The development of a single Anti-Money Laundering rule book

On May 7, 2020 the European Commission (EC) published its action plan to further strengthen the European Union’s (EU) fight against money laundering (ML) and the financing of terrorism (FT). ¹ Legislative proposals to realize this action plan are expected next month (July 2021). The action plan builds on six pillars, each of which is aimed at shutting down any remaining loopholes and removing any weak links in the EU's rules against ML/FT and strengthening the EU’s global role in this area. One of these pillars is the delivery of a reinforced rulebook.

Whereas the EU legal framework already provides the Member States with a comprehensive regulatory environment to combat ML/FT, the EC noticed that the current approach to this legislation has resulted in diverging implementation of the framework across Member States. Such fragmented legislative anti-money laundering and countering the financing of terrorism (AML/CFT) landscape leads to additional costs, burdens for those providing cross-border services and causes regulatory shopping, with businesses registering where rules are more relaxed. To combat this, the EC plans to develop with a more harmonized set of rules in the second quarter of 2021.

In parallel to the adoption of its action plan, the EC issued a public consultation to gather the views of citizens and stakeholders on the proposed measures.² The feedback period ended on August 26, 2020. The EY organization submitted its response on August 24, 2020 and addressed a letter to the EC illustrating its main recommendations to improve the EU’s AML regulatory framework.³ On March 3, 2020 the EC also issued a call for advice to the European Banking Authority (EBA) for defining the scope of application and the enacting terms of a regulation to be adopted in the field of preventing ML/FT.⁴ Following this call, the EBA published a report in which it sets out how the EU’s legal framework should be amended to tackle vulnerabilities linked to divergent national approaches and gaps in the EU’s AML/CFT defenses.⁵

Minimum harmonization and open standards

Part of the ambiguity of the current regulatory framework is caused by the use of open standards in the applicable rules and the fact that the current Anti-Money Laundering Directive (AMLD) is a minimum harmonization directive. Minimum harmonization allows Member States to impose stricter rules, which  is considered necessary in some cases to accommodate different national approaches as well as to facilitate a flexible response to specific local ML/FT risks. For example, in The Netherlands the Trust Company Service Provider (TCSP) sector is relatively large due to, among other things, the Dutch fiscal climate. On top of that, the services of TCSPs are considered as high risk, mainly because TCSPs often provide services to companies with complex ownership structures. To mitigate these risks, The Netherlands has imposed stricter rules in addition to the rules set out by the AMLD.⁶ In its response to the EC’s public consultation, The Netherlands highlighted its fear that harmonization of these rules by the EC would result in less strict rules being applied to this sector in The Netherlands compared to the current situation.³

Whereas flexibility is, thus, necessary to allow Member States to respond to specific local ML/FT risks, it has also resulted in diverging implementations across Member States, undermining the effective functioning of the current EU’s AML/CFT framework.

Harmonization through directly applicable EU law

To limit divergences in the interpretation and application of the rules, the EC considers it essential to turn certain parts of the AMLD into directly applicable provisions set out in a regulation. Opting for a regulation rather than a directive will eliminate the need for national transposition in these areas and, therefore, ensure a consistent approach to AML/CFT compliance, supervision and enforcement. According to the EC, the regulation should at a minimum include the provisions/requirements related to:¹

• List of obliged entities
• Structure and tasks of supervision
• Tasks of FIUs
• Customer due diligence
• Electronic identification and verification
• Record keeping
• Internal controls
• Reporting obligations
• Beneficial ownership registers
• Central bank account mechanisms
• Ceiling for large cash payments
• Freezing powers for FIUs
• Sanctions

Public consultation – The Netherlands and the EY organization

In its public consultation the EC asked the public whether it agrees with its selection and what other provisions should be harmonized through a regulation. The Netherlands highlighted that the provisions the most important to further harmonize are those concerning customer due diligence, record keeping, reporting obligation, internal controls and administrative sanctions. Criminal sanctions, on the other hand, should remain within the competence of the Member States. Furthermore, the Netherlands disagrees with the EC’s suggestion to incorporate the provisions laying down the tasks of FIUs, the provisions related to beneficial ownership and those related to central bank account registers in a future regulation.³

In its response to the public consultation, EY teams have presented itself as a strong proponent of far-reaching harmonisation.³ It agreed with all topics the EC suggested to turn into directly applicable rules by include them in a regulation. EY teams agree that including these topics into a regulation will facilitate faster and more harmonized implementation of the current AML/CFT framework. Moreover, the EY organization suggested to include strengthened/new provisions regarding information sharing in this new regulation, since this would help obliged entities with the data protection issues they are currently facing, and more particular the uncertainty regarding the intercommunication between data protection and AML/CFT provisions.

Call of advice to the EBA

In its response to the call of advice launched by the EC, the EBA refers to review work performed by the European Supervisory Authorities (ESA) over the last 5 years to evidence that the harmonization of the legal framework by means of directly applicable provisions is necessary in at least the following areas:⁴

• Customer due diligence
• Occasional transactions
• AML/CFT systems and controls
• Supervisory ML/TF risk assessments
• Cooperation
• Sanctions and other corrective measures

The ESA’s review work⁷ suggests that divergence in national rules and practices related to these topics are considered to have had a significant, adverse impact on the prevention of the use of the EU’s financial system for ML/TF purposes. Further harmonization of these rules by means of directly applicable provisions included in a regulation is thus necessary to avoid regulatory arbitrage, provide legal certainty and a level playing field for market participants.

Whereas the implementation of these core requirements in a regulation could decrease the risk of diverging implementation, these directly applicable rules could also take away the current flexibility left to the Member States to tailor the rules to their specific situations. The EBA recognizes in its report that the nature of AML/CFT supervision and compliance requires flexibility and discretion, in particular where this is necessary to address specific ML/TF risks.⁴  Both the EY organization and The Netherlands recognize as well the need for national competent authorities, as first line of defense in the fight against ML/FT, to retain some discretion with regard to adopting additional measures in specific circumstances.

The EC thus has the difficult task of striking the proper balance between the following two interests:

i. precise and detailed rules that are less subject to diverging implementation, and

ii. flexibility to accommodate different national approaches and to facilitate a flexible response to specific local ML/FT risks.

The EBA is convinced that this need for flexibility can be combined successfully with setting rules by means of a regulation rather than a directive, and refers to the new European Market Infrastructure regulation (EMIR)⁸ as a useful precedent in this context.⁴

The fact that certain topics should be turned into a regulation does however not mean that other topics cannot remain part of a directive. Similar legislative packages, consisting of a regulation and a directive, have been observed with regard to, for example, capital requirements (CRR and CRD)⁹ and financial instruments (MiFIR and MiFID)¹⁰. Such packages give the EC the opportunity to not directly convert the whole AMLD into a regulation, but to focus on those topics for which full harmonisation is necessary to achieve better outcomes in the fight against ML/TF across the EU.

Incorporation of additional (national) rules in the single rulebook

Reopening the AML/CFT framework provides the opportunity to incorporate further improvements and ensure the framework is future-proof. Possible improvements could be based on the need to mitigate newly emerging risks or on additional requirements adopted by some Member States in their local AML/CFT regulations, such as the aforementioned stricter rules in the Dutch TCSP sector.

Roughly the following two types of additional or broader national requirements can be distinguished:

• An expansion of the list of obliged entities, bringing additional entities or services within the scope of the AML/CFT regulatory framework; and
• Additional and/or stricter local requirements on top of the European framework, such as stricter CDD requirements.

According to the EC certain of these local requirements might contribute to a stronger AML/CFT framework and could be integrated into the future EU AML/CFT rulebook. A question that will undoubtedly arise during legislative negotiations is which of these requirements can be perceived  across the EU and should be included in the revised framework. EY teams believe there are a few aspects to consider when deciding on the incorporation of a local rule in the single rulebook.

The Supra National Risk Assessment

Firstly, the Supra National Risk Assessment (SNRA), an assessment of ML and FT risks affecting the internal market conducted by the EC, should be taken into account. The SNRA focusses on vulnerabilities identified at EU level, both in terms of legal framework and in terms of effective application and provides recommendations for addressing them. The more the additional requirements set by a Member State are put in place to address the risks identified in the SNRA, the more pressing the call to include these in the single EU rulebook. One example is the risks related to cash or cash-like assets. According to the SNRA, the level of ML threat related to cash (couriers) is very high. In accordance with this, an increasing number of Member States have introduced restrictions on cash.¹² The EC could consider including these additional requirements in its single EU rulebook to address this specific risk identified in the SNRA.

Technical innovations

The second consideration relates to technological innovations, such as remote customer onboarding, and developments in international standards. Technical innovations as well as updates of international standards could constitute reasons to revise the framework. For example, the scope of the AMLD should be expanded to virtual assets service providers, which are not presently covered, but are in scope of the international standards of the Financial Action Task Force. This will also prevent Member States from implementing these international standards in different ways.

Relationship with other European legislative acts

The EC identified a number of EU rules of which the consistency with AML/CFT rules might need to be further enhanced or clarified through guidance or legislative changes. These rules are listed in its public consultation, together with the question whether the public can think of other EU rules that should be considered in this respect.

Both The Netherlands and the EY organization responded that they would welcome more clarity on the intercommunication between the GDPR and other specific legislation regarding the sharing of data and the AML/CFT framework, as well as more EU guidance and sharing of good practices regarding national public-private partnerships. In this context, EY teams suggested to include revised/new provisions regarding information sharing in the new regulation, since this would help obliged entities with the data protection issues they are currently facing. Such a regulation would provide more clarity, because it would be the “lex specialis” that supersedes the General Data Protection Regulation (GDPR)¹³ in instances where the regulations contradict each other. In a subsequent point of view, the authors will focus in more detail on the intercommunication between the GDPR and AML/CFT provisions and the role of public-private partnerships in this respect.