France

Plain English

ACPR and Tracfin expect the paragraph 7 financial organisations to maintain risk controls that use their risk classification and updated knowledge/risk profile of each business relationship to identify unusual sums or transactions. Detected unusual activity is to be analysed and may require enhanced examination. The paragraph supplies no universal document checklist, threshold or deadline. Its statutory foundation and current scope remain unverified.

Obligation

ACPR and Tracfin expect the paragraph 7 financial organisations to maintain risk controls that use their risk classification and updated knowledge/risk profile of each business relationship to identify unusual sums or transactions. Detected unusual activity is to be analysed and may require enhanced examination. The paragraph supplies no universal document checklist, threshold or deadline. Its statutory foundation and current scope remain unverified.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

The paragraph 7 financial organisations; monitoring/control system and analysis of detected atypical activity. The legal population, statutory basis and any sector-specific scope require current-law verification.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The risk system described in paragraph 10 should be capable of surfacing both activity needing vigilance and activity that may meet the legal conditions for a suspicious transaction report to Tracfin. “And/or” preserves the distinction: a vigilance response need not itself amount to a report, and the report trigger must be assessed under current law.

Obligation

The risk system described in paragraph 10 should be capable of surfacing both activity needing vigilance and activity that may meet the legal conditions for a suspicious transaction report to Tracfin. “And/or” preserves the distinction: a vigilance response need not itself amount to a report, and the report trigger must be assessed under current law.

Assess Report

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Paragraph 7 financial organisations; system capability for detection. Whether an individual case legally requires reporting depends on the unverified current reporting provisions.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The box says Tracfin sends information requests through ERMES and the recipient must answer by the deadline shown in the request. For flow data such as account/transaction statements, it recommends machine-processable formats where possible and says to avoid PDFs/screenshots; other documents such as contracts or photographs may be sent in various formats, including PDF/screenshots. The actual legal power, deadline and scope must be checked in current law and the request itself; no universal deadline is stated here.

Obligation

The box says Tracfin sends information requests through ERMES and the recipient must answer by the deadline shown in the request. For flow data such as account/transaction statements, it recommends machine-processable formats where possible and says to avoid PDFs/screenshots; other documents such as contracts or photographs may be sent in various formats, including PDF/screenshots. The actual legal power, deadline and scope must be checked in current law and the request itself; no universal deadline is stated here.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisation receiving a Tracfin request through ERMES. Answer by the deadline specified in that request; machine-readable format preference applies to flow-related responses where possible. Other document formats are expressly allowed.

Exceptions

No wider audience or outcome is inferred; current legal scope is unverified.

Plain English

The guidance expects the financial organisation’s risk controls to cover its full transaction activity, including transactions with occasional customers, so unusual activity can be detected and assessed for a possible Tracfin report. This does not mean every atypical transaction must be reported: the paragraph says “where appropriate,” and the actual suspicion/reporting conditions are left to the applicable law.

Obligation

The guidance expects the financial organisation’s risk controls to cover its full transaction activity, including transactions with occasional customers, so unusual activity can be detected and assessed for a possible Tracfin report. This does not mean every atypical transaction must be reported: the paragraph says “where appropriate,” and the actual suspicion/reporting conditions are left to the applicable law.

Assess Report

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; all transactions including occasional transactions. Reporting only where the legal suspicion conditions are met; those conditions and current law remain unverified.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects the paragraph 7 financial organisations to resource the risk system adequately and to give the person responsible for AML/CFT implementation enough information to understand its scope, settings and scenarios. It does not specify a headcount, budget or technical platform. This is an ACPR/Tracfin guidance expectation; the current legal force and scope of the cited regulation are unverified.

Obligation

The guidance expects the paragraph 7 financial organisations to resource the risk system adequately and to give the person responsible for AML/CFT implementation enough information to understand its scope, settings and scenarios. It does not specify a headcount, budget or technical platform. This is an ACPR/Tracfin guidance expectation; the current legal force and scope of the cited regulation are unverified.

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; sufficient human and material resources for an effective risk-management system, with the named AML/CFT-responsible person able to understand scope, configuration and scenarios.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

Before a business relationship starts, the guidance describes identifying and verifying the customer and, where applicable, the beneficial owner. It also expects collection and analysis of information on the relationship’s purpose and nature and regular updating of that information. The referenced 2 September 2009 list and separate ACPR customer-knowledge guidance are dependencies, not a universal document checklist; the current legal text and which items apply to a particular customer have not been verified.

Obligation

Before a business relationship starts, the guidance describes identifying and verifying the customer and, where applicable, the beneficial owner. It also expects collection and analysis of information on the relationship’s purpose and nature and regular updating of that information. The referenced 2 September 2009 list and separate ACPR customer-knowledge guidance are dependencies, not a universal document checklist; the current legal text and which items apply to a particular customer have not been verified.

Verify Collect information Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations in the defined scope, before a business relationship; beneficial-owner steps apply where relevant. Information items are those relevant under the cited texts/list, not a universal fixed dossier.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects the organisation to calibrate vigilance to its exposure and to build/update its risk classification using the listed legislatively identified risks, Tracfin typologies and alerts, national and sectoral risk assessments, competent authorities’ material, and cases where simplified measures are permitted. It expressly says simplified measures cannot be used for a business relationship where there is ML/TF suspicion. Adjacent Box 2 explains Tracfin AAV handling separately. Every cited statutory reference and the claimed boundary between measures requires current-law verification; the paragraph does not independently establish a 2026 legal prohibition. The citation to article L. 561-4-1 carries footnote marker 24 in the PDF; the marker is not part of the article number.

Obligation

The guidance expects the organisation to calibrate vigilance to its exposure and to build/update its risk classification using the listed legislatively identified risks, Tracfin typologies and alerts, national and sectoral risk assessments, competent authorities’ material, and cases where simplified measures are permitted. It expressly says simplified measures cannot be used for a business relationship where there is ML/TF suspicion. Adjacent Box 2 explains Tracfin AAV handling separately. Every cited statutory reference and the claimed boundary between measures requires current-law verification; the paragraph does not independently establish a 2026 legal prohibition.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; their risk classification and business relationships, with intensity linked to assessed ML/TF exposure. The explicit no-simplified-measures statement is limited to a business relationship for which suspicion exists; other statutory conditions remain unverified.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

An AAV is a targeted Tracfin alert, sent to one or more financial organisations through ERMES, identifying significant ML/TF risk connected with named people, transaction types or geography. The box says it lasts up to six months and can be renewed. The recipient is expected to tailor and strengthen its risk system and classification to the alert; examples include adjusting relevant risk criteria, reviewing affected relationship profiles and redefining information to collect. Daily/ad hoc monitoring are examples, not universal fixed controls. If a suspicious transaction resulting from an AAV is reported, include the circumstances in the report analysis. Group circulation may use the authorised group correspondent. The existence/designation is confidential except to the strictly necessary extent for implementing measures. These are statements in non-binding guidance; current CMF authority, duration, confidentiality and group rules require official-law verification.

Obligation

An AAV is a targeted Tracfin alert, sent to one or more financial organisations through ERMES, identifying significant ML/TF risk connected with named people, transaction types or geography. The box says it lasts up to six months and can be renewed. The recipient is expected to tailor and strengthen its risk system and classification to the alert; examples include adjusting relevant risk criteria, reviewing affected relationship profiles and redefining information to collect. Daily/ad hoc monitoring are examples, not universal fixed controls. If a suspicious transaction resulting from an AAV is reported, include the circumstances in the report analysis. Group circulation may use the authorised group correspondent. The existence/designation is confidential except to the strictly necessary extent for implementing measures. These are statements in non-binding guidance; current CMF authority, duration, confidentiality and group rules require official-law verification.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Only an organisation to which Tracfin sends an AAV, and the risks/relationships specified by that AAV. Measures vary with its content. Daily monitoring/ad hoc controls are examples. Group circulation is conditional on the stated group/correspondent arrangement. Disclosure is limited as the guidance describes, subject to current-law verification.

Exceptions

No wider audience or outcome is inferred; current legal scope is unverified.

Plain English

For each business relationship, the guidance expects a risk profile informed by the organisation’s overall risk classification, what it knows about that relationship, and the nature and risks of planned transactions. The profile is used to tailor vigilance; no score, formula or fixed risk tier is prescribed here.

Obligation

For each business relationship, the guidance expects a risk profile informed by the organisation’s overall risk classification, what it knows about that relationship, and the nature and risks of planned transactions. The profile is used to tailor vigilance; no score, formula or fixed risk tier is prescribed here.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations and each business relationship; profile informs tailored vigilance. No one-size-fits-all scoring method is stated.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The organisation builds an individual risk profile for each business relationship from relevant characteristics. It gathers relevant information about the relationship and, where applicable, the beneficial owner, from the customer and also from third parties. It identifies reliable sources, including media, information published by authorities or communicated through an AAV, and third-party databases that may supplement or confirm its customer knowledge. These examples are not a universal document checklist; the cited provisions and current evidential standard remain unverified.

Obligation

The organisation builds an individual risk profile for each business relationship from relevant characteristics. It gathers relevant information about the relationship and, where applicable, the beneficial owner, from the customer and also from third parties. It identifies reliable sources, including media, information published by authorities or communicated through an AAV, and third-party databases that may supplement or confirm its customer knowledge. These examples are not a universal document checklist; the cited provisions and current evidential standard remain unverified.

Collect information Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

For the financial organisations described by paragraph 7, for an individual business relationship and, where applicable, its beneficial owner. Relevant information may be gathered from the customer and third parties; reliable sources may supplement or confirm customer knowledge. The source examples do not prescribe a universal document packet.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

When assessing the relationship’s risk, the guidance expects organisations to consider both the origin/destination jurisdictions of funds and the products, services and distribution channels used. It names FATF and EU risk-country materials, the tax non-cooperative-country list, sanctions-related lists and announcements, Tracfin typologies and national/sectoral assessments. These are risk inputs, not a rule that every listed jurisdiction makes every relationship prohibited or high risk. Use current lists and law; this paragraph does not verify them.

Obligation

When assessing the relationship’s risk, the guidance expects organisations to consider both the origin/destination jurisdictions of funds and the products, services and distribution channels used. It names FATF and EU risk-country materials, the tax non-cooperative-country list, sanctions-related lists and announcements, Tracfin typologies and national/sectoral assessments. These are risk inputs, not a rule that every listed jurisdiction makes every relationship prohibited or high risk. Use current lists and law; this paragraph does not verify them.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; risk assessment of business relationships/transactions. Consider relevant current jurisdictional, product, service and channel risks; no automatic prohibition or uniform risk rating is stated.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects the relationship risk profile to change as relevant facts change and to be refreshed with frequency and depth proportionate to risk. An enhanced examination or report may also prompt an update; the direction depends on the analysis—up if suspicion is substantiated, down if the earlier risk assessment was inadequate. Filing a report does not automatically dictate a particular rating.

Obligation

The guidance expects the relationship risk profile to change as relevant facts change and to be refreshed with frequency and depth proportionate to risk. An enhanced examination or report may also prompt an update; the direction depends on the analysis—up if suspicion is substantiated, down if the earlier risk assessment was inadequate. Filing a report does not automatically dictate a particular rating.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; ongoing business relationships. Update cadence/intensity is risk-based; events listed are possible reassessment points, not fixed calendar deadlines.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects the organisation to retain relationship information in a form that lets it see the relationship as a whole, rather than as disconnected fragments. This paragraph does not set a retention period or prescribe a particular repository. The legal basis, duration and data-protection limits are not established by this guidance excerpt and remain dependencies.

Obligation

The guidance expects the organisation to retain relationship information in a form that lets it see the relationship as a whole, rather than as disconnected fragments. This paragraph does not set a retention period or prescribe a particular repository. The legal basis, duration and data-protection limits are not established by this guidance excerpt and remain dependencies.

Retain records

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; retention/organisation of the relationship information referred to above, to support a complete consolidated view. No retention duration is stated.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects a suitable system and internal procedures that can detect activity linked to the named high-risk jurisdictions and other atypical transactions that may require enhanced examination or meet report conditions. Alert handling and a documented analysis are part of the described system. The cited statutory criteria and current lists must be checked; this paragraph does not mean every transaction involving a listed jurisdiction automatically triggers a report.

Obligation

The guidance expects a suitable system and internal procedures that can detect activity linked to the named high-risk jurisdictions and other atypical transactions that may require enhanced examination or meet report conditions. Alert handling and a documented analysis are part of the described system. The cited statutory criteria and current lists must be checked; this paragraph does not mean every transaction involving a listed jurisdiction automatically triggers a report.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; all relevant transaction monitoring, with jurisdiction-linked and other atypical activity as detection targets. Enhanced examination/reporting only where the applicable legal conditions are met.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects the organisation’s system to cover its full customer, product and transaction population, including one-off/occasional activity. “All” is bounded by the paragraph 7 financial-organisation scope and the relevant activity; it is not an instruction to collect the same information from every customer.

Obligation

The guidance expects the organisation’s system to cover its full customer, product and transaction population, including one-off/occasional activity. “All” is bounded by the paragraph 7 financial-organisation scope and the relevant activity; it is not an instruction to collect the same information from every customer.

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; system coverage includes all customers, products and transactions in the organisation’s relevant activity, including occasional transactions.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The paragraph expects the risk system to use the organisation’s own risk classification and customer knowledge and to be refreshed for newly identified ML/TF patterns. Annex 1 is described as examples of measures linked to typologies; it is not a universal checklist. The adjacent Box 3 is separate contextual material about suspected document fraud, including when to reconsider the profile and consider a report.

Obligation

The paragraph expects the risk system to use the organisation’s own risk classification and customer knowledge and to be refreshed for newly identified ML/TF patterns. Annex 1 is described as examples of measures linked to typologies; it is not a universal checklist. The adjacent Box 3 is separate contextual material about suspected document fraud, including when to reconsider the profile and consider a report.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; risk system and typology updates. Annex 1 examples are contextual aids, not automatic required controls or a standard document list.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects relevant staff, especially customer-facing staff, to participate in identifying unusual activity. Where agents or outsourced distributors act under the organisation’s responsibility, the organisation should give them instructions sufficient for detection and use internal controls to check that they follow them. The named examples illustrate distribution roles; the scope depends on the actual responsibility/outsourcing arrangement, not every third party automatically.

Obligation

The guidance expects relevant staff, especially customer-facing staff, to participate in identifying unusual activity. Where agents or outsourced distributors act under the organisation’s responsibility, the organisation should give them instructions sufficient for detection and use internal controls to check that they follow them. The named examples illustrate distribution roles; the scope depends on the actual responsibility/outsourcing arrangement, not every third party automatically.

Train staff

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations and relevant personnel; agents/distributors only where used under the organisation’s responsibility in the described distribution or outsourcing role.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance expects regular AML/CFT information and training for all persons acting under the financial organisation’s responsibility. It gives no prescribed interval, curriculum or training format. The source’s second sentence is a fragment-like statement that training is a key element; it is retained rather than turned into a separate legal requirement. Box 4 separately discusses the guidance’s BaaS example.

Obligation

The guidance expects regular AML/CFT information and training for all persons acting under the financial organisation’s responsibility. It gives no prescribed interval, curriculum or training format. The source’s second sentence is a fragment-like statement that training is a key element; it is retained rather than turned into a separate legal requirement. Box 4 separately discusses the guidance’s BaaS example.

Train staff

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Defined financial organisations; all persons acting under their responsibility. “Regular” is not quantified here; frequency and content require risk/context assessment and current-law verification.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The box addresses a specific BaaS arrangement: an authorised financial organisation supplies white-label products marketed by an agent. The guidance emphasises that the organisation remains responsible for the AML/CFT implementation it describes and expects it to maintain operational control, assess and mitigate the model’s risks, design adequate controls before launch and include agent activity in internal control. Real-time data/control gaps are identified as risk drivers. This is supervisory guidance, not a standalone current statutory allocation of liability; current legal scope and outsourcing/agent rules must be checked.

Obligation

The box addresses a specific BaaS arrangement: an authorised financial organisation supplies white-label products marketed by an agent. The guidance emphasises that the organisation remains responsible for the AML/CFT implementation it describes and expects it to maintain operational control, assess and mitigate the model’s risks, design adequate controls before launch and include agent activity in internal control. Real-time data/control gaps are identified as risk drivers. This is supervisory guidance, not a standalone current statutory allocation of liability; current legal scope and outsourcing/agent rules must be checked.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Only the described white-label BaaS/agent model. The organisation’s controls should reflect the actual agent products, data access and operational arrangement; no conclusion is asserted for unrelated outsourcing or distribution models.

Exceptions

No wider audience or outcome is inferred; current legal scope is unverified.

Plain English

The guidance expressly says software-based detection is not universally required. Depending on the organisation’s structure, size and activities, automated controls may nevertheless be necessary. If used, the guidance expects defined ownership/governance (including configuration oversight) and full integration into internal control. This is conditional guidance, not a rule that every firm must buy or deploy an automated tool.

Obligation

The guidance expressly says software-based detection is not universally required. Depending on the organisation’s structure, size and activities, automated controls may nevertheless be necessary. If used, the guidance expects defined ownership/governance (including configuration oversight) and full integration into internal control. This is conditional guidance, not a rule that every firm must buy or deploy an automated tool.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations within paragraph 7’s guidance scope. Automated detection is conditional on organisation, size and activity making it necessary; governance/internal-control expectations apply where such a system is used.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

Where several systems are used, the guidance expects them to work together where feasible. Regardless of whether interoperability is achievable, the organisation should be able to see the business relationship as a whole at both entity and group levels. The paragraph does not prescribe a particular software architecture. Its legal foundation and the relevant group scope remain unverified.

Obligation

Where several systems are used, the guidance expects them to work together where feasible. Regardless of whether interoperability is achievable, the organisation should be able to see the business relationship as a whole at both entity and group levels. The paragraph does not prescribe a particular software architecture. Its legal foundation and the relevant group scope remain unverified.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations whose arrangements involve multiple IT tools; interoperability is qualified by “as far as possible”, while the overall relationship view is stated in any event and at entity/group level.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

The guidance says internal procedures should document who does what in implementing the automated detection system and the responsible staff’s level in the hierarchy. This paragraph depends on the cited 2021 order and on use of an automated system; it does not set a required organisational chart or staffing model.

Obligation

The guidance says internal procedures should document who does what in implementing the automated detection system and the responsible staff’s level in the hierarchy. This paragraph depends on the cited 2021 order and on use of an automated system; it does not set a required organisational chart or staffing model.

Retain records

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations operating the described automated detection system; procedures identify respective roles/functions and hierarchy of staff responsible for implementation.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

Procedures should also identify which governance bodies oversee the automated system, their responsibilities and remit, how they work, and how decisions such as tool or parameter changes are made. The example is illustrative; no named committee structure is prescribed.

Obligation

Procedures should also identify which governance bodies oversee the automated system, their responsibilities and remit, how they work, and how decisions such as tool or parameter changes are made. The example is illustrative; no named committee structure is prescribed.

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations using the automated system; applies to the procedures governing that system. No particular committee or cadence is specified.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

A group-wide tool is not enough merely because it is shared: the local financial organisation should be able to adapt its functions and settings to its own needs. If the group tool cannot address its specific needs and risks, it should have enough autonomy to use another suitable tool. This concerns group-shared tools and does not require every organisation to operate multiple systems.

Obligation

A group-wide tool is not enough merely because it is shared: the local financial organisation should be able to adapt its functions and settings to its own needs. If the group tool cannot address its specific needs and risks, it should have enough autonomy to use another suitable tool. This concerns group-shared tools and does not require every organisation to operate multiple systems.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations using common group tools. Adaptability is required for that arrangement; alternative tools are contemplated only where the group system does not meet the organisation’s needs/specificities.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.

Plain English

If the detection arrangement is outsourced or located abroad, the guidance expects the organisation to assess resulting barriers and risks. Its examples are language, understanding of the domestic risk environment, and knowledge of domestic regulatory specifics. They are examples, not a closed checklist or a prohibition on outsourcing.

Obligation

If the detection arrangement is outsourced or located abroad, the guidance expects the organisation to assess resulting barriers and risks. Its examples are language, understanding of the domestic risk environment, and knowledge of domestic regulatory specifics. They are examples, not a closed checklist or a prohibition on outsourcing.

Assess

Applies to

Firm types

Financial institution

Business lines

Not recorded

Customer types

Not recorded

Stages

Not recorded

Conditions

Financial organisations that outsource or locate the relevant arrangement abroad; assess risks created by that arrangement, including but not limited to the listed examples.

Exceptions

No broader audience or exception is inferred beyond the original paragraph. Current legal scope is not verified.