BQK
BANKA QENDRORE E REPUBLIKËS SË KOSOVËS
CENTRALNA BANKA REPUBLIKE KOSOVO
CENTRAL BANK OF THE REPUBLIC OF KOSOVO

Pursuant to Article 35, paragraph 1, subparagraph 1.1, and Article 65, paragraphs 1 and 2, of Law No.
03/L-209 on the Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No. 77/16 August 2010, Prishtina), as amended and supplemented by Law No. 05/L-150 (Official Gazette of the Republic of Kosovo, No. 10/03 April 2017), Article 8, paragraph 1, of Law No. 08/L- 304 on Banks (Official Gazette of the Republic of Kosovo, No. 2, 27 January 2026), Article 114 of Law No. 04/L-093 on Banks, Microfinance Institutions and Non-Bank Financial Institutions (Official Gazette of the Republic of Kosovo, No. 11/11 May 2012, Prishtina), Article 4, paragraph 3, of Law No. 05/L-045 on Insurance (Official Gazette of the Republic of Kosovo, No. 38/24 December 2015, Prishtina), Article 34 of Law No. 08/L-295 on Crypto-Assets (Official Gazette of the Republic of Kosovo, No. 21, 22 November 2024), and Article 66, paragraph 2, of Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing (Official Gazette of the Republic of Kosovo, No. 18/15 June 2016, Prishtina), as amended and supplemented by Law No. 11/L-017, the Board of the Central Bank of the Republic of Kosovo, at its meeting held on 27 October 2026, adopted the following:

REGULATION ON THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING

CHAPTER I GENERAL PROVISIONS

Article 1 Purpose

The purpose of this Regulation is to establish the criteria and procedures necessary for managing the process of preventing money laundering and terrorist financing in compliance with the applicable AML/CFT legislation.

Article 2 Scope

This Regulation applies to all banks, branches of foreign banks, microfinance institutions, non-bank financial institutions, payment service providers, insurers, crypto-asset service operators and currency exchange offices (hereinafter referred to as financial institutions).

Article 3 Definitions

1. All terms used in this Regulation shall have the same meaning as the terms defined in Article 2 of Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing

and Article 3 of Law No. 11/L-017 amending and supplementing Law No. 05/L-096 on AML/CFT, and/or the following definitions for the purposes of this Regulation:

1.1. Senior Manager – means a person as defined in the Law on Banks, Microfinance Institutions and Non-Bank Financial Institutions (hereinafter the Law on Banks).

1.2. Financial services – means financial activities as defined in the Law on Banks and the Law on Insurance, and as described in the definition of “financial institution” in the Law on AML/CFT.

1.3. FIU-K – the Financial Intelligence Unit of the Republic of Kosovo.

1.4. Shell bank – means a bank or financial institution, or an institution engaged in activities equivalent to those of banks and financial institutions, established in a country in which it has no physical presence enabling its management and direction, and which is not affiliated with a regulated financial group.

1.5. Payable-through account – means correspondent accounts to which the respondent bank allows direct access by customers of the correspondent bank.

1.6. Resident – means a natural person whose principal place of residence is in Kosovo or who is physically present in Kosovo for more than one hundred and eighty-three (183) days in any twelve (12)-month period.

1.7. Law on AML/CFT – means Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing, as amended and supplemented by Law No. 11/L-017.

1.8. Transfer of funds – has the meaning defined in Article 2, paragraph 1.44, of the Law on AML/CFT.

1.9. Transfer of crypto-assets – has the meaning defined in Article 2, paragraph 1.66, of the Law on AML/CFT.

CHAPTER II AML/CFT REQUIREMENTS AND COMPLIANCE

Article 4 Responsibilities of financial institutions

1. For the purposes of preventing money laundering and combating terrorist financing (hereinafter AML/CFT), the Board of Directors of financial institutions shall, within the AML/CFT programme:

1.1. approve effective AML/CFT policies;

1.2. ensure that AML/CFT policies and procedures are fully implemented in practice;

1.3. appoint and dismiss the Head of the AML/CFT Function, who shall assume the responsibilities of the “compliance officer” under Article 21 of the Law on AML/CFT. In the case of branches of foreign financial institutions, the Head of the AML/CFT Function shall be appointed or dismissed by the board of directors of the financial institution operating

through a branch in Kosovo, in consultation with the senior management of the branch in Kosovo;

1.4. ensure that the internal AML/CFT Function is equipped with technical resources and personnel who have a thorough knowledge of AML/CFT policies and procedures, high ethical standards and relevant expertise;

1.5. approve a policy for establishing and maintaining business relationships, particularly those involving higher risk, including politically exposed persons, and, for this purpose, develop effective risk-sensitive procedures for accepting and exiting customers, products and services;

1.6. establish policies on money laundering and terrorist financing risk, including risk acceptance and management;

1.7. approve the customer acceptance policy within the institution’s risk management framework;

1.8. take decisions on matters referred to them within their area of operational responsibility in accordance with the provisions of this Regulation;

1.9. receive and discuss internal audit reports on the implementation of AML/CFT policies and procedures;

1.10. approve such other measures as may be required from time to time by the relevant institutions.

2. The management of financial institutions shall be responsible for:

2.1. approving procedures for implementing AML/CFT policies;

2.2. ensuring compliance with procedures for preventing money laundering and terrorist financing in the areas of the institution for which they are responsible;

2.3. ensuring the effective day-to-day implementation of all AML/CFT policies and procedures;

2.4. providing the Head of the AML/CFT Function, in a timely manner, with the appropriate assistance and information necessary to discharge AML/CFT duties and responsibilities.

3. All employees of the financial institution shall be trained and informed so as to:

3.1. remain alert to the possibility that the institution’s services and products may be used for money laundering or terrorist financing;

3.2. know how to report to the Head of the AML/CFT Function all transactions, acts or persons suspected of money laundering or terrorist financing, and transactions at the threshold specified in Article 26 of the Law on AML/CFT. In the absence of the Head of the AML/CFT Function, reports shall be made to their deputy, as provided in Article 21 of the Law on AML/CFT;

3.3. effectively implement procedures for preventing money laundering and combating terrorist financing as prescribed by the applicable AML/CFT legislation, this Regulation and their institution’s internal policies and procedures, particularly those concerning customer due diligence, ongoing transaction monitoring and record retention; and

3.4. actively participate in training and awareness sessions provided by the financial institution.

4. For financial institutions which, by virtue of their organisational structure, do not have a Board of Directors, the obligations under this Regulation shall be fulfilled by Management.

Article 5 AML/CFT programme

1. Financial institutions shall develop and maintain an AML/CFT programme based on a risk-based approach.

2. The primary purpose of the AML/CFT programme is to identify, mitigate and manage the risk that the provision of a particular service by a financial institution may, intentionally or unintentionally, involve or facilitate money laundering or terrorist financing.

3. The AML/CFT programme shall provide for customer identification and customer due diligence procedures for the financial institution’s customers.

4. The four pillars, or core elements, to be addressed in an AML/CFT programme are:

4.1. internal AML/CFT policies, procedures and controls (first line of defence);

4.2. the AML/CFT compliance function and the head of the function (second line of defence);

4.3. an ongoing employee training programme; and

4.4. an independent ongoing audit function to test the overall effectiveness of the AML/CFT programme (third line of defence).

Article 6 Internal AML/CFT Function

1. Financial institutions shall appoint a qualified individual with relevant experience as Head of Compliance, who shall act as the person responsible for compliance in accordance with Article 21 of the Law on AML/CFT and paragraphs 2 and 3 of this Article. This shall be considered the minimum criterion for compliance with this Regulation. Financial institutions may elevate the AML/CFT compliance Function to a higher level within their organisational structure, provided that the Function retains its independence.

2. Banks shall establish an internal AML/CFT Function which shall be independent of all other functions within the bank and shall be headed by a senior manager who shall report directly to the Chief Executive Officer and periodically to the Board of Directors, in accordance with the conditions and procedures established by this Regulation.

3. In performing their duties, the Head of the internal AML/CFT Function shall have:

3.1. full and unrestricted access to all data, records, documentation and information of the bank or financial institution;

3.2. the necessary human resources, based on the size of the financial institution;

3.3. the necessary materials, IT equipment and appropriate working space required and suitable for fulfilling the obligations arising from the applicable AML/CFT legislation and this Regulation;

3.4. technical arrangements ensuring an appropriate level of protection for confidential data accessible to the compliance officer;

3.5. ongoing professional training in AML/CFT;

3.6. protection against the disclosure of their data to unauthorised persons.

4. The following persons may not serve as Head of the internal AML/CFT Function:

4.1. a person who is not resident in Kosovo;

4.2. a person who is a member of the board of directors, an executive director or holds any other permanent position in the financial institution that may conflict with their role as head of the unit;

4.3. an employee of the financial institution engaged in internal audit;

4.4. an employee of the financial institution responsible for controlling activities and operational monitoring.

5. The AML/CFT Compliance Function in currency exchange offices may be performed by the Director of the Exchange Office, unless the latter designates another person to perform this function.

6. For banks, the Head of the internal AML/CFT Function shall be considered a senior manager in accordance with the Law on Banks.

7. Financial institutions shall notify FIU-K and the CBK of the appointment of the Head of the internal AML/CFT Function within the statutory deadlines specified in paragraph 8 of Article 21 of the Law on AML/CFT.

8. Upon the departure of the Head of the internal AML/CFT Function, financial institutions shall notify FIU-K and the CBK within the statutory deadlines specified in paragraph 9 of Article 21 of the Law on AML/CFT, also explaining the reasons for their dismissal.

9. The internal AML/CFT Function of financial institutions shall advise and assist the Board of Directors and Senior Management in implementing the applicable AML/CFT legislation. This Function shall coordinate or be responsible, inter alia, for:

9.1. preparing internal AML/CFT policies and procedures under Article 7 of this Regulation for approval by the Board of Directors and Management;

9.2. monitoring the implementation of internal AML/CFT policies and procedures;

9.3. cooperating with internal auditors, external auditors and management on AML/CFT matters;

9.4. planning and overseeing AML/CFT training and awareness-raising for the financial institution’s employees;

9.5. establishing criteria for business relationships, including high-risk relationships, as described in Article 4 of this Regulation;

9.6. conducting, at least annually, an assessment of all risks arising from existing and new customers, new products and services offered by the financial institution, in accordance with Article 10 of this Regulation;

9.7. assessing the effectiveness of internal procedures using statistical information collected domestically and information maintained by financial institutions, as may be specified by FIU-K or the CBK;

9.8. receiving internal suspicious activity reports and conducting an internal review of such reports to determine whether the suspicion is reasonable and, where it is, reporting to FIU-K as

prescribed by the applicable AML/CFT legal provisions;

9.9. reporting other information to FIU-K in compliance with the applicable AML/CFT legal provisions;

9.10. cooperation between the bank or financial institution and the relevant authorities under Article 26 of the Law on AML/CFT concerning suspicious acts or transaction reports submitted to FIU-K;

9.11. other duties assigned by the Board of Directors and/or Senior Management to help prevent the bank from being used for money laundering or terrorist financing purposes.

Article 7 Internal AML/CFT policies and procedures

1. Financial institutions shall adopt internal AML/CFT policies and procedures and communicate them to all relevant staff.

2. The internal policies and procedures referred to in paragraph 1 of this Article shall, at a minimum, establish:

2.1. a customer due diligence policy in accordance with the applicable AML/CFT legislation and this Regulation, including the procedure for identifying and accepting new customers within the financial institution’s acceptable risk management framework;

2.2. a procedure for collecting and retaining information and records in accordance with the applicable AML/CFT legislation and this Regulation;

2.3. a procedure for reporting to FIU-K under Article 26 of the Law on AML/CFT;

2.4. the criteria to be applied in identifying business relationships involving higher risk;

2.5. the procedure for identifying and dealing with politically exposed persons;

2.6. the procedure for assessing and monitoring the risks associated with customers, business relationships, products and transactions;

2.7. procedures for the financial institution to develop indicators of money laundering and the financing of terrorist activities, based on FATF recommendations, FIU-K guidance and CBK requirements;

2.8. the situations in which staff shall consult the internal AML/CFT Function and the cases in which the Board of Directors and/or Senior Management shall be informed of AML/CFT-related events;

2.9. procedures for staff screening, development and training for AML/CFT purposes.

3. Financial institutions shall develop internal policies and procedures to protect compliance personnel and other personnel involved in reporting suspicious transactions.

4. Financial institutions that are part of a group shall implement group-wide policies and procedures, including data protection policies and policies and procedures for sharing information within the group for AML/CFT purposes. These policies and procedures shall be effectively implemented at the level of branches and majority-owned subsidiaries.

5. Financial institutions operating in another country shall ensure compliance with that country’s national provisions transposing provisions equivalent to the home country’s AML/CFT legislation or the EU AML/CFT Directives.

6. Where financial institutions have branches or majority-owned subsidiaries located in countries whose minimum AML/CFT requirements are less stringent than those laid down in the home country’s AML/CFT legislation or the EU Directives, their branches and subsidiaries shall apply the requirements of the home country’s AML/CFT legislation or the EU Directives, including data protection requirements, to the extent permitted by the law of the third country. Where the law of that country does not permit implementation of the policies and procedures required under paragraph 4, financial institutions shall ensure that branches and majority-owned subsidiaries in that country apply additional measures to address effectively the risk of money laundering or terrorist financing, and shall inform the CBK and FIU-K. If these additional measures are insufficient, the CBK shall take additional supervisory action in respect of branches and majority-owned subsidiaries in that country, including requiring the group not to establish or to terminate business relationships and not to undertake transactions and, where necessary, requiring the group to close its operations in that country.

Article 8 Staff screening, development and training

1. Financial institutions shall make staff aware of their personal legal (statutory) obligations and inform them that they shall be personally liable if they fail to report information in accordance with internal policies and procedures.

2. Financial institutions shall implement general measures to ensure that their employees, particularly staff who have contact with customers or execute transactions and staff within the AML/CFT function, do not have a criminal record and are not subject to ongoing criminal prosecution for financial crimes, terrorism or any other serious crime that could call their trustworthiness into question.

3. Financial institutions shall regularly provide AML/CFT training, at least once a year, to all staff who have contact with customers or execute transactions.

4. Documents on the structure and content of training programmes, and the names and signatures of participants, shall be retained in the files of the bank or financial institution for at least five (5) years.

Article 9 Role of internal and external audit

1. The internal audit unit of financial institutions shall conduct an audit at least once a year to ensure that AML/CFT policies and procedures are fully implemented and comply with all requirements of the applicable AML/CFT legislation and this Regulation.

The Internal Audit Unit shall report annually to the Board of Directors and inform the management of financial institutions of its findings and assessments, including an appropriate assessment of staff training on AML/CFT matters.

2. The CBK may require financial institutions to engage their external auditors to assess and report on the quality of AML/CFT implementation measures, including compliance with legal and regulatory requirements, the implementation of policies and procedures, internal control systems and the conduct of internal audit.

Article 10 ML/TF risk assessment

1. To reach an objectively grounded decision on customer acceptance, particularly where customers may pose a high risk to the institution, financial institutions shall have a policy defining the level of risk to be managed on an ongoing basis. Financial institutions shall establish and maintain a “risk acceptance” strategy that supports their customer acceptance policies.

2. In accordance with Article 18 of the Law on AML/CFT, financial institutions shall prepare a risk analysis and develop a risk assessment of customers, business relationships, products or transactions in relation to their potential misuse for money laundering or terrorist financing. Financial institutions shall understand and acknowledge the risks and vulnerabilities that may expose the institution itself to potential misuse of its products and services.

3. The risk assessment shall take into account the following risk elements present in every business relationship:

3.1. Customer risk (risk arising from the type of customer);

3.2. Product, service and transaction risk (risk arising from the purpose of the product itself);

3.3. Country risk (risk arising from the geographical dimension of the economic activities of business relationships).

4. The elements specified in paragraph 3 of this Article shall be combined to establish a risk profile. The risk profile, or the procedure for establishing it, shall reflect the specific characteristics of the organisation and its activities (e.g. its size and composition, business scope and structure, the types of customers with whom it does business and the types of products it offers), as provided in Article 14 of this Regulation.

5. The AML/CFT risk analysis shall be carried out in two stages:

5.1. A risk assessment based on the financial institution’s products, services and geographical distribution in the areas in which it operates.

5.2. A risk assessment based on the financial institution’s customer relationships and the products and services used by its customers, as well as the geographical locations in which they reside, operate or conduct business, and other similar risk factors.

6. The risk assessment under subparagraph 5.1 of this Article requires a sound knowledge of the institution’s business operations and the exercise of sound judgement so that money laundering and terrorist financing risk can be weighed (assessed) by individual factor and by a combination of factors. Although the tools developed for risk analysis are intended to ensure objectivity, an element of subjectivity remains in determining a risk factor; therefore, the better informed the decision-making process, the more realistic the judgement of the factor’s level of risk. The risk assessment element is not static and shall change over time, as do the way financial institutions operate and developments in the products and services they offer.

7. The risk assessment under subparagraph 5.2 of this Article means a risk-based assessment of relationships following a methodology that ultimately identifies the level of risk arising from a particular customer, thereby enabling financial institutions to determine whether accepting that new customer could pose a potentially detrimental risk.

8. Financial institutions shall identify and assess money laundering or terrorist financing risks that may arise in relation to:

8.1. the development of new products and new business practices, including new delivery mechanisms; and

8.2. the use of new or developing technologies for both new and pre-existing products.

9. Such a risk assessment shall be undertaken before new products or business practices are introduced, or new or developing technologies are used. Financial institutions shall take appropriate measures to manage and mitigate these risks.

CHAPTER III CUSTOMER DUE DILIGENCE

Article 11 Application of customer due diligence measures

1. The AML/CFT programme shall establish the applicable customer identification and customer due diligence procedures for financial institutions’ customers. Financial institutions shall conduct due diligence in respect of:

1.1. Customers;

1.2. Any beneficial owner of the customer;

1.3. Any person acting on behalf of a customer.

2. For the purposes of this Regulation, pursuant to Article 19 of the Law on AML/CFT and in accordance with international standards, customer due diligence shall include, but not be limited to:

2.1. Identifying and verifying the customer’s identity on the basis of valid documents issued by competent authorities;

2.2. Determining the beneficial owner and taking appropriate risk-based measures to verify their identity;

2.3. Obtaining information on the purpose and nature of business relationships and establishing a customer profile based on the information collected;

2.4. Conducting due diligence and ongoing monitoring of business relationships and customer transactions in accordance with the customer’s profile;

2.5. Implementing the prescribed policies and practices for transfers of funds or wire transfers and

correspondent banks; and

2.6. Recording and retaining data.

3. Taking the level of risk into account, financial institutions shall conduct customer due diligence or enhanced customer due diligence.

4. Financial institutions shall conduct customer due diligence in accordance with the prescribed terms and conditions in the following circumstances, without limitation:

4.1. when establishing a business relationship with a new customer;

4.2. where there has been a material change in the nature or purpose of the business relationship with an existing customer and the information available on that customer is considered insufficient;

4.3. where there are doubts about the authenticity and accuracy of previously obtained information on the customer or beneficial owner;

4.4. when carrying out an occasional cash transaction amounting to EUR 10,000 or more, or the equivalent in foreign currency, whether the transaction is carried out in a single operation or in several operations (transactions) that appear to be linked and are carried out on a single day;

4.5. when carrying out an occasional transaction constituting a transfer of funds exceeding EUR 1,000;

4.6. when carrying out an occasional transaction constituting a transfer of crypto-assets exceeding EUR 1,000;

4.7. whenever there is a suspicion of money laundering or terrorist financing.

5. Financial institutions shall not maintain anonymous accounts, accounts in fictitious names, anonymous savings passbooks or anonymous safe-deposit boxes.

6. Financial institutions shall not accept payments made using anonymous prepaid cards.

Article 12 Identification, verification and acceptance of new customers

1. Financial institutions shall ensure that they know the customer’s true identity and have a thorough understanding of the customer’s business before establishing a business relationship, pursuant to the obligations under Article 19 of the Law on AML/CFT. In addition, before establishing a business relationship with a customer, financial institutions shall consult the updated international list of persons wanted for terrorist financing as part of a relationship-based assessment or riskbased customer assessment in accordance with Article 10 of this Regulation.

2. Financial institutions shall take additional steps to ensure proper customer identification where doubts arise about the authenticity and accuracy of identification data previously obtained, or where there is a suspicion that the customer is, or may be, involved in money laundering or terrorist financing.

3. Financial institutions shall verify identification data using an independent source, as specified in Article 19 of the Law on AML/CFT. The verification process is separate from, but complementary to, the identification process. In addition to the requirements of Article 19 of the Law on AML/CFT, financial institutions may request and obtain any additional identification documentation for verification purposes that they consider reasonable and appropriate to the circumstances of each case, so that the due diligence process is satisfactorily completed.

4. In addition to the requirements of Article 19 of the Law on AML/CFT for verifying the identity of customers who are natural persons, financial institutions shall use reliable, independent-source documents, data or information, such as an identity card, passport, driving licence or birth certificate bearing a photograph. Identification of natural persons and verification of their identity shall include their full name, address, date and place of birth.

5. In addition to the requirements laid down in Article 19 of the Law on AML/CFT, when obtaining and verifying identification information on legal persons, financial institutions shall use documents evidencing:

5.1 the customer’s name and legal form, including proof of establishment or similar evidence of establishment or existence (such as a certificate of incorporation or a certificate of establishment of a trust);

5.2 the names and addresses of the members of the customer’s controlling body, such as company directors, trustees, limited liability companies, general partnerships and senior executives such as the chief executive officer;

5.3 documents establishing the customer’s status (such as the memorandum and articles of association or the certificate of establishment of a trust);

5.4 documents authorising persons to act on behalf of the customer (such as a resolution of the Board of Directors or a trustee’s declaration opening an account and granting authority to those who may operate it);

5.5 the identity of the natural person purporting to act on behalf of the customer.

6. Where the customer is represented by a third party under an instrument of representation, the financial institution shall request identification data for the customer and their representative, and retain in the customer’s file all documents submitted by the third party, including the original or a copy of the notarised authorisation.

7. Where the customer is not “physically present”, appropriate measures shall be taken as specified in Article 22a of the Law on AML/CFT.

8. Where, under the conditions of paragraph 7 of this Article of this Regulation, financial institutions establish a relationship or undertake a transaction without the customer’s physical presence, they shall apply enhanced due diligence measures as required by Article 22a of the Law on AML/CFT to mitigate the high risk.

9. Financial institutions shall not establish a business relationship, open an account or undertake transactions on behalf of a prospective customer until the full identification and verification process has been adequately completed. Where a bank or financial institution is unable to comply with points 2.1, 2.2 and 2.3 of Article 11 of this Regulation in accordance with Chapter III of the Law on AML/CFT, the financial institution shall refuse the transaction or business relationship and consider submitting a suspicious transaction report to FIU-K in accordance with the established reporting procedures.

10. Financial institutions shall develop clear customer acceptance policies and procedures within their risk management framework and as an integral part of their risk-based approach. Such customer acceptance policies and procedures shall include a description of the types of customers that may pose a higher-than-average risk to a financial institution, so that enhanced due diligence measures can be applied to higher-risk customers. Factors such as the customer’s background, country of origin, public or high-profile position, linked accounts, business activities and other risk indicators shall be taken into account.

11. Customers who meet the criteria laid down in the applicable AML/CFT legislation and this Regulation may open an account or conduct business with the financial institution. A natural or legal person who does not meet the criteria established in the customer acceptance policy and procedures shall not be permitted to open an account or undertake any transaction.

Article 13 Determination of holders of ownership rights (beneficial owners)

1. The applicable AML/CFT legislation defines a beneficial owner as “the natural person who ultimately owns or controls a customer or an account, a person on whose behalf a transaction is being conducted, or a person who ultimately exercises effective control over a legal person or arrangement”. Article 19, paragraph (1), point (1.2), of the Law on AML/CFT provides that “all reporting entities shall identify the beneficial owner and/or the natural person or persons who directly or indirectly control 25% or more of a legal person”.

2. Financial institutions shall take measures to determine whether a customer is acting on behalf of one or more beneficial owners, in accordance with the applicable AML/CFT legislation. To identify and verify the identity of the customer and the beneficial owner(s), financial institutions shall act in accordance with Article 19 of the Law on AML/CFT and Article 12 of this Regulation. Financial institutions shall verify identification data and information using independent-source documentation, as specified in Article 19 of the Law on AML/CFT.

3. Financial institutions shall ensure that a person acting on behalf of another person is authorised to do so and shall retain a copy of the document evidencing that authorisation.

4. For customers that are entities (legal persons), as defined in the Law on AML/CFT, financial institutions shall take substantial measures to establish the entity’s ownership and control structure. Financial institutions shall identify the legal person’s “decision-makers and management” and, ultimately, the beneficial owners (natural persons) who directly or indirectly control 25% or more of the legal person. In identifying the beneficial owner(s), financial institutions shall determine through their customer risk assessment procedures whether such beneficial owner(s) have politically exposed person status under the applicable AML/CFT legislation. In such cases, other financial institutions shall apply the enhanced measures for politically exposed persons prescribed by the applicable AML/CFT legislation and this Regulation.

5. For the purposes of this Regulation, “a person shall be considered to exercise direct or indirect control over a legal person in any of the following situations”:

5.1 by holding 25% or more of the legal person’s share capital registered in that person’s name;

5.2 by holding 25% or more of the voting rights in the legal person, irrespective of share ownership;

5.3 where, acting in concert with other persons, that person exercises control through a holding of 25% or more of the share capital or voting rights;

5.4 by holding 25% or more of the legal person’s share capital registered in the name of another legal person ultimately owned by that person;

5.5 through a holding of 25% or more of the voting rights in a legal person by another legal person ultimately owned by that person.

6. For entities that are non-profit organisations/NGOs, financial institutions shall ensure that they identify the control structure and understand the organisation’s legitimate purpose by examining its statute, founding document or trust deed.

7. For other legal arrangements, such as trusts, in addition to identifying the trustee, executor and/or director, financial institutions shall identify the beneficiaries of 25% or more of the trust’s assets where the beneficiaries have been determined or, where they have not been determined, the class of persons in whose interest the legal arrangement is established or operates. For other types of legal arrangements, financial institutions shall identify persons holding equivalent or similar positions.

Article 14 Establishing the customer profile

1. Financial institutions shall collect information on an ongoing basis concerning the intended purpose and nature of the business relationship. Documents, data or information collected through the customer due diligence process shall be kept up to date through periodic reviews of existing records, including transaction records.

2. Financial institutions shall establish and maintain a customer profile for each customer, with sufficient detail to enable the bank or financial institution to monitor the customer’s transactions, conduct customer due diligence where necessary and detect suspicious transactions/acts as required by the applicable AML/CFT legal provisions and this Regulation. The data and information included in the profile shall be commensurate with the level of risk expected to be posed by the customer.

3. The customer profile shall include relevant information on normal and reasonable activities for different types of customers, taking into account the nature of the customer’s business, as well as a thorough understanding of the customer’s transactions (including, where necessary, the source and legitimacy of funds) and the overall relationship with the bank or financial institution.

Article 15 Monitoring business relationships and transactions

1. Financial institutions shall conduct ongoing due diligence on business relationships and scrutinise transactions undertaken throughout the relationship to ensure that the transactions are consistent with the financial institution’s knowledge of the customer and their business and risk profile. They shall also review or update existing records to ensure that customer data remain up to date and relevant. For this purpose, in addition to the requirements of Article 19 of the Law on AML/CFT, information confirming the source of funds shall be requested where financial institutions consider it necessary. Financial institutions shall have systems to detect large or complex transactions carried out (completed) outside the expectations (knowledge) for that type of customer.

2. Financial institutions shall ensure that the scope and frequency of the measures under paragraph 1 of this Article are consistent with due diligence and risk assessment, and are adapted to the money laundering and terrorist financing risk to which the financial institution is exposed when conducting a particular business activity or transaction, or within the business relationship with the customer.

3. Financial institutions shall conduct frequent (intensified) monitoring of high-risk customers. Each financial institution shall establish key indicators for such accounts, taking into account the customer’s background, country of origin and sources of funds, the types of transactions involved and other risk factors as specified in the applicable AML/CFT legislation and this Regulation.

4. The ongoing process for monitoring accounts, transactions, customer identification and customer profile information shall be structured as set out in the table below.

Risk category	Minimum monitoring frequency
3. High	Transactions: Daily Account: Monthly Customer information: Annually
2. Medium	Transactions: Weekly Account: Every six months Customer information: Every three years
1. Low	Transactions: Monthly Account: Annually Customer information: Every five years

5. The monitoring intervals specified in the table in paragraph 4 of this Article shall not apply where there is a suspicion of money laundering or terrorist financing, or where the bank or financial institution identifies significant changes in transactions based on the customer’s risk profile.

6. Where a financial institution, in accordance with the Guidelines on ML/TF Risk Factors, considers the ML/TF risk to be low, it may apply simplified data review measures for vulnerable groups of customers. Before applying these measures, the financial institution shall document its low-risk assessment based on detailed analysis.

Article 16 Transfers of funds and crypto-assets

For domestic or international transfers of funds and crypto-assets, financial institutions shall apply the measures laid down in the applicable AML/CFT legislation, this Regulation and the Regulation on Information Accompanying Transfers of Funds and Crypto-Assets.

Article 17 Application of enhanced customer due diligence measures

1. When applying enhanced due diligence, financial institutions shall ensure that they do not discriminate on the grounds of race, colour, religion or national origin.

2. In addition to standard measures, and in accordance with the terms and conditions laid down in this Regulation, financial institutions shall apply enhanced due diligence to manage and mitigate risks appropriately in the situations specified in Articles 18 to 21 of this Regulation and in the following circumstances, without limitation:

2.1 when establishing a business relationship with a customer that is a trust or another vehicle (fund) for holding personal assets, and with a non-resident customer;

2.2 at any stage of customer due diligence, business relationships or transactions where financial institutions have assessed these categories as posing a higher risk of money laundering and terrorist financing in accordance with Article 10 of this Regulation. In this process, financial institutions shall make efforts to examine the customer’s source of wealth and source of funds;

2.3 in business relationships and transactions with natural and legal persons, including financial institutions, from countries presenting higher risks of money laundering and terrorist financing. For this purpose, financial institutions shall take into account public statements and lists issued by the Financial Action Task Force (FATF) concerning high-risk and noncooperative jurisdictions.

3. Financial institutions shall examine, as far as reasonably possible, the background and purpose of all transactions that meet at least one of the following conditions:

3.1 they are complex transactions;

3.2 they are unusually large transactions;

3.3 they are unusual transactions;

3.4 they have no apparent economic or lawful purpose.

4. Enhanced customer due diligence measures shall not automatically apply in relation to branches or majority-owned branches of financial institutions headquartered in Kosovo that operate in high-risk third countries, where the operations of those branches or majority-owned subsidiaries fully comply with the policies and procedures of the group to which they belong, in accordance with the financial institution’s risk assessment.

5. Financial institutions shall apply enhanced measures in monitoring accounts, transactions and business relationships to determine whether those transactions or activities appear suspicious.

6. Financial institutions shall apply enhanced measures in monitoring accounts, transactions and business relationships and increase the risk rating where a report has been submitted to FIU-K as a result of a suspicion of money laundering or terrorist financing.

7. The enhanced customer due diligence measures to be applied by financial institutions shall include, but not be limited to:

7.1 additional identification information and documents to verify the identity of the customer and beneficial owner, as necessary;

7.2 approval by a senior manager of the reporting entity to establish or continue a business relationship with a higher-risk customer;

7.3 additional information and clarification on the source of wealth and source of funds;

7.4 obtaining and assessing additional information on the intended nature of the business relationship; 7.5 a better understanding of the reasons for an intended or completed transaction by obtaining additional information;

7.6 increased monitoring and scrutiny of business relationships, transactions and accounts, including the source of funds;

7.7 increasing the frequency of updating available information on the identification of the customer, risk level and business profile;

7.8 increased periodic reporting to senior management.

8. For Non-Governmental Organisations established under the Law on Freedom of Association in Non-Governmental Organisations in Kosovo, reporting entities shall, for the purpose of identifying and verifying the beneficial owner, apply due diligence measures to identify the NGO’s governing structure, the chair of the assembly of members for associations (or the members of the intermediate body, where applicable), the members of the governing board for foundations and institutes, and the senior managing official for all three organisational forms of NGOs.

9. For entities that are non-governmental/non-profit organisations, financial institutions may, based on the risk assessment, apply the following enhanced customer due diligence measures, without limitation:

9.1 identification of the founders through official documents;

9.2 identification of the governing structure, board of directors and executive management;

9.3 information on the main donors of the non-profit organisation/NGO;

9.4 annual reports on financial activities and completed and planned projects.

Article 18 Business relationships and transactions with high-risk jurisdictions

1. For business relationships or transactions involving third countries with a high ML/TF risk, financial institutions shall apply the following enhanced customer due diligence measures:

1.1. obtaining additional information on the customer and the beneficial owner(s);

1.2. obtaining additional information on the intended nature of the business relationship;

1.3. obtaining information on the reasons for intended or completed transactions;

1.4. obtaining senior manager approval for establishing or continuing the business relationship;

1.5. conducting enhanced monitoring of the business relationship by increasing the number and timing of controls applied, and selecting transaction patterns that require further examination.

2. In addition to the measures provided for in paragraph 1 of this Article, where applicable, financial institutions shall apply one or more additional mitigating measures to persons and legal entities carrying out transactions involving high-risk third countries. These measures shall consist of one or more of the following:

2.1. applying additional elements of enhanced due diligence;

2.2. applying enhanced reporting mechanisms or systematic reporting of financial transactions;

2.3. limiting business relationships or transactions with natural or legal persons from third countries identified as high-risk countries.

3. When adopting or implementing the measures specified in paragraph 2, financial institutions shall take into account, as appropriate, relevant assessments or reports by international organisations and standard-setters with competence in preventing money laundering and combating terrorist financing, concerning the risks posed by individual third countries.

Article 19 Correspondent relationships

1. Article 22b of the Law on AML/CFT requires mandatory measures, in addition to standard measures, to enhance due diligence in correspondent banking relationships presenting a higher risk. Financial institutions shall develop and implement policies and procedures concerning correspondent relationships that address the higher risks in such relationships.

2. For the purposes of this Article, a correspondent relationship is defined as an arrangement for the provision of banking services by one bank (the correspondent) to another bank (the respondent), which may include lending, deposits, collection, clearing or payment services, as well as relationships between financial institutions where similar services are provided, including, but not limited to, relationships established for securities transactions or transfers of funds.

3. Banks in Kosovo shall act as “respondent banks” when they establish relationships to receive banking services from another bank (the correspondent bank), or as “correspondent banks” when they establish relationships to provide banking services to another bank (the respondent bank).

4. Financial institutions shall exercise prudence and due diligence in relation to the prospective correspondent bank’s controls against money laundering and terrorist financing, determine whether those controls are adequate and effective, and document each institution’s respective AML/CFT responsibilities. Financial institutions shall not enter into business relationships with shell banks. For correspondent banks from countries presenting a high risk of money laundering and terrorist financing, the bank shall ensure that it can apply enhanced measures to mitigate those risks, as required by Article 17 of this Regulation.

5. To assess the prospective respondent bank’s controls against money laundering and terrorist financing under the requirements of paragraph 3 of this Article, the bank shall collect sufficient information on the prospective respondent bank to understand its business and determine, from publicly available information, the institution’s reputation, the quality of its supervision and whether it has been subject to a money laundering or terrorist financing investigation or regulatory action. In general, a bank shall establish or continue a correspondent relationship with a foreign respondent bank only if it is satisfied that an authority is effectively supervising the respondent bank. In particular, a bank shall not establish or continue a correspondent banking relationship with a shell bank as defined in the Law on AML/CFT.

6. Particular care shall be exercised where respondent banks allow third parties to use the correspondent account directly to conduct business on their own behalf (payable-through accounts). The bank shall be satisfied that the respondent bank has conducted due diligence on those customers who have direct access to the respondent bank’s accounts and that the respondent bank can provide relevant customer identification information at the correspondent bank’s request.

7. Financial institutions shall develop and implement policies and procedures for ongoing monitoring of activities conducted through correspondent accounts. Financial institutions shall obtain senior management approval before establishing new correspondent relationships and shall apply the enhanced due diligence measures provided for in Article 22b of the Law on AML/CFT.

Article 20 Crypto-asset operators

1. Crypto-asset service operators shall identify and assess the money laundering and terrorist financing risk associated with transfers of crypto-assets to or from a self-hosted address. For this purpose, crypto-asset service operators shall implement internal policies, procedures and controls. Crypto-asset service operators shall apply mitigating measures commensurate with the risks identified. These mitigating measures shall include one or more of the following:

1.1. applying risk-based measures to identify and verify the identity of the originator or beneficiary of a transfer to or from a self-hosted address, or the beneficial owner of such originator or beneficiary, including through reliance on third parties;

1.2. requesting additional information on the origin and destination of the transferred crypto-assets;

1.3. conducting enhanced ongoing monitoring of these transactions;

1.4. any other measure to mitigate and manage the risks of money laundering and terrorist financing, as well as the risk of non-implementation and evasion of targeted financial sanctions and targeted financial sanctions relating to proliferation financing, as provided in Law No. 08/L-146 on the Implementation of Targeted International Financial Sanctions.

2. For correspondent relationships involving the execution of crypto-asset services with a relevant entity established abroad that provides similar services, including transfers of crypto-assets, crypto-asset service operators shall, in addition to the customer due diligence measures laid down in the applicable legislation, when entering into a business relationship with such an entity:

2.1. determine whether the respondent entity is licensed or registered;

2.2. collect sufficient information on the respondent entity to understand fully the nature of its business and determine, from publicly available information, the respondent’s reputation and the quality of supervision;

2.3. assess the respondent entity’s AML/CFT controls;

2.4. obtain senior manager approval before establishing new correspondent relationships;

2.5. document the respective responsibilities of each party to the correspondent relationship;

2.6. with regard to payable-through crypto-asset accounts, satisfy themselves that the respondent entity has verified the identity of customers with direct access to the correspondent entity’s accounts and has conducted ongoing customer due diligence, and that it can provide relevant customer due diligence data to the correspondent entity upon request.

3. Where crypto-asset service operators decide to terminate correspondent relationships for reasons relating to anti-money laundering and counter-terrorist financing policy, they shall document and record their decision.

4. Crypto-asset service operators shall update due diligence information on the correspondent relationship regularly or when new risks arise concerning the respondent entity.

5. Crypto-asset service operators shall take into account the information referred to in paragraph 1 to determine, on a risk-sensitive basis, the appropriate measures to mitigate the risks associated with the respondent entity.

Article 21 Politically exposed persons

1. Article 22c of the Law on AML/CFT and guidance issued by FIU-K require financial institutions to apply reasonable measures to determine whether their customers are domestic or foreign politically exposed persons. Financial institutions shall ensure that appropriate measures are applied in such situations, including where a beneficial owner is identified as having politically exposed person status.

2. For transactions or business relationships with politically exposed persons, financial institutions shall, in addition to customer due diligence measures:

2.1. have appropriate risk management systems, including risk-based procedures, to determine whether the customer or the customer’s beneficial owner is a politically exposed person;

2.2. apply the following measures in business relationships with politically exposed persons:

2.2.1. obtain senior manager approval for establishing or continuing business relationships with such persons;

2.2.2. take adequate measures to establish the source of wealth and source of funds involved in business relationships or transactions with such persons;

2.2.3. conduct enhanced ongoing monitoring of these business relationships.

3. Financial institutions shall apply enhanced due diligence measures to ongoing relationships with an existing customer or beneficial owner identified as a politically exposed person.

4. For the purposes of paragraph 2 of this Article, “source of wealth” refers to the assets held by the customer, which may have been accumulated over the years, while “source of funds” refers to the funds to be used for the initial and subsequent transactions undertaken by the customer in their capacity as a politically exposed person.

5. Financial institutions shall ensure that “immediate family members” and “persons known to be close associates” of domestic and foreign politically exposed persons are subject to the same enhanced due diligence measures.

6. Procedures and measures for determining who is a politically exposed person may include, but are not limited to:

6.1. requesting relevant information from the prospective customer, with reference to paragraph 4 of this Article;

6.2. searching official domestic and international lists;

6.3. referring to publicly available information; and

6.4. accessing available commercial electronic databases of politically exposed persons.

Article 22 Record-keeping and retention

1. Financial institutions shall retain all necessary records of both domestic and international transactions for at least five (5) years after completion of the transaction or completion of the last transaction in a series of linked transactions (or longer if required by FIU-K, the CBK or another competent authority in specific cases). This requirement shall apply irrespective of whether the business relationship is ongoing or has been terminated.

2. Transaction records shall be sufficient to permit the reconstruction of individual transactions so as to provide, where necessary, evidence for the prosecution of criminal activity. Such transaction records shall include:

2.1 the name of the customer and beneficial owner (and the authorised representative, where applicable), their addresses or other identifying information routinely recorded by the bank;

2.2 the nature (type) and date of the transaction;

2.3 the type and amount of currency involved in the transaction; and

2.4 the type and identification number of the accounts involved in the transaction.

3. Financial institutions shall retain all necessary records relating to the customer, beneficial owner or authorised representative, account files and business correspondence for at least five (5) years after termination of the business relationship or, in specific cases, for a longer period if requested by FIU-K, the CBK or another competent authority. The records shall identify the staff member who carried out the identification of the customer (and the beneficial owner, where applicable). Financial institutions shall provide safeguards to protect records from damage and prevent unauthorised access.

4. Financial institutions shall retain reports of the findings of analyses of large, complex transactions and business relationships subject to special monitoring, as provided in Article 25 of the Law on AML/CFT. Reports of findings shall be retained for a minimum period of five (5) years from completion of the analysis, or longer if required by FIU-K or the CBK.

5. In the absence of an ongoing business relationship, financial institutions, particularly currency exchange offices and money transfer operators, shall retain copies of identification records and transaction records for five (5) years after an occasional transaction or the last transaction in a series of linked occasional transactions.

6. Financial institutions shall, upon request by FIU-K, the CBK or any other competent authority, make available all data and information held on a customer, beneficial owner or authorised representative, and all required transaction records, in a complete, timely and comprehensible form and manner.

7. Where financial institutions are aware that records relate to ongoing investigations, those records shall be retained until the relevant law enforcement agency confirms that the case has been closed, even if the five-year period has expired.

8. Financial institutions’ electronic records shall be backed up electronically and shall be available in a readable format to FIU-K, the CBK and competent authorities under the applicable legislation.

9. The collection, processing, use and retention of personal data by financial institutions shall be limited to what is necessary for the purpose of complying with applicable AML/CFT legal requirements, and personal data shall not be further processed in a manner incompatible with that purpose. In particular, further processing of personal data for commercial purposes is prohibited.

Article 23 Identification and reporting of suspicious activities and transactions

1. Certain types of transactions shall alert financial institutions to the possibility that a customer is carrying out suspicious activities and acts. Such transactions may include transactions with no clear economic, lawful or commercial purpose, or involving large movements of funds inconsistent with the customer’s normal and expected transactions according to their risk and business profile. Very high account turnover, inconsistent with the amount of funds normally held in the account, may indicate that funds are being laundered. Examples of specific suspicious banking activities may be very useful to financial institutions and shall be included in training activities. A suspicious act or transaction will generally be an activity inconsistent with the known legitimate business or personal activities of the customer, or with the customer’s normal business for that type of financial product.

2. Questions that a bank or other financial institution may consider when determining whether an act or transaction may be suspicious include:

2.1 Is the size of the transaction consistent with the customer’s normal activities?

2.2 Is the transaction rational in the context of the customer’s business or personal activities?

2.3 Has the pattern of transactions carried out by the customer changed?

2.4 Where the transaction is international, does the customer have any apparent reason for conducting business with the other country involved?

3. Financial institutions shall take into account that a customer’s preference for carrying out a cash transaction below the EUR 10,000 threshold may be presumed to be intended to avoid reporting and, as such, gives rise to or contributes to suspicion concerning the transaction. Financial institutions shall consider that multiple cash transactions carried out by or on behalf of a person or entity, which appear to be linked and total EUR 10,000 or more over a period of time, give rise to or contribute to suspicion concerning the transactions.

4. Financial institutions shall provide sufficient guidance and training to staff to enable them to recognise suspicious acts and transactions. They shall ensure that all employees know to whom within the financial institution they must report suspicions and that there is a clear reporting line through which those suspicions are referred to the AML/CFT Function. The reporting line between the person raising the suspicion and the AML/CFT Function shall be as short as possible.

5. The AML/CFT compliance Function shall acknowledge receipt of the staff member’s report and, at the same time, provide guidance and remind them of their obligation not to take any action that could prejudice investigations, i.e. tipping off as explained in Article 26 of the Law on AML/CFT and as required by paragraph 12 of this Article.

6. Once the AML/CFT Function has received this initial report, it shall examine and analyse the matter on the basis of internal information. Financial institutions shall retain records of such analyses and their results. If, upon reviewing the analyses and results, the bank or financial institution concludes that the acts or transactions, or attempted acts or transactions, provide reasonable grounds to suspect money laundering, or where a link to a terrorist financing act or transaction is found, the AML/CFT Function shall immediately report the act or transaction, or attempted act or transaction, to FIU-K. Financial institutions shall report to FIU-K situations where the available information indicates that a person or entity may be, or may have been, involved in money laundering, related criminal offences and/or terrorist financing.

7. All internal enquiries arising in connection with the report, and the reasons for deciding whether or not to submit a report to FIU-K, shall be documented. Records of suspicions raised internally within the AML/CFT structure but not submitted to FIU-K shall also be retained for five (5) years from the date of the transaction.

8. Pursuant to Article 26 of the Law on AML/CFT, financial institutions shall report all suspicious acts or transactions to FIU-K within 24 hours of the activity or transaction being identified as suspicious. Sufficient information giving rise to reasonable suspicion to warrant reporting shall be disclosed and, if a particular offence is suspected, this shall be stated. Where the financial institution has other relevant evidence that can be made available, the nature of that evidence shall be clearly indicated when reporting without delay to FIU-K.

9. Where a financial institution reports in accordance with paragraph 1.2 of Article 26 of the Law on AML/CFT but suspects that the transaction may involve money laundering or be linked to terrorist financing, it shall also submit a suspicious transaction report concerning that transaction to FIU-K in accordance with paragraph 6 of this Article, indicating that the two reports refer to the same transaction, act or person.

10. If a financial institution decides not to enter into a business relationship because of a suspicion of money laundering or terrorist financing, it shall immediately report that decision to FIU-K as prescribed by the applicable AML/CFT legislation.

11. Financial institutions shall report to FIU-K any customer or transaction that they have reason to suspect may be linked to terrorist financing or to individuals supporting terrorism. Care shall be taken to monitor and maintain an updated list of organisations and individuals associated with terrorists or terrorism, based on information received from FIU-K or other available international sources. Attention shall be paid to non-profit and humanitarian organisations, particularly where their activities are inconsistent with their registered activities, where the source of funds is unclear or where such organisations receive assets from suspicious sources.

12. Reporting entities, directors, officers and temporary or permanent employees of a reporting entity who prepare or transmit reports in accordance with the Law on AML/CFT shall not disclose the fact that a report has been submitted or is in the process of being submitted, provide that report, or communicate any information contained in or concerning that report, including where such information is being prepared for reporting or where money laundering or terrorist financing investigations are being or may be conducted, to any person or entity, including any person or entity involved in the transaction covered by the report, other than FIU-K, without written authorisation from FIU-K, the public prosecutor or the court.

13. Every officer or employee of a bank or other financial institution who first raises a suspicion concerning an act, transaction or person involved in or linked to money laundering or terrorist financing shall be responsible for ensuring that an internal report of that suspicion is submitted to the Head of the AML/CFT Function. Under the applicable AML/CFT legislation, any form of threat intended to induce them to refrain from making a report, make a false statement or fail to disclose truthful information to FIU-K or other investigative agencies or judicial authorities constitutes an offence punishable under the applicable AML/CFT legislation. In such cases, reporting officers or employees shall immediately report the matter in accordance with their institution’s internal reporting lines and procedures.

CHAPTER IV SUPERVISION AND REMEDIAL MEASURES

Article 24 Supervision by the Central Bank of the Republic of Kosovo

1. The CBK shall supervise financial institutions’ compliance with their obligations under the applicable AML/CFT legislation and this Regulation.

2. The CBK shall ensure that persons holding a management function in financial institutions, or their beneficial owners, are fit and proper, by taking the necessary measures to prevent persons convicted of relevant criminal offences, or their associates, from holding a management function in financial institutions or being their beneficial owners.

3. The CBK shall supervise and inspect financial institutions. To exercise these supervisory powers, the CBK shall have authority to access financial institutions’ premises, request information and documents, obtain necessary copies, and exercise similar rights conferred under the applicable AML/CFT legislation and the relevant legislation governing financial institutions.

4. The CBK shall ensure that AML/CFT supervisory staff have high integrity, are appropriately qualified and maintain high professional standards, including confidentiality and data protection standards and standards addressing conflicts of interest.

5. The CBK shall apply a risk-based approach to supervising financial institutions’ AML/CFT compliance, ensuring that it:

5.1. has a clear understanding of the ML/TF risks present in the country;

5.2. has on-site and off-site access to all relevant information on domestic and international risks associated with financial institutions’ customers, products and services; and

5.3. adapts the frequency and intensity of on-site and off-site supervision to financial institutions’ risk profiles and the ML/TF risks in the country.

6. Financial institutions’ ML/TF risk profiles, including the risk of non-compliance, shall be reviewed periodically and whenever significant events or developments occur in management or operations.

7. The CBK shall assess the degree of discretion applied by financial institutions in identifying, assessing and mitigating ML/TF risks. The CBK shall assess the methodologies and assumptions underlying such discretion and verify the adequacy and effective implementation of the institution’s internal risk assessments, policies, controls and procedures.

Article 25 Reporting of breaches

1. Through regulatory and supervisory instruments, the CBK shall establish and ensure the provision of secure reporting channels to encourage the reporting of breaches of the applicable AML/CFT legislation and this Regulation. These mechanisms shall include, at a minimum:

1.1. specific procedures for receiving reports of breaches and following them up;

1.2. appropriate protection for employees of financial institutions who report breaches committed within their institution;

1.3. appropriate legal protection for the accused person;

1.4. protection of personal data relating both to the person reporting breaches and to the natural person suspected of being responsible for a breach, in accordance with the principles laid down in the Law on Personal Data Protection;

1.5. clear rules ensuring that confidentiality is guaranteed in all cases concerning the person reporting breaches committed within the obliged entity, unless disclosure is required by the applicable legislation in the context of further investigations or subsequent judicial proceedings.

2. Financial institutions shall have appropriate procedures for their employees, or persons in a comparable position, to report breaches through a specific, independent and anonymous channel, proportionate to the nature and size of the obliged entity concerned.

3. Financial institutions shall ensure that individuals, including employees who report suspicions of money laundering or terrorist financing to FIU-K, are legally protected from exposure to threats, retaliatory or hostile actions and, in particular, adverse or discriminatory employment actions.

Article 26 Administrative penalties and remedial measures

1. Breaches of the provisions of this Regulation shall be subject to remedial and punitive measures as provided in the Law on the Central Bank, the applicable AML/CFT legislation and the relevant legislation governing financial institutions.

2. The CBK shall also ensure that law enforcement authorities are informed in a timely manner where breaches that may constitute potential criminal offences are identified.

3. The CBK and FIU-K may coordinate their actions to impose administrative measures and sanctions, in accordance with the applicable legislation, in any of the following ways:

3.1. directly;

3.2. in cooperation with each other;

3.3. under their responsibility, by delegating these powers to other authorities;

3.4. by submitting an application to the competent judicial authorities.

Article 27 Repeal

Upon the entry into force of this Regulation, the Regulation on the Prevention of Money Laundering and Terrorist Financing adopted by the Board of the Central Bank on 26 June 2024, and any other provision that may conflict with this Regulation, shall be repealed.