Final Report on Joint Draft Regulatory Technical Standards on Central Contact Points for AML/CFT

JC 2017 08
26/06/2017
Final Report
On
Joint draft regulatory technical standards on the criteria for determining the circumstances in which the appointment of a central contact point pursuant to Article 45(9) of Directive (EU) 2015/849 is appropriate and the functions of the central contact point

Contents
1. Executive summary 3
2. Background and rationale 4
3. Joint regulatory technical standards 8
4. Accompanying documents 15
4.1 Impact assessment 15
4.2 Overview of questions for the public consultation 26
4.3 Comments from the ESAs’ stakeholder groups 28
4.4 Feedback on the public consultation 29

1. Executive summary
Payment service providers and electronic money issuers with a head office in an EU Member State can operate establishments in other, host, Member States. Such establishments have to comply with the anti-money laundering and countering the financing of terrorism (AML/CFT) regime of the Member State in which they are based, even if they are not obliged entities themselves. To facilitate the AML/CFT supervision of such establishments, several Member States require payment service providers and electronic money issuers to appoint a ‘Central Contact Point’ (CCP). A CCP acts as a point of contact between the payment service provider or electronic money issuer and the host Member State’s competent authority. However, in the absence of a common European approach to CCPs, there is a risk of regulatory arbitrage, which threatens to undermine the robustness of Europe’s AML/CFT defences. There is also a risk that legal uncertainty creates unreasonable obstacles for payment service providers and electronic money issuers wishing to provide services on a cross-border basis.
Article 45(10) of Directive (EU) 2015/849 therefore requires the European Supervisory Authorities
(ESAs) to draft regulatory technical standards (RTS). These draft RTS:

• create legal certainty about the criteria that Member States will use to determine
  whether or not a CCP must be appointed; and
• clearly set out the functions a CCP must have to fulfil its duties.
  In line with the mandate of Article 45(10), these draft RTS do not specify the form a CCP must take or determine when payment service providers or electronic money issuers provide services in another Member State through establishments. The ESAs publicly consulted on these draft RTS between February and May 2017. Minor changes were brought to the draft as a result of comments received. Next steps The ESAs will submit these draft RTS to the European Commission for approval.

2. Background and rationale
On 26 June 2015, Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing entered into force. This Directive aims, inter alia, to bring European legislation in line with the International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation that the Financial Action Task Force (FATF), an international anti-money laundering (AML) and counter-terrorist financing (CFT) standard setter, adopted in 2012. In line with the FATF’s standards, Directive (EU) 2015/849 puts the risk-based approach at the centre of the European Union’s AML/CFT regime. It recognises that the risk of money laundering (ML) and terrorist financing (TF) can vary and that Member States, competent authorities and obliged entities have to take steps to identify and assess that risk with a view to deciding how best to manage it. Credit and financial institutions that are within the scope of Directive (EU) 2015/849 have to comply with the AML/CFT regime of the Member State in which they are established. This means that payment service providers and electronic money issuers (‘institutions’) that operate an establishment other than a branch in another Member State will have to ensure that this establishment complies with the host Member State’s AML/CFT requirements. 1 An ‘establishment other than a branch’ can include agents of payment service providers 2 and persons distributing electronic money on the electronic money issuer’s behalf. 3 Directive 2005/60/EC on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing made it clear that branches of credit or financial institutions that are located in another Member State are obliged entities. It did not address the phenomenon of establishments in forms other than a branch, such as agents of payment service providers or electronic money distributors. Notwithstanding, the territorial approach in Directive 2005/60/EC meant that those establishments were nevertheless expected to comply with the host Member State’s AML/CFT requirements, whether or not they were themselves obliged entities. This created challenges for competent authorities of host Member States in supervising those establishments’ compliance with local AML/CFT requirements. As a result, some Member States required institutions that were headquartered in another European Member State but provided services in their jurisdiction through agents and, in some cases, distributors to appoint ‘Central Contact Points’ (CCPs). These CCPs serve as a point of contact between the host competent authority and the institution situated in another Member

Article 45(2) of Directive (EU) 2015/849.
Article 4(38) of Directive (EU) 2015/2366 defines ‘agent’ as ‘a natural or legal person who acts on behalf of a payment
institution in providing payment services’.
Directive 2009/110/EC.

State, which facilitates the AML/CFT supervision of agent and distributor networks in the host Member State’s territory. The Commission’s proposal for a Fourth Anti-Money Laundering Directive, which was published in 2013, suggested that the ESAs should develop draft regulatory technical standards to ensure that Member States that require institutions to appoint a CCP adopt a consistent approach and to make sure that this requirement is proportionate to the ML/TF risk.
Article 45(10) of Directive (EU) 2015/849 — application and scope
Article 45(10) of Directive (EU) 2015/849 requires the ESAs to draft regulatory technical standards
on the criteria that Member States should use when deciding whether or not foreign institutions that operate establishments other than a branch in the Member State’s territory should appoint a CCP and what the functions of that CCP point should be. The ESAs have to submit these draft regulatory technical standards to the Commission by 26 June 2017. The requirements set out in the draft regulatory technical standards will apply where:
a) Member States decide to require CCPs. Where Member States do not to require institutions to appoint central contact points, these draft regulatory technical standards will not apply; and b) institutions that have their head office in another Member State operate establishments other than a branch in the host Member State’s territory. A CCP is not required where institutions do not operate establishments, because they make use of the free provision of services.
Article 45(10) of Directive (EU) 2015/849 does not authorise the ESAs to determine when agents
or persons distributing electronic money on an electronic money issuer’s behalf are establishments. The mandate also does not extend to determining the form a CCP should take. Consequently, any decision about who the CCP should be and how it has to be set up will be the host Member State’s. Criteria These draft regulatory technical standards set out a two-pronged approach to deciding whether or not the appointment of a CCP is appropriate Host Member States can require institutions that are headquartered in another Member State to appoint a CCP if certain quantitative criteria are met, namely:

a) the number of establishments other than a branch that the institution operates in the host Member State’s territory is, or exceeds, 10; or b) the amount of the electronic money distributed and redeemed, or the value of the payment transactions executed by such establishments is expected to exceed EUR 3 million per financial year or has exceeded EUR 3 million in the previous financial year; or c) the information necessary to assess whether or not criterion (a) or (b) is met is not made available to the host Member State’s competent authority upon request and in a timely manner. Host Member States can also require institutions that are headquartered in another Member State to appoint a CCP if the money laundering or terrorist financing risk associated with the operation of these institutions’ establishments other than a branch is such that the appointment of a CCP is proportionate even if the criteria in (a), (b) or (c) are not met. The intention is to create legal certainty and a consistent interpretation of the CCP provisions across the EU, while at the same time allowing Member States to require CCPs where this is necessary in the light of, and commensurate with, the money laundering and terrorist financing risk associated with the operation of foreign institutions’ establishments in their territory. Functions
Article 45(9) of Directive (EU) 2015/849 is clear that a CCP has two main functions:

1. to ensure, on the appointing institution’s behalf, compliance with the host Member
   State’s AML/CFT requirements; and
2. to facilitate supervision by the host Member State’s competent authorities. This includes
   providing the host Member State’s competent authorities with documents and information upon request. This means that CCPs will need to, at a minimum, inform the appointing institution of applicable AML/CFT rules and how these might affect the institution’s AML/CFT policies and processes; and oversee the compliance by establishments other than a branch with applicable AML/CFT rules and take corrective action where necessary. As part of this, CCPs also need to, at a minimum, be able to access information held by establishments other than a branch; represent the appointing institution in communications with the Member State’s competent authorities and the Financial Intelligence Unit (FIU); and facilitate on-site inspections of establishments if necessary.

While not explicitly required, this implies that the CCP should have adequate technical knowledge of applicable AML/CFT requirements as well as sufficient human and financial resources to carry out its functions. Member States may also determine, based on their assessment of money laundering and terrorist financing risk, that, as part of their duty to ensure compliance with local AML/CFT obligations, the CCPs are required to perform certain additional functions. In particular, it may be appropriate for Member States to require the CCP to submit suspicious transaction reports to the host FIU. Failure to comply
Article 48(4) of Directive (EU) 2015/849 makes it clear that competent authorities of the host
Member State must supervise foreign payment service providers and electronic money issuers who operate establishments other than a branch in their territory to ensure compliance with their AML/CFT obligations. This may include taking temporary measures to address serious failings by those establishments, provided that the nature of the failing means that taking immediate corrective action is necessary. The power of host competent authorities to sanction breaches of institutions’ establishments in their territory is outside the scope of the mandate in Article 45(10) of Directive (EU) 2015/849. Central contact point provisions in Directive (EU) 2015/2366
Article 29(5) of Directive (EU) 2015/2366 requires the European Banking Authority (EBA) to draft
regulatory technical standards, which set out criteria for the appointment of CCPs for payment institutions operating in a host Member State through agents under the right of establishment. These regulatory technical standards also establish the functions of such CCPs to ensure adequate communication and information reporting on compliance with Titles III and IV of Directive (EU) 2015/2366, and to facilitate the supervision, by the competent authorities, under Directive (EU) 2015/2366. The purpose of these central contact points is different from that provided for under Directive (EU) 2015/849).

3. Joint regulatory technical standards
   COMMISSION DELEGATED REGULATION (EU) No …/.. of XXX […] supplementing Directive (EU) 2015/849 of the European Parliament and of the Council with regard to regulatory technical standards on the criteria for determining the circumstances in which the appointment of a central contact point for electronic money issuers and payment service providers is appropriate pursuant to Article 45(9) and the functions of such central contact points THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC, 4 and in particular Article 45(10), Whereas:
   (1) Member States may require the appointment of a central contact point where payment service providers and electronic money issuers provide services in their territory through establishments in forms other than a branch, but not where they provide services without an establishment. (2) The appointment of a central contact point is justified where the size and scale of the activities carried out by payment service providers and electronic money issuers through establishments in forms other than a branch meets or exceeds certain thresholds. These thresholds should be set at a level that is proportionate to the aim of the Directive to facilitate supervision by competent authorities of such establishments’ compliance, on their appointing institution’s behalf, with local anti-

OJ L 141, 5.6.2015, p. 73.

money laundering and countering the financing of terrorism (AML/CFT) obligations, while at the same time not creating undue regulatory burden on payment service providers and electronic money issuers. (3) The requirement to appoint a central contact point may also be justified where a Member State considers that the risk of money laundering and terrorist financing associated with the operation of such establishments is increased, as demonstrated, for instance, on the basis of an assessment of the money laundering and terrorist financing (ML/TF) risk associated with certain categories of payment service providers or electronic money issuers. Member States should not be required to risk assess individual institutions for that purpose. (4) However, in exceptional cases, where Member States have reasonable grounds to believe that the ML/TF risk associated with a particular payment service provider or electronic money issuer that operates establishments in their territory is high, they should be able to require that institution to appoint a central contact point, even if it does not meet the thresholds or belong to a category of institutions that is required to appoint a central contact point based on the Member State’s assessment of ML/TF risk. (5) Where a central contact point is appointed, it should ensure, on behalf of the appointing institution, the compliance of the establishments of the appointing institution with the applicable AML/CFT rules. To this end, the central contact point should have a sound understanding of applicable AML/CFT requirements and facilitate the development and implementation of AML/CFT policies and procedures. (6) The central contact point should, among others, have a central coordinating role between the appointing institution and its establishments, and between the appointing institution and the competent authorities of the Member State where the establishments operate, to facilitate their supervision. (7) Member States may determine, based on their overall assessment of money laundering and terrorist financing risk associated with the activity of payment service providers and electronic money issuers that are established in their territory in forms other than a branch, that as part of their duty to ensure compliance with local AML/CFT obligations, central contact points are required to perform certain additional functions. In particular, it may be appropriate for Member States to require central contact points to submit, on behalf of the appointing institution, suspicious transaction reports to the FIU of the host Member State in whose territory the obliged entity is established. (8) It is for each Member State to determine whether or not central contact points should take a particular form. Where the form is prescribed, Member States should ensure that the requirements are proportionate and do not go beyond what is necessary to achieve the aim of compliance with AML/CFT rules and facilitate supervision. (9) This
Regulation is based on the draft regulatory technical standards submitted by the European Supervisory Authorities (European Banking Authority, European Insurance and Occupational Pensions Authority, European Securities and Markets Authority) to the Commission.

(10) The European Supervisory Authorities have conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the opinion of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010, 5 Regulation (EU) No 1094/2010 6 and Regulation (EU) No 1095/2010, 7 respectively. HAS ADOPTED THIS REGULATION:
Article 1 — Subject matter and scope
This Regulation lays down rules concerning:
a) criteria for determining the circumstances in which the appointment of a central contact point pursuant to Article 45(9) of Directive (EU) 2015/849 is appropriate; b) the functions of such central contact points.
Article 2 — Definitions
For the purposes of this Regulation, the following definitions shall apply:
(1) ‘competent authority’ means the authority competent for ensuring compliance of electronic money issuers and payment service providers that are established in their territory in forms other than a branch and whose head office is situated in another Member State with the requirements of Directive (EU) 2015/849 as transposed by national legislation; (2) ‘host Member State’ means the Member State in whose territory electronic money issuers and payment service providers whose head office is situated in another Member State are established in forms other than a branch;

Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2020, p. 12). Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p.48). Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

(3) ‘institution’ means electronic money issuers as defined in point (3) of Article 2 of Directive 2009/110/EC 8 and payment services providers as defined in point (9) of
Article 4 of Directive 2007/64/EC. 9
Section 1
Circumstances in which the appointment of a central contact point is appropriate
Article 3 — Criteria

1. Host Member States may require institutions that are established in their territory in
   forms other than a branch, and whose head office is situated in another Member State, to appoint a central contact point if any of the following conditions are met:
   (a) the number of such establishments is equal to, or exceeds, 10; or (b) the cumulative amount of the electronic money distributed and redeemed, or the cumulative value of the payment transactions executed by the institution’s establishments is expected to exceed EUR 3 million per financial year or has exceeded EUR 3 million in the previous financial year; or (c) the information necessary to assess whether or not criterion (a) or (b) is met is not made available to the host Member State’s competent authority upon request and in a timely manner.
2. Without prejudice to the conditions set out in paragraph 1, host Member States may
   require categories of institutions that are established in their territory in forms other than a branch and whose head office is situated in another Member State to appoint a central contact point in situations where this is commensurate to the level of money laundering or terrorist financing risk associated with the operation of those institutions’ establishments. Host Member States shall base their assessment of the level of money laundering or terrorist financing risk associated with the operation of such establishments on the findings of risk assessments carried out in accordance with Article 6(1) and
   Article 7(1) of Directive (EU) 2015/849 and other credible and reliable sources
   available to them. As part of this, host Member States shall take into account at least:

Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p.7). Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC (OJ L 319, 5.12.2007, p.1).

(a) the money laundering and terrorist financing risk associated with the types of products and services offered and the distribution channels used; (b) the money laundering and terrorist financing risk associated with the types of customers; (c) the money laundering and terrorist financing risk associated with the prevalence of occasional transactions over business relationships; and (d) the money laundering and terrorist financing risk associated with the countries and geographic areas serviced.
3. Without prejudice to the conditions set out in paragraphs 1 and 2, a host Member
State may, in exceptional cases, empower the host Member State’s competent authority to require an institution that is established in its territory in forms other than a branch and whose head office is situated in another Member State to appoint a central contract point providing that the host Member State or the host Member State’s competent authority has reasonable grounds to believe that the operation of establishments of that institution presents a high money laundering and terrorist financing risk.
Section 2
Functions of the central contact points
Article 4 — Ensuring compliance with AML/CFT rules
A central contact point shall ensure that establishments specified in Article 45(9) of Directive (EU) 2015/849 comply with AML/CFT rules of the host Member State. To this end, a central contact point shall:
(a) facilitate the development and implementation of AML/CFT policies and procedures pursuant to Article 8(3) and (4) of Directive EC 2015/849 by informing the appointing institution of applicable AML/CFT requirements in the host Member State; (b) oversee, on behalf of the appointing institution, the effective compliance by such institution’s establishments with applicable AML/CFT requirements in the host Member State and the appointing institution’s policies, controls and procedures adopted pursuant to Article 8(3) and (4) of Directive (EU) 2015/849; (c) inform the head office of the appointing institution of any breaches or compliance issues encountered in such establishments, including any information that might affect the establishment’s ability to comply effectively with the appointing institution’s AML/CFT policies and procedures or may otherwise affect the appointing institution’s risk assessment;

(d) ensure, on behalf of the appointing institution, that corrective action is taken in cases where such establishments do not comply, or risk non-compliance, with applicable AML/CFT rules; (e) ensure, on behalf of the appointing institution, that such establishments and their staff participate in training programmes referred to in Article 46(1) of Directive (EU) 2015/849; and (f) represent the appointing institution in its communications with the competent authorities and the FIU of the host Member State.
Article 5 — Facilitation of supervision by competent authorities of the host Member State
A central contact point shall facilitate supervision by competent authorities of the host Member State of establishments specified in Article 45(9) of Directive (EU) 2015/849. To this end, a central contact point shall, on behalf of the appointing institution:
(a) represent the appointing institution in its communications with competent authorities; (b) access information held by such establishments; (c) respond to any request made by competent authorities related to the activity of such establishments, and provide relevant information held by the appointing institution and such establishments to competent authorities . Where appropriate, reporting shall be done on a regular basis; and (d) facilitate on-site inspections of such institution’s establishments if required by the competent authorities.
Article 6 — Additional functions of a central contact point

1. In addition to the functions specified in Articles 4 and 5, host Member States may
   require central contact points to perform on behalf of the appointing institution one or more of the following functions:
   (a) filing reports pursuant to Article 33(1) of Directive (EU) 2015/849 as transposed in national law of the host Member State; (b) responding to any request of the FIU related to the activity of establishments specified in Article 45(9) of Directive (EU) 2015/849, and providing relevant information related to such establishments to the FIU;

(c) scrutinising transactions to identify suspicious transactions where appropriate in light of the size and complexity of the institution’s operations in the host Member State.
2. Host Member States may oblige central contact points to perform one or more of
the additional functions specified in paragraph 1 where this is commensurate to the overall level of money laundering and terrorist financing risk associated with the operation of those payment service providers and electronic money issuers that are established in their territory in forms other than a branch. Host Member States shall base their assessment of the level of money laundering or terrorist financing risk associated with the operation of such establishments on the findings of risk assessments carried out in accordance with Article 6(1) and
Article 7(1) of Directive (EU) 2015/849, Article 3(2) of this Regulation where
applicable, and other credible and reliable sources available to them.
Article 7
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, For the Commission The President [For the Commission On behalf of the President [Position]

4. Accompanying documents
4.1 Impact assessment
1. Article 45(10) of Directive (EU) 2015/849 requires the European Supervisory Authorities
(ESAs) to draft regulatory technical standards (RTS) on the criteria that Member States should apply to determine whether or not payment service providers or electronic money issuers that are established in their territory in forms other than a branch and whose head office is situated in another Member State must appoint a central contact point (CCP), and what the functions of that CCP will be.
2. This document considers advantages and disadvantages of different policy options and
assesses the impacts that the preferred options will have on payment service providers, electronic money issuers and competent authorities. A. Problem identification and baseline scenario
3. Directive (EU) 2015/849 aims to bring European legislation in line with the International
Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation that the Financial Action Task Force (FATF), an international anti-money laundering standard setter, adopted in 2012. In line with the FATF’s Standards, Directive (EU) 2015/849 recognises that the risk of money laundering and terrorist financing (ML/TF) can vary and that Member States, competent authorities and obliged entities have to take steps to identify and assess that risk with a view to deciding how best to manage it.
4. Obliged entities are subject to the anti-money laundering and counter-terrorist financing
(AML/CTF) regime of the Member State in which they are based. This means that credit and financial institutions that operate an establishment in another (host) Member State will have to ensure that this establishment complies with the host Member State’s AML/CTF requirements. The establishment will be supervised for compliance with these requirements by the host competent authority. 10

5. This approach can be challenging where institutions provide services in another Member
State through agents or persons who distribute electronic money on the electronic money issuer’s behalf. Article 45(9) of Directive (EU) 2015/849 therefore provides for the creation of ‘central contact points’, which serve as a point of contact between a host supervisor and a payment institution or electronic money issuer from another Member State and facilitate the AML/CFT supervision of networks of agents or persons distributing electronic money, where applicable.

10 Article 48(4) of Directive (EU) 2015/849.

6. Article 45(10) of Directive (EU) 2015/849 requires the ESAs to draft RTS on the criteria to
   be used when deciding whether or not foreign payment service providers or electronic money issuers that operate establishments in the host Member State’s territory should appoint a CCP and what the functions of that CCP should be. In the absence of such RTS, there will be no consistent approach to the appointment and functions of a CCP in the EU and a resultant risk of regulatory arbitrage as well as legal uncertainty for payment service providers and electronic money issuers wishing to provide their services on a cross-border basis. This is the baseline scenario. B. Policy objectives
7. In drafting these RTS, the ESAs’ overall policy objective is to foster the adoption of a
   coherent and risk-based approach across the EU in the areas specified in Article 45(10) of Directive (EU) 2015/849, and to do so in a way that is both proportionate and effective and does not unreasonably create obstacles to the operation of establishments other than a branch in a host Member State’s territory.
8. Specifically,

• with regard to the appointment of a CCP, the ESAs’ aim is to create greater legal
  certainty about the criteria that Member States will use to determine whether or not this is necessary and commensurate with the ML/TF risk; and
• with regard to the functions that a CCP should have, the ESAs’ aim is to clarify what
  CCPs must be able to do to ensure, on the appointing institution’s behalf, compliance with the host Member State’s AML/CFT requirements and to facilitate supervision of compliance with those requirements by the host Member State’s competent authorities.

9. Article 45(10) of Directive (EU) 2015/849 does not give the ESAs a mandate to draft RTS
   on the form a CCP should have, or to determine when agents or distributors may be establishments.
   C. Options considered and preferred options
   10.The ESAs considered the views expressed by AML/CFT competent authorities in two questionnaires and subsequent discussions and informal feedback from private sector stakeholders as well as other quantitative and qualitative data that the ESAs had at their disposal.

C.1. Criteria that Member States shall use to determine when a CCP is required 11.Article 45(10)of Directive (EU) 2015/849 mandates the ESAs to set out which criteria Member States should use to determine whether or not the appointment of a CCP is appropriate. 12.European legislation is clear that a CCP is not required where payment service providers or electronic money issuers do not operate establishments because they make use of the free provision of services. 13.This means that the first criterion that host Member States have to consider is whether or not the payment service provider or electronic money issuer operates an establishment other than a branch in its territory. However, establishing criteria for determining when an agent or distributor becomes an establishment is outside the scope of these draft RTS.
14. The second criterion that host Member States have to consider is whether or not the
appointment of a CCP is proportionate.
15.There are a number of policy options.
(i) All foreign payment service providers or electronic money issuers that operate establishments in a host Member State have to appoint a CCP (Option 1.1). 16.The RTS could allow Member States to require the appointment of a CCP wherever a foreign payment service provider or electronic money issuer operates one or more establishments in the host Member State. 17.The advantage of this option is that it could provide for a harmonised approach to CCPs and a level playing field across the EU. 18.The disadvantage of this option is that this requirement is unlikely to be proportionate, as it fails to take into account the ML/TF risk associated with the establishment’s operation and the practicalities associated with the AML/CFT supervision of such establishments by the host Member State’s competent authority. (ii) A CCP is required where a foreign payment service provider or electronic money issuer operates 10 or more establishments in the host Member State (Option 1.2). 19.Directive (EU) 2015/849 envisages that the appointment of a CCP will facilitate the AML/CTF supervision of a foreign payment service provider’s or electronic money issuer’s establishments by the host Member State’s competent authority. The number of establishments that triggers a CCP requirement should therefore reflect the point at which it becomes difficult for the host competent authority to supervise compliance with local AML/CFT requirements effectively.

20.Feedback from competent authorities suggests that this point is reached where the number of establishments of a foreign payment service provider or electronic money issuer in the host Member State is, or exceeds, 10. 21.The advantage of this option is that it creates regulatory certainty, as it establishes a definitive quantitative threshold. It is also proportionate, as the majority of payment service providers and electronic money issuers do not operate more than five establishments in another Member State’s territory (although a small number of payment service providers operate more than 100 establishments in some Member States). 22.The disadvantages are that:
a) the number of establishments alone does not take into account transaction volumes or ML/TF risk associated with the nature and type of the product or service provided; b) there is a risk that institutions might structure their foreign operations in a way that the quantitative requirement is not met; c) Member States may come to different conclusions when determining whether or not one agent or person distributing electronic money on an electronic money issuer’s behalf is a legal entity (e.g. supermarket chain XYZ) or the number of operational parts of that legal entity (e.g. each of supermarket chain XYZ’s branches); and d) in the absence of clear legal obligations on foreign payment service providers, electronic money issuers or home competent authorities to make available the information required for the assessment of the quantitative thresholds, the host competent authority may be unable to assess if these thresholds are met. (iii) A CCP is required where a foreign payment service provider or electronic money issuer transacts, or distributes and redeems, more than EUR 3 million per financial year through its establishments in the host Member State (Option 1.3). 23.Under this option, the RTS set a monetary threshold for both the amount of electronic money distributed and redeemed and the amount of payment transactions executed. A CCP will be required where the threshold is either reached or exceeded. This threshold should be set at a level where the operation of the institution’s establishments in the host Member State’s territory is deemed complex, which means that the risk of ML/TF is unlikely to be low. Once this threshold has been reached or exceeded, a CCP will be required. 24.Feedback from competent authorities suggests that this threshold should be set at EUR 3 million. 25.The advantage of this option is that it creates regulatory certainty, as it establishes a definitive quantitative threshold. It is also proportionate, since it takes into account the

size of the activities of the agent or distributor network and captures those business models that involve relatively few but high-value or high-risk transactions; establishments providing only few, lower risk products and services are unlikely to be caught. Member States that already require the appointment of CCPs report that, based on their experience, this level is also proportionate to the cost associated with the establishment and running of a CCP. 11

26.The disadvantages are the following:
a) monthly or annual figures can be volatile and fluctuate significantly; b) differences in purchasing power in different Member States are not taken into account; c) higher transaction amounts or turnover may not necessarily be an indicator of ML/TF risk; d) in the absence of clear legal obligations on foreign payment service providers, electronic money issuers or home competent authorities to make available the information required for the assessment of the quantitative thresholds, the host competent authority may be unable to assess if these thresholds are met; and e) a monetary threshold set at this level might act as a barrier to market entry in some cases where a Member State’s requirements on the form a CCP must take offer little flexibility. (iv) A CCP is required where the Member State assesses that the operation of establishments other than a branch increases the money laundering or terrorist financing risk (Option 1.4). 27.Under this option, the RTS would set out which criteria the host Member State must consider when determining whether or not the establishment of agents or persons distributing electronic money on an electronic money issuer’s behalf increases the ML/TF risk in the host Member State’s territory. 28.The advantage of this option is that this is in line with the risk-based approach required by Directive (EU) 2015/849. The appointment of a CCP will be proportionate to the ML/TF risk posed by the establishment of agents or persons distributing electronic money on an electronic money issuer’s behalf, or networks of agents or distributors. It is also cost￾effective, as Member States will be able to draw on their national ML/TF risk assessments and the Commission’s supranational risk assessment. There is no expectation that Member States carry out individual risk assessments of each payment service provider,

11 The cost of establishing and running a CCP will be determined by the form a CCP is required to take. The ESAs’ mandate does not extend to determining what that form might be.

electronic money issuer, agent, person distributing electronic money on an electronic money issuer’s behalf, or network thereof. Nevertheless, in exceptional cases, where a Member State has reasonable grounds to believe that the ML/TF risk associated with the operation of a specific payment service provider’s or electronic money issuer’s establishments in the Member State’s territory is high, it would be able to require such a payment service provider or electronic money issuer to appoint a CCP. 29.The disadvantage is that this approach may not create a level playing field because the decision on whether or not to require the appointment of a CCP will ultimately be the Member State’s, based on its assessment of the ML/TF risk. This criterion, by itself, also fails to acknowledge practical difficulties associated with the AML/CTF supervision of large numbers of establishments. (v) A CCP is required where the number of establishments exceeds a certain threshold, or the value of payment transactions or electronic money distribution and redemption in the host’s territory exceeds EUR 3 million per calendar year, or the Member State assesses that the operation of establishments other than a branch increases the ML/TF risk (Option 1.5). 30.This option is a combination of options 1.2, 1.3 and 1.4. In this option, a drawback linked to the availability of information to support the assessment of quantitative thresholds under options 1.2 and 1.3 is mitigated by including an additional criterion on access to information, which makes it clear that it will be in an institution’s interest to make this information available upon request: should relevant information not be forthcoming, this will be grounds for the appointment of a CCP. 31.The advantage of this option is that it is in line with the risk-based approach in Directive (EU) 2015/849 and conducive to a proportionate outcome. It also creates regulatory certainty, as it includes a quantitative threshold above which a CCP is always required and makes it more difficult for institutions to avoid specific quantitative thresholds. 32.The disadvantage of this option is that Member States may come to a different view of the extent to which the outcome of their assessment of ML/TF risk justifies the appointment of CCPs where the quantitative criteria are not met, which means that differences in the EU may remain. Preferred option 33.Option 1.5 is the preferred option, as it combines quantitative criteria with a more qualitative risk assessment. It sets a definitive quantitative threshold across all Member States, which is related to the number of establishments in the host Member State’s territory, and a monetary threshold that reflects the nature and complexities of the services provided. At the same time, it allows Member States to require the appointment of CCPs where this is commensurate with the ML/TF risk.

C.2 CCP functions
34. Article 45(10) of Directive (EU) 2015/849 mandates the ESAs to set out which functions a
CCP should have. These fall into two broad categories:

• to ensure compliance, on behalf of the appointing institution, with applicable AML/CTF
  rules; and
• to facilitate supervision by competent authorities, including by providing competent
  authorities with documents and information on request.
  35.The ESAs consider that, to ensure compliance, a CCP will need to, at least:
• oversee the effective implementation, by establishments, of AML/CTF policies and
  procedures on the payment service provider’s or electronic money issuer’s behalf and take corrective action where necessary either on the payment service provider’s or electronic money issuer’s behalf or by informing the payment service provider or electronic money issuer of any breaches or compliance issues encountered;
• have adequate financial, human and technical resources to perform its functions;
• have a sound knowledge of applicable AML/CTF requirements; and
• inform the development of AML/CTF policies, controls and procedures in line with
  Article 8(3) and (4) of Directive (EU) 2015/849 and training in line with Article 46 of
  Directive (EU) 2015/849.
  36.To facilitate supervision, a CCP will need to, at least:
• have the ability to access information held by local establishments;
• have the ability to respond to any question, and provide relevant information on the
  payment service provider’s or electronic money issuer’s behalf to the host AML/CTF competent authority, including, where appropriate, on a regular basis;
• represent the payment service provider or electronic money issuer in communications
  with the host AML/CTF competent authority; and
• facilitate on-site inspections of local establishments if required by the host AML/CTF
  competent authority.

37.With this in mind, the RTS could set out:
(i) a definitive list of functions that all CCPs must be able to perform (Option 2.1) 38.The RTS could set out a definitive list of functions that all CCPs must perform in line with those set out in paragraphs 35 and 36 above. Member States would not be able to require CCPs to perform additional functions. 39.The advantage of this option is that it clearly sets out which functions a CCP must always have in order to meet the overarching objective in Article 45(9) of Directive (EU) 2015/849. It is conducive to maximum harmonisation and legal certainty. 40.The disadvantage is that setting out a definitive list of functions does not take into account specific circumstances, such as a Member State’s legal and regulatory framework or the need to address particular ML/TF risks that have been identified at the national level, where additional functions will be necessary to ensure that CCPs can effectively comply with their obligations under Article 45(9) of Directive (EU) 2015/849. This might stand in the way of the effective implementation of Article 45(9) of Directive (EU) 2015/849. (ii) a list of core functions, which can be complemented with additional functions (Option 2.2) 41.The RTS could set out a definitive list of functions that all CCPs must perform but give Member States the option of requiring the CCP to perform additional functions subject to certain criteria. 42.This option recognises that there may be specific circumstances where the imposition of additional functions on CCPs may be appropriate to ensure that CCPs can effectively ensure compliance with local AML/CFT obligations. In particular, it may be appropriate for Member States to require the CCP to facilitate interactions with the host Financial Intelligence Unit (FIU). Such additional functions would consist of:

• submitting suspicious transaction reports to the local FIU;
• responding, on behalf of the appointing institution, to any request related to the
  activity of establishments and providing relevant information upon request;
• representing the payment service provider or electronic money issuer in
  communications with the host Member State’s FIU;
• scrutinising transactions to identify suspicious transactions.
  43.The advantages of this approach are that it accommodates differences in Member States’ legal systems and approaches to AML/CFT, while at the same time preserving a minimum common standard. It is also compatible with the principle, in Directive (EU) 2015/849,

that the appointing institution is ultimately responsible for its establishments’ failure to comply with applicable AML/CFT obligations, and in line with the Directive’s risk-based approach. 44.The disadvantage of this option is that this approach introduces an element of uncertainty for payment service providers and electronic money issuers, as Member States’ practices can differ on this particular point. (iii) a list of core functions with the possibility of waivers (Option 2.3) 45.The RTS could set out a comprehensive list of functions that a CCP must perform but give Member States the option of waiving one or several functions in cases where the ML/TF risk associated with an institution’s establishments other than a branch justifies this. The advantage of this option is that it would help ensure that the CCP requirement is proportionate and can be tailored to specific risk scenarios. 46.However, responses from competent authorities to a cost–benefit questionnaire suggest that the cost associated with the introduction of waivers is greater, both for competent authorities that have to consider waiver requests and for institutions that have to apply for these, than a set list of functions. 47.Furthermore, the introduction of waivers leads to a loss of legal certainty for institutions and may not be compatible with the maximum harmonisation mandate that the ESAs have under Article 48(10) of Directive (EU) 2015/849. Preferred option 48.Option 2.2 is the preferred option because it ensures a level playing field by requiring a core list of key functions while at the same time recognising that additional functions may be necessary to ensure that the appointment of a CCP meets the objective of Article 45(9) of Directive (EU) 2015/849. D. Impact assessment 49.The implementation of the ESAs’ preferred options will create costs and benefits both for competent authorities and for payment service providers and electronic money issuers. 50.One-off costs for competent authorities will arise from the need to obtain the information necessary to assess whether or not the criteria for the appointment of a CCP are met. However, the ESAs’ preferred option frames those criteria in such a way that those costs are unlikely to be significant: competent authorities will be able to draw on existing data, such as passporting notifications and their Member State’s national risk assessments under Article 6 of Directive (EU) 2015/849, to inform their analysis. There is no expectation that the Member States carry out individual risk assessments of each agent,

person distributing electronic money on behalf of electronic money issuers, or network thereof. 51.Where Member States do not already operate a CCP regime, or have to amend an existing regime in light of these RTS, competent authorities will also face one-off costs to set up a suitable regime for ensuring CCP oversight. 52.Ongoing costs for competent authorities will arise from the need to ensure effective AML/CFT oversight. This cost exists already, independently from these RTS, and depends on the nature and size of the sector in each Member State. However, competent authorities from Member States that already have a CCP requirement indicated that the cost of supervision of CCPs was unlikely to exceed 2 FTE (full-time equivalents); and some competent authorities from Member States that did not already require a CCP expected their ongoing cost of supervision to reduce. No competent authority expected the cost of supervision to rise as a result of introducing a CCP requirement. 53.For competent authorities, the preferred options therefore lead to a net benefit in the medium term. This is because information from Member States’ competent authorities that already require the appointment of CCPs suggests that the benefits associated with the appointment of a CCP, such as easier access to information to facilitate supervision and a single point of contact between the host authority and the appointing institution, are greater than the costs to competent authorities arising from an assessment of whether or not a CCP is warranted. 54.The preferred options will create both one-off and ongoing costs for payment service providers and electronic money issuers that operate establishments other than a branch in another Member State, provided that these establishments meet the criteria for the appointment of a CCP and that the host Member State opts to require CCPs. 55.The costs related to the setting up and operation of a CCP will be determined by the form a CCP will take and depend, at least in part, on the particular circumstances of a host Member State, such as the cost of labour or (where applicable) the cost of office space. The ESAs’ mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to determining the form a CCP should take, and any decision about what the CCP should be and how it should be set up is the host Member State’s. Nevertheless, the functions envisaged by the ESAs’ preferred option suggest that all CCPs will adequate human and financial resources to carry out their functions effectively. One respondent estimated that, in some cases, the cost of maintaining a CCP could rise to EUR 140 000 per annum, although this assessment was not widely shared. 56.Information from competent authorities in Member States that already require CCPs suggests that these costs are unlikely to act as a barrier to market entry and do not impose a cost burden on providers beyond that required anyway to comply with the local AML/CFT regime. Competent
authorities from Member States that already require the

appointment of CCPs report a significant increase in the number of agents and persons distributing electronic money on an electronic money issuer’s behalf, and a public consultation in one Member State on the requirement to appoint a CCP yielded no negative responses. Furthermore, greater consistency in the way CCPs are appointed and the functions a CCP must have will benefit those payment service providers and electronic money issuers that provide services through establishments other than a branch in other Member States. 57.In the medium to long term, the ESAs expect the net impact of the ESAs’ preferred options on payment service providers and electronic money issuers to be not substantial, although the extent to which costs will outweigh the expected benefits will depend on external factors outside the ESAs’ mandate, such as the form that the CCP will take and labour market conditions in the host Member State.

4.2 Overview of questions for the public consultation
Q1: Do you agree with the criteria for a requirement to appoint a CCP (CCP)? In particular,

• do you agree that it is proportionate to require the appointment of a CCP where
• the number of establishments is equal to, or exceeds, ten; or
• the amount of electronic money distributed and redeemed, or the value of the
  payment transactions executed by such establishments is expected to exceed EUR 3 million per financial year or has exceeded EUR 3 million in the previous financial year? If you do not agree, clearly set out your rationale and provide supporting evidence where available. Please also set out at what level these thresholds should be set instead, and why.
• do you agree that Member States should be able to
• require all institutions, or certain categories of institutions, to appoint a CCP
  where this is commensurate with the ML/TF risk associated with the operation of these institutions’ establishments on the Member State’s territory; and
• empower competent authorities to require an institution to appoint a CCP where
  they have reasonable grounds to believe that the establishments of that institution present a high money laundering and terrorist financing risk, even if the criteria in Article 3(1) and (2) of these draft RTS are not met. If you do not agree, clearly set out your rationale and provide supporting evidence where available. Q2: Do you agree that the functions a CCP must always have are necessary to ensure that
• the CCP can ensure, on the appointing institutions’ behalf, establishments’ compliance
  with the host Member State’s AML/CFT requirements?
• Facilitate supervision by the host Member State’s competent authorities?
  If you do not agree, please explain which functions you think the CCP should have, and why. Q3: Do you agree that CCPs should be required to fulfil one or more of the additional functions in Article 6 of these draft RTS where this is commensurate with the ML/TF risk associated with the operation of establishments other than a branch on the host Member State’s territory? If you do not agree, clearly set out your rationale and provide supporting evidence where available. Please also set out whether you think that these additional functions should be core functions instead, and if so, why.

Q4: What level of resource (financial and other) would be required to comply with these RTS? Please differentiate between one-off (set-up) costs and ongoing (running) costs. When providing your answer, please consider that the ESAs’ mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to determining the form a CCP should take.

4.3 Comments from the ESAs’ stakeholder groups
The EBA’s Banking Stakeholder Group (BSG) responded to this consultation. The BSG broadly agreed with the quantitative criteria for appointing a central contact point but stressed that the cost associated with the operation of a central contact point in the host Member State should be low, to avoid creating a barrier to appointing institutions providing services in another Member State through establishments other than a branch. In the light of this, the BSG considered that the proposed transaction threshold was too low. The BSG did not agree with the qualitative criterion, as it considered that appointing institutions were best placed to identify and manage the ML/TF risks to which they were exposed. The BSG was of the view that the draft RTS should not specify the functions that a central contact point should have, but should instead merely task central contact points with ensuring compliance and communication with the host competent authority. Appointing institutions should be allowed to decide themselves how these outcomes should be achieved.

4.4 Feedback on the public consultation
The ESAs publicly consulted on the draft proposal.
The consultation period lasted for 3 months and ended on 5 May 2017. Ten responses were received from representatives or associations of the private sector, of which seven were published on the EBA’s website. The EBA’s Banking Stakeholder Group also expressed a view. This paper summarises the key points and other comments received during the public consultation, the ESAs’ response and the action taken to address these comments. Where several respondents made similar comments or the same respondent repeated their comments in response to different questions, these comments, and the ESAs’ analysis, are included in the section of this paper where the ESAs considered them most appropriate. Several changes to the draft joint regulatory technical standards and minor changes to the impact assessment have been made as a result of the responses received during the public consultation. Summary of key issues and the ESAs’ response Many respondents commented on issues that were outside the scope of the ESAs’ mandate in
Article 45(6) of Directive (EU) 2015/849, such as the form a central contact point should take, the
location of the central contact point and determining when an agent or distributor becomes an ‘establishment’. Other comments related to the monetary threshold for determining whether a central contact point should be appointed, and the functions a central contact point should have.

• Several respondents thought that the monetary threshold for appointing a central contact
  point was too low. Estimates provided by some respondents of the cost of establishing and maintaining a central contact point ranged between EUR 3 million per annum for central contact points in all Member States to EUR 140 000 per annum per Member State, and this meant that providing services in other Member States through establishments other than a branch would prove too costly in some cases. Central contact points exist to facilitate compliance and AML/CFT supervision in situations where a payment service provider or electronic money issuer provides services in another Member State through establishments other than a branch. It follows that Member States should be able to require the appointment of a central contact point where either or both functions cannot otherwise be ensured. This may be the case where the number of establishments other than a branch exceeds the host competent authority’s capacity to ensure adequate AML/CFT supervision, where the transactions channelled through such establishments are so complex that the risk of ML/TF is unlikely to be low, or where the ML/TF risk associated with the operation of such establishments is otherwise increased. The main criterion for deciding whether or not a central contact point is warranted is therefore the extent to which the appointment of a central contact point is commensurate with ML/TF risk, and instrumental in the fight against ML/TF. In this context, it is worth noting that recent national risk assessments and the Commission’s communications accompanying its 2016 proposal for a Directive amending Directive (EU)

2015/849 highlight that many of the services provided by payment service providers and electronic money issuers through establishments other than a branch are associated with high ML/TF risk, even where the transaction value is low. At the same time, it is important that the requirement to appoint a central contact point does not put in place barriers to market entry or otherwise create compliance costs over and above those that are necessary to achieve the aim of Article 45(9) of Directive (EU) 2015/849. The functions listed in these draft RTS are similar to those that central contact points are expected to perform in Member States that already require central contact points, and information from competent authorities that already require central contact points suggests that the central contact point requirement did not appear to stand in the way of market entry. Furthermore, while some respondents provided estimates of the cost of establishing and maintaining a central contact point, no respondent provided information on the cost of establishing and maintaining a central contact point in Member States where this is already a legal requirement. The cost of appointing and maintaining a central contact point will vary and depend on a variety of factors, such as the complexity of the appointing institution’s operation in the host Member State, the cost of labour and office space in the host Member State, host Member State requirements regarding the form a central contact point should take and the way the appointing institution structures its compliance functions, among others. Estimated cost, by itself, is therefore not enough to justify a review of the monetary threshold. In the light of the above, the monetary threshold has been maintained.

• Some respondents were concerned that the list of functions that a central contact point
  should have duplicated functions that the appointing institution had to perform itself. They were concerned that this was neither efficient nor proportionate. Central contact points are not obliged entities under Directive (EU) 2015/849. Directive (EU) 2015/849 is clear that their function is to ensure, on the appointing institution’s behalf, compliance with AML/CFT rules and to facilitate supervision by competent authorities. Consequently, there is no expectation in either the Directive or these draft RTS that central contact points duplicate compliance functions; instead, the expectation is that the central contact points serve to inform the appointing institution’s compliance efforts. Articles 4 and 5 of these draft RTS have been amended to make this clearer.

Responses to questions in Consultation Paper JC/CP/2017/08 Comments Summary of responses received ESAs’ analysis Amendments to the proposals General Comments Several respondents asked that the RTS prescribe the form a CCP should take. They were concerned that, in the absence of clear instructions to Member State, divergent expectations and practices would emerge. Some asked that the ESAs consider issuing own-initiative guidelines on this point. The ESAs’ mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to determining the form a CCP should take and any decision on the form should therefore be the host Member State’s. In line with recital 50 of Directive (EU) 2015/849, when taking decisions on the form a central contact point should take, host Member States should ensure that the requirements are proportionate and do not go beyond what is necessary to achieve the aim of compliance with AML/CFT rules and facilitating supervision. The ESAs will review the implementation of these RTS in due course; should there be evidence of market failure, the ESAs will consider if own￾initiative guidelines on the form a CCP should take might be appropriate. A new recital 8 has been included in the draft RTS to make it clear that any decision on the form a central contact point should take will be the host Member State’s One respondent thought that electronic money issuers that use distributors should be required to appoint a central contact point only if those distributors provide compliance-related activities. Directive (EU) 2015/849 is clear that a central contact point serves to ensure that its appointing institution complies with the AML/CFT rules of the host Member State in which it is established in forms other than a branch. It does not draw a distinction between establishments that play a role in the appointing institution’s compliance process and those that do not. No change One respondent asked that the draft RTS include a review clause. The ESAs have the power to review draft RTS where necessary and will endeavour to do so as and when appropriate. No change One respondent asked that the draft RTS allow appointing institutions to choose the location of their central contact points. Directive (EU) 2015/849 is clear that Member States can appoint a central contact point in their territory. It is not possible, therefore, for the draft RTS to provide for the central contact point to be based elsewhere. No change One respondent thought that CCPs The mandate in Article 45(10) of Directive (EU) 2015/849 requires the No change

Comments Summary of responses received ESAs’ analysis Amendments to the proposals should be allowed to communicate in English. ESAs to determine the functions of a central contact point, but it does not include a requirement for the ESAs to determine how these functions are to be performed. Consequently, the decision to allow central contact points to communicate in languages other than the host Member State’s official language should be the host Member State’s. When considering whether or not to allow central contact points to communicate in another language, host Member States are likely to consider the impact that the central contact point’s inability to communicate in the local language would have on the central contact point’s ability to liaise with the host Member State’s authorities and its duty to advise its appointing institution on the host Member State’s legal and regulatory AML/CFT framework.
Article 1 —
scope
One respondent asked that the scope of these draft RTS be extended to those institutions that make use of a services passport. This was necessary to avoid regulatory arbitrage.
Article 45(9) of Directive (EU) 2015/849 does not provide for the
appointment of central contact points where services are provided without an establishment. A new recital 1 was drafted to clarify that these draft RTS apply only where payment service providers or electronic money issuers operate establishments (other than a branch) in the host Member State
Article 2 —
definitions
Several respondents asked that the draft
RTS define the term ‘establishment’.
Article 45(9) of Directive (EU) 2015/849 makes it clear that central
contact points can be appointed only where a payment service provider or electronic money issuer operates establishments in another Member State’s territory. However, the ESAs’ mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to defining what is an establishment, or ‘an establishment other than a branch’. No change
Article 3 —
criteria
Most respondents welcomed the qualitative criterion and the quantitative criterion related to the number of establishments, but some respondents thought that the EUR 3 million threshold To meet the objectives in Article 45(9) of Directive (EU) 2015/849, the question is not whether or not the appointment of a CCP is an economically viable option, but whether or not a central contact point is needed to manage ML/TF risk. Chapter 5 of the consultation paper makes it clear that the proposed threshold was set at the point where an Minor amendments to Article 3 to clarify that the threshold applies to all transactions by the appointing

Comments Summary of responses received ESAs’ analysis Amendments to the proposals was too low. There was a risk that this would render the provision of services in another Member State through establishments unprofitable. Where respondents provided alternative thresholds, these ranged from EUR 20 million to EUR 500 million. One respondent was unclear whether the monetary threshold applied per establishment or captured the overall value of transactions in the host Member State, and two respondents challenged the thresholds and asked that the ESAs provide details of their own risk assessment. appointing institution’s operations in the host Member State are deemed sufficiently complex to warrant specific AML/CFT oversight by the host Member State’s competent authorities: it is low enough to reflect the fact, highlighted by recent national and supranational risk assessments, that many of the services provided by payment service providers and electronic money issuers through establishments other than a branch are associated with high ML/TF risk, but it is high enough to exclude small￾scale operations and facilitate market entry. institution’s establishments in the host Member State
Article 4 and
Article 5 —
functions
A number of respondents thought that the functions that a central contact point should have risked duplicating the appointing institution’s own compliance efforts. Some suggested that the functions should not be spelled out, and that it should be the appointing institution’s prerogative to decide how best to comply with the host Member State’s AML/CFT obligations. One respondent thought that the functions listed in the draft RTS were those that a central contact point would have in any event and considered it unnecessary to legislate for them, and Directive (EU) 2015/849 requires central contact points to ensure, on behalf of their appointing institution, compliance with the host Member State’s AML/CFT rules and to facilitate AML/CFT supervision by the host Member State’s competent authority. Central contact points are not obliged entities under Directive (EU) 2015/849 and there is no expectation in this Directive or these draft RTS that central contact points duplicate their appointing institutions’ compliance efforts. Instead, central contact points need to be sufficiently involved with, and informed of, the appointing institution’s compliance processes and findings to enable them to fulfil their functions effectively and efficiently. In light of this, and the need to create legal certainty among Member States and market participants, it is important that these draft RTS are specific about the functions that central contact points should always Minor, inconsequential amendments to Articles 4 and 5 to clarify that the central contact point is not expected to perform compliance duties of its own accord

Comments Summary of responses received ESAs’ analysis Amendments to the proposals two respondents asked for more detail on how these functions should be applied. have.
Article 6 —
additional functions
Many respondents did not support additional functions, which they said would lead to the inconsistent application of these draft RTS across the EU and, consequently, to regulatory arbitrage. They said that the duty to identify and report suspicious transactions was the appointing institution’s, and not the central contact point’s.
Article 6 applies where Member States decide, based on a risk
assessment, that the imposition of additional functions is appropriate and necessary to ensure the appointing institution’s compliance with local AML/CFT obligations. This could be the case, for example, where the host Member State’s legislation requires that reporting entities be physically based in the host Member State’s territory.
Article 6 is clear that the ultimate responsibility for identifying and
reporting suspicious transactions remains with the appointing institution. Minor changes to Article 6 to make it clear that the CCP’s role in relation to the detection and reporting of suspicious transactions is restricted to what they do on the appointing institution’s behalf