{"id":14483,"date":"2020-03-10T06:00:25","date_gmt":"2020-03-10T13:00:25","guid":{"rendered":"https:\/\/www.trulioo.com\/?p=14483"},"modified":"2023-08-24T16:05:04","modified_gmt":"2023-08-24T16:05:04","slug":"5amld-considerations","status":"publish","type":"post","link":"https:\/\/www.trulioo.com\/blog\/aml\/5amld-considerations","title":{"rendered":"5AMLD considerations \u2013 factors for implementing a robust EU compliance program"},"content":{"rendered":"\n
\"5amld<\/figure>\n\n\n\n

The European Union\u2019s 5th Anti-Money Laundering Directive (5AMLD<\/a>) is now in effect. Technically, EU member states had until January 10, 2020 to implement 5AMLD provisions into their national law. However, as with other EU directives, actual implementation varies widely and no enforcement actions have occurred to date.<\/p>\n\n\n\n

Having said that, for obliged entities operating in the EU (or the U.K.) ignoring the directive is not an option. It\u2019s just a matter of time before compliance is mandatory (if it\u2019s not already), and risking fines and reputational damage is an unnecessary risk. For example, Austria cryptocurrency-related businesses that fail to register face fines of \u20ac200,000<\/a>. In the Czech Republic, these fines might be in the region of \u20ac500,000, although that exact figure is not law yet.<\/p>\n\n\n\n

If your organization hasn\u2019t taken steps to ensure compliance, it\u2019s imperative to take action now. What factors do you need to consider? What are some practical measures that you should be taking now to comply with 5AMLD?<\/p>\n\n\n\n

Balancing 5AMLD and GDPR<\/h2>\n\n\n\n

It\u2019s important to understand that 5AMLD doesn\u2019t exist in isolation; there are many other regulations that need consideration and coordination, and there are factors that contradict each other. GDPR upholds strict privacy and data protection measures. PSD2<\/a> requires careful handling of payment information. Each of the three directives are fairly new, but they have different goals and don\u2019t have considerations for the other requirements.<\/p>\n\n\n\n

To help put an end to corruption and financial crime, one of the most important steps governments can take is to ensure that effective beneficial ownership transparency rules and procedures are in place. On the other hand, data privacy<\/a> is a critically important topic, not only because of the risks incurred by sub-standard security or legal non-compliance, but because an individual\u2019s digital identity is increasingly the benchmark of their existence.<\/p>\n\n\n\n

How can organizations protect privacy while simultaneously ensuring transparency?<\/strong><\/p>\n\n\n\n

Fundamentally, you need to collect enough information to ensure that you can perform AML checks while making sure that the proper consent to acquire that information is granted and that the information is handled effectively throughout the process. The rules for consent are critical.<\/p>\n\n\n\n

The exact balance is still to be determined by further guidance, legal clarifications and court rulings. Ian Rumens, global head of private wealth at Intertrust in Jersey, is taking a wait-and-see approach to publishing beneficial ownership information: \u201cOur timetable is designed to allow us to see how all the EU states are going to deal with the conflict between GDPR and 5AMLD<\/a>,\u201d which might get some resolution in an EU review of implementation in January 2022. As Jersey is not technically a member state of the EU, perhaps he\u2019s in an enviable position, but it does demonstrate the complexity of the issue.<\/p>\n\n\n\n

There are other considerations in play. Organizations desire to maximize data collection to fight fraud, better spot patterns of money laundering and improve their customer knowledge. However, collecting data under GDPR has specified restrictions, which makes data analysis more difficult. Does it become a matter of balancing the threat of one regulator against another? Fines and sanctions for AML lapses are well known and considerable, while actions under GDPR are still the exception; should organizations really have to choose?<\/p>\n\n\n\n

A clear set of rules<\/h2>\n\n\n\n

It\u2019s ironic, considering the other directives, that one of the goals of 5AMLD was achieving regulatory homogenization. With so many member states, and so many affected industries, AML requirements in the EU were, to put it bluntly, a mess.<\/p>\n\n\n\n

For entities that operated cross-border, multiple regulatory sets and multiple regulatory agencies resulted in significant additional costs, substantial compliance risks and results that were not really effective in any case. Consider that in the EU, banks are spending $20 billion on compliance per year<\/a> and, as stated by Rob Wainwright, former director of Europol, \u201cprofessional money launderers are running billions of illegal drug and other criminal profits through the banking system with a 99 percent success rate.\u201d<\/p>\n\n\n\n

Cryptocurrencies<\/strong><\/p>\n\n\n\n

While the level of desired homogenization is not there yet, 5AMLD has provided some measure of clarity. Consider cryptocurrencies, which previously had no clear legal standing. Under 5AMLD, crypto exchanges and crypto wallet providers will be considered \u201cobliged entities\u201d and face the same requirements as financial institutions. These requirements include AML, customer due diligence, transaction monitoring and suspicious activity reports.<\/p>\n\n\n\n

For some operations, these rules are onerous and have led to an exodus to other jurisdictions such as Panama, but others welcome having clear regulations and consider them signs of a maturing industry. Benjamin Kirschbaum, a German lawyer for Winheller Attorneys at Law & Tax Advisors, stated that \u201cexchanges will now have to implement strong KYC procedures. This will help bringing cryptocurrency trading out of the gray market<\/a> and make it easier for banks and institutional investors to make a move into the space, without regulatory backlash. So, we might begin to see more volume in the space and thus less volatility going forward.\u201d<\/p>\n\n\n\n

Company registers<\/strong><\/p>\n\n\n\n

The concept of company registers, to improve transparency for beneficial ownership, was a part of 4AMLD. Now, with 5AMLD, there are specific dates for having these registers and interconnecting them with the European central platform.<\/p>\n\n\n\n

Consultancy UK suggests that \u201ca formalised process to obtain, record and update the beneficial ownership information required<\/a> for the register should be developed. Technical requirements, including access controls and operational challenges, should also be considered and tested in preparation for compliance with 5AMLD requirements.\u201d<\/p>\n\n\n\n

Gaming<\/strong><\/p>\n\n\n\n

The U.K. Gambling Commission published the fifth edition of their guidance for remote and non-remote casinos<\/a> to coincide with 5AMLD. Gaming operations face extended requirements to ensure that they are trying to prevent laundered money from being placed in their operations, such as these:<\/p>\n\n\n\n