The Anti-Money Laundering (AML) Directive - guide to businesses

Why do we need Anti-Money Laundering (AML) laws and regulations?

Anti-money laundering laws and regulations exist to prevent money being made from criminal activities being used in the rest of society. Fundamentally, the law exists in order to make it more difficult to commit crimes, such as tax avoidance and financial fraud. The law is also intended to prevent the financing of terrorism.

All EU and EEA countries have their own anti-money laundering laws and regulations. However, they’re all formed by EU directives which are formed and approved by the European Parliament. The EU has, at the current moment, created six different directives regarding money laundering. In technical terminology they’re referred to as AML 1-6. AML is an abbreviation for ‘anti-money laundering.’

EU directive

A directive is a legal act decreed by the European Union. The directives are binding for member states and members of the European Economic Area (EEA). However, the countries themselves decide on how to implement the directive in national laws and regulations.

How do EU directive and national laws interact?

Whenever the European Parliament issues a directive, the individual member states have a period where they’re required to implement the directive in local legislation. This typically happens by making adjustments in pre-existing laws and/or issuing new executive orders.

The work involved in implementation typically stretches over a longer period, and not all countries implement the law concurrently or similarly. This creates some debate between countries, as it leads to situations arising where it might be more beneficial to set up a financial license in one place and then delivering your products to the remaining countries.

EU’s expert groups

The development of AML-directives involves a number of different professions, interest groups, legal experts as well as local regulatory agencies.

NewBanking has since 2015 been represented in one of the EU’s payment systems market expert groups (PSMEG) by our CEO, Christian Visti Larsen, who has assisted in developing AML 5.

What happens if businesses don’t uphold the law?

There’s a difference between how the individual regulatory agencies communicate the activities and issues they might uncover when supervising businesses.

At times these can be in the form of regulatory AML reports that specify criticisms, injunctions and even reports to the police. These reports are typically publicly available on their websites, and it’s often required that the reports are displayed on the businesses’ own websites.

If a business is caught not living up to their obligations, it doesn’t necessarily result in a fine. However, the business will rarely be able to avoid penalties or a trip to the metaphorical pillory. For businesses that depend on their good name and reputation, this can be much worse than a fine.

Penalties

The regulatory agencies can rarely issue fines but they are able to report the company in violation of AML laws to the local police department for criminal financial activities. This then results in a police investigation that can lead to a public trial. However, it’s possible for the agency to issue administrative fines in simple cases where the business admits to wrongdoing.

AML 5: The risk-based approach

The latest directive, AML 5, was passed in 2017 and widely adopted by januar 2020. With this directive we transitioned to a risk-conditional approach to anti-money laundering (AML) precautions – an approach that requires more from businesses’ assessment of their client relations.

Businesses now need to assess the individual risk, from each client, of being used for money laundering or financing of terrorism. Some of the central and fundamental elements in the new AML directive is:

• Risk assessments
• Policies
• Business procedures

It’s all up to the business to develop and implement these requirements. Below, we explain what each element entails. Furthermore, you need to create a description of how you audit and supervise each activity, so you’re certain the law is being upheld.

The risk-based approach results in a much greater focus on verification of identity and ongoing KYC checks.

Policies

A business’ policies describe their overall appetite for risk. This policy will often include descriptions of:

• Which types of clients you want to do business with
• Which types of clients you don’t want to do business with

It will typically be management who outline and develop these policies which are then approved by the board of directors. One of the primary reasons for this is that it forces leaders to acknowledge and actively decide on the risks associated with running the business. In this way no one in the business can acquiesce their responsibilities or wash their hands of wrongdoing if problems arise.

Policies also define the area within which the employees operate without needing constant approval from upper management.

Policies

A business’ policies describe their overall approach and capacity for risk. Policies are created by upper management and approved by the board of directors.

Audits and verification

Audits and verification always have to be documented. It’s useless to perform verification if you can’t subsequently prove it took place.

A typical mistake in this process involves manual verification of copies of passports or driver’s licenses. To counter this, a business procedure could prescribe that the employee has to go through the documents and ensure that the ID is valid and of such a quality that they can subsequently identify the client. But if there’s no documentation that this has happened, the audit is not considered to have transpired regardless of whether or not the employee actually looked through the documents.

AML 6: New requirements coming

All the previous requirements have a common denominator: they require established procedures and verification processes on each individual client. A secure procedure and verification of client relations can only be ensured if there’s sufficient documentation that it took place.

If you don’t follow the rules it can have grave repercussions for your business. Aside from the already comprehensive demands, you can be subject to increased supervision and thus further requirements. This is a field with a massive political and societal interest and scrutiny, which is why it’s just good business to know the rules and be at the forefront.

The latest edition, AML 6, is scheduled to be implemented in all member states by December 3rd 2020 and go into effect for business by June 3rd 2021. With AML 6 multiple elements will be expanded upon with an emphasis on fines and sanctions.