Communiqué concerning non-profit organisations and the fight against t

Published on 30 May 2024 Email this Share this on LinkedIn Share this on Facebook Communiqué Communiqué concerning non-profit organisations and the fight against terrorism financing In Luxembourg, vertical risk assessments (on legal persons and legal arrangements1, on the one hand, and especially on terrorist financing2 (“TF”), on the other hand), published by the Ministry of Justice in 2022, measure the level of TF risk exposure of certain non-profit organisations (“NPOs”) as high, based on the characteristics and activities of these NPOs. As regards the Luxembourg NPOs which may be at risk (non-profit associations and foundations, as referred to in the new Law of 7 August 2023 on non-profit associations and foundations), reference is made especially to NPOs carrying out development and humanitarian projects abroad. As a reminder, the aforementioned TF vertical risk assessment identified a twofold TF risk exposure of these NPOs: “(…) through the donations they receive and the destination of their funds. Regarding donations, organisations linked to terrorists or terrorist groups have been known to create false appeals to raise money. In most cases, donations are made by the public in the belief that the money will be used to fund genuine charitable activities. However, occasionally the donors are aware of the true destination of the funds and use the humanitarian cover to avoid raising suspicion. No such cases have yet been identified in Luxembourg, but the vulnerability exists; Regarding the destination of the funds, money may be paid by NPOs active in projects abroad (with or without DNGO [development non-governmental organisation] status) to individual terrorists or terrorist groups, deliberately or inadvertently. As above, no such cases have yet been identified in Luxembourg, but the vulnerability exists. Although the globally observed typologies have not been detected in relation to Luxembourg NPOs developing projects abroad, this sub-sector remains highly vulnerable in view of the geography of their activities”3, notably in the vicinity of or in conflict zones. Given the current international geopolitical context (cf. e.g. the CSSF communiqué AML/CFT of 25 October 20234, the risk that illegal financing networks exploit the weaknesses of certain NPOs has been increasing, in particular as NPOs are not directly subject to the obligations provided for by the legislation relating to the fight against money laundering and terrorist financing (“AML/CFT”). As a result, the implementation of an adequate risk-based approach should lead the financial institutions to target these riskier NPOs and to apply appropriate mitigation measures, taking care not to stigmatise all NPOs. At international level, it should be stressed that the Financial Action Task Force (“FATF”) has also been reporting for many years that terrorist groups may succeed in abusing and misusing the money of certain NPOs to finance their activities or their promotion, even that NPOs actively support terrorist organisations or activities. However, the FATF also recalls and emphasises that NPOs do not all pose the same risk of abuse for TF purposes5. Consequently, in order to prevent financial institutions from applying disproportionate measures, NPOs must be subject to a factual and risk-based analysis. The FATF highlights the practices to be avoided in order to preserve the integrity of the non-profit sector and also stresses the unintended and harmful consequences of the implementation of inappropriate mitigation measures towards NPOs (e.g. considering all NGOs as posing a high TF risk). “De-risking”, as defined by the FATF, means, in this case, the phenomenon of financial institutions terminating or restricting business relationships with NPOs to avoid, rather than manage, risk in line with the FATF’s risk-based approach6. The application of risk mitigation measures must not jeopardise the financial inclusion of NPOs, which consequently might move to unregulated and unsupervised financial services, further increasing the risk of abuse for TF purposes. The FATF thus adopted, during the plenary meeting of October 2023, amendments to Recommendation 8 regarding NPOs in order to provide an effective framework to protect the financial system from potential abuses for TF purposes7. In order to take account of these amendments, the FATF also updated its Best practices paper on combating the terrorist financing abuse of NPOs (which also includes examples of bad practices)8. In parallel, the FATF’s assessment methodology has also been adapted, as decided during the plenary meeting of February 2024, in order to mirror these recent changes for the next FATF’s assessments under the 5th round of evaluations. Hence, the FATF provides a set of good practices aimed at reconciling the fight against TF and the access of NPOs to financial services. We would like to raise attention to the fact that the FATF requests financial institutions, where they identified a TF risk specific to an NPO and its activities, to determine if there are appropriate guarantees and measures that enable them to manage it. The FATF also recommends financial institutions to collaborate more closely with the non-profit sector to open discussions on the expectations and issues of each of them. Such exchanges offer the possibility to financial institutions to clearly express their requirements towards NPOs. In this sense, it should also be pointed out that, at European level, the European Banking Authority (EBA) updated its guidelines in order to reflect the factors which financial institutions must take into account when assessing the risks of money laundering and TF related to business relationships with NPOs. Reference is made to Circular CSSF 23/8429 on the adoption of these guidelines (EBA/GL/2023/03). Finally, the combination of these factors and of the aforementioned guidelines allows drawing up a non-exhaustive list of indicators that financial institutions may take into consideration in order to determine whether they face a TF risk situation through the abusive exploitation of an NPO: Indicators linked to funding methods/frequency: difficulties in tracing the origin or destination of the funds; mostly cash-based donations; unexplained increase of deposits and transactions; significant and unusual withdrawals (in particular following a refusal to carry out a cross-border transfer); transactions including terms/symbols associated with violent, racist and/or terrorist ideologies. Geographical factors: transferring funds to several entities in (

a)high-risk country(ies); appointment of a third party as representative to transfer funds to high-risk countries (notably upon a fund collection campaign); no domestic donors, donors located in high-risk countries; resources transferred or activities conducted in an area where terrorist entities are known to have a substantial presence; links with conflict zones or nearby regions (e.g. transfers to a local association that is supposed to pursue the NPO’s missions); fund transfers from/to entities operating in areas with known terrorist activities. Indicators linked to reputation: existence of reliable information indicating that the NPO is linked to third parties that support or are engaged in terrorist activities; receipt of funds from entities suspected of supporting terrorist activities; receipt of funds from suspected terrorists [or “listed persons”, i.e. persons included in the TF financial sanctions lists]10. Indicators linked to control: lack of information on the objective, and, where applicable, on the ultimate beneficiaries of the activities of the NPO; inability to account for the final use of all of the resources; absence of legal status (under national law or a different jurisdiction). Other indicators: disappearance of the NPO’s online and/or social media presence (notably following a crowdfunding request for donations); use of falsified or conflicting documentation; sharing premises with an organisation suspected of supporting terrorist activities, etc. The geographic indicators allow evidencing potential situations through which NPOs might be abused for TF purposes in ex post situations (embezzlement of funds), whereas the other indicators mostly refer to situations in which NPOs potentially engage in TF and have been established ex ante for this specific purpose. As a conclusion, based on their risk-based approach, financial institutions should apply mitigation measures that are appropriate and proportionate to the NPOs that they identified as being exposed to TF risk, whilst ensuring that all the actors of that sector are not stigmatised, and refrain from “de-risking” which would be detrimental to the financial inclusion of NPOs and to transparency. 1 MinJus_ ML/TF vertical risk assessment on legal persons and legal arrangements 2022 (VRA LP LA) – Ministry of Justice // The Luxembourg Government (gouvernement.
lu)2 Luxembourg finalises its first vertical risk assessment on terrorist financing – government.lu (gouvernement.
lu)3 Luxembourg finalises its first vertical risk assessment on terrorist financing – government.lu (gouvernement.
lu)4 Communiqué AML/CFT 5 NPO: refers to a legal person or arrangement or organisation that primarily engages in raising or disbursing funds for purposes such as charitable, religious, cultural, educational, social or fraternal purposes, or for the carrying out of other types of “good works”. 6 Financial inclusion and NPO issues (fatf-gafi.org) 7 FATF Recommendations (fatf-gafi.org) 8 FATF’s Best practice: https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/BPP-Combating-TF-Abuse-NPO-R8.pdf.coredownload.inline.pdf and FATF Communiqué: Best Practices on Combating the Abuse of Non-Profit Organisations (fatf-gafi.org) 9 Circular CSSF 23/842 on the adoption of the revised guidelines, by the EBA, on money laundering and terrorist financing risk factors – complement of Circular CSSF 21/782 which introduces a new annex to the consolidated guidelines on customers that are NPOs: Circular CSSF 23_842 10 In this case, financial institutions are reminded of their strict obligations under the Law of 19 December 2020 on the implementation of restrictive measures in financial matters and from the Grand-ducal Regulation of 14 November 2022 providing details on the Law of 19 December 2020 on the implementation of restrictive measures in financial matters. We also reiterate that the financial sanctions regime does not follow a risk-based approach and that, for this purpose, strict rules are applicable, in particular for the identification, the freezing and the obligation to inform the Ministry of Finance without delay. 16 October 2023 Circular CSSF 23/842 Adoption of the revised guidelines, by the EBA, on money laundering and terrorist financing risk factors – complement of Circular CSSF 21/782 CSSF circular PDF (309.67Kb) PDF (432.44Kb) Main topic: Financial crime Relevant for Alternative investment fund managers Central Securities Depositories (CSDs) Credit institutions Crowdfunding service providers Investment firms Investment funds and vehicles Payment institutions/electronic money institutions/AISPs Specialised PFS Support PFS Virtual Asset Service Providers (VASPs) Circulaire CSSF 23/842 Adoption des Orientations révisées par l’EBA sur les facteurs de risque de blanchiment de capitaux et de financement du terrorisme – complément de la circulaire CSSF 21/782 En cas de divergences entre les textes français et anglais, le texte anglais prévaut. Circulaire CSSF 23/842 Adoption des Orientations révisées par l’EBA sur les facteurs de risque de blanchiment de capitaux et de financement du terrorisme – complément de la circulaire CSSF 21/782 La présente circulaire s’applique aux établissements de crédit et aux établissements financiers tels que définis à l’article 1er, paragraphes 3 et 3bis du titre I, chapitre 1er, de la loi modifiée du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme. Luxembourg, le 16 octobre 2023 Mesdames, Messieurs, L’objet de la présente circulaire est de porter à votre attention l’application, par la CSSF, en sa qualité d’autorité compétente, des Orientations de l’Autorité bancaire européenne (« EBA ») (réf. EBA/GL/2023/03, ci-après, les « Orientations modificatives »), publiées le 31 mars 2023, modifiant les orientations de l’EBA sur les mesures de vigilance à l’égard de la clientèle et sur les facteurs que les établissements de crédit et les établissements financiers (les « professionnels ») devraient prendre en considération lorsqu’ils évaluent les risques de blanchiment de capitaux et de financement du terrorisme (« BC/FT ») associés aux relations d’affaires individuelles et aux transactions conclues à titre occasionnel (« Orientations sur les facteurs de risque de BC/FT ») au titre des articles 17 et 18, paragraphe 4, de la directive (UE) 2015/849 (EBA/GL/2021/02). La CSSF a ainsi intégré ces Orientations modificatives dans sa pratique administrative et dans son approche réglementaire en vue de favoriser la convergence en matière de surveillance dans ce domaine au niveau européen. 1. Les Orientations À la suite de la publication, en janvier 2022, d’un avis de l’EBA sur la réduction des risques (« derisking ») 1, qui évaluait l’ampleur de la réduction des risques au sein de l’UE ainsi que l’impact des décisions prises par les professionnels de refuser ou de rompre des relations d’affaires avec des clients individuels ou des catégories de clients associés à un risque élevé de BC/FT, notamment les organisations à but non lucratif (OBNL), et de la demande de la Commission européenne à l’attention de l’EBA de publier de nouvelles orientations sur les mesures à prendre par les établissements pour faciliter l’accès des OBNL aux services financiers, l’EBA a préparé des Orientations modificatives y relatives (EBA/GL/2023/03) concernant les clients qui sont des OBNL. Ces Orientations modificatives ont désormais été ajoutées en tant qu’annexe aux Orientations sur les facteurs de risque de BC/FT et il y est fait référence à l’Orientation n° 2 (Identifier les facteurs de risque de BC/FT - Facteurs de risque liés aux clients), paragraphe 2.7., lettre d), de la partie principale des Orientations sur les facteurs de risque de BC/FT, telles que modifiées. L’objectif de l’annexe est de fournir une aide aux professionnels dans leur compréhension des spécificités des clients potentiels ou existants qui sont des OBNL. L’annexe clarifie ainsi les mesures 1 Avis de l’Autorité bancaire européenne au sujet du « de-risking » (uniquement en anglais) CIRCULAIRE CSSF 23/842 2/3 que les professionnels devraient prendre afin de bien comprendre la manière dont chaque OBNL est organisée et fonctionne, ainsi que les facteurs que les professionnels devraient prendre en considération lorsqu’ils évaluent le risque de BC/FT associé à une relation d’affaires avec des clients qui sont des OBNL. Les Orientations modificatives sont annexées à la présente circulaire et également disponibles sur le site Internet de l’EBA : https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guideline s/2023/EBA-GL-202303/Tranlsations/1061430/GL%20amending%20EBA%20GL%202021%2002%20%28EBA%20GL% 202023%2003%29_FR_COR.pdf La version consolidée des Orientations sur les facteurs de risque de BC/FT (EBA/GL/2021/02), telles que modifiées, est disponible sur le site Internet de l’EBA : https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guideline s/2023/EBA-GL-2023-03/Consolidated/1061625/EBA%20GL%202021%2002%20%20consolidated%20%28amended%20by%20EBA%20GL%202023%2003%29_FR.pdf La présente circulaire vient compléter la circulaire CSSF 21/782. 2. Champ d’application La présente circulaire s’applique aux établissements de crédit et aux établissements financiers tels que définis à l’article 1er, paragraphes 3 et 3bis du titre I, chapitre 1er, de la loi modifiée du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme. 3. Date d’application Les Orientations modificatives introduisant l’annexe sont applicables à partir du 3 novembre 2023. Claude WAMPACH Directeur Marco ZWICK Directeur Françoise KAUTHEN Directeur Annexe Jean-Pierre FABER Directeur Claude MARX Directeur général EBA/GL/2023/03 - Orientations modifiant les orientations EBA/2021/02 sur les mesures de vigilance à l’égard de la clientèle et les facteurs que les établissements de crédit et les établissements financiers devraient prendre en considération lorsqu’ils évaluent le risque de blanchiment de capitaux et de financement du terrorisme associé aux relations d’affaires individuelles et aux transactions conclues à titre occasionnel (les « orientations sur les facteurs de risque de BC/FT ») au titre des articles 17 et 18, paragraphe 4, de la directive (UE) 2015/849 À noter que l'annexe reprise ci-après en version française inclut uniquement les Orientations, alors que la version anglaise reprend le Final Report. CIRCULAIRE CSSF 23/842 3/3 EBA/GL/2023/03 31 mars 2023 Orientations modifiant les orientations EBA/2021/02 sur les mesures de vigilance à l’égard de la clientèle et les facteurs que les établissements de crédit et les établissements financiers devraient prendre en considération lorsqu’ils évaluent le risque de blanchiment de capitaux et de financement du terrorisme associé aux relations d’affaires individuelles et aux transactions conclues à titre occasionnel (les «orientations sur les facteurs de risque de BC/FT») au titre des articles 17 et 18, paragraphe 4, de la directive (UE) 2015/849 1. Obligations en matière de conformité et de déclaration Statut des présentes orientations 1. Le présent document contient des orientations émises en vertu de l’article 16 du règlement (UE) nº 1093/2010 1. Conformément à l’article 16, paragraphe 3, du règlement nº 1093/2010, les autorités compétentes et les établissements financiers ou de crédit mettent tout en œuvre pour respecter les présentes orientations. 2. Ces orientations présentent le point de vue de l’ABE sur les pratiques de surveillance appropriées au sein du Système européen de surveillance financière et sur la manière dont le droit de l’Union devrait être appliqué dans ce domaine particulier. Les autorités compétentes, telles que définies à l’article 4, paragraphe 2, du règlement (UE) nº 1093/2010, auxquelles s’appliquent ces orientations, devraient s’y conformer en les intégrant de manière adéquate dans leurs pratiques (par exemple en modifiant leur cadre juridique ou leurs processus de surveillance), y compris lorsque ces orientations s’adressent principalement aux établissements. Obligations de déclaration 3. Conformément à l’article 16, paragraphe 3, du règlement (UE) nº 1093/2010, les autorités compétentes doivent indiquer à l’ABE si elles respectent ou entendent respecter ces orientations, ou indiquer les raisons de leur non-respect, le cas échéant, pour le 03.10.2023. En l’absence d’une notification dans ce délai, les autorités compétentes seront considérées par l’ABE comme n’ayant pas respecté les orientations. Les notifications devraient être transmises en utilisant le formulaire disponible sur le site internet de l’ABE, sous la référence «EBA/GL/2023/03». Les notifications devraient être communiquées par des personnes dûment habilitées à rendre compte du respect de ces orientations au nom des autorités compétentes qu’elles représentent. Toute modification du statut de conformité avec les orientations sont également à signaler à l’ABE. 4. 4. Les notifications seront publiées sur le site internet de l’ABE, conformément à l’article 16, paragraphe 3. 1 Règlement (UE) nº 1093/2010 du Parlement européen et du Conseil du 24 novembre 2010 instituant une Autorité européenne de surveillance (Autorité bancaire européenne), modifiant la décision nº 716/2009/CE et abrogeant la décision 2009/78/CE de la Commission (JO L 331 du 15.12.2010, p. 12). 2 2. Objet, champ définitions d’application et Définitions 5. Aux fins de la modification des orientations, la définition suivante est ajoutée: Organisations à but non lucratif Une organisation à but non lucratif (OBNL) est une personne morale, une structure ou une organisation qui se consacre principalement à la collecte ou à la distribution de fonds à des fins caritatives, religieuses, culturelles, éducatives, sociales ou fraternelles. 3. Mise en œuvre Date d’application 6. Les présentes orientations s’appliqueront à compter du 03.11.2023. 4. Orientation concernant les clients qui sont des OBNL Orientation 2. Le point 7(
d)est remplacé par le texte suivant: 2.7.(
d)Lorsque le client est une organisation à but non lucratif (OBNL), les établissements devraient appliquer les critères énoncés en annexe. L’annexe suivante est ajoutée: 3 Annexe: Clients qui sont des OBNL 1. Lorsqu’ils évaluent pour la première fois le profil de risque d’un client ou d’un client potentiel qui est une OBNL, les établissements devraient s’assurer qu’ils comprennent bien la gouvernance de l’OBNL, son mode de financement, ses activités, son lieu de fonctionnement et l’identité de ses bénéficiaires. Toutes les OBNL ne sont pas exposées de la même manière au risque de BC/FT, et les établissements devraient prendre des mesures fondées sur une appréciation des risques pour comprendre:
a)qui contrôle le client et qui sont ses bénéficiaires effectifs. Dans ce cadre, les établissements devraient identifier les administrateurs ou équivalents de l’OBNL, son organe de direction et toute autre personne exerçant un contrôle ou une influence sur l’OBNL. À cette fin, les établissements devraient se référer à des informations telles que le statut juridique de l’OBNL, la description de la structure de gouvernance de l’OBNL et/ou la liste du ou des représentants légaux;
b)le mode de financement de l’OBNL (dons privés, fonds publics, etc.). À cette fin, les établissements devraient se référer aux informations relatives à la base des donateurs, aux sources de financement et aux méthodes de collecte de fonds, telles que les rapports annuels et les états financiers;
c)quels sont les objectifs des opérations du client. À cette fin, les établissements devraient se référer à des informations telles que la déclaration de mission du client, la liste de ses programmes et de ses budgets, activités et services fournis;
d)quelles catégories de bénéficiaires bénéficient des activités du client (par exemple, réfugiés, entités juridiques qui reçoivent une assistance par l’intermédiaire des services de l’OBNL ou similaires). La documentation compilée à cette fin peut inclure des déclarations de mission ou des documents en lien avec la campagne;
e)les transactions que l’OBNL est susceptible de demander, en fonction de ses objectifs et de son profil d’activité, y compris le paiement du personnel ou des prestataires détachés à l’étranger, ainsi que la fréquence, la taille et la destination géographique envisagées de ces transactions. À cette fin, les établissements devraient se référer à des informations telles que les organigrammes, des explications sur la structure organisationnelle de l’OBNL, la liste des pays et territoires dans lesquels le personnel est rémunéré et le nombre de travailleurs à rémunérer dans chacun d’eux;
f)lorsque l’OBNL mène ses programmes et/ou ses opérations, en particulier si elle ne mène ses activités qu’au niveau national ou bien dans d’autres pays ou territoires associés à des risques BC/FT plus élevés et dans des pays tiers à haut risque. À cette fin, les établissements devraient se référer à des informations telles que la liste de tous les programmes, activités et services fournis par l’OBNL, ainsi que la liste des sites géographiques desservis, y compris son siège et ses zones opérationnelles. Les établissements devraient également évaluer, aux fins de l’orientation 8, si les transactions des OBNL sont susceptibles d’impliquer l’exécution de paiements avec un établissement d’un pays tiers. Facteurs de risque 4 2. Lorsqu’ils déterminent le risque associé aux clients qui sont des OBNL, les établissements devraient tenir compte au moins des facteurs de risque suivants et les évaluer en fonction de leur appréciation des risques: Gouvernance et exercice du contrôle
a)Le statut juridique de l’OBNL relève-t-il du droit national ou du droit national d’un autre État membre? Existe-t-il des documents qui définissent ses modalités de gouvernance et identifient les administrateurs de l’OBNL, les membres de l’organe directeur ou toute autre personne qui exerce un contrôle sur l’OBNL?
b)La structure juridique de l’OBNL nécessite-t-elle, pour sa mise en place, la démonstration de la capacité de gestion de son trésorier ou de ses dirigeants?
c)La structure juridique de l’OBNL exige-t-elle la publication annuelle des états financiers? Réputation/articles négatifs dans les médias
d)Dans quelle mesure est-il difficile pour les établissements d’établir la bonne réputation de l’OBNL et de ses dirigeants? Existe-t-il une bonne raison pour laquelle cela pourrait être difficile, par exemple parce que l’OBNL n’a été créée que récemment, par exemple au cours des 12 derniers mois?
e)L’OBNL a-t-elle été associée par des sources pertinentes, fiables et indépendantes à l’extrémisme, à la propagande extrémiste ou à des sympathies et activités terroristes?
f)L’OBNL a-t-elle été impliquée dans des activités délictueuses ou criminelles, y compris dans des cas liés au ML/TF, selon des sources pertinentes, fiables et indépendantes? Méthodes de financement
g)Le financement de l’OBNL est-il transparent et rapporté dans les comptes ou difficile à suivre? Documente-t-elle publiquement ses sources de financement et celles-ci font-elles l’objet d’audits externes?
h)Les méthodes de financement de l’OBNL comportent-elles des risques de BC/FT? Reposet-elle entièrement ou en grande partie sur des dons en espèces, des cryptoactifs ou un financement participatif? Ou bien les sources de financement de l’OBNL sont-elles acheminées par l’intermédiaire du système de paiements?
i)L’OBNL est-elle financée en partie ou en grande partie par des donateurs privés ou des donateurs relevant de juridictions associées à des risques plus élevés de BC/FT ou issus de pays tiers à haut risque connus pour présenter des carences stratégiques dans leur dispositif de LBC/FT? 5 Opérations dans des juridictions associées à des risques BC/FT plus élevés et des pays tiers à haut risque
j)L’OBNL agit-elle ou fournit-elle une assistance dans des pays ou territoires associés à des risques de BC/FT plus élevés (évalués sur la base des facteurs de risque présentés au titre I des présentes lignes directrices), dans des pays tiers à haut risque [recensés par la Commission conformément à l’article 9, paragraphe 2, de la directive (UE) 2015/849] ou dans des zones de conflit?
k)Dans de telles situations, l’OBNL s’appuie-t-elle sur des tiers ou des intermédiaires pour exercer ses activités et est-elle en mesure d’expliquer la nature de la délégation? Dans ce contexte, l’OBNL est-elle en mesure de contrôler et de surveiller de manière adéquate l’accomplissement des tâches par ces tiers?
l)La relation d’affaires avec l’OBNL est-elle susceptible d’impliquer l’exécution de transactions avec un établissement client situé dans des pays ou territoires associés à des risques plus élevés de BC/FT ou dans des pays tiers à haut risque? 3. Les établissements devraient au minimum tenir également compte des facteurs suivants susceptibles de contribuer à la réduction des risques:
a)les rôles et responsabilités de l’organe directeur de l’OBNL et de ses gestionnaires sont clairement documentés;
b)l’OBNL est légalement tenue de divulguer annuellement ses états financiers ou de publier un rapport annuel qui précise les sources des fonds, l’objectif principal des activités de l’OBNL et les catégories de bénéficiaires de ses programmes;
c)l’OBNL peut démontrer qu’elle fait ou a fait l’objet d’examens indépendants ou d’audits externes;
d)l’OBNL jouit d’une bonne réputation publique selon des sources pertinentes, fiables et indépendantes;
e)l’OBNL reçoit des fonds de gouvernements, d’organisations supranationales ou internationales qui ne sont pas associés à des pays tiers à haut risque ou à des pays ou territoires présentant des risques BC/FT plus élevés, et la source de ses fonds peut être clairement établie;
f)l’OBNL n’a aucun lien avec des pays tiers à haut risque ou, si elle en a, elle peut démontrer qu’elle a pris les mesures appropriées pour atténuer les risques BC/FT (par exemple, avec la désignation de personnel chargé de la conformité en matière de LBC/FT ou l’élaboration de procédures permettant d’identifier les catégories de bénéficiaires de l’OBNL et d’évaluer les risques BC/FT qui y sont associés);
g)les activités et les bénéficiaires de l’OBNL ne l’exposent pas à des risques BC/FT plus élevés; 6
h)l’OBNL ne fournit de l’assistance et du soutien aux personnes qu’au moyen d’une aide matérielle directe, telle que la mise à disposition d’équipements informatiques ou de dispositifs médicaux. 4. Dans le cas où l’OBNL mène des activités dans des pays et territoires soumis à des sanctions de l’UE ou des Nations unies, les établissements devraient déterminer si l’OBNL bénéficie de dispositions relatives à l’aide humanitaire et de dérogations aux régimes de sanctions financières de l’UE ou des Nations unies, telles que des exemptions ou des dérogations humanitaires. Lorsqu’ils décident de la manière de fournir des services à ces clients et conformément à leurs propres obligations en matière de gel des avoirs, les établissements devraient obtenir des preuves démontrant à suffisance que l’OBNL mène ses activités dans ces pays et territoires conformément aux exemptions prévues au régime, ou qu’elle bénéficie d’une dérogation accordée par une autorité compétente concernée. 5. Aux fins de la vérification initiale et tout au long de la relation d’affaires une fois qu’elle est établie, les établissements devraient prendre les mesures nécessaires pour comprendre la manière dont l’OBNL fonctionne et mène ses activités. Les établissements susceptibles d’avoir des clients OBNL, par exemple parce qu’ils fournissent des services de transfert d’argent ou des services de compte courant, devraient envisager de créer un point de contact dédié à cette catégorie spécifique de clients afin de bien comprendre la façon dont le secteur est organisé et fonctionne. 7 Circular CSSF 23/842 Adoption of the revised guidelines, by the EBA, on money laundering and terrorist financing risk factors – complement of Circular CSSF 21/782 Circular CSSF 23/842 Adoption of the revised guidelines, by the EBA, on money laundering and terrorist financing risk factors – complement of Circular CSSF 21/782 This circular shall apply to credit and financial institutions as defined in Article 1

(3)and

(3a)of Title I of Chapter 1 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended. Luxembourg, 16 October 2023 Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the European Banking Authority (“EBA”) guidelines amending (ref. EBA/GL/2023/03) (“amending Guidelines”) the EBA Guidelines on customer due diligence and the factors credit and financial institutions (“professionals”) should consider when assessing the money laundering and terrorist financing (“ML/TF”) risks associated with individual business relationships and occasional transactions (“Guidelines on ML/TF risk factors”) under Articles 17 and 18

(4)of Directive (EU) 2015/849 (EBA/GL/2021/02), published on 31 March

Consequently, the CSSF has integrated the amending Guidelines into its administrative practice and regulatory approach with a view to promoting supervisory convergence in this field at European level.
The Guidelines Indeed, following the publication, in January 2022, of an Opinion of the EBA on “de-risking” 1, which assessed the scale of de-risking in the EU, and the impact of the professionals’ decisions to refuse to enter into or to terminate business relationships with individual customers or categories of customers associated with higher ML/TF risks, among which not-for-profit organisations (NPOs), and the European Commission’s request to the EBA to issue new guidelines on the steps institutions should take to facilitate access to financial services by NPOs, the EBA prepared dedicated amending guidelines (EBA/GL/2023/03) regarding customers that are NPOs. These have now been added as an annex to the Guidelines on ML/TF risk factors and are referred to under Guideline 2 (Identifying ML/TF risk factors – Customer risk factors), paragraph 2.7.(d) of the main body of the Guidelines on ML/TF risk factors, as amended. The purpose of the annex is to support the professionals in their understanding of the specificities of prospective or existing customers that are NPOs. Thus, they clarify the steps that the professionals should undertake to get a good understanding of how an individual NPO is set up and operates and what factors the professionals should consider when assessing the ML/TF risk associated with a business relationship with customers that are NPOs. 1 Opinion of the European Banking Authority on ‘de-risking’ – CSSF CIRCULAR CSSF 23/842 2/3 The Guidelines are annexed to this circular and are also available on the EBA’s website at: https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guideline s/2023/1054143/Amending%20GLs%20to%20the%20RFGLs%20in%20relation%20to%20NPOs.p df The consolidated version of the Guidelines on ML/TF risk factors (EBA/GL/2021/02), as amended, is available on the EBA’s website at: https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guideline s/2023/EBA-GL-2023-03/1061654/Guidelines%20ML%20TF%20Risk%20Factors_conslidated.pdf This circular complements Circular CSSF 21/
Scope of application This circular shall apply to credit and financial institutions as defined in Article 1

(3)and

(3a)of Title I of Chapter 1 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended.

Date of application The Guidelines introducing the annex are applicable as of 3 November
Claude WAMPACH Director Françoise KAUTHEN Director Annex Marco ZWICK Director Jean-Pierre FABER Director Claude MARX Director General EBA/GL/2023/03 – Guidelines amending Guidelines EBA/2021/02 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18

(4)of Directive (EU) 2015/849 CIRCULAR CSSF 23/842 3/3 EBA/GL/2023/03 31 March 2023 Final Report Guidelines amending Guidelines EBA/2021/02 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18

(4)of Directive (EU) 2015/849 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO Contents

Executive summary 3
Background and rationale 4
Guidelines 6 1.Compliance and reporting obligation 8
Subject matter, scope and definitions 9
Implementation 9
Guideline on customers that are NPOs 9
Accompanying documents 13 2 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO
Executive summary De-risking refers to decisions made by credit and financial institutions to refuse to enter into or to terminate business relationships with individual customers or categories of customers associated with higher money laundering and terrorist financing (ML/TF) risk. In January 2022, the EBA published an Opinion on the scale and impact of de-risking in the EU.1 This Opinion identified the main drivers of de-risking and the negative impact unwarranted de-risking can have on customers, including not-for-profit organisations (NPOs). It also highlighted the steps competent authorities and co-legislators should take to address unwarranted de-risking and mitigate its negative impact. The European Commission welcomed the EBA’s Opinion and asked the EBA to issue guidelines on the steps institutions should take to facilitate access to financial services by those categories of customers that the EBA’s analysis had highlighted as particularly vulnerable to unwarranted derisking, in particular NPOs. These guidelines amend the Guidelines on ML/TF risk factors (EBA/GL/2021/02) and consist of an annex that sets out factors credit and financial institutions should consider when assessing the ML/TF risks associated with a business relationship with customers that are NPOs. Through these guidelines, the EBA fosters a common understanding by institutions and AML/CFT supervisors of effective ML/TF risk management practices and contribute to mitigate the adverse impact of de-risking on human relief efforts. Next steps The guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be two months after the publication of the translations. The guidelines will apply three months after publication in all EU official languages. 1 EBA/Op/2022/01 3 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO
Background and rationale .2.1 Background
In January 2022, the EBA published an Opinion on de-risking.2 It assessed the scale of de-risking in the EU, and the impact of credit and financial institutions’ decisions to refuse to enter into or to terminate business relationships with individual customers or categories of customers associated with higher money laundering and terrorist financing (ML/TF) risks. The EBA found that, across the EU, de-risking affected a variety of customers or potential customers of institutions, including not-for-profit organisations (NPOs). The EBA made clear that de-risking of entire categories of customers, without due consideration of individual customers’ risk profiles, may be unwarranted and a sign of ineffective ML/TF risk management.
The publication of the EBA Opinion on de-risking led the European Commission to ask the EBA to issue new guidelines on the steps institutions should take to facilitate access to financial services by NPOs. 3 This coincided with the outbreak of the war in Ukraine, which further demonstrated the adverse impact of de-risking on humanitarian relief.
To respond to the Commission’s request, the EBA prepared a dedicated annex on customers that are NPOs, which will be added to the Guidelines on ML/TF risk factors (EBA/GL/2021/02).
The EBA consulted the public on a version of these guidelines between 6 December 2022 and 6 February
It received 25 responses. .2.2 Rationale
The EBA is aware of reports that NPOs have faced difficulties in accessing financial services. These difficulties can lead to delays in programme delivery, and in some cases, the wind-down of programmes of NPOs. The EBA found in its Opinion on de-risking that the main drivers of credit and financial institutions’ decisions to de-risk NPOs or to restrict some of the services provided to them appeared to be related to institutions’ reluctance to service customers with links to jurisdictions that are associated with higher ML/TF risks or risks of breaching sanction regimes. The EBA also noted that institutions’ decisions to de-risk NPOs appeared to be related to the perceived complexities of their set-up and associated difficulties in obtaining the requisite customer due diligence (CDD) information.
To address these issues, the EBA proposes to add an annex to the Guidelines on risk factors. This annex will clarify the steps that institutions should undertake to get a good understanding of how an individual NPO is set up and operates, as well as the factors credit and financial 2 EBA/Op/2022/01 3 ARES

(2022)1932799 4 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO institutions should consider when assessing the ML/TF risks associated with a business relationship with customers that are NPOs. By clarifying regulatory expectations, the annex aims at supporting credit and financial institutions in their understanding of the specificities of prospective or existing customers that are NPOs. 5 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO 3. Guidelines 6 EBA/GL/2023/03 31 March 2023 Guidelines amending Guidelines EBA/2021/02 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18

(4)of Directive (EU) 2015/849 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO

Compliance and reporting obligations Status of these guidelines
This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/
In accordance with Article 16

(3)of Regulation (EU) No 1093/2010, competent authorities and credit and financial institutions must make every effort to comply with the guidelines. 2. Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4

(2)of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements 3. According to Article 16

(3)of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by [dd.mm.yyyy]. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2023/03’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA. 4. Notifications will be published on the EBA website, in line with Article 16

(3). 4 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12). 8 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO 2. Subject matter, scope and definitions Definitions 5. For the purposes of the amending guidelines, the following definition is added: Not-for-profit organisations A not-for-profit organisation is a legal person or arrangement or an organisation that primarily engages in raising or disbursing funds for purposes such as charitable, religious, cultural, educational, social or fraternal purposes. 3. Implementation Date of application 6. These guidelines will apply three months after publication in all EU official languages. 4. Guideline on customers that are NPOs Guideline 2. 7(

d)is replaced by the following: 2.7.(
d)Where the customer is a not-for-profit organisation (NPO), the firms should apply the criteria set out in the annex. The following annex is added: Annex: Customers that are NPOs 1. When assessing the risk profile of a customer or prospective customer that is an NPO for the first time, firms should ensure that they obtain a good understanding of the NPO’s governance, how it is funded, its activities, where it operates and who its beneficiaries are. Not all NPOs are 9 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO exposed in a similar way to ML/TF risk, and firms should take risk-sensitive measures to understand:
a)who controls the customer and who its beneficial owners are. As part of this, firms should identify the NPO’s trustees or equivalent, its governing body and any other individual who has control or influence over the NPO. For this purpose, firms should refer to information such as the legal status of the NPO, a description of the NPO’s governance set-up and/or a list of the legal representative(s).
b)how the NPO is funded (private donations, government funds, etc.). For this purpose, firms should refer to information about the donor base, funding sources and fundraising methods, such as annual reports and financial statements.
c)what the objectives of the customer’s operations are. For this purpose, firms should refer to information such as the customer’s mission statement, a list of its programmes and associated budgets, activities, and services delivered.
d)which categories of beneficiaries benefit from the customer’s activities (for example, refugees, legal entities that receive assistance through the services of the NPO or similar). Documentation gathered for this purpose may include mission statements or campaignrelated documents.
e)what transactions the NPO is likely to request, based on its objectives and activity profile, including payment of staff or providers posted abroad, and the expected frequency, size, and geographical destination of such transactions. For this purpose, firms should refer to information such as organisational charts, explanations of the organisational structure of the NPO, a list of jurisdictions where the staff is paid and the number of employees to be paid in each of them.
f)where the NPO conducts its programmes and/or operations, in particular whether the NPO conducts its activities only at domestic level, or in other jurisdictions associated with higher ML/TF risks and in high-risk third countries. For this purpose, firms should refer to information such as a list of all programmes, activities and services delivered by the NPO, as well as a list of geographical locations served, including its headquarters and operational areas. Firms should also assess, for the purposes of Guideline 8, whether the NPO’s transactions are likely to involve the execution of payments with a third-country institution. Risk factors 2. When identifying the risk associated with customers that are NPOs, firms should consider at least the following risk factors and assess them on a risk-sensitive basis: Governance and exertion of control
a)Does the NPO have a legal status under national law or the national law of another Member State? Is there any documentation that sets out its modalities of governance and identifies the NPO’s trustees, members of the governing body or any other individuals who exert control over the NPO? 10 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO
b)Does the legal structure of the NPO require, for its set up, the demonstration of the management capability of its treasurer or managers?
c)Does the legal structure of the NPO require the annual disclosure of financial statements? Reputation/adverse media findings
d)To what extent is it difficult for firms to establish the good reputation of the NPO and its managers? Is there a good reason why this may be difficult, for example because the NPO has been established only recently, for instance in the last 12 months?
e)Has the NPO been linked by relevant, reliable and independent sources to extremism, extremist propaganda or terrorist sympathies and activities?
f)Has the NPO been involved in misconduct or criminal activities, including ML/TF-related cases, according to relevant, reliable and independent sources? Funding methods
g)Is the NPO’s funding transparent and accountable or difficult to trace? Does it publicly document its funding sources and are these subject to external audits?
h)Do the NPO’s funding methods carry ML/TF risks? Does it rely entirely or largely on cash donations, crypto assets or crowdfunding? Or are the NPO’s sources of funds channelled through the payments system?
i)Is the NPO funded partly or largely by private donors or donors from jurisdictions associated with higher ML/TF risks or high-risk third countries identified as having strategic deficiencies in their AML/CFT regime? Operations in jurisdictions associated with higher ML/TF risks and high-risk third countries
j)Does the NPO operate or deliver assistance in jurisdictions associated with higher ML/TF risks (as assessed based on risk factors presented in Title I of these guidelines) or in highrisk third countries (as identified by the Commission pursuant to Article 9

(2)of Directive (EU) 2015/849) or in conflict zones?

k)In such situations, does the NPO rely on third parties or intermediaries to perform its activities and is it able to explain the nature of the discharge? In this context, is the NPO able to monitor and have adequate oversight of the discharge by these third parties?
l)Is the business relationship with the NPO likely to involve the execution of transactions with a respondent institution located in jurisdictions associated with higher ML/TF risks or in high-risk third countries? 11 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO 3. Firms should also consider at least the following factors that may contribute to reducing risks:
a)The roles and responsibilities of the NPO’s governing body and its managers are clearly documented.
b)The NPO is legally required to annually disclose its financial statements or to issue an annual report that identifies the sources of funds, the main purpose of the NPO’s activities and the categories of beneficiaries of its programmes.
c)The NPO can demonstrate it is or has been subject to independent reviews or external audits.
d)The NPO has a good public reputation according to relevant, reliable and independent sources.
e)The NPO receives fundings from governments, supranational or international organisations that are not associated with high-risk third countries or with jurisdictions with higher ML/TF risks, and the source of its funds can be clearly established.
f)The NPO does not have any links with high-risk third countries, or if it has, the NPO can demonstrate that it has taken appropriate steps to mitigate the ML/TF risks (for instance, with the designation of staff responsible for AML/CFT compliance or the design of procedures to identify the NPO’s categories of beneficiaries and assess the ML/TF risks associated therewith).
g)The NPO’s activities and beneficiaries do not expose it to higher ML/TF risks.
h)The NPO only delivers assistance and support to individuals through direct material help, such as providing IT equipment or medical devices. 4. In the event the NPO is conducting activities in jurisdictions subject to EU or UN sanctions, firms should establish whether the NPO benefits from any provisions related to humanitarian aid and derogations in EU/UN financial sanctions regimes, such as humanitarian exemptions or derogations. When deciding how to service these customers and in accordance with their own asset freezing obligations, firms should obtain evidence that provide reasonable assurance that the NPO conducts its activities in these jurisdictions in line with the exemptions provided in the regime, or that it benefits from a derogation granted by a relevant competent authority. 5. For initial screening purposes and throughout the business relationship once it is established, firms should take the steps necessary to understand how the NPO operates and conducts its operations. Firms that are likely to have NPO customers, for example because they provide money transfer services or current account services, should consider establishing a dedicated contact point for this specific category of customers to have a good understanding of the way the sector is set up and operates. 12 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO 4. Accompanying documents .4.1 Cost-benefit analysis / impact assessment As per Article 16

(2)of Regulation (EU) No 1093/2010 (EBA Regulation), any guidelines and recommendations developed by the EBA must be accompanied by an impact assessment (IA), which analyses ‘the potential related costs and benefits’. This analysis presents the IA of the main policy options included in this consultation paper on the draft guidelines amending Guidelines EBA/GL/2021/02 (‘the ML/TF Risk Factors Guidelines’ or ‘RFGLs’) on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions under Articles 17 and 18

(4)of Directive (EU) 2015/849 (‘The Draft Guidelines amending the RFGLs’ or ‘The Draft Guidelines’). The IA is at a high level and qualitative in nature. A. Problem identification and background In January 2022, the EBA published an Opinion on de-risking in which it assessed the scale and impact of de-risking in the EU5. De-risking in this context refers to decisions by credit and financial institutions to refuse to enter into or decisions to terminate business relationships with individual customers or categories of customers associated with higher money laundering and terrorist financing (ML/TF) risks. The EBA found that, across the EU, de-risking affected a variety of customers or potential customers of institutions. The EBA made clear that de-risking of entire categories of customers, without due consideration of individual customers’ risk profiles, may be unwarranted and a sign of ineffective ML/TF risk management. This Opinion led the European Commission to ask the EBA in a letter dated March 2022 to issue guidelines to ‘broaden the scope of such guidelines beyond the interaction of AML and Payment Accounts Directive (PAD) requirements, such as the de-risking related to the non-profit sector’. The Draft Guidelines are related to the non-profit sector. Following the Commission’s request, the EBA assessed existing EBA guidance, in particular its ML/TF RFGLs, which were revised in March 2021. The EBA performed a gap analysis to establish how best to respond to the Commission’s request without duplicating existing provisions. On this basis, the EBA recognised that several aspects would indeed benefit from further regulatory clarifications, as it pointed out in its Opinion on de-risking. In particular, the EBA assessed that one area in which new guidance would be necessary is the area related to NPO customers. That is because NPOs, 5 Opinion of the European Banking Authority on ‘de-risking’, EBA/Op/2022/01. 13 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO which are legal entities, are not covered by the rights provided by Directive 2014/92/EU (the Payment Accounts Directive). As such, following this gap analysis and to respond to the Commission’s request without duplicating existing provisions, the EBA, having consulted with the competent authorities that are responsible for the AML/CFT supervision of financial institutions, is proposing to add an annex to the ML/TF RFGLs, focusing on customers that are NPOs (‘The draft Guidelines amending the RFGLs’). B. Policy objectives The draft Guidelines amending the RFGLs aim to support credit and financial institutions in their understanding of the specificities of prospective or existing customers that are NPOs and in their assessment of the ML/TF risks associated with such customers. The draft guidelines amending the RFGLs, therefore, clarify the steps that institutions should take to get a good understanding of how an individual NPO is set up and operates, as well as the factors they should consider when assessing the ML/TF risks associated with a business relationship with customers which are NPOs. This is key to ensuring that financial institutions assess the risks associated with NPOs in an efficient and comprehensive manner and determine the types of transactions that will be expected in the course of the business relationship in order to avoid delays in transfers of funds, for instance. C. Options considered, assessment of the options and preferred options Section C presents the main policy options discussed and the decisions made by the EBA during the development of the Draft Guidelines amending the RFGLs. The advantages and disadvantages, as well as potential costs and benefits from the qualitative perspective of the policy options and the preferred options resulting from this analysis are outlined. Add a specific section for NPO The difficulties faced by NPOs in accessing financial services have been highlighted by several international reports.6 These difficulties were also reported to the EBA during the series of information gathering exercises that it conducted in 2020-2021, in which NPOs raised the fact that they experienced obstacles to accessing financial services, such as the being unable to open bank account or facing extensive delays in cash transfers in certain high-risk jurisdictions. NPOs also indicated to the EBA that the reason for these difficulties was a stricter and risk-adverse application by the institutions of the AML/CFT requirement. On the other hand, some institutions reported to EBA that they indeed 6 FATF, COMBATING THE ABUSE OF NON-PROFIT ORGANISATIONS (RECOMMENDATION 8) 2015; NYU Paris EU Public Interest Clinic, Bank De-Risking of Non-Profit Customers, 2021 14 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO refused to provide financial services to NPOs because it was often difficult for them to understand their business model and structure, which can be very complex. Based on these observations, two options have been envisaged by the EBA: Option 1a: Adding a section in the RFGLs to guide institutions on conducting their due diligence of customers that are NPOs. Option 1b: Not adding a section in the RFGLs to guide institutions on conducting their due diligence of customers that are NPOs. As detailed in the EBA’s Opinion on de-risking, one of the main reasons mentioned by institutions for de-risking NPOs is that it is difficult to understand the NPOs’ structures and business models. Another key driver of the de-risking of NPOs is the fact that some of them have operations in highrisk jurisdictions. De-risking of NPOs has several consequences. For example, NPOs may struggle to access a bank account in order to operate or face difficulties in transferring funds in certain jurisdictions where the NPO operates. This has an impact on NPOs’ activities and the delivery of their programmes. In view of these challenges, which are very specific to this group of customers, the EBA saw merits in drafting guidelines dedicated to NPOs as part of the RFGLs. It should be stressed that NPOs’ activities are essential for providing support and relief not only within the EU, but also across the globe. This includes the delivery of humanitarian aid in the context of war or natural disasters, as well as medical assistance and the provision of basic services to populations in need. While international reports highlight the fact that NPOs can be abused for terrorist financing purposes, not all NPOs are exposed to these risks, and the extent to which these risks can materialise varies greatly across NPOs. ML/TF risks associated with customers that are NPOs must therefore be carefully assessed. For the institutions, such individual risk assessment would require additional time to understand the business model of each NPO, thus incurring costs. However, this additional time would be compensated by the proposed new section in the RFGLs that provides guidance on the risk factors to consider when dealing with customers that are NPOs. Similarly, the EBA’s proposition to encourage financial institutions to have a dedicated contact point for NPOs, even though this could potentially incur initial costs in terms of resources and training, would facilitate and speed up this process and thus decrease related costs in the long term. Finally, costs will be exceeded by the reputational gain for the financial sector from serving a sector that is not for profit and whose aim is to provide support to populations in need. This will compensate for the often low level of financial income resulting from NPO relationships. For all these reasons, Option 1a has been chosen as the preferred option. 15 FINAL REPORT ON GUIDELINES AMENDING THE ML/TF RISK FACTORS GUIDELINES IN RELATION TO NPO D. Conclusion The development of the Draft Guidelines amending the RFGLs is necessary to provide specific support to institutions for the due diligence of NPOs, which often have a very complex structure and business model. These new guidelines will improve the due diligence process required at the onboarding stage and in the course of the business relationship, and ultimately will help to improve the social impact of credit and financial institutions. The costs associated with more granular, tailored customer due diligence policies and procedures will be more than offset by the aforementioned benefits. Hence, these new guidelines should achieve their objective of providing better and fairer access to financial services with acceptable costs. .4.2 Feedback on the public consultation The EBA consulted the public on the draft proposal contained in this paper. The consultation period lasted for two months and ended on 6 February 2023. 24 responses were received, of which 20 were published on the EBA website. Respondents came from various backgrounds: credit and financial institutions, representatives of NPOs and representatives of NPO umbrella organisations. Several industry bodies made similar comments, or the same body repeated its comments in response to different questions. In such cases, the comments and the EBA analysis are included in the feedback table where the EBA considers appropriate. Changes to the draft guidelines have been incorporated as a result of the responses received during the public consultation. The amendments mainly clarify that: • information should be provided in relation to categories of beneficiaries, not the beneficiaries themselves • when identifying the risk associated with customers that are NPOs, firms should do this on a risk-sensitive basis • where an NPO receives funds from government, supranational or international organisations that are not linked with high-risk third countries or jurisdictions associated with higher ML/TF risks, this may be considered as a factor that reduces ML/TF risk Some amendments have also been made to improve alignment with the EBA’s Guidelines on ML/TF risk factors. The following table presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments, and the actions taken to address them if deemed necessary. 16 Final report – Guidelines amending the ML/TF risk factors guidelines in relation to NPOs Summary of responses to the consultation and the EBA’s analysis Amendments to the GLs on ML/TF risk factors: Do you have any comments regarding the proposed annex on NPOs as part of the GLs on ML/TF risk factors? Guideline Summary of responses received EBA analysis Amendments to the proposal General comment A respondent recommended that the EBA could consider adding a legal entity identifier as a full requirement for customer due diligence. Given that Directive (EU) 2015/849 (AMLD) does not contain the requirement for firms to obtain legal entity identifiers (LEIs), the EBA does not require their usage in these Guidelines either. None General comment Several respondents recommended that the EBA should add an extra section to the annex addressed to national competent authorities (NCAs) about communication with NPOs. These guidelines are primarily addressed to firms. Competent authorities should use these guidelines when assessing the adequacy of firms’ risk assessments and AML/CFT policies and procedures. The EBA has already covered CAs’ engagement with the NPO sector and its interaction with firms, in particular as part of the report on de-risking that it published in January 2022. None General comment One respondent said that it is unlikely that NPOs take out life insurance policies for investment purposes. The respondent is therefore of the view that due diligence measures as described in the annex would not be proportionate. These guidelines should be applied on a risk-sensitive basis. This means that in lower-risk situations, firms can apply simplified due diligence (SDD) measures in line with the general provisions and sectoral guidance in these guidelines. None General comment One respondent claimed that the due diligence process required at the onboarding stage of NPOs was unreasonable and in conflict with Article 16 EU Charter of Fundamental Rights, which recognises the freedom to conduct a business. Due diligence is a requirement of the AMLD, and Article 11 requires entities subject to the directive to apply customer due diligence measures when establishing a business relationship, including with NPOs. None Definitions One respondent asked the EBA to clarify the difference between NPOs and NGOs. The EBA has aligned its definition of NPOs with the one used by the FATF. None 17 Final report – Guidelines amending the ML/TF risk factors guidelines in relation to NPOs Amendments to the GLs on ML/TF risk factors: Do you have any comments regarding the proposed annex on NPOs as part of the GLs on ML/TF risk factors? Paragraph 9 Several respondents noted that not all information and documentation listed in the paragraph is necessary in all cases and that the need to obtain them in line with a risk-based approach should be recognised. A suggestion was therefore to change ‘should refer’ mentioned in 9a) to

f)into ‘may refer’. Paragraph 9 is already clear that ‘not all NPOs are exposed in a similar way to ML/TF risk’ and that firms should take ‘risk-sensitive measures’ to understand the NPO’s governance, how it is funded, its activities, where it operates, and who its beneficiaries are. None Paragraph 9 Several respondents said that the types of information about the beneficiaries that can be requested by credit and financial institutions should be clarified. It was indicated that humanitarian organisations cannot share the list of individual beneficiaries with banks as they operate in accordance with International Humanitarian Law, which states that they must provide assistance based on people’s needs alone, without distinction. Similar concerns were raised in relation to NPOs’ staff, as the required list of staff may endanger these persons if they are based in conflict zones for instance. The respondents also felt that sharing such details with banks would raise data protection concerns. The EBA agrees with the comments and has amended the guidelines as follows: Amendment of Paragraph 1.d. and 1.e. [paragraph 1.d. of the final version] which categories of beneficiaries benefit from the customer’s activities (e.g. refugees, legal entities that receive assistance through the services of the NPO or similar) who the beneficiaries of the customer’s activities are. Documentation gathered for this purpose may include mission statements or campaign-related documents. 1.e. what transactions the NPO is likely to request, based on its objectives and activity profile, including payment of staff or providers posted abroad, and the expected frequency, size, and geographical destination of such transactions. For this purpose, firms should refer to information such as organisational charts, explanations of the organisational structure of the NPO, a list of jurisdictions where the staff is paid and the number of employees to be paid in each of them. staff and beneficiaries for each of its activities. The new drafting also alleviates concerns over data protection issues. Paragraph 10 Several respondents were of the view that the risk factors listed in paragraph 10 do not need to be considered in all cases. For instance, to establish the risk profile of newly established or small NPOs, there may not be a need to assess their reputation and obtain evidence of their management capability or annual reports/financial statements. A suggestion was to redraft the start of paragraph 10 as follows: ‘The The EBA is of the view that the risk factors listed in this paragraph are all relevant to establish a risk profile. However, the EBA agrees that the level of details to identify each of the risk factors should be determined following a risk-based approach. Therefore, to clarify this further, the EBA has amended the guidelines as follows: Amendment of paragraph 2 [Paragraph 2 of the final version] When identifying the risk associated with customers that are NPOs, firms should consider at least the following risk 18 Final report – Guidelines amending the ML/TF risk factors guidelines in relation to NPOs Amendments to the GLs on ML/TF risk factors: Do you have any comments regarding the proposed annex on NPOs as part of the GLs on ML/TF risk factors? following risk factors may be relevant to consider when identifying the risk associated with clients that are NPOs.’ factors and assess them on a risk-sensitive basis. consider at least the following risk factors Paragraph 10 a., b. and c. One respondent asked for a more precise and framed definition of ‘good reputation’. (Governance and exertion of control) Another respondent was of the view that a lack of legal status should not be considered an increased risk for ML/TF, as within certain contexts registration may not be possible due to reasons such as a lack of state mechanisms to legalise NGOs, laws that ban the registration of NPOs, politically motivated restrictions on some NPOs and concerns about security. Less established yet credible NPOs may also have fewer resources to comply with the burdensome registration requirements. Guideline 2.5. of the general section of the Guidelines on ML/TF risk factors, to which the Guidelines on NPOs are annexed, provides a list of risk factors that may be relevant when identifying the risk associated with a customer’s reputation. None Regarding the second comment related to legal status, the EBA notes that it would be unlikely that a credit or financial institution would agree to serve an NPO without any legal status. NPOs are legal entities, and this status requires formalised set-ups in the EU. Regarding the third comment, the EBA is of the view that this aspect is covered in paragraph 11.f. of the guidelines, which specifies the factors that would decrease the risks associated with an NPO. Several respondents suggested adding a section that recommends reviewing the due diligence and risk management procedures that NPOs have in place and considering the risk mitigants NPOs operating in higher-risk jurisdictions have put in place to reduce or manage risk. Paragraph 10.e (Reputation/adverse media findings) Several respondents were concerned that these paragraphs did not account for the fact that NPOs can be the target of smear campaigns, even by the governments of the jurisdictions in which they operate. In this context, the terms ‘relevant, reliable and independent’ may not be sufficiently clear and should be better contextualised. Guidelines 1.29 to 1.32 of the general section of the Guidelines on ML/TF risk factors, to which the Guidelines on NPOs are annexed, provide examples of sources of information that can be used to identify ML/TF risk. The guidelines are clear that firms should refer to information from a variety of sources and should not normally rely on only one source to identify ML/TF risk. Potential sources include information from civil society, such as corruption indices and country reports, and information from credible and reliable open sources, such as reports in reputable newspapers. None Paragraph 10.f. Several respondents were of the view that the focus of these guidelines should be on (predicate offences
to)ML and TF. To clarify this paragraph and to align it with the amendment introduced in paragraph 10.e., paragraph 10.f. is amended as follows: Amendment of paragraph 2.f. 19 Final report – Guidelines amending the ML/TF risk factors guidelines in relation to NPOs Amendments to the GLs on ML/TF risk factors: Do you have any comments regarding the proposed annex on NPOs as part of the GLs on ML/TF risk factors? (Reputation/adverse media findings) [Paragraph 2.f. of the final version]: … has the NPO been involved in misconduct or criminal activities, other crimes, including ML/TF-related activities, according to relevant, reliable and independent sources? Paragraph 10.g.,h.,i. (Funding methods) In relation to crypto assets and crowdfunding referred to in 10.h., several respondents requested further clarification as to why this is different to the risk profiles of other customers receiving funds from similar sources. The EBA is of the view that the transparency of NPOs’ funding methods and sources of funds is a prerequisite to assessing ML/TF risks. In this context, funds obtained through crowdfunding or in the form of crypto assets carry specific risks, in particular in relation to the risks arising from the borderless situation and anonymity these allow. Sectoral Guideline 17 of the Guidelines on ML/TF risk factors has more details on this point. The Guidelines on ML/TF risk factors will also be amended to include a sectoral guideline for crypto assets service providers (CASPs). None Paragraph 10.k. One respondent was of the view that the use of third parties or intermediaries is a standard approach in humanitarian work. Therefore this should not be viewed as a higher risk factor. The guidelines recognise that third parties or intermediaries may be used by NPOs. The guidelines specify that in such situations, it is nevertheless expected that an NPO is able to explain the nature of contractual performance and how it can monitor it. None Paragraph 11 Several respondents recommended that sectoral self-regulation, which can include measures that help mitigate risk (including understanding of TF risk itself), should be recognised as a risk-decreasing factor. The EBA recognises that representational and self-regulatory organisations can play a role in the protection of the sector against a range of abuses. However, as their set-ups and level of independence can vary across jurisdictions, the EBA does not consider they can be considered – on their own – as decreasing the risk of misuse by terrorist groups. None (Factors that decrease the ML/TF risks) Another respondent also suggested that one category of NPOs that could be considered as presenting a low risk is the NPOs that engage in expressive activities and not in raising or disbursing funds. Paragraph 11.e. Several respondents asked for further clarification to reflect the diversity of donors and suggested specifying that funding As regards the second comment, the EBA notes that NPOs engaged in ‘expressive activities’ are not immune to ML/TF risks. Guideline 10.f. is clear that if an NPO can be linked to extremism, extremist propaganda or terrorist sympathies, this should be considered as a risk-increasing factor. The EBA has amended the paragraph as follows: 3.e. [of the final version] The NPO receives funds from government, supranational or international organisations that are not associated with high- Amendment of paragraph 3.e. 20 Final report – Guidelines amending the ML/TF risk factors guidelines in relation to NPOs Amendments to the GLs on ML/TF risk factors: Do you have any comments regarding the proposed annex on NPOs as part of the GLs on ML/TF risk factors? received from governments from high-risk third countries should not be considered as a risk-reducing factor. risk third countries or with jurisdictions with higher ML/TF risks, and the source of funds can therefore be clearly established. Other respondents have stated that NPOs should not be expected to screen their beneficiaries, as these would be contrary to humanitarian law. To reflect this point and ensure consistency with the amendment in paragraph 10, the EBA has amended the paragraph as follows: Paragraph 11.h. A respondent said that humanitarian assistance is not limited to material support and that evidence has shown that cash assistance can be the most effective method to respond to some humanitarian needs. In the respondent’s view, banks should understand that cash assistance can be the best method to respond to people’s needs and they should consider the risk management and due diligence process that an organisation has in place when providing cash assistance. The use of cash carries inherent risks and cannot be considered as a method presenting low ML/TF risks. While the EBA recognises that cash assistance is an important means to provide humanitarian assistance, it is also of the view – and in line with the FATF – that when cash is used, it should be done appropriately and in line with international and national laws and regulations, including cash declaration and/or cash disclosure requirements to promote greater transparency and accountability of the funds. None Paragraph 12 Several respondents noted that this paragraph could say more about what kind of evidence a financial institution might be able to obtain, and how, to get assurance that an NPO is operating within the scope of an applicable exemption from the sanctions regime. The EBA notes that there are no standardised types of evidence across the EU that can be requested from NPOs to demonstrate they benefit from any provisions related to humanitarian aid and derogations in EU/UN financial sanctions regimes, such as humanitarian exemptions or derogations. Regarding EU sanctions, the EBA notes that firms can refer to the factsheet issued by the European Commission outlining the most common rules and procedures in place in different Member States when assessing requests and granting humanitarian derogations under EU sanctions regulations. None Paragraph 11.f. (Activities in jurisdictions subject to EU or UN sanctions) Amendment of paragraph 3.f. 3.f. [of the final version] The NPO does not have any links with high-risk third countries, or if it has, the NPO can demonstrate that it has taken appropriate steps to mitigate the ML/TF risks (for instance, with the designation of staff responsible for AML/CFT compliance or the design of procedures to identify the NPO’s categories of beneficiaries and assess the ML/TF risks associated therewith). In addition, when sanctions are issued, for example by the EU or the UN, there are some areas of derogations that are published for the purpose of humanitarian interventions and that apply to all NPOs. These derogations are made public so that credit and financial institutions can also consult 21 Final report – Guidelines amending the ML/TF risk factors guidelines in relation to NPOs Amendments to the GLs on ML/TF risk factors: Do you have any comments regarding the proposed annex on NPOs as part of the GLs on ML/TF risk factors? them. The European Commission’s Directorate General for civil protection and humanitarian aid operations has further information on this point. Paragraph 13 (contact point for NPOs) Some respondents recommended that the contact points referred to in paragraph 13 should receive training to gain adequate knowledge of NPOs’ structures and contexts. Paragraph 9 of the guidelines already provides that firms should ensure that they obtain a good understanding of the NPO’s governance, how it is funded, its activities, where it operates, and who its beneficiaries are. The EBA is of the view that it should be for firms to decide how best to ensure this. None 22

🔗 Vers la source officielle

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.