Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC, and in particular Article 45(7) thereof,

1. Where a term is defined in Directive (EU) 2015/849 that definition shall apply for the purposes of this Regulation except where (2) applies.

2. Where a term is defined in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended by the Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019, that definition shall apply for the purposes of this Regulation.

This Regulation lays down a set of additional measures, including minimum action, that credit institutions and financial institutions must take to effectively handle the money laundering and terrorist financing risk where a third country's law does not permit the implementation of group-wide policies and procedures as referred to in Regulation 20(1) and 20(3) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 at the level of branches or subsidiary undertakings that are part of the group and established in the third country.

For each third country where they have established a branch or they are a parent undertaking of a subsidiary undertaking, credit institutions and financial institutions shall at least:

1. (a)

   assess the money laundering and terrorist financing risk to their group, record that assessment, keep it up to date and retain it in order to be able to share it with their competent authority in the United Kingdom;

2. (b)

   ensure that the risk referred to in point (a) is reflected appropriately in their group-wide anti-money laundering and countering the financing of terrorism policies and procedures;

3. (c)

   obtain senior management approval at group-level for the risk assessment referred to in point (a) and for the group-wide anti-money laundering and countering the financing of terrorism policies and procedures referred to in point (b);

4. (d)

   provide targeted training to relevant staff members in the third country to enable them to identify money laundering and terrorist financing risk indicators, and ensure that the training is effective.

1. (1)

   Where the third country's law prohibits or restricts the application of policies and procedures that are necessary to identify and assess adequately the money laundering and terrorist financing risk associated with a business relationship or occasional transaction due to restrictions on access to relevant customer and beneficial ownership information or restrictions on the use of such information for customer due diligence purposes, credit institutions or financial institutions shall at least:

   1. (a)

      inform their competent authority in the United Kingdom without undue delay and in any case no later than 28 calendar days after identifying the third country of the following:

      1. (i)

         the name of the third country concerned;

      2. (ii)

         how the implementation of the third country's law prohibits or restricts the application of policies and procedures that are necessary to identify and assess the money laundering and terrorist financing risk associated with a customer;

   2. (b)

      ensure that their branches or subsidiary undertakings that are established in the third country determine whether consent from their customers and, where applicable, their customers' beneficial owners, can be used to legally overcome restrictions or prohibitions referred to in point (a)(ii);

   3. (c)

      ensure that their branches or subsidiary undertakings that are established in the third country require their customers and, where applicable, their customers' beneficial owners, to give consent to overcome restrictions or prohibitions referred to in point (a)(ii) to the extent that this is compatible with the third country's law.

2. (2)

   Where the consent referred to in point (c) of paragraph 1 is not feasible, credit institutions and financial institutions shall take additional measures as well as their standard anti-money laundering and countering the financing of terrorism measures, to manage the money laundering and terrorist financing.

   Those additional measures shall include the additional measure set out in point (c) of Article 8 and one or more of the measures set out in points (a), (b), (d), (e) and (f) of that Article.

   Where a credit institution or financial institution cannot effectively manage the money laundering and terrorist financing risk by applying the measures referred to in paragraphs 1 and 2, it shall:

   1. (a)

      ensure that the branch or subsidiary undertaking terminates the business relationship;

   2. (b)

      ensure that the branch or subsidiary undertaking does not carry out the occasional transaction;

   3. (c)

      close down some or all of the operations provided by their branch and subsidiary undertaking established in the third country.

3. (3)

   Credit institutions and financial institutions shall determine the extent of the additional measures referred to in paragraphs 2 and 3 on a risk-sensitive basis and be able to demonstrate to their competent authority in the United Kingdom that the extent of additional measures is appropriate in view of the money laundering and terrorist financing risk.

1. (1)

   Where a third country's law prohibits or restricts the sharing or processing of customer data for anti-money laundering and countering the financing of terrorism purposes within the group, credit institutions and financial institution shall at least:

   1. (a)

      inform their competent authority in the United Kingdom without undue delay and in any case no later than 28 days after identifying the third country of the following:

      1. (i)

         the name of the third country concerned;

      2. (ii)

         how the implementation of the third country's law prohibits or restricts the sharing or processing of customer data for anti-money laundering and countering the financing of terrorism purposes;

   2. (b)

      ensure that their branches or subsidiary undertakings that are established in the third country determine whether consent from their customers and, where applicable, their customers' beneficial owners, can be used to legally overcome restrictions or prohibitions referred to in point (a)(ii);

   3. (c)

      ensure that their branches or subsidiary undertakings that are established in the third country require their customers and, where applicable, their customers' beneficial owners, to provide consent to overcome restrictions or prohibitions referred to in point (a)(ii) to the extent that this is compatible with the third country's law.

2. (2)

   In cases where consent referred to in point (c) of paragraph 1 is not feasible, credit institutions and financial institutions shall take additional measures as well as their standard anti-money laundering and countering the financing of terrorism measures to manage risk. These additional measures shall include the additional measure set out in point (a) of Article 8 or the additional measure set out in point (c) of that Article. Where the money laundering and terrorist financing risk is sufficient to require further additional measures, credit and financial institutions shall apply one or more of the remaining additional measures set out in points (a) to (c) of Article 8.

3. (3)

   Where a credit institution or financial institution cannot effectively manage the money laundering and terrorist financing risk by applying the measures referred to in paragraphs 1 and 2, it shall close down some or all of the operations provided by their branch and subsidiary undertaking established in the third country.

4. (4)

   Credit institutions and financial institutions shall determine the extent of the additional measures referred to in paragraphs 2 and 3 on a risk-sensitive basis and be able to demonstrate to their competent authority in the United Kingdom that the extent of additional measures is appropriate in view of the risk of money laundering and terrorist financing.

1. (1)

   Where the third country's law prohibits or restricts the sharing of information referred to in Article 33(1) of Directive (EU) 2015/849 by branches and subsidiary undertakings established in the third country with other entities in their group, credit institutions and financial institutions shall at least:

   1. (a)

      inform their competent authority in the United Kingdom without undue delay and in any case no later than 28 days after identifying the third country of the following:

      1. (i)

         the name of the third country concerned;

      2. (ii)

         how the implementation of the third country's law prohibits or restricts the sharing or processing of the content of information referred to in Article 33(1) of Directive (EU) 2015/849 identified by a branch and subsidiary undertaking established in a third country with other entities in their group;

   2. (b)

      require the branch or subsidiary undertaking to provide relevant information to the credit institution's or financial institution's senior management so that it is able to assess the money laundering and terrorist financing risk associated with the operation of such a branch or subsidiary undertaking and the impact this has on the group, such as:

      1. (i)

         the number of suspicious transactions reported within a set period;

      2. (ii)

         aggregated statistical data providing an overview of the circumstances that gave rise to suspicion.

2. (2)

   Credit institutions and financial institutions shall take additional measures as well as their standard anti-money laundering and countering the financing of terrorism measures and the measures referred to in paragraph 1 to manage risk.

   Those additional measures shall include one or more of the additional measures set out in points (a) to (c) and (g) to (i) of Article 8.

3. (3)

   Where credit institutions and financial institutions cannot effectively manage the money laundering and terrorist financing risk by applying the measures referred to in paragraphs 1 and 2, they shall close down some or all of the operations provided by their branch and subsidiary undertaking established in the third country.

4. (4)

   Credit institutions and financial institutions shall determine the extent of the additional measures referred to in paragraphs 2 and 3 on a risk-sensitive basis and be able to demonstrate to their competent authority in the United Kingdom that the extent of additional measures is appropriate in view of the risk of money laundering and terrorist financing.

Where the third country's law prohibits or restricts the transfer of data related to customers of a branch and subsidiary undertaking established in a third country to the United Kingdom for the purpose of supervision for anti-money laundering and countering the financing of terrorism, credit institutions and financial institutions shall at least:

1. (a)

   inform their competent authority in the United Kingdom without undue delay and in any case no later than 28 calendar days after identifying the third country of the following:

   1. (i)

      the name of the third country concerned;

   2. (ii)

      how the implementation of the third country's law prohibits or restricts the transfer of data related to customers for the purpose of supervision for anti-money laundering and countering the financing of terrorism;

2. (b)

   carry out enhanced reviews, including, where this is commensurate with the money laundering and terrorist financing risk associated with the operation of the branch or subsidiary undertaking established in the third country, onsite checks or independent audits, to be satisfied that the branch or subsidiary undertaking effectively implements group-wide policies and procedures and that it adequately identifies, assesses and manages the money laundering and terrorist financing risks;

3. (c)

   provide the findings of the reviews referred to in point (b) to their competent authority in the United Kingdom upon request;

4. (d)

   require the branch or subsidiary undertaking established in the third country regularly to provide relevant information to the credit institution's or financial institution's senior management, including at least the following:

   1. (i)

      the number of high risk customers and aggregated statistical data providing an overview of the reasons why customers have been classified as high risk, such as politically exposed person status;

   2. (ii)

      the number of suspicious transactions identified and reported and aggregated statistical data providing an overview of the circumstances that gave rise to suspicion;

5. (e)

   make the information referred to in point (d) available to their competent authority in the United Kingdom upon request.

1. (1)

   Where the third country's law prohibits or restricts the application of record-keeping measures equivalent to those specified in Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, credit institutions and financial institutions shall at least:

   1. (a)

      inform their competent authority in the United Kingdom without undue delay and in any case no later than 28 days after identifying the third country of the following:

      1. (i)

         the name of the third country concerned;

      2. (ii)

         how the implementation of the third country's law prohibits or restricts the application of record-keeping measures equivalent to those laid down in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;

   2. (b)

      establish whether consent from the customer and, where applicable, their beneficial owner, can be used to legally overcome restrictions or prohibitions referred to in point (a)(ii);

   3. (c)

      ensure that their branches or subsidiary undertakings that are established in the third country require customers and, where applicable, their customers' beneficial owners, to provide consent to overcome restrictions or prohibitions referred to in point (a)(ii) to the extent that this is compatible with the third country's law.

2. (2)

   In cases where consent referred to in point (c) of paragraph 1 is not feasible, credit institutions and financial institutions shall take additional measures as well as their standard anti-money laundering and countering the financing of terrorism measures and the measures referred to in paragraph 1 to manage risk. These additional measures shall include one or more of the additional measures set out in points (a) to (c) and (j) of Article 8.

3. (3)

   Credit and financial institutions shall determine the extent of the additional measures referred to in paragraph 2 on a risk-sensitive basis and be able to demonstrate to their competent authority in the United Kingdom that the extent of additional measures is appropriate in view of the risk of money laundering and terrorist financing.

Credit institutions and financial institutions shall take the following additional measures pursuant to Article 3(2), Article 4(2), Article 5(2) and Article 7(2) respectively:

1. (a)

   ensuring that their branches or subsidiary undertakings that are established in the third country restrict the nature and type of financial products and services provided by the branch or subsidiary undertaking in the third country to those that present a low money laundering and terrorist financing risk and have a low impact on the group's risk exposure;

2. (b)

   ensuring that other entities of the same group do not rely on customer due diligence measures carried out by a branch or subsidiary undertaking established in the third country, but instead carry out customer due diligence on any customer of a branch or subsidiary undertaking established in the third country who wishes to be provided with products or services by those other entities of the same group even if the conditions in Regulation 39(6) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are met;

3. (c)

   carrying out enhanced reviews, including, where this is commensurate with the money laundering and terrorist financing risk associated with the operation of the branch or subsidiary undertaking established in the third country, onsite checks or independent audits, to be satisfied that the branch or subsidiary undertaking effectively identifies, assesses and manages the money laundering and terrorist financing risks;

4. (d)

   ensuring that their branches or subsidiary undertakings that are established in the third country seek the approval of the credit institution's or financial institution's senior management for the establishment and maintenance of higher-risk business relationships, or for carrying out a higher risk occasional transaction;

5. (e)

   ensuring that their branches or subsidiary undertakings that are established in the third country determine the source and, where applicable, the destination of funds to be used in the business relationship or occasional transaction;

6. (f)

   ensuring that their branches or subsidiary undertakings that are established in the third country carry out enhanced ongoing monitoring of the business relationship including enhanced transaction monitoring, until the branches or subsidiary undertakings are reasonably satisfied that they understand the money laundering and terrorist financing risk associated with the business relationship;

7. (g)

   ensuring that their branches or subsidiary undertakings that are established in the third country share with the credit institution or financial institution underlying suspicious transaction report information that gave rise to the knowledge, suspicion or reasonable grounds to suspect that money laundering and terrorist financing was being attempted or had occurred, such as facts, transactions, circumstances and documents upon which suspicions are based, including personal information to the extent that this is possible under the third country's law;

8. (h)

   carrying out enhanced ongoing monitoring on any customer and, where applicable, beneficial owner of a customer of a branch or subsidiary undertaking established in the third country who is known to have been the subject of suspicious transaction reports by other entities of the same group;

9. (i)

   ensuring that their branches or subsidiary undertakings that are established in the third country has effective systems and controls in place to identify and report suspicious transactions;

10. (j)

    ensuring that their branches or subsidiary undertakings that are established in the third country keep the risk profile and due diligence information related to a customer of a branch or subsidiary undertaking established in the third country up to date and secure as long as legally possible, and in any case for at least the duration of the business relationship.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 3 September 2019.