Response to consultation on Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures
Question 1: Do you agree with the proposed provisions? If you do not agree, please explain how you think these provisions should be amended, and set out why they should be amended. Please provide evidence of the impact these provisions would have if they were maintained as drafted'?
The EMA welcomes the publication of the two sets of Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures, providing useful guidance for obliged entities.
1. Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures.
4.1.2 – Firms would welcome greater clarity around the use of the term ´international restrictive measures’. This is particularly valuable for firms that must comply with international lists under their enterprise policies.
4.1.3 - The term “senior staff member” can easily be confused with the AML manager or a member of the management body – we would welcome clarity from the EBA on this term.
4.2 - Regarding the “restrictive measures exposure assessment”, firms would welcome confirmation that they may incorporate this assessment into their existing MLRA or MLRO annual plans. This approach would greatly improve efficiency and reduce the compliance burden rather than developing a separate document for this assessment.
2. Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures under Regulation (EU) 2023/1113
The EMA has identified an issue with reconciling the Guidelines and the EU Instant Transfer Regulation, which also prescribes screening for targeted financial restrictive measures. We would be grateful for your consideration of the proposed amendment.
Payment service providers (“PSPs”) offering instant credit transfers in euro will be subject to the requirements of EU Regulation 2024/886, amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro (the “Regulation”).
In Recital 25, the Regulation identifies an important issue for PSPs – the screening of payer and payee involved in each credit transfer leads to a very high number of credit transfers being flagged as potentially involving persons or entities subject to targeted financial restrictive measures. However, upon completion of verification, the large majority of such flagged transactions turn out to be false positives.
The recital further states that “Due to the nature of instant credit transfers, it is impossible for PSPs to verify, within the required short time limit, those flagged transactions and, as a result, they are rejected. That situation creates operational challenges for PSPs to offer the payment service of sending and receiving instant credit transfers to their PSUs across the Union in a reliable and predictable way.”
The Regulation will provide for greater legal certainty in the context of instant credit transfers in euro, requiring PSPs to periodically, and at least daily, verify whether their payment service users (“PSUs”) are persons or entities subject to targeted financial restrictive measures. PSPs will no longer apply transaction-based screening in the specific context of instant credit transfers. This will only be applicable to persons or entities subject to targeted financial restrictive measures; other types of restrictive measures adopted in accordance with Article 215 TFEU or restrictive measures that are not adopted in accordance with Article 215 TFEU fall outside the scope of that obligation.
The new Article 5d provides for the screening of PSUs by PSPs that offer instant credit transfers:
1. PSPs offering instant credit transfers shall verify whether any of their PSUs are persons or entities subject to targeted financial restrictive measures.
PSPs shall carry out such verifications immediately after the entry into force of any new targeted financial restrictive measures, and immediately after the entry into force of any amendments to such targeted financial restrictive measures, and at least once every calendar day.
2. During the execution of an instant credit transfer, the payer’s PSP and the payee’s PSP involved in the execution of that instant credit transfer shall not verify whether the payer or the payee whose payment accounts are used for the execution of that instant credit transfer are persons or entities subject to targeted financial restrictive measures in addition to carrying out verifications under paragraph 1 of this Article.
The first subparagraph of this paragraph is without prejudice to actions taken by PSPs in order to comply with restrictive measures, other than targeted financial restrictive measures, adopted in accordance with Article 215 TFEU, with restrictive measures that are not adopted in accordance with Article 215 TFEU, or with Union law on the prevention of money laundering and terrorist financing.
The current draft Guidelines do not take into account the change proposed in Article 5d of the Instant Credit Transfer Regulation and should be aligned to clarify that for instant credit transfers, screening is not required prior to completion of each credit transfer.
4.1.4 Regarding “screening the customer bases”
The term ‘beneficial owners’ (point 18) is a term recognized and defined under AML legislation, but not in sanctions law. In order to avoid regulatory confusion, we therefore recommend alignment with EU AML legislation; ‘beneficial owners’ should refer to legal persons owning or controlling the legal person that is a customer. Alternatively, the term beneficial owner could be removed and a reference inserted to Article 1 of Council Regulation (EC) No 2580/2001.
4.1.5 - Regarding “Screening of transfers of funds and crypto-assets”
Firms would welcome clarification of the scope of applicability of these guidelines in relation to non-credit transfer payments. Screening of the transfer of funds should only occur where screening is not already conducted on a customer (the ‘stock’) or alternatively align the definition of ‘transfer of funds’ under point 4.1.5 with that provided in Regulation (EU) 2023/1113.
4.1.7 - Regarding “reliance on third parties and outsourcing”
It is unclear what requirements apply to arrangements with third parties that do not qualify as outsourcing. If it is expected that such arrangmenets should be subject to similar requirements, firms would welcome clarity.
4.2.2 - Regarding “due diligence measures for alert analysis”
The EBA statement “PSPs should refrain from providing financial services to a person prior to coming to an informed decision” leaves room for interpretation. We assume it is not suggesting that PSPs should refrain from processing all transactions, but instead that it applies in cases where it is not possible to conclude that it is a true positive match. We would welcome clarity on this point.
4.3.1 - Regarding “suspending the execution of transfers of funds and freezing of funds”
In relation to suspending real-time transactions, we consider that firms should block transactions only for confirmed matches (true positive matches) rather than “possible” matches. The scenario described in point 47 appears to suggest that PSPs should suspend transactions preventively during the sanction alert assessment phase. However this is inconsistent with the position set out in Para 53, where PSPs are expected to suspend transactions without delay “where true positive matches are confirmed.”
We encourage the EBA to adopt the approach taken by the US, where obliged entities are required to block or reject transactions only for confirmed matches, not blocking or rejecting based on potential matches due to lack of data.