Art. 5 Criteria to be taken into account when applying the administrative measures listed under this Regulation | RTS on pecuniary sanctions and administrative measures | AML

This article guides supervisors on how to choose the type of administrative measure to impose on an obliged entity following an AML/CFT breach.

Building directly on the gravity classification framework established in Articles 1 and 2, it sets out distinct criteria for three specific types of measure: restricting or limiting business operations, withdrawing or suspending an authorisation, and requiring a change in governance structure.

In each case, supervisors must weigh a tailored set of factors before acting, ensuring the chosen measure is appropriate to the nature and severity of the breach identified.

Important points:

Supervisors are required to apply the gravity classification from Article 2 as a threshold consideration — category three or four is a prerequisite for all three types of measure covered here.
Supervisors are required to consider the potential negative impact of a measure on customers and stakeholders when deciding whether to restrict or limit business operations.
Supervisors are required to factor in structural failures in AML/CFT systems, lack of cooperation, and the conduct of the responsible party when considering the most severe measures, such as authorisation withdrawal or governance changes.

1. To set the type of administrative measure, supervisors shall, after assessing the indicators specified in Article 1 and 2, take into account:
  1. the circumstances referred in Article 53(6) of Directive (EU) 2024/1640, and
  2. the criteria specified in paragraphs 2 to 4.
1. When considering whether to restrict or limit the business, operations or network of institutions comprising the obliged entity, or requiring the divestment of activities as referred to in Article 56(2), point (e), of Directive (EU) 2024/1640, supervisors shall take into account each of the following criteria, to the extent that they apply:
  1. the level of gravity is classified pursuant to Article 2 as category three or four;
  2. whether such a measure is capable of mitigating the actual impact or preventing a potential impact by assessing the indicators specified in Article 1, points (e), (g), (i) or (j);
  3. the extent to which the business, operations or network of institutions comprising the obliged entity are affected by the breach or the potential breach;
  4. the extent to which the measure could have a negative impact on customers or stakeholders;
  5. any other criteria identified by the supervisor.
1. When considering whether to withdraw or suspend an authorisation as referred to in Article 56(2), point (f), of Directive (EU) 2024/1640, supervisors shall take into account each of the following criteria, to the extent that they apply:
  1. the level of gravity is classified pursuant to Article 2 as category three or four;
  2. whether such a measure is capable of mitigating the actual impact or preventing a potential impact by assessing the indicators specified in Article 1, points (e), (g), (i) or (j);
  3. the conduct of the natural person or legal person held responsible;
  4. whether there is a structural failure within the obliged entity, with regards to AML/CFT systems and controls and policies or a material failure of the entity to put in place adequate AML/CFT systems and controls;
  5. any other criteria identified by the supervisor.
1. When considering the need for a change in the governance structure as referred to in Article 56(2), point (g), of Directive (EU) 2024/1640, supervisors shall take into account each of the following criteria to the extent that they apply:
  1. the level of gravity is classified pursuant to Article 2 as category three or four;
  2. the conduct of the natural person or legal person held responsible;
  3. the natural person or legal person held responsible has not cooperated with the supervisor or took actions aimed at partially or fully concealing the breach to the supervisor or at misleading the supervisor, or the absence of remedial actions since the breach was identified, either by the natural person of legal person held responsible or by the supervisor;
  4. the internal policies, procedures and controls put in place by the obliged entity are ineffective;
  5. any other additional information, where appropriate, including information from a financial intelligence unit, from a prudential supervisor or any other authority or from a judicial authority;
  6. any other criteria identified by the supervisor.

Article 5 Criteria to be taken into account when applying the administrative measures listed under this Regulation

Tag

Tags