—

welcomes the obligation for Member States to notify the Commission the closed list of competent authorities and self-regulatory bodies and of the categories of obliged entities that are granted access to the beneficial ownership registers. However, the EDPS invites the legislator to specify that access to beneficial ownership registers, by tax authorities as well as by self-regulatory bodies, should be limited to the purpose of the fight against money-laundering and financing of terrorism and thus authorized only for this purpose;

—

in relation to access by ‘any member of the general public’ to the beneficial ownership registers, the EDPS reiterates his earlier position that the necessity and proportionality of such generalised access for the purposes of prevention of money laundering and terrorism financing has not been clearly established so far. In principle, such access should be limited to competent authorities who are in charge of enforcing the law and to obliged entities when taking customer due diligence measures. The EDPS is of the view that access to beneficial ownership information motivated by other objectives of general interest (such as enhancing transparency) should rather be considered as right to obtain information. Such public access would require a separate necessity and proportionality assessment, and be subject to a separate set of rules laying down the necessary safeguards. Hence, the EDPS recommends the legislator to assess the necessity and proportionality of such a ‘general access’ and, on the basis of this assessment, if considered appropriate, to lay down a specific legal framework in this regard, distinct from the one related to access by competent authorities;

1.

The European Commission adopted on 20 July 2021 a Proposal for a Regulation of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (‘the Proposal for a Regulation’) (1); a Proposal for a Directive of the European Parliament and of the Council on the mechanisms for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing Directive (EU) 2015/849 (‘the “Proposal for a Directive’) (2); a Proposal for a Regulation of the European Parliament and of the Council establishing the European Authority for Countering Money Laundering and Financing of Terrorism, amending Regulations (EU) No 1093/2010 (EU) 1094/2010 and (EU) 1095/2010 (‘the Proposal for a Regulation establishing AMLA’) (3); and a Proposal for a Regulation of the European Parliament and of the Council on information accompanying transfers of funds and certain crypto-assets (‘the Proposal for a Regulation on crypto-assets’) (4). Hereinafter, we also refer to the four draft Proposals as ‘the AML legislative package’.

2.

The AML legislative package is proposed pursuant to the Action Plan for a comprehensive Union policy on preventing money laundering and terrorism financing of 7 May 2020 (5). The EDPS has issued the Opinion on the Action Plan on 23 July 2020 (6).

3.

The objectives of the Action Plan, as referred to in particular in the Regulation (7), are:

4.

The AML legislative package, including the Proposal for a Regulation incorporating elements (provisions) of Directive (EU) 2018/843 (8), is an ambitious legislative initiative aiming at increasing the effectiveness of the fight against money laundering. It aims to do so in particular through the centralisation of enforcement, including the newly established European Authority for Countering Money Laundering and Financing of Terrorism (‘AMLA’), a standardisation of the obligations for obliged entities, streamlining a supra-national and national risk-based approach, as well as laying down rules on cooperation between competent oversight authorities and on relevant databases and infrastructure for the exchange of information, notably FIU.net, to be hosted and managed by AMLA.

5.

On 21 July 2021, the European Commission requested the EDPS to issue an opinion on the Proposal, in accordance with Article 42(1) of Regulation (EU) 2018/1725. These comments are limited to the provisions of the Proposal that are most relevant from a data protection perspective.

—

welcomes the AML legislative package’s aims to increase the effectiveness of anti-money laundering and countering the financing of terrorism in particular via greater harmonization of the applicable rules and enhanced supervision at the EU level (including the establishment of the European Authority for Countering Money Laundering and Financing of Terrorism, AMLA);

—

and welcomes the risk-based approach followed to prevent the use of the financial system for money laundering, which is at the core of the AML legislative package;

—

the AML legislative package (notably, the Proposal for a Regulation) should identify the categories of personal data to be processed by the obliged entities to fulfil the AML/CFT obligations;

—

in particular, the Proposal for a Regulation should provide clear indications on conditions and limits for the processing of special categories of personal data and of personal data relating to criminal convictions and offences;

—

concerning special categories of personal data, the AML legislative package should specify in particular which type of data (within the broader category of special categories of personal data under Article 9 of the GDPR) should be processed by the obliged entities, and at what exact stage of the process, for the purpose of anti-money laundering and countering the financing of terrorism. In this regard, the EDPS considers that the processing of personal data related to sexual orientation or ethnic origin should not be allowed;

—

concerning beneficial ownership registers, the EDPS:

—

having regard to the processing of personal data relating to criminal convictions and offences, the reference to ‘allegations’ (in addition to ‘investigations’, ‘proceedings’ and ‘convictions’) in Article 55(3)(b) of the Proposal for a Regulation is vague and should therefore be deleted or specified;

—

remarks the extensive access powers conferred to FIUs under Article 18 of the Proposal for a Directive, and hence invites the legislator to reassess the necessity and proportionality of these access rights, in relation in particular to the ‘law enforcement information’ listed under Article 18(1)(c). In the same vein, the EDPS recommends to clearly and exhaustively delineate the categories of personal data to which FIUs may have access pursuant to Article 18(1)(a) (‘financial information’) and Article 18(1)(b) (‘administrative information’);

—

reiterates that a legal configuration of the powers and activities of FIUs as ‘investigation-based’, rather than ‘intelligence-based’, would be more in line with the data protection principles of proportionality and purpose limitation, and thus recommends deleting wording in recital 51 of the Directive related to the detection of ‘subjects of interest’;

—

having regard to FIU.net, recommends that the Proposal for a Regulation establishing AMLA, or at least an implementing technical standard to be adopted by the Commission pursuant to Article 24(3) of the Proposal for a Directive, clearly provides for the roles of all involved stakeholders (AMLA, FIUs) from a data protection perspective, as this impacts on the applicable data protection framework and on the supervision model;

—

having regard to the central AML/CFT database, the EDPS recommends specifying a storage limitation period for the personal data contained therein, in particular due to the collection by FIUs and transmission to the central AML/CFT database of ‘results from supervisory inspections of files concerning Politically Exposed Persons their family members and associates’;

—

having regard to the sources of information for CDD, including ‘watch lists’, the AML legislative package should clarify in particular in which cases obliged entities should have recourse to such lists. In this respect, the EDPS invites the legislator to consider whether such access should only take place in case of high risk of money laundering or financing of terrorism. Moreover, a recital could specify that obliged entities should duly verify information from watch lists, having regard in particular to their reliability and accuracy.

—

furthermore, in order to foster the adoption of codes of conducts and certifications to be adhered to by providers of databases and watch lists used for AML/CTF purposes, the EDPS invites the legislator to include in the AML legislative package a reference to codes of conduct under Article 40 GDPR and to certifications under Article 42 GDPR, to be developed taking into account the specific needs in this sector;

—

Article 32(3) of the Proposal for a Regulation provides that AMLA shall issue guidelines on the criteria for the identification of persons falling under the definition of persons known to be a close associate [of ‘politically exposed person’]. In this regard, the EDPS considers that the category of ‘persons known to be close associate’ should be specified in the Proposal for a Regulation itself, rather than (only) by AMLA’s guidance;

—

the EDPS recommends specifying the categories of employees falling under the ‘integrity screening’ required under Article 11 of the Proposal for a Regulation;

—

the EDPS recommends including, in a more explicit way, among the criteria for consideration of the competent authority when publishing administrative sanctions and measures, the risks to the protection of the personal data of the individuals concerned;

—

finally, the EDPS recommends some changes (additions and deletions) to the wording of articles and recitals of the AML legislative package referring to the GDPR and the EUDPR.