.
Article 3
Definitions
Some respondents requested further clarification of the meaning of ‘supervisory and administrative measures’ in the The definition aims to cover the various types of measures taken by a competent authority on a financial sector operator in response to the material None.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database definition of a measure, one of them wondering whether enhanced follow-up checks would be considered as a measure. Another respondent requested replacing measures ‘taken’ by ‘measuresimposed’. weakness. This definition needs to cover the measures taken in response not only to a material ‘breach’ but also a ‘potential breach’ or ‘ineffective application’. For instance, enhancing the number of follow-up checks on a financial sector operator is a measure that will have to be reported to the EBA. The same applies if the number of meetings with the financial sector operator is increased. By contrast, setting up internal training for the competent authority’s staff will not have to be reported. Only measures taken in response to material weaknesseswill have to be reported –in practicethen, not all the measures taken by the competent authority. Moreover, Article 9 a of the EBA Regulation refers to ‘measures taken’ and therefore the RTS need to be in line with the legal mandate’s wording and to retain the term ‘taken’.
Article 3 A clarification was sought during the analysis of the
consultation responses on the definition of ‘branch’, ‘third country branches’ and ‘AML/CFT requirement’:

The definition of a ‘branch’ also referred to other
forms of establishments treated or regarded like a branch and it was not sufficiently clear what this entailed.
The definition of a third country branch did not
appear necessary as the definition of a branch In light of these comments, the definition of a third country branch has been deleted. The definition of a branch has been shortened and no longer refers to other forms of establishment. The RTS refer separately to ‘agents’ and ‘distributors’. The RTS have been modified to refer to ‘AML/CFT-related requirements’. Amendments to Article 3 and consequential amendment to the relevant
part of the draftRTS.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database already refers to a branch with a head office in a third country.

A suggestion was made to add the term ‘related’ to
the definition of ‘AML/CFT requirement’ –
AML/CFT-related requirement – so as to avoid the impression that a large portion of CRD, Solvency II, PSD and other sectoral legislation is composed of AML/CFT requirements.
Annex 1
‘Correspondin g situations’
General comment
One respondent underlined that the list in Annex 1 should explicitly indicate which types of competent authorities are to adhere to the provisions. The clarification is crucial in terms of determining which competent authorities should have indirect access to the database through a ‘sequential approach’. The corresponding situations are defined in Annex 1 with regard to the different types of competent authorities within the scope of these RTS,which are themselves defined in Article 3. The list of competent authorities whichwill report indirectly the AML/CFT database is specified in the technical specifications. For further clarity, the EBA has added a heading in the
Annex to clarify that competent authorities may come
across weaknesses in the following situations specified in the Annex.
Minor amendments to Annex 1.
Annex 1
‘Correspondin g situations’
Some respondents have requested slight adjustments of various specific parts of Annex 1 ‘Corresponding situations’:
-With regard to Part 3 ‘Designated authorities’:
One respondent underlined that thisshould also include onsite and off-site DGS inspections/audits, in addition to DGS payouts and stress tests. As such inspections can be seen as part of preparing for a DGS intervention and the stress testing framework allows for on-site and off-site inspections, they were already included. With a view to avoiding any ambiguity, the EBA has adjusted the RTS by explicitly mentioning the on-site and off-site inspections. Minor amendments to Annex 1 part 3 ‘Designated Authorities’.
Annex 1 -With regard to Part 2 ‘Prudential authorities’: EBA has amended the drafting so as to take into
account the concerns expressed regarding points 1) c) and 1) d). With regard to 1) g), there is room to assess Minor amendments to Annex 1 Part 2 ‘Prudential Authorities’.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database ‘Correspondin g situations’ Some respondents requested slight amendments of Part 2 ‘Prudential authorities’:

1. c) as the conduct of business under freedom of
  services or freedom of establishment is not subject to authorisation;
1. d) if there is no shareholder with a qualified block
  of shares; such analysis is possible at the stage of establishing a bank - it will not apply in cases concerning the acquisition of qualified blocks of shares.
One respondent suggested to add one more
situation in Part 2 (1) ‘Assessment of the ownership structure up to beneficial owner(s)’.
1. g) One respondent underlined that they have
  limited possibilities under their national framework to request information on ICT risks from the point of view of AML/CTF during proceedings concerning the acquisition of qualifying shareholdings. ICT security and risk management also in the context of the acquisition of a qualifying holding under the sound and prudent management criterion (ICT as part of internal governance). With regard to the assessment of the ownership structure, the RTS set out that ‘Assessment of the sources of funds to pay up capital at authorisation or the source of funds to purchase the qualifying holding;’

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
Article 4 and
Annex 1
With regard to Part 4 ‘Resolution authorities’:
One respondent underlined that the powers of the resolution authorities are stated in the level 1 Directive (EU) (2014/59)- BRRD and therefore a delegated regulation cannot overwrite it. Moreover, the resolution authority does not have any additional data and powers at its disposal compared to the supervisory authorities. The current requirement of the AMLD and BRRD are clear and the respondent see no reason to establish an additional channel of data collection which may hinder a rapid resolution action. Resolution authorities in the scope of the AML/CFT database and they will therefore have to report material weaknesses to the EBA. One recital recognizes that they do not have the same level of information as the AML/CFT competent authorities and that they will enter information on a best effort basis. In order to anticipate considerable differences in the reporting frequency between the competent authorities due to their supervisory responsibilities a sequential approach has been elaborated in order to ensure operational and cost efficiency. Resolutions authorities with exception of the SRB are authorities indirectly submitting to the AML/CFT Central database. So as to take into account the principle of proportionality, only material weaknesses will have to be reported to the AML/CFT Central Database. None. Type of information
Article 6, 7
and 8
General comment
One respondent considered that article 6, 7 and 8 should set out that only available information among the ones described in those articles should be provided by the competent authorities and on a best effort basis. The legal mandate is not for the EBA to define the legal obligation to report to the AML/CFT Central database but the type of information that should be provided. With regard to the legal obligation to report, Article 9 a specifies: ‘Competent authorities shall provide all such information to the authority (…)’ The RTS recognizes in a Recital that some authorities do not possess the same level of AML/CFT information and expertise as the supervisory authorities designated as competent under Directive (EU) 2015/8495 and that information should be reported to the database on a best efforts basis by those competent authorities. None.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Data protection Some respondents madesome comments in relation to data protection:
One respondent underlined that the type of information requested in 8(d) to 8(f) (existence of a measure regarding a natural person, description of the measures, status) is very sensitive and could even qualify as information relating to criminal offences. One respondent underlined that with regard to data related to criminal offences, stricter rules apply to the dissemination of the information. The EBA Regulation stipulates in Article 9a (2) that:
The Authority may, where appropriate, transmit evidence that is in its possession which could give rise to criminal proceedings to the national judicial authorities and the competent authorities of the Member State concerned in accordance with national procedural rules. The Authority may also, where appropriate, transmit evidence to the European Public Prosecutor’s Office where such evidence concerns offences in respect of which the European Public Prosecutor’s Office exercises or could exercise competence in accordance with Council Regulation (EU) 2017/1939 . Thus the legislators haveenvisaged that the competent authorities could provide such sensitive information to the EBA. The EBA has elaborated a Data Protection Impact Assessment and a Summary of the draft DPIA was published on the EBA website at the time of the publication of the CP. The EBA will consider whether some adjustments areneeded to the draft DPIA on this topic. None. Data protection One respondent wondered whether the sharing the provision in article 8 (k) could present the risk of infringing the principle of purpose limitation. ‘(k) whether and which information relevant to this measure should be communicated by the EBA to other competent authorities, which competent authorities these are and the reason thereof;’. Not applicable, this provision has not been kept in the final report on the RTS (see feedback table below for the rationale for the deletion). Deletion of article 8(k).

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
Article 6
(general information)
One respondent underlined that it might be necessary to define the meaning of ‘home’ in Article 6 (d). One respondent considered that the mention of ‘or any other firm of the relevant group, is subject to any proceedings set out in Directive 2014/59/EU or any other insolvency proceedings;’ ‘may be too complicated and lead to delaysin reporting’. The meaning of home in Article 6(d) has been set out and Article 6 has clarified that this provision is also addressed to the ECB and the SRB. So as to simplify reporting, ‘or any other firm of the relevant group’ in Article 6(g) has been deleted. As resolution and insolvency are differentiated, ‘other’ in ‘or any other insolvency proceedings’ has been deleted. Amendments to Article 6.
Article 6 and
Annex 3
‘ML/TF risk profile/
One respondent considered that there is a need for further guidance by the EBA on how to quantify inherent risk as well as on the control effectiveness score. The EBA’s revised Risk Based Supervision Guidelines (RBSGLS) contain some guidance on those topics. The EBA has adjusted point iv. of the Annex for consistency with the Final RBSGLS. Minor amendments to Annex 3.
Article 7
(Type of information to be submitted for the material weakness) One respondent requested that the competent authority should be required to demonstrate the existence of a weakness.
Article 7 contains detailed types of information that
aim to describe the weakness that will have to be reported by the competent authority, including ‘the reason for materiality as set out in Article 5’, as well as the description of the material weakness and the corresponding situations, timeline etc. None.
Article 7 (m) One respondent requested further clarification with regard
to the provision about the link with a natural person. The respondent wondered whether this was probably more when the weakness was ‘caused’ by a client and also This provision only applies when there is a material weakness as defined in the RTS and not to every weakness. With regard to the client, both situations could be potentially covered: a client who takes advantage of a weakness in the financial sector None.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database underlined that the database should not function as a way to report ‘STRs’, as this is the role of FIUs. It considers it more plausible that a weakness be linked to a specific natural person within the institution – such as a manager who was influencing the decision-making processes in order to lower the AML/CFT controls on purpose. operator’s preventive procedures, for instance, or a client who causes the weakness. The aim of the AML/CFT central database is not to collect STRs asthis is not within the scope of the legal mandate given to the EBA. The EBA does not expect reporting under
Article 7(m) with regard to clientsto be very frequent.
Article 7 (n) One respondent wondered whether 7(n) b was addressed
to all the competent authorities or only to the AML/CFT authorities and what type of emerging risks are concerned here. Another respondent considered not clear what was meant by ‘specific area relevant for AML/CFT already identified by the EBA’.
Article 7(n) b applies to the AML/CFT authorities only
and the EBA has therefore added an explicit reference to AML/CFT authorities for further clarification. With regard to emerging risk, the aim is to refer to ML/TF emerging risk, and therefore the clarification has been added. With regard to the ‘specific area relevant for AML/CFT already identified by the EBA’, the explanation is already provided in the technical specifications:
Evolving list that will be elaborated by the EBA based on the areas it will have identified (pre-defined list with multiple choice). Examples of risks previously identified in the Opinion on ML/TF Risk: de-risking, tax-related crime, ML/TF risk arising as a result of COVID-19, risk associated with terrorist financing. Amendments made to article 7 (n) b.
Article 8
(Type of information transmitted in relation to measures One respondent mentioned that the collection of data on measures taken by competent authorities may have a disproportionate impact on firms offering cross-border services. This respondent provides an example of a firm’s home competent authority,which may take a ‘tick-box’ approach, applying frequent low-value fines for minor Only material weaknesses and measures taken in response to those material weaknesses will have to be reported to the AML/CFT database. To assess the materiality of a weakness, the competent authority will have to apply its supervisory judgement and not follow None.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database taken in response to material weaknesses) breaches which could then trigger visits and inspections from the host authority, despite the fact that this report triggering such action would normally be considered minor by another authority and/or may have already been rectified by the firm immediately after being identified. a tick-box approach. Subsequent developmentsshould also be reported to the AML/CFT central database, so if the weakness is rectified by the financial sector operator, the competent authority will have to update the EBA.
Article 8(c) One respondent suggested replacing ‘when published’ by ‘if
published’, as it is often the case that provisional/preliminary measures arenot published. The RTS have been amended accordingly. Minor Amendment to article 8 c).
Article 8(d) One respondent commented in relation to the point below
‘full information as to the legal and natural persons which the measure concerns; any reporting on natural persons shall be made in accordance with Annex 2;’ The respondent wondered whetherthe client is no longer covered.
Annex 2 and the technical specifications refer to the
‘functions in the firms’.
A reference to the ‘role’ (with regard to customer of beneficial owner)’ has been added in Annex 2 as it was deemed missing. Amendmentto Annex 2.
Article 8 One respondent underlined that increased information
exchange with respect to AML may create uncoordinated supervision, and the respondent would like to see some safeguards. The respondentsuggested reinforcing the role of the colleges in the RTS, including clear guidance on how the information should be used in order to avoid inefficient supervision practices. The RTS have given a fundamental role to the colleges as the EBA will uses the colleges as a privileged way to share the information from the database on its own initiative (see Article 10). So as to avoid uncoordinated supervisory actions, the RTS set out that the EBA will reach out to the lead supervisor, lead supervisor/group supervisor/consolidating supervisor/group level resolution authority. The EBA AML/CFT colleges guidelines contain guidance on the functioning of the AML/CFT colleges. The RTS have also clarified the respective responsibilities with the deletion of the provisions in Amendments to Articles 8(k) and 7(o) and 8(j) and 7(j).

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database the RTS in Articles 8 (k), and 7(o) and the simplification of the provisions in Articles 8(j) and 7(i) and (j).
Annex 2
Information on natural persons

One respondent wondered how far a competent
authority should go to consider that,for example, CDD has been conducted effectively. The respondent considers that such expectations may clash with the GDPR’s proportionality principle.
One respondent underlined that reference is made
to ‘nationality’ and wondered if this means that nationality will become a compulsory element that needs to be registered for CDD. The same respondent wondered what the rationaleis behind asking for the nationality of individuals. AML/CFT authorities may come across material weaknesses in CDD when carrying out their supervisory activities and they will have to report those to the EBA. The legal mandate given to the EBA with this RTS does not require the EBA to define what CDD entails. The RTS need to ensure that natural persons are properly identified. Nationality is an important set of data that can help to identify a person and to avoid mistakes. It enhances the accuracy of the data set. There may be very common names in different countries, and the date of birth may also be the same. The information on nationality appears to be less intrusive in order to achieve that goal. None.
Annex 2
Information on natural persons
4 a (c)
One respondent considered that the purpose being required to support a proposed disclosure of personal data is too vague – i.e. the competent authority only has to say the personal data is ‘relevant’, as distinct from ‘necessary’, and also it is not made completely clear that the competent authority must articulate why it needs the information.
Annex 2 requests the competent authority to specify
the ‘rationale for the request’,which includes whether the information about that specific person is relevant as well as the intended use(s) of the information requested. The RTS have been amended to be more explicit that the competent authority should explain the reason why the information is necessary. Amendments to Annex 2.
Annex 2
Information on natural persons
One respondent considered that provisions on secure data disclosure from the banks to the EBA are missing and should be mentioned in the RTS. The EBA is not going to collect data directly from financial sector operators, butrather from the competent authorities. None.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
Article 9 As part of the analysis of the responses to the consultation,
some comments were made with regard to the use of ‘immediately’ in Article 9.

One respondent felt that ‘immediately’should only
start to apply after obtaining all the information required pursuant to Articles 6, 7 and 8.
One respondent felt that ‘immediately’ should be
defined more precisely and suggested specifying a longer period of time as a submission deadline, as needed for the evaluation and internal discussion of the information obtained.
Some respondents requested the replacement of
this word by ‘in due time’, and some by ‘without undue delay’. The moment at which the weaknesses must be submitted should be when supervisors have obtained assurance of the finding and its materiality, and this certainty may be obtained at a later stage than its immediate detection; With regard to the starting point of the delay, in Article 9 a (1) the RTS explicitly refer to ‘material weakness’, which implies that the materiality of the weakness has been assessed for it to be reported. All the various types of weaknesses have to be reported to the AML/CFT database (breach, potential breach and ineffective or inappropriate application). The draft has been amended and now refers to ‘without undue delay’. This wording is meant to emphasise the urgency of the reporting for the database to be effective and support early intervention to mitigate risks before they crystallise, This wording does not mean thatthe competent authority can delay the reportingprocess. Amendments to Article 9.
Article 10 and
With regard to the analysis of the information by the EBA, one respondent asked what parameters the EBA will use to analyse the information The EBA will analyse the information received following a risk-based approach. The EBA may seek, where appropriate, to combine information submitted in accordance with this Regulation with information available to the EBA or with information that the EBA has gathered from other sources during the performance of its tasks. The EBA may also seek, where appropriate, to obtain additional information from the ESMA and EIOPA. The EBA needs Minor amendments to Articles 9, 10 and 11.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database to keep some flexibility in the analysis so as to perform it in the most efficient manner. The provisionsthat the EBA will review the information submitted and shall request additional or subsequent information have been deleted from this
article and moved to Article 9 in order to avoid a
cross-reference between the two articles.
Article 13 (2) One respondent underlined that rather than providing the
EBA with a summary in English,the competent authorities should be requested to submit the full translation of the supporting document in English so as to ensure the EBA has a full understanding. There is a need to ensure proportionality and avoid excessive costs to the competent authorities. Therefore, where the supporting documents are not available in English, their submission should be made in the original language of the document accompanied by a summary in English. This rationale is also explained in Recital 17. The EBA will still be able to request some clarification if the information submitted is not accurate, complete, adequate or up to date as set out in Article 9 of the RTS. None.
Article 13
Sequential approach
Some respondents stressed that they support the sequential approach so as to achieve operational and cost efficiency both for the competent authorities and the EBA, as well to ensure a more standardisedapproach. Based on further discussions during the analysis of the responses to the public consultation, it appearsthatthe RTS were unclear on how the notifications under Article 9 (a) 3 will be carried outfor the authorities indirectly submitting to the AML/CFT central database. The EBA takes note of the support expressed for the sequential approach. The draft has been amended so asto follow the same process for the notifications under Article 9 (a) 3 and to clarify that these notifications will be sent to the authorities indirectly submitting the information through the authorities enabling the indirect submission. Addition of d) in Article 13 4).

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
Article 14
Confidentiality
As part of the analysis of the responses to the consultation, some concerns were expressed that the dedicated confidentiality regime set out in Article 14 4) was not sufficiently clear and also did not sufficiently take into account the various existing confidentiality regimes,which could create some legal challenges. With a view to simplifying the draft and providing further clarity, the EBA has amended the provisions in the RTS and now refers to the relevant existing confidentiality regimes. Amendment to Article 14 4).
Article 15 and
Annex 2
Data protection

One respondent underlined that the consultation
refers to the fact that the EBA has mentioned its intention to approach the European Data Protection Supervisor (EDPS) and underlined that it would provide comfort to receive more information on how its recommendations/advice is taken into account in the RTS.
Some respondents note that the retention period
of the data is not specified in the RTS.
The EDPS has provided informal feedback to the EBA without prejudice to the formal feedback that will be given later to the European Commission when the European Commission reviews the RTS. The EBA has implemented the EDPS’s proposals. The retention period of the data, which was mentioned in the draft DPIA published at the same time as the CP, has been added to the RTS. Addition of the retention period of the data in Article 15 4).

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
5. Annexe
Technical specifications in accordance with Article 13(7) of the regulatory technical standards under
Article 9a (1) and (3) of Regulation (EU) No 1093/2010 setting up an AML/CFT central database
Data Points
Article of the
RTS
Type of information Data points
Article 6 Type of
information - general
6 (a) Identification of the competent authority Identification of the authority indirectly submitting the information where Article 13(4) applies The name of the authority; The Member State of the authority (pre-defined list, single choice) The type of authority (pre-defined list, single choice) AML/CFT authority; Prudential authority; Resolution authority; Designated Authority; Conduct of business; Payment institutions authority; Specification of home and host AML/CFT authority (pre-defined list, single choice) Home authority;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Host authority; If the AML/CFT authority acts as the home authority, name of the AML/CFT authority acting as host (predefined list, single choice) and vice versa 6(b) Identification of the financial sector operator and of its branches, agents and distributors under Directive (EU) 2015/2366 and Directive (EU) 2009/110 concerned by the material weakness or the measures taken, including the type of financial sector operator and,where applicable,the type of establishment; The legal name of the financial sector operator/branch/agent and distributor The commercial name of the financial sector operator/branch/agent and distributor(if different from the legal name) The address of the financial sector operator/branch/agent and distributor:
a) Street address; b) Postcode; c) City; d) Country (pre-defined list, single choice) The type of financial sector operator (also to be completed for branch/agent and distributor) (pre-defined list, single choice) Credit Institution; Credit union; Credit provider (other than credit institutions, for example consumer credit, factoring, leasing, mortgage credit and commercial credit); Life insurance undertaking; Life insurance intermediary E-money institution; Payment Institution; Bureau de change; Investment firm; Collective investment undertakings/fund managers:
Alternative investment fund managers as defined under Article 4(1)(b) of Directive 2011/61/EU, including registered (sub-threshold) and authorised AIFMs13 as well as non-EU AIFMs managing EU AIFs or marketing (EU or non-EU) AIFs to investors in the EU; 13 Including internally managed AIFs in accordance with Article 5(1)(b) of the AIFMD.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database ‘Management companies’ as defined under Article 2(1)(b) of Directive 2009/65/EC; ‘Manager of a qualifying venture capital fund’ as defined under Article 3(c) of Regulation (EU) No 345/2013; ‘Manager of a qualifying social entrepreneurship fund’ as defined under Article 3(1)(c) of Regulation (EU) No 346/2013; ’Manager of European long-term investment funds’ as defined under Article 2(12) of Regulation (EU) 2015/760 ‘Alternative investment funds’ as defined under Article 4(1)(a) of Directive 2011/61/EU14, marketing their units or shares; Other type of financial sector operator (free text) The material weakness concerns (pre-defined list, single choice):
Branch of a financial sector operatorlocated in another European Union Member State; Branch of an entity located in a third country. In this case, the third country concerned (pre-defined list, single choice) A network of agents or distributors Other formof establishment(free text) Not applicable The entity identifier of the financial sector operator/branch/agent and distributor a) The legal entity identifier (LEI) if available (for a branch/agent and distributor: the LEI of the financial sector operator); A code that allows legally distinct entities that engage in financial transactions to be uniquely identified b) The national identifier In the case of an agent under Directive (EU) 2015/2366 on payment services in the internal market: the national identification number 6(c) Where the financial sector operator is part of a group, identification of the Union parent financial sector Is the financial sector operator part of a group? Yes No 14 Including European venture capital funds (EuVECA), European social entrepreneurship funds (EuSEF), European long-term investment funds (ELTIFs) and money market funds (MMF) qualifying as AIFs in accordance with Article 4(1)(a) of Directive 2011/61/EU

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database operator, the parent financial sector operator in a Member State; The name of the Union parent financial sector operator; The name of the parent financial sector operator; The address of the Union parent financial sector operator/parent financial sector operator:
a) Street address; b) Postcode; c) City; d) Country (pre-defined list, single choice). Type of the union parent financial sector operator/parent financial sector operator (on a voluntary basis): (predefined list, single choice) Not applicable, the financial sector operator is a subsidiary of a legal entity situated in a third country (predefined list of countries, single choice) 6(d) In the case of the European Central bank, the Single Resolution Bord or the national competent authorities of the Member State where the registered office of the financial sector operator is situated, or, if the financial sector operator has no registered office, of the Member State in whichits head office is situated, identification of the countries in which the financial sector operator operate branches and subsidiaries or through a network of agents and distributors; Countries where the financial sector operator operates branches/agents and distributors(EU/non-EU) (Pre-defined list, multiple choice) Countries where the financial sector operator operates subsidiaries (EU/non-EU) (Pre-defined list, multiple choice) 6(e) where the financial sector operator is part of a group, information as to any college established where the competent authority participates including information on the members, observers, lead supervisor/group supervisor/ consolidating supervisor/group level resolution authority of that college The type of college established where the competent authority participates (if any):
The competent authority participates in an AML/CFT college If so, role of the competent authority in the AML/CFT college (pre-defined-list, single choice)? Permanent member; Observer; Lead supervisor. If it is not the lead supervisor, name of the authority that is the lead supervisor and country (free text); The competent authority participates in a prudential college If so, role of the competent authority in the prudential college (pre-defined-list, single choice Permanent member; Observer;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Consolidated supervisor/group supervisor; If it is not the consolidated supervisor/group supervisor, name of the authority that is the consolidated supervisor/group supervisor and country (free text); c) The competent authority participates in a resolution college If so, role of the competent authority in the resolution college (pre-defined list, single choice) Permanent member; Observer; Group lead resolution authority (GLRA) of this college. If it is not the GLRA, name of the authority that is the GLRA and country (free text); Not applicable 6(f) Whether there is a central contact point as referred to in Article 45(9) of Directive (EU) 2015/849, where applicable, and its identification; Yes; No To be completed in situations where agents or distributors under Directive (EU) 2015/2366 on payment services in the internal market and Directive (EU) 2009/110 are concerned by the material weakness. Is ‘yes’ is selected:
Name;
Contact details.
6(g) Any other relevant information, including whether the financial sector operator is currently applying for authorisation, establishment or other supervisory approvals, whether the financial sector operator is in the process of application to exercise its right of establishment or its freedom to provide services, and whether the financial sector operator is subject to any proceedings set out in Directive 2014/59/EU or other insolvency proceedings; The current status of the financial sector operator (from a pre-defined list, single choice):
Request for an extension of authorisation/date; Authorised/date; Request for passporting/date; In the process of application to exercise its right of establishment/date; In the process of application to exercise its right to provide services under the freedom to provide services/date Withdrawal of authorisation /date Suspension of authorisation/date Resolution/date Liquidation/ date; 6(h) Information on the size of the financial sector operator’s and branch’s activities, including, where applicable:
a) information on financial statements; b) number of clients; With regard to the type of financial sector operators below, the following information shall be provided (information in the Member State, at the time of submission) a) For Credit Institution, Credit Union, Credit provider, Payment institutions and E money institutions,

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database c) volume of assets under management; d) for an insurance undertaking: its annual gross written premium (GWP) and the size of its technical provisions e) for an insurance intermediary: the volume of premiums intermediated; f) for payment institutions and electronic money institutions: the size of the distribution network including information on the number of agents and distributors; Balance sheet of the financial sector operator (total assets (liability + equities)/date (to be submitted by the prudential competent authority on a mandatory basis/voluntary by the others); approximate number of clients; b) For life insurance undertakings(to be submittedby the prudential competent authority on a mandatory basis/voluntary by the others):
annual gross written premium (GWP); size of the technical provisions. c) For life insurance intermediaries:
the volume of premiums intermediated d) For payment institutions and e-money institutions: number of agents/distributors operating in the Member State (to be completed by the host AML/CFT competent authority); e) For investment firms: client assets under management and amount of own assets (balance sheet (total assets) /date); f) Collective investment undertakings/fund managers: approximate number of clients, assets under management, balance sheet (total assets)/date g) Other type of financial sector operators: approximate number of clients, assets under management, balance sheet (total assets)/date) 6(i) Prudential authorities shall, in addition to points (a) to (h), specify the following:
a) The result of the relevant risk assessment of any supervisory review process, including of the processes referred to in Article 97 of Directive 2013/36/EU and Directive 2019/138/EC and of any other similar process impacted by the ML/TF risk of the financial sector operator or of the branch, including in the areas of internal governance, business model, operational risk, liquidity and credit risk; Free text b) Any negative final assessment or decision on an application for authorisation or approval, including where a member of the management body does not meet the requirements on fitness and propriety, where such decision is also based on grounds of Free text Any reporting on natural persons shall be made in accordance with Annex 2 of the draft RTS.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database ML/TF risks. Any reporting on natural persons shall be made in accordance with Annex 2. 6(j) AML/CFT authorities shall, in addition to points (a) to (h), provide the ML/TF risk profile of the financial sector operator and branch as well as available information about agents’ and distributors’ ML/TF risk profile using the categories specified in Annex 3. Categories as specified in Annex 3 of the draft RTS
Article 7 Type of
information to be submitted for the material weakness 7(a) The type of weakness as set out in Article 4 paragraph 1; (Pre-defined list, single choice) Breach; Potential breach; Ineffectiveor inappropriateapplication. 7(b) The reason for materiality as set out in Article 5; a) The criteria that constitute the materiality as defined in Article 5 (pre-defined list, multiple choice); b)Other reason if not in the list of criteria (free text); 7(c) The description of the material weakness; Free text 7(d) The corresponding situation where the weakness has occurred in accordance with Annex 1; (Pre-defined list, multiple choice) in accordance with Annex 1 of the draft RTS For AML/CFT authorities, more details to be provided based on the list in Annex 1 Part 1 (pre-defined list, multiple choice).

Customer due diligence measures, including customer ML/TF risk assessments and the reliance on
third parties and transaction monitoring;
i. Existence and adequacy of the AML/CFT policies and procedures:
Existence and adequacy of the identification and verification
policies and procedures;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
2. Existence and adequacy of the policies and procedure to assess
and obtain information on the purpose and intended nature of the business relationship;
3. Existence and adequacy of other policies and procedures (free
text)
ii. Effectiveness of the application of the identification and verification policies
and procedures

Customer identification;
Customer verification;
Customer risk rating;
Remote onboarding;
Beneficial ownership identification;
Beneficial ownership verification;
Identification of politically exposed persons;
EDD in relation to politically exposed persons;
EDD in relation to correspondent banking relationships:
EDD with regard to high-risk third countries as defined in Article
9 AMLD;
The material weakness implied jurisdictions associated with a
higher ML/TF risk as assessed by thefinancial sector operator;
Simplified due diligence.
Reliance on a third party;
Other (free text)
iii. Transaction monitoring;
Existence and adequacy of the ongoing monitoring policies and
procedures, including transaction monitoring;
Effectiveness of ongoing monitoring, including transaction
monitoring.
EDD: complex transactions/unusually large
transactions/conducted in an unusual pattern/do not have an apparent or economic lawful purpose;
Inappropriate management of risks arising from the
characteristics of the products/services/delivery channels/ geographic areas, type of customer (inadequacy of the risk-based approach applied);

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
2. Suspicious transaction reporting;
i. Existence and adequacy of suspicious transaction reporting policies and
procedures;
ii. Effectiveness of the suspicious transaction reporting:

Identification of STRs;
Quality of STRs;
Delays in reporting STRs;
Average time to report STRs (free text/number)
Failure to report STRs;
Other (free text)
Record-keeping;
i. Existence and adequacy of policies and procedures with regard to recordkeeping;
ii. Effectiveness of the record-keeping
Quality of record held;
Failure to keep record;
Retention period of the record;
Others (free text);
Internal AML/CFT systems and controls;
i. Existence and adequacy of the internal control policies and procedures;
ii. Effectiveness of the application of the internal control policies and
procedures;
iii. Adequacy of the governance structure including reporting lines and senior
management responsibility
Independency of the compliance function;
Effectiveness of governance structure including reporting lines
and senior management buy-in;
Senior management oversight;
iv. Adequacy of AML/CFT human and material resources;
v. Awareness of ML/TF risks, including availability and effectiveness of staff
AML/CFT training;
vi. Other (free text)

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database
5. Risk management system, including business-wide ML/TF risk assessments;
i. Existence of a business-wide risk assessment;
ii. Adequacy of the business-widerisk assessment;
iii. Timeliness of the business-wide risk assessment
iv. Quality of the business-wide risk assessment;
v. Other (free text)
6. Group-wide policies and procedures, including policies for sharing information within the group.
i. Existence of the group-wide policies and procedures;
ii. Adequacy of group-wide policies and procedures;
iii. Effectiveness of group-wide policies and procedures;

Procedure for sharing information within the group for AML/CFT
purposes;
Data protection policies and procedures;
Situation where the third country’s law does not permit
implementation of the policies and procedures (RTS on third countries).
With regard to another topic, to be specified (free text)
For prudential authorities, when the corresponding situations relate to natural persons, reporting is conducted in accordance with Annex 2 paragraph 1. 7(e) Timeline of the material weakness The starting date of the material weakness (pre-defined list, single choice):
‘date’ unknown;
The date on which the material weakness was known for the first time by the authority (detection date) The current status of the material weakness (pre-defined list, single choice):
The material weakness hasterminated: ‘end date’; The material weakness is ongoing; Unknown.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database 7(f) Identification of the origin of the information on the material weakness The reporting authority Off-site monitoring; a) Date; b) Type (pre-defined list, single choice) Regular off-site monitoring;
Schedule off-site review;
Ad hoc off-site review;
Off-site thematic review;
Off-site follow-up review;
AML/CFT returns (regular or ad hoc requests to financial sector operators for quantitative and qualitative data and information relating to key ML/TF risk indicators. AML/CFT returns are different from off-site inspections in that they are frequently automated and often not comprehensive. Their aim is often to help supervisors gain a better understanding of the ML/TF risks to which their sector is exposed, rather than to assess the adequacy of a financial sector operator’s AML/CFT systems and controls). Other (free text) On-site inspection; a) Date; b) Type (pre-defined list, single choice) Full-scope inspection; Scheduled targeted inspection; Ad hoc inspection; Thematic inspection; Follow-up inspection; Inspections that include an AML/CFT element; On-site engagements (other type of on-site engagements with a financial sector operator or the financial sector operator’s key personnel either at the premises of the financial sector operator or at the competent authority. These engagements are likely to include bi-lateral meetings with the financial sector operator’s personnel, which are scheduled in line with the risk-based

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database approach. Such engagement is not part of the other type of onsite inspection.); Other (free text). Authorisation procedure; Passport notification; Other (free text). Another authority (e.g. in the context of a college or, in general, as a result of cooperation and the exchange of information); Financial Intelligence Unit (FIU); Third party such as auditor; Other law enforcement authorities; Whistleblowing; Breach reports from the public (including under article 23 of SSM Regulation); Media report (to be specified, free text); Any other credible source of information (free text). 7(g) The AML/CFT-related requirements to which the material weakness relates; References in the EU framework; Directive (EU) 2015/849 (AMLD); Regulation (EU) 2015/847 on information accompanying transfers of funds (AMLR); Directive (EU) 2015/2366 on payment services in the internal market (PSD 2); Directive (EU) 2009/110 (EMD 2); Directive (EU) 2009/138 on the taking-up and pursuit of the business of insurance and reinsurance (Solvency 2); Directive (EU) 2013/36 (CRD); Regulation (EU) 2019/876 (CRR); Directive (EU) 2019/2034 (investment firms); Deposit Guarantee Schemes Directive; Directive (EU) 2014/65 (MiFiD 2); Directive (EU) 2009/65 of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS); Directive (EU) 2011/61 of 8 June 2011 on alternative investment fund managers; Regulation (EU) No 345/2013 of 17 April 2013 on European venture capital funds; Regulation (EU) No 346/2013 of 17 April 2013 on European social entrepreneurship funds; Regulation (EU) 2015/760 of 29 April 2015 on European long-term investment funds; Regulation (EU) 2017/1131 of 14 June 2017 on money market funds;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Other(free text). References in the national framework (free text). 7(h) the type of products, services or activities for which the financial sector operator has been authorised that are impacted by the material weakness; The information regarding the type of products, services or activities impacted by the material weakness (predefined list,multiple choice) Correspondent banking; Retail banking; Electronic money; Money remittance; AIS and PIS; Other payment services as referred to in Annex I to PSD2 (free text); Wealth management; Asset management; Trade finance; Life insurance; Investments firms; Crowdfunding; Currency exchange; Corporate finance; Other (free text). The activity (activities)/service(s) for which the financial sector operator has been authorised which is (are) the subject of the material weakness: (free text). 7(i) Whether the material weakness concerns the financial sector operator, branch or agentor the distributor alone, as well as any cross-border impact of the material weakness (Pre-defined list, single choice) The material weakness concerns the financial sector operator, branch, agentor distributoralone; Yes; No Any cross-border impact of the weakness: other Member States/third countries that may be impacted (pre-defined list, multiple choice) 7(j) Whether information on the material weakness has been communicated to a college that has been Ifthe competent authority participates in a college,whether the informationaboutthe material weakness has already been communicated to that college

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database established for the group where the financial sector operator belongs; if not communicated yet: the reason why; Yes; No If no, the reason why (free text) 7(k) for the host AML/CFT competent authorities:
whether the information on the material weakness has been communicated to the home AML/CFT competent authority or to the central contact point as referred to in Article 45(9) of Directive (EU) 2015/849 whereapplicable; if not communicated yet:
the reason why;
For the host AML/CFT authority:
a) Has the material weakness reported under this Regulation already been notified to the home AML/CFT competent authority? Yes; No If no, the reason why. b) To the central contact point,where there is one? Yes; No. If no, the reason why. 7(l) Whether the material weakness appears to be inherent in the design of that particular product, service or activity; Yes; If ‘yes’ selected: name of the product/service/activity and description of the characteristics (free text) No 7(m) Whether the material weakness appears to be linked with specific natural persons, whether a client, a beneficial owner, a member of the managementbody or key function holder, including reasoning thereof; any reporting on natural persons shall be made in accordance with Annex 2
Annex 2 of the draft RTS
7(n) Any contextual or background information with regard to the material weakness,where known by the competent authority, including; a) whether the material weakness is linked with a specific area relevant for AML/CFT already identified by the EBA; Evolving list that will be elaborated by the EBA based on the areas it will have identified (pre-defined list with multiple choice) Examples of risks previously identified in the Opinion on ML/TF risk: de-risking, tax-related crime, ML/TF risk arising as a result of COVID-19, risk associated with terrorist financing

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database b) for the AML/CFT authorities,whether the material weakness points to a ML/TF emerging risk (emerging risks include new risks that have not been identified before and existing risks that have significantly increased or takenon new significance); Yes; If yes selected: name of this emerging risk (free text) No c) whether the material weakness is linked to the use of new technology and a short description of the technology employed; Yes; If yes selected: short description of the technology employed (free text) No
Article 8 Type of
information transmitted in relation to measures taken in response to material weaknesses 8(a) A reference to the material weakness in relation to which the measure has been taken, and any necessary update of the information provided in accordance with Article 7; a) The reference communicated by the EBA of the material weakness previously submitted (where applicable); b) Any update of the information communicated about the weakness for the purpose of Article 7 of the RTS, if necessary 8(b) The date of the imposition of the measure(s); Date 8(c) The type of measure, its internal reference number and link to it if published; The type of measure(s) taken:
The type of measure(s) taken concerning the financial sector operator/branch/agent and distributor or any other legal person that is part of the financial sector operator/branch/agent and distributor(where applicable) (pre-defined list, multiple choice) Warning; Reprimand; Restriction of business relationships with certain customers; Restriction of carrying out certain transactions;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Capital add-ons; Full withdrawal of authorisation; Restriction of activities;  Temporary  Permanent Public statement; Cease and desist order(order to cease the conduct or to desist from repetition of that conduct); Order to comply; Order to implement measures; Order to put in place a remediation plan; Fines/administrative pecuniary sanctions. In this case: amount for the fines/administrative pecuniary sanctions; Business suspension orders; Temporary suspension (or resignation) of one or several member(s) of the management body (executive functions); Deregistration of a financial sector operator; Suspension of the authorisation; Withdrawal of authorisation; Other to specify (free text). The type of measure(s) taken concerning members of the management body or of any other natural person, including a natural person acting on behalf of a financial sector operator/branch/agent and distributor (predefined list, multiple choice):
In the case of fines/administrative pecuniary sanctions: amount in euros; Temporary suspension of one or several member(s) of the management body (executive functions); Reprimand; Warning; Removal of one or several member (s) of the management body; Other (free text). Internal reference of the measure(s) (free text). Link to the text of the measure(s) when published (free text). 8(d) Full information as to the legal and natural persons The reporting on natural person shall be made in accordance with Annex 2.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database which the measure concerns; any reporting on natural persons shall be made in accordance with
Annex 2;
With regard to the function in the financial sector operator/branch/agent and distributoras specified in
Annex 2 for natural persons (pre-defined list, single choice);
Member of the management body;
AML/CFT compliance officer at management level; Key function holders; Shareholders; Agent; Distributor; Other (free text). Information regarding the legal persons a) Legal name; b) Commercial name (if different from the legal name); c) Address a) Street address; b) Postcode; c) City; d) Country (pre-defined list, single choice) d)Entity identifier a) Legal entity identifier (LEI), if available; A code that allows legally distinct entities that engage in financial transactions to be uniquely identified b) The national identifier 8(e) A description of the measure taken including its legal basis; The description ofthe measures taken (free text). The legal basis a) The legal basis that gave the CAs the power to impose the measures (EU); b) The requirements concerned by the measure taken (only if different from what has already been reported under the material weakness), data points listed for the purpose of Article 7 (g). 8(f) The status of the measure, including whether any appeal has been brought against the measure; a) Subject to an internal appeal (internal appeal: appeal within the competent authority, different from the contradictory process) Not applicable;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Yes; No; Partial (free text to explain) b) Subject to an external appeal (tribunal/court) Yes; No; Partial (free text). c) Effect of this appeal : suspension of the decision taken Yes; No d) Outcome of the appeal (if applicable and decision already taken at the time of the reporting of the measure)
i. Internal appeal

Decision and rationale (free text);
Date
ii. External appeal (i.e.tribunal/courts)
Decision and rationale (free text);
Date
e) Unknown at the time of the reporting.
8(g) Whether and how the measure has been published, including reasoning for any anonymous publication, delay in publication or non-publication; (Pre-defined list, multiple choice) Full publication; Publication on an anonymous basis; If selected:
a) Type of anonymity:
Anonymity of the financial sector operator;
Anonymity of the natural person; b) Reason for anonymous publication (pre-defined list, multiple choice):
Disproportionate damage;
Jeopardise ongoing investigation;
Jeopardise the stability of the financial markets Delay in publication; If selected:
a) Reason for the delay in publication (pre-defined list, multiple choice):
Disproportionate damage;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Jeopardise ongoing investigation; Jeopardise the stability of the financial markets b) Time period by which the publication is delayed (free text) Non-publication; Reason for which the measure is not published Disproportionate damage; Jeopardise ongoing investigation; Jeopardise the stability of the financial markets Other (free text) 8(h) All information relevant to the remediation of the material weakness that the measure concerns, including any action planned or taken for such remediation, any additional information necessary and the relevant timeline; a)The action planned or taken for the remediation (pre-defined list, multiple choice) Warning; Follow up inspection; Thematic inspection; Enhanced reporting; Full-scope on-site inspection; Regular written updates from the financial sector operator/ branch/agent and distributoron its remediation plan (or follow-up letter); Enhanced written engagement with the financial sector operator/ branch/agent and distributor; Reliance on the financial sector operator to implement the remediation plan; Regular meetings with the financial sector operator/ branch/agent and distributors; Off-site inspection; Recommendation; No further engagement with the financial sector operator/branch/agent or distributor; Others (free text). b)Additional explanations on the remediation process (if this appears necessary to the competent authority/non-mandatory: free text). c)Timeline for remediation as described in a) (free text with date(s) and/or period (s) of time, if already decided). 8(i) whether the information on the measure has been communicated to a college that has been established for the group where the financial sector operator belongs; if not communicated yet: the reason why; If the competent authority participates in a college, whether the information on the measure taken has already been communicated to that college Yes; No. If no,the reason why.

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database 8(j) For the host AML/CFT competent authorities:
whether information on the measure has been communicated to the home AML/CFT competent authority; if not communicated yet: the reason why. The measures taken have already been notified to the home AML/CFT competent authority:
Yes;
No
If no,the reason why.
Article 9
Timelines and obligation to provide updates
9(5) Competent authorities shall provide in due time all the information necessary to keep the EBA informed about any subsequent developments relating to the information provided, including information related to the material weakness identified or to the measure taken and its remediation. a) Subsequent developmentsregarding the general information submitted for the purpose of Article 6; b) Subsequent developments regarding the material weakness; Any substantive additional/new developments (free text) and date (including the end date of the material weakness if this is the case); c) Subsequent developments regarding the measures taken:

Update regarding the remediation;
With regard to the action taken by the competent authority as described regarding the purpose of
Article 8 (h), including challenges encountered and the outcome of the remediation (adequacy and
effectiveness of the financial sector operator/branch/agent and distributorremediation effort) (free text).
Update with regard to an appeal process, (if applicable):
i. Internal appeal
Decision and rationale (free text);
Date
ii. External appeal (i.e.tribunal/courts)
Decision and rationale (free text);
Date
Article 11
Making information available

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database 11(2) and (3) The request referred to in point (a) of paragraph 1 shall identify the requesting competent authority and the authority enabling the indirect submission where appropriate, as well as the financial sector operator concerned by the request, and shall specify whether the request concerns the financial sector operatoror a natural person; why the information is relevant for the requesting authority and its supervisory activities with regard to the prevention of the use of the financial system for the purpose of money laundering or terrorist financing; what the intended use of the requested information is; the date by which the information should be received, if any; whether there is a degree of urgency and relevant justifications for both, as well as any additional information that may assist or is requested by the EBA while processing the request. Requests and making information available shall be made in accordance with Annex 2 where natural persons are concerned. a) The information to identify the requesting competent authority and the authority enabling the indirect submission,where appropriate, as per Article 6(a); b) The information to identify the financial sector operator concerned as per Article 6(b) (but not all fields are mandatory); c) The type of request:
Information related to a financial sector operator; Information related to a natural person The information to communicate for a request related to a financial sector operator:
a) Why the information is relevant for the requesting authority and its supervisory activities with regard to prevention of the use of the financial system for the purpose of money laundering or terrorist financing and what the intended use of the requested information is(free text) b) The categories of requests (pre-defined list, single choice):
i. For carrying out on-site and off-site supervisory activities;
ii. For the taking of a measure;
iii. For the assessment of authorisation, acquisition or assessment of qualifying holdings,
suitability of key function holders;
iv. For the withdrawal of authorisation;
v. To assess the ML/TF risk associated with applicationsforthe right of establishment
and freedom to provide services;
vi. Other (free text)
a) The information to communicate for a request related to a natural person shall be made in accordance with Annex 2 (but not all fields are mandatory) b) The categories of request about a natural person (pre-defined list, single choice):
i. Fit and proper assessment;
ii. Key function holders assessment;
iii. Information about a customer/BO;
iv. Other (free text)
a) The date by which the information is necessary (if any) and justification for the date (mandatory if a date is mentioned/free text); b) Degree of urgency

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Yes; If ‘yes’ selected, justification for the urgency (free text). No Any additional information that may assist the EBA in processing the request (free text/not mandatory)
Article 12
Articulation with other notifications
12(1) An AML/CFT competent authority submitting information on a measure in accordance with this Regulation shall be deemed as also submitting the notification referred to in Article 62 of Directive (EU) 2015/849 with regard to that measure. Whether the AML/CFT competent authority submitting information on a measure in accordance with this Regulation also falls within the scope of the notification referred to in Article 62 of Directive(EU) 2015/849 for the purpose of that measure. Yes No 12(2) An AML/CFT or a prudential competent authority submitting information under this Regulation shall specify with its submission whether it has already submitted a notification under Article 97 (6) of Directive(EU) 2013/36. For an AML/CFT or a prudential competent authority submitting information under this Regulation,whether it has already submitted a notification under Article 97 (6) of Directive (EU) 2013/36:
Yes
No
Article 13
Practical implementation of the information collection 13(6) Additional information set out in the penultimate subparagraph of point (a) of Article 9a (1) of Regulation 1093/2010 includes – for the AML/CFT competent authority – the current ML/TF risk profile of the group if any, the ML/TF risk assessments of the financial sector operator, branch, agent or distributor a) Additional information:
Free text, including explanation of the relevance of the additional information b) Supporting documents:
Option to upload a document, summary of the document, free text to explain the relevance of it

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database or of the group; any information or document not referred to in this Regulation relevant for any material weakness or measure shall be provided by the competent authority with an explanation of such relevance;

Final Report on draft RTS under Article 9a (1) and (3) setting up an AML/CFT central database Authorities indirectly submitting to the AML/CFT central database The competent authorities, as defined in Article 3 of the regulatory technical standards under Article 9a (1) and (3) of Regulation (EU) No 1093/2010, that shall be authorities indirectly submitting in accordance with Article 13(4) of these RTS, are the following:

Payment institutions authority;
Conduct of business;
Resolution authority with the exception of the Single Resolution Board;
Designated authority

Final Report on Draft RTS Setting Up an AML/CFT Central Database

Lineage: In force