Resolution amending Resolution No 03-17 on Guidelines for Prevention of Money Laundering and Terrorist Financing for Financial Market Participants

BOARD OF THE BANK OF LITHUANIA RESOLUTION AMENDING RESOLUTION NO 03-17 OF THE BOARD OF THE BANK OF LITHUANIA OF 12 FEBRUARY 2015 ON THE APPROVAL OF THE GUIDELINES ON THE PREVENTION OF MONEY LAUNDERING AND/OR TERRORIST FINANCING FOR FINANCIAL MARKET PARTICIPANTS 30 May 2023 No 03-97 Vilnius The Board of the Bank of Lithuania has r e s o l v e d: To amend the Guidelines on the Prevention of Money Laundering and/or Terrorist Financing for Financial Market Participants approved by Resolution No 03-17 of the Board of the Bank of Lithuania of 12 February 2015 on the approval of the Guidelines on the Prevention of Money Laundering and/or Terrorist Financing for Financial Market Participants: 1. To amend paragraph 2 to read as follows: “2. The Guidelines shall apply to credit institutions, electronic money institutions, payment institutions, currency exchange operators, crowdfunding platform operators, crowdfunding service providers, peer-to-peer lending platform operators, insurance undertakings carrying out life insurance activities, insurance brokerage firms carrying out life insurance mediation activities, financial brokerage firms, management companies, investment companies and the depository as well as, mutatis mutandis , branches of relevant foreign entities established in the Republic of Lithuania, and electronic money institutions and payment institutions headquartered in another EU Member State that provide services in the Republic of Lithuania through intermediaries that are natural or legal persons.” 2. To amend paragraph 2 to read as follows: “2. The Guidelines shall apply to credit institutions, electronic money institutions, payment institutions, currency exchange operators, crowdfunding service providers, peer-to-peer lending platform operators, insurance undertakings carrying out life insurance activities, insurance brokerage firms carrying out life insurance mediation activities, financial brokerage firms, management companies, investment companies and the depository as well as, mutatis mutandis , branches of relevant foreign entities established in the Republic of Lithuania, and electronic money institutions and payment institutions headquartered in another EU Member State that provide services in the Republic of Lithuania through intermediaries that are natural or legal persons.” 3. To amend paragraph 3 to read as follows: “3. The Guidelines shall apply in conjunction with:

3.1. The European Banking Authority’s Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849 repealing and replacing Guidelines JC/2017/37 (EBA/GL/2021/02); 3.2. European Banking Authority’s Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer under Article 8 and Chapter VI of Directive (EU) 2015/849 (EBA/GL/2022/05).” 4. To supplement paragraph 4 with a new subparagraph 4.6: “4.6. assessment of the elements of the internal control systems – the assessment of the elements of the internal control system for the prevention of ML/TF, which is aimed at assessing the compliance of the internal control system set up by the FMP for the prevention of ML/TF with legal requirements, and at assessing the effectiveness and efficiency of the application of the elements of the internal control system for the prevention of ML/TF in practice.” 5. To repeal paragraph 8. 6. To amend paragraph 15 to read as follows: “15. The FMP shall ensure that the competence, experience and qualifications of the employee responsible for the implementation of AML/CTF measures in the FMP’s activities and of the member of the Board organising the implementation of AML/CTF measures as laid down in the Law (where the financial market participant is led by the Board) are assessed before the appointment of such an employee. An evaluation of the competence, experience and qualifications of a responsible person implementing AML/CTF measures in the FMP’s activities shall be based on the person’s educational background, professional development, the nature and length of professional activity or professional experience and other factors that may affect the person’s competence, experience and qualifications as well as the fact of whether a person to be appointed as the person responsible for the implementation of AML/CTF measures possesses risk management knowledge relating to the implementation of AML/CTF measures. The FMP shall notify the Bank of Lithuania of the appointment of such an employee and/or member of the Board no later than within 7 working days from the date of their appointment and/or replacement.” 7. To amend Chapter IX to read as follows: “ CHAPTER IX ASSESSMENT OF THE ELEMENTS OF THE INTERNAL CONTROL SYSTEM 70. The compliance of the elements of the internal control system set up by the FMP for the prevention of ML/TF referred to in paragraph 7 of the Guidelines with legislation and the effectiveness and efficiency thereof shall be assessed both continuously (when the staff carry out their daily professional duties) and periodically by assessing the elements of the internal control system for the prevention of ML/TF, which shall be aimed at ensuring the effectiveness, efficiency, continuity, ongoing monitoring, improvement of the internal control system, and the identification and elimination of shortcomings. 71. The FMP shall ensure that the assessment of the elements of the internal control system set up by the FMP for the prevention of ML/TF referred to in paragraph 7 of the Guidelines is carried out periodically, taking into account the ML/TF risk identified by the FMP, the scale and nature of the FMP’s activities, the services and/or products provided by it, at least once every two years and in the case of significant changes. The FMP shall ensure that, prior to the assessment of the elements of the internal control system for the prevention of ML/TF, selection criteria for the selection of the elements of the internal control system to be assessed are defined taking into account the ML/TF risk identified by the FMP, the scale and nature of the FMP’s activities, the services and/or products provided by it, and other relevant information. The FMP shall document and be able to justify the reasonableness of the selection criteria on the basis of which the elements to be assessed are selected. 72. The periodic assessment of the elements of the internal control system for the prevention of ML/TF shall involve the assessment of the compliance of the internal regulation of the internal control system set up by the FMP for the prevention of ML/TF with legal requirements, and the assessment of the effectiveness and efficiency of the application of the elements of the internal control system. The methods used in the assessment shall be appropriate to the scale, nature and complexity of the FMP’s activities and to the nature of the services and/or products provided by it and shall be proportionate in relation to the FMP’s exposure to ML/TF risks. 73. The periodic assessment of the elements of the internal control system for the prevention of ML/TF may be carried out during an internal or external audit or by any other means chosen by the FMP. Irrespective of whether the periodic assessment of the elements of the internal control system for the prevention of ML/TF is carried out by means of the FMP’s internal resources or by external service providers, the responsibility for conducting such an assessment properly shall rest with the FMP, therefore, the FMP shall ensure that the person carrying out the assessment is competent in the prevention of ML/TF, is familiar with the legislation on the prevention of ML/TF, has an understanding of the FMP’s business model, and has all the information necessary for such an assessment. 74. The FMP shall ensure that the periodic assessment of the elements of the internal control system for the prevention of ML/TF is carried out impartially, i.e. the person carrying out such an assessment may not evaluate the elements for the organisation and/or implementation of which they were responsible (e.g. the compliance of the internal control procedures and policies with legal requirements may not be assessed by the same person who drafted them). 75. The results of the periodic assessment of the elements of the internal control system for the prevention of ML/TF shall in all cases be documented in a written document and/or documented in the form of an assessment report which shall cover at least the following elements: 75.1. the scope of the assessment (i.e. highlighting the assessed areas, processes, etc.); 75.2. the period assessed; 75.3. the assessment methodology, detailing how the assessment of the selected area was carried out and what specific assessment methods were used (e.g. off-site inspection, survey/interview, monitoring of activities, etc.); 75.4. the FMP’s policies and internal control procedures that were assessed, and the assessment of the implementation thereof in practice; 75.5. the scope of the FMP’s client testing and the criteria for the selection for testing, specifying how many clients were selected for testing and what client information was assessed; 75.6. the assessment of compliance of the FMP’s internal control system for the prevention of ML/TF with the applicable legislation and the assessment of the effectiveness and efficiency of the internal control system, highlighting the specific areas assessed and providing an assessment of any such specific areas assessed; 75.7. the observations and shortcomings identified during the assessment and the potential impact of such shortcomings, highlighting the categories of the shortcomings by their nature, extent and potential impact; 75.8. recommendations relating to the elimination of the shortcomings identified during the assessment; 75.9. any other relevant information. 76. The FMP’s body responsible for identifying and controlling the implementation of measures to eliminate the identified shortcomings and to manage/mitigate risks shall familiarise themselves with the outcomes of the assessment of the elements of the internal control system for the prevention of ML/TF and shall approve the plan for elimination of the shortcomings identified during the assessment.” 8. To consider former paragraphs 72 and 73 as paragraphs 77 and 78, respectively. 9. Paragraphs 4 to 8 of this Resolution shall come into force as of 1 September 2023. 10. Paragraph 2 of this Resolution shall come into force as of 10 November 2023. Chairman of the Board Gediminas Šimkus