It is concerning to see that, in its draft implementing rules regarding groups of companies with anti-money laundering obligations [1], the new European authority, the Authority for Countering Money Laundering and Financing of Terrorism (AMLA), is not remaining within the framework of the Anti-Money Laundering Regulation (AMLR) [2] and is disregarding data protection principles.
This is show by the consultation response of the European Banking Federation (EBF) [3].
Examples in the EBF response:
No basis in AMLR (‘Level 1 framework’)
page 2:
“Moreover, the draft RTS appears to extend the scope of information sharing beyond what is foreseen in the AML Regulation (Level 1 text). (…) As a Level 2 instrument, the RTS should remain strictly aligned with the mandate set by the Level 1 framework to ensure legal certainty and avoid an unintended broadening of information-sharing obligations.“.
page 2:
“The RTS imposes a number of specific requirements beyond AMLR Art. 16, including the obligation to establish a dedicated group-level organisation and coordination body with sufficient decision-making powers and a group AML/CFT officer“.
page 5:
“The Level 1 basis for this duplication is not clear, and it may create unnecessary administrative burden without commensurate supervisory benefit.“.
page 6:
“The reliance prohibition in Art. 15(b) appears broader than Art. 49 AMLR, as it may apply even where the underlying impediment does not directly affect the reliability of CDD, and should therefore be narrowed to ensure proportionality.“.
Data protection issues
page 4:
“However, the use of “shall” and “at least” in Art. 4(1) is overly prescriptive and may be read as requiring systematic sharing of all listed categories, regardless of customer risk, purpose or information availability. (…) Intra-group sharing should be limited to information directly relevant or necessary in light of the ML/TF risks identified for that customer; the RTS should not authorise routine transfers of verification data or complete customer files. Sharing identifying data requires a clear legal basis.“.
page 4:
“the inclusion of counterparty transaction data appears to extend beyond L1 (Arts. 16/17 AMLR): no extension of scope to TFS should be introduced via L2 measures). Art. 4(2): the extension of info sharing to customers linked through BO or group/structure affiliation goes beyond Art.16(3)AMLR.“.
page 5:
“Broad data sharing under art.4 conflicts with GDPR data minimisation. The list shouldn’t be treated as a minimum that must always be shared, and the words “at least” should be deleted. Art. 4(1)(a) requires sharing identification and verification documents, which may include national identification numbers. Art. 4(2) requires OEs to identify common customers across the group portfolio, requiring processing of the entire customer database before any specific ML/TF risk is identified. This may not be lawful under GDPR absent an explicit legal basis/proportionality justification. AMLA should clarify the GDPR legal basis and necessity test for each data category covered by the RTS. Arts. 4/7/10 suggest that customer or beneficial owner consent may overcome legal restrictions on info sharing. While consistent with Del. Reg. (EU) 2019/758, consent under GDPR must be freely given and may be withdrawn at any time, limiting its reliability as a legal basis for AML/CFT obligations. AMLA should clarify that consent cannot be relied on where invalid under data protection law and that, where consent is refused/withdrawn, the consequences should be addressed under the AML framework.“.
page 5:
“Art.10(1)(c), Arts. 11(1)(b) and 14(1)(b) refer to beneficial owner consent as a mechanism for overcoming third-country legal restrictions. (…) While obliged entities are required to assess whether customer or beneficial owner consent can be used to legally overcome restrictions, this should not be interpreted as a general or standalone solution. In particular, under GDPR, consent must be freely given and may be withdrawn at any time, which limits its reliability as a basis for AML/CFT compliance.“.
page 6:
“Art. 15(1)(e) envisages as an additional measure the documentation of source of funds, source of wealth and destination of funds. Applying such a measure to all customer types appears disproportionate and should instead cover higher-risk business relationships, similarly to point (d). We also note that the documentation of source of wealth goes beyond the scope of the corresponding provision of Commission Delegated Regulation 2019/758. Art. 15(1)(f) should not be interpreted as imposing blanket enhanced monitoring at onboarding, as this would assume a uniform high-risk classification for all third-country clients and would not be consistent with a risk-based approach.“.
page 7:
“Limitations of the consent-based approach
Arts. 10–14 rely on customer or beneficial owner consent as the primary mechanism for addressing legal impediments to information sharing (Arts. 10(1)(b) and (c), 11(1)(b) and (c), and 14(1)(b) and (c)). Where consent cannot be obtained or is ineffective, obliged entities are required to apply the additional measures set out in Art. 15 and, ultimately, to consider termination of the business relationship or account closure.
In practice, this approach may be difficult to implement in certain jurisdictions, including the PRC and Hong Kong. Consent is often not a comprehensive solution where the restriction on information sharing arises from regulatory or legal requirements rather than from the data subject’s rights. In particular, consent may not be legally effective in relation to sanctions-related disclosures, and certain restrictions, such as blocking statutes, may apply irrespective of whether the customer or beneficial owner has provided consent.“.
page 10:
“Potential application to non-obliged entities
Art. 21(3) appears to imply that non-obliged entities within a structure may be required to share information. If this is the intended scope, the provision would have a disproportionate and far-reaching impact, extending AML information-sharing obligations to entities that are not subject to AMLR and that have no established AML compliance framework. AMLA should clarify the intended scope of Art. 21(3) and, where appropriate, limit its application to entities subject to the AMLR. If non-obliged entities are intended to fall within scope, there should be an explicit legal basis in the AMLR for this extension. In the absence of a clear legal basis, Art. 21(3) should be amended to limit its scope to obliged entities within the structure.“.
It shows that the AMLA lacks sufficient legal expertise and that there is a lack of attention to data protection and data minimisation. That does not inspire confidence in what is to come under the AMLR.
Notes:
[1] The draft RTS on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries as consulted until 15 June 2026.
[2] AMLR comes into effect 10 July 2027.
[3] Announcement: EBF feedback on AMLA Draft RTS on group-wide minimum requirements, document with the response (pdf).
Ellen Timmer - juridische artikelen en berichten 