Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 (Text with EEA relevance)

CHAPTER I ESTABLISHMENT, LEGAL STATUS AND DEFINITIONS

Article 1

Establishment and scope of action

• (a) preventing the use of the Union’s financial system for the purposes of money laundering and terrorist financing (‘ML/TF’);

• (b) contributing to the identification and assessment of ML/TF risks and threats across the internal market, as well as risks and threats originating from outside the Union that impact, or have the potential to impact, the internal market;

• (c) ensuring high-quality supervision in the area of anti-money laundering and countering the financing of terrorism (‘AML/CFT’) across the internal market;

• (d) contributing to supervisory convergence in the area of AML/CFT across the internal market;

• (e) contributing to the harmonisation of practices in the detection of suspicious transactions or activities by Financial Intelligence Units (‘FIUs’);

• (f) supporting and coordinating the exchange of information between FIUs, and between FIUs and other competent authorities.

The provisions of this Regulation are without prejudice to the powers of the Commission, in particular pursuant to Article 258 TFEU, to ensure compliance with Union law.

Article 2

Definitions

• (1) ‘selected obliged entity’ means a credit institution, a financial institution, or a group of credit institutions or financial institutions at the highest level of consolidation in the Union in accordance with applicable accounting standards, which is under direct supervision by the Authority pursuant to Article 13;

• (2) ‘non-selected obliged entity’ means a credit institution, a financial institution, or a group of credit institutions or financial institutions at the highest level of consolidation in the Union in accordance with applicable accounting standards, other than a selected obliged entity;

• (3) ‘AML/CFT supervisory system’ means the Authority and the supervisory authorities in Member States;

• (4) ‘non-AML/CFT authority’ means:
• (a) a competent authority as defined in Article 4(1), point (40), of Regulation (EU) No 575/2013 of the European Parliament and of the Council ([^E0001]);
• (b) the European Central Bank (ECB), when it carries out the tasks conferred on it by Regulation (EU) No 1024/2013;
• (c) a resolution authority designated in accordance with Article 3 of Directive 2014/59/EU;
• (d) a designated authority as defined in Article 2(1), point (18), of Directive 2014/49/EU;
• (e) a competent authority as defined in Article 3(1), point (35), of Regulation (EU) 2023/1114.

Article 3

Legal status

Article 4

Seat

The Authority shall have its seat in Frankfurt am Main, Germany.

CHAPTER II TASKS AND POWERS OF THE AUTHORITY

SECTION 1 Tasks and powers

Article 5

Tasks

• (a) monitor developments across the internal market and assess threats, vulnerabilities and risks in relation to ML/TF;

• (b) monitor developments in third countries and assess threats, vulnerabilities and risks in relation to their AML/CFT systems that have an actual or potential impact on the internal market;

• (c) collect and analyse information, from its own supervisory activities and those of the supervisors and supervisory authorities, on weaknesses identified in the application of AML/CFT rules by obliged entities, the risk exposure of obliged entities, the sanctions imposed and the remedial actions taken;

• (d) establish a central AML/CFT database of information collected from supervisory authorities or stemming from the Authority’s activities, and keep it up to date;

• (e) analyse the information collected in the central database and share those analyses with supervisors, supervisory authorities and non-AML/CFT authorities on a need-to-know and confidential basis;

• (f) support the analysis of risks of ML/TF and of non-implementation and evasion of targeted financial sanctions affecting the internal market, referred to in Article 7 of Directive (EU) 2024/1640;

• (g) support, facilitate and strengthen cooperation and exchange of information between obliged entities and supervisors, supervisory authorities and non-AML/CFT authorities in order to develop a common understanding of ML/TF risks and threats facing the internal market, including by participating in partnerships for information sharing in the field of AML/CFT;

• (h) issue publications and provide training, as well as other services on demand, in order to raise awareness of, and address, ML/TF risks;

• (i) report to the Commission any instances where the Authority, in the performance of its tasks, discovers that a Member State has transposed Directive (EU) 2024/1640 incorrectly or incompletely;

• (j) undertake any other specific task set out in this Regulation or in the other legislative acts referred to in Article 1(2);

• (k) assist the Commission in reviewing the application of the relevant regulatory and implementing technical standards adopted by the Commission, review the application of the guidelines and recommendations issued by the Authority and propose amendments, where appropriate, including amendments to:
• (i) remove redundant or obsolete reporting requirements and minimise costs while preserving data usability and quality;
• (ii) ensure proportionate and consistent reporting requirements; and
• (iii) address regulatory gaps related to reporting requirements.

• (a) ensure compliance of the selected obliged entities with the requirements applicable to them pursuant to Regulation (EU) 2024/1624 and Regulation (EU) 2023/1113, including obligations related to the implementation of targeted financial sanctions;

• (b) carry out supervisory reviews and assessments at the level of individual entities and at group-wide level in order to determine whether the internal policies, procedures and controls put in place by the selected obliged entities are adequate to comply with the requirements applicable to them, and on the basis of those supervisory reviews and assessments impose specific requirements, apply administrative measures and impose pecuniary sanctions and periodic penalty payments pursuant to Articles 21, 22 and 23;

• (c) participate in group-wide supervision, in particular in AML/CFT supervisory colleges, including where a selected obliged entity is part of a group that has headquarters, subsidiaries or branches outside the Union;

• (d) develop and keep up to date a system to assess the risks and vulnerabilities of the selected obliged entities, in order to inform the supervisory activities of the Authority and the supervisory authorities, including through the collection of data from those entities by means of structured questionnaires and other online or offline tools.

• (a) maintain an up-to-date list of financial supervisors within the Union;

• (b) carry out periodic assessments to ensure that all financial supervisors have adequate resources, powers and strategies necessary for the performance of their tasks in the area of AML/CFT, and make the results of such assessments available;

• (c) take, in response to a request by financial supervisors for the Authority to assume direct supervision or on the Authority’s own initiative, appropriate measures in exceptional circumstances requiring the Authority’s intervention and related to non-selected obliged entities’ compliance or risk exposure;

• (d) facilitate the functioning of the AML/CFT supervisory colleges in the financial sector;

• (e) contribute, in collaboration with financial supervisors, to the convergence of supervisory practices and the promotion of high supervisory standards in the area of AML/CFT, including in relation to verification of compliance with AML/CFT requirements related to targeted financial sanctions;

• (f) coordinate staff and information exchanges among financial supervisors in the Union in the area of AML/CFT;

• (g) provide assistance, in the area of AML/CFT, to financial supervisors, following their specific requests, including requests to mediate between financial supervisors;

• (h) settle, with binding effect, disagreements between financial supervisors concerning the measures to be taken in relation to an obliged entity, including in the context of AML/CFT supervisory colleges, following a specific request as referred to in point (g).

• (a) maintain an up-to-date list of non-financial supervisors within the Union;

• (b) coordinate peer reviews of supervisory standards and practices in the area of AML/CFT;

• (c) in the area of AML/CFT, investigate potential breaches or non-application of Union law by non-financial supervisors and public authorities overseeing self-regulatory bodies, issue recommendations on how to remedy the identified breaches and, where the supervisors or public authorities do not comply with the recommendations, issue warnings identifying the measures to be implemented to mitigate the effects of the breach;

• (d) carry out periodic reviews to ensure that all non-financial supervisors have adequate resources and powers necessary for the performance of their tasks in the area of AML/CFT;

• (e) contribute to the convergence of supervisory practices and the promotion of high supervisory standards in the area of AML/CFT;

• (f) facilitate the functioning of AML/CFT supervisory colleges in the non-financial sector;

• (g) provide assistance to non-financial supervisors, following their specific requests, such as requests to mediate between non-financial supervisors in the event of a disagreement on the measures to be taken in relation to an obliged entity, including in the context of AML/CFT supervisory colleges.

Where supervision of specific sectors is delegated at national level to self-regulatory bodies, the Authority shall exercise the tasks set out in the first subparagraph in relation to supervisory authorities overseeing the activities of those bodies.

• (a) maintain an up-to-date list of FIUs within the Union;

• (b) monitor changes in the legal framework of FIUs, as well as in their organisation, focusing on resources for the performance of their tasks;

• (c) support the work of FIUs and contribute to improved cooperation and coordination between FIUs;

• (d) contribute to the identification and the selection of relevant cases for the conduct of joint analyses by FIUs;

• (e) develop appropriate methods and procedures for the conduct of joint analyses by FIUs of cross-border cases;

• (f) set up, coordinate, organise and facilitate the conduct of joint analyses carried out by FIUs;

• (g) provide assistance to FIUs, upon their specific requests, such as requests for mediation in the case of a disagreement between FIUs;

• (h) conduct peer reviews of the activities of FIUs aimed at strengthening their consistency and effectiveness and identifying best practices;

• (i) develop and make available to FIUs tools and services to enhance their analysis capabilities, as well as IT and artificial intelligence services and tools for secure information sharing, including by hosting FIU.net;

• (j) develop, share and promote expert knowledge on detection, analysis, and dissemination methods of suspicious transactions;

• (k) at the request of FIUs, provide them with specialised training and assistance, including through the provision of financial support, within the scope of the Authority’s objectives and in accordance with the staffing and budgetary resources at its disposal;

• (l) support, at the request of FIUs, their interaction with obliged entities by providing expert knowledge to obliged entities, including improving their awareness and procedures to detect suspicious activities and transactions and their reporting to the FIUs;

• (m) prepare and coordinate assessments and strategic analyses of ML/TF threats, risks and methods identified by FIUs.

Article 6

Powers of the Authority

The Authority shall also have the powers and obligations which financial supervisors have in the area of AML/CFT under the applicable Union law, unless otherwise provided for by this Regulation.

To the extent necessary to carry out the tasks conferred on it by this Regulation, the Authority may require financial supervisors, by way of instructions, to make use of their powers in the area of AML/CFT, under and in accordance with the conditions set out in national law, where this Regulation does not confer such powers on the Authority.

For the purposes of exercising the powers referred to in the first and second subparagraphs, the Authority may issue binding decisions addressed to individual selected obliged entities. The Authority shall have the power to apply administrative measures and impose pecuniary sanctions for non-compliance with the decisions taken in the exercise of the power laid down in Article 21 in accordance with Article 22.

• (a) to require the submission of information or documents, including written or oral explanations, necessary for the performance of its functions, including statistical information and information concerning internal processes or arrangements of national supervisors and supervisory authorities, and to access that information in and extract it from the common structured questionnaires and other online and offline tools developed by the Authority;

• (b) to issue guidelines and recommendations;

• (c) to issue requests to act and instructions on measures to be taken in relation to non-selected obliged entities pursuant to Chapter II, Section 4;

• (d) to carry out mediation upon the request of a financial supervisor or of a non-financial supervisor;

• (e) upon the request of financial supervisors, to settle, with binding effect, disagreements between financial supervisors, including in the context of the AML/CFT supervisory colleges.

• (a) to request non-operational data and analyses from FIUs, where they are necessary for the assessment of threats, vulnerabilities and risks facing the internal market in relation to ML/TF;

• (b) to collect information and statistics in relation to the tasks and activities of FIUs;

• (c) to obtain and process information and data required for initiating, conducting and coordinating joint analyses as specified in Article 40;

• (d) to issue guidelines and recommendations.

• (a) to develop draft regulatory technical standards in accordance with Article 49;

• (b) to develop draft implementing technical standards in accordance with Article 53;

• (c) to issue guidelines and recommendations, as provided for in Article 54;

• (d) to provide opinions to the European Parliament, to the Council and to the Commission, as provided for in Article 55.

SECTION 2 AML/CFT supervisory system

Article 7

Cooperation within the AML/CFT supervisory system

Article 8

AML/CFT supervisory methodology

• (a) benchmarks and a methodology for classification of obliged entities into risk categories on the basis of their residual risk profile, separately for each category of obliged entities;

• (b) approaches to supervisory review of ML/TF risk self-assessments of obliged entities;

• (c) approaches to supervisory review of obliged entities’ internal policies and procedures, including their customer due diligence policies and procedures, in line with a risk-based approach to the prevention of ML/TF;

• (d) approaches to supervisory evaluation of risk factors inherent in, or related to, customers, business relationships, transactions and delivery channels of obliged entities, as well as geographical risk factors.

The tools developed by the Authority shall ensure the collection of objective and comparable AML/CFT-related data and information from obliged entities and enable an efficient and speedy exchange of information between supervisors and the Authority.

The Authority shall endeavour to develop those tools as soon as the supervisory methodology is applicable across the entire AML/CFT supervisory system.

Article 9

Thematic reviews

• (a) the scope of each planned thematic review in terms of category and number of obliged entities included and the subject matter of the review;

• (b) the timeframe of each planned thematic review;

• (c) the planned types, nature and frequency of supervisory activities to be performed in relation to each thematic review, including any on-site inspections or other types of direct interaction with obliged entities, where applicable.

Article 10

Mutual assistance in the AML/CFT supervisory system

• (a) new practical instruments and convergence tools to promote common supervisory approaches and best practices;

• (b) practical tools and methods for mutual assistance following:
• (i) specific requests from supervisory authorities;
• (ii) referral of disagreements between supervisory authorities on the measures to be taken jointly by several supervisory authorities in relation to an obliged entity.

• (a) sectoral and cross-sectoral training programmes, including with respect to technological innovation;

• (b) exchanges of staff and the use of secondment schemes, twinning and short-term visits;

• (c) exchanges of supervisory best practices between supervisory authorities where one authority has developed expertise in a specific area of AML/CFT supervisory practices.

Article 11

Central AML/CFT database

The Authority shall make the information available to supervisory authorities, non-AML/CFT authorities, other national authorities and bodies competent for ensuring compliance with Directive 2008/48/EC of the European Parliament and of the Council ([^E0002]), Directive 2009/110/EC of the European Parliament and of the Council ([^E0003]), Directive 2009/138/EC of the European Parliament and of the Council ([^E0004]), Directive 2014/17/EU of the European Parliament and of the Council ([^E0005]), Regulation (EU) No 537/2014 of the European Parliament and of the Council ([^E0006]), Directive 2014/56/EU of the European Parliament and of the Council ([^E0007]), Directive 2014/65/EU of the European Parliament and of the Council ([^E0008]) or Directive (EU) 2015/2366 of the European Parliament and of the Council ([^E0009]), and to the European Supervisory Authorities, namely, the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA) (collectively, ‘the ESAs’), on a need-to-know and confidential basis, where it is necessary for the fulfilment of their tasks.

The Authority shall also analyse the collected information and may share the results of its analysis on its own initiative with supervisory authorities, where to do so would facilitate their supervisory activities, and, where relevant, with obliged entities.

• (a) a list of all supervisory authorities and self-regulatory bodies in their Member State entrusted with the supervision of obliged entities, including information about their mandate, tasks and powers and, where applicable, the identification of the leading supervisor or coordination mechanism;

• (b) statistical information about the categories and the number of supervised obliged entities per category in their Member State and basic information about the risk profile of those entities;

• (c) the administrative measures applied and pecuniary sanctions imposed in the course of supervision of individual obliged entities in response to breaches of AML/CFT requirements, accompanied by:
• (i) the grounds for applying the administrative measure or imposing the pecuniary sanction, such as the nature of the breach;
• (ii) related information on the supervisory activities and outcomes which led to the administrative measure being applied or the pecuniary sanction being imposed;

• (d) any advice or opinion related to ML/TF risks provided to other authorities in relation to authorisation procedures, withdrawal of authorisation procedures, and ‘fit and proper’ assessments of shareholders or members of the management body of individual obliged entities;

• (e) the outcomes of their assessments of the inherent and residual risk profiles of all credit institutions and financial institutions that meet the criteria set out in Article 12(1);

• (f) the outcomes and reports of thematic reviews and other horizontal supervisory actions with regard to high-risk areas or activities;

• (g) information regarding the supervisory activities they performed over the past calendar year, gathered pursuant to Article 40(5) of Directive (EU) 2024/1640;

• (h) statistical information about staffing and other resources of supervisors and supervisory authorities.

The information provided pursuant to the first subparagraph shall not include references to specific suspicions reported pursuant to Article 69 of Regulation (EU) 2024/1624.

The Authority shall also enter into the database the information stemming from its activities in the area of direct supervision which corresponds to the categories of information listed in the first subparagraph, as well as the outcomes of the risk assessment process carried out by the Authority pursuant to Article 12.

The information referred to in the first subparagraph shall include instances where the authorities and bodies referred to in that subparagraph have reasonable grounds to suspect that ML/TF is being attempted or committed or that an increased risk thereof exists in connection with an obliged entity, and where such reasonable grounds arose in the context of the exercise of their respective tasks. The database shall also include relevant information which authorities or bodies supervising credit institutions in accordance with Directive 2013/36/EU of the European Parliament and of the Council ([^E0010]), including the ECB when acting in accordance with Regulation (EU) No 1024/2013, have obtained, in the context of ongoing supervision, including information on business model assessments, assessments of governance arrangements, authorisation procedures, assessments of acquisitions of qualifying holdings, ‘fit and proper’ assessments and procedures related to the withdrawal of licences.

• (a) the procedure, formats and timelines for the transmission of information pursuant to paragraphs 2 and 3;

• (b) the scope and level of detail of the information to be transmitted, taking into account relevant distinctions between obliged entities, such as their risk profile;

• (c) the scope and level of detail of the information to be transmitted in relation to obliged entities in the non-financial sector;

• (d) the type of information the disclosure of which by the Authority, pursuant to a reasoned request or at its own initiative, requires the prior consent of the supervisory authority that originated it;

• (e) which level of materiality a breach needs to have in order for a supervisory authority to be obliged to transmit information on the breach pursuant to paragraph 2, point (c);

• (f) the conditions under which the Authority may request additional information pursuant to paragraph 3;

• (g) the types of additional information to be transmitted to the Authority pursuant to paragraph 3.

The Authority shall submit those draft regulatory technical standards to the Commission by 27 December 2025.

The Commission is empowered to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Article 49 of this Regulation.

SECTION 3 Direct supervision of selected obliged entities

Article 12

Assessment of credit institutions and financial institutions for the purposes of selection for direct supervision

• (a) credit institutions;

• (b) bureaux de change;

• (c) collective investment undertakings;

• (d) credit providers other than credit institutions;

• (e) e-money institutions;

• (f) investment firms;

• (g) payment institutions;

• (h) life insurance undertakings;

• (i) life insurance intermediaries;

• (j) crypto-asset service providers;

• (k) other financial institutions.

• (a) with respect to customer-related risk: the share of non-resident customers from third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624 and the presence and share of customers identified as politically exposed persons;

• (b) with respect to products and services offered:
• (i) the significance and the trading volume of products and services identified as the most vulnerable to ML/TF risks either at the level of the internal market, in the risk assessment at Union level, or at the level of the country, in the national risk assessment;
• (ii) for money remittance service providers, the significance of the aggregate annual emission and reception activities of each remitter in the countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624;
• (iii) the relative volume of products, services and transactions that offer a considerable level of protection of clients’ privacy and identity or other form of anonymity;

• (c) with respect to geographical areas:
• (i) the annual volume of correspondent banking services and correspondent crypto-asset services, provided by Union financial sector entities in third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624;
• (ii) the number and share of correspondent banking clients and crypto-asset clients in third countries identified pursuant to Chapter III, Section 2, of Regulation (EU) 2024/1624.

• (a) the minimum activities to be carried out by a credit institution or a financial institution under the freedom to provide services, whether through infrastructure or remotely, for it to be considered as operating in a Member State other than that where it is established;

• (b) the methodology based on the benchmarks referred to in paragraphs 5 and 6 for classifying the inherent and residual risk profiles of credit institutions or financial institutions, or groups of credit institutions or financial institutions, as low, medium, substantial or high.

The Authority shall submit those draft regulatory technical standards to the Commission by 1 January 2026.

The Commission is empowered to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Article 49 of this Regulation.

Article 13

The listing of selected obliged entities

In deciding on a specific different number of selected obliged entities as referred to in the first subparagraph, the Authority shall take into account its own resources in terms of its capacity to allocate or additionally hire the necessary number of supervisory and support staff and shall ensure that the required increase in the financial and human resources is feasible.

Pursuant to the decision on the maximum number, the selected obliged entities shall be those obliged entities qualifying under paragraph 1 which are operating in the highest number of Member States whether through establishments or under the freedom to provide services.

Where the application of the criterion referred to in the third subparagraph yields more than the set maximum number of selected obliged entities, the Authority shall select, from the obliged entities that would be selected in accordance with that subparagraph and that operate in the smallest number of Member States, those which have the highest ratio of the volume of transactions with third countries to the total volume of transactions measured over the last financial year.

Following the additional selection process, the credit institution, financial institution or group of credit institutions or financial institutions, established or registered in that Member State whose risk profile is classified as high, shall qualify as a selected obliged entity.

Where several credit institutions or financial institutions, or groups of credit institutions or financial institutions, in the Member State in question have a risk profile that is classified as high, the entity operating in the highest number of Member States whether through establishments or under the freedom to provide services shall qualify as the selected obliged entity. If several credit institutions or financial institutions, or groups of credit institutions or financial institutions, operate in the same number of Member States, the entity with the highest ratio of transaction volume with third countries to total transaction volume measured over the last financial year shall qualify as a selected obliged entity.

Article 14

Additional transfer of direct supervision tasks and powers in exceptional circumstances upon the request of a financial supervisor

The request referred to in the first subparagraph shall only be submitted in exceptional circumstances with the aim of addressing at Union level a heightened ML/TF risk or compliance failures at a non-selected obliged entity and to ensure a consistent application of high supervisory standards.

• (a) identify the non-selected obliged entity in respect of which the financial supervisor is of the view that the Authority should assume direct supervision;

• (b) state the reasons for which AML/CFT direct supervision of the non-selected obliged entity is necessary;

• (c) identify and duly justify the proposed transfer date and the period for which the transfer of the tasks and powers is requested; and

• (d) provide all necessary supporting information, data and evidence that could be useful for the assessment of the request.

• (a) the requesting supervisor can demonstrate the inefficacy of supervisory measures imposed on the non-selected obliged entity in relation to serious, repeated or systematic breaches of applicable requirements;

• (b) the heightened ML/TF risk or the serious, repeated or systematic breaches of applicable requirements affect several entities within a non-selected obliged entity group, and the relevant financial supervisors agree that coordinated supervisory action at Union level would be more effective to address them;

• (c) the request concerns a temporary, objective and demonstrable lack of capacity at the level of the financial supervisor to adequately and timely address the ML/TF risk of a non-selected obliged entity.

Upon the end of the duration of the direct supervision by the Authority, set out in the decision referred to in the first subparagraph, the tasks and powers related to the direct supervision of the obliged entity concerned shall automatically be transferred back to the financial supervisor, unless the Authority extends the application of that decision following a corresponding request made by the financial supervisor in accordance with paragraphs 1 to 4.

Article 15

Cooperation within the AML/CFT supervisory system for the purposes of direct supervision

• (a) the conditions under which financial supervisors are to assist the Authority pursuant to paragraph 2;

• (b) the process of periodic assessment referred to in Article 12(1), including the roles of the supervisory authorities and the Authority in assessing the risk profile of credit institutions and financial institutions referred to in that paragraph;

• (c) the working arrangements for the transfer of supervisory tasks and powers to the Authority or from the Authority to national level following a selection process, including arrangements on the continuity of pending supervisory procedures or investigations;

• (d) the procedures for the preparation and adoption of decisions on the selection of obliged entities;

• (e) the detailed rules and arrangements for the composition and functioning of the joint supervisory teams referred to in Article 16(1) and (2).

The Authority shall submit those draft implementing technical standards to the Commission by 1 January 2026.

The Commission is empowered to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 53.

Article 16

Joint supervisory teams

Each financial supervisor that appoints more than one staff member to the joint supervisory team pursuant to paragraph 4 may designate one of them as sub-coordinator (‘national sub-coordinator’). The national sub-coordinators shall assist the JST coordinator as regards the organisation and coordination of the tasks in the joint supervisory team, in particular as regards the staff members that were appointed by the same financial supervisor as the relevant national sub-coordinator. The national sub-coordinator may give instructions to the members of the joint supervisory team appointed by the same financial supervisor, provided that those instructions do not conflict with the instructions given by the JST coordinator.

• (a) performing the supervisory reviews and assessments of the selected obliged entities;

• (b) coordinating on-site inspections of selected obliged entities and preparing supervisory measures where necessary;

• (c) participating in the preparation of draft decisions applicable to the respective selected obliged entity to be proposed to the General Board and Executive Board, taking into account the reviews, assessments and on-site inspections referred to in points (a) and (b);

• (d) liaising with financial supervisors where that is necessary to exercise supervisory tasks in any Member State where a selected obliged entity is established.

Article 17

Requests for information

Article 18

General investigations

To that end, the Authority may:

• (a) require the submission of documents;

• (b) examine the books and records of the persons concerned and take copies or extracts from the books and records;

• (c) obtain access to internal audit reports, certification of accounts, and any software, databases, IT tools or other electronic means of recording information;

• (d) obtain access to documents and information relating to decision-making processes, including those developed by algorithms or other digital processes;

• (e) obtain written or oral explanations from any person referred to in Article 17 or their representatives or staff;

• (f) interview any other person who consents to being interviewed for the purpose of collecting information relating to the subject matter of an investigation.

Article 19

On-site inspections

Article 20

Authorisation by a judicial authority

Article 21

Administrative measures

• (a) the selected obliged entity is found to be in breach of the Union acts and national legislation referred to in Article 1(2);

• (b) the Authority has sufficient and demonstrable indications that the selected obliged entity is likely to breach the Union acts and national legislation referred to in Article 1(2) and the application of an administrative measure can prevent the occurrence of the breach or reduce the risk thereof;

• (c) based on a duly justified determination by the Authority, the internal policies, procedures and controls in place in the selected obliged entity are not commensurate to the risks of money laundering, its predicate offences or terrorist financing to which the selected obliged entity is exposed.

• (a) issue recommendations;

• (b) order obliged entities to comply, including to implement specific corrective measures;

• (c) issue a public statement which identifies the natural or legal person and the nature of the breach;

• (d) issue an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;

• (e) restrict or limit the business, operations or network of institutions comprising the selected obliged entity, or require the divestment of activities;

• (f) require changes in the governance structure;

• (g) where a selected obliged entity is subject to authorisation, propose the withdrawal or suspension of that authorisation to the authority that has granted it; where the authority which has granted that authorisation does not follow the Authority’s proposal to suspend or withdraw, the Authority shall request it to provide the reasons thereof in writing.

• (a) require the provision of any data or information necessary for the fulfilment of tasks listed in Article 5(2) without undue delay, require the submission of any document, or impose additional or more frequent reporting requirements;

• (b) require the reinforcement of the internal policies, procedures and controls;

• (c) require the application of a specific policy or requirements relating to categories of, or individual, clients, transactions, activities or delivery channels that pose high ML/TF risks;

• (d) require the implementation of measures to decrease the ML/TF risks in the activities and products of selected obliged entities;

• (e) temporarily ban any person exercising managerial responsibilities in the selected obliged entity, or any other natural person held responsible for the breach, from exercising managerial functions in obliged entities.

Article 22

Pecuniary sanctions

• (a) for serious, repeated or systematic breaches of one or more requirements related to customer due diligence, group-wide policies, procedures and controls or reporting obligations that have been identified in two or more Member States where a selected obliged entity operates, the amount shall be at least EUR 500 000 and shall not exceed EUR 2 000 000 or 1 % of the annual turnover, whichever is higher;

• (b) for serious, repeated or systematic breaches of one or more requirements related to customer due diligence, internal policies, procedures and controls or reporting obligations that have been identified in one Member State where a selected obliged entity operates, the amount shall be at least EUR 100 000 and shall not exceed EUR 1 000 000 or 0,5  % of the annual turnover, whichever is higher;

• (c) for serious, repeated or systematic breaches of all other requirements that have been identified in two or more Member States where a selected obliged entity operates, the amount shall be at least EUR 100 000 and shall not exceed EUR 2 000 000 ;

• (d) for serious, repeated or systematic breaches of all other requirements that have been identified in one Member State where a selected obliged entity operates, the amount shall be at least EUR 100 000 and shall not exceed EUR 1 000 000 ;

• (e) for serious, repeated or systematic breaches of the decisions of the Authority referred to in Article 6(1), the amount shall be at least EUR 100 000 and shall not exceed EUR 1 000 000 .