Guidelines on ML/TF risk management and access to financial services

EBA/GL/2023/04
31 March 2023
Final Report
Guidelines on policies and controls for the effective management of money laundering and terrorist financing (ML/TF) risks when providing access to financial services

FINAL REPORT – GUIDELINES ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES Contents

Executive summary 3
Background and rationale 4
Guidelines 6
1.Compliance and reporting obligations 8
2.Subject matter, scope and definitions 9
Implementation 10
Accompanying documents 15

FINAL REPORT – GUIDELINES ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES

Executive summary
De-risking refers to decisions made by credit and financial institutions to refuse to enter into, or to terminate, business relationships with individual customers or categories of customers associated with higher money laundering and terrorist financing (ML/TF) risk. In January 2022, the EBA published an Opinion on the scale and impact of de-risking in the EU. 1 This Opinion identified the main drivers of de-risking and the negative impact unwarranted de-risking can have on customers and access to financial services and the fight against financial crime. It also highlighted the steps competent authorities and co-legislators should take to address unwarranted derisking and mitigate its negative impact. The European Commission welcomed the EBA’s Opinion and asked the EBA to issue guidelines on the steps institutions should take to facilitate access to financial services by those categories of customers that the EBA’s analysis had highlighted as particularly vulnerable to unwarranted de-risking. In response to this request, the EBA issued Guidelines on policies and controls for the effective management of ML/TF risks when providing access to financial services. The guidelines complement the EBA’sseparate Guidelines on ML/TF risk factors by specifying further the policies, procedures and controls credit and financial institutions should have in place to mitigate and effectively manage ML/TF risks in accordance with Article 8(3) of Directive (EU) 2015/849, including in situations where the provisions in Article 16 of Directive (EU) 2014/92 apply, which introduces the right of individuals to open and maintain a payment account with basic features. Through these guidelines, the EBA fosters a common understanding by institutions and AML/CFT supervisors of effective ML/TF risk management practices in situations where access by customers to financial products and services should be ensured. Next steps The guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be two months after the publication of the translations. The guidelines will apply three months after publication in all EU official languages. EBA/Op/2022/01

FINAL REPORT – GUIDELINES ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES
2. Background and rationale
2.1 Background
In January 2022, the EBA published an Opinion on de-risking. 2 It assessed the scale of de-risking in the EU and the impact of credit and financial institutions’ decisions to refuse to enter into or to terminate business relationships with individual customers or categories of customers associated with higher money laundering and terrorist financing (ML/TF) risk. The EBA found that across the EU, de-risking affected a variety of customers or potential customers of institutions. The EBA made clear that derisking of entire categories of customers, without due consideration of individual customers’ risk profiles, may be unwarranted and a sign of ineffective ML/TF risk management. The publication of the EBA Opinion on de-risking led the European Commission to ask the EBA to issue new guidelines on the steps institutions should take to facilitate access to financial services by those categories of customers that the EBA’s analysis had highlighted as particularly vulnerable to unwarranted de-risking. 3 This coincided with the outbreak of the war in Ukraine, which further demonstrated the adverse impact of de-risking on vulnerable customers, such as asylum seekers. To respond to the Commission’s request, the EBA prepared draft guidelines that foster a common understanding by institutions and AML/CFT supervisory authorities of effective ML/TF risk management practices in situations where access by customers to financial products and services is at risk. These guidelines complement the EBA’s Guidelines on ML/TF risk factors (EBA/GL/2021/02) and specify further the policies, procedures and controls credit and financial institutions should have in place to mitigate and effectively manage ML/TF risks in accordance with Article 8(3) of Directive (EU) 2015/849, including in situations where the provisions in Article 16 of Directive (EU) 2014/92 (the Payment Accounts Directive – PAD) apply. The EBA consulted the public on a version of these guidelines between 6 December 2022 and 6 February 2023. It received 25 responses, which came from various categories of stakeholders: representatives of credit and financial institutions, of the diamond industry and of the not-for-profit sector, as well as individuals.
2.2 Rationale
Access to financial products and services is a prerequisite for participation in modern economic and social life. For the most vulnerable, preventing such access can lead to severe economic outcomes, EBA/Op/2022/01 ARES(2022)1932799

FINAL REPORT – GUIDELINES ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES affect everyday life and in some cases increase the risks of being exploited. At the same time, it is important that financial crime risks are effectively managed. Through these guidelines, the EBA clarifies the interplay between access to financial services and institutions’ AML/CFT obligations. It also sets out the steps institutions should take when considering whether to refuse or terminate a business relationship with a customer based on ML/TF risk or AML/CFT compliance grounds. The guidelines also make clear that credit and financial institutions should document any decisions to refuse a business relationship or to apply risk-mitigating measures. These decisions must be proportionate and aligned with the principle of non-discrimination as enshrined in Article 15 of the PAD and
Article 21 of the EU Charter of Fundamental Rights and must be made readily available to competent
authorities.
The guidelines finally include aspects related to complaint mechanism institutions should have in place to ensure customers can complain if they feel they have been treated unfairly. The Joint Guidelines on complaints-handling for the securities and banking sectors 4 also provide useful information on this aspect. JC 2018 35.

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES
3. Guidelines

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES EBA/GL/2023/04 31 March 2023 Guidelines on policies and controls for the effective management of money laundering and terrorist financing (ML/TF) risks when providing access to financial services

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES

Compliance and reporting obligations
Status of these guidelines
This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No
1093/2010 5
. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and credit and financial institutions must make every effort to comply with the guidelines.
Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area.
Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must
notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by [dd.mm.yyyy]. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be noncompliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2023/04’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.
Notifications will be published on the EBA website, in line with Article 16(3).
Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES
2. Subject matter, scope and definitions
Subject matter and scope of application
5. These guidelines complement the EBA’s Guidelines on ML/TF risk factors (EBA/GL/2021/02)
and specify further the policies, procedures and controls credit and financial institutions should have in place to mitigate and effectively manage ML/TF risks in accordance with
Article 8(3) of Directive (EU) 2015/849, including measures with respect to the provision of
a basic payment account in accordance with Article 16 of Directive (EU) 2014/92.
Addressees
6. These guidelines are addressed to credit and financial institutions as defined in Article 3(1)
and 3(2) of Directive (EU) 2015/849, which are financial sector operators as defined in Article 4(1a) of Regulation (EU) No 1093/2010. These guidelines are also addressed to competent authorities as defined in Article 4(2) point (iii) of Regulation (EU) No 1093/2010. Competent authorities should use these guidelines when assessing the adequacy of credit and financial institutions’ risk assessments and anti-money laundering and counter-terrorist financing (AML/CFT) policies and procedures. Definitions
7. Unless otherwise specified, terms used and defined in Directive (EU) 2015/849 have the
same meaning in the guidelines. In addition, for the purposes of these guidelines, the following definitions apply:
De-risking a refusal to enter into or a decision to terminate business relationships with individual customers or categories of customers associated with higher ML/TF risk, or to refuse to carry out higher ML/TF risk transactions. ML/TF risk the likelihood and impact of ML/TF taking place. ML/TF risk factors variables that, either on their own or in combination, may increase or decrease ML/TF risk. Risk‐based approach means an approach whereby competent authorities and credit and financial institutions identify, assess and understand the ML/TF risks to which institutions are exposed and take AML/CFT measures that are proportionate to those risks. 6 Directive 2014/92/EU of the European Parliament and of the Council of 23 July 2014 on the comparability of fees related to payment accounts, payment account switching and access to payment accounts with basic features (OJ L 257, 28.8.2014, p. 214–246)

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES Jurisdictions associated with higher ML/TF risk means countries that, based on an assessment of the risk factors set out in Title I of these guidelines, present a higher ML/TF risk. This excludes ‘high-risk third countries’ identified as having strategic deficiencies in their AML/CFT regime, which pose a significant threat to the Union’s financial system (Article 9 of Directive (EU) 2015/849).
3. Implementation
Date of application
8. The guidelines will apply three months after publication in all EU official languages.
Title 1: General provisions
RISK ASSESSMENT
9. Credit and financial institutions should set up their policies, controls and procedures in a way
that enables them to identify relevant risk factors and to assess ML/TF risks associated with individual business relationships in line with the EBA ML/TF risk factors guidelines. 7 As part of this, credit and financial institutions should differentiate between the risks associated with a particular category of customers and the risks associated with individual customers that belong to this category.
10. Credit and financial institutions should ensure that the implementation of these policies, procedures and controls does not result in the blanket refusal or termination of business relationships with entire categories of customers that they have assessed as presenting higher ML/TF
risk.
CDD MEASURES
11. Credit and financial institutions should put in place risk-sensitive policies and procedures to
ensure that their approach to applying customer due diligence (CDD) measures does not result in them unduly denying customers legitimate access to financial services. To comply with their obligations under Article 14(4) of Directive (EU) 2015/849, credit and financial institutions should set out in their policies and procedures the criteria they will use to determine on which grounds they will decide that a business relationship may be rejected or terminated or that a transaction may be denied. As part of this, they should set out in their policies, procedures and controls all options for mitigating higher ML/TF risks that they will consider applying before 7 Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849, EBA/GL/2021/02.

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES deciding to reject a customer on ML/TF risk grounds. These options should at least include adjusting the level and intensity of monitoring and, where this is permitted under national law, the application of targeted restrictions to products or services. Institutions’ policies and procedures should set out clearly in which situations the application of these mitigating measures may be appropriate.
12. Before taking a decision to reject or to terminate a business relationship, credit and financial
institutions should satisfy themselves that they have considered and rejected all possible mitigating measures that could reasonably be applied in the particular case, taking into account the ML/TF risk associated with the existing or prospective business relationship. REPORTING AND RECORD KEEPING
13. For the purposes of reporting obligations under Article 33 of Directive (EU) 2015/849, credit
and financial institutions should set out in their policies and procedures the criteria that will be used to determine the reasonable grounds on which they would suspect that ML/TF is taking place or is being attempted.

Credit and financial institutions should document any decision to refuse or terminate a business
relationship and the reason for doing so, and should be prepared to make this documentation available to their competent authority upon request. PROVISIONS SPECIFIC TO THE INTERPLAY WITH DIRECTIVE 2014/92/EU
In relation to the right of access to a payment account with basic features in accordance with
Articles 16(2) and 17 of Directive 2014/92/EU, credit institutions obliged to offer such basic accounts should set out in their account opening policies and procedures how they can adjust their customer due diligence requirements to account for the fact that the limited functionalities of a basic payment account help mitigate the risk that the customer could abuse these products and services for financial crime purposes.
When ensuring non-discriminatory access to a basic payment account under Article 15 of Directive 2014/92/EU, credit institutions should make sure that where digital onboarding solutions are in place, these also comply with the aforementioned directive and with these guidelines and that the digital solutions do not produce automated rejections, which would conflict
with the directive and these guidelines.
Over time and as their understanding of the ML/TF risk associated with individual business relationships grows, credit institutions should update the individual risk assessment of the customer and adjust the extent of monitoring and the type of products and services for which that
customer is eligible.
Title 2: Adjusting the intensity of monitoring measures

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES
18. Credit and financial institutions should set out in their policies and procedures how they adjust
the level and intensity of monitoring in a way that is commensurate with the ML/TF risk associated with the customer and in line with the customer’s risk profile, as set out in the EBA’s risk factors guidelines and in particular guidelines 4.69 to 4.75. To effectively manage ML/TF risk associated with a customer, monitoring should at least include the following steps:
a. setting expectations of the customer’s behaviour, such as the likely nature, amount, source and destination of transactions, so as to enable the institution to spot unusual transactions. b. ensuring that the customer’s account is reviewed regularly to understand whether changes to the customer’s risk profile are justified.
c. ensuring that any changes to the previously obtained CDD information that might affect the institution’s assessment of the ML/TF risk associated with the individual business relationship are taken into account.
19. Credit and financial institutions’ policies and procedures should contain guidance on handling
applications from individuals that may have credible and legitimate reasons to be unable to provide traditional forms of identity documentation. These should set out at least:
a. The steps to take where the customer is a person seeking asylum under the Geneva Convention of 28 July 1951 relating to the Status of Refugees, the Protocol thereto of 31 January 1967 and other relevant international treaties, and cannot provide the credit and financial institution with a traditional form of identification, such as a passports or ID card. Institutions’ policies and procedures should specify which alternative, independent documentation it can rely upon to meet its CDD obligations, where permitted by national law. These documents should be sufficiently reliable, i.e., up to date, issued by an official national or local authority and containing, as a minimum, the applicant’s full name and date of birth. b. The steps to take where the customer is vulnerable and cannot provide traditional forms of identification or an address, for example because the customer is a refugee under the 1951 Geneva Convention or other relevant international treaties, or does not have a fixed address. Institutions’ policies and procedures should specify which alternative, independent documentation it can rely upon. This documentation may include, where permitted under national law, expired identity documents and documentation provided by an official authority, such as social services or a well-established not-for-profit organisation working on behalf of official authorities (Red Cross or similar), which also provides assistance to this customer.
c. Similar steps may also be applied to individuals who are not granted a residence
permit but whose expulsion is impossible for legal or factual reasons. In such situations, credit and financial institutions’ policies and procedures should have regard

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES to certificates or documentation produced by an official authority or by an organisation providing support or legal assistance to those individuals on behalf of an official authority, where permitted by national law. Such authorities may include social work departments, home affairs ministries and migration services. These documents may be used as proof that the individual cannot be expulsed expelled in accordance with EU law. d. In cases where support for the persons referred to in points a., b. and c. is disbursed in the form of prepaid cards and where the conditions related to simplified due diligence are met as set out in guidelines 4.41, 9.15, 10.18 of the EBA’s ML/TF Risk Factors Guidelines, policies and procedures should indicate that credit and financial institutions may postpone the application of initial customer due diligence measures to a later date. e. In cases where the persons referred to in points a., b. and c. apply for access to a payment account and are considered as presenting low ML/TF risks, policies and procedures should indicate which alternative forms of ID the institution may accept and the options for postponing the application of full CDD until after the establishment of the business relationship. Title 3: Targeted and proportionate limitation of access to products or services
20. Credit and financial institutions’ policies and procedures should, where permitted by national
law, include options and criteria on adjusting the features of products or services offered to a given customer on an individual and risk-sensitive basis. These should include the following options:
a. offer payment accounts with basic features, where a credit institution is obliged to offer such accounts under the national transposition of Directive 2014/92/EU; or b. impose targeted restrictions on financial products and services, such as the amount, the type or the number of transfers or the amount of transactions to and from third countries, in particular where these third countries are associated with higher ML/TF risk, where permitted under national law.
21. In relation to ML/TF risks associated with customers who are particularly vulnerable, such as
those persons referred to in paragraph 19, credit and financial institutions should ensure that their controls and procedures specify that possible limitations of products and services set out in paragraph 20 (b) are applied taking into consideration the personal situation of the individu-

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES als, the ML/TF risks associated therewith and their financial basic needs. In those cases, procedures should include the assessment of the following options to potentially mitigate the associated risks:
a. no provision of credit or overdraft facilities; b. monthly turnover limits (unless the rationale for larger or unlimited turnover can be explained and justified);
c. limits on the amount, the type and/or number of transfers (further or larger transfers are
possible on a case-by-case basis); d. limits on the amount of transactions to and from third countries (while considering the cumulative effect of frequent smaller transactions within a set period of time), in particular where these third countries are associated with higher ML/TF risk; e. limits on the size of deposits; f. limits third party payments to those made by the authority that disburses support for such customers; g. limits on payments received from third parties that the institution has not verified; and h. prohibiting cash withdrawals from third countries. Title 4: Information on complaint mechanisms
22. Credit and financial institutions’ policies and procedure should specify that when they communicate a decision to refuse or terminate a business relationship with a customer or potential
customer, they must advise that person of their right to contact the relevant competent authority or designated alternative dispute resolution body and they must provide the relevant contact details. Institutions may also provide the customer with the weblink of the EBA’s suggestions on the submission of complaints to national bodies. 8 https://www.eba.europa.eu/consumer-corner/how-to-complain

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES
4. Accompanying documents
4.1 Cost-benefit analysis / impact assessment
As per Article 16(2) of Regulation (EU) No 1093/2010 (EBA Regulation), any guidelines and recommendations developed by the EBA must be accompanied by an impact assessment (IA), which analyses ‘the potential related costs and benefits’. This analysis presents the IA of the main policy options included in this consultation paper on the draft guidelines on policies and controls for the effective management of ML/TF risks when providing access to financial services (‘the draft guidelines on access to financial services’ or ‘the draft guidelines’). The IA is at a high level and qualitative in nature. A. Problem identification and background In January 2022, the EBA published an Opinion on de-risking in which it assessed the scale and impact of de-risking in the EU 9 . De-risking in this context refers to decisions by credit and financial institutions to refuse to enter into or decisions to terminate business relationships with individual customers or categories of customers associated with higher money laundering and terrorist financing (ML/TF) risk. The EBA found that across the EU, de-risking affected a variety of customers or potential customers of institutions. The EBA made clear that de-risking of entire categories of customers, without due consideration of individual customers’ risk profiles, may be unwarranted and a sign of ineffective ML/TF risk management. This Opinion led the European Commission to ask the EBA in a letter dated March 2022 to ask the EBA to:
“work on Guidelines (…) on the articulation of PAD rules (…) and the AML framework. The Guidelines should consider the de-risking issue in its broadest financial inclusion dimension (…)” and to ”broaden the scope of such guidelines beyond the interaction of AML and PAD requirements(…)”. Following the Commission’s request, the EBA assessed existing EBA guidance, in particular its ML/TF RFGLs, which were revised in March 2021. The EBA performed a gap analysis to establish how best to respond to the Commission’s request without duplicating existing provisions. On this basis, the EBA recognised that several aspects would indeed benefit from further regulatory clarifications, as it pointed out in its Opinion on de-risking. Following this gap analysis and to respond to the Com9 Opinion of the European Banking Authority on ‘de-risking’, EBA/Op/2022/01.

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES mission’s request without duplicating existing provisions, the EBA, having consulted with the competent authorities that are responsible for the AML/CFT supervision of financial institutions, is proposing to issue a new set of guidelines (‘the draft guidelines on access to financial services’), which build on the right to access a payment account and clarify different ways of mitigating ML/TF risks in an efficient manner. B. Policy objectives The draft guidelines on access to financial services address financial access in a broad sense and provide general principles for the provision of such access for all types of customers. The overall objective of these draft guidelines is to address the main drivers of unwarranted de-risking of legitimate customers, as identified in the above-mentioned EBA Opinion on de-risking. The draft guidelines on access to financial services give details on how ML/TF risks associated with certain types of customers can be mitigated effectively, such as by adjusting the intensity of monitoring measures or by limiting the access to targeted products or services, in line with a risk-based approach. These details are divided into a general part that relates to all types of customers and a more specific part that deals with customers that are likely to be excluded from access to financial services (such as refugees or homeless individuals) and for whom access to financial services is a prerequisite for the fulfilment of their basic or essential needs.
C. Options considered, assessment of the options and preferred options
Section C presents the main policy options discussed and the decisions made by the EBA during the
development of the draft guidelines on access to financial services. The advantages and disadvantages, as well as potential costs and benefits from the qualitative perspective of the policy options and the preferred options resulting from this analysis, are outlined. In the section on the adjustment of the intensity of monitoring measures, add a specific part about individuals that may have credible and legitimate reasons for being unable to provide traditional forms of identity documentation. The draft guidelines on access to financial services contain a section on the adjustment of the intensity of monitoring measures. A first and general point requests institutions to set out in their policies and procedures how they adjust the level and intensity of monitoring in a way that is commensurate with the ML/TF risk associated with the customer, and this point also broadly outlines the steps that these monitoring measures should include. In addition to this broad point covering all types of customers, the EBA evaluated the possibility of providing institutions with more specific and detailed guidance on the adjustment of these monitoring measures in situations where individuals may have credible and legitimate reasons for being unable to provide traditional forms of identity documentation, which are usually required for accessing financial services. Two options have been considered by the EBA in this regard:

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES Option 1a: Adding specific guidance about individuals that may have credible and legitimate reasons for being unable to provide traditional forms of identity documentation. Option 1b: Not adding specific guidance about individuals that may have credible and legitimate reasons for being unable to provide traditional forms of identity documentation. As highlighted by the EBA Opinion on de-risking and the EBA’s Consumer Trends Reports 10, an increasing number of individuals face difficulties opening a bank account. This is leading to the financial exclusion and further marginalisation of such individuals in EU societies. The move towards a cashless society makes access to financial services all the more crucial for fulfilling basic needs. As described by several organisations’ reports, vulnerable individuals (such as homeless persons or refugees) are particularly affected by these difficulties 11. This is because very often these individuals are unable to provide traditional forms of identity documentation. Even though the Payment Accounts Directive sets out in Article 16 a ‘right of access to a payment account with basic features’ for all individuals legally resident in the EU, this can be in conflict with the requirements of Article 13 of the AMLD, which requires financial institutions to ‘identify the customer and verify the customer’s identity on the basis of documents’. This due diligence requirement can be a strong disincentive for institutions to provide access to financial services when a prospective customer is unable to provide such documentation. As a result of those observations, providing additional guidance to institutions to support them in handling applications for the opening of bank accounts for those individuals with no traditional form of identity documentation proves necessary. Such guidance would equip them to effectively manage financial crime risks whilst not excluding vulnerable customers. To evaluate and accept alternatives in situations where a customer has credible and legitimate reasons to be unable to provide traditional forms of identity documentation, institutions would need to implement more granular and tailored policies and procedures for their account opening process. The draft guidelines on access to financial services would give guidance on the type of documents that could be used in this regard by institutions to facilitate the opening of a bank account for these specific categories of customers. Furthermore, having such policies in place would result in a reputational gain for the institutions, who would be able to demonstrate their commitment to facilitating the financial inclusion of vulnerable customers. As the guidance would apply to all customers that may have credible and legitimate reasons for being unable to provide traditional forms of identity documentation, this approach would strengthen social inclusion at
EU level. In addition to these reputational benefits, institutions could benefit from the incomes – although not significant – resulting from opening more customer accounts. 10 Opinion of the European Banking Authority on ‘de-risking’, EBA/Op/2022/01; EBA Consumer Trends Report, EBA/REP/2021/04. 11 Finance Watch, Financial exclusion: Making the invisible visible. A study on societal groups encountering barriers to accessing financial services in the EU, March 2020; FEANTSA, Homelessness services provide solutions to increase financial inclusion of people experiencing homelessness in increasingly cashless societies, 2022.

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES On these grounds, Option 1a has been chosen as the preferred option. Documentation of refusal of a business relationship and the reason for doing so As explained above, the draft guidelines on access to financial services first contain general principles that apply to all types of customers and provide details on how ML/TF risks associated with certain types of customers can be mitigated effectively, such as by adjusting the intensity of monitoring measures and by limiting the access to targeted products or services, in line with a risk-based approach. To enhance the impact of the new guidelines and to monitor their implementation in the institutions, the EBA considered two options:
Option 2a: Adding a requirement to document the decision to refuse a business relationship and the reason for doing so. Option 2b: Not adding a requirement to document the decision to refuse a business relationship and the reason for doing so. Decisions made by institutions to reject or terminate a business relationship might have several negative consequences. In addition to the above-mentioned exclusion of vulnerable individuals, the negative consequences can also affect other types of de-risked customers, such as payment institutions, fund managers, FinTech firms, NPOs and diamond-trade businesses. De-risking can unfairly exclude legitimate customers in certain cases. Moreover, once rejected by institutions, these customers may resort to alternative payment and banking channels where they will be monitored less and, as a consequence, AML/CFT prevention could be hampered. Enhancing the quality and granularity of the decision process to de-risk a particular customer is thus crucial, and all the principles disclosed in the current draft guidelines provide added value in this context. Nevertheless, in the EBA’s view, not documenting the decision and reasons behind the refusal of business relationships would impede institutions’ internal controls on correct implementation of EBA’s guidance and strongly alter the objectives of the draft guidelines. It would also make effective supervision difficult. Moreover, the requirement to document the decisions will naturally streamline the entire account opening process before a potential refusal. In addition, documenting the decisions would allow institutions to better defend their decisions in case of claims by rejected customers. As this documenting requirement would be a strong pillar supporting the correct implementation of the draft guidelines on access to financial services, it would indirectly trigger reputational gains for the institutions described in the section on Option 1 and would also generate financial income from the opening of more customer accounts. As a result, the costs incurred by the requirement to document decisions made to refuse business relationship are more than offset by the above-mentioned benefits. For these reasons, Option 2a has been chosen as the preferred option.

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES Add a specific section for other categories of customers particularly affected by de-risking The afore-mentioned letter from the European Commission of March 2022 requested that the EBA take into consideration some specific situations where de-risking is particularly acute, for instance when it affects individuals that are politically exposed persons (‘PEPs’) or customers who appear to be excluded from access to financial services because they are subject to the US tax regime (e.g. ‘accidental Americans’). Based on this suggestion from the European Commission and the EBA’s own findings, the EBA considered two options:
Option 3a: Adding a specific new set of guidelines related to other categories of customers particularly affected by de-risking. Option 3b: Not adding a specific new set of guidelines related to other categories of customers particularly affected by de-risking. As mentioned previously, the EBA performed a gap analysis to establish how best to respond to the Commission’s request without duplicating existing provisions. As regards PEPs, the RFGLs already provide a number of clarifications that support credit and financial institutions in managing ML/TF risks associated with individual business relationships in an effective manner when customers are PEPs. A detailed guide for institutions on how to approach PEPs is thus not needed. On the other hand, the draft guidelines on access to financial services will apply to all type of customers, including PEPs. These draft guidelines will as such enhance the effectiveness of institutions’ ML/TF risk management when providing PEPs with access to financial services and clarify the different ways of mitigating their ML/TF risks in an efficient manner. The principles in these draft guidelines’ will enhance the implementation of the already existing provisions related to PEPs outlined in the RFGLs – for instance, with the requirement to document the decision to refuse or terminate a business relationship and the reason for doing so. ‘Accidental Americans’ who are EU citizens or who legally reside in the EU, are entitled to access to a payment account with basic features, and therefore the draft guidelines on access to financial services that the EBA is proposing are applicable in this context. Therefore, as for PEPs, the application of these draft guidelines will enhance the effectiveness of institutions’ ML/TF risk management when providing access to financial services to ‘accidental Americans’. These draft guidelines will also clarify the different ways to mitigate ML/TF risks in an efficient manner. The EBA in this regard stresses that reporting obligations under the Foreign Account Tax Compliance Act (FATCA) do not constitute grounds for denying such access under the PAD. Therefore, the EBA considered that the specific situation of PEPs, ‘accidental Americans’ or any other customers (including legal entities) affected by unwarranted de-risking, would be addressed

FINAL REPORT ON EFFECTIVE ML/TF RISK MANAGEMENT AND ACCESS TO FINANCIAL SERVICES via the requirements set out in the draft guidelines on access to financial services. Finally, not adding a specific new set of guidelines for each of these customer categories will mean no additional costs for the institutions. For all these reason, Option 3b has been chosen as the preferred option. D. Conclusion The development of the draft guidelines on policies and controls for the effective ML/TF risk management when providing access to financial services, which clarify the different ways to mitigate ML/TF risks in an efficient manner, was deemed necessary to mitigate the negative impact of unwarranted de-risking and to decrease as a result the exclusion of legitimate and in some cases vulnerable customers. These new guidelines will improve the due diligence process required at the onboarding stage and in the course of the business relationship, and ultimately will help to improve the social impact of credit and financial institutions. The costs associated with more granular, tailored customer due diligence policies and procedures will be exceeded by the afore-mentioned benefits. Hence, these new guidelines should achieve their objective of providing better and fairer access to financial services with acceptable costs.
4.2 Feedback on the public consultation
The EBA consulted the public on the draft proposal contained in this paper. The consultation period lasted for two months and ended on 6 February 2023. 25 responses were received, of which 20 were published on the EBA website. Respondents came from various backgrounds: credit and financial institutions, diamond trade associations, representatives of NPOs and NPO umbrella organisations, and individuals. Several industry bodies made similar comments, or the same body repeated its comments in response to different questions. In such cases, the comments and the EBA analysis are included in the feedback table where EBA considers them most appropriate. Changes to the draft guidelines have been incorporated as a result of the responses received during the public consultation. The amendments mainly cover:

clarification related to the reporting obligations of credit and financial institutions
clarification on the types of products that can be restricted/limited
further alignment with the EBA’s Guidelines on ML/TF risk factors
The following table presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments, and the actions taken to address them if deemed necessary.

Summary of responses to the consultation and the EBA’s analysis
Section: Subject matter, scope and definitions
Guideline Summary of responses received EBA analysis Amendments to the proposal Addresses/ Scope A respondent argued that these guidelines were only relevant for credit institutions. A respondent asked if the guidelines would also apply to investment services. Respondents asked whether account information services (AIS), payment initiation services (PIS) and payment institutions were in scope. As specified in the ‘Addressees’ section, the guidelines are addressed to credit and financial institutions as defined in
Article 3(1) and 3(2) of Directive (EU) 2015/849, which are
financial sector operators as defined in Article 4 (1a) of Regulation (EU) No 1093/2010. These are the institutions that are in the EBA’s remit in relation to AML/CFT. The guidelines specify the instances in which only credit institutions covered by the PAD requirement are concerned. None A respondent recommended that the EBA extend the scope of the guidelines on effective management of ML/TF risks when providing access to financial services to also include the offering of bank accounts to payment institutions (PIs). The report annexed to the Opinion on de-risking stressed that payment institutions can make decisions to de-risk customers, but they may also be subject to de-risking by credit institutions. The guidelines cover all types of customers, whether they are individuals, individuals covered by the PAD, or legal entities. However, the EBA considered that derisking of PIs required a distinct approach from that required for other customers to be effective, and therefore it has decided to tackle this issue in a more detailed manner as part of the current revision of PSD2. Please refer to the EBA’s response to the Commission’s Call for advice published in June 2022 for further details. None A respondent implied that these guidelines were not applicable to NPO customers but only to individuals and asked whether the EBA could recommend that a basic account be made available to legal entities too. The guidelines cover all types of customers, whether they are individuals, individuals covered by the PAD, or legal entities. The guidelines specify the instances in which only the PAD requirement would apply. None

Definitions
A respondent recommended amending the definition of ‘ML/TF risk’ and deleting the ‘impact’ criterion from the definition. The definition of ML/TF risk is the EBA’s and is used across all of the EBA’s products. None Several respondents recommended amending the definition of de-risking and aligning it with the FATF definition. The EBA acknowledges that its definition of de-risking differs from the FATF’s definition. This is because the EBA makes a distinction, as explained in its Opinion on de-risking, between a decision to reject a customer as a result of the application of Article 14(4) of the AMLD and a decision to reject a customer without due consideration of the individual customer’s risk profile (i.e. unwarranted de-risking). None A respondent recommended that the EBA include the risk of ‘proliferation financing’ and align with the FATF in that regard. The guidelines are based on the EU AMLD, which does not cover proliferation financing. None A respondent asked whether refugees are included in the asylum seeker category and suggested referring to ‘forcibly displaced persons’ to ensure further clarity. The EBA agrees that the guideline should distinguish between asylum seekers and refugees, since both these categories of customers are vulnerable and may face different difficulties to access financial services, because their legal status is different. Therefore, paragraph 19 has been amended to reflect this, as follows:
19.a. The steps to take where the customer is a person seeking asylum under the Geneva Convention of 28 July 1951 relating to the Status of Refugees, the Protocol thereto of 31 January 1967 and other relevant international treaties and cannot provide the credit and financial institution with traditional forms of identification, such as passports or ID cards. 19.b. The steps to take where the customer is vulnerable and cannot provide traditional forms of identification or an address, for example because the customer is a refugee under the 1951 Geneva Convention or other relevant international treaties, or does not have a fixed address Amendment in paragraph 19

Section: General provisions
Guideline Summary of responses received EBA analysis Amendments to the proposal General comments A respondent recommended that it should be made clearer that financial institutions’ staff should receive adequate training on applying these guidelines. Another recommended providing more details on the engagement of NCAs to promote more effective financial inclusion measures. These guidelines must be approached in conjunction with the EBA’s Guidelines on ML/TF risk factors, which already cover training of staff in guideline 6. None Several respondents were concerned that these guidelines only cover decisions to reject customers on ML/TF grounds, and not those connected to ESG-related concerns. They argued that credit and financial institutions often rely on ESG considerations to justify a blanket refusal or termination of customers. For ESG-related concerns, the legal basis of these guidelines is the applicable EU AML/CFT legal framework. These guidelines consider AML/CFT and thus ESG-related matters to the extent that they are also relevant from an AML perspective. None Several respondents were of the view that the guidelines affect their freedom to conduct business, as enshrined in Art 16 of the EU Charter. The guidelines do not restrict the freedom to conduct business as enshrined in Art 16 of the EU Charter. They however make clear that AML/CFT can never be an excuse to deny legitimate customers access to financial services. None A respondent recommended that the guidelines should require the institutions to make their policies and procedures public. There is currently no provision at EU level that would require a financial institution to make their policies and procedures publicly available. None Paragraph 9 A respondent suggested adding the following sentence at the end of the paragraph: ‘Such a differentiation should facilitate individual evaluations when people belonging to pre-established highrisk customer categories access financial services, This aspect is covered as part of the following paragraph, which makes clear that policies, procedures and controls should not result in the blanket refusal or termination of None

preventing individuals from being automatically excluded without proper customer due diligence.’ business relationships with entire categories of customers that they have assessed as presenting higher ML/TF risk. Paragraph 10 Several respondents said that not every financial service or product is a prerequisite for participation in society. They were of the view that only payment accounts as envisaged by the PAD are a prerequisite for participation. They also recommended defining what a customer is in that context, using the definition of ‘consumer’ as in the PAD. Some were also of the view that the banks’ right to decide the level and intensity of the CCD requirements (also in terms of information required) based on the risk of the client should be re-affirmed. The paragraph is clear that CDD measures should not result in unduly denying customers legitimate access to financial services. Therefore, this requirement goes beyond the payment account with basic features envisaged by the PAD and that only applies to individuals who are legally residing in the EU. The paragraph is equally clear that institutions should put in place risk-sensitive policies and procedures. None A respondent asked the EBA to clarify whether the term ‘entire categories of customers’ included customers suspected or convicted of involvement with organised crime. The EBA’s Guidelines on ML/TF risk factors provide guidance on the risk factors to consider when identifying the risk associated with a customer’s reputation. This includes allegations of criminality or terrorism, or the fact that the customer is publicly known to be under investigation for terrorist activity or has been convicted for terrorist activity. The AMLD furthermore specifies that suspicious transactions and other information relevant to money laundering, associated predicate offences and terrorist financing should be reported to the Financial Intelligence Unit (in line with
Article 33 of the Directive).
None
Paragraph 11 One respondent suggested adding to this paragraph: ‘Options for mitigating higher ML/TF risks should consider barriers that people in vulnerable situations may face in producing requested documentation, but which do not lead necessarily to a high level of risk (such as the example of people facing homelessness, destitute mobile EU citizens or asylum seekers who may not have an address).’ This aspect is already covered in paragraph 21, which makes clear that credit and financial institutions should ensure that their controls and procedures should take into consideration the personal situation of the individuals who are vulnerable and their basic financial needs. None

Paragraph 12 A respondent recommended the guidelines specify that credit and financial institutions must keep a record of the mitigating measures that have been considered in concrete cases, together with the reasons why these measures were considered to be insufficient. It would also be very much welcomed if in particular cases credit and financial institutions were required to produce proof of the fact that these measures have effectively been considered. This aspect is covered by paragraph 14, which requires financial institutions to document any decision to refuse or terminate a business relationship and the reason for doing so. None Paragraph 13 Several respondents recommended that it should be made clear that a customer may be rejected if it is not possible to assess how risk can be mitigated or in case of criminal conduct or suspected criminal conduct. Similarly, a respondent recommended that the guidelines could consider differentiating between situations in which a financial institution has reported a customer for suspected ML/TF activity. To clarify further paragraph 13 and to reflect the respondents’ concerns, paragraphs 11 and 13 are amended as follows:
11. Credit and financial institutions should put in
place risk-sensitive policies and procedures to ensure that their approach to applying customer due diligence (CDD) measures does not result in unduly denying customers legitimate access to financial services. To comply with their obligations under Article 14(4) of Directive (EU) 2015/849, credit and financial institutions should set out in their policies and procedures the criteria they will use to determine on which grounds they will decide that a business relationship is rejected or terminated, or a transaction denied. As
part of this, credit and financial institutions should set out
in their policies, procedures and controls all options for mitigating higher ML/TF risk that they will consider applying before deciding to reject a customer on ML/TF risk grounds. These options should at least include adjusting the level and intensity of monitoring and, where this is permitted under national law, the application of targeted restrictions to products or services. Institutions’ policies and procedures should set out clearly in which situations the application of these mitigating measures may be appropriate. Amendment of paragraph 11 and 13

For the purposes of reporting obligations under
Article 33 of Directive (EU) 2015/849, credit and financial institutions should set out in their policies and procedures the
criteria that will be used to determine the reasonable grounds on which they would suspect that ML/TF is taking place or is being attempted. Several respondents asked, in relation to FATCA, if the EBA considered that a lack of Tax Identification Number (TIN) or a client’s refusal to provide a TIN should be considered as an indicator for tax evasion. Applicable rules under FATCA are not within the scope of these guidelines, as FATCA is a US matter. None Paragraph 14 One respondent suggested modifying the paragraph as follows: ‘Credit and financial institutions should document [in writing] any decision to refuse or terminate a business relationship and the reason for doing so, [by the deadline set out in the PAD Directive: ‘without undue delay and at the latest ten business days after receiving a complete application.]’ The requirement in paragraph 14 does not cover information to be provided to the customer who has been rejected, but rather information for the competent authorities to be able to check whether financial institutions have taken the appropriate steps before making a decision to reject the customer. To make this point clearer, the paragraph is amended as follows:
Credit and financial institutions should document any
decision to refuse or terminate a business relationship and the reason for doing so, and Furthermore, they they should be prepared to make this documentation available to their competent authority upon request. Amendment of paragraph 14 Several respondents were also of the view that clarification was needed that only refusals and terminations of client relationships for AML/CFT reasons should be documented. If a client relationship is refused or terminated for other reasons (e.g. ESG framework, client non-responsiveness), documenting the decision would be disproportionate and not in line with the General Data Protection Regulation (GDPR). Another respondent was of the view that financial institutions ESG-related matters and financial institutions’ customer acceptance policies are outside the scope of these guidelines. None

should be given the option to reject companies or certain industries without further explanations.
According to the respondent, if banks were required to document decisions to reject certain legal entities, this would put them in the difficult position of having to explain why they reject corporate customers in, for instance, the red-light industry (whenever legal in the respective country), where there is no concrete evidence of criminal behaviour, instead of managing the ML/TF risks related to them. Paragraph 15 Several respondents were of the view that this paragraph gives the impression that that CDD requirements for basic payment accounts should be less rigorous than regular CDD requirements. Another respondent, for clarity purposes, suggested reformulating this paragraph as follows:
‘The limited functionalities of a basic payment account help mitigate the risk that the customer could abuse these products and services for financial crime purposes. In relation to the right of access to a payment account with basic features in accordance with Articles 16(2) and 17 of Directive 2014/92/EU, credit institutions obliged to offer such basic accounts should set out in their account opening policies and procedures how they can adjust their customer due diligence requirements to account for this fact.’ The paragraph makes clear that basic accounts’ limited functionalities mitigate the risk that the customer could abuse these accounts for financial crime purposes. The paragraph furthermore specifies that CDD measures should therefore be adjusted in accordance with the risks identified. None Paragraph 16 Several respondents said that non-face-to-face interactions may represent additional risks and that financial institutions may want to apply a riskbased approach to take measures commensurate with the risks associated with their customers. Risks associated with non-face-to-face interactions are addressed in the EBA’s Guidelines on remote onboarding (EBA/GL/2022/15). The issue addressed in paragraph 16 is about digital onboarding solutions that may produce automated rejections of customers on the basis, for instance, of the customer’s nationality. This would be contrary to the None

right of non-discriminatory access to a basic payment account under Article 15 of Directive 2014/92/EU.
Section: Adjusting level of monitoring
Guideline Summary of responses received EBA analysis Amendments to the proposal Paragraph 18 Several respondents commented that this paragraph would benefit from conveying more clearly that there is an expectation of lower monitoring in low-risk cases. A suggestion was to add, at the end of paragraph 18, the following sentence: ‘The measures referred to in points a) to c) should be used in a way and with a frequency that is proportionate so as not to constitute an unduly onerous obligation on customers constituting a low risk. Credit and financial institutions should ensure that ongoing monitoring is less intensive for customers identified as lower risk where they continue to carry out their activities within the profile established under point a).’ The paragraph starts by reminding credit and financial institutions that they should set out in their policies and procedures how to adjust the level and intensity of monitoring in a way that is commensurate with the ML/TF risk associated with the customer, as set out in the EBA’s Guidelines on risk factors. To ensure further clarity, the paragraph is amended as follows:
18. Credit and financial institutions should set out in their
policies and procedures how they adjust the level and intensity of monitoring in a way that is commensurate with the ML/TF risk associated with the customer and in line with the customer’s risk profile, as set out in the EBA’s Guidelines on risk factors and in particular guidelines 4.69 to 4.75 Amendment of paragraph 18 Another respondent commented that the term ‘destination of transactions’ was unclear as this could be interpreted as the purpose of the relationship or as the geographical destination of the transaction. The term refers to enhanced due diligence (EDD) measures set out in Article 18(1), which requires credit and financial institutions to apply EDD measures in cases of links with high-risk third countries or high-risk jurisdictions. The term is the one used in the EBA’s Guidelines on ML/TF risk factors, which contain further details on this point. None One respondent noted that the EBA should recognise that in industry practice, the expectations of the customer’s behaviour are often based on inThe guidelines specify that institutions should set expectations of the customer’s behaviour, so as to enable the institution to spot unusual transactions. This is in line with related provisions in the EBA’s Guidelines on ML/TF risk factors. None

formation provided by the customer and expected transactional activity across groups of customers with common characteristics. Several respondents noted that the requirement to regularly review the customer’s account does not reflect current industry practice. The EBA’s Guidelines on ML/TF risk factors are clear that credit and financial institutions should put in place systems and controls to keep their assessments of the ML/TF risk associated with their business and with their individual business relationships under review to ensure that their assessment of ML/TF risk remains up to date and relevant (see guideline 1.6.). This concerns all customers. Guideline 1.9. is equally clear that the systems and controls that institutions should put in place to identify emerging risks should include processes to ensure that internal information, such as information obtained as part of a firm’s ongoing monitoring of business relationships, is reviewed regularly to identify trends and emerging issues in relation to both individual business relationships and the firm’s business. Guideline 1.10 specifies that firms should determine the frequency of wholesale reviews of their business-wide and individual risk assessment methodology on a risk-sensitive basis. These provisions of the EBA’s Guidelines on ML/TF risk factors are therefore consistent with the content of paragraph 18.b. None A respondent asked whether, for refugees and vulnerable customers who are unable to provide traditional documents, a rental agreement or a utility bill would be sufficient to prove residence. Several respondents suggested providing an exhaustive list of the alternatives that could be used for identification purposes. Respondents also asked for clarification on what is a sufficiently reliable document for identification and verification. Paragraph 19 accounts for the fact that national laws differ across Member States and as a result specifies ‘where permitted by national law’ where relevant. For the same reason, the EBA cannot provide an exhaustive list of documents that would be acceptable, since national laws may differ on this aspect. Therefore the possible alternatives presented in this paragraph are for illustrative purposes. None

Paragraph 19
A respondent suggested amending paragraph 19b as follows: ‘This documentation may include expired identity documents and, where permitted under national law, documentation provided by an official authority, such as social services or a well-established not-for-profit organisation working on behalf of official authorities (Red Cross or established service providers in the homelessness sector) which also provides assistance to this customer. Another respondent was of the view that the term ‘working on behalf of official authorities’ was unduly restrictive and misaligned with local law in several Member States. Therefore the respondent suggested amending this paragraph as follows: ‘…This documentation may include expired identity documents and, where permitted under national law, documentation provided by an official authority, such as social services or a well-established not-for-profit organisation working on behalf of official authorities (e.g. Red Cross or similar) which also provides assistance to this customer.’ The EBA notes that the word ‘or similar’ in the paragraph accounts for the fact that other organisations may be considered. The EBA is also of the view that the term ‘working on behalf of official authorities’ accounts for the fact that documents provided in this context could be considered as reliable enough. None A respondent stressed that many institutions have implemented automated transaction monitoring systems to help them carry out ongoing monitoring of customer accounts. Underlying rules may be calibrated in a way that may impact disadvantaged customer segments and consequently limit their financial inclusion. It is important, therefore, that a system’s rules and the underlying data are regularly reviewed to ensure Paragraph 10 of the guidelines already specifies that credit and financial institutions’ policies, procedures and controls should not result in the blanket refusal or termination of business relationships with entire categories of customers that they have assessed as presenting a higher ML/TF risk. None

that they are free from bias and do not disproportionately impact any groups of disadvantaged customers.
Another respondent recommended that in paragraph 19.d., further clarity should provided on how long the initial customer due diligence can reasonably be postponed. With respect to the length of the postponement of the initial CDD, the appropriate date to perform full CDD after the establishment of the relationship would be decided on a case-by-case basis and on a risk-sensitive basis, and therefore the EBA cannot prescribe in this context a ‘one-sizefits-all’ approach. The EBA’s Guidelines on ML/TF risk factors (EBA/GL/2021/02) contain further details on this point. None
Section: Targeted restrictions of products/services
Guideline Summary of responses received EBA analysis Amendments to the proposal Paragraph 20 A respondent is of the view that this paragraph should make clearer that the refusal or termination of the business relationship and the options chosen by credit and financial institutions should be proportional and in line with the principle of non-discrimination. Regarding the first comment, paragraphs 11-12 are already clear that a number of options need to be considered before making a decision to reject a customer. None Several respondents said that the proposal to impose targeted restrictions, such as the amount or the number of person-to-person transfers or the amount of transactions to and from third countries is in contradiction with the PAD. With respect to the point related to the PAD, paragraph 20 clearly distinguishes between restrictions that can be applied by credit institutions covered by the PAD (in paragraph 20.a.) and restrictions that can be applied by institutions not covered by PAD-related obligations (in 20.b.). None A respondent stressed that while the restrictions identified by the EBA may be appropriate ways of managing risks, it is also important that the restrictions do not, in and of themselves, hinder financial inclusion, for example by reducing the Paragraph 21 addresses the point made by the respondent by requiring that credit and financial institutions ‘should ensure that their controls and procedures specify that possible limitations of products and service set out in paragraph 20 None

utility of a service or product to the extent that it does not provide any benefits to the consumer.
(b) are applied taking into consideration the personal situation of the individuals, the ML/TF risks associated therewith and their financial basic needs’. Paragraph 21 A respondent pointed to the costs associated with the implementation of new products and services. They recommended the following amendment: ‘In those cases, procedures should, where possible (technically and without incurring large costs), include the assessment of the following options to potentially mitigate the associated risks:’ As explained in the cost/benefit analysis of these guidelines, the objective of financial inclusion of vulnerable customers outweighs the costs caused by the handling of such customers. None In relation to paragraph 21c, a respondent was of the view that the intention of the ‘person-to-person’ restriction was unclear. The respondent stressed that if the intention is to restrict transactions to other private individuals, execution is highly dependent on the technical capability to establish whether the counterparty account holder is a private individual or legal entity. The EBA agrees that the term ‘person-to-person’ is insufficiently clear and has amended the paragraph accordingly. Therefore, the paragraph is amended as follows:
21. c. limits on the amount, the type and/or number of person-to-person of transfers (further or larger transfers are
possible on a case-by-case basis);
Amendment of paragraph 21.c.
Another respondent also said that the risk mitigating measures should include accounts that only allow deposits by a specific counterparty, i.e., the social service agency that disburses aid to refugees. The EBA agrees to add a reference to deposits made by a specific counterparty as a possible targeted measure, as follows:
21.f. limits third party payments to those made by identified third parties (e.g. the authority that disburses support for such customers) Amendment of paragraph 21.f. Another respondent recommended that paragraph 21e should be further clarified, as it was unclear when a party qualifies as ‘unidentified’ and when a deposit or transfer qualifies as ‘unexpected’. The EBA has amended the paragraph and aligned the wording with the EBA Guidelines on ML/TF risk factors:
21.g. limits on payments received from third parties that the institution has not verified Amendment of paragraph 21.g.

Another respondent was of the view that the provisions offered in the paragraph could potentially be abused, and therefore recommended specifying that the provisions of this paragraph apply to customers who are particularly vulnerable, such as refugees and homeless individuals, who may have credible and legitimate reasons for being unable to provide traditional forms of identity documentation. The EBA is of the view that since this paragraph aims at providing guidance on how limits on access to products and services can be introduced as risk-mitigating measures, there is limited potential for abuse by vulnerable customers. None
Section: Complaints Mechanism
Guideline Summary of responses received EBA analysis Amendments to the proposal Paragraph 22 Several respondents pointed to the fact that the inclusion of this obligation would mean an additional workload for entities subject to it. Several respondents stressed that it was important to ensure that complaint mechanisms are accessible to all. Not all marginalised groups have access to a phone or email, so having the competent authority’s or designated alternative dispute resolution body’s contact details physically would be key. This would ensure that complaints successfully reach the intended point of contact. Also, due to lack of access to technology for some marginalised groups, it would be beneficial for them to have the option to mail the EBA to submit complaints to national bodies rather than solely use a weblink. Several respondents said that it was also key to ensure institutions provide written evidence of why an individual person is rejected. One respondent in particular recommended that the EBA should consider whether there is more that With respect to the first comment, the EBA recalls that the PAD includes a requirement for credit institutions to immediately inform the consumer of the refusal and of the specific reason for that refusal unless such disclosure would be contrary to objectives of national security, public policy or the provisions of the AMLD. The AMLD specifies in article 39 that entitiessubject to it must not disclose to a customer the fact that information is being, will be or has been transmitted to the FIU or that a money laundering or terrorist financing analysis is being or may be carried out. This prohibition however does not include disclosure to the competent authorities. The PAD also specifies that in the event of refusal, the credit institution must advise the consumer of the procedure to submit a complaint against the refusal, and of the consumer’s right to contact the relevant competent authority and designated alternative dispute resolution body, and it must provide the relevant contact details. Therefore, the EBA is of the view that the information on the complaint mechanism envisaged in paragraph 22, combined with the requirement of documenting the decision to None

can be said here about communication to clients.
The aim would be to provide customers with a way to understand why their access to a financial service has been refused, particularly if there are steps they may be able to take to address the issue, without ‘tipping them off’ about any specific ML/TF concerns. reject a customer and making this documentation available to competent authorities proposed in paragraph 14 provides the right balance between the requirements of the PAD and the AMLD. The Joint Guidelines on complaints handling for the securities and banking sectors also provide useful information on this aspect (JC 2018 35). The objective of these guidelines is to provide EU consumers with a single set of complaints handling arrangements, irrespective of the type of product or service and of the geographical location of the firm in question. This will also allow institutions to streamline and standardise their complaints handling arrangements and allow national regulators to supervise the same requirements across all sectors of financial services.